From 215ea62c6a7e432cc92db0648c5b26285c6c72c0 Mon Sep 17 00:00:00 2001
From: JerryShih <hshih@mozilla.com>
Date: Sat, 24 Sep 2016 01:40:00 +0200
Subject: [PATCH 001/102] Bug 1160157 - skip content painting when the device
 is in device-reset/remove status. r=dvander

---
 gfx/layers/client/ClientLayerManager.cpp | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/gfx/layers/client/ClientLayerManager.cpp b/gfx/layers/client/ClientLayerManager.cpp
index f7a875067fb3..74dfbf81cc30 100644
--- a/gfx/layers/client/ClientLayerManager.cpp
+++ b/gfx/layers/client/ClientLayerManager.cpp
@@ -304,12 +304,17 @@ ClientLayerManager::EndTransactionInternal(DrawPaintedLayerCallback aCallback,
 
   GetRoot()->ComputeEffectiveTransforms(Matrix4x4());
 
-  if (gfxPrefs::AlwaysPaint() && XRE_IsContentProcess()) {
-    TimeStamp start = TimeStamp::Now();
-    root->RenderLayer();
-    mLastPaintTime = TimeStamp::Now() - start;
+  // Skip the painting if the device is in device-reset status.
+  if (!gfxPlatform::GetPlatform()->DidRenderingDeviceReset()) {
+    if (gfxPrefs::AlwaysPaint() && XRE_IsContentProcess()) {
+      TimeStamp start = TimeStamp::Now();
+      root->RenderLayer();
+      mLastPaintTime = TimeStamp::Now() - start;
+    } else {
+      root->RenderLayer();
+    }
   } else {
-    root->RenderLayer();
+    gfxCriticalNote << "LayerManager::EndTransaction skip RenderLayer().";
   }
 
   if (!mRepeatTransaction && !GetRoot()->GetInvalidRegion().IsEmpty()) {
@@ -626,8 +631,12 @@ ClientLayerManager::ForwardTransaction(bool aScheduleComposite)
 {
   TimeStamp start = TimeStamp::Now();
 
-  if (mForwarder->GetSyncObject()) {
-    mForwarder->GetSyncObject()->FinalizeFrame();
+  // Skip the synchronization for buffer since we also skip the painting during
+  // device-reset status.
+  if (!gfxPlatform::GetPlatform()->DidRenderingDeviceReset()) {
+    if (mForwarder->GetSyncObject()) {
+      mForwarder->GetSyncObject()->FinalizeFrame();
+    }
   }
 
   mPhase = PHASE_FORWARD;

From 6781bead2d51bcc967fd2ec60ac4069b3760c24f Mon Sep 17 00:00:00 2001
From: JerryShih <hshih@mozilla.com>
Date: Sat, 24 Sep 2016 01:40:00 +0200
Subject: [PATCH 002/102] Bug 1160157 - remove the painting aborting for
 ClientPaintedLayer in device-remove/reset status. r=dvander

Since we already have the device-remove checking in ClientLayerManager, this checking is redundant.
---
 gfx/layers/client/ClientPaintedLayer.cpp | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/gfx/layers/client/ClientPaintedLayer.cpp b/gfx/layers/client/ClientPaintedLayer.cpp
index 70a568eefb79..871f10559b50 100644
--- a/gfx/layers/client/ClientPaintedLayer.cpp
+++ b/gfx/layers/client/ClientPaintedLayer.cpp
@@ -24,10 +24,6 @@
 #include "gfx2DGlue.h"
 #include "ReadbackProcessor.h"
 
-#ifdef XP_WIN
-#include "gfxWindowsPlatform.h"
-#endif
-
 namespace mozilla {
 namespace layers {
 
@@ -36,13 +32,6 @@ using namespace mozilla::gfx;
 void
 ClientPaintedLayer::PaintThebes()
 {
-#ifdef XP_WIN
-  if (gfxWindowsPlatform::GetPlatform()->DidRenderingDeviceReset()) {
-    // If our rendering device has reset simply avoid rendering completely.
-    return;
-  }
-#endif
-
   PROFILER_LABEL("ClientPaintedLayer", "PaintThebes",
     js::ProfileEntry::Category::GRAPHICS);
 

From ab9e34053dd5e02db8f9873bed70862cc2bec987 Mon Sep 17 00:00:00 2001
From: Tracy Walker <twalker@mozilla.com>
Date: Mon, 26 Sep 2016 08:13:38 -0500
Subject: [PATCH 003/102] Bug 1279087 - In caps/tests/mochitests/bug995943.xul,
 widen range of assertion check for OSX 10.10 to 5-9 to reduce intermittent
 test timeouts. r=emk

---
 caps/tests/mochitest/test_bug995943.xul | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/caps/tests/mochitest/test_bug995943.xul b/caps/tests/mochitest/test_bug995943.xul
index da2c1ae6e89d..3d3f06bd97b2 100644
--- a/caps/tests/mochitest/test_bug995943.xul
+++ b/caps/tests/mochitest/test_bug995943.xul
@@ -27,7 +27,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=995943
   SimpleTest.waitForExplicitFinish();
   SimpleTest.requestCompleteLog();
   if (navigator.userAgent.indexOf("Mac OS X 10.10") != -1)
-    SimpleTest.expectAssertions(6, 9); // See bug 1067022
+    SimpleTest.expectAssertions(5, 9); // See bug 1067022
   else if (Services.appinfo.OS == "WINNT")
     SimpleTest.expectAssertions(0, 1); // See bug 1067022
 

From c0462c28b658370d8e9d5b91839b93d2c610b159 Mon Sep 17 00:00:00 2001
From: Jan Varga <jvarga@mozilla.com>
Date: Wed, 24 Aug 2016 13:40:25 +0800
Subject: [PATCH 004/102] Bug 1290853 - Iterate the blocked transactions in the
 first-come, first-served order. r=btseng

---
 dom/indexedDB/ActorsParent.cpp                | 87 +++++++++++++------
 .../transaction-lifetime-empty.html.ini       |  3 -
 2 files changed, 61 insertions(+), 29 deletions(-)
 delete mode 100644 testing/web-platform/meta/IndexedDB/transaction-lifetime-empty.html.ini

diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
index ed0b660e28f0..8ed1dd4c454f 100644
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@@ -5314,7 +5314,7 @@ private:
   struct IdleThreadInfo;
   struct ThreadInfo;
   class ThreadRunnable;
-  struct TransactionInfo;
+  class TransactionInfo;
   struct TransactionInfoPair;
 
   // This mutex guards mDatabases, see below.
@@ -5713,10 +5713,14 @@ private:
   NS_DECL_NSIRUNNABLE
 };
 
-struct ConnectionPool::TransactionInfo final
+class ConnectionPool::TransactionInfo final
 {
   friend class nsAutoPtr<TransactionInfo>;
 
+  nsTHashtable<nsPtrHashKey<TransactionInfo>> mBlocking;
+  nsTArray<TransactionInfo*> mBlockingOrdered;
+
+public:
   DatabaseInfo* mDatabaseInfo;
   const nsID mBackgroundChildLoggingId;
   const nsCString mDatabaseId;
@@ -5724,7 +5728,6 @@ struct ConnectionPool::TransactionInfo final
   const int64_t mLoggingSerialNumber;
   const nsTArray<nsString> mObjectStoreNames;
   nsTHashtable<nsPtrHashKey<TransactionInfo>> mBlockedOn;
-  nsTHashtable<nsPtrHashKey<TransactionInfo>> mBlocking;
   nsTArray<nsCOMPtr<nsIRunnable>> mQueuedRunnables;
   const bool mIsWriteTransaction;
   bool mRunning;
@@ -5743,10 +5746,16 @@ struct ConnectionPool::TransactionInfo final
                   TransactionDatabaseOperationBase* aTransactionOp);
 
   void
-  Schedule();
+  AddBlockingTransaction(TransactionInfo* aTransactionInfo);
+
+  void
+  RemoveBlockingTransactions();
 
 private:
   ~TransactionInfo();
+
+  void
+  MaybeUnblock(TransactionInfo* aTransactionInfo);
 };
 
 struct ConnectionPool::TransactionInfoPair final
@@ -11745,7 +11754,7 @@ ConnectionPool::Start(const nsID& aBackgroundChildLoggingId,
     // Mark what we are blocking on.
     if (TransactionInfo* blockingRead = blockInfo->mLastBlockingReads) {
       transactionInfo->mBlockedOn.PutEntry(blockingRead);
-      blockingRead->mBlocking.PutEntry(transactionInfo);
+      blockingRead->AddBlockingTransaction(transactionInfo);
     }
 
     if (aIsWriteTransaction) {
@@ -11756,7 +11765,7 @@ ConnectionPool::Start(const nsID& aBackgroundChildLoggingId,
           MOZ_ASSERT(blockingWrite);
 
           transactionInfo->mBlockedOn.PutEntry(blockingWrite);
-          blockingWrite->mBlocking.PutEntry(transactionInfo);
+          blockingWrite->AddBlockingTransaction(transactionInfo);
         }
       }
 
@@ -12288,18 +12297,7 @@ ConnectionPool::NoteFinishedTransaction(uint64_t aTransactionId)
     blockInfo->mLastBlockingWrites.RemoveElement(transactionInfo);
   }
 
-  for (auto iter = transactionInfo->mBlocking.Iter();
-       !iter.Done();
-       iter.Next()) {
-    TransactionInfo* blockedInfo = iter.Get()->GetKey();
-    MOZ_ASSERT(blockedInfo);
-    MOZ_ASSERT(blockedInfo->mBlockedOn.Contains(transactionInfo));
-
-    blockedInfo->mBlockedOn.RemoveEntry(transactionInfo);
-    if (!blockedInfo->mBlockedOn.Count()) {
-      blockedInfo->Schedule();
-    }
-  }
+  transactionInfo->RemoveBlockingTransactions();
 
   if (transactionInfo->mIsWriteTransaction) {
     MOZ_ASSERT(dbInfo->mWriteTransactionCount);
@@ -13101,18 +13099,55 @@ TransactionInfo::~TransactionInfo()
 
 void
 ConnectionPool::
-TransactionInfo::Schedule()
+TransactionInfo::AddBlockingTransaction(TransactionInfo* aTransactionInfo)
 {
   AssertIsOnBackgroundThread();
-  MOZ_ASSERT(mDatabaseInfo);
+  MOZ_ASSERT(aTransactionInfo);
 
-  ConnectionPool* connectionPool = mDatabaseInfo->mConnectionPool;
-  MOZ_ASSERT(connectionPool);
-  connectionPool->AssertIsOnOwningThread();
+  if (!mBlocking.Contains(aTransactionInfo)) {
+    mBlocking.PutEntry(aTransactionInfo);
+    mBlockingOrdered.AppendElement(aTransactionInfo);
+  }
+}
 
-  Unused <<
-    connectionPool->ScheduleTransaction(this,
-                                        /* aFromQueuedTransactions */ false);
+void
+ConnectionPool::
+TransactionInfo::RemoveBlockingTransactions()
+{
+  AssertIsOnBackgroundThread();
+
+  for (uint32_t index = 0, count = mBlockingOrdered.Length();
+       index < count;
+       index++) {
+    TransactionInfo* blockedInfo = mBlockingOrdered[index];
+    MOZ_ASSERT(blockedInfo);
+
+    blockedInfo->MaybeUnblock(this);
+  }
+
+  mBlocking.Clear();
+  mBlockingOrdered.Clear();
+}
+
+void
+ConnectionPool::
+TransactionInfo::MaybeUnblock(TransactionInfo* aTransactionInfo)
+{
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(mBlockedOn.Contains(aTransactionInfo));
+
+  mBlockedOn.RemoveEntry(aTransactionInfo);
+  if (!mBlockedOn.Count()) {
+    MOZ_ASSERT(mDatabaseInfo);
+
+    ConnectionPool* connectionPool = mDatabaseInfo->mConnectionPool;
+    MOZ_ASSERT(connectionPool);
+    connectionPool->AssertIsOnOwningThread();
+
+    Unused <<
+      connectionPool->ScheduleTransaction(this,
+                                          /* aFromQueuedTransactions */ false);
+  }
 }
 
 ConnectionPool::
diff --git a/testing/web-platform/meta/IndexedDB/transaction-lifetime-empty.html.ini b/testing/web-platform/meta/IndexedDB/transaction-lifetime-empty.html.ini
deleted file mode 100644
index 0381b82582a2..000000000000
--- a/testing/web-platform/meta/IndexedDB/transaction-lifetime-empty.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[transaction-lifetime-empty.html]
-  type: testharness
-  disabled: https://bugzilla.mozilla.org/show_bug.cgi?id=1290853

From 04e71c59d277783b4d4d136ea9c4c884c9540728 Mon Sep 17 00:00:00 2001
From: m-r-m-s <litewrite@gmail.com>
Date: Tue, 27 Sep 2016 08:11:47 +0200
Subject: [PATCH 005/102] Bug 1293704 - added adoptee/MS. r=ehsan

---
 extensions/spellcheck/locales/en-US/hunspell/en-US.dic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index 74392b6e32fc..0b006936b130 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -1,4 +1,4 @@
-52342
+52343
 0/nm
 0th/pt
 1/n1
@@ -13747,6 +13747,7 @@ adolescence/SM
 adolescent/SM
 adopt/AGVDS
 adoptable
+adoptee/MS
 adopter/MS
 adoption/SM
 adorableness/M

From 8026a8d792fcfec626d18a0c1f32633e71a9ee83 Mon Sep 17 00:00:00 2001
From: Tom Tung <ttung@mozilla.com>
Date: Mon, 26 Sep 2016 09:54:10 +0800
Subject: [PATCH 006/102] Bug 1301966 - Prevent serviceWorker to modify
 response for sharedWorker and remove the second unexpected registration for
 the serviceWorker test. r=bkelly.

---
 .../test/serviceworkers/create_another_sharedWorker.html | 2 +-
 dom/workers/test/serviceworkers/fetch.js                 | 6 ++----
 dom/workers/test/serviceworkers/hello.html               | 9 +++++++++
 dom/workers/test/serviceworkers/mochitest.ini            | 2 +-
 dom/workers/test/serviceworkers/sharedWorker_fetch.js    | 2 --
 .../test/serviceworkers/test_fetch_integrity.html        | 2 +-
 6 files changed, 14 insertions(+), 9 deletions(-)
 create mode 100644 dom/workers/test/serviceworkers/hello.html

diff --git a/dom/workers/test/serviceworkers/create_another_sharedWorker.html b/dom/workers/test/serviceworkers/create_another_sharedWorker.html
index a63f3c59a412..f49194fa5049 100644
--- a/dom/workers/test/serviceworkers/create_another_sharedWorker.html
+++ b/dom/workers/test/serviceworkers/create_another_sharedWorker.html
@@ -3,4 +3,4 @@
 <pre id=log>Hello World</pre>
 <script>
   var worker = new SharedWorker('sharedWorker_fetch.js');
-</script>
\ No newline at end of file
+</script>
diff --git a/dom/workers/test/serviceworkers/fetch.js b/dom/workers/test/serviceworkers/fetch.js
index 1fa24f81a4e6..38d20a638997 100644
--- a/dom/workers/test/serviceworkers/fetch.js
+++ b/dom/workers/test/serviceworkers/fetch.js
@@ -1,10 +1,8 @@
 addEventListener('fetch', function(event) {
   if (event.request.url.indexOf("fail.html") !== -1) {
-    event.respondWith(fetch("serviceworker.html", {"integrity": "abc"}));
+    event.respondWith(fetch("hello.html", {"integrity": "abc"}));
   } else if (event.request.url.indexOf("fake.html") !== -1) {
-    event.respondWith(fetch("serviceworker.html"));
-  } else {
-    event.respondWith(new Response("Hello world"));
+    event.respondWith(fetch("hello.html"));
   }
 });
 
diff --git a/dom/workers/test/serviceworkers/hello.html b/dom/workers/test/serviceworkers/hello.html
new file mode 100644
index 000000000000..97eb03c9025c
--- /dev/null
+++ b/dom/workers/test/serviceworkers/hello.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+  </head>
+  <body>
+    Hello.
+  </body>
+<html>
diff --git a/dom/workers/test/serviceworkers/mochitest.ini b/dom/workers/test/serviceworkers/mochitest.ini
index 14dcf9648977..df2949db00d6 100644
--- a/dom/workers/test/serviceworkers/mochitest.ini
+++ b/dom/workers/test/serviceworkers/mochitest.ini
@@ -210,7 +210,7 @@ support-files =
   sw_bad_mime_type.js^headers^
   error_reporting_helpers.js
   fetch.js
-  serviceworker.html
+  hello.html
   create_another_sharedWorker.html
   sharedWorker_fetch.js
 
diff --git a/dom/workers/test/serviceworkers/sharedWorker_fetch.js b/dom/workers/test/serviceworkers/sharedWorker_fetch.js
index 8475498b4b2b..4970a1fd2fcf 100644
--- a/dom/workers/test/serviceworkers/sharedWorker_fetch.js
+++ b/dom/workers/test/serviceworkers/sharedWorker_fetch.js
@@ -27,5 +27,3 @@ onconnect = function(e) {
     }
   }
 }
-
-
diff --git a/dom/workers/test/serviceworkers/test_fetch_integrity.html b/dom/workers/test/serviceworkers/test_fetch_integrity.html
index 6b4ad6d0c7c9..50eb05581a8a 100644
--- a/dom/workers/test/serviceworkers/test_fetch_integrity.html
+++ b/dom/workers/test/serviceworkers/test_fetch_integrity.html
@@ -175,4 +175,4 @@ add_task(function* test_integrity_sharedWorker() {
 
 </script>
 </body>
-</html>
\ No newline at end of file
+</html>

From 626dd129aacb9bb461b49e6fc1c829a67a8b4217 Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Mon, 12 Sep 2016 15:38:43 -0700
Subject: [PATCH 007/102] Bug 1302261 - Refresh Spec For Deleted Indexes.
 r=janv

---
 dom/indexedDB/IDBObjectStore.cpp              | 29 ++++---
 dom/indexedDB/IDBObjectStore.h                |  1 +
 dom/indexedDB/IDBTransaction.cpp              |  6 ++
 dom/indexedDB/test/mochitest.ini              |  6 ++
 .../test/test_abort_deleted_index.html        | 19 +++++
 .../test/test_abort_deleted_objectStore.html  | 19 +++++
 .../test/unit/test_abort_deleted_index.js     | 78 +++++++++++++++++++
 .../unit/test_abort_deleted_objectStore.js    | 74 ++++++++++++++++++
 dom/indexedDB/test/unit/xpcshell-shared.ini   |  2 +
 9 files changed, 223 insertions(+), 11 deletions(-)
 create mode 100644 dom/indexedDB/test/test_abort_deleted_index.html
 create mode 100644 dom/indexedDB/test/test_abort_deleted_objectStore.html
 create mode 100644 dom/indexedDB/test/unit/test_abort_deleted_index.js
 create mode 100644 dom/indexedDB/test/unit/test_abort_deleted_objectStore.js

diff --git a/dom/indexedDB/IDBObjectStore.cpp b/dom/indexedDB/IDBObjectStore.cpp
index 9cbf3d787fcc..20e3920eb399 100644
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -1554,7 +1554,8 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(IDBObjectStore)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTransaction)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mIndexes);
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mIndexes)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDeletedIndexes)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IDBObjectStore)
@@ -1562,7 +1563,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IDBObjectStore)
 
   // Don't unlink mTransaction!
 
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mIndexes);
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mIndexes)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDeletedIndexes)
 
   tmp->mCachedKeyPath.setUndefined();
 
@@ -1774,13 +1776,11 @@ IDBObjectStore::CreateIndex(const nsAString& aName,
   }
 
   IDBTransaction* transaction = IDBTransaction::GetCurrent();
-  if (!transaction || transaction != mTransaction) {
+  if (!transaction || transaction != mTransaction || !transaction->IsOpen()) {
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_TRANSACTION_INACTIVE_ERR);
     return nullptr;
   }
 
-  MOZ_ASSERT(transaction->IsOpen());
-
   auto& indexes = const_cast<nsTArray<IndexMetadata>&>(mSpec->indexes());
   for (uint32_t count = indexes.Length(), index = 0;
        index < count;
@@ -1888,13 +1888,11 @@ IDBObjectStore::DeleteIndex(const nsAString& aName, ErrorResult& aRv)
   }
 
   IDBTransaction* transaction = IDBTransaction::GetCurrent();
-  if (!transaction || transaction != mTransaction) {
+  if (!transaction || transaction != mTransaction || !transaction->IsOpen()) {
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_TRANSACTION_INACTIVE_ERR);
     return;
   }
 
-  MOZ_ASSERT(transaction->IsOpen());
-
   auto& metadataArray = const_cast<nsTArray<IndexMetadata>&>(mSpec->indexes());
 
   int64_t foundId = 0;
@@ -1916,6 +1914,11 @@ IDBObjectStore::DeleteIndex(const nsAString& aName, ErrorResult& aRv)
 
         if (index->Id() == foundId) {
           index->NoteDeletion();
+
+          RefPtr<IDBIndex>* deletedIndex =
+            mDeletedIndexes.AppendElement();
+          deletedIndex->swap(mIndexes[indexIndex]);
+
           mIndexes.RemoveElementAt(indexIndex);
           break;
         }
@@ -2130,6 +2133,12 @@ IDBObjectStore::RefreshSpec(bool aMayDelete)
         mIndexes[idxIndex]->RefreshMetadata(aMayDelete);
       }
 
+      for (uint32_t idxCount = mDeletedIndexes.Length(), idxIndex = 0;
+           idxIndex < idxCount;
+           idxIndex++) {
+        mDeletedIndexes[idxIndex]->RefreshMetadata(false);
+      }
+
       found = true;
       break;
     }
@@ -2202,13 +2211,11 @@ IDBObjectStore::SetName(const nsAString& aName, ErrorResult& aRv)
   }
 
   IDBTransaction* transaction = IDBTransaction::GetCurrent();
-  if (!transaction || transaction != mTransaction) {
+  if (!transaction || transaction != mTransaction || !transaction->IsOpen()) {
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_TRANSACTION_INACTIVE_ERR);
     return;
   }
 
-  MOZ_ASSERT(transaction->IsOpen());
-
   if (aName == mSpec->metadata().name()) {
     return;
   }
diff --git a/dom/indexedDB/IDBObjectStore.h b/dom/indexedDB/IDBObjectStore.h
index 31bcfbd726c0..7a255a4afc62 100644
--- a/dom/indexedDB/IDBObjectStore.h
+++ b/dom/indexedDB/IDBObjectStore.h
@@ -67,6 +67,7 @@ class IDBObjectStore final
   nsAutoPtr<ObjectStoreSpec> mDeletedSpec;
 
   nsTArray<RefPtr<IDBIndex>> mIndexes;
+  nsTArray<RefPtr<IDBIndex>> mDeletedIndexes;
 
   const int64_t mId;
   bool mRooted;
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index 6f1e61c74691..e0a30b56cb2a 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -653,6 +653,12 @@ IDBTransaction::AbortInternal(nsresult aAbortCode,
       mDatabase->RevertToPreviousState();
     }
 
+    // We do the reversion only for the mObjectStores/mDeletedObjectStores but
+    // not for the mIndexes/mDeletedIndexes of each IDBObjectStore because it's
+    // time-consuming(O(m*n)) and mIndexes/mDeletedIndexes won't be used anymore
+    // in IDBObjectStore::(Create|Delete)Index() and IDBObjectStore::Index() in
+    // which all the executions are returned earlier by !transaction->IsOpen().
+
     const nsTArray<ObjectStoreSpec>& specArray =
       mDatabase->Spec()->objectStores();
 
diff --git a/dom/indexedDB/test/mochitest.ini b/dom/indexedDB/test/mochitest.ini
index cb80a9ac47d2..557821b56453 100644
--- a/dom/indexedDB/test/mochitest.ini
+++ b/dom/indexedDB/test/mochitest.ini
@@ -19,6 +19,8 @@ support-files =
   service_worker_client.html
   third_party_iframe1.html
   third_party_iframe2.html
+  unit/test_abort_deleted_index.js
+  unit/test_abort_deleted_objectStore.js
   unit/test_add_put.js
   unit/test_add_twice_failure.js
   unit/test_advance.js
@@ -115,6 +117,10 @@ support-files =
   webapp_clearBrowserData_appFrame.html
   webapp_clearBrowserData_browserFrame.html
 
+[test_abort_deleted_index.html]
+skip-if = (buildapp == 'b2g' && toolkit != 'gonk') # Bug 931116
+[test_abort_deleted_objectStore.html]
+skip-if = (buildapp == 'b2g' && toolkit != 'gonk') # Bug 931116
 [test_add_put.html]
 skip-if = (buildapp == 'b2g' && toolkit != 'gonk') # Bug 931116
 [test_add_twice_failure.html]
diff --git a/dom/indexedDB/test/test_abort_deleted_index.html b/dom/indexedDB/test/test_abort_deleted_index.html
new file mode 100644
index 000000000000..2c5eb6cbcb76
--- /dev/null
+++ b/dom/indexedDB/test/test_abort_deleted_index.html
@@ -0,0 +1,19 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>Indexed Database Abort Deleted Index Test</title>
+
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script type="text/javascript;version=1.7" src="unit/test_abort_deleted_index.js"></script>
+  <script type="text/javascript;version=1.7" src="helpers.js"></script>
+
+</head>
+
+<body onload="runTest();"></body>
+
+</html>
diff --git a/dom/indexedDB/test/test_abort_deleted_objectStore.html b/dom/indexedDB/test/test_abort_deleted_objectStore.html
new file mode 100644
index 000000000000..a45e52d52f8f
--- /dev/null
+++ b/dom/indexedDB/test/test_abort_deleted_objectStore.html
@@ -0,0 +1,19 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>Indexed Database Abort Deleted ObjectStore Test</title>
+
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script type="text/javascript;version=1.7" src="unit/test_abort_deleted_objectStore.js"></script>
+  <script type="text/javascript;version=1.7" src="helpers.js"></script>
+
+</head>
+
+<body onload="runTest();"></body>
+
+</html>
diff --git a/dom/indexedDB/test/unit/test_abort_deleted_index.js b/dom/indexedDB/test/unit/test_abort_deleted_index.js
new file mode 100644
index 000000000000..8bd1f6ae2cac
--- /dev/null
+++ b/dom/indexedDB/test/unit/test_abort_deleted_index.js
@@ -0,0 +1,78 @@
+/**
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+var testGenerator = testSteps();
+
+function testSteps()
+{
+  const name = this.window ? window.location.pathname : "Splendid Test";
+  const storeName = "test store";
+  const indexName_ToBeDeleted = "test index to be deleted";
+
+  info("Create index in v1.");
+  let request = indexedDB.open(name, 1);
+  request.onerror = errorHandler;
+  request.onupgradeneeded = grabEventAndContinueHandler;
+  request.onsuccess = unexpectedSuccessHandler;
+  let event = yield undefined;
+
+  let db = event.target.result;
+  let txn = event.target.transaction;
+
+  is(db.objectStoreNames.length, 0, "Correct objectStoreNames list");
+
+  let objectStore = db.createObjectStore(storeName, { keyPath: "foo" });
+  is(db.objectStoreNames.length, 1, "Correct objectStoreNames list");
+  is(db.objectStoreNames.item(0), objectStore.name, "Correct object store name");
+
+  // create index to be deleted later in v2.
+  objectStore.createIndex(indexName_ToBeDeleted, "foo");
+  ok(objectStore.index(indexName_ToBeDeleted), "Index created.");
+
+  txn.oncomplete = continueToNextStepSync;
+  yield undefined;
+  request.onsuccess = continueToNextStep;
+  yield undefined;
+  db.close();
+
+  info("Delete index in v2.");
+  request = indexedDB.open(name, 2);
+  request.onerror = errorHandler;
+  request.onupgradeneeded = grabEventAndContinueHandler;
+  request.onsuccess = unexpectedSuccessHandler;
+  event = yield undefined;
+
+  db = event.target.result;
+  txn = event.target.transaction;
+
+  objectStore = txn.objectStore(storeName);
+  let index = objectStore.index(indexName_ToBeDeleted);
+  ok(index, "index is valid.");
+  objectStore.deleteIndex(indexName_ToBeDeleted);
+
+  // Aborting the transaction.
+  request.onerror = expectedErrorHandler("AbortError");
+  txn.abort();
+  try {
+    index.get('foo');
+    ok(false, "TransactionInactiveError shall be thrown right after a deletion of an index is aborted.");
+  } catch (e) {
+    ok(e instanceof DOMException, "got a database exception");
+    is(e.name, "TransactionInactiveError", "TransactionInactiveError shall be thrown right after a deletion of an index is aborted.");
+  }
+
+  yield undefined;
+
+  try {
+    index.get('foo');
+    ok(false, "TransactionInactiveError shall be thrown after the transaction is inactive.");
+  } catch (e) {
+    ok(e instanceof DOMException, "got a database exception");
+    is(e.name, "TransactionInactiveError", "TransactionInactiveError shall be thrown after the transaction is inactive.");
+  }
+
+  finishTest();
+  yield undefined;
+}
diff --git a/dom/indexedDB/test/unit/test_abort_deleted_objectStore.js b/dom/indexedDB/test/unit/test_abort_deleted_objectStore.js
new file mode 100644
index 000000000000..98035b3dab72
--- /dev/null
+++ b/dom/indexedDB/test/unit/test_abort_deleted_objectStore.js
@@ -0,0 +1,74 @@
+/**
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+var testGenerator = testSteps();
+
+function testSteps()
+{
+  const name = this.window ? window.location.pathname : "Splendid Test";
+  const storeName_ToBeDeleted = "test store to be deleted";
+
+  info("Create objectStore in v1.");
+  let request = indexedDB.open(name, 1);
+  request.onerror = errorHandler;
+  request.onupgradeneeded = grabEventAndContinueHandler;
+  request.onsuccess = unexpectedSuccessHandler;
+  let event = yield undefined;
+
+  let db = event.target.result;
+  let txn = event.target.transaction;
+
+  is(db.objectStoreNames.length, 0, "Correct objectStoreNames list");
+
+  // create objectstore to be deleted later in v2.
+  db.createObjectStore(storeName_ToBeDeleted, { keyPath: "foo" });
+  is(db.objectStoreNames.length, 1, "Correct objectStoreNames list");
+  ok(db.objectStoreNames.contains(storeName_ToBeDeleted), "Correct name");
+
+  txn.oncomplete = continueToNextStepSync;
+  yield undefined;
+  request.onsuccess = continueToNextStep;
+  yield undefined;
+  db.close();
+
+  info("Delete objectStore in v2.");
+  request = indexedDB.open(name, 2);
+  request.onerror = errorHandler;
+  request.onupgradeneeded = grabEventAndContinueHandler;
+  request.onsuccess = unexpectedSuccessHandler;
+  event = yield undefined;
+
+  db = event.target.result;
+  txn = event.target.transaction;
+
+  let objectStore = txn.objectStore(storeName_ToBeDeleted);
+  ok(objectStore, "objectStore is available");
+
+  db.deleteObjectStore(storeName_ToBeDeleted);
+
+  // Aborting the transaction.
+  request.onerror = expectedErrorHandler("AbortError");
+  txn.abort();
+  try {
+    objectStore.get('foo');
+    ok(false, "TransactionInactiveError shall be thrown if the transaction is inactive.");
+  } catch (e) {
+    ok(e instanceof DOMException, "got a database exception");
+    is(e.name, "TransactionInactiveError", "correct error");
+  }
+
+  yield undefined;
+
+  try {
+    objectStore.get('foo');
+    ok(false, "TransactionInactiveError shall be thrown if the transaction is inactive.");
+  } catch (e) {
+    ok(e instanceof DOMException, "got a database exception");
+    is(e.name, "TransactionInactiveError", "correct error");
+  }
+
+  finishTest();
+  yield undefined;
+}
diff --git a/dom/indexedDB/test/unit/xpcshell-shared.ini b/dom/indexedDB/test/unit/xpcshell-shared.ini
index 1f02645669a2..05359097bd42 100644
--- a/dom/indexedDB/test/unit/xpcshell-shared.ini
+++ b/dom/indexedDB/test/unit/xpcshell-shared.ini
@@ -2,6 +2,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+[test_abort_deleted_index.js]
+[test_abort_deleted_objectStore.js]
 [test_add_put.js]
 [test_add_twice_failure.js]
 [test_advance.js]

From cb9811b6b4db77a450ecd2d4fe54dd188506a14b Mon Sep 17 00:00:00 2001
From: Jan Beich <jbeich@FreeBSD.org>
Date: Wed, 17 Aug 2016 04:55:36 +0000
Subject: [PATCH 008/102] Bug 1295883 - Chase Linux scroll wheel behavior on
 Tier3 desktop Unix. r=smaug

MozReview-Commit-ID: 7osYJCwDQev

--HG--
extra : transplant_source : %F8%0CL%3D%C2d%92%B8%8AYd%C5%137h%ED%81Nt%3E
---
 dom/html/HTMLInputElement.cpp | 6 +++---
 dom/html/HTMLInputElement.h   | 2 +-
 dom/html/test/mochitest.ini   | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index 6f48db718416..229013926e4d 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -3442,7 +3442,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
   return;
 }
 
-#if defined(XP_WIN) || defined(XP_LINUX)
+#if !defined(ANDROID) && !defined(XP_MACOSX)
 bool
 HTMLInputElement::IsNodeApzAwareInternal() const
 {
@@ -4538,7 +4538,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
           }
           break;
         }
-#if defined(XP_WIN) || defined(XP_LINUX)
+#if !defined(ANDROID) && !defined(XP_MACOSX)
         case eWheel: {
           // Handle wheel events as increasing / decreasing the input element's
           // value when it's focused and it's type is number or range.
@@ -6203,7 +6203,7 @@ FireEventForAccessibility(nsIDOMHTMLInputElement* aTarget,
 void
 HTMLInputElement::UpdateApzAwareFlag()
 {
-#if defined(XP_WIN) || defined(XP_LINUX)
+#if !defined(ANDROID) && !defined(XP_MACOSX)
   if ((mType == NS_FORM_INPUT_NUMBER) || (mType == NS_FORM_INPUT_RANGE)) {
     SetMayBeApzAware();
   }
diff --git a/dom/html/HTMLInputElement.h b/dom/html/HTMLInputElement.h
index 0f9dc3946ab4..bb83b304b822 100644
--- a/dom/html/HTMLInputElement.h
+++ b/dom/html/HTMLInputElement.h
@@ -135,7 +135,7 @@ public:
   virtual void Focus(ErrorResult& aError) override;
 
   // nsINode
-#if defined(XP_WIN) || defined(XP_LINUX)
+#if !defined(ANDROID) && !defined(XP_MACOSX)
   virtual bool IsNodeApzAwareInternal() const override;
 #endif
 
diff --git a/dom/html/test/mochitest.ini b/dom/html/test/mochitest.ini
index 09908c97dd5e..a1964e84b4fe 100644
--- a/dom/html/test/mochitest.ini
+++ b/dom/html/test/mochitest.ini
@@ -622,11 +622,11 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android'
 [test_bug1250401.html]
 [test_bug1260664.html]
 [test_bug1261673.html]
-skip-if = (os != 'win' && os != 'linux')
+skip-if = (os == 'android' || os == 'mac')
 [test_bug1261674-1.html]
-skip-if = (os != 'win' && os != 'linux')
+skip-if = (os == 'android' || os == 'mac')
 [test_bug1261674-2.html]
-skip-if = (os != 'win' && os != 'linux')
+skip-if = (os == 'android' || os == 'mac')
 [test_bug1260704.html]
 [test_allowMedia.html]
 [test_bug1292522_same_domain_with_different_port_number.html]

From cb9968ef9d26d7671785e15b0dafe6da455c3d64 Mon Sep 17 00:00:00 2001
From: James Cheng <jacheng@mozilla.com>
Date: Fri, 23 Sep 2016 14:33:01 +0800
Subject: [PATCH 009/102] Bug 1304258 - Part1 - Add Util Method to Create JNI
 Array Object. r=jchen

MozReview-Commit-ID: INXNelhQzuR

--HG--
extra : transplant_source : %1F%A3%E1%E3/%B7%5Em%D7%0F%CA%1Ah%B5%16U%9Bn%89U
---
 widget/android/jni/Refs.h  | 15 +++++++++++++++
 widget/android/jni/Types.h |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/widget/android/jni/Refs.h b/widget/android/jni/Refs.h
index 139494c48613..a99eea3e04b9 100644
--- a/widget/android/jni/Refs.h
+++ b/widget/android/jni/Refs.h
@@ -707,6 +707,21 @@ public:
         : Base(ctx)
     {}
 
+    static typename Base::LocalRef New(const ElementType* data, size_t length) {
+        using JNIElemType = typename detail::TypeAdapter<ElementType>::JNIType;
+        static_assert(sizeof(ElementType) == sizeof(JNIElemType),
+                      "Size of native type must match size of JNI type");
+        JNIEnv* const jenv = mozilla::jni::GetEnvForThread();
+        auto result =
+            (jenv->*detail::TypeAdapter<ElementType>::NewArray)(length);
+        MOZ_CATCH_JNI_EXCEPTION(jenv);
+        (jenv->*detail::TypeAdapter<ElementType>::SetArray)(
+                result, jsize(0), length,
+                reinterpret_cast<const JNIElemType*>(data));
+        MOZ_CATCH_JNI_EXCEPTION(jenv);
+        return Base::LocalRef::Adopt(jenv, result);
+    }
+
     size_t Length() const
     {
         const size_t ret = Base::Env()->GetArrayLength(Base::Instance());
diff --git a/widget/android/jni/Types.h b/widget/android/jni/Types.h
index 10fb5702599e..a083d3e50d08 100644
--- a/widget/android/jni/Types.h
+++ b/widget/android/jni/Types.h
@@ -107,6 +107,8 @@ template<class Cls> struct TypeAdapter<const Cls&>
         static constexpr auto Set = &JNIEnv::Set ## JNIName ## Field; \
         static constexpr auto StaticSet = &JNIEnv::SetStatic ## JNIName ## Field; \
         static constexpr auto GetArray = &JNIEnv::Get ## JNIName ## ArrayRegion; \
+        static constexpr auto SetArray = &JNIEnv::Set ## JNIName ## ArrayRegion; \
+        static constexpr auto NewArray = &JNIEnv::New ## JNIName ## Array; \
     \
         static JNIType FromNative(JNIEnv*, NativeType val) { \
             return static_cast<JNIType>(val); \

From 345dc9fc9d8871f1ce49c3518420ebf4c95d1e0f Mon Sep 17 00:00:00 2001
From: James Cheng <jacheng@mozilla.com>
Date: Fri, 23 Sep 2016 14:33:47 +0800
Subject: [PATCH 010/102] Bug 1304258 - Part2 - Use XXXArray::New instead.
 r=jchen

MozReview-Commit-ID: 2bqO7839fX2

--HG--
extra : transplant_source : Y%A7%17%04%97%06%C8%96%29%8C%1Dy%98%AD%04%DB%BA%B9%9A%C3
---
 .../android/AndroidDecoderModule.cpp          | 43 +++++--------------
 1 file changed, 11 insertions(+), 32 deletions(-)

diff --git a/dom/media/platforms/android/AndroidDecoderModule.cpp b/dom/media/platforms/android/AndroidDecoderModule.cpp
index 03bef68cbfd5..0fcbe1c91718 100644
--- a/dom/media/platforms/android/AndroidDecoderModule.cpp
+++ b/dom/media/platforms/android/AndroidDecoderModule.cpp
@@ -29,33 +29,6 @@ using namespace mozilla::gl;
 using namespace mozilla::java::sdk;
 using media::TimeUnit;
 
-namespace {
-  template<class T>
-  mozilla::jni::ByteArray::LocalRef
-  CreateAndInitJByteArray(const T& data, jsize length)
-  {
-    JNIEnv* const jenv = mozilla::jni::GetEnvForThread();
-    jbyteArray result = jenv->NewByteArray(length);
-    MOZ_CATCH_JNI_EXCEPTION(jenv);
-    jenv->SetByteArrayRegion(result, 0, length, reinterpret_cast<const jbyte*>(const_cast<T>(data)));
-    MOZ_CATCH_JNI_EXCEPTION(jenv);
-    return mozilla::jni::ByteArray::LocalRef::Adopt(jenv, result);
-  }
-
-  template<class T>
-  mozilla::jni::IntArray::LocalRef
-  CreateAndInitJIntArray(const T& data, jsize length)
-  {
-    JNIEnv* const jenv = mozilla::jni::GetEnvForThread();
-    jintArray result = jenv->NewIntArray(length);
-    MOZ_CATCH_JNI_EXCEPTION(jenv);
-    jenv->SetIntArrayRegion(result, 0, length, reinterpret_cast<const jint*>(const_cast<T>(data)));
-    MOZ_CATCH_JNI_EXCEPTION(jenv);
-    return mozilla::jni::IntArray::LocalRef::Adopt(jenv, result);
-  }
-}
-
-
 namespace mozilla {
 
 mozilla::LazyLogModule sAndroidDecoderModuleLog("AndroidDecoderModule");
@@ -125,11 +98,17 @@ GetCryptoInfoFromSample(const MediaRawData* aSample)
     tempIV.AppendElement(0);
   }
 
-  auto numBytesOfPlainData = CreateAndInitJIntArray(&plainSizes[0], plainSizes.Length());
-  auto numBytesOfEncryptedData = CreateAndInitJIntArray(&cryptoObj.mEncryptedSizes[0],
-                                                        cryptoObj.mEncryptedSizes.Length());
-  auto iv = CreateAndInitJByteArray(&tempIV[0], tempIV.Length());
-  auto keyId = CreateAndInitJByteArray(&cryptoObj.mKeyId[0], cryptoObj.mKeyId.Length());
+  auto numBytesOfPlainData = mozilla::jni::IntArray::New(
+                              reinterpret_cast<int32_t*>(&plainSizes[0]),
+                              plainSizes.Length());
+
+  auto numBytesOfEncryptedData =
+    mozilla::jni::IntArray::New(reinterpret_cast<const int32_t*>(&cryptoObj.mEncryptedSizes[0]),
+                                cryptoObj.mEncryptedSizes.Length());
+  auto iv = mozilla::jni::ByteArray::New(reinterpret_cast<int8_t*>(&tempIV[0]),
+                                        tempIV.Length());
+  auto keyId = mozilla::jni::ByteArray::New(reinterpret_cast<const int8_t*>(&cryptoObj.mKeyId[0]),
+                                            cryptoObj.mKeyId.Length());
   cryptoInfo->Set(numSubSamples,
                   numBytesOfPlainData,
                   numBytesOfEncryptedData,

From 5d3595ab735304ebc82258e0458a7de16dcbb84f Mon Sep 17 00:00:00 2001
From: Rob Thijssen <rthijssen@mozilla.com>
Date: Wed, 21 Sep 2016 17:47:44 +0100
Subject: [PATCH 011/102] Bug 1304354 - disambiguate Windows build platform in
 treeherder; r=dustin

MozReview-Commit-ID: 7RV9IDFDDoH

--HG--
extra : transplant_source : %F7Am%1E%C9%EC%EE%C8h%B3%C6%ED%7B%91%F4R%7Fo%9Dz
---
 taskcluster/ci/build/windows.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/taskcluster/ci/build/windows.yml b/taskcluster/ci/build/windows.yml
index 78c1e00f5343..342a6b0b5369 100644
--- a/taskcluster/ci/build/windows.yml
+++ b/taskcluster/ci/build/windows.yml
@@ -5,7 +5,7 @@ win32/debug:
         job-name:
             gecko-v2: win32-debug
     treeherder:
-        platform: windowsxp/debug
+        platform: windows2012-32/debug
         symbol: tc(B)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-win2012
@@ -25,7 +25,7 @@ win32/opt:
         job-name:
             gecko-v2: win32-opt
     treeherder:
-        platform: windowsxp/opt
+        platform: windows2012-32/opt
         symbol: tc(B)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-win2012
@@ -45,7 +45,7 @@ win64/debug:
         job-name:
             gecko-v2: win64-debug
     treeherder:
-        platform: windows8-64/debug
+        platform: windows2012-64/debug
         symbol: tc(B)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-win2012
@@ -65,7 +65,7 @@ win64/opt:
         job-name:
             gecko-v2: win64-opt
     treeherder:
-        platform: windows8-64/opt
+        platform: windows2012-64/opt
         symbol: tc(B)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-win2012

From ba6cb5196e9f21c62181e9ffde73d80f025b4785 Mon Sep 17 00:00:00 2001
From: Thomas Wisniewski <wisniewskit@gmail.com>
Date: Fri, 23 Sep 2016 21:10:01 -0400
Subject: [PATCH 012/102] Bug 1305202 - Use NullString() more and remove
 superfluous Truncates(). r=smaug

---
 dom/ipc/Blob.cpp                             | 10 ++--------
 dom/json/nsJSON.cpp                          |  2 --
 dom/plugins/ipc/PluginMessageUtils.h         |  4 +---
 js/xpconnect/src/XPCConvert.cpp              |  1 -
 parser/html/nsHtml5TreeOperation.cpp         |  4 +---
 storage/Variant.h                            |  2 --
 storage/mozStorageArgValueArray.cpp          |  2 --
 storage/mozStorageStatement.cpp              |  2 --
 toolkit/components/places/nsNavBookmarks.cpp |  6 ++----
 xpcom/ds/nsVariant.cpp                       |  1 -
 10 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/dom/ipc/Blob.cpp b/dom/ipc/Blob.cpp
index b51665e9f716..22d76c9bd6cb 100644
--- a/dom/ipc/Blob.cpp
+++ b/dom/ipc/Blob.cpp
@@ -3574,10 +3574,7 @@ BlobChild::SetMysteryBlobInfo(const nsString& aContentType, uint64_t aLength)
   MOZ_ASSERT(mBlobImpl);
   MOZ_ASSERT(mRemoteBlobImpl);
 
-  nsString voidString;
-  voidString.SetIsVoid(true);
-
-  mBlobImpl->SetLazyData(voidString, aContentType, aLength, INT64_MAX);
+  mBlobImpl->SetLazyData(NullString(), aContentType, aLength, INT64_MAX);
 
   NormalBlobConstructorParams params(aContentType,
                                      aLength,
@@ -4400,10 +4397,7 @@ BlobParent::RecvResolveMystery(const ResolveMysteryParams& aParams)
         return false;
       }
 
-      nsString voidString;
-      voidString.SetIsVoid(true);
-
-      mBlobImpl->SetLazyData(voidString,
+      mBlobImpl->SetLazyData(NullString(),
                              params.contentType(),
                              params.length(),
                              INT64_MAX);
diff --git a/dom/json/nsJSON.cpp b/dom/json/nsJSON.cpp
index a3d1f4f00f46..f46606fc5a81 100644
--- a/dom/json/nsJSON.cpp
+++ b/dom/json/nsJSON.cpp
@@ -70,7 +70,6 @@ nsJSON::Encode(JS::Handle<JS::Value> aValue, JSContext* cx, uint8_t aArgc,
     return rv;
 
   if (aArgc == 0) {
-    aJSON.Truncate();
     aJSON.SetIsVoid(true);
     return NS_OK;
   }
@@ -83,7 +82,6 @@ nsJSON::Encode(JS::Handle<JS::Value> aValue, JSContext* cx, uint8_t aArgc,
     rv = NS_OK;
     // if we didn't consume anything, it's not JSON, so return null
     if (!writer.DidWrite()) {
-      aJSON.Truncate();
       aJSON.SetIsVoid(true);
     } else {
       writer.FlushBuffer();
diff --git a/dom/plugins/ipc/PluginMessageUtils.h b/dom/plugins/ipc/PluginMessageUtils.h
index d58c38989244..0150eac10cda 100644
--- a/dom/plugins/ipc/PluginMessageUtils.h
+++ b/dom/plugins/ipc/PluginMessageUtils.h
@@ -253,9 +253,7 @@ inline nsCString
 NullableString(const char* aString)
 {
     if (!aString) {
-        nsCString str;
-        str.SetIsVoid(true);
-        return str;
+        return NullCString();
     }
     return nsCString(aString);
 }
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index 23e1731a9d78..feea398cf543 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -640,7 +640,6 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
     {
         if (s.isNull() || s.isUndefined()) {
             nsACString* rs = *((nsACString**)d);
-            rs->Truncate();
             rs->SetIsVoid(true);
             return true;
         }
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index 3ba9ec975b8b..af246a253929 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -565,14 +565,12 @@ nsHtml5TreeOperation::AppendDoctypeToDocument(nsIAtom* aName,
   // Adapted from nsXMLContentSink
   // Create a new doctype node
   nsCOMPtr<nsIDOMDocumentType> docType;
-  nsAutoString voidString;
-  voidString.SetIsVoid(true);
   NS_NewDOMDocumentType(getter_AddRefs(docType),
                         aBuilder->GetNodeInfoManager(),
                         aName,
                         aPublicId,
                         aSystemId,
-                        voidString);
+                        NullString());
   NS_ASSERTION(docType, "Doctype creation failed.");
   nsCOMPtr<nsIContent> asContent = do_QueryInterface(docType);
   return AppendToDocument(asContent, aBuilder);
diff --git a/storage/Variant.h b/storage/Variant.h
index 988851ad8084..265abb02aede 100644
--- a/storage/Variant.h
+++ b/storage/Variant.h
@@ -357,7 +357,6 @@ public:
   NS_IMETHOD GetAsAUTF8String(nsACString &_str)
   {
     // Return a void string.
-    _str.Truncate(0);
     _str.SetIsVoid(true);
     return NS_OK;
   }
@@ -365,7 +364,6 @@ public:
   NS_IMETHOD GetAsAString(nsAString &_str)
   {
     // Return a void string.
-    _str.Truncate(0);
     _str.SetIsVoid(true);
     return NS_OK;
   }
diff --git a/storage/mozStorageArgValueArray.cpp b/storage/mozStorageArgValueArray.cpp
index 3b9daab2fd08..40d67a4cd897 100644
--- a/storage/mozStorageArgValueArray.cpp
+++ b/storage/mozStorageArgValueArray.cpp
@@ -108,7 +108,6 @@ ArgValueArray::GetUTF8String(uint32_t aIndex,
   if (::sqlite3_value_type(mArgv[aIndex]) == SQLITE_NULL) {
     // NULL columns should have IsVoid set to distinguish them from an empty
     // string.
-    _value.Truncate(0);
     _value.SetIsVoid(true);
   }
   else {
@@ -127,7 +126,6 @@ ArgValueArray::GetString(uint32_t aIndex,
   if (::sqlite3_value_type(mArgv[aIndex]) == SQLITE_NULL) {
     // NULL columns should have IsVoid set to distinguish them from an empty
     // string.
-    _value.Truncate(0);
     _value.SetIsVoid(true);
   } else {
     _value.Assign(static_cast<const char16_t *>(::sqlite3_value_text16(mArgv[aIndex])),
diff --git a/storage/mozStorageStatement.cpp b/storage/mozStorageStatement.cpp
index 3733a7ae15b1..6f032dde54a8 100644
--- a/storage/mozStorageStatement.cpp
+++ b/storage/mozStorageStatement.cpp
@@ -772,7 +772,6 @@ Statement::GetUTF8String(uint32_t aIndex,
   if (type == mozIStorageStatement::VALUE_TYPE_NULL) {
     // NULL columns should have IsVoid set to distinguish them from the empty
     // string.
-    _value.Truncate(0);
     _value.SetIsVoid(true);
   }
   else {
@@ -795,7 +794,6 @@ Statement::GetString(uint32_t aIndex,
   if (type == mozIStorageStatement::VALUE_TYPE_NULL) {
     // NULL columns should have IsVoid set to distinguish them from the empty
     // string.
-    _value.Truncate(0);
     _value.SetIsVoid(true);
   } else {
     const char16_t *value =
diff --git a/toolkit/components/places/nsNavBookmarks.cpp b/toolkit/components/places/nsNavBookmarks.cpp
index 74da2203da3c..d2459ac8da8e 100644
--- a/toolkit/components/places/nsNavBookmarks.cpp
+++ b/toolkit/components/places/nsNavBookmarks.cpp
@@ -799,11 +799,9 @@ nsNavBookmarks::InsertSeparator(int64_t aParent,
 
   *aNewItemId = -1;
   // Set a NULL title rather than an empty string.
-  nsCString voidString;
-  voidString.SetIsVoid(true);
   nsAutoCString guid(aGUID);
   PRTime dateAdded = RoundedPRNow();
-  rv = InsertBookmarkInDB(-1, SEPARATOR, aParent, index, voidString, dateAdded,
+  rv = InsertBookmarkInDB(-1, SEPARATOR, aParent, index, NullCString(), dateAdded,
                           0, folderGuid, grandParentId, nullptr, aSource,
                           aNewItemId, guid);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -814,7 +812,7 @@ nsNavBookmarks::InsertSeparator(int64_t aParent,
   NOTIFY_OBSERVERS(mCanNotify, mCacheObservers, mObservers,
                    nsINavBookmarkObserver,
                    OnItemAdded(*aNewItemId, aParent, index, TYPE_SEPARATOR,
-                               nullptr, voidString, dateAdded, guid, folderGuid,
+                               nullptr, NullCString(), dateAdded, guid, folderGuid,
                                aSource));
 
   return NS_OK;
diff --git a/xpcom/ds/nsVariant.cpp b/xpcom/ds/nsVariant.cpp
index 6edae9f4f32b..edb020139a6e 100644
--- a/xpcom/ds/nsVariant.cpp
+++ b/xpcom/ds/nsVariant.cpp
@@ -766,7 +766,6 @@ nsDiscriminatedUnion::ToString(nsACString& aOutString) const
 
     case nsIDataType::VTYPE_VOID:
     case nsIDataType::VTYPE_EMPTY:
-      aOutString.Truncate();
       aOutString.SetIsVoid(true);
       return NS_OK;
 

From cd3ee4c9514b8c439baeb7684477518a896486de Mon Sep 17 00:00:00 2001
From: Honza Bambas <honzab.moz@firemni.cz>
Date: Tue, 22 Mar 2016 11:42:00 +0100
Subject: [PATCH 013/102] Bug 1231565 - (Part 1) Basic test for alt-data
 representation in cache r=honzab

---
 netwerk/cache2/CacheStorageService.cpp        |  27 +++++
 netwerk/cache2/nsICacheTesting.idl            |   3 +
 netwerk/test/unit/test_alt-data_simple.js     | 111 ++++++++++++++++++
 netwerk/test/unit/xpcshell.ini                |   1 +
 .../unit_ipc/test_alt-data_simple_wrap.js     |   3 +
 netwerk/test/unit_ipc/xpcshell.ini            |   2 +
 6 files changed, 147 insertions(+)
 create mode 100644 netwerk/test/unit/test_alt-data_simple.js
 create mode 100644 netwerk/test/unit_ipc/test_alt-data_simple_wrap.js

diff --git a/netwerk/cache2/CacheStorageService.cpp b/netwerk/cache2/CacheStorageService.cpp
index 5869ddeaea46..175bb3bc6b0b 100644
--- a/netwerk/cache2/CacheStorageService.cpp
+++ b/netwerk/cache2/CacheStorageService.cpp
@@ -2251,5 +2251,32 @@ CacheStorageService::ResumeCacheIOThread()
   return NS_OK;
 }
 
+NS_IMETHODIMP
+CacheStorageService::Flush(nsIObserver* aObserver)
+{
+  RefPtr<CacheIOThread> thread = CacheFileIOManager::IOThread();
+  if (!thread) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  nsCOMPtr<nsIObserverService> observerService =
+    mozilla::services::GetObserverService();
+  if (!observerService) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  // Adding as weak, the consumer is responsible to keep the reference
+  // until notified.
+  observerService->AddObserver(aObserver, "cacheservice:purge-memory-pools", false);
+
+  // This runnable will do the purging and when done, notifies the above observer.
+  // We dispatch it to the CLOSE level, so all data writes scheduled up to this time
+  // will be done before this purging happens.
+  RefPtr<CacheStorageService::PurgeFromMemoryRunnable> r =
+    new CacheStorageService::PurgeFromMemoryRunnable(this, CacheEntry::PURGE_WHOLE);
+
+  return thread->Dispatch(r, CacheIOThread::CLOSE);
+}
+
 } // namespace net
 } // namespace mozilla
diff --git a/netwerk/cache2/nsICacheTesting.idl b/netwerk/cache2/nsICacheTesting.idl
index d71891f0daec..15704f7caa82 100644
--- a/netwerk/cache2/nsICacheTesting.idl
+++ b/netwerk/cache2/nsICacheTesting.idl
@@ -4,6 +4,8 @@
 
 #include "nsISupports.idl"
 
+interface nsIObserver;
+
 /**
  * This is an internal interface used only for testing purposes.
  *
@@ -14,4 +16,5 @@ interface nsICacheTesting : nsISupports
 {
   void suspendCacheIOThread(in uint32_t aLevel);
   void resumeCacheIOThread();
+  void flush(in nsIObserver aObserver);
 };
diff --git a/netwerk/test/unit/test_alt-data_simple.js b/netwerk/test/unit/test_alt-data_simple.js
new file mode 100644
index 000000000000..6066eddf0835
--- /dev/null
+++ b/netwerk/test/unit/test_alt-data_simple.js
@@ -0,0 +1,111 @@
+/**
+ * Test for the "alternative data stream" stored withing a cache entry.
+ *
+ * - we load a URL with preference for an alt data (check what we get is the raw data,
+ *   since there was nothing previously cached)
+ * - we store the alt data along the channel (to the cache entry)
+ * - we flush the HTTP cache
+ * - we reload the same URL using a new channel, again prefering the alt data be loaded
+ * - this time the alt data must arive
+ */
+
+Cu.import("resource://testing-common/httpd.js");
+Cu.import("resource://gre/modules/NetUtil.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "URL", function() {
+  return "http://localhost:" + httpServer.identity.primaryPort + "/content";
+});
+
+var httpServer = null;
+
+function make_channel(url, callback, ctx) {
+  return NetUtil.newChannel({uri: url, loadUsingSystemPrincipal: true});
+}
+
+const responseContent = "response body";
+const altContent = "!@#$%^&*()";
+const altContentType = "text/binary";
+
+var servedNotModified = false;
+
+function contentHandler(metadata, response)
+{
+  response.setHeader("Content-Type", "text/plain");
+  response.setHeader("Cache-Control", "no-cache");
+  response.setHeader("ETag", "test-etag1");
+
+  try {
+    var etag = metadata.getHeader("If-None-Match");
+  } catch(ex) {
+    var etag = "";
+  }
+
+  if (etag == "test-etag1") {
+    response.setStatusLine(metadata.httpVersion, 304, "Not Modified");
+    servedNotModified = true;
+  } else {
+    response.bodyOutputStream.write(responseContent, responseContent.length);
+  }
+}
+
+function run_test()
+{
+  do_get_profile();
+  httpServer = new HttpServer();
+  httpServer.registerPathHandler("/content", contentHandler);
+  httpServer.start(-1);
+
+  var chan = make_channel(URL);
+
+  var cc = chan.QueryInterface(Ci.nsICacheInfoChannel);
+  cc.preferAlternativeDataType(altContentType);
+
+  chan.asyncOpen2(new ChannelListener(readServerContent, null, CL_ALLOW_UNKNOWN_CL));
+  do_test_pending();
+}
+
+function readServerContent(request, buffer)
+{
+  var cc = request.QueryInterface(Ci.nsICacheInfoChannel);
+
+  do_check_eq(buffer, responseContent);
+  do_check_eq(cc.alternativeDataType, "");
+
+  do_execute_soon(() => {
+    var os = cc.openAlternativeOutputStream(altContentType);
+    os.write(altContent, altContent.length);
+    os.close();
+
+    do_execute_soon(flushAndOpenAltChannel);
+  });
+}
+
+// needs to be rooted
+var cacheFlushObserver = cacheFlushObserver = { observe: function() {
+  cacheFlushObserver = null;
+
+  var chan = make_channel(URL);
+  var cc = chan.QueryInterface(Ci.nsICacheInfoChannel);
+  cc.preferAlternativeDataType(altContentType);
+
+  chan.asyncOpen2(new ChannelListener(readAltContent, null));
+}};
+
+function flushAndOpenAltChannel()
+{
+  // We need to do a GC pass to ensure the cache entry has been freed.
+  gc();
+  Services.cache2.QueryInterface(Ci.nsICacheTesting).flush(cacheFlushObserver);
+}
+
+function readAltContent(request, buffer)
+{
+  var cc = request.QueryInterface(Ci.nsICacheInfoChannel);
+
+  do_check_eq(servedNotModified, true);
+  do_check_eq(cc.alternativeDataType, altContentType);
+  do_check_eq(buffer, altContent);
+
+  httpServer.stop(do_test_finished);
+}
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index a53cc0cc5396..73a4ce4b1730 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -358,6 +358,7 @@ skip-if = os == "android"
 [test_packaged_app_bug1214079.js]
 [test_bug412457.js]
 [test_bug464591.js]
+[test_alt-data_simple.js]
 [test_cache-control_request.js]
 [test_bug1279246.js]
 [test_throttlequeue.js]
diff --git a/netwerk/test/unit_ipc/test_alt-data_simple_wrap.js b/netwerk/test/unit_ipc/test_alt-data_simple_wrap.js
new file mode 100644
index 000000000000..04441c22a467
--- /dev/null
+++ b/netwerk/test/unit_ipc/test_alt-data_simple_wrap.js
@@ -0,0 +1,3 @@
+function run_test() {
+  run_test_in_child("../unit/test_alt-data_simple.js");
+}
diff --git a/netwerk/test/unit_ipc/xpcshell.ini b/netwerk/test/unit_ipc/xpcshell.ini
index 70760b382d05..ea7d7c22ae56 100644
--- a/netwerk/test/unit_ipc/xpcshell.ini
+++ b/netwerk/test/unit_ipc/xpcshell.ini
@@ -54,6 +54,7 @@ support-files = child_app_offline.js
   !/netwerk/test/unit/data/test_readline7.txt
   !/netwerk/test/unit/data/test_readline8.txt
   !/netwerk/test/unit/data/signed_win.exe
+  !/netwerk/test/unit/test_alt-data_simple.js
 
 [test_bug528292_wrap.js]
 [test_bug248970_cookie_wrap.js]
@@ -93,6 +94,7 @@ skip-if = true
 [test_reply_without_content_type_wrap.js]
 [test_app_offline_http.js]
 [test_getHost_wrap.js]
+[test_alt-data_simple_wrap.js]
 [test_app_offline_notifications.js]
 [test_original_sent_received_head_wrap.js]
 [test_channel_id.js]

From 76d2cd8b5d2b4ac1586463c3920c456b74df297b Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Mon, 11 Apr 2016 05:17:02 +0200
Subject: [PATCH 014/102] Bug 1231565 - (Part 2) Allow storing alternate data
 in the HTTP cache r=honzab * Add PAltDataOutputStream.ipdl to be able to open
 an OutputStream to the cache entry in the child process *
 AltDataOutputStreamChild/Parent are Main Thread only for now. * Adds methods
 for reading and writing alt-data to nsICacheInfoChannel.idl * Keep a ref of
 the cache entry after OnStopRequest in case the consumer tries to open the
 alt-data output stream

MozReview-Commit-ID: jlraDI97Hg
---
 netwerk/base/nsICacheInfoChannel.idl          |  29 ++++
 netwerk/cache2/CacheEntry.cpp                 |  44 ++++-
 netwerk/cache2/CacheEntry.h                   |   1 +
 netwerk/cache2/OldWrappers.h                  |   9 ++
 netwerk/cache2/nsICacheEntry.idl              |  23 +++
 netwerk/ipc/NeckoChannelParams.ipdlh          |   1 +
 netwerk/ipc/NeckoChild.cpp                    |  20 +++
 netwerk/ipc/NeckoChild.h                      |   4 +
 netwerk/ipc/NeckoParent.cpp                   |  26 +++
 netwerk/ipc/NeckoParent.h                     |   6 +
 netwerk/ipc/PNecko.ipdl                       |   4 +
 .../http/AltDataOutputStreamChild.cpp         | 151 ++++++++++++++++++
 .../protocol/http/AltDataOutputStreamChild.h  |  46 ++++++
 .../http/AltDataOutputStreamParent.cpp        |  71 ++++++++
 .../protocol/http/AltDataOutputStreamParent.h |  52 ++++++
 netwerk/protocol/http/HttpBaseChannel.cpp     |  13 ++
 netwerk/protocol/http/HttpBaseChannel.h       |   9 ++
 netwerk/protocol/http/HttpChannelChild.cpp    |  58 ++++++-
 netwerk/protocol/http/HttpChannelChild.h      |   6 +-
 netwerk/protocol/http/HttpChannelParent.cpp   |  23 ++-
 netwerk/protocol/http/HttpChannelParent.h     |   5 +-
 .../protocol/http/PAltDataOutputStream.ipdl   |  32 ++++
 netwerk/protocol/http/PHttpChannel.ipdl       |   3 +-
 netwerk/protocol/http/moz.build               |   5 +
 netwerk/protocol/http/nsHttpChannel.cpp       |  62 ++++++-
 netwerk/protocol/http/nsHttpChannel.h         |   6 +
 26 files changed, 694 insertions(+), 15 deletions(-)
 create mode 100644 netwerk/protocol/http/AltDataOutputStreamChild.cpp
 create mode 100644 netwerk/protocol/http/AltDataOutputStreamChild.h
 create mode 100644 netwerk/protocol/http/AltDataOutputStreamParent.cpp
 create mode 100644 netwerk/protocol/http/AltDataOutputStreamParent.h
 create mode 100644 netwerk/protocol/http/PAltDataOutputStream.ipdl

diff --git a/netwerk/base/nsICacheInfoChannel.idl b/netwerk/base/nsICacheInfoChannel.idl
index 9ad97309f130..f6d3c7b735cf 100644
--- a/netwerk/base/nsICacheInfoChannel.idl
+++ b/netwerk/base/nsICacheInfoChannel.idl
@@ -4,6 +4,8 @@
 
 #include "nsISupports.idl"
 
+interface nsIOutputStream;
+
 [scriptable, uuid(72c34415-c6eb-48af-851f-772fa9ee5972)]
 interface nsICacheInfoChannel : nsISupports
 {
@@ -52,4 +54,31 @@ interface nsICacheInfoChannel : nsISupports
    * channel being the default load group's channel.
    */
   attribute boolean allowStaleCacheContent;
+
+  /**
+   * Calling this method instructs the channel to serve the alternative data
+   * if that was previously saved in the cache, otherwise it will serve the
+   * real data.
+   * Must be called before AsyncOpen.
+   */
+  void preferAlternativeDataType(in ACString type);
+
+  /**
+   * Holds the type of the alternative data representation that the channel
+   * is returning.
+   * Is empty string if no alternative data representation was requested, or
+   * if the requested representation wasn't found in the cache.
+   * Can only be called during or after OnStartRequest.
+   */
+  readonly attribute ACString alternativeDataType;
+
+  /**
+   * Opens and returns an output stream that a consumer may use to save an
+   * alternate representation of the data.
+   * Must be called after the OnStopRequest that delivered the real data.
+   * The consumer may choose to replace the saved alt representation.
+   * Opening the output stream will fail if there are any open input streams
+   * reading the already saved alt representation.
+   */
+  nsIOutputStream openAlternativeOutputStream(in ACString type);
 };
diff --git a/netwerk/cache2/CacheEntry.cpp b/netwerk/cache2/CacheEntry.cpp
index dba9e72b1dd8..1122fe3fc142 100644
--- a/netwerk/cache2/CacheEntry.cpp
+++ b/netwerk/cache2/CacheEntry.cpp
@@ -1128,6 +1128,19 @@ NS_IMETHODIMP CacheEntry::SetExpirationTime(uint32_t aExpirationTime)
 NS_IMETHODIMP CacheEntry::OpenInputStream(int64_t offset, nsIInputStream * *_retval)
 {
   LOG(("CacheEntry::OpenInputStream [this=%p]", this));
+  return OpenInputStreamInternal(offset, nullptr, _retval);
+}
+
+NS_IMETHODIMP CacheEntry::OpenAlternativeInputStream(const nsACString & type, nsIInputStream * *_retval)
+{
+  LOG(("CacheEntry::OpenAlternativeInputStream [this=%p, type=%s]", this,
+       PromiseFlatCString(type).get()));
+  return OpenInputStreamInternal(0, PromiseFlatCString(type).get(), _retval);
+}
+
+nsresult CacheEntry::OpenInputStreamInternal(int64_t offset, const char *aAltDataType, nsIInputStream * *_retval)
+{
+  LOG(("CacheEntry::OpenInputStreamInternal [this=%p]", this));
 
   NS_ENSURE_SUCCESS(mFileStatus, NS_ERROR_NOT_AVAILABLE);
 
@@ -1136,7 +1149,12 @@ NS_IMETHODIMP CacheEntry::OpenInputStream(int64_t offset, nsIInputStream * *_ret
   RefPtr<CacheEntryHandle> selfHandle = NewHandle();
 
   nsCOMPtr<nsIInputStream> stream;
-  rv = mFile->OpenInputStream(selfHandle, getter_AddRefs(stream));
+  if (aAltDataType) {
+    rv = mFile->OpenAlternativeInputStream(selfHandle, aAltDataType,
+                                           getter_AddRefs(stream));
+  } else {
+    rv = mFile->OpenInputStream(selfHandle, getter_AddRefs(stream));
+  }
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsISeekableStream> seekable =
@@ -1188,6 +1206,30 @@ NS_IMETHODIMP CacheEntry::OpenOutputStream(int64_t offset, nsIOutputStream * *_r
   return NS_OK;
 }
 
+NS_IMETHODIMP CacheEntry::OpenAlternativeOutputStream(const nsACString & type, nsIOutputStream * *_retval)
+{
+  LOG(("CacheEntry::OpenAlternativeOutputStream [this=%p, type=%s]", this,
+       PromiseFlatCString(type).get()));
+
+  nsresult rv;
+
+  mozilla::MutexAutoLock lock(mLock);
+
+  if (!mHasData || mState < READY || mOutputStream || mIsDoomed) {
+    LOG(("  entry not in state to write alt-data"));
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  nsCOMPtr<nsIOutputStream> stream;
+  rv = mFile->OpenAlternativeOutputStream(nullptr,
+                                          PromiseFlatCString(type).get(),
+                                          getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  stream.swap(*_retval);
+  return NS_OK;
+}
+
 nsresult CacheEntry::OpenOutputStreamInternal(int64_t offset, nsIOutputStream * *_retval)
 {
   LOG(("CacheEntry::OpenOutputStreamInternal [this=%p]", this));
diff --git a/netwerk/cache2/CacheEntry.h b/netwerk/cache2/CacheEntry.h
index 688a28125c17..7331be2a4f55 100644
--- a/netwerk/cache2/CacheEntry.h
+++ b/netwerk/cache2/CacheEntry.h
@@ -242,6 +242,7 @@ private:
   void OnFetched(Callback const & aCallback);
 
   nsresult OpenOutputStreamInternal(int64_t offset, nsIOutputStream * *_retval);
+  nsresult OpenInputStreamInternal(int64_t offset, const char *aAltDataType, nsIInputStream * *_retval);
 
   void OnHandleClosed(CacheEntryHandle const* aHandle);
 
diff --git a/netwerk/cache2/OldWrappers.h b/netwerk/cache2/OldWrappers.h
index 33c7d9b71e82..c89e3abf1b54 100644
--- a/netwerk/cache2/OldWrappers.h
+++ b/netwerk/cache2/OldWrappers.h
@@ -45,6 +45,15 @@ public:
     return !mOldDesc ? NS_ERROR_NULL_POINTER :
                        mOldDesc->OpenOutputStream(offset, _retval);
   }
+  NS_IMETHOD OpenAlternativeOutputStream(const nsACString & type, nsIOutputStream * *_retval) override
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+  NS_IMETHOD OpenAlternativeInputStream(const nsACString & type, nsIInputStream * *_retval) override
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   NS_IMETHOD GetPredictedDataSize(int64_t *aPredictedDataSize) override
   {
     return !mOldDesc ? NS_ERROR_NULL_POINTER :
diff --git a/netwerk/cache2/nsICacheEntry.idl b/netwerk/cache2/nsICacheEntry.idl
index 327baf450dab..a8c093b46e3f 100644
--- a/netwerk/cache2/nsICacheEntry.idl
+++ b/netwerk/cache2/nsICacheEntry.idl
@@ -196,6 +196,29 @@ interface nsICacheEntry : nsISupports
    */
   readonly attribute long long dataSize;
 
+  /**
+   * Opens and returns an output stream that a consumer may use to save an
+   * alternate representation of the data.
+   * @throws
+   *    - NS_ERROR_NOT_AVAILABLE if the real data hasn't been written.
+   *    - NS_ERROR_IN_PROGRESS when the writing regular content or alt-data to
+   *      the cache entry is still in progress.
+   *
+   * If there is alt-data already saved, it will be overwritten.
+   */
+  nsIOutputStream openAlternativeOutputStream(in ACString type);
+
+  /**
+   * Opens and returns an input stream that can be used to read the alternative
+   * representation previously saved in the cache.
+   * If this call is made while writing alt-data is still in progress, it is
+   * still possible to read content from the input stream as it's being written.
+   * @throws
+   *    - NS_ERROR_NOT_AVAILABLE if the alt-data representation doesn't exist at
+   *      all or if alt-data of the given type doesn't exist.
+   */
+  nsIInputStream openAlternativeInputStream(in ACString type);
+
   /****************************************************************************
    * The following methods might be added to some nsICacheEntryInternal
    * interface since we want to remove them as soon as the old cache backend is
diff --git a/netwerk/ipc/NeckoChannelParams.ipdlh b/netwerk/ipc/NeckoChannelParams.ipdlh
index 6bc287182ed8..2b421d9efaa0 100644
--- a/netwerk/ipc/NeckoChannelParams.ipdlh
+++ b/netwerk/ipc/NeckoChannelParams.ipdlh
@@ -126,6 +126,7 @@ struct HttpChannelOpenArgs
   bool                        allowStaleCacheContent;
   nsCString                   contentTypeHint;
   nsCString                   channelId;
+  nsCString                   preferredAlternativeType;
 };
 
 struct HttpChannelConnectArgs
diff --git a/netwerk/ipc/NeckoChild.cpp b/netwerk/ipc/NeckoChild.cpp
index aaf3391211f8..565c130205db 100644
--- a/netwerk/ipc/NeckoChild.cpp
+++ b/netwerk/ipc/NeckoChild.cpp
@@ -23,6 +23,8 @@
 #include "mozilla/dom/network/TCPSocketChild.h"
 #include "mozilla/dom/network/TCPServerSocketChild.h"
 #include "mozilla/dom/network/UDPSocketChild.h"
+#include "mozilla/net/AltDataOutputStreamChild.h"
+
 #ifdef NECKO_PROTOCOL_rtsp
 #include "mozilla/net/RtspControllerChild.h"
 #include "mozilla/net/RtspChannelChild.h"
@@ -88,6 +90,24 @@ NeckoChild::DeallocPHttpChannelChild(PHttpChannelChild* channel)
   return true;
 }
 
+PAltDataOutputStreamChild*
+NeckoChild::AllocPAltDataOutputStreamChild(
+        const nsCString& type,
+        PHttpChannelChild* channel)
+{
+  AltDataOutputStreamChild* stream = new AltDataOutputStreamChild();
+  stream->AddIPDLReference();
+  return stream;
+}
+
+bool
+NeckoChild::DeallocPAltDataOutputStreamChild(PAltDataOutputStreamChild* aActor)
+{
+  AltDataOutputStreamChild* child = static_cast<AltDataOutputStreamChild*>(aActor);
+  child->ReleaseIPDLReference();
+  return true;
+}
+
 PFTPChannelChild*
 NeckoChild::AllocPFTPChannelChild(const PBrowserOrId& aBrowser,
                                   const SerializedLoadContext& aSerialized,
diff --git a/netwerk/ipc/NeckoChild.h b/netwerk/ipc/NeckoChild.h
index d246e5d00410..4dfa13fb6fb7 100644
--- a/netwerk/ipc/NeckoChild.h
+++ b/netwerk/ipc/NeckoChild.h
@@ -29,6 +29,10 @@ protected:
     AllocPHttpChannelChild(const PBrowserOrId&, const SerializedLoadContext&,
                            const HttpChannelCreationArgs& aOpenArgs) override;
   virtual bool DeallocPHttpChannelChild(PHttpChannelChild*) override;
+
+  virtual PAltDataOutputStreamChild* AllocPAltDataOutputStreamChild(const nsCString& type, PHttpChannelChild* channel) override;
+  virtual bool DeallocPAltDataOutputStreamChild(PAltDataOutputStreamChild* aActor) override;
+
   virtual PCookieServiceChild* AllocPCookieServiceChild() override;
   virtual bool DeallocPCookieServiceChild(PCookieServiceChild*) override;
   virtual PWyciwygChannelChild* AllocPWyciwygChannelChild() override;
diff --git a/netwerk/ipc/NeckoParent.cpp b/netwerk/ipc/NeckoParent.cpp
index 40cd99334069..ce4ad8bd1326 100644
--- a/netwerk/ipc/NeckoParent.cpp
+++ b/netwerk/ipc/NeckoParent.cpp
@@ -15,6 +15,8 @@
 #include "mozilla/net/WebSocketChannelParent.h"
 #include "mozilla/net/WebSocketEventListenerParent.h"
 #include "mozilla/net/DataChannelParent.h"
+#include "mozilla/net/AltDataOutputStreamParent.h"
+#include "mozilla/Unused.h"
 #ifdef NECKO_PROTOCOL_rtsp
 #include "mozilla/net/RtspControllerParent.h"
 #include "mozilla/net/RtspChannelParent.h"
@@ -257,6 +259,30 @@ NeckoParent::RecvPHttpChannelConstructor(
   return p->Init(aOpenArgs);
 }
 
+PAltDataOutputStreamParent*
+NeckoParent::AllocPAltDataOutputStreamParent(
+        const nsCString& type,
+        PHttpChannelParent* channel)
+{
+  HttpChannelParent* chan = static_cast<HttpChannelParent*>(channel);
+  nsCOMPtr<nsIOutputStream> stream;
+  nsresult rv = chan->OpenAlternativeOutputStream(type, getter_AddRefs(stream));
+  AltDataOutputStreamParent* parent = new AltDataOutputStreamParent(stream);
+  parent->AddRef();
+  // If the return value was not NS_OK, the error code will be sent
+  // asynchronously to the child, after receiving the first message.
+  parent->SetError(rv);
+  return parent;
+}
+
+bool
+NeckoParent::DeallocPAltDataOutputStreamParent(PAltDataOutputStreamParent* aActor)
+{
+  AltDataOutputStreamParent* parent = static_cast<AltDataOutputStreamParent*>(aActor);
+  parent->Release();
+  return true;
+}
+
 PFTPChannelParent*
 NeckoParent::AllocPFTPChannelParent(const PBrowserOrId& aBrowser,
                                     const SerializedLoadContext& aSerialized,
diff --git a/netwerk/ipc/NeckoParent.h b/netwerk/ipc/NeckoParent.h
index 6dbd35e7d92f..737fd96fb107 100644
--- a/netwerk/ipc/NeckoParent.h
+++ b/netwerk/ipc/NeckoParent.h
@@ -105,6 +105,12 @@ protected:
                       const SerializedLoadContext& aSerialized,
                       const HttpChannelCreationArgs& aOpenArgs) override;
   virtual bool DeallocPHttpChannelParent(PHttpChannelParent*) override;
+
+  virtual PAltDataOutputStreamParent* AllocPAltDataOutputStreamParent(
+    const nsCString& type, PHttpChannelParent* channel) override;
+  virtual bool DeallocPAltDataOutputStreamParent(
+    PAltDataOutputStreamParent* aActor) override;
+
   virtual bool DeallocPCookieServiceParent(PCookieServiceParent*) override;
   virtual PWyciwygChannelParent* AllocPWyciwygChannelParent() override;
   virtual bool DeallocPWyciwygChannelParent(PWyciwygChannelParent*) override;
diff --git a/netwerk/ipc/PNecko.ipdl b/netwerk/ipc/PNecko.ipdl
index bc0bfbd52c5e..29d049610abf 100644
--- a/netwerk/ipc/PNecko.ipdl
+++ b/netwerk/ipc/PNecko.ipdl
@@ -30,6 +30,7 @@ include URIParams;
 include InputStreamParams;
 include NeckoChannelParams;
 include PBrowserOrId;
+include protocol PAltDataOutputStream;
 
 using class IPC::SerializedLoadContext from "SerializedLoadContext.h";
 using mozilla::dom::TabId from "mozilla/dom/ipc/IdType.h";
@@ -58,6 +59,7 @@ prio(normal upto urgent) sync protocol PNecko
   manages PRtspChannel;
   manages PChannelDiverter;
   manages PTransportProvider;
+  manages PAltDataOutputStream;
 
 parent:
   async __delete__();
@@ -116,6 +118,8 @@ parent:
 
   async RemoveRequestContext(nsCString rcid);
 
+  async PAltDataOutputStream(nsCString type, PHttpChannel channel);
+
 child:
   /*
    * Bring up the http auth prompt for a nested remote mozbrowser.
diff --git a/netwerk/protocol/http/AltDataOutputStreamChild.cpp b/netwerk/protocol/http/AltDataOutputStreamChild.cpp
new file mode 100644
index 000000000000..b24514685e51
--- /dev/null
+++ b/netwerk/protocol/http/AltDataOutputStreamChild.cpp
@@ -0,0 +1,151 @@
+#include "mozilla/net/AltDataOutputStreamChild.h"
+#include "mozilla/Unused.h"
+#include "nsIInputStream.h"
+
+namespace mozilla {
+namespace net {
+
+NS_IMPL_ADDREF(AltDataOutputStreamChild)
+
+NS_IMETHODIMP_(MozExternalRefCountType) AltDataOutputStreamChild::Release()
+{
+  NS_PRECONDITION(0 != mRefCnt, "dup release");
+  MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
+  --mRefCnt;
+  NS_LOG_RELEASE(this, mRefCnt, "AltDataOutputStreamChild");
+
+  if (mRefCnt == 1 && mIPCOpen) {
+    // Send_delete calls NeckoChild::PAltDataOutputStreamChild, which will release
+    // again to refcount == 0
+    PAltDataOutputStreamChild::Send__delete__(this);
+    return 0;
+  }
+
+  if (mRefCnt == 0) {
+    mRefCnt = 1; /* stabilize */
+    delete this;
+    return 0;
+  }
+  return mRefCnt;
+}
+
+NS_INTERFACE_MAP_BEGIN(AltDataOutputStreamChild)
+  NS_INTERFACE_MAP_ENTRY(nsIOutputStream)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+AltDataOutputStreamChild::AltDataOutputStreamChild()
+  : mIPCOpen(false)
+  , mError(NS_OK)
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
+}
+
+AltDataOutputStreamChild::~AltDataOutputStreamChild()
+{
+}
+
+void
+AltDataOutputStreamChild::AddIPDLReference()
+{
+  MOZ_ASSERT(!mIPCOpen, "Attempt to retain more than one IPDL reference");
+  mIPCOpen = true;
+  AddRef();
+}
+
+void
+AltDataOutputStreamChild::ReleaseIPDLReference()
+{
+  MOZ_ASSERT(mIPCOpen, "Attempt to release nonexistent IPDL reference");
+  mIPCOpen = false;
+  Release();
+}
+
+bool
+AltDataOutputStreamChild::WriteDataInChunks(const nsCString& data)
+{
+  const uint32_t kChunkSize = 128*1024;
+  uint32_t next = std::min(data.Length(), kChunkSize);
+  for (uint32_t i = 0; i < data.Length();
+       i = next, next = std::min(data.Length(), next + kChunkSize)) {
+    nsCString chunk(Substring(data, i, kChunkSize));
+    if (mIPCOpen && !SendWriteData(chunk)) {
+      mIPCOpen = false;
+      return false;
+    }
+  }
+  return true;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::Close()
+{
+  if (!mIPCOpen) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  if (NS_FAILED(mError)) {
+    return mError;
+  }
+  Unused << SendClose();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::Flush()
+{
+  if (!mIPCOpen) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  if (NS_FAILED(mError)) {
+    return mError;
+  }
+
+  // This is a no-op
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::Write(const char * aBuf, uint32_t aCount, uint32_t *_retval)
+{
+  if (!mIPCOpen) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  if (NS_FAILED(mError)) {
+    return mError;
+  }
+  if (WriteDataInChunks(nsCString(aBuf, aCount))) {
+    *_retval = aCount;
+    return NS_OK;
+  }
+  return NS_ERROR_FAILURE;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::WriteFrom(nsIInputStream *aFromStream, uint32_t aCount, uint32_t *_retval)
+{
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::WriteSegments(nsReadSegmentFun aReader, void *aClosure, uint32_t aCount, uint32_t *_retval)
+{
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+AltDataOutputStreamChild::IsNonBlocking(bool *_retval)
+{
+  *_retval = false;
+  return NS_OK;
+}
+
+bool
+AltDataOutputStreamChild::RecvError(const nsresult& err)
+{
+  mError = err;
+  return true;
+}
+
+
+} // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/http/AltDataOutputStreamChild.h b/netwerk/protocol/http/AltDataOutputStreamChild.h
new file mode 100644
index 000000000000..76b4b82ba19f
--- /dev/null
+++ b/netwerk/protocol/http/AltDataOutputStreamChild.h
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 : */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_net_AltDataOutputStreamChild_h
+#define mozilla_net_AltDataOutputStreamChild_h
+
+#include "mozilla/net/PAltDataOutputStreamChild.h"
+#include "nsIOutputStream.h"
+
+namespace mozilla {
+namespace net {
+
+class AltDataOutputStreamChild
+  : public PAltDataOutputStreamChild
+  , public nsIOutputStream
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOUTPUTSTREAM
+  explicit AltDataOutputStreamChild();
+
+  void AddIPDLReference();
+  void ReleaseIPDLReference();
+  // Saves an error code which will be reported to the writer on the next call.
+  virtual bool RecvError(const nsresult& err) override;
+
+private:
+  virtual ~AltDataOutputStreamChild();
+  // Sends data to the parent process in 256k chunks.
+  bool WriteDataInChunks(const nsCString& data);
+
+  bool mIPCOpen;
+  // If there was an error opening the output stream or writing to it on the
+  // parent side, this will be set to the error code. We check it before we
+  // write so we can report an error to the consumer.
+  nsresult mError;
+};
+
+} // namespace net
+} // namespace mozilla
+
+#endif // mozilla_net_AltDataOutputStreamChild_h
diff --git a/netwerk/protocol/http/AltDataOutputStreamParent.cpp b/netwerk/protocol/http/AltDataOutputStreamParent.cpp
new file mode 100644
index 000000000000..1181209dc70b
--- /dev/null
+++ b/netwerk/protocol/http/AltDataOutputStreamParent.cpp
@@ -0,0 +1,71 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 : */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/net/AltDataOutputStreamParent.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla {
+namespace net {
+
+NS_IMPL_ISUPPORTS0(AltDataOutputStreamParent)
+
+AltDataOutputStreamParent::AltDataOutputStreamParent(nsIOutputStream* aStream)
+  : mOutputStream(aStream)
+  , mStatus(NS_OK)
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
+}
+
+AltDataOutputStreamParent::~AltDataOutputStreamParent()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
+}
+
+bool
+AltDataOutputStreamParent::RecvWriteData(const nsCString& data)
+{
+  if (NS_FAILED(mStatus)) {
+    Unused << SendError(mStatus);
+    return true;
+  }
+  nsresult rv;
+  uint32_t n;
+  if (mOutputStream) {
+    rv = mOutputStream->Write(data.BeginReading(), data.Length(), &n);
+    MOZ_ASSERT(n == data.Length());
+    if (NS_FAILED(rv)) {
+      Unused << SendError(rv);
+    }
+  }
+  return true;
+}
+
+bool
+AltDataOutputStreamParent::RecvClose()
+{
+  if (NS_FAILED(mStatus)) {
+    Unused << SendError(mStatus);
+    return true;
+  }
+  nsresult rv;
+  if (mOutputStream) {
+    rv = mOutputStream->Close();
+    if (NS_FAILED(rv)) {
+      Unused << SendError(rv);
+    }
+    mOutputStream = nullptr;
+  }
+  return true;
+}
+
+void
+AltDataOutputStreamParent::ActorDestroy(ActorDestroyReason aWhy)
+{
+}
+
+} // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/http/AltDataOutputStreamParent.h b/netwerk/protocol/http/AltDataOutputStreamParent.h
new file mode 100644
index 000000000000..208339efb904
--- /dev/null
+++ b/netwerk/protocol/http/AltDataOutputStreamParent.h
@@ -0,0 +1,52 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 : */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_net_AltDataOutputStreamParent_h
+#define mozilla_net_AltDataOutputStreamParent_h
+
+#include "mozilla/net/PAltDataOutputStreamParent.h"
+#include "nsIOutputStream.h"
+
+namespace mozilla {
+namespace net {
+
+// Forwards data received from the content process to an output stream.
+class AltDataOutputStreamParent
+  : public PAltDataOutputStreamParent
+  , public nsISupports
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  // Called from NeckoParent::AllocPAltDataOutputStreamParent which also opens
+  // the output stream.
+  // aStream may be null
+  explicit AltDataOutputStreamParent(nsIOutputStream* aStream);
+
+  // Called when data is received from the content process.
+  // We proceed to write that data to the output stream.
+  virtual bool RecvWriteData(const nsCString& data) override;
+  // Called when AltDataOutputStreamChild::Close() is
+  // Closes and nulls the output stream.
+  virtual bool RecvClose() override;
+  virtual void ActorDestroy(ActorDestroyReason aWhy) override;
+
+  // Sets an error that will be reported to the content process.
+  void SetError(nsresult status) { mStatus = status; }
+
+private:
+  virtual ~AltDataOutputStreamParent();
+  nsCOMPtr<nsIOutputStream> mOutputStream;
+  // In case any error occurs mStatus will be != NS_OK, and this status code will
+  // be sent to the content process asynchronously.
+  nsresult mStatus;
+};
+
+} // namespace net
+} // namespace mozilla
+
+#endif // mozilla_net_AltDataOutputStreamParent_h
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index c40c74d7ec7d..049fe8f057ab 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -54,6 +54,7 @@
 #include "mozilla/BinarySearch.h"
 #include "nsIHttpHeaderVisitor.h"
 #include "nsIXULRuntime.h"
+#include "nsICacheInfoChannel.h"
 
 #include <algorithm>
 
@@ -107,6 +108,7 @@ HttpBaseChannel::HttpBaseChannel()
   , mFetchCacheMode(nsIHttpChannelInternal::FETCH_CACHE_MODE_DEFAULT)
   , mOnStartRequestCalled(false)
   , mOnStopRequestCalled(false)
+  , mAfterOnStartRequestBegun(false)
   , mTransferSize(0)
   , mDecodedBodySize(0)
   , mEncodedBodySize(0)
@@ -924,6 +926,11 @@ HttpBaseChannel::DoApplyContentConversions(nsIStreamListener* aNextListener,
     return NS_OK;
   }
 
+  if (!mAvailableCachedAltDataType.IsEmpty()) {
+    LOG(("not applying conversion because delivering alt-data\n"));
+    return NS_OK;
+  }
+
   nsAutoCString contentEncoding;
   nsresult rv = mResponseHead->GetHeader(nsHttp::Content_Encoding, contentEncoding);
   if (NS_FAILED(rv) || contentEncoding.IsEmpty())
@@ -3161,6 +3168,12 @@ HttpBaseChannel::SetupReplacementChannel(nsIURI       *newURI,
     }
   }
 
+  // Pass the preferred alt-data type on to the new channel.
+  nsCOMPtr<nsICacheInfoChannel> cacheInfoChan(do_QueryInterface(newChannel));
+  if (cacheInfoChan) {
+    cacheInfoChan->PreferAlternativeDataType(mPreferredCachedAltDataType);
+  }
+
   if (redirectFlags & (nsIChannelEventSink::REDIRECT_INTERNAL |
                        nsIChannelEventSink::REDIRECT_STS_UPGRADE)) {
     // Copy non-origin related headers to the new channel.
diff --git a/netwerk/protocol/http/HttpBaseChannel.h b/netwerk/protocol/http/HttpBaseChannel.h
index bda22e734bad..004c22c9803e 100644
--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@@ -530,6 +530,10 @@ protected:
   bool mOnStartRequestCalled;
   bool mOnStopRequestCalled;
 
+  // Defaults to false. Is set to true at the begining of OnStartRequest.
+  // Used to ensure methods can't be called before OnStartRequest.
+  bool mAfterOnStartRequestBegun;
+
   uint64_t mTransferSize;
   uint64_t mDecodedBodySize;
   uint64_t mEncodedBodySize;
@@ -545,6 +549,11 @@ protected:
 
   nsCOMPtr<nsIConsoleReportCollector> mReportCollector;
 
+  // Holds the name of the preferred alt-data type.
+  nsCString mPreferredCachedAltDataType;
+  // Holds the name of the alternative data type the channel returned.
+  nsCString mAvailableCachedAltDataType;
+
   bool mForceMainDocumentChannel;
 
   nsID mChannelId;
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 6141a6377b65..9ffc84e9f224 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -314,7 +314,8 @@ class StartRequestEvent : public ChannelEvent
                     const nsCString& aSecurityInfoSerialization,
                     const NetAddr& aSelfAddr,
                     const NetAddr& aPeerAddr,
-                    const uint32_t& aCacheKey)
+                    const uint32_t& aCacheKey,
+                    const nsCString& altDataType)
   : mChild(aChild)
   , mChannelStatus(aChannelStatus)
   , mResponseHead(aResponseHead)
@@ -328,6 +329,7 @@ class StartRequestEvent : public ChannelEvent
   , mSelfAddr(aSelfAddr)
   , mPeerAddr(aPeerAddr)
   , mCacheKey(aCacheKey)
+  , mAltDataType(altDataType)
   {}
 
   void Run()
@@ -337,7 +339,7 @@ class StartRequestEvent : public ChannelEvent
                            mRequestHeaders, mIsFromCache, mCacheEntryAvailable,
                            mCacheExpirationTime, mCachedCharset,
                            mSecurityInfoSerialization, mSelfAddr, mPeerAddr,
-                           mCacheKey);
+                           mCacheKey, mAltDataType);
   }
  private:
   HttpChannelChild* mChild;
@@ -353,6 +355,7 @@ class StartRequestEvent : public ChannelEvent
   NetAddr mSelfAddr;
   NetAddr mPeerAddr;
   uint32_t mCacheKey;
+  nsCString mAltDataType;
 };
 
 bool
@@ -368,7 +371,8 @@ HttpChannelChild::RecvOnStartRequest(const nsresult& channelStatus,
                                      const NetAddr& selfAddr,
                                      const NetAddr& peerAddr,
                                      const int16_t& redirectCount,
-                                     const uint32_t& cacheKey)
+                                     const uint32_t& cacheKey,
+                                     const nsCString& altDataType)
 {
   LOG(("HttpChannelChild::RecvOnStartRequest [this=%p]\n", this));
   // mFlushedForDiversion and mDivertingToParent should NEVER be set at this
@@ -387,7 +391,8 @@ HttpChannelChild::RecvOnStartRequest(const nsresult& channelStatus,
                                               cacheExpirationTime,
                                               cachedCharset,
                                               securityInfoSerialization,
-                                              selfAddr, peerAddr, cacheKey));
+                                              selfAddr, peerAddr, cacheKey,
+                                              altDataType));
   return true;
 }
 
@@ -403,7 +408,8 @@ HttpChannelChild::OnStartRequest(const nsresult& channelStatus,
                                  const nsCString& securityInfoSerialization,
                                  const NetAddr& selfAddr,
                                  const NetAddr& peerAddr,
-                                 const uint32_t& cacheKey)
+                                 const uint32_t& cacheKey,
+                                 const nsCString& altDataType)
 {
   LOG(("HttpChannelChild::OnStartRequest [this=%p]\n", this));
 
@@ -433,6 +439,10 @@ HttpChannelChild::OnStartRequest(const nsresult& channelStatus,
   mSelfAddr = selfAddr;
   mPeerAddr = peerAddr;
 
+  mAvailableCachedAltDataType = altDataType;
+
+  mAfterOnStartRequestBegun = true;
+
   AutoEventEnqueuer ensureSerialDispatch(mEventQ);
 
   nsresult rv;
@@ -913,6 +923,13 @@ HttpChannelChild::OnStopRequest(const nsresult& channelStatus,
 
   ReleaseListeners();
 
+  // DocumentChannelCleanup actually nulls out mCacheEntry in the parent, which
+  // we might need later to open the Alt-Data output stream, so just return here
+  if (!mPreferredCachedAltDataType.IsEmpty()) {
+    mKeptAlive = true;
+    return;
+  }
+
   if (mLoadFlags & LOAD_DOCUMENT_URI) {
     // Keep IPDL channel open, but only for updating security info.
     mKeptAlive = true;
@@ -1905,6 +1922,7 @@ HttpChannelChild::ContinueAsyncOpen()
   openArgs.loadFlags() = mLoadFlags;
   openArgs.requestHeaders() = mClientSetRequestHeaders;
   mRequestHead.Method(openArgs.requestMethod());
+  openArgs.preferredAlternativeType() = mPreferredCachedAltDataType;
 
   nsTArray<mozilla::ipc::FileDescriptor> fds;
   SerializeInputStream(mUploadStream, openArgs.uploadStream(), fds);
@@ -2178,6 +2196,36 @@ HttpChannelChild::GetAllowStaleCacheContent(bool *aAllowStaleCacheContent)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+HttpChannelChild::PreferAlternativeDataType(const nsACString & aType)
+{
+  ENSURE_CALLED_BEFORE_ASYNC_OPEN();
+  mPreferredCachedAltDataType = aType;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HttpChannelChild::GetAlternativeDataType(nsACString & aType)
+{
+  // Must be called during or after OnStartRequest
+  if (!mAfterOnStartRequestBegun) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  aType = mAvailableCachedAltDataType;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HttpChannelChild::OpenAlternativeOutputStream(const nsACString & aType, nsIOutputStream * *_retval)
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
+  RefPtr<AltDataOutputStreamChild> stream =
+    static_cast<AltDataOutputStreamChild*>(gNeckoChild->SendPAltDataOutputStreamConstructor(nsCString(aType), this));
+  stream.forget(_retval);
+  return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // HttpChannelChild::nsIResumableChannel
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/http/HttpChannelChild.h b/netwerk/protocol/http/HttpChannelChild.h
index 3dabad5ae9d3..df46dd6a5fd5 100644
--- a/netwerk/protocol/http/HttpChannelChild.h
+++ b/netwerk/protocol/http/HttpChannelChild.h
@@ -121,7 +121,8 @@ protected:
                           const NetAddr& selfAddr,
                           const NetAddr& peerAddr,
                           const int16_t& redirectCount,
-                          const uint32_t& cacheKey) override;
+                          const uint32_t& cacheKey,
+                          const nsCString& altDataType) override;
   bool RecvOnTransportAndData(const nsresult& channelStatus,
                               const nsresult& status,
                               const uint64_t& progress,
@@ -261,7 +262,8 @@ private:
                       const nsCString& securityInfoSerialization,
                       const NetAddr& selfAddr,
                       const NetAddr& peerAddr,
-                      const uint32_t& cacheKey);
+                      const uint32_t& cacheKey,
+                      const nsCString& altDataType);
   void MaybeDivertOnData(const nsCString& data,
                          const uint64_t& offset,
                          const uint32_t& count);
diff --git a/netwerk/protocol/http/HttpChannelParent.cpp b/netwerk/protocol/http/HttpChannelParent.cpp
index d07793f99fa2..78a92fe15531 100644
--- a/netwerk/protocol/http/HttpChannelParent.cpp
+++ b/netwerk/protocol/http/HttpChannelParent.cpp
@@ -134,7 +134,7 @@ HttpChannelParent::Init(const HttpChannelCreationArgs& aArgs)
                        a.initialRwin(), a.blockAuthPrompt(),
                        a.suspendAfterSynthesizeResponse(),
                        a.allowStaleCacheContent(), a.contentTypeHint(),
-                       a.channelId());
+                       a.channelId(), a.preferredAlternativeType());
   }
   case HttpChannelCreationArgs::THttpChannelConnectArgs:
   {
@@ -266,7 +266,8 @@ HttpChannelParent::DoAsyncOpen(  const URIParams&           aURI,
                                  const bool&                aSuspendAfterSynthesizeResponse,
                                  const bool&                aAllowStaleCacheContent,
                                  const nsCString&           aContentTypeHint,
-                                 const nsCString&           aChannelId)
+                                 const nsCString&           aChannelId,
+                                 const nsCString&           aPreferredAlternativeType)
 {
   nsCOMPtr<nsIURI> uri = DeserializeURI(aURI);
   if (!uri) {
@@ -421,6 +422,7 @@ HttpChannelParent::DoAsyncOpen(  const URIParams&           aURI,
   }
 
   mChannel->SetCacheKey(cacheKey);
+  mChannel->PreferAlternativeDataType(aPreferredAlternativeType);
 
   mChannel->SetAllowStaleCacheContent(aAllowStaleCacheContent);
 
@@ -1059,6 +1061,9 @@ HttpChannelParent::OnStartRequest(nsIRequest *aRequest, nsISupports *aContext)
     }
   }
 
+  nsAutoCString altDataType;
+  mChannel->GetAlternativeDataType(altDataType);
+
   // !!! We need to lock headers and please don't forget to unlock them !!!
   requestHead->Enter();
   nsresult rv = NS_OK;
@@ -1072,7 +1077,8 @@ HttpChannelParent::OnStartRequest(nsIRequest *aRequest, nsISupports *aContext)
                           expirationTime, cachedCharset, secInfoSerialization,
                           mChannel->GetSelfAddr(), mChannel->GetPeerAddr(),
                           redirectCount,
-                          cacheKeyValue))
+                          cacheKeyValue,
+                          altDataType))
   {
     rv = NS_ERROR_UNEXPECTED;
   }
@@ -1592,6 +1598,17 @@ HttpChannelParent::NotifyDiversionFailed(nsresult aErrorCode,
   }
 }
 
+nsresult
+HttpChannelParent::OpenAlternativeOutputStream(const nsACString & type, nsIOutputStream * *_retval)
+{
+  // We need to make sure the child does not call SendDocumentChannelCleanup()
+  // before opening the altOutputStream, because that clears mCacheEntry.
+  if (!mCacheEntry) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  return mCacheEntry->OpenAlternativeOutputStream(type, _retval);
+}
+
 void
 HttpChannelParent::OfflineDisconnect()
 {
diff --git a/netwerk/protocol/http/HttpChannelParent.h b/netwerk/protocol/http/HttpChannelParent.h
index 9eb5e0c754e9..4232517ff13f 100644
--- a/netwerk/protocol/http/HttpChannelParent.h
+++ b/netwerk/protocol/http/HttpChannelParent.h
@@ -98,6 +98,8 @@ public:
     }
   }
 
+  nsresult OpenAlternativeOutputStream(const nsACString & type, nsIOutputStream * *_retval);
+
 protected:
   // used to connect redirected-to channel in parent with just created
   // ChildChannel.  Used during redirects.
@@ -140,7 +142,8 @@ protected:
                    const bool&                aSuspendAfterSynthesizeResponse,
                    const bool&                aAllowStaleCacheContent,
                    const nsCString&           aContentTypeHint,
-                   const nsCString&           aChannelId);
+                   const nsCString&           aChannelId,
+                   const nsCString&           aPreferredAlternativeType);
 
   virtual bool RecvSetPriority(const uint16_t& priority) override;
   virtual bool RecvSetClassOfService(const uint32_t& cos) override;
diff --git a/netwerk/protocol/http/PAltDataOutputStream.ipdl b/netwerk/protocol/http/PAltDataOutputStream.ipdl
new file mode 100644
index 000000000000..824137f8e33b
--- /dev/null
+++ b/netwerk/protocol/http/PAltDataOutputStream.ipdl
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 ft=cpp : */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PNecko;
+
+namespace mozilla {
+namespace net {
+
+protocol PAltDataOutputStream
+{
+  manager PNecko;
+
+parent:
+  // Sends data from the child to the parent that will be written to the cache.
+  async WriteData(nsCString data);
+  // Signals that writing to the output stream is done.
+  async Close();
+  async __delete__();
+
+child:
+  // The parent calls this method to signal that an error has ocurred.
+  // This may mean that opening the output stream has failed or that writing to
+  // the stream has returned an error.
+  async Error(nsresult err);
+};
+
+} // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/http/PHttpChannel.ipdl b/netwerk/protocol/http/PHttpChannel.ipdl
index e7312fb40a98..d7c0da64ac6f 100644
--- a/netwerk/protocol/http/PHttpChannel.ipdl
+++ b/netwerk/protocol/http/PHttpChannel.ipdl
@@ -99,7 +99,8 @@ child:
                        NetAddr             selfAddr,
                        NetAddr             peerAddr,
                        int16_t             redirectCount,
-                       uint32_t            cacheKey);
+                       uint32_t            cacheKey,
+                       nsCString           altDataType);
 
   // Combines a single OnDataAvailable and its associated OnProgress &
   // OnStatus calls into one IPDL message
diff --git a/netwerk/protocol/http/moz.build b/netwerk/protocol/http/moz.build
index 3e342be23195..467cdfde22ba 100644
--- a/netwerk/protocol/http/moz.build
+++ b/netwerk/protocol/http/moz.build
@@ -31,6 +31,8 @@ EXPORTS += [
 ]
 
 EXPORTS.mozilla.net += [
+    'AltDataOutputStreamChild.h',
+    'AltDataOutputStreamParent.h',
     'HttpBaseChannel.h',
     'HttpChannelChild.h',
     'HttpChannelParent.h',
@@ -53,6 +55,8 @@ SOURCES += [
 ]
 
 UNIFIED_SOURCES += [
+    'AltDataOutputStreamChild.cpp',
+    'AltDataOutputStreamParent.cpp',
     'CacheControlParser.cpp',
     'ConnectionDiagnostics.cpp',
     'Http2Compression.cpp',
@@ -95,6 +99,7 @@ SOURCES += [
 ]
 
 IPDL_SOURCES += [
+    'PAltDataOutputStream.ipdl',
     'PHttpChannel.ipdl',
 ]
 
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 5d7d7a400834..5dbe0b6dff5f 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -466,7 +466,7 @@ nsHttpChannel::ContinueConnect()
         if (!mFallbackChannel && !mFallbackKey.IsEmpty()) {
             return AsyncCall(&nsHttpChannel::HandleAsyncFallback);
         }
-        LOG(("  !mCachedEntry && mLoadFlags & LOAD_ONLY_FROM_CACHE"));
+        LOG(("  !mCacheEntry && mLoadFlags & LOAD_ONLY_FROM_CACHE"));
         return NS_ERROR_DOCUMENT_NOT_CACHED;
     }
 
@@ -4496,7 +4496,24 @@ nsHttpChannel::OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBufferi
     // Open an input stream for the entity, so that the call to OpenInputStream
     // happens off the main thread.
     nsCOMPtr<nsIInputStream> stream;
-    rv = cacheEntry->OpenInputStream(0, getter_AddRefs(stream));
+
+    // If an alternate representation was requested, try to open the alt
+    // input stream.
+    if (!mPreferredCachedAltDataType.IsEmpty()) {
+        rv = cacheEntry->OpenAlternativeInputStream(mPreferredCachedAltDataType,
+                                                    getter_AddRefs(stream));
+        if (NS_SUCCEEDED(rv)) {
+            // We have succeeded.
+            mAvailableCachedAltDataType = mPreferredCachedAltDataType;
+            // The alternative data may have a different length than the original
+            // content, so we clear the Content-Length header
+            mCachedResponseHead->SetContentLength(-1);
+        }
+    }
+
+    if (!stream) {
+        rv = cacheEntry->OpenInputStream(0, getter_AddRefs(stream));
+    }
 
     if (NS_FAILED(rv)) {
         LOG(("Failed to open cache input stream [channel=%p, "
@@ -6340,6 +6357,8 @@ nsHttpChannel::OnStartRequest(nsIRequest *request, nsISupports *ctxt)
     MOZ_ASSERT(!(mTransactionPump && mCachePump) || mCachedContentIsPartial,
                "If we have both pumps, the cache content must be partial");
 
+    mAfterOnStartRequestBegun = true;
+
     if (!mSecurityInfo && !mCachePump && mTransaction) {
         // grab the security info from the connection object; the transaction
         // is guaranteed to own a reference to the connection.
@@ -6689,6 +6708,14 @@ nsHttpChannel::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult st
         mOnStopRequestCalled = true;
     }
 
+    // If a preferred alt-data type was set, this signals the consumer is
+    // interested in reading and/or writing the alt-data representation.
+    // We need to hold a reference to the cache entry in case the listener calls
+    // openAlternativeOutputStream() after CloseCacheEntry() clears mCacheEntry.
+    if (!mPreferredCachedAltDataType.IsEmpty()) {
+        mAltDataCacheEntry = mCacheEntry;
+    }
+
     CloseCacheEntry(!contentComplete);
 
     if (mOfflineCacheEntry)
@@ -7052,6 +7079,37 @@ nsHttpChannel::GetAllowStaleCacheContent(bool *aAllowStaleCacheContent)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsHttpChannel::PreferAlternativeDataType(const nsACString & aType)
+{
+    ENSURE_CALLED_BEFORE_ASYNC_OPEN();
+    mPreferredCachedAltDataType = aType;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHttpChannel::GetAlternativeDataType(nsACString & aType)
+{
+    // must be called during or after OnStartRequest
+    if (!mAfterOnStartRequestBegun) {
+        return NS_ERROR_NOT_AVAILABLE;
+    }
+    aType = mAvailableCachedAltDataType;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHttpChannel::OpenAlternativeOutputStream(const nsACString & type, nsIOutputStream * *_retval)
+{
+    // OnStopRequest will clear mCacheEntry, but we may use mAltDataCacheEntry
+    // if the consumer called PreferAlternativeDataType()
+    nsCOMPtr<nsICacheEntry> cacheEntry = mCacheEntry ? mCacheEntry : mAltDataCacheEntry;
+    if (!cacheEntry) {
+        return NS_ERROR_NOT_AVAILABLE;
+    }
+    return cacheEntry->OpenAlternativeOutputStream(type, _retval);
+}
+
 //-----------------------------------------------------------------------------
 // nsHttpChannel::nsICachingChannel
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index 37517b4fba57..d5fa26c00daf 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -457,6 +457,12 @@ private:
 
     // cache specific data
     nsCOMPtr<nsICacheEntry>           mCacheEntry;
+    // This will be set during OnStopRequest() before calling CloseCacheEntry(),
+    // but only if the listener wants to use alt-data (signaled by
+    // HttpBaseChannel::mPreferredCachedAltDataType being not empty)
+    // Needed because calling openAlternativeOutputStream needs a reference
+    // to the cache entry.
+    nsCOMPtr<nsICacheEntry>           mAltDataCacheEntry;
     // We must close mCacheInputStream explicitly to avoid leaks.
     AutoClose<nsIInputStream>         mCacheInputStream;
     RefPtr<nsInputStreamPump>       mCachePump;

From 29eff7dfe4edede3c68fdc1f43341d2e4b4f1320 Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Tue, 27 Sep 2016 10:26:00 +0200
Subject: [PATCH 015/102] Bug 1231565 - (Part 3) Make alt-data responses report
 the correct content length r=michal

MozReview-Commit-ID: DvQP7NB4SqW
---
 netwerk/cache2/CacheEntry.cpp             | 11 +++++++++++
 netwerk/cache2/CacheFile.cpp              | 16 ++++++++++++++++
 netwerk/cache2/CacheFile.h                |  2 ++
 netwerk/cache2/OldWrappers.cpp            |  5 +++++
 netwerk/cache2/OldWrappers.h              |  1 +
 netwerk/cache2/nsICacheEntry.idl          |  9 +++++++++
 netwerk/protocol/http/nsHttpChannel.cpp   |  8 ++++++--
 netwerk/test/unit/test_alt-data_simple.js |  2 +-
 8 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/netwerk/cache2/CacheEntry.cpp b/netwerk/cache2/CacheEntry.cpp
index 1122fe3fc142..0ed49ef16401 100644
--- a/netwerk/cache2/CacheEntry.cpp
+++ b/netwerk/cache2/CacheEntry.cpp
@@ -1506,6 +1506,17 @@ NS_IMETHODIMP CacheEntry::GetDataSize(int64_t *aDataSize)
   return NS_OK;
 }
 
+
+NS_IMETHODIMP CacheEntry::GetAltDataSize(int64_t *aDataSize)
+{
+  LOG(("CacheEntry::GetAltDataSize [this=%p]", this));
+  if (NS_FAILED(mFileStatus)) {
+    return mFileStatus;
+  }
+  return mFile->GetAltDataSize(aDataSize);
+}
+
+
 NS_IMETHODIMP CacheEntry::MarkValid()
 {
   // NOT IMPLEMENTED ACTUALLY
diff --git a/netwerk/cache2/CacheFile.cpp b/netwerk/cache2/CacheFile.cpp
index 45bbcd7fbcd3..3b87ea649e1d 100644
--- a/netwerk/cache2/CacheFile.cpp
+++ b/netwerk/cache2/CacheFile.cpp
@@ -2100,6 +2100,22 @@ CacheFile::DataSize(int64_t* aSize)
   return true;
 }
 
+nsresult
+CacheFile::GetAltDataSize(int64_t *aSize)
+{
+  CacheFileAutoLock lock(this);
+  if (mOutput) {
+    return NS_ERROR_IN_PROGRESS;
+  }
+
+  if (mAltDataOffset == -1) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  *aSize = mDataSize - mAltDataOffset;
+  return NS_OK;
+}
+
 bool
 CacheFile::IsDoomed()
 {
diff --git a/netwerk/cache2/CacheFile.h b/netwerk/cache2/CacheFile.h
index cbc050f452d3..839f63cff582 100644
--- a/netwerk/cache2/CacheFile.h
+++ b/netwerk/cache2/CacheFile.h
@@ -91,6 +91,8 @@ public:
   void Kill() { mKill = true; }
   nsresult   ThrowMemoryCachedData();
 
+  nsresult GetAltDataSize(int64_t *aSize);
+
   // metadata forwarders
   nsresult GetElement(const char *aKey, char **_retval);
   nsresult SetElement(const char *aKey, const char *aValue);
diff --git a/netwerk/cache2/OldWrappers.cpp b/netwerk/cache2/OldWrappers.cpp
index bdda4f93a715..81df88df0e8f 100644
--- a/netwerk/cache2/OldWrappers.cpp
+++ b/netwerk/cache2/OldWrappers.cpp
@@ -399,6 +399,11 @@ NS_IMETHODIMP _OldCacheEntryWrapper::GetDataSize(int64_t *aSize)
   return NS_OK;
 }
 
+NS_IMETHODIMP _OldCacheEntryWrapper::GetAltDataSize(int64_t *aSize)
+{
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP _OldCacheEntryWrapper::GetPersistent(bool *aPersistToDisk)
 {
   if (!mOldDesc) {
diff --git a/netwerk/cache2/OldWrappers.h b/netwerk/cache2/OldWrappers.h
index c89e3abf1b54..460aa0162ef8 100644
--- a/netwerk/cache2/OldWrappers.h
+++ b/netwerk/cache2/OldWrappers.h
@@ -139,6 +139,7 @@ public:
   NS_IMETHOD MetaDataReady() override { return NS_OK; }
   NS_IMETHOD Recreate(bool, nsICacheEntry**) override;
   NS_IMETHOD GetDataSize(int64_t *size) override;
+  NS_IMETHOD GetAltDataSize(int64_t *size) override;
   NS_IMETHOD OpenInputStream(int64_t offset, nsIInputStream * *_retval) override;
   NS_IMETHOD OpenOutputStream(int64_t offset, nsIOutputStream * *_retval) override;
   NS_IMETHOD MaybeMarkValid() override;
diff --git a/netwerk/cache2/nsICacheEntry.idl b/netwerk/cache2/nsICacheEntry.idl
index a8c093b46e3f..784523a01541 100644
--- a/netwerk/cache2/nsICacheEntry.idl
+++ b/netwerk/cache2/nsICacheEntry.idl
@@ -196,6 +196,15 @@ interface nsICacheEntry : nsISupports
    */
   readonly attribute long long dataSize;
 
+  /**
+  * Returns the length of data this entry holds.
+  * @throws
+  *    - NS_ERROR_IN_PROGRESS when a write is still in progress (either real
+                              content or alt data).
+  *    - NS_ERROR_NOT_AVAILABLE if alt data does not exist.
+  */
+  readonly attribute long long altDataSize;
+
   /**
    * Opens and returns an output stream that a consumer may use to save an
    * alternate representation of the data.
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 5dbe0b6dff5f..a5b5bc327254 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -4505,9 +4505,13 @@ nsHttpChannel::OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBufferi
         if (NS_SUCCEEDED(rv)) {
             // We have succeeded.
             mAvailableCachedAltDataType = mPreferredCachedAltDataType;
-            // The alternative data may have a different length than the original
-            // content, so we clear the Content-Length header
+            // Clear the header.
             mCachedResponseHead->SetContentLength(-1);
+            // Set the correct data size on the channel.
+            int64_t altDataSize;
+            if (NS_SUCCEEDED(cacheEntry->GetAltDataSize(&altDataSize))) {
+                mCachedResponseHead->SetContentLength(altDataSize);
+            }
         }
     }
 
diff --git a/netwerk/test/unit/test_alt-data_simple.js b/netwerk/test/unit/test_alt-data_simple.js
index 6066eddf0835..a140809231da 100644
--- a/netwerk/test/unit/test_alt-data_simple.js
+++ b/netwerk/test/unit/test_alt-data_simple.js
@@ -61,7 +61,7 @@ function run_test()
   var cc = chan.QueryInterface(Ci.nsICacheInfoChannel);
   cc.preferAlternativeDataType(altContentType);
 
-  chan.asyncOpen2(new ChannelListener(readServerContent, null, CL_ALLOW_UNKNOWN_CL));
+  chan.asyncOpen2(new ChannelListener(readServerContent, null));
   do_test_pending();
 }
 

From 632626f6395692fd359d3687a5885a777f7d841e Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Tue, 27 Sep 2016 10:26:32 +0200
Subject: [PATCH 016/102] Bug 1231565 - (Part 4) Test that large alt-data
 content can be saved, and that streaming works r=honzab

--HG--
rename : netwerk/test/unit/test_alt-data_simple.js => netwerk/test/unit/test_alt-data_stream.js
rename : netwerk/test/unit_ipc/test_alt-data_simple_wrap.js => netwerk/test/unit_ipc/test_alt-data_stream_wrap.js
---
 netwerk/test/unit/test_alt-data_stream.js     | 120 ++++++++++++++++++
 netwerk/test/unit/xpcshell.ini                |   1 +
 .../unit_ipc/test_alt-data_stream_wrap.js     |   3 +
 netwerk/test/unit_ipc/xpcshell.ini            |   2 +
 4 files changed, 126 insertions(+)
 create mode 100644 netwerk/test/unit/test_alt-data_stream.js
 create mode 100644 netwerk/test/unit_ipc/test_alt-data_stream_wrap.js

diff --git a/netwerk/test/unit/test_alt-data_stream.js b/netwerk/test/unit/test_alt-data_stream.js
new file mode 100644
index 000000000000..da3794dd0654
--- /dev/null
+++ b/netwerk/test/unit/test_alt-data_stream.js
@@ -0,0 +1,120 @@
+/**
+ * Test for the "alternative data stream" stored withing a cache entry.
+ *
+ * - we load a URL with preference for an alt data (check what we get is the raw data,
+ *   since there was nothing previously cached)
+ * - we write a big chunk of alt-data to the output stream
+ * - we load the URL again, expecting to get alt-data
+ * - we check that the alt-data is streamed. We should get the first chunk, then
+ *   the rest of the alt-data is written, and we check that it is received in
+ *   the proper order.
+ *
+ */
+
+Cu.import("resource://testing-common/httpd.js");
+Cu.import("resource://gre/modules/NetUtil.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "URL", function() {
+  return "http://localhost:" + httpServer.identity.primaryPort + "/content";
+});
+
+var httpServer = null;
+
+function make_channel(url, callback, ctx) {
+  return NetUtil.newChannel({uri: url, loadUsingSystemPrincipal: true});
+}
+
+const responseContent = "response body";
+// We need a large content in order to make sure that the IPDL stream is cut
+// into several different chunks.
+// We fill each chunk with a different character for easy debugging.
+const altContent = "a".repeat(128*1024) +
+                   "b".repeat(128*1024) +
+                   "c".repeat(128*1024) +
+                   "d".repeat(128*1024) +
+                   "e".repeat(128*1024) +
+                   "f".repeat(128*1024) +
+                   "g".repeat(128*1024) +
+                   "h".repeat(128*1024) +
+                   "i".repeat(13); // Just so the chunk size doesn't match exactly.
+
+const firstChunkSize = Math.floor(altContent.length / 4);
+const altContentType = "text/binary";
+
+function contentHandler(metadata, response)
+{
+  response.setHeader("Content-Type", "text/plain");
+  response.setHeader("Cache-Control", "max-age=86400");
+
+  response.bodyOutputStream.write(responseContent, responseContent.length);
+}
+
+function run_test()
+{
+  do_get_profile();
+  httpServer = new HttpServer();
+  httpServer.registerPathHandler("/content", contentHandler);
+  httpServer.start(-1);
+
+  var chan = make_channel(URL);
+
+  var cc = chan.QueryInterface(Ci.nsICacheInfoChannel);
+  cc.preferAlternativeDataType(altContentType);
+
+  chan.asyncOpen2(new ChannelListener(readServerContent, null));
+  do_test_pending();
+}
+
+// Output stream used to write alt-data to the cache entry.
+var os;
+
+function readServerContent(request, buffer)
+{
+  var cc = request.QueryInterface(Ci.nsICacheInfoChannel);
+
+  do_check_eq(buffer, responseContent);
+  do_check_eq(cc.alternativeDataType, "");
+
+  do_execute_soon(() => {
+    os = cc.openAlternativeOutputStream(altContentType);
+    // Write a quarter of the alt data content
+    os.write(altContent, firstChunkSize);
+
+    do_execute_soon(openAltChannel);
+  });
+}
+
+function openAltChannel()
+{
+  var chan = make_channel(URL);
+  var cc = chan.QueryInterface(Ci.nsICacheInfoChannel);
+  cc.preferAlternativeDataType(altContentType);
+
+  chan.asyncOpen2(listener);
+}
+
+var listener = {
+  buffer: "",
+  onStartRequest: function(request, context) { },
+  onDataAvailable: function(request, context, stream, offset, count) {
+    let string = NetUtil.readInputStreamToString(stream, count);
+    this.buffer += string;
+
+    // XXX: this condition might be a bit volatile. If this test times out,
+    // it probably means that for some reason, the listener didn't get all the
+    // data in the first chunk.
+    if (this.buffer.length == firstChunkSize) {
+      // write the rest of the content
+      os.write(altContent.substring(firstChunkSize, altContent.length), altContent.length - firstChunkSize);
+      os.close();
+    }
+  },
+  onStopRequest: function(request, context, status) {
+    var cc = request.QueryInterface(Ci.nsICacheInfoChannel);
+    do_check_eq(cc.alternativeDataType, altContentType);
+    do_check_eq(this.buffer.length, altContent.length);
+    do_check_eq(this.buffer, altContent);
+    httpServer.stop(do_test_finished);
+  },
+};
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 73a4ce4b1730..1bdda2fab8ac 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -359,6 +359,7 @@ skip-if = os == "android"
 [test_bug412457.js]
 [test_bug464591.js]
 [test_alt-data_simple.js]
+[test_alt-data_stream.js]
 [test_cache-control_request.js]
 [test_bug1279246.js]
 [test_throttlequeue.js]
diff --git a/netwerk/test/unit_ipc/test_alt-data_stream_wrap.js b/netwerk/test/unit_ipc/test_alt-data_stream_wrap.js
new file mode 100644
index 000000000000..1eee2f2434fe
--- /dev/null
+++ b/netwerk/test/unit_ipc/test_alt-data_stream_wrap.js
@@ -0,0 +1,3 @@
+function run_test() {
+  run_test_in_child("../unit/test_alt-data_stream.js");
+}
diff --git a/netwerk/test/unit_ipc/xpcshell.ini b/netwerk/test/unit_ipc/xpcshell.ini
index ea7d7c22ae56..f9818947ffe8 100644
--- a/netwerk/test/unit_ipc/xpcshell.ini
+++ b/netwerk/test/unit_ipc/xpcshell.ini
@@ -55,6 +55,7 @@ support-files = child_app_offline.js
   !/netwerk/test/unit/data/test_readline8.txt
   !/netwerk/test/unit/data/signed_win.exe
   !/netwerk/test/unit/test_alt-data_simple.js
+  !/netwerk/test/unit/test_alt-data_stream.js
 
 [test_bug528292_wrap.js]
 [test_bug248970_cookie_wrap.js]
@@ -95,6 +96,7 @@ skip-if = true
 [test_app_offline_http.js]
 [test_getHost_wrap.js]
 [test_alt-data_simple_wrap.js]
+[test_alt-data_stream_wrap.js]
 [test_app_offline_notifications.js]
 [test_original_sent_received_head_wrap.js]
 [test_channel_id.js]

From 17db78f2b59419e66b4b7531e0db3de68d8e11fe Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 6 Sep 2016 14:19:45 +0100
Subject: [PATCH 017/102] Bug 1284395, r=bz,mconley,baku

MozReview-Commit-ID: 1nPyv7G3q7d

--HG--
extra : rebase_source : 9b0b75c43d441a13992f085ce6f766aee0614666
extra : source : 6036b8acdab58eb565f15e12f8184f8abe7c6413
---
 browser/base/content/browser.js               | 26 +++++++++-----
 browser/base/content/content.js               |  1 +
 browser/base/content/nsContextMenu.js         |  1 +
 browser/base/content/tabbrowser.xml           |  9 +++++
 browser/base/content/test/general/browser.ini |  1 +
 ...browser_modifiedclick_inherit_principal.js | 30 ++++++++++++++++
 browser/base/content/utilityOverlay.js        | 11 +++++-
 browser/modules/ContentClick.jsm              | 15 ++++----
 toolkit/content/browser-child.js              | 13 +++++++
 toolkit/content/widgets/browser.xml           | 10 ++++++
 toolkit/content/widgets/remote-browser.xml    |  9 +++++
 toolkit/modules/BrowserUtils.jsm              | 36 +++++++++++++++++++
 12 files changed, 147 insertions(+), 15 deletions(-)
 create mode 100644 browser/base/content/test/general/browser_modifiedclick_inherit_principal.js

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index efcc08720e02..51d3bb382358 100755
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1128,6 +1128,7 @@ var gBrowserInit = {
       //                 [4]: allowThirdPartyFixup (bool)
       //                 [5]: referrerPolicy (int)
       //                 [6]: userContextId (int)
+      //                 [7]: originPrincipal (nsIPrincipal)
       else if (window.arguments.length >= 3) {
         let referrerURI = window.arguments[2];
         if (typeof(referrerURI) == "string") {
@@ -1142,7 +1143,10 @@ var gBrowserInit = {
         let userContextId = (window.arguments[6] != undefined ?
             window.arguments[6] : Ci.nsIScriptSecurityManager.DEFAULT_USER_CONTEXT_ID);
         loadURI(uriToLoad, referrerURI, window.arguments[3] || null,
-                window.arguments[4] || false, referrerPolicy, userContextId);
+                window.arguments[4] || false, referrerPolicy, userContextId,
+                // pass the origin principal (if any) and force its use to create
+                // an initial about:blank viewer if present:
+                window.arguments[7], !!window.arguments[7]);
         window.focus();
       }
       // Note: loadOneOrMoreURIs *must not* be called if window.arguments.length >= 3.
@@ -2033,14 +2037,17 @@ function BrowserTryToCloseWindow()
 }
 
 function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
-                 userContextId) {
+                 userContextId, originPrincipal, forceAboutBlankViewerInCurrent) {
   try {
     openLinkIn(uri, "current",
                { referrerURI: referrer,
                  referrerPolicy: referrerPolicy,
                  postData: postData,
                  allowThirdPartyFixup: allowThirdPartyFixup,
-                 userContextId: userContextId });
+                 userContextId: userContextId,
+                 originPrincipal,
+                 forceAboutBlankViewerInCurrent,
+               });
   } catch (e) {}
 }
 
@@ -5584,11 +5591,14 @@ function handleLinkClick(event, href, linkNode) {
   }
 
   urlSecurityCheck(href, doc.nodePrincipal);
-  let params = { charset: doc.characterSet,
-                 allowMixedContent: persistAllowMixedContentInChildTab,
-                 referrerURI: referrerURI,
-                 referrerPolicy: referrerPolicy,
-                 noReferrer: BrowserUtils.linkHasNoReferrer(linkNode) };
+  let params = {
+    charset: doc.characterSet,
+    allowMixedContent: persistAllowMixedContentInChildTab,
+    referrerURI: referrerURI,
+    referrerPolicy: referrerPolicy,
+    noReferrer: BrowserUtils.linkHasNoReferrer(linkNode),
+    originPrincipal: doc.nodePrincipal,
+  };
 
   // The new tab/window must use the same userContextId
   if (doc.nodePrincipal.originAttributes.userContextId) {
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 5cd36097de9e..0c43e1554b68 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -507,6 +507,7 @@ var ClickEventHandler = {
           json.allowMixedContent = true;
         } catch (e) {}
       }
+      json.originPrincipal = ownerDoc.nodePrincipal;
 
       sendAsyncMessage("Content:Click", json);
       return;
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 2aca5ed14908..4f0ad432d846 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -965,6 +965,7 @@ nsContextMenu.prototype = {
 
   _openLinkInParameters : function (extra) {
     let params = { charset: gContextMenuContentData.charSet,
+                   originPrincipal: this.principal,
                    referrerURI: gContextMenuContentData.documentURIObject,
                    referrerPolicy: gContextMenuContentData.referrerPolicy,
                    noReferrer: this.linkHasNoReferrer };
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index e5db1fa93203..e29eb7231ac4 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1500,6 +1500,7 @@
             var aNoReferrer;
             var aUserContextId;
             var aRelatedBrowser;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
@@ -1518,6 +1519,7 @@
               aNoReferrer           = params.noReferrer;
               aUserContextId        = params.userContextId;
               aRelatedBrowser       = params.relatedBrowser;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             var bgLoad = (aLoadInBackground != null) ? aLoadInBackground :
@@ -1537,6 +1539,7 @@
                                   forceNotRemote: aForceNotRemote,
                                   noReferrer: aNoReferrer,
                                   userContextId: aUserContextId,
+                                  originPrincipal: aOriginPrincipal,
                                   relatedBrowser: aRelatedBrowser });
             if (!bgLoad)
               this.selectedTab = tab;
@@ -2043,6 +2046,7 @@
             var aUserContextId;
             var aEventDetail;
             var aRelatedBrowser;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
@@ -2062,6 +2066,7 @@
               aUserContextId        = params.userContextId;
               aEventDetail          = params.eventDetail;
               aRelatedBrowser       = params.relatedBrowser;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             // if we're adding tabs, we're past interrupt mode, ditch the owner
@@ -2141,6 +2146,10 @@
             var evt = new CustomEvent("TabOpen", { bubbles: true, detail });
             t.dispatchEvent(evt);
 
+            if (!usingPreloadedContent && aOriginPrincipal) {
+              b.createAboutBlankContentViewer(aOriginPrincipal);
+            }
+
             // If we didn't swap docShells with a preloaded browser
             // then let's just continue loading the page normally.
             if (!usingPreloadedContent && !uriIsAboutBlank) {
diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 7e40f041587b..f8b7b1b30eb2 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -342,6 +342,7 @@ subsuite = clipboard
 [browser_mixed_content_cert_override.js]
 [browser_mixedcontent_securityflags.js]
 tags = mcb
+[browser_modifiedclick_inherit_principal.js]
 [browser_offlineQuotaNotification.js]
 skip-if = buildapp == 'mulet'
 [browser_feed_discovery.js]
diff --git a/browser/base/content/test/general/browser_modifiedclick_inherit_principal.js b/browser/base/content/test/general/browser_modifiedclick_inherit_principal.js
new file mode 100644
index 000000000000..3b5a5a149492
--- /dev/null
+++ b/browser/base/content/test/general/browser_modifiedclick_inherit_principal.js
@@ -0,0 +1,30 @@
+"use strict";
+
+const kURL =
+  "http://example.com/browser/browser/base/content/test/general/dummy_page.html";
+  "data:text/html,<a href=''>Middle-click me</a>";
+
+/*
+ * Check that when manually opening content JS links in new tabs/windows,
+ * we use the correct principal, and we don't clear the URL bar.
+ */
+add_task(function* () {
+ yield BrowserTestUtils.withNewTab(kURL, function* (browser) {
+   let newTabPromise = BrowserTestUtils.waitForNewTab(gBrowser);
+   yield ContentTask.spawn(browser, null, function* () {
+     let a = content.document.createElement("a");
+     a.href = "javascript:document.write('spoof'); void(0);";
+     a.textContent = "Some link";
+     content.document.body.appendChild(a);
+   });
+   info("Added element");
+   yield BrowserTestUtils.synthesizeMouseAtCenter("a", {button: 1}, browser);
+   let newTab = yield newTabPromise;
+   is(newTab.linkedBrowser.contentPrincipal.origin, "http://example.com",
+      "Principal should be for example.com");
+   yield BrowserTestUtils.switchTab(gBrowser, newTab);
+   info(gURLBar.value);
+   isnot(gURLBar.value, "", "URL bar should not be empty.");
+   yield BrowserTestUtils.removeTab(newTab);
+ });
+});
diff --git a/browser/base/content/utilityOverlay.js b/browser/base/content/utilityOverlay.js
index 24de93c9a919..bfc73e9868ff 100644
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -222,6 +222,9 @@ function openLinkIn(url, where, params) {
   var aAllowPopups          = !!params.allowPopups;
   var aUserContextId        = params.userContextId;
   var aIndicateErrorPageLoad = params.indicateErrorPageLoad;
+  var aPrincipal            = params.originPrincipal;
+  var aForceAboutBlankViewerInCurrent =
+      params.forceAboutBlankViewerInCurrent;
 
   if (where == "save") {
     // TODO(1073187): propagate referrerPolicy.
@@ -290,6 +293,7 @@ function openLinkIn(url, where, params) {
     sa.AppendElement(allowThirdPartyFixupSupports);
     sa.AppendElement(referrerPolicySupports);
     sa.AppendElement(userContextIdSupports);
+    sa.AppendElement(aPrincipal);
 
     let features = "chrome,dialog=no,all";
     if (aIsPrivate) {
@@ -357,6 +361,10 @@ function openLinkIn(url, where, params) {
       flags |= Ci.nsIWebNavigation.LOAD_FLAGS_ERROR_LOAD_CHANGES_RV;
     }
 
+    if (aForceAboutBlankViewerInCurrent) {
+      w.gBrowser.selectedBrowser.createAboutBlankContentViewer(aPrincipal);
+    }
+
     w.gBrowser.loadURIWithFlags(url, {
       flags: flags,
       referrerURI: aNoReferrer ? null : aReferrerURI,
@@ -380,7 +388,8 @@ function openLinkIn(url, where, params) {
       skipAnimation: aSkipTabAnimation,
       allowMixedContent: aAllowMixedContent,
       noReferrer: aNoReferrer,
-      userContextId: aUserContextId
+      userContextId: aUserContextId,
+      originPrincipal: aPrincipal,
     });
     break;
   }
diff --git a/browser/modules/ContentClick.jsm b/browser/modules/ContentClick.jsm
index 679bcca71b79..8abc32525c63 100644
--- a/browser/modules/ContentClick.jsm
+++ b/browser/modules/ContentClick.jsm
@@ -77,12 +77,15 @@ var ContentClick = {
 
     // Todo(903022): code for where == save
 
-    let params = { charset: browser.characterSet,
-                   referrerURI: browser.documentURI,
-                   referrerPolicy: json.referrerPolicy,
-                   noReferrer: json.noReferrer,
-                   allowMixedContent: json.allowMixedContent,
-                   isContentWindowPrivate: json.isContentWindowPrivate};
+    let params = {
+      charset: browser.characterSet,
+      referrerURI: browser.documentURI,
+      referrerPolicy: json.referrerPolicy,
+      noReferrer: json.noReferrer,
+      allowMixedContent: json.allowMixedContent,
+      isContentWindowPrivate: json.isContentWindowPrivate,
+      originPrincipal: json.originPrincipal,
+    };
 
     // The new tab/window must use the same userContextId.
     if (json.originAttributes.userContextId) {
diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index 9d7c1e67eb19..c819e3db65f2 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -8,6 +8,7 @@ var Cu = Components.utils;
 var Cr = Components.results;
 
 Cu.import("resource://gre/modules/AppConstants.jsm");
+Cu.import("resource://gre/modules/BrowserUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import('resource://gre/modules/XPCOMUtils.jsm');
 Cu.import("resource://gre/modules/RemoteAddonsChild.jsm");
@@ -565,6 +566,18 @@ addMessageListener("Browser:Thumbnail:GetOriginalURL", function (aMessage) {
   });
 });
 
+/**
+ * Remote createAboutBlankContentViewer request handler.
+ */
+addMessageListener("Browser:CreateAboutBlank", function(aMessage) {
+  if (!content.document || content.document.documentURI != "about:blank") {
+    throw new Error("Can't create a content viewer unless on about:blank");
+  }
+  let principal = aMessage.data;
+  principal = BrowserUtils.principalWithMatchingOA(principal, content.document.nodePrincipal);
+  docShell.createAboutBlankContentViewer(principal);
+});
+
 // The AddonsChild needs to be rooted so that it stays alive as long as
 // the tab.
 var AddonsChild = RemoteAddonsChild.init(this);
diff --git a/toolkit/content/widgets/browser.xml b/toolkit/content/widgets/browser.xml
index 99f490ad6248..52bd7b758491 100644
--- a/toolkit/content/widgets/browser.xml
+++ b/toolkit/content/widgets/browser.xml
@@ -1038,6 +1038,16 @@
         </body>
       </method>
 
+      <method name="createAboutBlankContentViewer">
+        <parameter name="aPrincipal"/>
+        <body>
+          <![CDATA[
+            let principal = BrowserUtils.principalWithMatchingOA(aPrincipal, this.contentPrincipal);
+            this.docShell.createAboutBlankContentViewer(principal);
+          ]]>
+        </body>
+      </method>
+
       <field name="_AUTOSCROLL_SNAP">10</field>
       <field name="_scrolling">false</field>
       <field name="_startX">null</field>
diff --git a/toolkit/content/widgets/remote-browser.xml b/toolkit/content/widgets/remote-browser.xml
index dd7f74092ab2..5f2059295dcc 100644
--- a/toolkit/content/widgets/remote-browser.xml
+++ b/toolkit/content/widgets/remote-browser.xml
@@ -561,6 +561,15 @@
           ]]>
         </body>
       </method>
+
+      <method name="createAboutBlankContentViewer">
+        <parameter name="aPrincipal"/>
+        <body>
+          <![CDATA[
+            this.messageManager.sendAsyncMessage("Browser:CreateAboutBlank", aPrincipal);
+          ]]>
+        </body>
+      </method>
     </implementation>
     <handlers>
       <handler event="dragstart">
diff --git a/toolkit/modules/BrowserUtils.jsm b/toolkit/modules/BrowserUtils.jsm
index 993dfe5096a7..e883c508e5ea 100644
--- a/toolkit/modules/BrowserUtils.jsm
+++ b/toolkit/modules/BrowserUtils.jsm
@@ -82,6 +82,42 @@ this.BrowserUtils = {
     }
   },
 
+  /**
+   * Return or create a principal with the codebase of one, and the originAttributes
+   * of an existing principal (e.g. on a docshell, where the originAttributes ought
+   * not to change, that is, we should keep the userContextId, privateBrowsingId,
+   * etc. the same when changing the principal).
+   *
+   * @param principal
+   *        The principal whose codebase/null/system-ness we want.
+   * @param existingPrincipal
+   *        The principal whose originAttributes we want, usually the current
+   *        principal of a docshell.
+   * @return an nsIPrincipal that matches the codebase/null/system-ness of the first
+   *         param, and the originAttributes of the second.
+   */
+  principalWithMatchingOA(principal, existingPrincipal) {
+    // Don't care about system principals:
+    if (principal.isSystemPrincipal) {
+      return principal;
+    }
+
+    // If the originAttributes already match, just return the principal as-is.
+    if (existingPrincipal.originSuffix == principal.originSuffix) {
+      return principal;
+    }
+
+    let secMan = Services.scriptSecurityManager;
+    if (principal.isCodebasePrincipal) {
+      return secMan.createCodebasePrincipal(principal.URI, existingPrincipal.originAttributes);
+    }
+
+    if (principal.isNullPrincipal) {
+      return secMan.createNullPrincipal(existingPrincipal.originAttributes);
+    }
+    throw new Error("Can't change the originAttributes of an expanded principal!");
+  },
+
   /**
    * Constructs a new URI, using nsIIOService.
    * @param aURL The URI spec.

From 2cdba405f7aa53bcd08e17aa3e5888b8cdba19ec Mon Sep 17 00:00:00 2001
From: Philip Chee <philip.chee@gmail.com>
Date: Tue, 27 Sep 2016 16:48:14 +0800
Subject: [PATCH 018/102] Bug 1281005 - Move the nsPlacesAutocomplete component
 to Suite (mozilla-central part) r=mak77

---
 toolkit/components/places/moz.build           |    6 -
 .../components/places/nsPlacesAutoComplete.js | 1369 -----------------
 .../places/nsPlacesAutoComplete.manifest      |    3 -
 .../places/tests/autocomplete/.eslintrc       |    5 -
 .../tests/autocomplete/head_autocomplete.js   |  314 ----
 .../places/tests/autocomplete/test_416211.js  |   30 -
 .../places/tests/autocomplete/test_416214.js  |   38 -
 .../places/tests/autocomplete/test_417798.js  |   36 -
 .../places/tests/autocomplete/test_418257.js  |   43 -
 .../places/tests/autocomplete/test_422277.js  |   25 -
 ...st_autocomplete_on_value_removed_479089.js |   54 -
 .../test_download_embed_bookmarks.js          |   53 -
 .../tests/autocomplete/test_empty_search.js   |   69 -
 .../places/tests/autocomplete/test_enabled.js |   69 -
 .../tests/autocomplete/test_escape_self.js    |   30 -
 .../autocomplete/test_ignore_protocol.js      |   27 -
 .../tests/autocomplete/test_keyword_search.js |   73 -
 .../autocomplete/test_match_beginning.js      |   45 -
 .../autocomplete/test_multi_word_search.js    |   49 -
 .../tests/autocomplete/test_special_search.js |  183 ---
 .../tests/autocomplete/test_swap_protocol.js  |   63 -
 .../tests/autocomplete/test_tabmatches.js     |   97 --
 .../autocomplete/test_word_boundary_search.js |  105 --
 .../places/tests/autocomplete/xpcshell.ini    |   29 -
 toolkit/components/places/tests/moz.build     |    5 -
 25 files changed, 2820 deletions(-)
 delete mode 100644 toolkit/components/places/nsPlacesAutoComplete.js
 delete mode 100644 toolkit/components/places/nsPlacesAutoComplete.manifest
 delete mode 100644 toolkit/components/places/tests/autocomplete/.eslintrc
 delete mode 100644 toolkit/components/places/tests/autocomplete/head_autocomplete.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_416211.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_416214.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_417798.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_418257.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_422277.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_autocomplete_on_value_removed_479089.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_download_embed_bookmarks.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_empty_search.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_enabled.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_escape_self.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_ignore_protocol.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_keyword_search.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_match_beginning.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_multi_word_search.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_special_search.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_swap_protocol.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_tabmatches.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/test_word_boundary_search.js
 delete mode 100644 toolkit/components/places/tests/autocomplete/xpcshell.ini

diff --git a/toolkit/components/places/moz.build b/toolkit/components/places/moz.build
index a3788dcf63e2..55ab218ef885 100644
--- a/toolkit/components/places/moz.build
+++ b/toolkit/components/places/moz.build
@@ -85,12 +85,6 @@ if CONFIG['MOZ_PLACES']:
         'UnifiedComplete.js',
     ]
 
-    if CONFIG['MOZ_SUITE']:
-        EXTRA_COMPONENTS += [
-            'nsPlacesAutoComplete.js',
-            'nsPlacesAutoComplete.manifest',
-        ]
-
     FINAL_LIBRARY = 'xul'
 
 include('/ipc/chromium/chromium-config.mozbuild')
diff --git a/toolkit/components/places/nsPlacesAutoComplete.js b/toolkit/components/places/nsPlacesAutoComplete.js
deleted file mode 100644
index 30615fe072cc..000000000000
--- a/toolkit/components/places/nsPlacesAutoComplete.js
+++ /dev/null
@@ -1,1369 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
- * vim: sw=2 ts=2 sts=2 expandtab
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
-Components.utils.import("resource://gre/modules/Services.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "PlacesUtils",
-                                  "resource://gre/modules/PlacesUtils.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "TelemetryStopwatch",
-                                  "resource://gre/modules/TelemetryStopwatch.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
-                                  "resource://gre/modules/NetUtil.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "Task",
-                                  "resource://gre/modules/Task.jsm");
-
-////////////////////////////////////////////////////////////////////////////////
-//// Constants
-
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cr = Components.results;
-
-// This SQL query fragment provides the following:
-//   - whether the entry is bookmarked (kQueryIndexBookmarked)
-//   - the bookmark title, if it is a bookmark (kQueryIndexBookmarkTitle)
-//   - the tags associated with a bookmarked entry (kQueryIndexTags)
-const kBookTagSQLFragment =
-  `EXISTS(SELECT 1 FROM moz_bookmarks WHERE fk = h.id) AS bookmarked,
-   (
-     SELECT title FROM moz_bookmarks WHERE fk = h.id AND title NOTNULL
-     ORDER BY lastModified DESC LIMIT 1
-   ) AS btitle,
-   (
-     SELECT GROUP_CONCAT(t.title, ',')
-     FROM moz_bookmarks b
-     JOIN moz_bookmarks t ON t.id = +b.parent AND t.parent = :parent
-     WHERE b.fk = h.id
-   ) AS tags`;
-
-// observer topics
-const kTopicShutdown = "places-shutdown";
-const kPrefChanged = "nsPref:changed";
-
-// Match type constants.  These indicate what type of search function we should
-// be using.
-const MATCH_ANYWHERE = Ci.mozIPlacesAutoComplete.MATCH_ANYWHERE;
-const MATCH_BOUNDARY_ANYWHERE = Ci.mozIPlacesAutoComplete.MATCH_BOUNDARY_ANYWHERE;
-const MATCH_BOUNDARY = Ci.mozIPlacesAutoComplete.MATCH_BOUNDARY;
-const MATCH_BEGINNING = Ci.mozIPlacesAutoComplete.MATCH_BEGINNING;
-const MATCH_BEGINNING_CASE_SENSITIVE = Ci.mozIPlacesAutoComplete.MATCH_BEGINNING_CASE_SENSITIVE;
-
-// AutoComplete index constants.  All AutoComplete queries will provide these
-// columns in this order.
-const kQueryIndexURL = 0;
-const kQueryIndexTitle = 1;
-const kQueryIndexFaviconURL = 2;
-const kQueryIndexBookmarked = 3;
-const kQueryIndexBookmarkTitle = 4;
-const kQueryIndexTags = 5;
-const kQueryIndexVisitCount = 6;
-const kQueryIndexTyped = 7;
-const kQueryIndexPlaceId = 8;
-const kQueryIndexQueryType = 9;
-const kQueryIndexOpenPageCount = 10;
-
-// AutoComplete query type constants.  Describes the various types of queries
-// that we can process.
-const kQueryTypeKeyword = 0;
-const kQueryTypeFiltered = 1;
-
-// This separator is used as an RTL-friendly way to split the title and tags.
-// It can also be used by an nsIAutoCompleteResult consumer to re-split the
-// "comment" back into the title and the tag.
-const kTitleTagsSeparator = " \u2013 ";
-
-const kBrowserUrlbarBranch = "browser.urlbar.";
-// Toggle autocomplete.
-const kBrowserUrlbarAutocompleteEnabledPref = "autocomplete.enabled";
-
-////////////////////////////////////////////////////////////////////////////////
-//// Globals
-
-XPCOMUtils.defineLazyServiceGetter(this, "gTextURIService",
-                                   "@mozilla.org/intl/texttosuburi;1",
-                                   "nsITextToSubURI");
-
-////////////////////////////////////////////////////////////////////////////////
-//// Helpers
-
-/**
- * Initializes our temporary table on a given database.
- *
- * @param aDatabase
- *        The mozIStorageConnection to set up the temp table on.
- */
-function initTempTable(aDatabase)
-{
-  // Note: this should be kept up-to-date with the definition in
-  //       nsPlacesTables.h.
-  let stmt = aDatabase.createAsyncStatement(
-    `CREATE TEMP TABLE moz_openpages_temp (
-       url TEXT PRIMARY KEY
-     , open_count INTEGER
-     )`
-  );
-  stmt.executeAsync();
-  stmt.finalize();
-
-  // Note: this should be kept up-to-date with the definition in
-  //       nsPlacesTriggers.h.
-  stmt = aDatabase.createAsyncStatement(
-    `CREATE TEMPORARY TRIGGER moz_openpages_temp_afterupdate_trigger
-     AFTER UPDATE OF open_count ON moz_openpages_temp FOR EACH ROW
-     WHEN NEW.open_count = 0
-     BEGIN
-       DELETE FROM moz_openpages_temp
-       WHERE url = NEW.url;
-     END`
-  );
-  stmt.executeAsync();
-  stmt.finalize();
-}
-
-/**
- * Used to unescape encoded URI strings, and drop information that we do not
- * care about for searching.
- *
- * @param aURIString
- *        The text to unescape and modify.
- * @return the modified uri.
- */
-function fixupSearchText(aURIString)
-{
-  let uri = stripPrefix(aURIString);
-  return gTextURIService.unEscapeURIForUI("UTF-8", uri);
-}
-
-/**
- * Strip prefixes from the URI that we don't care about for searching.
- *
- * @param aURIString
- *        The text to modify.
- * @return the modified uri.
- */
-function stripPrefix(aURIString)
-{
-  let uri = aURIString;
-
-  if (uri.indexOf("http://") == 0) {
-    uri = uri.slice(7);
-  }
-  else if (uri.indexOf("https://") == 0) {
-    uri = uri.slice(8);
-  }
-  else if (uri.indexOf("ftp://") == 0) {
-    uri = uri.slice(6);
-  }
-
-  if (uri.indexOf("www.") == 0) {
-    uri = uri.slice(4);
-  }
-  return uri;
-}
-
-/**
- * safePrefGetter get the pref with type safety.
- * This will return the default value provided if no pref is set.
- *
- * @param aPrefBranch
- *        The nsIPrefBranch containing the required preference
- * @param aName
- *        A preference name
- * @param aDefault
- *        The preference's default value
- * @return the preference value or provided default
- */
-
-function safePrefGetter(aPrefBranch, aName, aDefault) {
-  let types = {
-    boolean: "Bool",
-    number: "Int",
-    string: "Char"
-  };
-  let type = types[typeof(aDefault)];
-  if (!type) {
-    throw "Unknown type!";
-  }
-
-  // If the pref isn't set, we want to use the default.
-  if (aPrefBranch.getPrefType(aName) == Ci.nsIPrefBranch.PREF_INVALID) {
-    return aDefault;
-  }
-  try {
-    return aPrefBranch["get" + type + "Pref"](aName);
-  }
-  catch (e) {
-    return aDefault;
-  }
-}
-
-/**
- * Whether UnifiedComplete is alive.
- */
-function isUnifiedCompleteInstantiated() {
-  try {
-    return Components.manager.QueryInterface(Ci.nsIServiceManager)
-                     .isServiceInstantiated(Cc["@mozilla.org/autocomplete/search;1?name=unifiedcomplete"],
-                                            Ci.mozIPlacesAutoComplete);
-  } catch (ex) {
-    return false;
-  }
-}
-
-////////////////////////////////////////////////////////////////////////////////
-//// AutoCompleteStatementCallbackWrapper class
-
-/**
- * Wraps a callback and ensures that handleCompletion is not dispatched if the
- * query is no longer tracked.
- *
- * @param aAutocomplete
- *        A reference to a nsPlacesAutoComplete.
- * @param aCallback
- *        A reference to a mozIStorageStatementCallback
- * @param aDBConnection
- *        The database connection to execute the queries on.
- */
-function AutoCompleteStatementCallbackWrapper(aAutocomplete, aCallback,
-                                              aDBConnection)
-{
-  this._autocomplete = aAutocomplete;
-  this._callback = aCallback;
-  this._db = aDBConnection;
-}
-
-AutoCompleteStatementCallbackWrapper.prototype = {
-  //////////////////////////////////////////////////////////////////////////////
-  //// mozIStorageStatementCallback
-
-  handleResult: function ACSCW_handleResult(aResultSet)
-  {
-    this._callback.handleResult.apply(this._callback, arguments);
-  },
-
-  handleError: function ACSCW_handleError(aError)
-  {
-    this._callback.handleError.apply(this._callback, arguments);
-  },
-
-  handleCompletion: function ACSCW_handleCompletion(aReason)
-  {
-    // Only dispatch handleCompletion if we are not done searching and are a
-    // pending search.
-    if (!this._autocomplete.isSearchComplete() &&
-        this._autocomplete.isPendingSearch(this._handle)) {
-      this._callback.handleCompletion.apply(this._callback, arguments);
-    }
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// AutoCompleteStatementCallbackWrapper
-
-  /**
-   * Executes the specified query asynchronously.  This object will notify
-   * this._callback if we should notify (logic explained in handleCompletion).
-   *
-   * @param aQueries
-   *        The queries to execute asynchronously.
-   * @return a mozIStoragePendingStatement that can be used to cancel the
-   *         queries.
-   */
-  executeAsync: function ACSCW_executeAsync(aQueries)
-  {
-    return this._handle = this._db.executeAsync(aQueries, aQueries.length,
-                                                this);
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsISupports
-
-  QueryInterface: XPCOMUtils.generateQI([
-    Ci.mozIStorageStatementCallback,
-  ])
-};
-
-////////////////////////////////////////////////////////////////////////////////
-//// nsPlacesAutoComplete class
-//// @mozilla.org/autocomplete/search;1?name=history
-
-function nsPlacesAutoComplete()
-{
-  //////////////////////////////////////////////////////////////////////////////
-  //// Shared Constants for Smart Getters
-
-  // TODO bug 412736 in case of a frecency tie, break it with h.typed and
-  // h.visit_count which is better than nothing.  This is slow, so not doing it
-  // yet...
-  function baseQuery(conditions = "") {
-    let query = `SELECT h.url, h.title, f.url, ${kBookTagSQLFragment},
-                        h.visit_count, h.typed, h.id, :query_type,
-                        t.open_count
-                 FROM moz_places h
-                 LEFT JOIN moz_favicons f ON f.id = h.favicon_id
-                 LEFT JOIN moz_openpages_temp t ON t.url = h.url
-                 WHERE h.frecency <> 0
-                   AND AUTOCOMPLETE_MATCH(:searchString, h.url,
-                                          IFNULL(btitle, h.title), tags,
-                                          h.visit_count, h.typed,
-                                          bookmarked, t.open_count,
-                                          :matchBehavior, :searchBehavior)
-                 ${conditions}
-                 ORDER BY h.frecency DESC, h.id DESC
-                 LIMIT :maxResults`;
-    return query;
-  }
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// Smart Getters
-
-  XPCOMUtils.defineLazyGetter(this, "_db", function() {
-    // Get a cloned, read-only version of the database.  We'll only ever write
-    // to our own in-memory temp table, and having a cloned copy means we do not
-    // run the risk of our queries taking longer due to the main database
-    // connection performing a long-running task.
-    let db = PlacesUtils.history.DBConnection.clone(true);
-
-    // Autocomplete often fallbacks to a table scan due to lack of text indices.
-    // In such cases a larger cache helps reducing IO.  The default Storage
-    // value is MAX_CACHE_SIZE_BYTES in storage/mozStorageConnection.cpp.
-    let stmt = db.createAsyncStatement("PRAGMA cache_size = -6144"); // 6MiB
-    stmt.executeAsync();
-    stmt.finalize();
-
-    // Create our in-memory tables for tab tracking.
-    initTempTable(db);
-
-    // Populate the table with current open pages cache contents.
-    if (this._openPagesCache.length > 0) {
-      // Avoid getter re-entrance from the _registerOpenPageQuery lazy getter.
-      let stmt = this._registerOpenPageQuery =
-        db.createAsyncStatement(this._registerOpenPageQuerySQL);
-      let params = stmt.newBindingParamsArray();
-      for (let i = 0; i < this._openPagesCache.length; i++) {
-        let bp = params.newBindingParams();
-        bp.bindByName("page_url", this._openPagesCache[i]);
-        params.addParams(bp);
-      }
-      stmt.bindParameters(params);
-      stmt.executeAsync();
-      stmt.finalize();
-      delete this._openPagesCache;
-    }
-
-    return db;
-  });
-
-  this._customQuery = (conditions = "") => {
-    return this._db.createAsyncStatement(baseQuery(conditions));
-  };
-
-  XPCOMUtils.defineLazyGetter(this, "_defaultQuery", function() {
-    return this._db.createAsyncStatement(baseQuery());
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_historyQuery", function() {
-    // Enforce ignoring the visit_count index, since the frecency one is much
-    // faster in this case.  ANALYZE helps the query planner to figure out the
-    // faster path, but it may not have run yet.
-    return this._db.createAsyncStatement(baseQuery("AND +h.visit_count > 0"));
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_bookmarkQuery", function() {
-    return this._db.createAsyncStatement(baseQuery("AND bookmarked"));
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_tagsQuery", function() {
-    return this._db.createAsyncStatement(baseQuery("AND tags IS NOT NULL"));
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_openPagesQuery", function() {
-    return this._db.createAsyncStatement(
-      `SELECT t.url, t.url, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-              :query_type, t.open_count, NULL
-       FROM moz_openpages_temp t
-       LEFT JOIN moz_places h ON h.url_hash = hash(t.url) AND h.url = t.url
-       WHERE h.id IS NULL
-         AND AUTOCOMPLETE_MATCH(:searchString, t.url, t.url, NULL,
-                                NULL, NULL, NULL, t.open_count,
-                                :matchBehavior, :searchBehavior)
-       ORDER BY t.ROWID DESC
-       LIMIT :maxResults`
-    );
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_typedQuery", function() {
-    return this._db.createAsyncStatement(baseQuery("AND h.typed = 1"));
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_adaptiveQuery", function() {
-    return this._db.createAsyncStatement(
-      `/* do not warn (bug 487789) */
-       SELECT h.url, h.title, f.url, ${kBookTagSQLFragment},
-              h.visit_count, h.typed, h.id, :query_type, t.open_count
-       FROM (
-       SELECT ROUND(
-           MAX(use_count) * (1 + (input = :search_string)), 1
-         ) AS rank, place_id
-         FROM moz_inputhistory
-         WHERE input BETWEEN :search_string AND :search_string || X'FFFF'
-         GROUP BY place_id
-       ) AS i
-       JOIN moz_places h ON h.id = i.place_id
-       LEFT JOIN moz_favicons f ON f.id = h.favicon_id
-       LEFT JOIN moz_openpages_temp t ON t.url = h.url
-       WHERE AUTOCOMPLETE_MATCH(NULL, h.url,
-                                IFNULL(btitle, h.title), tags,
-                                h.visit_count, h.typed, bookmarked,
-                                t.open_count,
-                                :matchBehavior, :searchBehavior)
-       ORDER BY rank DESC, h.frecency DESC`
-    );
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_keywordQuery", function() {
-    return this._db.createAsyncStatement(
-      `/* do not warn (bug 487787) */
-       SELECT REPLACE(h.url, '%s', :query_string) AS search_url, h.title,
-       IFNULL(f.url, (SELECT f.url
-                      FROM moz_places
-                      JOIN moz_favicons f ON f.id = favicon_id
-                      WHERE rev_host = h.rev_host
-                      ORDER BY frecency DESC
-                      LIMIT 1)
-       ), 1, NULL, NULL, h.visit_count, h.typed, h.id,
-       :query_type, t.open_count
-       FROM moz_keywords k
-       JOIN moz_places h ON k.place_id = h.id
-       LEFT JOIN moz_favicons f ON f.id = h.favicon_id
-       LEFT JOIN moz_openpages_temp t ON t.url = search_url
-       WHERE k.keyword = LOWER(:keyword)`
-    );
-  });
-
-  this._registerOpenPageQuerySQL =
-    `INSERT OR REPLACE INTO moz_openpages_temp (url, open_count)
-       VALUES (:page_url,
-         IFNULL(
-           (
-             SELECT open_count + 1
-             FROM moz_openpages_temp
-             WHERE url = :page_url
-           ),
-           1
-         )
-       )`;
-  XPCOMUtils.defineLazyGetter(this, "_registerOpenPageQuery", function() {
-    return this._db.createAsyncStatement(this._registerOpenPageQuerySQL);
-  });
-
-  XPCOMUtils.defineLazyGetter(this, "_unregisterOpenPageQuery", function() {
-    return this._db.createAsyncStatement(
-      `UPDATE moz_openpages_temp
-       SET open_count = open_count - 1
-       WHERE url = :page_url`
-    );
-  });
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// Initialization
-
-  // load preferences
-  this._prefs = Cc["@mozilla.org/preferences-service;1"].
-                getService(Ci.nsIPrefService).
-                getBranch(kBrowserUrlbarBranch);
-  this._syncEnabledPref();
-  this._loadPrefs(true);
-
-  // register observers
-  this._os = Cc["@mozilla.org/observer-service;1"].
-              getService(Ci.nsIObserverService);
-  this._os.addObserver(this, kTopicShutdown, false);
-
-}
-
-nsPlacesAutoComplete.prototype = {
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsIAutoCompleteSearch
-
-  startSearch: function PAC_startSearch(aSearchString, aSearchParam,
-                                        aPreviousResult, aListener)
-  {
-    // Stop the search in case the controller has not taken care of it.
-    this.stopSearch();
-
-    // Note: We don't use aPreviousResult to make sure ordering of results are
-    //       consistent.  See bug 412730 for more details.
-
-    // We want to store the original string with no leading or trailing
-    // whitespace for case sensitive searches.
-    this._originalSearchString = aSearchString.trim();
-
-    this._currentSearchString =
-      fixupSearchText(this._originalSearchString.toLowerCase());
-
-    let params = new Set(aSearchParam.split(" "));
-    this._enableActions = params.has("enable-actions");
-    this._disablePrivateActions = params.has("disable-private-actions");
-
-    this._listener = aListener;
-    let result = Cc["@mozilla.org/autocomplete/simple-result;1"].
-                 createInstance(Ci.nsIAutoCompleteSimpleResult);
-    result.setSearchString(aSearchString);
-    result.setListener(this);
-    this._result = result;
-
-    // If we are not enabled, we need to return now.
-    if (!this._enabled) {
-      this._finishSearch(true);
-      return;
-    }
-
-    // Reset our search behavior to the default.
-    if (this._currentSearchString) {
-      this._behavior = this._defaultBehavior;
-    }
-    else {
-      this._behavior = this._emptySearchDefaultBehavior;
-    }
-    // For any given search, we run up to four queries:
-    // 1) keywords (this._keywordQuery)
-    // 2) adaptive learning (this._adaptiveQuery)
-    // 3) open pages not supported by history (this._openPagesQuery)
-    // 4) query from this._getSearch
-    // (1) only gets ran if we get any filtered tokens from this._getSearch,
-    // since if there are no tokens, there is nothing to match, so there is no
-    // reason to run the query).
-    let {query, tokens} =
-      this._getSearch(this._getUnfilteredSearchTokens(this._currentSearchString));
-    let queries = tokens.length ?
-      [this._getBoundKeywordQuery(tokens), this._getBoundAdaptiveQuery()] :
-      [this._getBoundAdaptiveQuery()];
-
-    if (this._hasBehavior("openpage")) {
-      queries.push(this._getBoundOpenPagesQuery(tokens));
-    }
-    queries.push(query);
-
-    // Start executing our queries.
-    this._telemetryStartTime = Date.now();
-    this._executeQueries(queries);
-
-    // Set up our persistent state for the duration of the search.
-    this._searchTokens = tokens;
-    this._usedPlaces = {};
-  },
-
-  stopSearch: function PAC_stopSearch()
-  {
-    // We need to cancel our searches so we do not get any [more] results.
-    // However, it's possible we haven't actually started any searches, so this
-    // method may throw because this._pendingQuery may be undefined.
-    if (this._pendingQuery) {
-      this._stopActiveQuery();
-    }
-
-    this._finishSearch(false);
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsIAutoCompleteSimpleResultListener
-
-  onValueRemoved: function PAC_onValueRemoved(aResult, aURISpec, aRemoveFromDB)
-  {
-    if (aRemoveFromDB) {
-      PlacesUtils.history.removePage(NetUtil.newURI(aURISpec));
-    }
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// mozIPlacesAutoComplete
-
-  // If the connection has not yet been started, use this local cache.  This
-  // prevents autocomplete from initing the database till the first search.
-  _openPagesCache: [],
-  registerOpenPage: function PAC_registerOpenPage(aURI)
-  {
-    if (!this._databaseInitialized) {
-      this._openPagesCache.push(aURI.spec);
-      return;
-    }
-
-    let stmt = this._registerOpenPageQuery;
-    stmt.params.page_url = aURI.spec;
-    stmt.executeAsync();
-  },
-
-  unregisterOpenPage: function PAC_unregisterOpenPage(aURI)
-  {
-    if (!this._databaseInitialized) {
-      let index = this._openPagesCache.indexOf(aURI.spec);
-      if (index != -1) {
-        this._openPagesCache.splice(index, 1);
-      }
-      return;
-    }
-
-    let stmt = this._unregisterOpenPageQuery;
-    stmt.params.page_url = aURI.spec;
-    stmt.executeAsync();
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// mozIStorageStatementCallback
-
-  handleResult: function PAC_handleResult(aResultSet)
-  {
-    let row, haveMatches = false;
-    while ((row = aResultSet.getNextRow())) {
-      let match = this._processRow(row);
-      haveMatches = haveMatches || match;
-
-      if (this._result.matchCount == this._maxRichResults) {
-        // We have enough results, so stop running our search.
-        this._stopActiveQuery();
-
-        // And finish our search.
-        this._finishSearch(true);
-        return;
-      }
-
-    }
-
-    // Notify about results if we've gotten them.
-    if (haveMatches) {
-      this._notifyResults(true);
-    }
-  },
-
-  handleError: function PAC_handleError(aError)
-  {
-    Components.utils.reportError("Places AutoComplete: An async statement encountered an " +
-                                 "error: " + aError.result + ", '" + aError.message + "'");
-  },
-
-  handleCompletion: function PAC_handleCompletion(aReason)
-  {
-    // If we have already finished our search, we should bail out early.
-    if (this.isSearchComplete()) {
-      return;
-    }
-
-    // If we do not have enough results, and our match type is
-    // MATCH_BOUNDARY_ANYWHERE, search again with MATCH_ANYWHERE to get more
-    // results.
-    if (this._matchBehavior == MATCH_BOUNDARY_ANYWHERE &&
-        this._result.matchCount < this._maxRichResults && !this._secondPass) {
-      this._secondPass = true;
-      let queries = [
-        this._getBoundAdaptiveQuery(MATCH_ANYWHERE),
-        this._getBoundSearchQuery(MATCH_ANYWHERE, this._searchTokens),
-      ];
-      this._executeQueries(queries);
-      return;
-    }
-
-    this._finishSearch(true);
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsIObserver
-
-  observe: function PAC_observe(aSubject, aTopic, aData)
-  {
-    if (aTopic == kTopicShutdown) {
-      this._os.removeObserver(this, kTopicShutdown);
-
-      // Remove our preference observer.
-      this._prefs.removeObserver("", this);
-      delete this._prefs;
-
-      // Finalize the statements that we have used.
-      let stmts = [
-        "_defaultQuery",
-        "_historyQuery",
-        "_bookmarkQuery",
-        "_tagsQuery",
-        "_openPagesQuery",
-        "_typedQuery",
-        "_adaptiveQuery",
-        "_keywordQuery",
-        "_registerOpenPageQuery",
-        "_unregisterOpenPageQuery",
-      ];
-      for (let i = 0; i < stmts.length; i++) {
-        // We do not want to create any query we haven't already created, so
-        // see if it is a getter first.
-        if (Object.getOwnPropertyDescriptor(this, stmts[i]).value !== undefined) {
-          this[stmts[i]].finalize();
-        }
-      }
-
-      if (this._databaseInitialized) {
-        this._db.asyncClose();
-      }
-    }
-    else if (aTopic == kPrefChanged) {
-      // Avoid re-entrancy when flipping linked preferences.
-      if (this._ignoreNotifications)
-        return;
-      this._ignoreNotifications = true;
-      this._loadPrefs(false, aTopic, aData);
-      this._ignoreNotifications = false;
-    }
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsPlacesAutoComplete
-
-  get _databaseInitialized() {
-    return Object.getOwnPropertyDescriptor(this, "_db").value !== undefined;
-  },
-
-  /**
-   * Generates the tokens used in searching from a given string.
-   *
-   * @param aSearchString
-   *        The string to generate tokens from.
-   * @return an array of tokens.
-   */
-  _getUnfilteredSearchTokens: function PAC_unfilteredSearchTokens(aSearchString)
-  {
-    // Calling split on an empty string will return an array containing one
-    // empty string.  We don't want that, as it'll break our logic, so return an
-    // empty array then.
-    return aSearchString.length ? aSearchString.split(" ") : [];
-  },
-
-  /**
-   * Properly cleans up when searching is completed.
-   *
-   * @param aNotify
-   *        Indicates if we should notify the AutoComplete listener about our
-   *        results or not.
-   */
-  _finishSearch: function PAC_finishSearch(aNotify)
-  {
-    // Notify about results if we are supposed to.
-    if (aNotify) {
-      this._notifyResults(false);
-    }
-
-    // Clear our state
-    delete this._originalSearchString;
-    delete this._currentSearchString;
-    delete this._strippedPrefix;
-    delete this._searchTokens;
-    delete this._listener;
-    delete this._result;
-    delete this._usedPlaces;
-    delete this._pendingQuery;
-    this._secondPass = false;
-    this._enableActions = false;
-  },
-
-  /**
-   * Executes the given queries asynchronously.
-   *
-   * @param aQueries
-   *        The queries to execute.
-   */
-  _executeQueries: function PAC_executeQueries(aQueries)
-  {
-    // Because we might get a handleCompletion for canceled queries, we want to
-    // filter out queries we no longer care about (described in the
-    // handleCompletion implementation of AutoCompleteStatementCallbackWrapper).
-
-    // Create our wrapper object and execute the queries.
-    let wrapper = new AutoCompleteStatementCallbackWrapper(this, this, this._db);
-    this._pendingQuery = wrapper.executeAsync(aQueries);
-  },
-
-  /**
-   * Stops executing our active query.
-   */
-  _stopActiveQuery: function PAC_stopActiveQuery()
-  {
-    this._pendingQuery.cancel();
-    delete this._pendingQuery;
-  },
-
-  /**
-   * Notifies the listener about results.
-   *
-   * @param aSearchOngoing
-   *        Indicates if the search is ongoing or not.
-   */
-  _notifyResults: function PAC_notifyResults(aSearchOngoing)
-  {
-    let result = this._result;
-    let resultCode = result.matchCount ? "RESULT_SUCCESS" : "RESULT_NOMATCH";
-    if (aSearchOngoing) {
-      resultCode += "_ONGOING";
-    }
-    result.setSearchResult(Ci.nsIAutoCompleteResult[resultCode]);
-    this._listener.onSearchResult(this, result);
-    if (this._telemetryStartTime) {
-      let elapsed = Date.now() - this._telemetryStartTime;
-      if (elapsed > 50) {
-        try {
-          Services.telemetry
-                  .getHistogramById("PLACES_AUTOCOMPLETE_1ST_RESULT_TIME_MS")
-                  .add(elapsed);
-        } catch (ex) {
-          Components.utils.reportError("Unable to report telemetry.");
-        }
-      }
-      this._telemetryStartTime = null;
-    }
-  },
-
-  /**
-   * Synchronize suggest.* prefs with autocomplete.enabled.
-   */
-  _syncEnabledPref: function PAC_syncEnabledPref()
-  {
-    let suggestPrefs = ["suggest.history", "suggest.bookmark", "suggest.openpage"];
-    let types = ["History", "Bookmark", "Openpage"];
-
-    this._enabled = safePrefGetter(this._prefs, kBrowserUrlbarAutocompleteEnabledPref,
-                                   true);
-    this._suggestHistory = safePrefGetter(this._prefs, "suggest.history", true);
-    this._suggestBookmark = safePrefGetter(this._prefs, "suggest.bookmark", true);
-    this._suggestOpenpage = safePrefGetter(this._prefs, "suggest.openpage", true);
-
-    if (this._enabled) {
-      // If the autocomplete preference is active, activate all suggest
-      // preferences only if all of them are false.
-      if (types.every(type => this["_suggest" + type] == false)) {
-        for (let type of suggestPrefs) {
-          this._prefs.setBoolPref(type, true);
-        }
-      }
-    } else {
-      // If the preference was deactivated, deactivate all suggest preferences.
-      for (let type of suggestPrefs) {
-        this._prefs.setBoolPref(type, false);
-      }
-    }
-  },
-
-  /**
-   * Loads the preferences that we care about.
-   *
-   * @param [optional] aRegisterObserver
-   *        Indicates if the preference observer should be added or not.  The
-   *        default value is false.
-   * @param [optional] aTopic
-   *        Observer's topic, if any.
-   * @param [optional] aSubject
-   *        Observer's subject, if any.
-   */
-  _loadPrefs: function PAC_loadPrefs(aRegisterObserver, aTopic, aData)
-  {
-    // Avoid race conditions with UnifiedComplete component.
-    if (aData && !isUnifiedCompleteInstantiated()) {
-      // Synchronize suggest.* prefs with autocomplete.enabled.
-      if (aData == kBrowserUrlbarAutocompleteEnabledPref) {
-        this._syncEnabledPref();
-      } else if (aData.startsWith("suggest.")) {
-        let suggestPrefs = ["suggest.history", "suggest.bookmark", "suggest.openpage"];
-        this._prefs.setBoolPref(kBrowserUrlbarAutocompleteEnabledPref,
-                                suggestPrefs.some(pref => safePrefGetter(this._prefs, pref, true)));
-      }
-    }
-
-    this._enabled = safePrefGetter(this._prefs,
-                                   kBrowserUrlbarAutocompleteEnabledPref,
-                                   true);
-    this._matchBehavior = safePrefGetter(this._prefs,
-                                         "matchBehavior",
-                                         MATCH_BOUNDARY_ANYWHERE);
-    this._filterJavaScript = safePrefGetter(this._prefs, "filter.javascript", true);
-    this._maxRichResults = safePrefGetter(this._prefs, "maxRichResults", 25);
-    this._restrictHistoryToken = safePrefGetter(this._prefs,
-                                                "restrict.history", "^");
-    this._restrictBookmarkToken = safePrefGetter(this._prefs,
-                                                 "restrict.bookmark", "*");
-    this._restrictTypedToken = safePrefGetter(this._prefs, "restrict.typed", "~");
-    this._restrictTagToken = safePrefGetter(this._prefs, "restrict.tag", "+");
-    this._restrictOpenPageToken = safePrefGetter(this._prefs,
-                                                 "restrict.openpage", "%");
-    this._matchTitleToken = safePrefGetter(this._prefs, "match.title", "#");
-    this._matchURLToken = safePrefGetter(this._prefs, "match.url", "@");
-
-    this._suggestHistory = safePrefGetter(this._prefs, "suggest.history", true);
-    this._suggestBookmark = safePrefGetter(this._prefs, "suggest.bookmark", true);
-    this._suggestOpenpage = safePrefGetter(this._prefs, "suggest.openpage", true);
-    this._suggestTyped = safePrefGetter(this._prefs, "suggest.history.onlyTyped", false);
-
-    // If history is not set, onlyTyped value should be ignored.
-    if (!this._suggestHistory) {
-      this._suggestTyped = false;
-    }
-    let types = ["History", "Bookmark", "Openpage", "Typed"];
-    this._defaultBehavior = types.reduce((memo, type) => {
-      let prefValue = this["_suggest" + type];
-      return memo | (prefValue &&
-                     Ci.mozIPlacesAutoComplete["BEHAVIOR_" + type.toUpperCase()]);
-    }, 0);
-
-    // Further restrictions to apply for "empty searches" (i.e. searches for "").
-    // The empty behavior is typed history, if history is enabled. Otherwise,
-    // it is bookmarks, if they are enabled. If both history and bookmarks are disabled,
-    // it defaults to open pages.
-    this._emptySearchDefaultBehavior = Ci.mozIPlacesAutoComplete.BEHAVIOR_RESTRICT;
-    if (this._suggestHistory) {
-      this._emptySearchDefaultBehavior |= Ci.mozIPlacesAutoComplete.BEHAVIOR_HISTORY |
-                                          Ci.mozIPlacesAutoComplete.BEHAVIOR_TYPED;
-    } else if (this._suggestBookmark) {
-      this._emptySearchDefaultBehavior |= Ci.mozIPlacesAutoComplete.BEHAVIOR_BOOKMARK;
-    } else {
-      this._emptySearchDefaultBehavior |= Ci.mozIPlacesAutoComplete.BEHAVIOR_OPENPAGE;
-    }
-
-    // Validate matchBehavior; default to MATCH_BOUNDARY_ANYWHERE.
-    if (this._matchBehavior != MATCH_ANYWHERE &&
-        this._matchBehavior != MATCH_BOUNDARY &&
-        this._matchBehavior != MATCH_BEGINNING) {
-      this._matchBehavior = MATCH_BOUNDARY_ANYWHERE;
-    }
-    // register observer
-    if (aRegisterObserver) {
-      this._prefs.addObserver("", this, false);
-    }
-  },
-
-  /**
-   * Given an array of tokens, this function determines which query should be
-   * ran.  It also removes any special search tokens.
-   *
-   * @param aTokens
-   *        An array of search tokens.
-   * @return an object with two properties:
-   *         query: the correctly optimized, bound query to search the database
-   *                with.
-   *         tokens: the filtered list of tokens to search with.
-   */
-  _getSearch: function PAC_getSearch(aTokens)
-  {
-    let foundToken = false;
-    let restrict = (behavior) => {
-      if (!foundToken) {
-        this._behavior = 0;
-        this._setBehavior("restrict");
-        foundToken = true;
-      }
-      this._setBehavior(behavior);
-    };
-
-    // Set the proper behavior so our call to _getBoundSearchQuery gives us the
-    // correct query.
-    for (let i = aTokens.length - 1; i >= 0; i--) {
-      switch (aTokens[i]) {
-        case this._restrictHistoryToken:
-          restrict("history");
-          break;
-        case this._restrictBookmarkToken:
-          restrict("bookmark");
-          break;
-        case this._restrictTagToken:
-          restrict("tag");
-          break;
-        case this._restrictOpenPageToken:
-          if (!this._enableActions) {
-            continue;
-          }
-          restrict("openpage");
-          break;
-        case this._matchTitleToken:
-          restrict("title");
-          break;
-        case this._matchURLToken:
-          restrict("url");
-          break;
-        case this._restrictTypedToken:
-          restrict("typed");
-          break;
-        default:
-          // We do not want to remove the token if we did not match.
-          continue;
-      }
-
-      aTokens.splice(i, 1);
-    }
-
-    // Set the right JavaScript behavior based on our preference.  Note that the
-    // preference is whether or not we should filter JavaScript, and the
-    // behavior is if we should search it or not.
-    if (!this._filterJavaScript) {
-      this._setBehavior("javascript");
-    }
-
-    return {
-      query: this._getBoundSearchQuery(this._matchBehavior, aTokens),
-      tokens: aTokens
-    };
-  },
-
-  /**
-   * @return a string consisting of the search query to be used based on the
-   * previously set urlbar suggestion preferences.
-   */
-  _getSuggestionPrefQuery: function PAC_getSuggestionPrefQuery()
-  {
-    if (!this._hasBehavior("restrict") && this._hasBehavior("history") &&
-        this._hasBehavior("bookmark")) {
-      return this._hasBehavior("typed") ? this._customQuery("AND h.typed = 1")
-                                        : this._defaultQuery;
-    }
-    let conditions = [];
-    if (this._hasBehavior("history")) {
-      // Enforce ignoring the visit_count index, since the frecency one is much
-      // faster in this case.  ANALYZE helps the query planner to figure out the
-      // faster path, but it may not have up-to-date information yet.
-      conditions.push("+h.visit_count > 0");
-    }
-    if (this._hasBehavior("typed")) {
-      conditions.push("h.typed = 1");
-    }
-    if (this._hasBehavior("bookmark")) {
-      conditions.push("bookmarked");
-    }
-    if (this._hasBehavior("tag")) {
-      conditions.push("tags NOTNULL");
-    }
-
-    return conditions.length ? this._customQuery("AND " + conditions.join(" AND "))
-                             : this._defaultQuery;
-  },
-
-  /**
-   * Obtains the search query to be used based on the previously set search
-   * behaviors (accessed by this._hasBehavior).  The query is bound and ready to
-   * execute.
-   *
-   * @param aMatchBehavior
-   *        How this query should match its tokens to the search string.
-   * @param aTokens
-   *        An array of search tokens.
-   * @return the correctly optimized query to search the database with and the
-   *         new list of tokens to search with.  The query has all the needed
-   *         parameters bound, so consumers can execute it without doing any
-   *         additional work.
-   */
-  _getBoundSearchQuery: function PAC_getBoundSearchQuery(aMatchBehavior,
-                                                         aTokens)
-  {
-    let query = this._getSuggestionPrefQuery();
-
-    // Bind the needed parameters to the query so consumers can use it.
-    let params = query.params;
-    params.parent = PlacesUtils.tagsFolderId;
-    params.query_type = kQueryTypeFiltered;
-    params.matchBehavior = aMatchBehavior;
-    params.searchBehavior = this._behavior;
-
-    // We only want to search the tokens that we are left with - not the
-    // original search string.
-    params.searchString = aTokens.join(" ");
-
-    // Limit the query to the the maximum number of desired results.
-    // This way we can avoid doing more work than needed.
-    params.maxResults = this._maxRichResults;
-
-    return query;
-  },
-
-  _getBoundOpenPagesQuery: function PAC_getBoundOpenPagesQuery(aTokens)
-  {
-    let query = this._openPagesQuery;
-
-    // Bind the needed parameters to the query so consumers can use it.
-    let params = query.params;
-    params.query_type = kQueryTypeFiltered;
-    params.matchBehavior = this._matchBehavior;
-    params.searchBehavior = this._behavior;
-
-    // We only want to search the tokens that we are left with - not the
-    // original search string.
-    params.searchString = aTokens.join(" ");
-    params.maxResults = this._maxRichResults;
-
-    return query;
-  },
-
-  /**
-   * Obtains the keyword query with the properly bound parameters.
-   *
-   * @param aTokens
-   *        The array of search tokens to check against.
-   * @return the bound keyword query.
-   */
-  _getBoundKeywordQuery: function PAC_getBoundKeywordQuery(aTokens)
-  {
-    // The keyword is the first word in the search string, with the parameters
-    // following it.
-    let searchString = this._originalSearchString;
-    let queryString = "";
-    let queryIndex = searchString.indexOf(" ");
-    if (queryIndex != -1) {
-      queryString = searchString.substring(queryIndex + 1);
-    }
-    // We need to escape the parameters as if they were the query in a URL
-    queryString = encodeURIComponent(queryString).replace(/%20/g, "+");
-
-    // The first word could be a keyword, so that's what we'll search.
-    let keyword = aTokens[0];
-
-    let query = this._keywordQuery;
-    let params = query.params;
-    params.keyword = keyword;
-    params.query_string = queryString;
-    params.query_type = kQueryTypeKeyword;
-
-    return query;
-  },
-
-  /**
-   * Obtains the adaptive query with the properly bound parameters.
-   *
-   * @return the bound adaptive query.
-   */
-  _getBoundAdaptiveQuery: function PAC_getBoundAdaptiveQuery(aMatchBehavior)
-  {
-    // If we were not given a match behavior, use the stored match behavior.
-    if (arguments.length == 0) {
-      aMatchBehavior = this._matchBehavior;
-    }
-
-    let query = this._adaptiveQuery;
-    let params = query.params;
-    params.parent = PlacesUtils.tagsFolderId;
-    params.search_string = this._currentSearchString;
-    params.query_type = kQueryTypeFiltered;
-    params.matchBehavior = aMatchBehavior;
-    params.searchBehavior = this._behavior;
-
-    return query;
-  },
-
-  /**
-   * Processes a mozIStorageRow to generate the proper data for the AutoComplete
-   * result.  This will add an entry to the current result if it matches the
-   * criteria.
-   *
-   * @param aRow
-   *        The row to process.
-   * @return true if the row is accepted, and false if not.
-   */
-  _processRow: function PAC_processRow(aRow)
-  {
-    // Before we do any work, make sure this entry isn't already in our results.
-    let entryId = aRow.getResultByIndex(kQueryIndexPlaceId);
-    let escapedEntryURL = aRow.getResultByIndex(kQueryIndexURL);
-    let openPageCount = aRow.getResultByIndex(kQueryIndexOpenPageCount) || 0;
-
-    // If actions are enabled and the page is open, add only the switch-to-tab
-    // result.  Otherwise, add the normal result.
-    let [url, action] = this._enableActions && openPageCount > 0 && this._hasBehavior("openpage") ?
-                        ["moz-action:switchtab," + escapedEntryURL, "action "] :
-                        [escapedEntryURL, ""];
-
-    if (this._inResults(entryId, url)) {
-      return false;
-    }
-
-    let entryTitle = aRow.getResultByIndex(kQueryIndexTitle) || "";
-    let entryFavicon = aRow.getResultByIndex(kQueryIndexFaviconURL) || "";
-    let entryBookmarked = aRow.getResultByIndex(kQueryIndexBookmarked);
-    let entryBookmarkTitle = entryBookmarked ?
-      aRow.getResultByIndex(kQueryIndexBookmarkTitle) : null;
-    let entryTags = aRow.getResultByIndex(kQueryIndexTags) || "";
-
-    // Always prefer the bookmark title unless it is empty
-    let title = entryBookmarkTitle || entryTitle;
-
-    let style;
-    if (aRow.getResultByIndex(kQueryIndexQueryType) == kQueryTypeKeyword) {
-      style = "keyword";
-      title = NetUtil.newURI(escapedEntryURL).host;
-    }
-
-    // We will always prefer to show tags if we have them.
-    let showTags = !!entryTags;
-
-    // However, we'll act as if a page is not bookmarked if the user wants
-    // only history and not bookmarks and there are no tags.
-    if (this._hasBehavior("history") && !this._hasBehavior("bookmark") &&
-        !showTags) {
-      showTags = false;
-      style = "favicon";
-    }
-
-    // If we have tags and should show them, we need to add them to the title.
-    if (showTags) {
-      title += kTitleTagsSeparator + entryTags;
-    }
-    // We have to determine the right style to display.  Tags show the tag icon,
-    // bookmarks get the bookmark icon, and keywords get the keyword icon.  If
-    // the result does not fall into any of those, it just gets the favicon.
-    if (!style) {
-      // It is possible that we already have a style set (from a keyword
-      // search or because of the user's preferences), so only set it if we
-      // haven't already done so.
-      if (showTags) {
-        style = "tag";
-      }
-      else if (entryBookmarked) {
-        style = "bookmark";
-      }
-      else {
-        style = "favicon";
-      }
-    }
-
-    this._addToResults(entryId, url, title, entryFavicon, action + style);
-    return true;
-  },
-
-  /**
-   * Checks to see if the given place has already been added to the results.
-   *
-   * @param aPlaceId
-   *        The place id to check for, may be null.
-   * @param aUrl
-   *        The url to check for.
-   * @return true if the place has been added, false otherwise.
-   *
-   * @note Must check both the id and the url for a negative match, since
-   *       autocomplete may run in the middle of a new page addition.  In such
-   *       a case the switch-to-tab query would hash the page by url, then a
-   *       next query, running after the page addition, would hash it by id.
-   *       It's not possible to just rely on url though, since keywords
-   *       dynamically modify the url to include their search string.
-   */
-  _inResults: function PAC_inResults(aPlaceId, aUrl)
-  {
-    if (aPlaceId && aPlaceId in this._usedPlaces) {
-      return true;
-    }
-    return aUrl in this._usedPlaces;
-  },
-
-  /**
-   * Adds a result to the AutoComplete results.  Also tracks that we've added
-   * this place_id into the result set.
-   *
-   * @param aPlaceId
-   *        The place_id of the item to be added to the result set.  This is
-   *        used by _inResults.
-   * @param aURISpec
-   *        The URI spec for the entry.
-   * @param aTitle
-   *        The title to give the entry.
-   * @param aFaviconSpec
-   *        The favicon to give to the entry.
-   * @param aStyle
-   *        Indicates how the entry should be styled when displayed.
-   */
-  _addToResults: function PAC_addToResults(aPlaceId, aURISpec, aTitle,
-                                           aFaviconSpec, aStyle)
-  {
-    // Add this to our internal tracker to ensure duplicates do not end up in
-    // the result.  _usedPlaces is an Object that is being used as a set.
-    // Not all entries have a place id, thus we fallback to the url for them.
-    // We cannot use only the url since keywords entries are modified to
-    // include the search string, and would be returned multiple times.  Ids
-    // are faster too.
-    this._usedPlaces[aPlaceId || aURISpec] = true;
-
-    // Obtain the favicon for this URI.
-    let favicon;
-    if (aFaviconSpec) {
-      let uri = NetUtil.newURI(aFaviconSpec);
-      favicon = PlacesUtils.favicons.getFaviconLinkForIcon(uri).spec;
-    }
-    favicon = favicon || PlacesUtils.favicons.defaultFavicon.spec;
-
-    this._result.appendMatch(aURISpec, aTitle, favicon, aStyle);
-  },
-
-  /**
-   * Determines if the specified AutoComplete behavior is set.
-   *
-   * @param aType
-   *        The behavior type to test for.
-   * @return true if the behavior is set, false otherwise.
-   */
-  _hasBehavior: function PAC_hasBehavior(aType)
-  {
-    let behavior = Ci.mozIPlacesAutoComplete["BEHAVIOR_" + aType.toUpperCase()];
-
-    if (this._disablePrivateActions &&
-        behavior == Ci.mozIPlacesAutoComplete.BEHAVIOR_OPENPAGE) {
-      return false;
-    }
-
-    return this._behavior & behavior;
-  },
-
-  /**
-   * Enables the desired AutoComplete behavior.
-   *
-   * @param aType
-   *        The behavior type to set.
-   */
-  _setBehavior: function PAC_setBehavior(aType)
-  {
-    this._behavior |=
-      Ci.mozIPlacesAutoComplete["BEHAVIOR_" + aType.toUpperCase()];
-  },
-
-  /**
-   * Determines if we are done searching or not.
-   *
-   * @return true if we have completed searching, false otherwise.
-   */
-  isSearchComplete: function PAC_isSearchComplete()
-  {
-    // If _pendingQuery is null, we should no longer do any work since we have
-    // already called _finishSearch.  This means we completed our search.
-    return this._pendingQuery == null;
-  },
-
-  /**
-   * Determines if the given handle of a pending statement is a pending search
-   * or not.
-   *
-   * @param aHandle
-   *        A mozIStoragePendingStatement to check and see if we are waiting for
-   *        results from it still.
-   * @return true if it is a pending query, false otherwise.
-   */
-  isPendingSearch: function PAC_isPendingSearch(aHandle)
-  {
-    return this._pendingQuery == aHandle;
-  },
-
-  //////////////////////////////////////////////////////////////////////////////
-  //// nsISupports
-
-  classID: Components.ID("d0272978-beab-4adc-a3d4-04b76acfa4e7"),
-
-  _xpcom_factory: XPCOMUtils.generateSingletonFactory(nsPlacesAutoComplete),
-
-  QueryInterface: XPCOMUtils.generateQI([
-    Ci.nsIAutoCompleteSearch,
-    Ci.nsIAutoCompleteSimpleResultListener,
-    Ci.mozIPlacesAutoComplete,
-    Ci.mozIStorageStatementCallback,
-    Ci.nsIObserver,
-    Ci.nsISupportsWeakReference,
-  ])
-};
-
-var components = [nsPlacesAutoComplete];
-this.NSGetFactory = XPCOMUtils.generateNSGetFactory(components);
diff --git a/toolkit/components/places/nsPlacesAutoComplete.manifest b/toolkit/components/places/nsPlacesAutoComplete.manifest
deleted file mode 100644
index 77dc732af23d..000000000000
--- a/toolkit/components/places/nsPlacesAutoComplete.manifest
+++ /dev/null
@@ -1,3 +0,0 @@
-component {d0272978-beab-4adc-a3d4-04b76acfa4e7} nsPlacesAutoComplete.js
-contract @mozilla.org/autocomplete/search;1?name=history {d0272978-beab-4adc-a3d4-04b76acfa4e7}
-
diff --git a/toolkit/components/places/tests/autocomplete/.eslintrc b/toolkit/components/places/tests/autocomplete/.eslintrc
deleted file mode 100644
index 8a895f93bd06..000000000000
--- a/toolkit/components/places/tests/autocomplete/.eslintrc
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "extends": [
-    "../../../../../testing/xpcshell/xpcshell.eslintrc"
-  ]
-}
diff --git a/toolkit/components/places/tests/autocomplete/head_autocomplete.js b/toolkit/components/places/tests/autocomplete/head_autocomplete.js
deleted file mode 100644
index ef6864ed1d10..000000000000
--- a/toolkit/components/places/tests/autocomplete/head_autocomplete.js
+++ /dev/null
@@ -1,314 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-var Ci = Components.interfaces;
-var Cc = Components.classes;
-var Cr = Components.results;
-var Cu = Components.utils;
-
-Cu.import("resource://gre/modules/Services.jsm");
-
-// Import common head.
-{
-  let commonFile = do_get_file("../head_common.js", false);
-  let uri = Services.io.newFileURI(commonFile);
-  Services.scriptloader.loadSubScript(uri.spec, this);
-}
-
-// Put any other stuff relative to this test folder below.
-
-
-/**
- * Header file for autocomplete testcases that create a set of pages with uris,
- * titles, tags and tests that a given search term matches certain pages.
- */
-
-var current_test = 0;
-
-function AutoCompleteInput(aSearches) {
-  this.searches = aSearches;
-}
-AutoCompleteInput.prototype = {
-  timeout: 10,
-  textValue: "",
-  searches: null,
-  searchParam: "",
-  popupOpen: false,
-  minResultsForPopup: 0,
-  invalidate: function() {},
-  disableAutoComplete: false,
-  completeDefaultIndex: false,
-  get popup() { return this; },
-  onSearchBegin: function() {},
-  onSearchComplete: function() {},
-  setSelectedIndex: function() {},
-  get searchCount() { return this.searches.length; },
-  getSearchAt: function(aIndex) { return this.searches[aIndex]; },
-  QueryInterface: XPCOMUtils.generateQI([
-    Ci.nsIAutoCompleteInput,
-    Ci.nsIAutoCompletePopup,
-  ])
-};
-
-function toURI(aSpec) {
-  return uri(aSpec);
-}
-
-var appendTags = true;
-// Helper to turn off tag matching in results
-function ignoreTags()
-{
-  print("Ignoring tags from results");
-  appendTags = false;
-}
-
-function ensure_results(aSearch, aExpected)
-{
-  let controller = Cc["@mozilla.org/autocomplete/controller;1"].
-                   getService(Ci.nsIAutoCompleteController);
-
-  // Make an AutoCompleteInput that uses our searches
-  // and confirms results on search complete
-  let input = new AutoCompleteInput(["history"]);
-
-  controller.input = input;
-
-  if (typeof kSearchParam == "string")
-    input.searchParam = kSearchParam;
-
-  let numSearchesStarted = 0;
-  input.onSearchBegin = function() {
-    numSearchesStarted++;
-    do_check_eq(numSearchesStarted, 1);
-  };
-
-  input.onSearchComplete = function() {
-    do_check_eq(numSearchesStarted, 1);
-    aExpected = aExpected.slice();
-
-    // Check to see the expected uris and titles match up (in any order)
-    for (let i = 0; i < controller.matchCount; i++) {
-      let value = controller.getValueAt(i);
-      let comment = controller.getCommentAt(i);
-
-      print("Looking for '" + value + "', '" + comment + "' in expected results...");
-      let j;
-      for (j = 0; j < aExpected.length; j++) {
-        // Skip processed expected results
-        if (aExpected[j] == undefined)
-          continue;
-
-        let [uri, title, tags] = gPages[aExpected[j]];
-
-        // Load the real uri and titles and tags if necessary
-        uri = toURI(kURIs[uri]).spec;
-        title = kTitles[title];
-        if (tags && appendTags)
-          title += " \u2013 " + tags.map(aTag => kTitles[aTag]);
-        print("Checking against expected '" + uri + "', '" + title + "'...");
-
-        // Got a match on both uri and title?
-        if (uri == value && title == comment) {
-          print("Got it at index " + j + "!!");
-          // Make it undefined so we don't process it again
-          aExpected[j] = undefined;
-          break;
-        }
-      }
-
-      // We didn't hit the break, so we must have not found it
-      if (j == aExpected.length)
-        do_throw("Didn't find the current result ('" + value + "', '" + comment + "') in expected: " + aExpected);
-    }
-
-    // Make sure we have the right number of results
-    print("Expecting " + aExpected.length + " results; got " +
-          controller.matchCount + " results");
-    do_check_eq(controller.matchCount, aExpected.length);
-
-    // If we expect results, make sure we got matches
-    do_check_eq(controller.searchStatus, aExpected.length ?
-                Ci.nsIAutoCompleteController.STATUS_COMPLETE_MATCH :
-                Ci.nsIAutoCompleteController.STATUS_COMPLETE_NO_MATCH);
-
-    // Fetch the next test if we have more
-    if (++current_test < gTests.length)
-      run_test();
-
-    do_test_finished();
-  };
-
-  print("Searching for.. '" + aSearch + "'");
-  controller.startSearch(aSearch);
-}
-
-// Get history services
-var histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
-              getService(Ci.nsINavHistoryService);
-var bhist = histsvc.QueryInterface(Ci.nsIBrowserHistory);
-var bmsvc = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
-            getService(Ci.nsINavBookmarksService);
-var tagsvc = Cc["@mozilla.org/browser/tagging-service;1"].
-             getService(Ci.nsITaggingService);
-var iosvc = Cc["@mozilla.org/network/io-service;1"].
-            getService(Ci.nsIIOService);
-var prefs = Cc["@mozilla.org/preferences-service;1"].
-            getService(Ci.nsIPrefBranch);
-
-// Some date not too long ago
-var gDate = new Date(Date.now() - 1000 * 60 * 60) * 1000;
-// Store the page info for each uri
-var gPages = [];
-
-// Initialization tasks to be run before the next test
-var gNextTestSetupTasks = [];
-
-/**
- * Adds a page, and creates various properties for it depending on the
- * parameters passed in.  This function will also add one visit, unless
- * aNoVisit is true.
- *
- * @param aURI
- *        An index into kURIs that holds the string for the URI we are to add a
- *        page for.
- * @param aTitle
- *        An index into kTitles that holds the string for the title we are to
- *        associate with the specified URI.
- * @param aBook [optional]
- *        An index into kTitles that holds the string for the title we are to
- *        associate with the bookmark.  If this is undefined, no bookmark is
- *        created.
- * @param aTags [optional]
- *        An array of indexes into kTitles that hold the strings for the tags we
- *        are to associate with the URI.  If this is undefined (or aBook is), no
- *        tags are added.
- * @param aKey [optional]
- *        A string to associate as the keyword for this bookmark.  aBook must be
- *        a valid index into kTitles for this to be checked and used.
- * @param aTransitionType [optional]
- *        The transition type to use when adding the visit.  The default is
- *        nsINavHistoryService::TRANSITION_LINK.
- * @param aNoVisit [optional]
- *        If true, no visit is added for the URI.  If false or undefined, a
- *        visit is added.
- */
-function addPageBook(aURI, aTitle, aBook, aTags, aKey, aTransitionType, aNoVisit)
-{
-  gNextTestSetupTasks.push([task_addPageBook, arguments]);
-}
-
-function* task_addPageBook(aURI, aTitle, aBook, aTags, aKey, aTransitionType, aNoVisit)
-{
-  // Add a page entry for the current uri
-  gPages[aURI] = [aURI, aBook != undefined ? aBook : aTitle, aTags];
-
-  let uri = toURI(kURIs[aURI]);
-  let title = kTitles[aTitle];
-
-  let out = [aURI, aTitle, aBook, aTags, aKey];
-  out.push("\nuri=" + kURIs[aURI]);
-  out.push("\ntitle=" + title);
-
-  // Add the page and a visit if we need to
-  if (!aNoVisit) {
-    yield PlacesTestUtils.addVisits({
-      uri: uri,
-      transition: aTransitionType || TRANSITION_LINK,
-      visitDate: gDate,
-      title: title
-    });
-    out.push("\nwith visit");
-  }
-
-  // Add a bookmark if we need to
-  if (aBook != undefined) {
-    let book = kTitles[aBook];
-    let bmid = bmsvc.insertBookmark(bmsvc.unfiledBookmarksFolder, uri,
-      bmsvc.DEFAULT_INDEX, book);
-    out.push("\nbook=" + book);
-
-    // Add a keyword to the bookmark if we need to
-    if (aKey != undefined)
-      yield PlacesUtils.keywords.insert({url: uri.spec, keyword: aKey});
-
-    // Add tags if we need to
-    if (aTags != undefined && aTags.length > 0) {
-      // Convert each tag index into the title
-      let tags = aTags.map(aTag => kTitles[aTag]);
-      tagsvc.tagURI(uri, tags);
-      out.push("\ntags=" + tags);
-    }
-  }
-
-  print("\nAdding page/book/tag: " + out.join(", "));
-}
-
-function run_test() {
-  print("\n");
-  // always search in history + bookmarks, no matter what the default is
-  prefs.setBoolPref("browser.urlbar.suggest.history", true);
-  prefs.setBoolPref("browser.urlbar.suggest.bookmark", true);
-  prefs.setBoolPref("browser.urlbar.suggest.openpage", true);
-  prefs.setBoolPref("browser.urlbar.suggest.history.onlyTyped", false);
-
-  // Search is asynchronous, so don't let the test finish immediately
-  do_test_pending();
-
-  // Load the test and print a description then run the test
-  let [description, search, expected, func] = gTests[current_test];
-  print(description);
-
-  // By default assume we want to match tags
-  appendTags = true;
-
-  // Do an extra function if necessary
-  if (func)
-    func();
-
-  Task.spawn(function* () {
-    // Iterate over all tasks and execute them
-    for (let [fn, args] of gNextTestSetupTasks) {
-      yield fn.apply(this, args);
-    }
-
-    // Clean up to allow tests to register more functions.
-    gNextTestSetupTasks = [];
-
-    // At this point frecency could still be updating due to latest pages
-    // updates.  This is not a problem in real life, but autocomplete tests
-    // should return reliable resultsets, thus we have to wait.
-    yield PlacesTestUtils.promiseAsyncUpdates();
-
-  }).then(() => ensure_results(search, expected),
-          do_report_unexpected_exception);
-}
-
-// Utility function to remove history pages
-function removePages(aURIs)
-{
-  gNextTestSetupTasks.push([do_removePages, arguments]);
-}
-
-function do_removePages(aURIs)
-{
-  for (let uri of aURIs)
-    histsvc.removePage(toURI(kURIs[uri]));
-}
-
-// Utility function to mark pages as typed
-function markTyped(aURIs, aTitle)
-{
-  gNextTestSetupTasks.push([task_markTyped, arguments]);
-}
-
-function* task_markTyped(aURIs, aTitle)
-{
-  for (let uri of aURIs) {
-    yield PlacesTestUtils.addVisits({
-      uri: toURI(kURIs[uri]),
-      transition: TRANSITION_TYPED,
-      title: kTitles[aTitle]
-    });
-  }
-}
diff --git a/toolkit/components/places/tests/autocomplete/test_416211.js b/toolkit/components/places/tests/autocomplete/test_416211.js
deleted file mode 100644
index 8f662b5b13fc..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_416211.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * Test bug 416211 to make sure results that match the tag show the bookmark
- * title instead of the page title.
- */
-
-var theTag = "superTag";
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://theuri/",
-];
-var kTitles = [
-  "Page title",
-  "Bookmark title",
-  theTag,
-];
-
-// Add page with a title, bookmark, and [tags]
-addPageBook(0, 0, 1, [2]);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Make sure the tag match gives the bookmark title",
-   theTag, [0]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_416214.js b/toolkit/components/places/tests/autocomplete/test_416214.js
deleted file mode 100644
index f8911800691a..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_416214.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * Test autocomplete for non-English URLs that match the tag bug 416214. Also
- * test bug 417441 by making sure escaped ascii characters like "+" remain
- * escaped.
- *
- * - add a visit for a page with a non-English URL
- * - add a tag for the page
- * - search for the tag
- * - test number of matches (should be exactly one)
- * - make sure the url is decoded
- */
-
-var theTag = "superTag";
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://escaped/ユニコード",
-  "http://asciiescaped/blocking-firefox3%2B",
-];
-var kTitles = [
-  "title",
-  theTag,
-];
-
-// Add pages that match the tag
-addPageBook(0, 0, 0, [1]);
-addPageBook(1, 0, 0, [1]);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Make sure tag matches return the right url as well as '+' remain escaped",
-   theTag, [0, 1]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_417798.js b/toolkit/components/places/tests/autocomplete/test_417798.js
deleted file mode 100644
index 6306c4125c81..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_417798.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 417798 to make sure javascript: URIs don't show up unless the
- * user searches for javascript: explicitly.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://abc/def",
-  "javascript:5",
-];
-var kTitles = [
-  "Title with javascript:",
-];
-
-addPageBook(0, 0); // regular url
-// javascript: uri as bookmark (no visit)
-addPageBook(1, 0, 0, undefined, undefined, undefined, true);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Match non-javascript: with plain search",
-   "a", [0]],
-  ["1: Match non-javascript: with almost javascript:",
-   "javascript", [0]],
-  ["2: Match javascript:",
-   "javascript:", [0, 1]],
-  ["3: Match nothing with non-first javascript:",
-   "5 javascript:", []],
-  ["4: Match javascript: with multi-word search",
-   "javascript: 5", [1]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_418257.js b/toolkit/components/places/tests/autocomplete/test_418257.js
deleted file mode 100644
index edff19d8b0f0..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_418257.js
+++ /dev/null
@@ -1,43 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 418257 by making sure tags are returned with the title as part of
- * the "comment" if there are tags even if we didn't match in the tags. They
- * are separated from the title by a endash.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://page1",
-  "http://page2",
-  "http://page3",
-  "http://page4",
-];
-var kTitles = [
-  "tag1",
-  "tag2",
-  "tag3",
-];
-
-// Add pages with varying number of tags
-addPageBook(0, 0, 0, [0]);
-addPageBook(1, 0, 0, [0, 1]);
-addPageBook(2, 0, 0, [0, 2]);
-addPageBook(3, 0, 0, [0, 1, 2]);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Make sure tags come back in the title when matching tags",
-   "page1 tag", [0]],
-  ["1: Check tags in title for page2",
-   "page2 tag", [1]],
-  ["2: Make sure tags appear even when not matching the tag",
-   "page3", [2]],
-  ["3: Multiple tags come in commas for page4",
-   "page4", [3]],
-  ["4: Extra test just to make sure we match the title",
-   "tag2", [1, 3]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_422277.js b/toolkit/components/places/tests/autocomplete/test_422277.js
deleted file mode 100644
index d6eb193dc8f0..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_422277.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 422277 to make sure bad escaped uris don't get escaped. This makes
- * sure we don't hit an assertion for "not a UTF8 string".
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://site/%EAid",
-];
-var kTitles = [
-  "title",
-];
-
-addPageBook(0, 0);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Bad escaped uri stays escaped",
-   "site", [0]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_autocomplete_on_value_removed_479089.js b/toolkit/components/places/tests/autocomplete/test_autocomplete_on_value_removed_479089.js
deleted file mode 100644
index 8c9b31cdbbba..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_autocomplete_on_value_removed_479089.js
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * Need to test that removing a page from autocomplete actually removes a page
- * Description From  Shawn Wilsher :sdwilsh   2009-02-18 11:29:06 PST
- * We don't test the code path of onValueRemoved
- * for the autocomplete implementation
- * Bug 479089
- */
-
-var histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
-getService(Ci.nsINavHistoryService);
-
-function run_test()
-{
-  run_next_test();
-}
-
-add_task(function* test_autocomplete_on_value_removed()
-{
-  // QI to nsIAutoCompleteSimpleResultListener
-  var listener = Cc["@mozilla.org/autocomplete/search;1?name=history"].
-                 getService(Components.interfaces.nsIAutoCompleteSimpleResultListener);
-
-  // add history visit
-  var testUri = uri("http://foo.mozilla.com/");
-  yield PlacesTestUtils.addVisits({
-    uri: testUri,
-    referrer: uri("http://mozilla.com/")
-  });
-  // create a query object
-  var query = histsvc.getNewQuery();
-  // create the options object we will never use
-  var options = histsvc.getNewQueryOptions();
-  // look for this uri only
-  query.uri = testUri;
-  // execute
-  var queryRes = histsvc.executeQuery(query, options);
-  // open the result container
-  queryRes.root.containerOpen = true;
-  // debug queries
-  // dump_table("moz_places");
-  do_check_eq(queryRes.root.childCount, 1);
-  // call the untested code path
-  listener.onValueRemoved(null, testUri.spec, true);
-  // make sure it is GONE from the DB
-  do_check_eq(queryRes.root.childCount, 0);
-  // close the container
-  queryRes.root.containerOpen = false;
-});
diff --git a/toolkit/components/places/tests/autocomplete/test_download_embed_bookmarks.js b/toolkit/components/places/tests/autocomplete/test_download_embed_bookmarks.js
deleted file mode 100644
index 65bec60cc787..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_download_embed_bookmarks.js
+++ /dev/null
@@ -1,53 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
- * vim:set ts=2 sw=2 sts=2 et:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Tests bug 449406 to ensure that TRANSITION_DOWNLOAD, TRANSITION_EMBED and
- * TRANSITION_FRAMED_LINK bookmarked uri's show up in the location bar.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://download/bookmarked",
-  "http://embed/bookmarked",
-  "http://framed/bookmarked",
-  "http://download",
-  "http://embed",
-  "http://framed",
-];
-var kTitles = [
-  "download-bookmark",
-  "embed-bookmark",
-  "framed-bookmark",
-  "download2",
-  "embed2",
-  "framed2",
-];
-
-// Add download and embed uris
-addPageBook(0, 0, 0, undefined, undefined, TRANSITION_DOWNLOAD);
-addPageBook(1, 1, 1, undefined, undefined, TRANSITION_EMBED);
-addPageBook(2, 2, 2, undefined, undefined, TRANSITION_FRAMED_LINK);
-addPageBook(3, 3, undefined, undefined, undefined, TRANSITION_DOWNLOAD);
-addPageBook(4, 4, undefined, undefined, undefined, TRANSITION_EMBED);
-addPageBook(5, 5, undefined, undefined, undefined, TRANSITION_FRAMED_LINK);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Searching for bookmarked download uri matches",
-   kTitles[0], [0]],
-  ["1: Searching for bookmarked embed uri matches",
-   kTitles[1], [1]],
-  ["2: Searching for bookmarked framed uri matches",
-   kTitles[2], [2]],
-  ["3: Searching for download uri does not match",
-   kTitles[3], []],
-  ["4: Searching for embed uri does not match",
-   kTitles[4], []],
-  ["5: Searching for framed uri does not match",
-   kTitles[5], []],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_empty_search.js b/toolkit/components/places/tests/autocomplete/test_empty_search.js
deleted file mode 100644
index df8eac383a7e..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_empty_search.js
+++ /dev/null
@@ -1,69 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 426864 that makes sure the empty search (drop down list) only
- * shows typed pages from history.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://foo/0",
-  "http://foo/1",
-  "http://foo/2",
-  "http://foo/3",
-  "http://foo/4",
-  "http://foo/5",
-];
-var kTitles = [
-  "title",
-];
-
-// Visited (in history)
-addPageBook(0, 0); // history
-addPageBook(1, 0, 0); // bookmark
-addPageBook(2, 0); // history typed
-addPageBook(3, 0, 0); // bookmark typed
-
-// Unvisited bookmark
-addPageBook(4, 0, 0); // bookmark
-addPageBook(5, 0, 0); // bookmark typed
-
-// Set some pages as typed
-markTyped([2, 3, 5], 0);
-// Remove pages from history to treat them as unvisited
-removePages([4, 5]);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Match everything",
-   "foo", [0, 1, 2, 3, 4, 5]],
-  ["1: Match only typed history",
-   "foo ^ ~", [2, 3]],
-  ["2: Drop-down empty search matches only typed history",
-   "", [2, 3]],
-  ["3: Drop-down empty search matches only bookmarks",
-   "", [2, 3], matchBookmarks],
-  ["4: Drop-down empty search matches only typed",
-   "", [2, 3], matchTyped],
-];
-
-function matchBookmarks() {
-  prefs.setBoolPref("browser.urlbar.suggest.history", false);
-  prefs.setBoolPref("browser.urlbar.suggest.bookmark", true);
-  clearPrefs();
-}
-
-function matchTyped() {
-  prefs.setBoolPref("browser.urlbar.suggest.history", true);
-  prefs.setBoolPref("browser.urlbar.suggest.history.onlyTyped", true);
-  clearPrefs();
-}
-
-function clearPrefs() {
-  prefs.clearUserPref("browser.urlbar.suggest.history");
-  prefs.clearUserPref("browser.urlbar.suggest.bookmark");
-  prefs.clearUserPref("browser.urlbar.suggest.history.onlyTyped");
-}
diff --git a/toolkit/components/places/tests/autocomplete/test_enabled.js b/toolkit/components/places/tests/autocomplete/test_enabled.js
deleted file mode 100644
index 80fc4a136df7..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_enabled.js
+++ /dev/null
@@ -1,69 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 471903 to make sure searching in autocomplete can be turned on
- * and off. Also test bug 463535 for pref changing search.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://url/0",
-];
-var kTitles = [
-  "title",
-];
-
-addPageBook(0, 0); // visited page
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["1: plain search",
-   "url", [0]],
-  ["2: search disabled",
-   "url", [], () => setSearch(0)],
-  ["3: resume normal search",
-   "url", [0], () => setSearch(1)],
-];
-
-function setSearch(aSearch) {
-  prefs.setBoolPref("browser.urlbar.autocomplete.enabled", !!aSearch);
-}
-
-add_task(function* test_sync_enabled() {
-  // Initialize autocomplete component.
-  Cc["@mozilla.org/autocomplete/search;1?name=history"]
-    .getService(Ci.mozIPlacesAutoComplete);
-
-  let types = [ "history", "bookmark", "openpage" ];
-
-  // Test the service keeps browser.urlbar.autocomplete.enabled synchronized
-  // with browser.urlbar.suggest prefs.
-  for (let type of types) {
-    Services.prefs.setBoolPref("browser.urlbar.suggest." + type, true);
-  }
-  Assert.equal(Services.prefs.getBoolPref("browser.urlbar.autocomplete.enabled"), true);
-
-  // Disable autocomplete and check all the suggest prefs are set to false.
-  Services.prefs.setBoolPref("browser.urlbar.autocomplete.enabled", false);
-  for (let type of types) {
-    Assert.equal(Services.prefs.getBoolPref("browser.urlbar.suggest." + type), false);
-  }
-
-  // Setting even a single suggest pref to true should enable autocomplete.
-  Services.prefs.setBoolPref("browser.urlbar.suggest.history", true);
-  for (let type of types.filter(t => t != "history")) {
-    Assert.equal(Services.prefs.getBoolPref("browser.urlbar.suggest." + type), false);
-  }
-  Assert.equal(Services.prefs.getBoolPref("browser.urlbar.autocomplete.enabled"), true);
-
-  // Disable autocoplete again, then re-enable it and check suggest prefs
-  // have been reset.
-  Services.prefs.setBoolPref("browser.urlbar.autocomplete.enabled", false);
-  Services.prefs.setBoolPref("browser.urlbar.autocomplete.enabled", true);
-  for (let type of types.filter(t => t != "history")) {
-    Assert.equal(Services.prefs.getBoolPref("browser.urlbar.suggest." + type), true);
-  }
-});
diff --git a/toolkit/components/places/tests/autocomplete/test_escape_self.js b/toolkit/components/places/tests/autocomplete/test_escape_self.js
deleted file mode 100644
index 0b0918b8ffe2..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_escape_self.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 422698 to make sure searches with urls from the location bar
- * correctly match itself when it contains escaped characters.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://unescapeduri/",
-  "http://escapeduri/%40/",
-];
-var kTitles = [
-  "title",
-];
-
-// Add unescaped and escaped uris
-addPageBook(0, 0);
-addPageBook(1, 0);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Unescaped location matches itself",
-   kURIs[0], [0]],
-  ["1: Escaped location matches itself",
-   kURIs[1], [1]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_ignore_protocol.js b/toolkit/components/places/tests/autocomplete/test_ignore_protocol.js
deleted file mode 100644
index 2ad63b735f42..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_ignore_protocol.js
+++ /dev/null
@@ -1,27 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 424509 to make sure searching for "h" doesn't match "http" of urls.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://site/",
-  "http://happytimes/",
-];
-var kTitles = [
-  "title",
-];
-
-// Add site without "h" and with "h"
-addPageBook(0, 0);
-addPageBook(1, 0);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Searching for h matches site and not http://",
-   "h", [1]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_keyword_search.js b/toolkit/components/places/tests/autocomplete/test_keyword_search.js
deleted file mode 100644
index 796f386bb826..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_keyword_search.js
+++ /dev/null
@@ -1,73 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 392143 that puts keyword results into the autocomplete. Makes
- * sure that multiple parameter queries get spaces converted to +, + converted
- * to %2B, non-ascii become escaped, and pages in history that match the
- * keyword uses the page's title.
- *
- * Also test for bug 249468 by making sure multiple keyword bookmarks with the
- * same keyword appear in the list.
- */
-
-// Details for the keyword bookmark
-var keyBase = "http://abc/?search=";
-var keyKey = "key";
-
-// A second keyword bookmark with the same keyword
-var otherBase = "http://xyz/?foo=";
-
-var unescaped = "ユニコード";
-var pageInHistory = "ThisPageIsInHistory";
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  keyBase + "%s",
-  keyBase + "term",
-  keyBase + "multi+word",
-  keyBase + "blocking%2B",
-  keyBase + unescaped,
-  keyBase + pageInHistory,
-  keyBase,
-  otherBase + "%s",
-  keyBase + "twoKey",
-  otherBase + "twoKey"
-];
-var kTitles = [
-  "Generic page title",
-  "Keyword title",
-  "abc",
-  "xyz"
-];
-
-// Add the keyword bookmark
-addPageBook(0, 0, 1, [], keyKey);
-// Add in the "fake pages" for keyword searches
-gPages[1] = [1, 2];
-gPages[2] = [2, 2];
-gPages[3] = [3, 2];
-gPages[4] = [4, 2];
-// Add a page into history
-addPageBook(5, 2);
-gPages[6] = [6, 2];
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Plain keyword query",
-   keyKey + " term", [1]],
-  ["1: Multi-word keyword query",
-   keyKey + " multi word", [2]],
-  ["2: Keyword query with +",
-   keyKey + " blocking+", [3]],
-  ["3: Unescaped term in query",
-   keyKey + " " + unescaped, [4]],
-  ["4: Keyword that happens to match a page",
-   keyKey + " " + pageInHistory, [5]],
-  ["5: Keyword without query (without space)",
-   keyKey, [6]],
-  ["6: Keyword without query (with space)",
-   keyKey + " ", [6]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_match_beginning.js b/toolkit/components/places/tests/autocomplete/test_match_beginning.js
deleted file mode 100644
index b9ba3ab39b1c..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_match_beginning.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 451760 which allows matching only at the beginning of urls or
- * titles to simulate Firefox 2 functionality.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://x.com/y",
-  "https://y.com/x",
-];
-var kTitles = [
-  "a b",
-  "b a",
-];
-
-addPageBook(0, 0);
-addPageBook(1, 1);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  // Tests after this one will match at the beginning
-  ["0: Match at the beginning of titles",
-   "a", [0],
-   () => setBehavior(3)],
-  ["1: Match at the beginning of titles",
-   "b", [1]],
-  ["2: Match at the beginning of urls",
-   "x", [0]],
-  ["3: Match at the beginning of urls",
-   "y", [1]],
-
-  // Tests after this one will match against word boundaries and anywhere
-  ["4: Sanity check that matching anywhere finds more",
-   "a", [0, 1],
-   () => setBehavior(1)],
-];
-
-function setBehavior(aType) {
-  prefs.setIntPref("browser.urlbar.matchBehavior", aType);
-}
diff --git a/toolkit/components/places/tests/autocomplete/test_multi_word_search.js b/toolkit/components/places/tests/autocomplete/test_multi_word_search.js
deleted file mode 100644
index c0b896c8687f..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_multi_word_search.js
+++ /dev/null
@@ -1,49 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 401869 to allow multiple words separated by spaces to match in
- * the page title, page url, or bookmark title to be considered a match. All
- * terms must match but not all terms need to be in the title, etc.
- *
- * Test bug 424216 by making sure bookmark titles are always shown if one is
- * available. Also bug 425056 makes sure matches aren't found partially in the
- * page title and partially in the bookmark.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://a.b.c/d-e_f/h/t/p",
-  "http://d.e.f/g-h_i/h/t/p",
-  "http://g.h.i/j-k_l/h/t/p",
-  "http://j.k.l/m-n_o/h/t/p",
-];
-var kTitles = [
-  "f(o)o b<a>r",
-  "b(a)r b<a>z",
-];
-
-// Regular pages
-addPageBook(0, 0);
-addPageBook(1, 1);
-// Bookmarked pages
-addPageBook(2, 0, 0);
-addPageBook(3, 0, 1);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: Match 2 terms all in url",
-   "c d", [0]],
-  ["1: Match 1 term in url and 1 term in title",
-   "b e", [0, 1]],
-  ["2: Match 3 terms all in title; display bookmark title if matched",
-   "b a z", [1, 3]],
-  ["3: Match 2 terms in url and 1 in title; make sure bookmark title is used for search",
-   "k f t", [2]],
-  ["4: Match 3 terms in url and 1 in title",
-   "d i g z", [1]],
-  ["5: Match nothing",
-   "m o z i", []],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_special_search.js b/toolkit/components/places/tests/autocomplete/test_special_search.js
deleted file mode 100644
index 78bf5a7d6413..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_special_search.js
+++ /dev/null
@@ -1,183 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test for bug 395161 that allows special searches that restrict results to
- * history/bookmark/tagged items and title/url matches.
- *
- * Test 485122 by making sure results don't have tags when restricting result
- * to just history either by default behavior or dynamic query restrict.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://url/",
-  "http://url/2",
-  "http://foo.bar/",
-  "http://foo.bar/2",
-  "http://url/star",
-  "http://url/star/2",
-  "http://foo.bar/star",
-  "http://foo.bar/star/2",
-  "http://url/tag",
-  "http://url/tag/2",
-  "http://foo.bar/tag",
-  "http://foo.bar/tag/2",
-];
-var kTitles = [
-  "title",
-  "foo.bar",
-];
-
-// Plain page visits
-addPageBook(0, 0); // plain page
-addPageBook(1, 1); // title
-addPageBook(2, 0); // url
-addPageBook(3, 1); // title and url
-
-// Bookmarked pages (no tag)
-addPageBook(4, 0, 0); // bookmarked page
-addPageBook(5, 1, 1); // title
-addPageBook(6, 0, 0); // url
-addPageBook(7, 1, 1); // title and url
-
-// Tagged pages
-addPageBook(8, 0, 0, [1]); // tagged page
-addPageBook(9, 1, 1, [1]); // title
-addPageBook(10, 0, 0, [1]); // url
-addPageBook(11, 1, 1, [1]); // title and url
-
-// Remove pages from history to treat them as unvisited, so pages that do have
-// visits are 0,1,2,3,5,10
-removePages([4, 6, 7, 8, 9, 11]);
-// Set some pages as typed
-markTyped([0, 10], 0);
-markTyped([3], 1);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  // Test restricting searches
-  ["0: History restrict",
-   "^", [0, 1, 2, 3, 5, 10]],
-  ["1: Star restrict",
-   "*", [4, 5, 6, 7, 8, 9, 10, 11]],
-  ["2: Tag restrict",
-   "+", [8, 9, 10, 11]],
-
-  // Test specials as any word position
-  ["3: Special as first word",
-   "^ foo bar", [1, 2, 3, 5, 10]],
-  ["4: Special as middle word",
-   "foo ^ bar", [1, 2, 3, 5, 10]],
-  ["5: Special as last word",
-   "foo bar ^", [1, 2, 3, 5, 10]],
-
-  // Test restricting and matching searches with a term
-  ["6.1: foo ^ -> history",
-   "foo ^", [1, 2, 3, 5, 10]],
-  ["6.2: foo | -> history (change pref)",
-   "foo |", [1, 2, 3, 5, 10], () => changeRestrict("history", "|")],
-  ["7.1: foo * -> is star",
-   "foo *", [5, 6, 7, 8, 9, 10, 11], () => resetRestrict("history")],
-  ["7.2: foo | -> is star (change pref)",
-   "foo |", [5, 6, 7, 8, 9, 10, 11], () => changeRestrict("bookmark", "|")],
-  ["8.1: foo # -> in title",
-   "foo #", [1, 3, 5, 7, 8, 9, 10, 11], () => resetRestrict("bookmark")],
-  ["8.2: foo | -> in title (change pref)",
-   "foo |", [1, 3, 5, 7, 8, 9, 10, 11], () => changeRestrict("title", "|")],
-  ["9.1: foo @ -> in url",
-   "foo @", [2, 3, 6, 7, 10, 11], () => resetRestrict("title")],
-  ["9.2: foo | -> in url (change pref)",
-   "foo |", [2, 3, 6, 7, 10, 11], () => changeRestrict("url", "|")],
-  ["10: foo + -> is tag",
-   "foo +", [8, 9, 10, 11], () => resetRestrict("url")],
-  ["10.2: foo | -> is tag (change pref)",
-   "foo |", [8, 9, 10, 11], () => changeRestrict("tag", "|")],
-  ["10.3: foo ~ -> is typed",
-   "foo ~", [3, 10], () => resetRestrict("tag")],
-  ["10.4: foo | -> is typed (change pref)",
-   "foo |", [3, 10], () => changeRestrict("typed", "|")],
-
-  // Test various pairs of special searches
-  ["11: foo ^ * -> history, is star",
-   "foo ^ *", [5, 10], () => resetRestrict("typed")],
-  ["12: foo ^ # -> history, in title",
-   "foo ^ #", [1, 3, 5, 10]],
-  ["13: foo ^ @ -> history, in url",
-   "foo ^ @", [2, 3, 10]],
-  ["14: foo ^ + -> history, is tag",
-   "foo ^ +", [10]],
-  ["14.1: foo ^ ~ -> history, is typed",
-   "foo ^ ~", [3, 10]],
-  ["15: foo * # -> is star, in title",
-   "foo * #", [5, 7, 8, 9, 10, 11]],
-  ["16: foo * @ -> is star, in url",
-   "foo * @", [6, 7, 10, 11]],
-  ["17: foo * + -> same as +",
-   "foo * +", [8, 9, 10, 11]],
-  ["17.1: foo * ~ -> is star, is typed",
-   "foo * ~", [10]],
-  ["18: foo # @ -> in title, in url",
-   "foo # @", [3, 7, 10, 11]],
-  ["19: foo # + -> in title, is tag",
-   "foo # +", [8, 9, 10, 11]],
-  ["19.1: foo # ~ -> in title, is typed",
-   "foo # ~", [3, 10]],
-  ["20: foo @ + -> in url, is tag",
-   "foo @ +", [10, 11]],
-  ["20.1: foo @ ~ -> in url, is typed",
-   "foo @ ~", [3, 10]],
-  ["20.2: foo + ~ -> is tag, is typed",
-   "foo + ~", [10]],
-
-  // Test default usage by setting certain bits of default.behavior to 1
-  ["21: foo -> default history",
-   "foo", [1, 2, 3, 5, 10], function () { setPref({ history: true }); }],
-  ["22: foo -> default history or is star",
-   "foo", [1, 2, 3, 5, 6, 7, 8, 9, 10, 11], () => setPref({ history: true, bookmark: true })],
-  ["22.1: foo -> default history or is star, is typed",
-   "foo", [3, 10], () => setPref({ history: true, bookmark: true, "history.onlyTyped": true })],
-
-];
-
-function setPref(aTypes) {
-  clearSuggestPrefs();
-  for (let type in aTypes) {
-    prefs.setBoolPref("browser.urlbar.suggest." + type, aTypes[type]);
-  }
-}
-
-function clearSuggestPrefs() {
-  prefs.setBoolPref("browser.urlbar.suggest.history", false);
-  prefs.setBoolPref("browser.urlbar.suggest.bookmark", false);
-  prefs.setBoolPref("browser.urlbar.suggest.history.onlyTyped", false);
-  prefs.setBoolPref("browser.urlbar.suggest.openpage", false);
-}
-
-function changeRestrict(aType, aChar)
-{
-  let branch = "browser.urlbar.";
-  // "title" and "url" are different from everything else, so special case them.
-  if (aType == "title" || aType == "url")
-    branch += "match.";
-  else
-    branch += "restrict.";
-
-  print("changing restrict for " + aType + " to '" + aChar + "'");
-  prefs.setCharPref(branch + aType, aChar);
-}
-
-function resetRestrict(aType)
-{
-  let branch = "browser.urlbar.";
-  // "title" and "url" are different from everything else, so special case them.
-  if (aType == "title" || aType == "url")
-    branch += "match.";
-  else
-    branch += "restrict.";
-
-  if (prefs.prefHasUserValue(branch + aType))
-    prefs.clearUserPref(branch + aType);
-}
diff --git a/toolkit/components/places/tests/autocomplete/test_swap_protocol.js b/toolkit/components/places/tests/autocomplete/test_swap_protocol.js
deleted file mode 100644
index 860b722498e6..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_swap_protocol.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 424717 to make sure searching with an existing location like
- * http://site/ also matches https://site/ or ftp://site/. Same thing for
- * ftp://site/ and https://site/.
- *
- * Test bug 461483 to make sure a search for "w" doesn't match the "www." from
- * site subdomains.
- */
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://www.site/",
-  "http://site/",
-  "ftp://ftp.site/",
-  "ftp://site/",
-  "https://www.site/",
-  "https://site/",
-  "http://woohoo/",
-  "http://wwwwwwacko/",
-];
-var kTitles = [
-  "title",
-];
-
-// Add various protocols of site
-addPageBook(0, 0);
-addPageBook(1, 0);
-addPageBook(2, 0);
-addPageBook(3, 0);
-addPageBook(4, 0);
-addPageBook(5, 0);
-addPageBook(6, 0);
-addPageBook(7, 0);
-
-var allSite = [0, 1, 2, 3, 4, 5];
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  ["0: http://www.site matches all site", "http://www.site", allSite],
-  ["1: http://site matches all site", "http://site", allSite],
-  ["2: ftp://ftp.site matches itself", "ftp://ftp.site", [2]],
-  ["3: ftp://site matches all site", "ftp://site", allSite],
-  ["4: https://www.site matches all site", "https://www.site", allSite],
-  ["5: https://site matches all site", "https://site", allSite],
-  ["6: www.site matches all site", "www.site", allSite],
-
-  ["7: w matches none of www.", "w", [6, 7]],
-  ["8: http://w matches none of www.", "w", [6, 7]],
-  ["9: http://www.w matches none of www.", "w", [6, 7]],
-
-  ["10: ww matches none of www.", "ww", [7]],
-  ["11: http://ww matches none of www.", "http://ww", [7]],
-  ["12: http://www.ww matches none of www.", "http://www.ww", [7]],
-
-  ["13: www matches none of www.", "www", [7]],
-  ["14: http://www matches none of www.", "http://www", [7]],
-  ["15: http://www.www matches none of www.", "http://www.www", [7]],
-];
diff --git a/toolkit/components/places/tests/autocomplete/test_tabmatches.js b/toolkit/components/places/tests/autocomplete/test_tabmatches.js
deleted file mode 100644
index 98ada6c42e44..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_tabmatches.js
+++ /dev/null
@@ -1,97 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
- * vim:set ts=2 sw=2 sts=2 et:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-var gTabRestrictChar = "%";
-prefs.setCharPref("browser.urlbar.restrict.openpage", gTabRestrictChar);
-do_register_cleanup(() => {
-  prefs.clearUserPref("browser.urlbar.restrict.openpage");
-});
-
-var kSearchParam = "enable-actions";
-
-var kURIs = [
-  "http://abc.com/",
-  "moz-action:switchtab,http://abc.com/",
-  "http://xyz.net/",
-  "moz-action:switchtab,http://xyz.net/",
-  "about:mozilla",
-  "moz-action:switchtab,about:mozilla",
-  "data:text/html,test",
-  "moz-action:switchtab,data:text/html,test"
-];
-
-var kTitles = [
-  "ABC rocks",
-  "xyz.net - we're better than ABC",
-  "about:mozilla",
-  "data:text/html,test"
-];
-
-addPageBook(0, 0);
-gPages[1] = [1, 0];
-addPageBook(2, 1);
-gPages[3] = [3, 1];
-
-addOpenPages(0, 1);
-
-// PAges that cannot be registered in history.
-addOpenPages(4, 1);
-gPages[5] = [5, 2];
-addOpenPages(6, 1);
-gPages[7] = [7, 3];
-
-var gTests = [
-  ["0: single result, that is also a tab match",
-   "abc.com", [1]],
-  ["1: two results, one tab match",
-   "abc", [1, 2]],
-  ["2: two results, both tab matches",
-   "abc", [1, 3],
-   function() {
-     addOpenPages(2, 1);
-   }],
-  ["3: two results, both tab matches, one has multiple tabs",
-   "abc", [1, 3],
-   function() {
-     addOpenPages(2, 5);
-   }],
-  ["4: two results, no tab matches",
-   "abc", [0, 2],
-   function() {
-     removeOpenPages(0, 1);
-     removeOpenPages(2, 6);
-   }],
-  ["5: tab match search with restriction character",
-   gTabRestrictChar + " abc", [1],
-   function() {
-    addOpenPages(0, 1);
-   }],
-  ["6: tab match with not-addable pages",
-   "mozilla", [5]],
-  ["7: tab match with not-addable pages and restriction character",
-   gTabRestrictChar + " mozilla", [5]],
-  ["8: tab match with not-addable pages and only restriction character",
-   gTabRestrictChar, [1, 5, 7]],
-];
-
-
-function addOpenPages(aUri, aCount) {
-  let num = aCount || 1;
-  let acprovider = Cc["@mozilla.org/autocomplete/search;1?name=history"].
-                   getService(Ci.mozIPlacesAutoComplete);
-  for (let i = 0; i < num; i++) {
-    acprovider.registerOpenPage(toURI(kURIs[aUri]));
-  }
-}
-
-function removeOpenPages(aUri, aCount) {
-  let num = aCount || 1;
-  let acprovider = Cc["@mozilla.org/autocomplete/search;1?name=history"].
-                   getService(Ci.mozIPlacesAutoComplete);
-  for (let i = 0; i < num; i++) {
-    acprovider.unregisterOpenPage(toURI(kURIs[aUri]));
-  }
-}
diff --git a/toolkit/components/places/tests/autocomplete/test_word_boundary_search.js b/toolkit/components/places/tests/autocomplete/test_word_boundary_search.js
deleted file mode 100644
index b4ae3684911e..000000000000
--- a/toolkit/components/places/tests/autocomplete/test_word_boundary_search.js
+++ /dev/null
@@ -1,105 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Test bug 393678 to make sure matches against the url, title, tags are only
- * made on word boundaries instead of in the middle of words.
- *
- * Make sure we don't try matching one after a CamelCase because the upper-case
- * isn't really a word boundary. (bug 429498)
- *
- * Bug 429531 provides switching between "must match on word boundary" and "can
- * match," so leverage "must match" pref for checking word boundary logic and
- * make sure "can match" matches anywhere.
- */
-
-var katakana = ["\u30a8", "\u30c9"]; // E, Do
-var ideograph = ["\u4efb", "\u5929", "\u5802"]; // Nin Ten Do
-
-// Define some shared uris and titles (each page needs its own uri)
-var kURIs = [
-  "http://matchme/",
-  "http://dontmatchme/",
-  "http://title/1",
-  "http://title/2",
-  "http://tag/1",
-  "http://tag/2",
-  "http://crazytitle/",
-  "http://katakana/",
-  "http://ideograph/",
-  "http://camel/pleaseMatchMe/",
-];
-var kTitles = [
-  "title1",
-  "matchme2",
-  "dontmatchme3",
-  "!@#$%^&*()_+{}|:<>?word",
-  katakana.join(""),
-  ideograph.join(""),
-];
-
-// Boundaries on the url
-addPageBook(0, 0);
-addPageBook(1, 0);
-// Boundaries on the title
-addPageBook(2, 1);
-addPageBook(3, 2);
-// Boundaries on the tag
-addPageBook(4, 0, 0, [1]);
-addPageBook(5, 0, 0, [2]);
-// Lots of word boundaries before a word
-addPageBook(6, 3);
-// Katakana
-addPageBook(7, 4);
-// Ideograph
-addPageBook(8, 5);
-// CamelCase
-addPageBook(9, 0);
-
-// Provide for each test: description; search terms; array of gPages indices of
-// pages that should match; optional function to be run before the test
-var gTests = [
-  // Tests after this one will match only on word boundaries
-  ["0: Match 'match' at the beginning or after / or on a CamelCase",
-   "match", [0, 2, 4, 9],
-   () => setBehavior(2)],
-  ["1: Match 'dont' at the beginning or after /",
-   "dont", [1, 3, 5]],
-  ["2: Match '2' after the slash and after a word (in tags too)",
-   "2", [2, 3, 4, 5]],
-  ["3: Match 't' at the beginning or after /",
-   "t", [0, 1, 2, 3, 4, 5, 9]],
-  ["4: Match 'word' after many consecutive word boundaries",
-   "word", [6]],
-  ["5: Match a word boundary '/' for everything",
-   "/", [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]],
-  ["6: Match word boundaries '()_+' that are among word boundaries",
-   "()_+", [6]],
-
-  ["7: Katakana characters form a string, so match the beginning",
-   katakana[0], [7]],
-  /*["8: Middle of a katakana word shouldn't be matched",
-   katakana[1], []],*/
-
-  ["9: Ideographs are treated as words so 'nin' is one word",
-   ideograph[0], [8]],
-  ["10: Ideographs are treated as words so 'ten' is another word",
-   ideograph[1], [8]],
-  ["11: Ideographs are treated as words so 'do' is yet another",
-   ideograph[2], [8]],
-
-  ["12: Extra negative assert that we don't match in the middle",
-   "ch", []],
-  ["13: Don't match one character after a camel-case word boundary (bug 429498)",
-   "atch", []],
-
-  // Tests after this one will match against word boundaries and anywhere
-  ["14: Match on word boundaries as well as anywhere (bug 429531)",
-   "tch", [0, 1, 2, 3, 4, 5, 9],
-   () => setBehavior(1)],
-];
-
-function setBehavior(aType) {
-  prefs.setIntPref("browser.urlbar.matchBehavior", aType);
-}
diff --git a/toolkit/components/places/tests/autocomplete/xpcshell.ini b/toolkit/components/places/tests/autocomplete/xpcshell.ini
deleted file mode 100644
index 7c018dbcc7b7..000000000000
--- a/toolkit/components/places/tests/autocomplete/xpcshell.ini
+++ /dev/null
@@ -1,29 +0,0 @@
-[DEFAULT]
-head = head_autocomplete.js
-tail = 
-skip-if = toolkit == 'android' || toolkit == 'gonk'
-
-[test_416211.js]
-[test_416214.js]
-[test_417798.js]
-[test_418257.js]
-[test_422277.js]
-[test_autocomplete_on_value_removed_479089.js]
-# Bug 676989: test fails consistently on Android
-fail-if = os == "android"
-[test_download_embed_bookmarks.js]
-# Bug 676989: test fails consistently on Android
-fail-if = os == "android"
-[test_empty_search.js]
-# Bug 676989: test fails consistently on Android
-fail-if = os == "android"
-[test_enabled.js]
-[test_escape_self.js]
-[test_ignore_protocol.js]
-[test_keyword_search.js]
-[test_match_beginning.js]
-[test_multi_word_search.js]
-[test_special_search.js]
-[test_swap_protocol.js]
-[test_tabmatches.js]
-[test_word_boundary_search.js]
diff --git a/toolkit/components/places/tests/moz.build b/toolkit/components/places/tests/moz.build
index d3a2c79fc260..5f9460babfd9 100644
--- a/toolkit/components/places/tests/moz.build
+++ b/toolkit/components/places/tests/moz.build
@@ -22,11 +22,6 @@ XPCSHELL_TESTS_MANIFESTS += [
     'unit/xpcshell.ini',
 ]
 
-if CONFIG['MOZ_SUITE']:
-    XPCSHELL_TESTS_MANIFESTS += [
-        'autocomplete/xpcshell.ini',
-    ]
-
 BROWSER_CHROME_MANIFESTS += ['browser/browser.ini']
 MOCHITEST_CHROME_MANIFESTS += [
     'chrome/chrome.ini',

From 419860c96f44a887274e7f8a6433540102720509 Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Mon, 26 Sep 2016 11:09:42 +0200
Subject: [PATCH 019/102] Bug 1292723: Add wasm/validate.js tests; r=luke

MozReview-Commit-ID: K78QF3FKw1p

--HG--
extra : rebase_source : 836af3264df5880069c7d844b4bc506f2baf8ba5
extra : amend_source : 03e5538ae87450127dbc204f08e431781eed7fd1
---
 js/src/jit-test/tests/wasm/validate.js | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 js/src/jit-test/tests/wasm/validate.js

diff --git a/js/src/jit-test/tests/wasm/validate.js b/js/src/jit-test/tests/wasm/validate.js
new file mode 100644
index 000000000000..d56f01d98c14
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/validate.js
@@ -0,0 +1,26 @@
+// |jit-test| test-also-wasm-baseline
+load(libdir + "wasm.js");
+
+const { validate } = WebAssembly;
+
+assertErrorMessage(() => validate(), Error, /requires more than 0 arguments/);
+
+const argError = /first argument must be an ArrayBuffer or typed array object/;
+assertErrorMessage(() => validate(null), Error, argError);
+assertErrorMessage(() => validate(true), Error, argError);
+assertErrorMessage(() => validate(42), Error, argError);
+assertErrorMessage(() => validate(NaN), Error, argError);
+assertErrorMessage(() => validate('yo'), Error, argError);
+assertErrorMessage(() => validate([]), Error, argError);
+assertErrorMessage(() => validate({}), Error, argError);
+assertErrorMessage(() => validate(Symbol.iterator), Error, argError);
+assertErrorMessage(() => validate({ valueOf: () => new ArrayBuffer(65536) }), Error, argError);
+
+assertEq(validate(wasmTextToBinary(`(module)`)), true);
+
+assertEq(validate(wasmTextToBinary(`(module (export "run" 0))`)), false);
+assertEq(validate(wasmTextToBinary(`(module (func) (export "run" 0))`)), true);
+
+// Feature-testing proof-of-concept.
+assertEq(validate(wasmTextToBinary(`(module (memory 1) (func (result i32) (current_memory)))`)), true);
+assertEq(validate(wasmTextToBinary(`(module (memory 1) (func (result i32) (grow_memory (i32.const 42))))`)), true);

From 36f06cc08f96a1b9092042325742a62aac334146 Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Mon, 26 Sep 2016 11:04:04 +0200
Subject: [PATCH 020/102] Bug 1305197: Return value of WebAssembly_validate
 must be consistent with werror; r=luke

MozReview-Commit-ID: 3WqMltmc35l

--HG--
extra : rebase_source : e8518af45727140067e599c48371e180c65dab35
extra : amend_source : 0b513f243b5e8bd74bf3f82f3f837ef4c54f1d99
---
 js/src/asmjs/WasmJS.cpp                | 6 +++---
 js/src/jit-test/tests/wasm/validate.js | 7 +++++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/js/src/asmjs/WasmJS.cpp b/js/src/asmjs/WasmJS.cpp
index f5846ab7606c..6249ae48992c 100644
--- a/js/src/asmjs/WasmJS.cpp
+++ b/js/src/asmjs/WasmJS.cpp
@@ -1578,9 +1578,9 @@ WebAssembly_validate(JSContext* cx, unsigned argc, Value* vp)
         return false;
     }
 
-    if (error) {
-        JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING, GetErrorMessage, nullptr,
-                                     JSMSG_WASM_COMPILE_ERROR, error.get());
+    if (error && !JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING, GetErrorMessage, nullptr,
+                                               JSMSG_WASM_COMPILE_ERROR, error.get())) {
+        return false;
     }
 
     callArgs.rval().setBoolean(validated);
diff --git a/js/src/jit-test/tests/wasm/validate.js b/js/src/jit-test/tests/wasm/validate.js
index d56f01d98c14..81891e83e2c7 100644
--- a/js/src/jit-test/tests/wasm/validate.js
+++ b/js/src/jit-test/tests/wasm/validate.js
@@ -24,3 +24,10 @@ assertEq(validate(wasmTextToBinary(`(module (func) (export "run" 0))`)), true);
 // Feature-testing proof-of-concept.
 assertEq(validate(wasmTextToBinary(`(module (memory 1) (func (result i32) (current_memory)))`)), true);
 assertEq(validate(wasmTextToBinary(`(module (memory 1) (func (result i32) (grow_memory (i32.const 42))))`)), true);
+
+// Enable warning as errors.
+options("werror");
+assertErrorMessage(() => validate(wasmTextToBinary(`(module (func) (func) (export "a" 2))`)),
+                  WebAssembly.CompileError,
+                  /exported function index out of bounds/);
+options("werror");

From 08bcfd5279e0f5e41d8e387bd3b80cdbeb6350b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Tue, 27 Sep 2016 11:57:38 +0200
Subject: [PATCH 021/102] Bug 1304363 - Use preprocessing instead of CSS
 variables for identity block icon variants. r=gijs

---
 browser/themes/shared/devedition.inc.css      | 21 ++---
 .../shared/identity-block/icons.inc.css       | 62 +++++++++++++
 .../identity-block/identity-block.inc.css     | 88 +++----------------
 3 files changed, 79 insertions(+), 92 deletions(-)
 create mode 100644 browser/themes/shared/identity-block/icons.inc.css

diff --git a/browser/themes/shared/devedition.inc.css b/browser/themes/shared/devedition.inc.css
index d667d021f9ff..900fcf50d7cc 100644
--- a/browser/themes/shared/devedition.inc.css
+++ b/browser/themes/shared/devedition.inc.css
@@ -191,22 +191,11 @@ toolbar[brighttext] #downloads-indicator-counter {
   box-shadow: none !important;
 }
 
-:root[devtoolstheme="dark"] #identity-icon:-moz-lwtheme {
-  --identity-icon-normal: url(chrome://browser/skin/identity-icon.svg#normal-white);
-  --identity-icon-hover: url(chrome://browser/skin/identity-icon.svg#hover-white);
-  --identity-icon-notice: url(chrome://browser/skin/identity-icon.svg#notice-white);
-  --identity-icon-notice-hover: url(chrome://browser/skin/identity-icon.svg#notice-hover-white);
-}
-
-:root[devtoolstheme="dark"] #tracking-protection-icon:-moz-lwtheme {
-  --tracking-protection-icon-enabled: url(chrome://browser/skin/tracking-protection-16.svg#enabled-white);
-  --tracking-protection-icon-disabled: url(chrome://browser/skin/tracking-protection-16.svg#disabled-white);
-}
-
-:root[devtoolstheme="dark"] #connection-icon:-moz-lwtheme {
-  --connection-icon-mixed-passive-loaded: url(chrome://browser/skin/connection-mixed-passive-loaded.svg#icon-white);
-  --connection-icon-mixed-active-loaded: url(chrome://browser/skin/connection-mixed-active-loaded.svg#icon-white);
-}
+%filter substitution
+%define selectorPrefix :root[devtoolstheme="dark"] 
+%define selectorSuffix :-moz-lwtheme
+%define iconVariant -white
+%include identity-block/icons.inc.css
 
 #urlbar {
   border-inline-start: none !important;
diff --git a/browser/themes/shared/identity-block/icons.inc.css b/browser/themes/shared/identity-block/icons.inc.css
new file mode 100644
index 000000000000..9146683abf5f
--- /dev/null
+++ b/browser/themes/shared/identity-block/icons.inc.css
@@ -0,0 +1,62 @@
+%if 0
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+%endif
+
+@selectorPrefix@#identity-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/identity-icon.svg#normal@iconVariant@);
+}
+
+@selectorPrefix@#identity-box:hover > #identity-icon:not(.no-hover)@selectorSuffix@,
+@selectorPrefix@#identity-box[open=true] > #identity-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/identity-icon.svg#hover@iconVariant@);
+}
+
+@selectorPrefix@#identity-box.grantedPermissions > #identity-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/identity-icon.svg#notice@iconVariant@);
+}
+
+@selectorPrefix@#identity-box.grantedPermissions:hover > #identity-icon:not(.no-hover)@selectorSuffix@,
+@selectorPrefix@#identity-box.grantedPermissions[open=true] > #identity-icon@selectorSuffix@ {
+  list-style-image: url(url(chrome://browser/skin/identity-icon.svg#notice-hover@iconVariant@));
+}
+
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.chromeUI > #identity-icon@selectorSuffix@ {
+  list-style-image: url(chrome://branding/content/identity-icons-brand.svg);
+}
+
+
+@selectorPrefix@#tracking-protection-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/tracking-protection-16.svg#enabled@iconVariant@);
+}
+
+@selectorPrefix@#tracking-protection-icon[state="loaded-tracking-content"]@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/tracking-protection-16.svg#disabled@iconVariant@);
+}
+
+
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.verifiedDomain > #connection-icon@selectorSuffix@,
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity > #connection-icon@selectorSuffix@,
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.mixedActiveBlocked > #connection-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/connection-secure.svg);
+  visibility: visible;
+}
+
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.certUserOverridden > #connection-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/connection-mixed-passive-loaded.svg#icon@iconVariant@);
+  visibility: visible;
+}
+
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.insecureLoginForms > #connection-icon@selectorSuffix@,
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.mixedActiveContent > #connection-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/connection-mixed-active-loaded.svg#icon@iconVariant@);
+  visibility: visible;
+}
+
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.weakCipher > #connection-icon@selectorSuffix@,
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.mixedDisplayContent > #connection-icon@selectorSuffix@,
+@selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.mixedDisplayContentLoadedActiveBlocked > #connection-icon@selectorSuffix@ {
+  list-style-image: url(chrome://browser/skin/connection-mixed-passive-loaded.svg#icon@iconVariant@);
+  visibility: visible;
+}
diff --git a/browser/themes/shared/identity-block/identity-block.inc.css b/browser/themes/shared/identity-block/identity-block.inc.css
index 01922edb52b0..d8627806649c 100644
--- a/browser/themes/shared/identity-block/identity-block.inc.css
+++ b/browser/themes/shared/identity-block/identity-block.inc.css
@@ -4,6 +4,18 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 %endif
 
+%filter substitution
+
+%define selectorPrefix
+%define selectorSuffix
+%define iconVariant
+%include icons.inc.css
+
+%define selectorPrefix
+%define selectorSuffix :-moz-lwtheme
+%define iconVariant -black
+%include icons.inc.css
+
 #identity-box {
   font-size: .9em;
   padding: 3px 5px;
@@ -52,39 +64,8 @@
 /* MAIN IDENTITY ICON */
 
 #identity-icon {
-  --identity-icon-normal: url(chrome://browser/skin/identity-icon.svg#normal);
-  --identity-icon-hover: url(chrome://browser/skin/identity-icon.svg#hover);
-  --identity-icon-notice: url(chrome://browser/skin/identity-icon.svg#notice);
-  --identity-icon-notice-hover: url(chrome://browser/skin/identity-icon.svg#notice-hover);
-
   width: 16px;
   height: 16px;
-  list-style-image: var(--identity-icon-normal);
-}
-
-#identity-icon:-moz-lwtheme {
-  --identity-icon-normal: url(chrome://browser/skin/identity-icon.svg#normal-black);
-  --identity-icon-hover: url(chrome://browser/skin/identity-icon.svg#hover-black);
-  --identity-icon-notice: url(chrome://browser/skin/identity-icon.svg#notice-black);
-  --identity-icon-notice-hover: url(chrome://browser/skin/identity-icon.svg#notice-hover-black);
-}
-
-#identity-box:hover > #identity-icon:not(.no-hover),
-#identity-box[open=true] > #identity-icon {
-  list-style-image: var(--identity-icon-hover);
-}
-
-#identity-box.grantedPermissions > #identity-icon {
-  list-style-image: var(--identity-icon-notice);
-}
-
-#identity-box.grantedPermissions:hover > #identity-icon:not(.no-hover),
-#identity-box.grantedPermissions[open=true] > #identity-icon {
-  list-style-image: var(--identity-icon-notice-hover);
-}
-
-#urlbar[pageproxystate="valid"] > #identity-box.chromeUI > #identity-icon {
-  list-style-image: url(chrome://branding/content/identity-icons-brand.svg);
 }
 
 #urlbar[pageproxystate="invalid"] > #identity-box > #identity-icon {
@@ -142,23 +123,10 @@
 /* TRACKING PROTECTION ICON */
 
 #tracking-protection-icon {
-  --tracking-protection-icon-enabled: url(chrome://browser/skin/tracking-protection-16.svg#enabled);
-  --tracking-protection-icon-disabled: url(chrome://browser/skin/tracking-protection-16.svg#disabled);
-
   width: 16px;
   height: 16px;
   margin-inline-start: 2px;
   margin-inline-end: 0;
-  list-style-image: var(--tracking-protection-icon-enabled);
-}
-
-#tracking-protection-icon:-moz-lwtheme {
-  --tracking-protection-icon-enabled: url(chrome://browser/skin/tracking-protection-16.svg#enabled-black);
-  --tracking-protection-icon-disabled: url(chrome://browser/skin/tracking-protection-16.svg#disabled-black);
-}
-
-#tracking-protection-icon[state="loaded-tracking-content"] {
-  list-style-image: var(--tracking-protection-icon-disabled);
 }
 
 #tracking-protection-icon[animate] {
@@ -184,37 +152,5 @@
   height: 16px;
   margin-inline-start: 2px;
   visibility: collapse;
-
-  --connection-icon-mixed-passive-loaded: url(chrome://browser/skin/connection-mixed-passive-loaded.svg#icon);
-  --connection-icon-mixed-active-loaded: url(chrome://browser/skin/connection-mixed-active-loaded.svg#icon);
 }
 
-#connection-icon:-moz-lwtheme {
-  --connection-icon-mixed-passive-loaded: url(chrome://browser/skin/connection-mixed-passive-loaded.svg#icon-black);
-  --connection-icon-mixed-active-loaded: url(chrome://browser/skin/connection-mixed-active-loaded.svg#icon-black);
-}
-
-#urlbar[pageproxystate="valid"] > #identity-box.verifiedDomain > #connection-icon,
-#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity > #connection-icon,
-#urlbar[pageproxystate="valid"] > #identity-box.mixedActiveBlocked > #connection-icon {
-  list-style-image: url(chrome://browser/skin/connection-secure.svg);
-  visibility: visible;
-}
-
-#urlbar[pageproxystate="valid"] > #identity-box.certUserOverridden > #connection-icon {
-  list-style-image: var(--connection-icon-mixed-passive-loaded);
-  visibility: visible;
-}
-
-#urlbar[pageproxystate="valid"] > #identity-box.insecureLoginForms > #connection-icon,
-#urlbar[pageproxystate="valid"] > #identity-box.mixedActiveContent > #connection-icon {
-  list-style-image: var(--connection-icon-mixed-active-loaded);
-  visibility: visible;
-}
-
-#urlbar[pageproxystate="valid"] > #identity-box.weakCipher > #connection-icon,
-#urlbar[pageproxystate="valid"] > #identity-box.mixedDisplayContent > #connection-icon,
-#urlbar[pageproxystate="valid"] > #identity-box.mixedDisplayContentLoadedActiveBlocked > #connection-icon {
-  list-style-image: var(--connection-icon-mixed-passive-loaded);
-  visibility: visible;
-}

From a0109e9d9f0e125058ef672399629dda89f7ea08 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 27 Sep 2016 09:59:09 +0000
Subject: [PATCH 022/102] Bug 1298354 - Do not add AssertRange instructions in
 unreachable blocks. r=sunfish

---
 js/src/jit-test/tests/ion/bug1298354.js | 17 +++++++++++++++++
 js/src/jit/RangeAnalysis.cpp            |  4 ++++
 2 files changed, 21 insertions(+)
 create mode 100644 js/src/jit-test/tests/ion/bug1298354.js

diff --git a/js/src/jit-test/tests/ion/bug1298354.js b/js/src/jit-test/tests/ion/bug1298354.js
new file mode 100644
index 000000000000..73502df5a791
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1298354.js
@@ -0,0 +1,17 @@
+// |jit-test| error: ReferenceError
+
+new Function(`
+  while (true) {
+    try {
+        var buf = new Uint8ClampedArray(a);
+    } catch (e) {
+        break;
+    }
+  }
+  var caughtInvalidArguments = false;
+  while (true) {
+    var a = inIon() ? -true.get : 0;
+    while (x > 7 & 0) {}
+  }
+`)();
+
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index d7ad1bd3b2ec..09da6f99cee3 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2346,6 +2346,10 @@ RangeAnalysis::addRangeAssertions()
     for (ReversePostorderIterator iter(graph_.rpoBegin()); iter != graph_.rpoEnd(); iter++) {
         MBasicBlock* block = *iter;
 
+        // Do not add assertions in unreachable blocks.
+        if (block->unreachable())
+            continue;
+
         for (MDefinitionIterator iter(block); iter; iter++) {
             MDefinition* ins = *iter;
 

From 653a0511a56af10028c3ba90f6187e00eed44356 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 27 Sep 2016 10:07:59 +0000
Subject: [PATCH 023/102] Bug 1299007 - Ensure enough ballast space in
 RangeAnalysis::prepareForUCE. r=sunfish

---
 js/src/jit-test/tests/ion/bug1299007.js | 41 +++++++++++++++++++++++++
 js/src/jit/RangeAnalysis.cpp            | 15 ++++-----
 2 files changed, 49 insertions(+), 7 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1299007.js

diff --git a/js/src/jit-test/tests/ion/bug1299007.js b/js/src/jit-test/tests/ion/bug1299007.js
new file mode 100644
index 000000000000..fb7f15184d5c
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1299007.js
@@ -0,0 +1,41 @@
+
+evalInFrame = function(global) {
+   dbgGlobal = newGlobal()
+   dbg = new dbgGlobal.Debugger
+   return function(upCount, code) {
+       dbg.addDebuggee(global)
+       var frame = dbg.getNewestFrame().older
+       for (var i = 0; i < upCount; i++)
+           if (!frame) frame = older
+       completion = frame.eval(code)
+   }
+}(this);
+function h() {
+    evalInFrame(0, "")
+    evalInFrame(0, "i")
+    evalInFrame(0, "a.push")
+    evalInFrame(1, "a.pushy")
+}
+function g() h()
+function f() g()
+f()
+evaluate(`
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+g()
+h()
+`);
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index 09da6f99cee3..3921e0b9d948 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -3495,13 +3495,14 @@ RangeAnalysis::prepareForUCE(bool* shouldRemoveDeadCode)
         // added by MBeta::computeRange on its own block.
         MTest* test = cond->toTest();
         MDefinition* condition = test->input();
-        MConstant* constant = nullptr;
-        if (block == test->ifTrue()) {
-            constant = MConstant::New(alloc(), BooleanValue(false));
-        } else {
-            MOZ_ASSERT(block == test->ifFalse());
-            constant = MConstant::New(alloc(), BooleanValue(true));
-        }
+
+        // If the false-branch is unreachable, then the test condition must be true.
+        // If the true-branch is unreachable, then the test condition must be false.
+        MOZ_ASSERT(block == test->ifTrue() || block == test->ifFalse());
+        bool value = block == test->ifFalse();
+        MConstant* constant = MConstant::New(alloc().fallible(), BooleanValue(value));
+        if (!constant)
+            return false;
 
         if (DeadIfUnused(condition))
             condition->setGuardRangeBailoutsUnchecked();

From 0753e4f3223934bddce62031d1c483668906c610 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 27 Sep 2016 10:07:59 +0000
Subject: [PATCH 024/102] Bug 1296667 - Ensure enough ballast space when given
 large list of parameters. r=h4writer

---
 js/src/jit-test/tests/ion/bug1296667.js | 11 +++++++++++
 js/src/jit/IonBuilder.cpp               | 24 +++++++++++++++++-------
 js/src/jit/IonBuilder.h                 |  4 ++--
 js/src/jit/MIR.cpp                      |  9 ++++-----
 js/src/jit/MIR.h                        |  6 ++----
 5 files changed, 36 insertions(+), 18 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1296667.js

diff --git a/js/src/jit-test/tests/ion/bug1296667.js b/js/src/jit-test/tests/ion/bug1296667.js
new file mode 100644
index 000000000000..24cf5ff80489
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1296667.js
@@ -0,0 +1,11 @@
+args = ""
+for (i = 0; i < 2000; i++) {
+    args += "arg" + i;
+    if (i != 1999) args += ",";
+}
+MyFunc = MyObject = Function(args, "for (var i = 0; i < MyFunc.length; i++ )   break; eval('this.arg'+i +'=arg'+i) ");
+new function TestCase() {
+    if (inIon())
+        return;
+    TestCase(eval("var EXP_1 = new MyObject; var EXP_2 = new MyObject; EXP_1 - EXP_2"));
+}
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index a4aa7405a7e6..acb304c9e4c0 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -823,7 +823,8 @@ IonBuilder::build()
     }
 #endif
 
-    initParameters();
+    if (!initParameters())
+        return false;
     initLocals();
 
     // Initialize something for the env chain. We can bail out before the
@@ -862,7 +863,8 @@ IonBuilder::build()
 
     // Parameters have been checked to correspond to the typeset, now we unbox
     // what we can in an infallible manner.
-    rewriteParameters();
+    if (!rewriteParameters())
+        return false;
 
     // Check for redeclaration errors for global scripts.
     if (!info().funMaybeLazy() && !info().module() &&
@@ -1136,25 +1138,29 @@ IonBuilder::rewriteParameter(uint32_t slotIdx, MDefinition* param, int32_t argIn
 // Apply Type Inference information to parameters early on, unboxing them if
 // they have a definitive type. The actual guards will be emitted by the code
 // generator, explicitly, as part of the function prologue.
-void
+bool
 IonBuilder::rewriteParameters()
 {
     MOZ_ASSERT(info().environmentChainSlot() == 0);
 
     if (!info().funMaybeLazy())
-        return;
+        return true;
 
     for (uint32_t i = info().startArgSlot(); i < info().endArgSlot(); i++) {
+        if (!alloc().ensureBallast())
+            return false;
         MDefinition* param = current->getSlot(i);
         rewriteParameter(i, param, param->toParameter()->index());
     }
+
+    return true;
 }
 
-void
+bool
 IonBuilder::initParameters()
 {
     if (!info().funMaybeLazy())
-        return;
+        return true;
 
     // If we are doing OSR on a frame which initially executed in the
     // interpreter and didn't accumulate type information, try to use that OSR
@@ -1182,10 +1188,14 @@ IonBuilder::initParameters()
             types->addType(type, alloc_->lifoAlloc());
         }
 
-        param = MParameter::New(alloc(), i, types);
+        param = MParameter::New(alloc().fallible(), i, types);
+        if (!param)
+            return false;
         current->add(param);
         current->initSlot(info().argSlotUnchecked(i), param);
     }
+
+    return true;
 }
 
 void
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 170488a148f2..dad2fb8e73d1 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -336,10 +336,10 @@ class IonBuilder
 
     void insertRecompileCheck();
 
-    void initParameters();
+    MOZ_MUST_USE bool initParameters();
     void initLocals();
     void rewriteParameter(uint32_t slotIdx, MDefinition* param, int32_t argIndex);
-    void rewriteParameters();
+    MOZ_MUST_USE bool rewriteParameters();
     MOZ_MUST_USE bool initEnvironmentChain(MDefinition* callee = nullptr);
     MOZ_MUST_USE bool initArgumentsObject();
     void pushConstant(const Value& v);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 8c9f0ca39e8e..5bf69c88caf0 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1867,11 +1867,10 @@ MAtomicIsLockFree::foldsTo(TempAllocator& alloc)
     return MConstant::New(alloc, BooleanValue(AtomicOperations::isLockfree(i)));
 }
 
-MParameter*
-MParameter::New(TempAllocator& alloc, int32_t index, TemporaryTypeSet* types)
-{
-    return new(alloc) MParameter(index, types);
-}
+// Define |THIS_SLOT| as part of this translation unit, as it is used to
+// specialized the parameterized |New| function calls introduced by
+// TRIVIAL_NEW_WRAPPERS.
+const int32_t MParameter::THIS_SLOT;
 
 void
 MParameter::printOpcode(GenericPrinter& out) const
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index d99f3125cc02..18ad32586d59 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2665,9 +2665,6 @@ class MParameter : public MNullaryInstruction
 {
     int32_t index_;
 
-  public:
-    static const int32_t THIS_SLOT = -1;
-
     MParameter(int32_t index, TemporaryTypeSet* types)
       : index_(index)
     {
@@ -2677,8 +2674,9 @@ class MParameter : public MNullaryInstruction
 
   public:
     INSTRUCTION_HEADER(Parameter)
-    static MParameter* New(TempAllocator& alloc, int32_t index, TemporaryTypeSet* types);
+    TRIVIAL_NEW_WRAPPERS
 
+    static const int32_t THIS_SLOT = -1;
     int32_t index() const {
         return index_;
     }

From add5fa9ec4d68f868f57f7bef61dfc0637466af5 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Tue, 27 Sep 2016 13:47:53 +0300
Subject: [PATCH 025/102] Bug 1286911. r=wchen.

MozReview-Commit-ID: hzAu0jKAxt
---
 parser/html/javasrc/HtmlAttributes.java       |   2 +-
 parser/html/javasrc/Tokenizer.java            | 183 ++++++++++++------
 parser/html/nsHtml5Tokenizer.cpp              | 140 ++++++++------
 parser/html/nsHtml5Tokenizer.h                |  41 ++--
 parser/html/nsHtml5TreeBuilderCppSupplement.h |   4 +-
 5 files changed, 239 insertions(+), 131 deletions(-)

diff --git a/parser/html/javasrc/HtmlAttributes.java b/parser/html/javasrc/HtmlAttributes.java
index 029703c19fa7..0ec25f96f0ae 100644
--- a/parser/html/javasrc/HtmlAttributes.java
+++ b/parser/html/javasrc/HtmlAttributes.java
@@ -62,7 +62,7 @@ public final class HtmlAttributes implements Attributes {
     private @Auto AttributeName[] names;
 
     private @Auto String[] values; // XXX perhaps make this @NoLength?
-
+    
     // CPPONLY: private @Auto int[] lines; // XXX perhaps make this @NoLength?
 
     // [NOCPP[
diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index 14ad0c0722ab..7e529035d846 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -817,30 +817,34 @@ public class Tokenizer implements Locator {
     }
 
     @Inline private void appendCharRefBuf(char c) {
+        // CPPONLY: assert charRefBufLen < charRefBuf.length:
+        // CPPONLY:     "RELEASE: Attempted to overrun charRefBuf!";
         charRefBuf[charRefBufLen++] = c;
     }
 
-    @Inline private void clearCharRefBufAndAppend(char c) {
-        charRefBuf[0] = c;
-        charRefBufLen = 1;
-    }
-
     private void emitOrAppendCharRefBuf(int returnState) throws SAXException {
         if ((returnState & DATA_AND_RCDATA_MASK) != 0) {
             appendCharRefBufToStrBuf();
         } else {
             if (charRefBufLen > 0) {
                 tokenHandler.characters(charRefBuf, 0, charRefBufLen);
+                charRefBufLen = 0;
             }
         }
     }
 
-    @Inline private void clearStrBufAndAppend(char c) {
-        strBuf[0] = c;
-        strBufLen = 1;
+    @Inline private void clearStrBufAfterUse() {
+        strBufLen = 0;
     }
 
-    @Inline private void clearStrBuf() {
+    @Inline private void clearStrBufBeforeUse() {
+        assert strBufLen == 0: "strBufLen not reset after previous use!";
+        strBufLen = 0; // no-op in the absence of bugs
+    }
+
+    @Inline private void clearStrBufAfterOneHyphen() {
+        assert strBufLen == 1: "strBufLen length not one!";
+        assert strBuf[0] == '-': "strBuf does not start with a hyphen!";
         strBufLen = 0;
     }
 
@@ -850,7 +854,13 @@ public class Tokenizer implements Locator {
      * @param c
      *            the UTF-16 code unit to append
      */
-    private void appendStrBuf(char c) {
+    @Inline private void appendStrBuf(char c) {
+        // CPPONLY: assert strBufLen < strBuf.length: "Previous buffer length insufficient.";
+        // CPPONLY: if (strBufLen == strBuf.length) {
+        // CPPONLY:     if (!EnsureBufferSpace(1)) {
+        // CPPONLY:         assert false: "RELEASE: Unable to recover from buffer reallocation failure";
+        // CPPONLY:     } // TODO: Add telemetry when outer if fires but inner does not
+        // CPPONLY: }
         strBuf[strBufLen++] = c;
     }
 
@@ -863,9 +873,11 @@ public class Tokenizer implements Locator {
      * @return the buffer as a string
      */
     protected String strBufToString() {
-        return Portability.newStringFromBuffer(strBuf, 0, strBufLen
+        String str = Portability.newStringFromBuffer(strBuf, 0, strBufLen
             // CPPONLY: , tokenHandler
         );
+        clearStrBufAfterUse();
+        return str;
     }
 
     /**
@@ -877,6 +889,7 @@ public class Tokenizer implements Locator {
     private void strBufToDoctypeName() {
         doctypeName = Portability.newLocalNameFromBuffer(strBuf, 0, strBufLen,
                 interner);
+        clearStrBufAfterUse();
     }
 
     /**
@@ -888,6 +901,7 @@ public class Tokenizer implements Locator {
     private void emitStrBuf() throws SAXException {
         if (strBufLen > 0) {
             tokenHandler.characters(strBuf, 0, strBufLen);
+            clearStrBufAfterUse();
         }
     }
 
@@ -934,6 +948,8 @@ public class Tokenizer implements Locator {
         switch (commentPolicy) {
             case ALTER_INFOSET:
                 strBufLen--;
+                // WARNING!!! This expands the worst case of the buffer length
+                // given the length of input!
                 appendStrBuf(' ');
                 appendStrBuf('-');
                 // FALLTHROUGH
@@ -951,14 +967,15 @@ public class Tokenizer implements Locator {
     }
 
     private void appendStrBuf(@NoLength char[] buffer, int offset, int length) {
-        int reqLen = strBufLen + length;
-        if (strBuf.length < reqLen) {
-            char[] newBuf = new char[reqLen + (reqLen >> 1)];
-            System.arraycopy(strBuf, 0, newBuf, 0, strBuf.length);
-            strBuf = newBuf;
-        }
+        int newLen = strBufLen + length;
+        // CPPONLY: assert newLen <= strBuf.length: "Previous buffer length insufficient.";
+        // CPPONLY: if (strBuf.length < newLen) {
+        // CPPONLY:     if (!EnsureBufferSpace(length)) {
+        // CPPONLY:         assert false: "RELEASE: Unable to recover from buffer reallocation failure";
+        // CPPONLY:     } // TODO: Add telemetry when outer if fires but inner does not
+        // CPPONLY: }
         System.arraycopy(buffer, offset, strBuf, strBufLen, length);
-        strBufLen = reqLen;
+        strBufLen = newLen;
     }
 
     /**
@@ -966,6 +983,7 @@ public class Tokenizer implements Locator {
      */
     @Inline private void appendCharRefBufToStrBuf() {
         appendStrBuf(charRefBuf, 0, charRefBufLen);
+        charRefBufLen = 0;
     }
 
     /**
@@ -986,6 +1004,7 @@ public class Tokenizer implements Locator {
             // [NOCPP[
         }
         // ]NOCPP]
+        clearStrBufAfterUse();
         cstart = pos + 1;
     }
 
@@ -1073,6 +1092,7 @@ public class Tokenizer implements Locator {
     private void strBufToElementNameString() {
         tagName = ElementName.elementNameByBuffer(strBuf, 0, strBufLen,
                 interner);
+        clearStrBufAfterUse();
     }
 
     private int emitCurrentTagToken(boolean selfClosing, int pos)
@@ -1124,6 +1144,7 @@ public class Tokenizer implements Locator {
                 , namePolicy != XmlViolationPolicy.ALLOW
                 // ]NOCPP]
                 , interner);
+        clearStrBufAfterUse();
 
         if (attributes == null) {
             attributes = new HtmlAttributes(mappingLangToXmlLang);
@@ -1190,6 +1211,8 @@ public class Tokenizer implements Locator {
             // ]NOCPP]
             attributeName = null; // attributeName has been adopted by the
             // |attributes| object
+        } else {
+            clearStrBufAfterUse();
         }
     }
 
@@ -1338,6 +1361,14 @@ public class Tokenizer implements Locator {
         // unifying the tokenizer and tree builder buffers in the future.
         int worstCase = strBufLen + inputLength + charRefBufLen + 2;
         tokenHandler.ensureBufferSpace(worstCase);
+        if (commentPolicy == XmlViolationPolicy.ALTER_INFOSET) {
+            // When altering infoset, if the comment contents are consecutive
+            // hyphens, each hyphen generates a space, too. These buffer
+            // contents never get emitted as characters() to the tokenHandler,
+            // which is why this calculation happens after the call to 
+            // ensureBufferSpace on tokenHandler.
+            worstCase *= 2;
+        }
         if (strBuf == null) {
             // Add an arbitrary small value to avoid immediate reallocation
             // once there are a few characters in the buffer.
@@ -1446,7 +1477,8 @@ public class Tokenizer implements Locator {
                                  * reference in data state.
                                  */
                                 flushChars(buf, pos);
-                                clearCharRefBufAndAppend(c);
+                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
+                                appendCharRefBuf(c);
                                 setAdditionalAndRememberAmpersandLocation('\u0000');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1506,7 +1538,8 @@ public class Tokenizer implements Locator {
                              * input character (add 0x0020 to the character's
                              * code point),
                              */
-                            clearStrBufAndAppend((char) (c + 0x20));
+                            clearStrBufBeforeUse();
+                            appendStrBuf((char) (c + 0x20));
                             /* then switch to the tag name state. */
                             state = transition(state, Tokenizer.TAG_NAME, reconsume, pos);
                             /*
@@ -1525,7 +1558,8 @@ public class Tokenizer implements Locator {
                             /*
                              * set its tag name to the input character,
                              */
-                            clearStrBufAndAppend(c);
+                            clearStrBufBeforeUse();
+                            appendStrBuf(c);
                             /* then switch to the tag name state. */
                             state = transition(state, Tokenizer.TAG_NAME, reconsume, pos);
                             /*
@@ -1565,7 +1599,8 @@ public class Tokenizer implements Locator {
                                 /*
                                  * Switch to the bogus comment state.
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
                             case '>':
@@ -1768,7 +1803,8 @@ public class Tokenizer implements Locator {
                                  * Set that attribute's name to the current
                                  * input character,
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 /*
                                  * and its value to the empty string.
                                  */
@@ -1914,7 +1950,7 @@ public class Tokenizer implements Locator {
                                  * attribute value (double-quoted) state.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_DOUBLE_QUOTED, reconsume, pos);
                                 break beforeattributevalueloop;
                             // continue stateloop;
@@ -1925,7 +1961,7 @@ public class Tokenizer implements Locator {
                                  * input character.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 reconsume = true;
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
                                 noteUnquotedAttributeValue();
@@ -1936,7 +1972,7 @@ public class Tokenizer implements Locator {
                                  * value (single-quoted) state.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_SINGLE_QUOTED, reconsume, pos);
                                 continue stateloop;
                             case '>':
@@ -1980,7 +2016,8 @@ public class Tokenizer implements Locator {
                                  * character to the current attribute's value.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 /*
                                  * Switch to the attribute value (unquoted)
                                  * state.
@@ -2023,7 +2060,8 @@ public class Tokenizer implements Locator {
                                  * additional allowed character being U+0022
                                  * QUOTATION MARK (").
                                  */
-                                clearCharRefBufAndAppend(c);
+                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
+                                appendCharRefBuf(c);
                                 setAdditionalAndRememberAmpersandLocation('\"');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -2192,7 +2230,8 @@ public class Tokenizer implements Locator {
                                  * additional allowed character being U+003E
                                  * GREATER-THAN SIGN (>)
                                  */
-                                clearCharRefBufAndAppend(c);
+                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
+                                appendCharRefBuf(c);
                                 setAdditionalAndRememberAmpersandLocation('>');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -2331,7 +2370,8 @@ public class Tokenizer implements Locator {
                                  * Set that attribute's name to the current
                                  * input character,
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 /*
                                  * and its value to the empty string.
                                  */
@@ -2377,19 +2417,22 @@ public class Tokenizer implements Locator {
                          */
                         switch (c) {
                             case '-':
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 state = transition(state, Tokenizer.MARKUP_DECLARATION_HYPHEN, reconsume, pos);
                                 break markupdeclarationopenloop;
                             // continue stateloop;
                             case 'd':
                             case 'D':
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 index = 0;
                                 state = transition(state, Tokenizer.MARKUP_DECLARATION_OCTYPE, reconsume, pos);
                                 continue stateloop;
                             case '[':
                                 if (tokenHandler.cdataSectionAllowed()) {
-                                    clearStrBufAndAppend(c);
+                                    clearStrBufBeforeUse();
+                                    appendStrBuf(c);
                                     index = 0;
                                     state = transition(state, Tokenizer.CDATA_START, reconsume, pos);
                                     continue stateloop;
@@ -2397,7 +2440,7 @@ public class Tokenizer implements Locator {
                                 // else fall through
                             default:
                                 errBogusComment();
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 reconsume = true;
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
@@ -2414,7 +2457,7 @@ public class Tokenizer implements Locator {
                             case '\u0000':
                                 break stateloop;
                             case '-':
-                                clearStrBuf();
+                                clearStrBufAfterOneHyphen();
                                 state = transition(state, Tokenizer.COMMENT_START, reconsume, pos);
                                 break markupdeclarationhyphenloop;
                             // continue stateloop;
@@ -2768,6 +2811,7 @@ public class Tokenizer implements Locator {
                             index++;
                             continue;
                         } else {
+                            clearStrBufAfterUse();
                             cstart = pos; // start coalescing
                             reconsume = true;
                             state = transition(state, Tokenizer.CDATA_SECTION, reconsume, pos);
@@ -2881,7 +2925,8 @@ public class Tokenizer implements Locator {
                                  * + additional allowed character being U+0027
                                  * APOSTROPHE (').
                                  */
-                                clearCharRefBufAndAppend(c);
+                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
+                                appendCharRefBuf(c);
                                 setAdditionalAndRememberAmpersandLocation('\'');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -3229,6 +3274,8 @@ public class Tokenizer implements Locator {
                                         charRefBufLen - charRefBufMark);
                             }
                         }
+                        // charRefBufLen will be zeroed below!
+
                         // Check if we broke out early with c being the last
                         // character that matched as opposed to being the
                         // first one that didn't match. In the case of an 
@@ -3236,6 +3283,7 @@ public class Tokenizer implements Locator {
                         // *after* the current character and the current 
                         // character shouldn't be reconsumed.
                         boolean earlyBreak = (c == ';' && charRefBufMark == charRefBufLen);
+                        charRefBufLen = 0;
                         if ((returnState & DATA_AND_RCDATA_MASK) == 0) {
                             cstart = earlyBreak ? pos + 1 : pos;
                         }
@@ -3374,6 +3422,8 @@ public class Tokenizer implements Locator {
                     // WARNING FALLTHRU CASE TRANSITION: DON'T REORDER
                 case HANDLE_NCR_VALUE:
                     // WARNING previous state sets reconsume
+                    // We are not going to emit the contents of charRefBuf.
+                    charRefBufLen = 0;
                     // XXX inline this case if the method size can take it
                     handleNcrValue(returnState);
                     state = transition(state, returnState, reconsume, pos);
@@ -3520,7 +3570,8 @@ public class Tokenizer implements Locator {
                             /*
                              * Switch to the bogus comment state.
                              */
-                            clearStrBufAndAppend('\n');
+                            clearStrBufBeforeUse();
+                            appendStrBuf('\n');
                             state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                             break stateloop;
                         case '\n':
@@ -3530,7 +3581,8 @@ public class Tokenizer implements Locator {
                             /*
                              * Switch to the bogus comment state.
                              */
-                            clearStrBufAndAppend('\n');
+                            clearStrBufBeforeUse();
+                            appendStrBuf(c);
                             state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                             continue stateloop;
                         case '\u0000':
@@ -3550,7 +3602,8 @@ public class Tokenizer implements Locator {
                                 /*
                                  * set its tag name to the input character,
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 /*
                                  * then switch to the tag name state. (Don't
                                  * emit the token yet; further details will be
@@ -3564,7 +3617,8 @@ public class Tokenizer implements Locator {
                                 /*
                                  * Switch to the bogus comment state.
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
                             }
@@ -3587,7 +3641,8 @@ public class Tokenizer implements Locator {
                                  * reference in RCDATA state.
                                  */
                                 flushChars(buf, pos);
-                                clearCharRefBufAndAppend(c);
+                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
+                                appendCharRefBuf(c);
                                 setAdditionalAndRememberAmpersandLocation('\u0000');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -3672,7 +3727,7 @@ public class Tokenizer implements Locator {
                                  * data end tag open state.
                                  */
                                 index = 0;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 break rawtextrcdatalessthansignloop;
                             // FALL THRU continue stateloop;
@@ -3701,7 +3756,7 @@ public class Tokenizer implements Locator {
                         c = checkChar(buf, pos);
                         /*
                          * ASSERT! when entering this state, set index to 0 and
-                         * call clearStrBuf() assert (contentModelElement !=
+                         * call clearStrBufBeforeUse() assert (contentModelElement !=
                          * null); Let's implement the above without lookahead.
                          * strBuf is the 'temporary buffer'.
                          */
@@ -3734,6 +3789,7 @@ public class Tokenizer implements Locator {
                             switch (c) {
                                 case '\r':
                                     silentCarriageReturn();
+                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                                     break stateloop;
                                 case '\n':
@@ -3749,6 +3805,7 @@ public class Tokenizer implements Locator {
                                      * appropriate end tag token, then switch to
                                      * the before attribute name state.
                                      */
+                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                                     continue stateloop;
                                 case '/':
@@ -3758,6 +3815,7 @@ public class Tokenizer implements Locator {
                                      * then switch to the self-closing start tag
                                      * state.
                                      */
+                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.SELF_CLOSING_START_TAG, reconsume, pos);
                                     continue stateloop;
                                 case '>':
@@ -3767,6 +3825,7 @@ public class Tokenizer implements Locator {
                                      * end tag token, then emit the current tag
                                      * token and switch to the data state.
                                      */
+                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, emitCurrentTagToken(false, pos), reconsume, pos);
                                     if (shouldSuspend) {
                                         break stateloop;
@@ -3941,7 +4000,7 @@ public class Tokenizer implements Locator {
                                  * data end tag open state.
                                  */
                                 index = 0;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 continue stateloop;
                             case '!':
@@ -4199,7 +4258,7 @@ public class Tokenizer implements Locator {
                                  * data escaped end tag open state.
                                  */
                                 index = 0;
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 returnState = Tokenizer.SCRIPT_DATA_ESCAPED;
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 continue stateloop;
@@ -4681,7 +4740,8 @@ public class Tokenizer implements Locator {
                                  * Set the token's name name to the current
                                  * input character.
                                  */
-                                clearStrBufAndAppend(c);
+                                clearStrBufBeforeUse();
+                                appendStrBuf(c);
                                 /*
                                  * Switch to the DOCTYPE name state.
                                  */
@@ -4902,7 +4962,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -4918,7 +4978,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -4989,7 +5049,7 @@ public class Tokenizer implements Locator {
                                  * token's public identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -5003,7 +5063,7 @@ public class Tokenizer implements Locator {
                                  * public identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -5154,7 +5214,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5170,7 +5230,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5235,7 +5295,7 @@ public class Tokenizer implements Locator {
                                  * token's system identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5249,7 +5309,7 @@ public class Tokenizer implements Locator {
                                  * system identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5498,7 +5558,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -5514,7 +5574,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -5585,7 +5645,7 @@ public class Tokenizer implements Locator {
                                  * token's system identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5598,7 +5658,7 @@ public class Tokenizer implements Locator {
                                  * system identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBuf();
+                                clearStrBufBeforeUse();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5814,6 +5874,9 @@ public class Tokenizer implements Locator {
     // ]NOCPP]
     
     private void initDoctypeFields() {
+        // Discard the characters "DOCTYPE" accumulated as a potential bogus
+        // comment into strBuf.
+        clearStrBufAfterUse();
         doctypeName = "";
         if (systemIdentifier != null) {
             Portability.releaseString(systemIdentifier);
@@ -6101,7 +6164,6 @@ public class Tokenizer implements Locator {
                     break eofloop;
                 case MARKUP_DECLARATION_OPEN:
                     errBogusComment();
-                    clearStrBuf();
                     emitComment(0, 0);
                     break eofloop;
                 case MARKUP_DECLARATION_HYPHEN:
@@ -6457,6 +6519,7 @@ public class Tokenizer implements Locator {
                                         charRefBufLen - charRefBufMark);
                             }
                         }
+                        charRefBufLen = 0;
                         state = returnState;
                         continue eofloop;
                         /*
@@ -6636,7 +6699,7 @@ public class Tokenizer implements Locator {
     }
 
     public void resetToDataState() {
-        strBufLen = 0;
+        clearStrBufAfterUse();
         charRefBufLen = 0;
         stateSave = Tokenizer.DATA;
         // line = 1; XXX line numbers
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 24b3604d40b8..550d2da8ffac 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -217,26 +217,24 @@ nsHtml5Tokenizer::emitOrAppendCharRefBuf(int32_t returnState)
   } else {
     if (charRefBufLen > 0) {
       tokenHandler->characters(charRefBuf, 0, charRefBufLen);
+      charRefBufLen = 0;
     }
   }
 }
 
-void 
-nsHtml5Tokenizer::appendStrBuf(char16_t c)
-{
-  strBuf[strBufLen++] = c;
-}
-
 nsString* 
 nsHtml5Tokenizer::strBufToString()
 {
-  return nsHtml5Portability::newStringFromBuffer(strBuf, 0, strBufLen, tokenHandler);
+  nsString* str = nsHtml5Portability::newStringFromBuffer(strBuf, 0, strBufLen, tokenHandler);
+  clearStrBufAfterUse();
+  return str;
 }
 
 void 
 nsHtml5Tokenizer::strBufToDoctypeName()
 {
   doctypeName = nsHtml5Portability::newLocalNameFromBuffer(strBuf, 0, strBufLen, interner);
+  clearStrBufAfterUse();
 }
 
 void 
@@ -244,26 +242,29 @@ nsHtml5Tokenizer::emitStrBuf()
 {
   if (strBufLen > 0) {
     tokenHandler->characters(strBuf, 0, strBufLen);
+    clearStrBufAfterUse();
   }
 }
 
 void 
 nsHtml5Tokenizer::appendStrBuf(char16_t* buffer, int32_t offset, int32_t length)
 {
-  int32_t reqLen = strBufLen + length;
-  if (strBuf.length < reqLen) {
-    jArray<char16_t,int32_t> newBuf = jArray<char16_t,int32_t>::newJArray(reqLen + (reqLen >> 1));
-    nsHtml5ArrayCopy::arraycopy(strBuf, newBuf, strBuf.length);
-    strBuf = newBuf;
+  int32_t newLen = strBufLen + length;
+  MOZ_ASSERT(newLen <= strBuf.length, "Previous buffer length insufficient.");
+  if (MOZ_UNLIKELY(strBuf.length < newLen)) {
+    if (MOZ_UNLIKELY(!EnsureBufferSpace(length))) {
+      MOZ_CRASH("Unable to recover from buffer reallocation failure");
+    }
   }
   nsHtml5ArrayCopy::arraycopy(buffer, offset, strBuf, strBufLen, length);
-  strBufLen = reqLen;
+  strBufLen = newLen;
 }
 
 void 
 nsHtml5Tokenizer::emitComment(int32_t provisionalHyphens, int32_t pos)
 {
   tokenHandler->comment(strBuf, 0, strBufLen - provisionalHyphens);
+  clearStrBufAfterUse();
   cstart = pos + 1;
 }
 
@@ -280,6 +281,7 @@ void
 nsHtml5Tokenizer::strBufToElementNameString()
 {
   tagName = nsHtml5ElementName::elementNameByBuffer(strBuf, 0, strBufLen, interner);
+  clearStrBufAfterUse();
 }
 
 int32_t 
@@ -321,6 +323,7 @@ void
 nsHtml5Tokenizer::attributeNameComplete()
 {
   attributeName = nsHtml5AttributeName::nameByBuffer(strBuf, 0, strBufLen, interner);
+  clearStrBufAfterUse();
   if (!attributes) {
     attributes = new nsHtml5HtmlAttributes(0);
   }
@@ -338,6 +341,8 @@ nsHtml5Tokenizer::addAttributeWithoutValue()
   if (attributeName) {
     attributes->addAttribute(attributeName, nsHtml5Portability::newEmptyString(), attributeLine);
     attributeName = nullptr;
+  } else {
+    clearStrBufAfterUse();
   }
 }
 
@@ -432,7 +437,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '&': {
               flushChars(buf, pos);
-              clearCharRefBufAndAppend(c);
+              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
+              appendCharRefBuf(c);
               setAdditionalAndRememberAmpersandLocation('\0');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -469,12 +475,14 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           c = checkChar(buf, pos);
           if (c >= 'A' && c <= 'Z') {
             endTag = false;
-            clearStrBufAndAppend((char16_t) (c + 0x20));
+            clearStrBufBeforeUse();
+            appendStrBuf((char16_t) (c + 0x20));
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
             NS_HTML5_BREAK(tagopenloop);
           } else if (c >= 'a' && c <= 'z') {
             endTag = false;
-            clearStrBufAndAppend(c);
+            clearStrBufBeforeUse();
+            appendStrBuf(c);
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
             NS_HTML5_BREAK(tagopenloop);
           }
@@ -495,7 +503,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errProcessingInstruction();
               }
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -622,7 +631,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
                 c += 0x20;
               }
               attributeLine = line;
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_NAME, reconsume, pos);
               NS_HTML5_BREAK(beforeattributenameloop);
             }
@@ -715,13 +725,13 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             case '\"': {
               attributeLine = line;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforeattributevalueloop);
             }
             case '&': {
               attributeLine = line;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               reconsume = true;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
 
@@ -729,7 +739,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             case '\'': {
               attributeLine = line;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -756,7 +766,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             default: {
               attributeLine = line;
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
 
               NS_HTML5_CONTINUE(stateloop);
@@ -782,7 +793,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_BREAK(attributevaluedoublequotedloop);
             }
             case '&': {
-              clearCharRefBufAndAppend(c);
+              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
+              appendCharRefBuf(c);
               setAdditionalAndRememberAmpersandLocation('\"');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -902,7 +914,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '&': {
-              clearCharRefBufAndAppend(c);
+              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
+              appendCharRefBuf(c);
               setAdditionalAndRememberAmpersandLocation('>');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -987,7 +1000,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (c >= 'A' && c <= 'Z') {
                 c += 0x20;
               }
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -1002,20 +1016,23 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           c = checkChar(buf, pos);
           switch(c) {
             case '-': {
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_MARKUP_DECLARATION_HYPHEN, reconsume, pos);
               NS_HTML5_BREAK(markupdeclarationopenloop);
             }
             case 'd':
             case 'D': {
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               index = 0;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_MARKUP_DECLARATION_OCTYPE, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
             case '[': {
               if (tokenHandler->cdataSectionAllowed()) {
-                clearStrBufAndAppend(c);
+                clearStrBufBeforeUse();
+                appendStrBuf(c);
                 index = 0;
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_START, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
@@ -1025,7 +1042,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errBogusComment();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               reconsume = true;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
@@ -1045,7 +1062,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_BREAK(stateloop);
             }
             case '-': {
-              clearStrBuf();
+              clearStrBufAfterOneHyphen();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_COMMENT_START, reconsume, pos);
               NS_HTML5_BREAK(markupdeclarationhyphenloop);
             }
@@ -1309,6 +1326,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             index++;
             continue;
           } else {
+            clearStrBufAfterUse();
             cstart = pos;
             reconsume = true;
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_SECTION, reconsume, pos);
@@ -1416,7 +1434,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '&': {
-              clearCharRefBufAndAppend(c);
+              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
+              appendCharRefBuf(c);
               setAdditionalAndRememberAmpersandLocation('\'');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1648,6 +1667,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
           }
           bool earlyBreak = (c == ';' && charRefBufMark == charRefBufLen);
+          charRefBufLen = 0;
           if (!(returnState & NS_HTML5TOKENIZER_DATA_AND_RCDATA_MASK)) {
             cstart = earlyBreak ? pos + 1 : pos;
           }
@@ -1741,6 +1761,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
         decimalloop_end: ;
       }
       case NS_HTML5TOKENIZER_HANDLE_NCR_VALUE: {
+        charRefBufLen = 0;
         handleNcrValue(returnState);
         state = P::transition(mViewSource, returnState, reconsume, pos);
         NS_HTML5_CONTINUE(stateloop);
@@ -1866,7 +1887,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             if (P::reportErrors) {
               errGarbageAfterLtSlash();
             }
-            clearStrBufAndAppend('\n');
+            clearStrBufBeforeUse();
+            appendStrBuf('\n');
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
             NS_HTML5_BREAK(stateloop);
           }
@@ -1875,7 +1897,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             if (P::reportErrors) {
               errGarbageAfterLtSlash();
             }
-            clearStrBufAndAppend('\n');
+            clearStrBufBeforeUse();
+            appendStrBuf(c);
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
             NS_HTML5_CONTINUE(stateloop);
           }
@@ -1888,14 +1911,16 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             if (c >= 'a' && c <= 'z') {
               endTag = true;
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             } else {
               if (P::reportErrors) {
                 errGarbageAfterLtSlash();
               }
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -1915,7 +1940,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '&': {
               flushChars(buf, pos);
-              clearCharRefBufAndAppend(c);
+              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
+              appendCharRefBuf(c);
               setAdditionalAndRememberAmpersandLocation('\0');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1989,7 +2015,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_BREAK(rawtextrcdatalessthansignloop);
             }
@@ -2033,6 +2059,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             switch(c) {
               case '\r': {
                 silentCarriageReturn();
+                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                 NS_HTML5_BREAK(stateloop);
               }
@@ -2042,14 +2069,17 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               case ' ':
               case '\t':
               case '\f': {
+                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
               }
               case '/': {
+                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_SELF_CLOSING_START_TAG, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
               }
               case '>': {
+                clearStrBufAfterUse();
                 state = P::transition(mViewSource, emitCurrentTagToken(false, pos), reconsume, pos);
                 if (shouldSuspend) {
                   NS_HTML5_BREAK(stateloop);
@@ -2193,7 +2223,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2378,7 +2408,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBuf();
+              clearStrBufBeforeUse();
               returnState = NS_HTML5TOKENIZER_SCRIPT_DATA_ESCAPED;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
@@ -2734,7 +2764,8 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (c >= 'A' && c <= 'Z') {
                 c += 0x20;
               }
-              clearStrBufAndAppend(c);
+              clearStrBufBeforeUse();
+              appendStrBuf(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_NAME, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypenameloop);
             }
@@ -2886,7 +2917,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypePublicKeywordAndQuote();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2894,7 +2925,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypePublicKeywordAndQuote();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2936,12 +2967,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               continue;
             }
             case '\"': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypepublicidentifierloop);
             }
             case '\'': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3034,7 +3065,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenPublicAndSystemIds();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3042,7 +3073,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenPublicAndSystemIds();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3080,12 +3111,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '\"': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(betweendoctypepublicandsystemidentifiersloop);
             }
             case '\'': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3257,7 +3288,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypeSystemKeywordAndQuote();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3265,7 +3296,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypeSystemKeywordAndQuote();
               }
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3307,12 +3338,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               continue;
             }
             case '\"': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
             case '\'': {
-              clearStrBuf();
+              clearStrBufBeforeUse();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypesystemidentifierloop);
             }
@@ -3460,6 +3491,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
 void 
 nsHtml5Tokenizer::initDoctypeFields()
 {
+  clearStrBufAfterUse();
   doctypeName = nsHtml5Atoms::emptystring;
   if (systemIdentifier) {
     nsHtml5Portability::releaseString(systemIdentifier);
@@ -3612,7 +3644,6 @@ nsHtml5Tokenizer::eof()
       }
       case NS_HTML5TOKENIZER_MARKUP_DECLARATION_OPEN: {
         errBogusComment();
-        clearStrBuf();
         emitComment(0, 0);
         NS_HTML5_BREAK(eofloop);
       }
@@ -3818,6 +3849,7 @@ nsHtml5Tokenizer::eof()
               tokenHandler->characters(charRefBuf, charRefBufMark, charRefBufLen - charRefBufMark);
             }
           }
+          charRefBufLen = 0;
           state = returnState;
           NS_HTML5_CONTINUE(eofloop);
         }
@@ -3940,7 +3972,7 @@ nsHtml5Tokenizer::isInDataState()
 void 
 nsHtml5Tokenizer::resetToDataState()
 {
-  strBufLen = 0;
+  clearStrBufAfterUse();
   charRefBufLen = 0;
   stateSave = NS_HTML5TOKENIZER_DATA;
   lastCR = false;
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index 6a6a8ed39b78..9848a502b3a8 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -158,28 +158,40 @@ class nsHtml5Tokenizer
   private:
     inline void appendCharRefBuf(char16_t c)
     {
+      MOZ_RELEASE_ASSERT(charRefBufLen < charRefBuf.length, "Attempted to overrun charRefBuf!");
       charRefBuf[charRefBufLen++] = c;
     }
 
-    inline void clearCharRefBufAndAppend(char16_t c)
-    {
-      charRefBuf[0] = c;
-      charRefBufLen = 1;
-    }
-
     void emitOrAppendCharRefBuf(int32_t returnState);
-    inline void clearStrBufAndAppend(char16_t c)
-    {
-      strBuf[0] = c;
-      strBufLen = 1;
-    }
-
-    inline void clearStrBuf()
+    inline void clearStrBufAfterUse()
     {
       strBufLen = 0;
     }
 
-    void appendStrBuf(char16_t c);
+    inline void clearStrBufBeforeUse()
+    {
+      MOZ_ASSERT(!strBufLen, "strBufLen not reset after previous use!");
+      strBufLen = 0;
+    }
+
+    inline void clearStrBufAfterOneHyphen()
+    {
+      MOZ_ASSERT(strBufLen == 1, "strBufLen length not one!");
+      MOZ_ASSERT(strBuf[0] == '-', "strBuf does not start with a hyphen!");
+      strBufLen = 0;
+    }
+
+    inline void appendStrBuf(char16_t c)
+    {
+      MOZ_ASSERT(strBufLen < strBuf.length, "Previous buffer length insufficient.");
+      if (MOZ_UNLIKELY(strBufLen == strBuf.length)) {
+        if (MOZ_UNLIKELY(!EnsureBufferSpace(1))) {
+          MOZ_CRASH("Unable to recover from buffer reallocation failure");
+        }
+      }
+      strBuf[strBufLen++] = c;
+    }
+
   protected:
     nsString* strBufToString();
   private:
@@ -200,6 +212,7 @@ class nsHtml5Tokenizer
     inline void appendCharRefBufToStrBuf()
     {
       appendStrBuf(charRefBuf, 0, charRefBufLen);
+      charRefBufLen = 0;
     }
 
     void emitComment(int32_t provisionalHyphens, int32_t pos);
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index 4cd030a3e7b4..ce040183f57b 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -955,8 +955,8 @@ nsHtml5TreeBuilder::elementPopped(int32_t aNamespace, nsIAtom* aName, nsIContent
 void
 nsHtml5TreeBuilder::accumulateCharacters(const char16_t* aBuf, int32_t aStart, int32_t aLength)
 {
-  MOZ_ASSERT(charBufferLen + aLength <= charBuffer.length,
-             "About to memcpy past the end of the buffer!");
+  MOZ_RELEASE_ASSERT(charBufferLen + aLength <= charBuffer.length,
+                     "About to memcpy past the end of the buffer!");
   memcpy(charBuffer + charBufferLen, aBuf + aStart, sizeof(char16_t) * aLength);
   charBufferLen += aLength;
 }

From d4aabe37f6a74c415b48d2e87d6bccc2e37e5a5f Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 13:52:01 +0300
Subject: [PATCH 026/102] Bug 1305489: talos: pageloader: scrolltest: fix where
 the URL contains %. r=jmaher

---
 .../talos/pageloader/chrome/pageloader.js     |   2 +-
 testing/talos/talos/pageloader/install.rdf    |   2 +-
 .../talos/pageloader/pageloader-signed.xpi    | Bin 29177 -> 28966 bytes
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/pageloader.js b/testing/talos/talos/pageloader/chrome/pageloader.js
index 0d61bcce5eb6..6d3f8592c4eb 100644
--- a/testing/talos/talos/pageloader/chrome/pageloader.js
+++ b/testing/talos/talos/pageloader/chrome/pageloader.js
@@ -873,7 +873,7 @@ function plLoadURLsFromURI(manifestUri) {
       // Note that if we have the scrollTest flag but the item already has "%", then we do
       // nothing (the scroll test will not execute, and the page will report with its
       // own tpRecordTime and not the one from the scroll test).
-      if (scrollTest && items[0].indexOf("%") < 0) {
+      if (scrollTest && items.length == 1) {  // scroll enabled and no "%"
         items.unshift("%");
         flags |= EXECUTE_SCROLL_TEST;
       }
diff --git a/testing/talos/talos/pageloader/install.rdf b/testing/talos/talos/pageloader/install.rdf
index dbd634dbaa64..861b9b092951 100644
--- a/testing/talos/talos/pageloader/install.rdf
+++ b/testing/talos/talos/pageloader/install.rdf
@@ -4,7 +4,7 @@
      xmlns:em="http://www.mozilla.org/2004/em-rdf#">
   <Description about="urn:mozilla:install-manifest">
     <em:id>pageloader@mozilla.org</em:id>
-    <em:version>1.0.10</em:version>
+    <em:version>1.0.12</em:version>
     <em:targetApplication>
       <Description>
         <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
diff --git a/testing/talos/talos/pageloader/pageloader-signed.xpi b/testing/talos/talos/pageloader/pageloader-signed.xpi
index 325e71a4c4e742a52f361c6a42cbfd5bcd8bfb16..5888b529b63f82fcc8f5695fb8a430b76186b11b 100644
GIT binary patch
delta 13067
zcmaia1ymec)^+0^+$FfXdw?K;;O-V6xVshZ?hu?naCdjt06_x5g1ZHWA7<uznfK<+
z{IynBcdzcV?>=>Jol|%1eX{{punvYT{~iJo0|WxWg0PhMBn4|L1dkCxAf;GrQh+PG
zDzYqgdA{2Kv7_rVN;Q*2Sjakaq(DT*K|fw1MXY}*S<68$3aKP5sYlX*UA57d_sb4@
znRf#Z`+`?)M?lBKu}=HS@m=fjwwE9%R`Rtt8CDKvl^Aj^_(!zV1TfNga2&|)NicS1
zDGUh6QAtU#$p>3-W3)9nFj5L!VnF0wDhe|!Vvuk7l90a+=(eL($WcO=<ZvZUC?cB~
za()n{2g#NQLK9LXde!21CuBp3qOl2O$(HCB<i`kdAHn*sBmqygnRC<IEj!|sXT7ia
zPH-2$^M2?1euk^r;<m6+#)2bs#trhj?%QOds=afeVke^Vt*IvEZh6n`H33ix+t&0A
zf)oLrSm<8bpN|5Gd}*ueQMX4=0=hR7)cjp=Le*0rWFbE08?pE#AgXTB;<sUJ!Dc>E
zL0TK4fX=U4rXL%RJK8fa^?9I`VciA%zSO{s|45yf|FMYQ<EmV1!{M9p<b0o{Fauk;
z=Z47Cd43p5U&_d>Wg!7RJ`60%+<bun6Rqr=P=QfU6bjK756gS1)hERfoyw!Q8d>Lj
z8ZvEU1C~k%0yAbc>58vmq!giuw%=Na99?{+WQ?L4Den7W(<Nx6QENFfWG@IQh&7f|
zPLake<d{o~#1}N^`+eTm!-5_2;yx)T-OO-^2PtcjB(zFdI0a3GDGgXsjbRQpdV8hf
zbyy}Wt444q<6%5#r4&ka&UIJR!#tDN5EMr!OPF--GDU`98c%IfA$}JNzZ`&xfjhuC
z#h`PSW1E-0vNVs=Rl_7c!@FT|Xf}b3_w(~;OJD8a5a)$+>o)=IczDZ2Buxr81#+WG
zE^*q@O~m>RDVgX`)_#ByVN6{4miuQD##6>DxzU-0Ura~AKekHsSL5W8EA^GMS2br=
zIPpC=WNvuAH7l~)TNE%fg+^%Z*iaf9ZTI6$kWq-8+E|*XI8L*XdZDH4T%~;69I&%6
z%v{T~XCg|hS3^3URk1QY95}J2i3$>P%HlBBjlvN}L@s8#=#vJVC(NMZn<$kr>#ZqD
zwq$}wRUjj6G7MD8W0#{ouQ|)W>J#OcEQ9sgc;FW)D~G;XlDI1!MI={t_awnhZ?HtO
z$fPa*`u*)?F0#7o^4E2>x!X3m!=S*40K~H1FKu+?r!FW>CXJnq?p!$iV6=`${nb~5
zQGE@IDwo|RqUH+#i-Nf_S{<??7jz31(Ri&h+5NGcVg5d5F;8aoRmd{rTOo|>jxma#
zjVvijW5J=6>uD5%33^Pk;)jQoV>8HmwS$c%s`S?s<0s)dNhckvio={5ik!@-wG)%|
zg!>=5^?^ml%d%C@dbQdPH3TN4WV4H^y+WDSE<Lg#Fr`d@W?#zjX9cy=3yC#_(N@Mb
zv4_rCI*Z83azQY<NVzbk_eO5%Dq&XM0?aLR>7oLP;t_H9R)D8zuF`Iswt|jF-~fx9
zZK-2>!g4LFGOLG*%)T0{jcR_DX6&X>oy#>EIx@#OmWI}me!!bYBhWO>lusHu-q2b2
zjMfC|-~=VmxO<Rs<1ju~fW%5&Y7QO3G-beaCe!~uuOlj5G>~h)h9B?9t+Lbh!P?o|
z&bM}`2l_5*Sjg<$A-V+O)+R9HwcgC*a_`Zvg~XCUce9Z68GjdJPY<+VFQGsh%~TKP
zy<dhWiy`R!wMb(`7`MAt=WUCRylTVR^L?pU-UH468KY)8ll|0o??)5K0TnWMQrrBG
z_NiBS8<VE(c=q<9$oNX#B2X1dq{d`Lgm)I686dj%R7Ot^e0Z-J*S*R`kQhgNe`HSC
zd}SSoqb5?q?V{IHozwVf6OpFFV%@lbO3+(f*n+k9iFp6A>$*S81JQswJb;pn6}4B7
zrk-C0(48978XMtJcT?0D?{dDi4i5ipA?wvC3G|cj7ncny0HaJ-8KgWtFtaUvEl%+j
z5Tf%$LIJV>l`Skf)b%!_@9Qd;P9U-M$%qrO1mAbnPIPW3>m9+i=(TvWx)2^29Ythf
zTr4l;@(1d3xoe<C`w`v0!TCM%tZi1xXH0V7Y224;3}4*7nJTQD(#yO?W^NJrz}o1L
zd|<(H2;-#nNnTIoAY0AU&G$ecxmfL6m^%kC3dHNsWo0++hUhyT5?pC)61vi9P2rqM
ziQPb&1}rhctv6J#N5T@Q{wH5}lILz>=Wxdypj(fZ#x7<xH+NSjIi$ATG8dI?{pIU{
z?9T0JH<v?ICC);2`BuvxCu-k4#$7i+Em9n3tqh`+J?9z9em~KZj5=0oxe1W5VWB@e
z8MNcTO;OjA#x~%8n%-E`nh>um8^{c!jYsyV3u1x_YjG^sr)gIBxNgOMEh~(1jvGk=
zR}b)GU6g^RDhA#V?R;`Q?SRXKizV;|wB`~G&xUz_hCZCEg0U7RdiXpTVswXaS#A$C
z2}U;sheu*nXHA{bd(TjpR#49d;fus5+c%rD4O>;d>E4XI6v$A<M>x&*afN>4JGXJ(
zmqsUfvSZh@JO_65cGD_sSemZ5Bc?8n+{KBhd2iUgVMyyXdV?p6?#Gq~u`sMN&}Kq%
z{;sP}eY&(VFiMlmSl=g8Zc{aw=(D!OwXW5cRRvVfFA_Nt<o@>P3}N_qmMQ4Ey0<_5
znm=aPXToYu22Ni46C@<Jz-bg_Cs+Bmw9Gwq)k0;dOMczm@on|Wz0s_3$BM5#zCBY*
zy^^nEXg2^em*%gyRcwLAL-fTR0=7_uKZ23MB6LQl#le8(LlP5Ds`;$pun>6(=SX}&
zgiw#Jnq&!rsAV?CKopgfg!1*o=OBWnrc3DSS@8>G7n4dUcl6r~K2KNuun`F^au$8)
zHyI;MOfHa;Uu`$ln`ioUL83I5S_UOG8e6V>3?6O>>Grh}I4UIgX9M;mR6sL3#0nDy
zgLc$?c)X`aOjhx1<%<GZbbN0Mk5r>N-$Uelds#=^)fkvR*$579R_FM9{|LHdUUNrE
zgun(Dy!YrZ&ebef$3xInP-%A83`q1XT(W!AUA)afsr@7THJw(2Vv4zO#SB@wlXYo&
zJ+f$7?S*u#u-=V_<6W<$G0;uJ;Z2o4)I?LjhA2g#LyKu?6~4Y8|BKT1-PUprBb0L3
z<JjIJ+D=CGQDa?*mjqCagKR%=B2t1qm+B&o;un1q7>w;k)Rxs=X`V*1E5E~`@VKej
zrtNquv@f|GZh9QOo6l28fT5d}^1Vw?x)oQdWVf&byDJfYM0#eQ6ewlCdiNz7MG)B-
zwt+%5BAy6td3nX3&0v$MNX<;ck{`iRe5_lsfEe5kRf7Zd5KnHn%FJ?dIc25PDl7;|
zEO|?6wGzU;pn$Ik-`RY<rz*VoWO5?AyP0=#V`X1#T*lUJLMHZURhv@BjO(~vMeHhW
z?ek<?!gM+9Tt$@=K9Ha^zkC^QG=Ak<!Fnv6ja_qo98aVw{sSdf_v41es_X*$IN4^H
z!%dqcOw0ye--eV%e#1t2#l9T>oWha0#GEnq3FTyp>YK#<M|pSma7qhqVi67qR>0ZA
zhBmBP;s@PMj(*7((weV>;fFbLxKzCm?W1{-F-V776W{p0djSVL=}a~quLv)H4zI$H
z_U~gFL}$~_|L|!xxlr5-f+{TFlzX&Z4;&CLuM|c^wcmW#fkOmGNc?l`X@vFWeaM5n
zb?O%AE?N|2bVB6S>Z3tUFY}|!Cdltisr)FaOS)Z1w^eh;q=m6`Npw2Zh;9_d>h1SE
zKeR54bdl-dxf$TRMK9Ssz%*J>?>(j@jqKNq4}|ezvMy$64M_{~^6h*y)EK(2=h*5O
zXI$io2$*9TfG9Rnt83=kX=4E`FB6_nFIwdk9Z5zp5RYK_Kqm(Nksren{7IT!V;2aG
zYu_UvYp)|)r!F-c&Vz(tn-0)(4h8hCy!dToK}XfIyTF%&kw{;Ld%rFd@Gv~geHc$F
zdDLu;++jjJrJL0ElsC>PNF}*T$UpJBD4<`jRLj<+ht^o2&e$XbI~9HxS~rn5zZ;t!
zn>ZVFZHiBIP3~{>FM>3)_g%o=tiykc<aUZcFBnm3=do!=>zw}R62L@h(zer*Y&<on
zS-yahI0@|RE$x4pA-1NaTb(pWZ!Pd&PMQqH8B;7)KWW(AMobNT-F}XKHf^1OW}LM=
zcJ3P2Y2a)yflgcHVdrR|L|8FSQG}GKEJ8uKq((@e+K5W{E7e2Qs+#_qfys!QEB~Xh
z-cTvT<7U9_<*qEZ+9YmQ{0}zga!p+x(u0_&{CZ$fEc+0Wg#IWQCNE&+#Ld8vD(+2y
zXe6en_zAW~Ev~uk^>?w;%v<#*I|p3w?WD}uS!|v-`cLgQABQY${Fvav>BY1#kx6l=
zJXp0IZQwK!bR>=j?cOMGQD2nrmi=1NF-xf=#YjlVFG_3vn)_C_I__44-KMxseIELY
z#?c4<N3h?Uqgiu4NjwK>_+&5;hy(%zLI9zH%&Z+84J<7g?Tt*7L?J<?&$}oUWhfAg
z{kuK2cpipMFr)Ze1_6NGl(Eu+fq?3ML-P8SG|Pg_c=r8-_9cweP|ehEY(+8I%2XFT
z0gBX$TCR}c`MTOYLutzDR1Tg;P`7VJ-LlyEmj=~r3TvB-%J1=~vGiaoVx;q3*CW>^
zy>_9T347LY9+e!hvY$*CvNz)JtBJhNu=L#U`OyXTH;D<3Bdz787O5CK-W-VQZ;bkU
zNqqPeZLO-t_5_o*!}L47QqmZSo94niR!9(t9u@?GeojwOOjuM#>`$3}9=27jQODwk
z<ah~iKAtc*fdYY+Q9vM+=YS8U_BK|=O!mgMHujE;<_`ZEI*E4+g&z8;_+3!#;9v(l
z2=s{<1i}HK#uHlOqW<acB#5kPH9Vw4@SI}LSN{Fr_L(#c2(*X_dLHMGksKX9*xNi$
zz+Z+kkl0hJ!Ddp0VSiz1wrm!d|2#GH&ohVoM=Yb2fwh^5v4i8EMt#XI9*U$$<exj@
zm+&fFm1N)N&~$JR2>Xw4rss*babWmhW9?{c{r9<2@rQ$PypYeLF|&t%UNX&af4WRo
z##T1=Zhy<YMjrzLcv*3sJ(}Tigdk9vH3)?9dvIHWkH(fZ21dsAe+_?Gdb0vrTKE!4
z$M<2?&gh!;F`c1oH7FiIgWLw#5dJ5;H~hNoNy=!14b2|ST7%Nvz=}hWg<e3VKuwKz
zrHs>TQL%$;h6g6#Kd^qrOWRAWvxQC*w5uGZX4Z}}sY*Z4F)T?lteh~Xn82!sL7Fjz
zTru4tVMh>lzR4X$skL6k9ZJbcV<fk9(Kr2Qtw%5+N=<3zY|)>d6{4aZLe9{~PCLwx
z$Ml{Dv!t*!=#_%6zKH@Nv$tfjAsQtqVX^__6S-nQej_6=VhJ#-pDaDFXCZ^OKqmMX
zeH&fhR8v>NR_X&nOh|ELd(XEg`dCwkH4+BRlG|bJ(6_)lx^%H|L9)ZSZ$f)=WBPm#
zQEmuxA)VhKP%Uj+@4r%2lPwn`egnSLQpWJ*xH`fR2kgzZ@#K)PaABa+gae#K7UKsE
zL~+&*umDV@2fc8yFCHhWr^yDVYa}1WI`i6=r||dk#ckHS<yKnT@g7<EdGNa0vk2w2
zs<qRD9e7$ZI=M}MD0$^Ph=89K+9lsHc1PDA;?J`9PgUgNFuRb%hrS^Nrfp<4<XF@6
zk|%G2j~@#=<)#tfddHZIeP5dxXutcowcdGuh12Zy^L04u=tv2xX5kHGBj0xiQ(%;W
zR3V2nGE9pPhLa@3F%<pyz-~mjpTybyR+@xDk5V#W^uewM1D2J*{nJ(vqd3`gu>$14
zfh{yFf3TALt<ToXFHWffU>Cl<bmz^{7j$kzR+4+(o^|&0%z_?UaG0-m^3rGQQC>!9
zmB|XIQ6EAhly1%nOijnmFvgh=?zmI)U+F;m&(=xzZcgo-?QJeh?d%;K?#^zW?r%)L
z_AsOnBNfK*DWn-@Po}p8^%*98LAZq*A`^1IrWPh)Ny-hG#yqHP1%h5zksZa&xrPeS
z$8M1s`Iv76rVnXTqAw4Y#&+k(Non%JN@{doR94$11Q45;*l{!6g3A;Cf|i3>dG*M>
zb9KjFX%_D3eX>6_A<@H?ETNXS*0(S;gz1bm$YK7C<u&|UH9?jz8A>z3#Odi6RhtR4
zqiY!=>{ew_RY+GOIG_igUl3nI-G3lj;cJwScvY*ir!;9L)2k1i<Z&d)4nMQfjcr&1
zfeo!&1GN5A?sQMkBP1+rQA|EGgd#6__ho}T>Bi4T{!Ww;BSmpDv`SI&t`)T}yF21&
zpYU_MDxE%Jd*&o#EOJmUll1ZXRoyDD|KtW&juHHlJ<*QcB0!z?3V>acKmMFLJsk+|
znY4LEDU}R$pt%8#gTZ1~<~Xn39l;H~Xk#2dA&gJika~dsnNR&|_}*@rV`SL0hX<Iw
zdI^_#Mb3pnJf(7@8r_FYmyhu%A}rtnp!l~UGB~3N?)19D>u*y{27lNmc`wZ!N~Rr1
zmkY-iig1t-`p!c2e}HbTCw@m^S}KCD-wy3KVP8O_P77Nrq~VS<ydfU<RvHXDUgoVP
z*id}o+Yo^Ni%F{gHf~~t(80-2h2tFWr^l+yKC-@76^(%&DoYeUs?GT-_ow9BA2rKF
zLnNfgAB<_vzkfJ{gNZz{dqWc?lZ<fFkT2@dZlPcF=Ant6%je?kfCIn#XBDRq+&K%8
zZZ;k9fZ;^0h}-K|X$cJc>8<<s3z6jH)!O+t!NLi^5%u(qe#N=>NV!_mK^JqbOlDD5
zNqW|}3H9Ekp&jq?77H3Kn2=%8(hO1*&pie=Ynuco-%}YS=?WIIfhYLV)7JWDp<kVL
z@S1ZuTV#7ysBAin)#&Pyl{zMO+2u*63DO#h1F$7jkM$A5XgHQFB@DInM84mUZFdC+
zP@mQT$Om;whlJ=T63q;H$=R<8Jv~Q6{PB5#opE#5R$r~=zta*bTd!ZOl;OFbYB!dA
zi{a-me$$dRm3k0Z3142n_R3m)%PsA=1tB2xGJE{NgEOF@4};|_6YAS^Oy&Vkgs*Nk
zZZ#~MMdHUwX=AFe(vHy$@7N*94rvMFSL`4UKxv6ah~77HF-JXaM7f-NYH*}z({St^
zddTUnW7a*se^J(|G#EkG8f$Q<l=6I@1t==hcG5{3`-yrHXF7(S3xP<wI)_z!PQy7$
z<_okUx4BqV2Q)4z_6ME}A9j3ZAHqGjvstM)N{w#TBZe!E2;nIoZfQaGF=cwTUh66)
z0OjT$Zr)r#)<+ACZRlO3zWXN))1XIo`nM?s=uyIV$4XiQ7loqau6GaY@k3e`ZR=S+
zfhxgOO>b}tb07kHgkc1ASuQd$w~7H|{-z)7;Nf16{E{9<S^~!*RNwC1NqGh8GaUKw
z)dhY8Zm}ywM!NBFSJHz5P<Fq{<0Fx7GFX&$Yt72+wrgWet!x_O9UT7p<$NeDI|$u(
zO2=&-^$E^!r=L{^DiP!m`{P~wyf`7aHYol|oD{$w2_WU&#{Sro_gtsWlF#!>))sa*
zr*`w#$jIt3tiR9%YnJ!myrm0-Buas=hLil>iM2@{fWFuN*#8yE_ZN0>F3OcOb^*q%
zS7Cj54}PcuHu+C-*?|v;aE-+M4Fr4%ZoW8~;BAJ?lG4dR*MWt^<2MkXuFq)pHVyK0
zU|xWRC=M3^)3)L9u8Rk7|H~|z%vQevj0ry!yl^m-(J<BLi$d)<iUCSlLU<{;%FxCs
zkRznz+s)d?VRlqSKBv`%w2COrBC2v`?%eUv<I=L?cxS~{SH4Q+9PHr-UXQ8;lky5Y
zC-}Y4!M36m3bhg}e8_H~JUjN1b*}n8xe;L3%PT4q#czOArfn2-;Fp_`Od#dC`ie1j
ziwD|?Mbv27y%VQWI^d(AR7w=80goOf<)HL;IF2UwvUm&{b3F94{&(zF!>`0d<yZX|
zV=Hf`dm0=O^FE}YU2NjK>Mv6tWTr_WWJUDK(|G+^h+`fXXOb9$jp=g^PgTZgLc2U5
zoMg+pi6WVyD4pL;rq}?pA3hhC9&6#ImSxi~Yq-IJFe(xh=n@4xz^89m*Ta-JXy?lI
z89jq`z62Ii?c9|e&-0WYXp0zm7b<QnQ5yzrY~6sck#=tQbUp3Y`OsxS{BbMA<#T&_
zL1>W2Bs8|0Nv!WItS40$++syIxd$YW01IZvlURfDYuS%NqQ7FnPa#Ru;i|OUTB{Nn
z43jKk<uG)440`nIP&KSJ)b4`<^t)LsAtmXYTFiLar2SZIOi(iEpdtA$x=|?K#p`C8
zrs=?_!`e9joRF8^NE%I^N`mlB>!sX?`qHvN(bt0%Byl{K<{eb0$@CpZtx71M)PMAS
zuu0NJC_SZHLZT5e`UuD-16ddn6N>1)aYX%V`p6!R0V;9K@jIMTqe?0E_g5a`Y<fkn
z8XL2OP<#QDYz3xHJj($^37!CbE{WCm0jCt)Fx3ZivQNjb2Y^thUmF~E_^FhB{jroN
z*D~lUj&vZTFZL=8Ay&iCPmT`&)4VtqF9~j&jf6kaHGbgkFQ`}FG)BAv{Huv{UfUK=
znW4MD<WAGV*dEWGe8=Mrfyc}Q;eOl56DLX&nf{3GsaTC4sc0~G!qZhChrmc^*(+Au
znR_zn_KJMdaum80!oAM$%%jrhD9D0y-RgdNM^d>fEkY#AK1uNo1AnX%NU}J6oko!Q
z%bG021%JX@V$p(3)N?`X$MW>XksyjHJw8?5Zb(d&mV*xmIFY^K8!-IC^9C>1!fcTI
zmHq`$z_;kAvm|^B|ILbTk#$8f`QLPd;qEh(`qwbcg@2f?TD1(InrvhN3q_XXeT%1*
zDI!f{gh)4Yxq08t<aD9F04nJ>PfWH3-GQGN^TuNGe>RT`mDT);yt>0PvhglaL@^_>
z)h3G8MD{#UJ-=*MI)sgsA>rikPxsnFY+{41wt;ELEUo8O?!ii!4M~JqT;kmIJajL-
zM!N1J$g_-^D{B?f;Q*gIP%a$*Hksuo;j{Ou%r{Sc9RL~yGNHeV1CSPsi}gKPLmjwn
z%gUw@p<1SzxW;}9#e?k3b{3!XY?s_`>`2+zv41JJ!^@<bYpz-EkJC}xJzxctD?#k!
zb+A?4UU?Ne@O5@6W0(9aWnlPOg^s)YF8|}NGO)a;THQB%t0G)i@sp85aw0;iHBpOP
zBjJRo6_;t5o7qS)9{?4;7)uK_Vp8Ggk!a;scn!C19@y>#*3l{10Yz@cuWywO$mxfB
zc9mrbr5D`Wq_XDvTEC6uB$!}`QR|$1DF#_UP8Sibn{93PV=gS_^iTLoLYJ*Xqva!^
z^L#f?9od~?)j>B;$F+ELQQD=b1(3=;`k?xJlF{4p{IUz_MS*513?2{lIw2KbTwBDj
zI*Tnn0V1RCr1w5YOqiuX6hn2)T@H*%xGfWu(l$zx+$b`(SiG8q^<nza+rjQEndH_~
zif>giGi`Nl4g7hIujuDwW=_SO+{t4n-+ZbcqtqNp6KImW@A69~wa1?nSYTw)nUa1u
zwdarGB7bydbOHpZsdz8gza#R<ptK3W`vs!CeS3GaofYd=j7U`!bfUSAVMgohtd6MQ
z0A|sjI1O%Kx>bs}{h(WPgzba))!U0iJdO=><$mC3`nY`;0DpQwUpVqz+FC?GHfow!
zW&cbpuK95<Oj?1{$P*l&ZNGV!k-Xt6PeR~oE2|Xzx(q;TX!9!Dpw_a=wwq!<(oFZp
z&{tG-cznIRkFK=v_Nail6-AXTrcR{Y*GXTI=*-Px1!WQ%zp~b4*j47zS*RSr)0QqZ
zRjx5W&saTVkgi=tDAeUAm~@E^&n0p=^An2Wcs3>!xTb3)-W!A>6uXkXfQ-tf;d(l?
zSOQ9=#3$eo*CTiTot$y?jSfV|myb&I&KxQu(VWwBQHAX>efC{NE7AtNL-={EP+X*2
zmg-%s(*%TGNWwF+rUBLHcdBCE%GLuc+Y1-Cbz#D9SrLXrn!!k7N-L$WnI=q3CC2p2
zrZdnFisE%r#AZK>V(@^&28OqNhTLAGXq0>)*Qo*m156!@i5R>z5PKu;8Wh~d-qo`e
zDx&iUBH85fQ1stYeGF!*(9Ixt<ZixQOFr+J+A(+KzTYhzhsM0#p9d|Ky~oTdSY@&k
zNLxx_@=W3%^fMMt2IF*8L67o{wo``w?r-IfwwGHnsT*SR(Cr#@a`gQQud8^$E{_*x
zR)!sz!xNZ<e40Vxw^-_|=||EwlU1BsTJkcLynsV!n7hy9XYuQ6y1QC$a@eof%CXkd
zY2)P=oZ=$L6}9Z4_4?sTs?4MVn&;&0tQwzTw)K%2FMDgc7e_~51xdQOJF05ImP*D8
zG0@&va9hneupj_)1iwP0o9?}UNh;bVQfdfrd$`q4s8Vj$y=@Ng(~Nsm!OChHtEzEW
z&6t&At8I^QIiaw6lJnp6y++)qbd%8=UTj@y`!Pvn&83OS$HE217!KPbuHTm<4ljlq
zr6PtrDk23xV}vJn+LJ}}5L)JQ2d?JAE0oap<%|qYMjfQ1_=*L}ptyvHFU~ZL*DI1K
zuq-_6Cg|%`uKlMCuB=@J&Z#a(gI&^Rp}d@ivn`VRph1{Y{<c>)vc^`LVgD+gQ~o2E
zQ+%d8HCk{YGs^}WjoXjc!NP$}7~fZz;^*awP>?EroMWr3G_)mbvn{QSQ^Z3n@PZ-7
z3oBrOeTi3BAOIVScT%7QJc3G3AQ<E_)iX&(c(q-xOn)so?7<P_zINKa7C9~VT*-7W
z$A$lpCa%S>+FjIR>oQ^6%vdlh(;GInWWW({Bqf9$mvxYXJ_%O~(X*11AI^~BWv|z%
zesrB=4?_uxTJua^BgFfbvS-e!3gMQQ8%(TVMeIT$hP5^gP0%(0?A{hcHWeRs%?q-|
zyIyEl${fsGuMPZ?su7%>F7o``#@{p7V8)TcpZzXSOUfjCTE#OptFKcZT5YzRduytW
z$uz)_=*tE(rvZwUcnOd=zf|cL`5NCAe##Ovt)Rx+-2b&&4%Sr_65Cn!?vA-WjFa&>
zXM{X^oD)KV!@=n?P#)T2Ro_JaI5mC!1Nu_1y)ff!K~*X*a^32thQIFaKDrDBbt6hK
zKX2dE;I#PllDsePB@TEhUx8yU9I2lPzCukd3@?4Y?VeeMc(TN{+V-0~p7)xce?Txr
zeyBjb%#poS^!aqIK-aCF>#{7gIz|(!ro5_b#uf=bXlCH)AsuV5=YcSeeK`Y$+0*hd
z^h5ham8e?{y<-8i7*3gVV0b|_ViV3;LmcE_`=l7ccUN#@&ag+ut4}fDlwzv7z9Z~@
zx_#bksz;96d%p3eO3Gj=@oh?6KzzHTHq-TjW)}PNmJjb1HQe*3_?OE-mprYK>(1L=
z9a}dm!0O$%%mr5GeBD`XnXoJw<$+82!nYjS;WXGnSz|FCAw4c;1%z2ybQY#a39g#5
zFoNbJjF+uRa+O$G=X$ff_vzP_{`rYyEi8p*mrwa$uXSl4Ek9XX6l=1W0?wSv=x}OK
zr1FU%s!FW7M@L7_r>Br735(6A<Bo6%tKgYL>3Z>D^xmtz5V={D{hxFtf#M2JH)xMt
zeqI^;9TE{GE-`5}WxS+5q!W&dc4sw+d9<0{lN@iIc4r#a&E7A^7bF+1HrnzC4PF{J
z@pR-{B!?v+Dz!^UVhY7c0Rb3vma1rTpJPU=xn?AgzlvV&O#33StF6QjCWl%n22?BZ
zFvkT!6g1Ux%Q{r-6j)fdagLZ;_5Y~Y<7(d9R%T46=E{_ZHmr%5It3Y3af{A0omKRf
zd^^iar+=?;NqwsVWt>5-wR||!Dlket#ec+qk^^q68tS5e<kVS)1B|qOK$KG(m~L9z
zj!HLx`8H`Pe>Ju>qzNG!vdCjq`$m%<rGwp8ha)x3<OqCrD5+RxjXX%IZ6s&_>yxaH
z*xTtmS|k`@fBOl)s<NdN9UZ$y=!oLCxts0-o_P>6x;$fXdTSENZcmz@CG{i%`I}t@
zT0shZvgg97>Qe$(M|eRF%T{}o%7tsaR6^C;YsK8jH`Llj2^Jnf@$jlbz!itG@P0g%
zxyy(kP`8+@WXm|i@Ki;@MQhdlDA3i!oe^?=h#@OuP~7V#@8H!(fXplEI|8A_syj($
z%gZip>2b2(u(c@@uUz*{OCZ^DMb=#MfHWa=IQ@GAx=X8Ncdtx38*;r#G*@fwI$nO%
zyWWAfry3cS8hdK_MEg{XK*V8AHA1K5Z67s6ecgm<lX`$qayixG#is*~^MZBMxe%m-
zOtAdJe4>tyHoS86jn}%Q4nT%%-jb5(U3K79mWKBS8J|TmP?mDvJ(KDyOW|2Y`m=qg
z{lS*4ALbhz;!J+I-cUVsC;YOCVG916$`%KDV<(|pxQr=$dxVtNfNFGH>G=iINFo2|
z$#P6gN#(+~{<(&x5Vq0t6Rc>vzFcQLQg$Ystyme>33$!^<_7Gk@WoIx6l}hwg;tAi
z_XW5|>o_eXgo`n@L~C5icg{3pVaJ$lX|C(N=5F+Y)wEs415YqIw>oH<%D=q6P&dJC
zm`XA69)(wgMO{lZ0zUk6%N>J8Dn8vPZ8y6Nc`)@Raw&82qkWy<8en$!P)S!yx&vNq
zO6YeaIdN1(c<cG(r0MFAVcG48OJ(1BU;Vfbnb6NH(2U&0l6IOL(Z1t;%6Nn<PDW(6
z4RZU$uUW!)k4QEPzeXLb)D05oaMMr6k3cd|$}(ZTv<0tu0&qhzq23G<OhR0(Udk*$
zB@GMptU-Y$43`d9fyc5Z*Gcs6TVD%(KL;zyQX>})BGd@#mzyxxqR#6fK#kT5Pj`5r
z$AD=xRtrdt3hwCV<WaRIXC%8t^r3Tqs*x^L%$E2vmg`=-sKGukNRGKTF8!HNdd7x_
zS>9mA&!rOz8L0e51tIZz>dK|%xTuj-it^N+man}*LdP)`f;&-8r>A#&jm+~6dh&Y$
zzb5ZKeswU=FRS1^i^JUlB&7wPG)?*>C@~2WnnzU#&mX6%0*vE%%#*pdf_pQTxD&5f
zp^@xn?C&-GPqM6y5f9qtj_aHKCOM|~VJ+?I$V5i4S^<vL+&sH;O#Z`gtL5(J8vh-6
z>7XjtLuZojuJA|>N%4~w7hzZk4KEw<?C86)Q*)QmQz*f0nvXx_!-50RTVWV@CDWL?
z8}s%^`&~<*RbbG(eWSxTpx)A7utMRVr|E*Apsj9o2-64pT)lmHv>)u#KY^(RUU?z>
zDq}|`1qYDVtztCTL#ZE@*5+m^Q9?l+kH1is@?m-PoSJ#fBGOIPO86Z`C^5ZNZ$LPO
znJoEDaERqNF2Ms{^`mAD;f`T+q=|a!mBLbbyK}|*?0U&Ccb_ue;qQjQtJF?AIRj})
zw3a&|*a!oYu|@fuRNXifw+s)>Nb^l$v1KUnSb!rqU9SpMq=u^}nIhDzJEhu$o$7t5
zHX5muGVfhMcEP9CIb>P;vw@p3_VEOrhF8-Ixa!84GfI6r^l@&D(kCiaMQPA37UKxW
zI+T4*>~x_J2UEsfPj}~(f@K+-X%}9)vF+uMFzAr2V>P%nOJre-sZry-GNXH~T_&?J
zSU?1lU1PD-{GCK0WXV~C>b1E9Ry=e3G|Z6qyrS4vi414BC(O;D%a4{vSBAF5cU@&d
z*l&0%pj9sf^$W5X!uMCX#LopERXj@Kc4{jIowjd=eNdQ@A!>6R<pVhdFY_p%pY%88
zO^1^01=by-d}2ibnG|?#5*ZV3`7C{vCjj9^OM4cyo{tyd<{uyab%OaV+`NcQkk4Y$
zA2Q*e6*%?PuL?rX3Y_ON5a#cwf0KJ$oh<)Du*z3eP^v*R5{E>0_0f1I*Zn1^_!+|$
z0R+N-R@S1m2>z_B^}<c4*7RtVLjwP#`y$8vJKYy$^Mj3*t&R1wvgN?^C(19X+@C2=
zMyb@YJ!^m{NFdOw-<0i~%>GstD^vS!k0*iRHK*q2T2sTx0>#DQlJ*YQvWu|rS#=D?
z1%c3hgUH+4n3!4qr^r>W_FApR5vdv$?!~fd<G2HV6|ZGV49tu~6-!}2uQti8Ejf;e
zLGkT^!H2+;hAf#3)@6sS(+*C*=G#usAWW@gi_<K+tTNwJYb6jhSoTaYP=QDXWQODn
zS$W*3@6-HRt@&Z!ln|$#5I@pv=ts~^k{3Rv(cas;$8y`B-Cti{-CNMgk5pUFdNATC
zZ@M9LU42u(10FN)l^=^lnE9Q49Viyo?~W9~*FM}7Fpp&nwm%&oQDKU&QQgX2TL=fu
zeVPmvO`R`K&c}kso<a}@&ydSMO49yyOJ=HEB`U0vPce{qej6=>&8>^-y^OQGQzJ$t
z<%sgWZ2qKm?#J~}T@`S(Dlabf^BZ=<1nYJccw`;F1mNRwbIAjbT27Q@_F&;xY&1^6
zSIf#g6Sj~M!0R*Np$BVmM=R`Q!!(!>P4uu_>L)P2WPD&z0SSc+5|M*sPOu{gp5?<E
z6NFH4IWB*SVYMe_c0udfp-^`|y4*czzp%-u94vDvtylcm2Y=jZ4$t(8<d@$S4iEeJ
z7>S8mFyLB8QYb0~M%Pyn;re}B(i%ZXhMJXrEY*UiR_-i~8*f-IqCK#~`5mqU+R_Kc
zpN3L95Byrt^(=TWgH3U2Hx|mtM1W~<i`X$XMsdTqDZw_p#6+;04UP%1vBvZSflH++
za5UR47Rec~OZH)?yKzRLRf|1JfGnjg(P22k3lK|SF#Q20Z~uXDyWTIlT`1(<Y{$}>
z0Hrx*N8zUdv_-=(KWU?QTKFz?-z8l(Jc4$c*x<QAPT`r|duVAf-p!$TyRndLhM!}a
z?e=N?kUBAIY>MpSuXgHKG($d0t>5+xxS?;^Na}CCbC_oVr^ow<dBx`f#*{ZmUAS@H
zTMIP4%f9&<Dodh?+o^CUiYsZ}(LFKf-Bana#o2Uf)kXo|!OoD>4*6?P|FvtNkP+c8
zts>*5q+FK}WJiykM|YG6`1Cgt@)Muddn6_fhI(A6v5nFtmk(}>8=L5Qk}5LzbjKyq
z%exQjDt#3yWtmO43Mh*hNaEkX-6Fr-l&^l<xP2**I^qK@q|_DPwt6b*`1!Z;UqHmC
zOJ&f<kCL%XTUj;v2@oK$Bx0v|+$uw=C4S<T;KpuJ&L=lcbq`h%GYR@h{@vaV3?%;^
z3>*XEH|`(y@OUaqM&MbJe({a}oi*a6pn!phpU))Eh2ei0C0>Rg`WMpQxe$IMoxKA6
z$&&#5tB$^i_J2kBt2N;_iUvC9|8G?IceuZ?E4-kAz+nE7UkGkIfi)iRr>gwVGWk2N
zzq2s>W)wyK2c!RCX!v(Z|7mLgo{bSNoc=)xkN*Dv|GUfKuW*00Is8U@_yg^Km>z&<
z+sj|);qSZ;zhQeB|Bocoe|JLsJIlZGL;L{;0YYMpXR*To{$d4r@k9I*<iGdk7mycc
z1_+cT_XnpxwY}dczkMNp?bR<BU?6DX=eJq8XDZl&e_9fMy*Pi<s$UTPHG>+;pqIw|
z=T-I6xc@zuziZt8!1zZlG8)gh{LeQ2dwssFr@uDx7bM`H>nZpJ>Yv`8|JK+4eWL!Z
zqrag26YNU&53v8$-(LVRsQ#_={G-i3dvLx&zgS^@A3k8KALAqJNQqyb1zzf&`SWjX
n&#&kE{Ex#249+4x+5!_x{yo%l{L51Y8p!hbvE{SH%eVgr6GjP5

delta 13365
zcma)?1yo!~`t}=l2<{MEg1fuByK8WFNFzZ4!O{?d1$PY=+@0X=?oM$1U}k4BJKyYo
zx6bK4efoC&s_Lz}b>Hge$z21xSqH;cl7)c8000260FKfPsr-Csm0LsrK<yO(fB_n|
z!3HjBdT~wM;iWDA_;N6hSP{)$@nBI*QlYk{g&YZMMMv^u#>03b#*c=OSG&?-79KZ_
zOuWXHglE)*O13}eh}&)WVg1o9?T+uNWqJFGVfpw@VEO8&0C7yG?fZ0Yg((sTW`JZm
zH@O8;Os6jzJOGC$23nY+4K~PGSy-r^SOF-6{GpkUT)8@sT+0|45nd<*7BD>$Wdwu!
zcm}?M9N1ppOcAiU0!xlz8Mq2ohYUuKR-lOJ=<L*%RUJlTFNV^XfFA1~3zmai;wm*N
zSb}#O@|FxGGxhsn2E<%vU%-l(qfqjU&o$TVoGDZK4`To#&DLcCC~n(>ibl7QZ3#FO
zC3O<#{_s^kX=l|x7UCOFKNi{u`}F>6ziRl-7R~A6lh1vDV3zHN($~Z=5E5W&kelT=
zh*)a%y>0$o1VXbw5hg$oxOU5O>QHaTQdi&P2mh;+r|Gp>;RzD1K(i4lZ}i3!1<0xb
zP!nUwZo18KQsBt7`(v8&gjD`#=nx?B#)Ae~_#)D=(XmM9{H#yPZ2@TvB<6kHApjFn
zB9KKG`EguCS_v?AP%n_75y!^W(aeGf45&Tl6BA-do!#bs%p$+p7(<>kvt>jf$u*DN
z&k*lIjPvH^);?sZ4^ZFIiyNu1&RfBHB03%&t;q2euv~BI&i0-9TJV6`Mh=7_foB_g
zsxC;^^SW!55sZkV{(8x-dTuGp&1nZ#B^7e+u<c$a&1Nv^SE+MD`2A3gonb{2;?q8X
z<W8>BIZ3~ra>QYEP*!X2OpP%l*kqo+!El&Ik2RP<fnS&81H3H}%wo%|a&3#|qrt3H
z*GMpm&)s3USVjl3q_N8^)&r2nYcOS~FJld>VG900AtmZlo2!9_(7}#sP!*AK>h*$`
zB_E6~Ew6WReT%GW7@=0m<Y&#-)h!I@0`nK?WG$Vvd~fB4n5l0OIx5W`$<LWsIXAc)
z+ew1H^=);3=+qoA8Zyf+m0(NGd<FYNZ6e!jWQlI;nw)zXG5kYC>ly-h)bl}XV3z$`
z{M5G{K$ZPPPhDzLXskTFurD&YG0F;d&=T3W1hFgDaCo--+OQ%<8C1Rov^;d-mm?v8
zFqa+aAnZu$8=9G;z3{ufH&e}^xU3DjzIejBcb=Auq?_b(CN2`FmS(NhE8T*3nJwXk
z9dhICtR&iPB}3ciMHR?E*`@L!+|a^&(+V@*f;P+GV;O1HAKWhVnh0#*Q0$JgWk=8q
zBTpt-cQ86J$B-D%LjEmClm{oq8(y!)7J`!P3;LkE$`2%mq<-=f?v1&;^Q96f-!mf^
za_D6Vt|Y<N9o{w5;B=O4`o`t{q_C=csU;%Mq2bPC$ts>ZvWLA2+>;|Z;rZeFTGFvq
z?PwffDnefZvW1hOS$T#%*@!i<_ahHxuIvLoS-M;(j++$Z24XwrxW{*+dk!RWGL!3E
zk%`FA`mlA6?+EbPhUp94>IMcm^7#}9G9oE%*wd=(ajxc(>mEpbLxqfcMV68b!78&(
z=yQbVn{ka<O`$a4K#IMog!^!rgyG%5;F6?p4vOllH=EE{U*mnC=BTt4_S%;&2rm-w
zRs*@!#dvL4XTl?NRUOAEsaMfm=&g)&KJQ3r1Y-K8ePeAj;7ZoluOdkh$WWOU6zHH9
zGF0Ui#C&wUKuKx~j`UWJZT-pSvg)7_v=382<f#BLK3BrG4pcm!*)4}|cTHr!&&=4i
zWTNb9GR1ah4L&00u&@zxWXLhGlI1mOBoW7M;V^VPhxf8?tD|`$?>Do3ce7jajr7!u
z2sBaWZ<xnR)}Zx%PS+$F2~1+@YT|OpFP}?u!96^~Zm)mpMDrUO8<J&u)RBB|>_ScR
zJe=&z#);ua5RmrXLGJ_!c)4|W9_4g4P&dc)Xp_XCoZRmjOn0rB$XUuQTwUDwfF_`b
zJIjEu3Aul#bZ)fZy46Fc-Zf$?ZTlMT6qmehyP1{iBQE&EP5cP)h{p*qzUj$~gS-JI
zcE_!CT1D_1*HZj-q}!&j_D50;4Wc)p{AP=y)K`kvKwzc*BYKdkw|UQ=mzLo;e08?d
z92VUdF-NZ@G(-8DnbnwrN{^B&5+4uQ_IUa_pGL;K<h}mVy#zgux2LI!(`DIGeE6sz
zbJN0}vJ=@`LKRh;Aacmwgzu?Xzb;HG@MW63TthRANP875&_NZObsl{-REBUe%cQ*-
zdEMQ;2?^XOJ`>oQ=rBJMkalR=mMiwn3%}ft(ruXa#?G&$)UGo+ix6dLn_`>!rqN*D
z21c21$p2pcla<6GTw`{}?%4(5XswYx1|dB?QJ=E+L05NPT>-vsDroz_kRMHO^2|-h
z@_yRpll`LXS&RW(PUjoTk#?qP6G~OBPaV$jN<u(FqjwwLt=OWh!~u^Zg6(GAhHRJF
zN&J;4Htu-D5AE0@tGL|O7#})M4VSG1xOdpoE*>+g*TU6EX=8Lm1cdH;Lts?$)Acfr
zRI___m}X0s1++OI!mBqzSH!x7+L{Z3D=KAa&XraB8~ob7cc_=fX(UZAEZdGs$Iec&
zI!^;t&kvRA2-wUAF2v}eAClRaCl=dvN~I<T&x_5ac?mBPCt^{dtF{JvZp*FpM>j%J
zaMC;|^-Y&Z4dj9x>P6KIB_(k=**;b;*c=>aTuO|AL$7`?JR|qz8`KdyLSo|I+9ia&
zwHw0oYvdCrvCejkHmja;=Sk4!F!FOUJfZ;V`5^E!NJUC-2tH)&f5gBDX{FhU^+$gV
z7X!14LPWucrU2CrFd{bN6O)56bi8iEArrb3rE?D371n{Qh6GQ~<N*)z!)G^;;Nm6N
z#59Yf{X#F5ROBX(vAm)_vb7Qo*%6L%C~{Ixz(mK2p?-JLl&HCD6S#buG=@mhY@!S7
z<3*}7HohTwGL?A^2B3~eualbs>zz*m5HR#J9PDgv=F*Y<JRYYujY#-*;TY>)>G6R7
z%}*D&$v7V<NrlDi{BF8_o%m~-bm9a$tIs5jKSGI#rOZr=b;IKDaWS<SA1^p>R+OS(
z-%sY(kB0?o6gvWvWw&l6b6~cpS3J?c#xrigFYe;ODg~!T7qSJVxHYO`#&%$u7t=p0
zf5?2?OW{vqCm=kgIBt)wftM&hh`Pv^$;P`~cAyUJ(YT~6j=j<g)QS3ecK8KH$+tE>
z<cqPGpmGo$*-~bL3v|)eEQ_YBuSFpzeNtQ&izKxzBpJ;zXCkIo7$2OjsLJCyFl(Ls
z$#JfdAtbGD;pUW%{DEjqW!`1>2i#h}R?XX<lB9w_(%9Oj;qxD7v@Kst$G<J@G)_^T
zV#V?xpv%49o&q%tv1txiI<|UbG0qy&5OShEF&QdEU$?g|;3YS&=F@W%JsCs@_(D-z
z*+LeMB}JvCtZpTy*=cX-(AAEZ11EhdqmGOk!pQSzYi;JV9MADIMG4ly&9%ZGb~Lr!
zEwY!E>6`Uq)bUs8M4E;I-nD{m`>M)c8-C&~7ewDk=27Ly`KpTwGOD!a`YCp$rkJ3%
zzUXr=&9-$#Omn56No_m25d{OPt}sTRsu3KPP~q1+h3iAh^ep<8uXx|g54>bfR%h{a
z5r*%%N*^e6X=)f4{s3}(*TCpImdvXQAXj8BAPHZgz6n_A<|shf#h()L6U~rWpbw%=
z;Wfb!4b<m)#Y71s1B1B#1k|Pk(tINxqwj&|yCp+K{8{-4!t0$@K9d{}#GO8Z@`k{r
zmC&z`HG-m;%Eq@}Ob~}08n|QEa2)<%=hh~z1gmaZIIy|LogDFoE;7a}Yb)f#@NVNA
z4ZA_ihi@0iNh>gF9H^9K)IqH-=OH77Ef2FyJw6--=&tRT;+!1cBS}Q>u)8cx>4tG(
z5Agk}GP(5FwJlE1E>^mCyH^tZRM)0FVZ<GCv&5a$3}HBq8(Yeub%BArqBop}fx71*
zL(Niqb#EYxZh7!o1H|c(%bRkxR3sT{um#twjCXUTQ8Mk~OEp^Fv9FU!SCDQfqZ0=G
z<mmh)zk7qcnJ9SFd^E+JS3*&rx~4R^8l!?;+i;;BY@hEC=c}jAn58R4cSTRMnbbIx
zEPa$Yqg0qUt&9$x_6`V=sLpV&E0c{8vkR<N`Lf*A(;Xe;H7JxD#w`k(+NfO7dtiCG
zkb48~Wh6VFD!ox*^rlD>kIBv>WxzFTgzvtBXt2jpmWzmkw_;&CgH&f$)t-I{vp|c`
zhH9r5Ej(OFeqOK9JeIwD^?vs&?ot2b8l_WU8?54?YQlO;R4$Mn+Y>FJVd4u9e~L!@
z*>|giDvIIS^8&;Eq55~E&2(&d+~!ee*Mwzgn~YdGF3oT9KSY?F-0hC@17Gud#Z;mP
zqvD$<eAGO#!RwdQDI32T;az+ibL@jznR)oOiV3ooAwC_;Ck;O84P6a#ey%a<c%>6T
z2FcH0EV@XfhC5fi0h1ga#knri2}qUnc+SDPc-begUuPyin?)&H+cv^{SO6dt7XUy5
z-~deDIy=~zGb%YdSXkMbJ2P0jsH;H%APAvcHQhWB0AP?8U;w~xXRb;v!wOgyF%L$m
zoBI4L7Dxbq?wJGq%uo>*7LynMt)7x%qQ>9rQK9fb^1ak^KOQzdfdT*)pU-Qrezomv
z?&#p``bW$EMEHV!3&s0Fuv)YV&Urrn(LHwx<xc{Gow2=@g}ICCf9e8Ai>^Qi{<$6i
z@Iv|R!@u4TUMLQBjt=(b_O33B|B3J`h%bPUs@~p~XI}Daz;ksR(5Wph&VQ;|IgHx}
z&xsJVA>}+NES&J%aS{js;H6nBdly$@TU!QaGmGCU=gxZnJ?0=?q*kzO5CJkjP_+=@
zKnI}*?#UCa8A4Ug9mGog#H#rapmJtg<-Ad}*X!Y04i58v>?)o*W~T8P6NvDJ($h7+
z`)h`yk)@r-=>2X9=GzbR`1}W#X1?UItsb$k?o5v?&A3i_nMgVH$s0trNP*+I+6X(f
z8zIG^X^mZ)OVGn&!`|GmJw92w##NWn14}3ks54xwD^})DTUp7IlRusUC~pz|JvOqv
z+h=kx0Kgn70D$`E6fwHGm^wQ=5B6W{>z`(Mh+G4P=Ow%&QR-E!&+FtB5&(ew3*qEu
z^?$CCPHlcDQ3ih<sc*RI2?5W6P5}o1uz%Hm4z_~}y{Ut}>+@9q(GlvVk^gVOiqc1b
z0bgdUc5E$Fln?+&uz&u8;TOo!*wWnA!PxBA?eY&(H_5N-gD&~`_z^SM9sRq|XInIu
zN{$$(_tK3vw%shUXUxSdpVdC`R@M8|>tZRaJvDEuOgHzkFjZFa0ZL1Gfa-2T1ukW0
zD;c%5;qc5d2{&Tl#ys(B=1Gi@RhR>(WzH($ESQ_|7&$+%gQYCbJBrS~Q%8xOdUHo*
z^?mlFR>=Gy2S1BG?RQ$+GLPNEiW)ARwD^U&OtF)ePVCcX6Ff|FqR51tlyG%51L4qo
zA*M=dXq=X8S!Ou&*r)-fKp+r}rd>rZ-n>Q-htBipUD7ZNzy(l=bi1}{WK;CRq4QW*
zM2r;`k!o$W($XYRZj(-Cqe|BBeJ!#}z_L+U1R{XSd^D}oSh;tt)jjMUSsA<`Eg1dC
zrNIrM=na)7X$&#g(c#qRaSv??=8yhqKUsD*Dqc^t*KgOouU1U>MyCT!mS_mk9{yO?
zl{wB|dvzUAe(jj{&0=MA>1YS(LM7|FV@sZcfj%-2_bWl9(Xt|PKD{=BL8uFNV`3}U
z+a*=Mj0ZjN(|o6dJBH_E=MaCAIcStI3x~;r0kq9ZinHz@zpluVWEekkn|J(J+^RV4
z0@pdnXa*u-!vqen=;Yr}*7DA~yaoQCAXUyFjSR=<h2bCxbNzsReBd;o)=lE>eJ@5r
zVMr+*_v68-5(Acnz&m-XU`Uc|yiggk=fDvf))y%+{Tytt;Lt8kZXDBBdla~!NafgR
zCUWf-(q+ZPFCV%JiJX0v@nyq`;I5b4h%u9tpa%^%?+mypKRS}MNt0qcbLGS$OIVKx
zUGyd~EFx>PYcrxUYjksVetaNeU9%@o@Ul}TTr7|ppsX5a#h|?c2=Ag(#6Cy=B<X*C
zq8un<LMM)z_h!b*3rf&La)F}k6g)tSbWpMvFxl<G4XTr)tdG?u3l>d_t8#tysltEP
z*nFKDP8j&($C{(TIaIpP0TK~PGvU40$nlkx(Ky!4{mOJ!T6Bm5LllE#$InU-NcMm(
z#%7|}Q~)ES)Yk+fS#HdiHZPB)Wa%r#!f7%egJ(flG3-e%S_r47FGoc=GzxKMHX&G~
ziC4z;7cnD4f^L6la#4ouUP11GB{TS^ZqD-#@{hoEC$1a7J>08TDkQQ<(Aln1@An-t
z#Jc+)y!=T%_ho+^BRBf+F|egfVSKcjoP$&3&S-y%;aZQ8rpiXCUNqbb()6OBv(E`K
z|Fxfja2h{m1Ah`S5O!7RI6HBCJQ&{h^X3_kOajz_&N?^_2D4L+>x@?WM=t0&2eVmp
zRD})@3kMb@XW{{VHm}xL#NKX+Yh?Jij}Nl5RuQLlS;o0Ah*GUq^Ns1IhYiS{gBg4g
z0+hiakJB6HO>NM-CYor`yX5@&-NN*tbkc!bsSpU7lbsARU=pg^6uQ3VwG_qMViAP>
zW@y(Q=Uf^sTG%QfZEvXlbsdlarySTesEAVstQQ2$6$bQ`A7p_UW~DU@oLL1K?v}c7
zJecxFz=RVTI3rvY*2*@TPr4gTXJz<4RO@_rg%T%qyRWjv*)xZZjJLS{PK6+uVf*Y@
z_QR#`bgK&R)<xSMu-i5JhU0yoshvOCmMLGOkfu;n*H`i2GXVlN8eLB=uj!izd}%4O
zI+>p+LDaxS<=mfb2HOvx^~;=RgN((J`BVipxdl@Pl_vJP)?DicP03ln{X6NN52*w$
z*EEi1-qE)1kGk?=&Gba=*O0YOgE!Iv2LbCCRi&bXFcb5n7WH~&ROO$H8h%^~>(j5(
zBvxccp=v1J`{Bk@FwMAY>b}+H11}+78S{%Gd+Y+j-F}nXq9!I3t>V%CRG5<$61uqP
zLn(<6@Vt=cv**jdtMlY9bP@x#*w6119W_fxysZ1*xwB`n&bk<5>e+P=E|mZH$+ql)
z4U4`noZ4_@3o9Q%W3s`IP@G4?Kj(r2(ImubhH5cIJ8YELuYjQqOze3e1%cirM)ecC
z1zZAiYt{X=!11d^zmX>t=t*bBCa4bFB*jv`S|8tKxZ#9W6>Lic=L+mFM@Em&FPGE=
z5b&?2@7FRsDpxV*l4#pw@qIB9HUC&zc|ee?fRybx5pDuRVi9BLcIE-I;xGd6PM~iT
z#gofdyf<IaJ+i?G$^>)z;`=tKK+7U*(IgM}`s@b1e9}7w@SWV^Q!HNFIY;FP;)9h|
z2$MV&LD1!LUQN`l@&~Dt%R4Jd(Dy0tE<rGaB4kq+Ad`|P418!1vTvi=4*#1U>Q6+T
z&P`U3Sa<i@pDufAyr)p3i*GKZT)l01cilP4y&Dk*tupcOf4VywX#-$M#&R+^@WlG%
zrnQ1O3zNtE>gY0;H^lJ{4lgg=59Jhkp}S6Hx$L8o;Y@bsSoERd0WPryvS;XS#SAkN
z(v6En?FVoa#E8_aP+fSv?~%|C-f5*kfYf<Of!hP`NqNeKheITvH?c0pvS@}-%RFq!
zJnWF@k25N@sksE!b?~N$B^YR)Mzp<@<aQ9caiCWU`S^GEve=Mwh6Ldv3#|HIRCca1
z=IY_gC?xb_VnAGk(ahv4fjG;K2TEH|CZ6!;;cev1`gm*DnSor}C;&*1OmEYoND1UQ
z&>Yox!LczVqN!*3@Zn~@hd-({U=g~}mK;8vl&U_=9Q>=qD39oS;VKn|ice}3(LGPW
z;PO!L0~ngwbv>W-9H2P;S(&<CsrMDlK3pm;AHEwu{608QADA{ncmxMOBVkKu!~^@D
zhym<dnryXjx*Q4h>s)M+Q9Z|o4<;p`7+@Fb{wsFwv-j*(&at=^F5&J5j?|}Ld25A|
zws9u9Ud6iYgPFFnpnkofHs+Cdzv-L!<u$7v)x^eLwSr1^zLnftJhIU$8eR-k;Q$nC
z$@V?PtK~7~k5R@lBMGKlIGiRV9oa_iy-eqk7Jf0{lSY<CLP1JD8e>AXI^DZfZ$*Gm
z+U>h>qU3He%<=HiQj0{zj0UpK5~Z8^e$BYNA0m6`m=JKWmbgg?j{QGOBDbiK_N)%Z
zD7Y3Hm659H4X%&AJ?Z*+Kgq&CMu8VkI7*8bSGUOU(Pk*(VO<dc{0gQlASKasDfZSm
zi4yNf7+-HAQ5;%>>?9SE>TL_drvp@=5-DWorrMCmj0eJJ0^Al01PN{H!Ntn@db>6O
zNVShl@4i#HbK*0}QVozgVrE}S;=Web1;{f8k7>y9XqUnmr~&lCUq{5wFfwC9TCeZt
zZYW^$)QlTE!MW~~$1qC^r4qQ^pG*nTn>u-f=Ezi<a^P4k>}E<%2)ksC+qGc<%aK_a
z36r#=s4Bi}C~JJ;m!pGdyzqu4&8I%mqBX60FtQ>j<rZKrbX@8QqY6^b)UID<O}bHW
zYwdb~41~Q80z`U)O&Rfi=IJMaY~ThrB>l+P${k~F=yVH|G<t%N!8nj_)&8gnUg@Vv
zTE7b&(``gc4%-M&+%2z_rYyq&`m}LWjKKBn`0?V|wl34ieP?tmAJRD@BZ#}$x%F3#
zR7kGnf0e4i?e9|-vOF~+td@TQ+gnaV%zie4ktC430{XQ0HV$4iWEhUaPsefBh>Sr6
z3M)8tXj({RsN1%cCtdRmWeW_#j(x2K*;2P)<X17w;y&tg8cUjL#c!jCK$|+Or;NT>
zD+kU%&xX^3@7YZpBAp5P8;6Aa_Q&AHT@_9&Nl~!7wd^ojWGezxm+0lA0>JsuJ9v12
z8;r!U(A$R{YKJ;uX01o-MXlsHHS0t5FRjbm<^%?rSR0YhOEo?O#vG3~390=OD#e5j
zfi!XR3!^bWdLC=~rww&SpiWof(-Sy0rC#kW%N(M%OzA%21dq+KXG@vT<rXI`RO}X5
z&*o|VMJtR0yWug<WYowEhKVX`?=00&jIQbHJ9o$ZKI;fkc3WZXNG-4QK|9dUbZKb#
zvcKUE=Kd|u#eRedbu!06h2T9~qz4*L$o!)bJg#tx$E(ofb*pkapji1<rX6o%{C)E1
zynHZ6Ol@#(yfWpNl5jZ)^zSt{P(39H#8fPzF2=+;c_W<#xtR9f?VAG8rX7TLc-Z{~
zZh6s*fXjJ2-ysO(+`h>S&5el=@y3o;t9e^2<1y_??O#+vFu1x1!YzKeCx<j+-_Q4}
zY@9(o)hXN6MxFz312w84`f4~JNYTz~@1?qmV&bV%f?mtfbPyc6(gm-R^0Rd*v}f|A
zC~Qu&#g$AKoqMVOuvsLKv64`JKL!OXgfEw1N}VJ5YVpoqFSdlx`kvs6*~sk!welQO
zY-P#kx)dV%arTVv#BW<b&UgcnyXlpBO+6(<Pwr7(TG;S@5ny(aSZrmeI)WPJ7qFgm
ztp=0k@pa)E`gW9^N0l~ftxtLg=zQBIiQn#Q+s`@T-$RT-T4rQT8W+J{dcMoYUYA~T
zCuLXL+=ZLYA?En<(|*`_QH;<*El&~+?xE6Z-Zrzkcovl0NlfQSL;4+T5p;+)jyX6%
z%-FN;DZ1vctpc15a?TW0tQ?FPha5%7eyv5#%vO~Ke8f%6>v#NQ4O>R85Swda8QS%V
z9lP8@kDLBgh{aI9<5HfCn;?u?%;i1;^QV-8>n%ZdV&Ikh6Z-XWTCe-n2FG+rE!BV@
zbRG#5^B9k+rdfCe$vXPX7wu_z50bk0p$t06?RaICR}MfGR38@rQkHo{Fgk;_gWS)4
zYy|QO6?d#FdIMweNe|B8)!_1^fMU!uq+$rrS<JBRU5G!&jDJp(YPU_{cL-<wl_1@|
zAHMAr_p}`%Vg{!r;4+P5C`LMd0|h{>_cx*GF3=^^uSVK!Ca$%mg2Qy_DG%Ncs@Le(
zg>Nt=7TyCLhG)?ACB11ugU5K+{QSuk)kOt5@5&RK-Ni2I=sqJTJXpY!DJ<b^($}Ig
zTXw*IPTbnrv4PEW7a@yFo%v3CmgUSF#XX!moUe|E_eom{YYYiCz%1Cj9q7d&%4-d6
zlX{e5q?mfpPFF}tk=ctXM6Gu~LBWN>*ebtAwHpqkCl||7y?DDjVDj2xp(V2ajYLJN
zaC}nlsg)<;APw`BAUChC)6Ln&NzdpeN=u^vK_o+HXh&Mqo~=?qOB7P;V!hI-75pRG
zbXH&FO*>Uz6P*^8E3T2KCi^PRHIAftIsXg?bp}H{{9)bo6yrxr*yCouGSuQELe4@L
zrA0BIOUWp|{E6aXE2tZZ&uXDHXN%lzaBwm7vshZWqtD>+C>fbnN&|2>jr;qfHPPPX
z=H@`hI=Wv6iA*O)@z{2xq{zh>l)qgT1i`)>5(Lc5#sbg#T!y-KG}+fGUx#d~IY8W*
ztd0i}ZweW0Tv8TYR!UC}S8sL`^hrb}-gMFeLn^T??`+Lg40y9;sq-mz4b4vz=LvXu
zVV1NX*hKdcykHE+E}z)6h{A@Mkdvp+bBYHW7Wa|-*4(qyzoEOJuT+FF*+Oa%SZ6E6
zt!k;Cx6);23(4o6VhH*^t@zY{AHnM_?g5ms()y#x*^I$lrMWvX-WQa5??`1@?VYnT
zV%0FvZsE%)if?lC91DzR*=7dqwvUNVEsg4{+Ipi)&o~6hrJsLj!n0icqBE5TiW9R0
zQwQCPQKQ|(Gcm8T(s(TqhYAPRVazYngE+*AUa^-iRc@;<e{YK0W?fhvf&!U|^MGA}
z(!{Zdii9X%TQ=^J0d>v@^-(QLOcf6j&&(Tq`H>dSoBBZG;<P{-QH|?>&yvw}!!hQB
z42?c)K1bXakjSIa^)9{{o|?@L!`#(~!OZemC0LHD6UMa-mR$PS<9n1QT^2{>cp@GY
z=?Hz%mm_dHkaGd6$0K81pN9nM7>(#Wd}Zq(&;dP;%>yUMNH%hA?6^e%jT)n(G5H)Z
z4WCFOPOKoJmbQVee&gMGlb1%e#EH^;o|H3`?$-Awran2^X?weB0%HbWSNG?u@Z^Y;
zvfJq?D!X=Rn|}<O7%>GES!)vf+?m5>6Jd@Xcfv_#3ggI{Y>~0G*J|sIM&b&7TLUjY
zt}R&I7G0ziaW@l!>owx)%3dB+U*Ux>L5<f}57p0od2J7z?p)=V*TZ_+vGR2Y@+LN%
zP`I&ulQSxDT63@cbx!}WXR0a8Nw#2YRK2R)a}vcqUntcZG2jQGD$g1us&HjwzV;{t
z;b#@Di>idIh^*;^GN6RZ=PIct7z4Z>1F}8Q)bktw=XRFH`)^{$^#QHPs%T~Ttp#Hi
zc$hKc?bnxbq#YAiSSgHq1rW3$9>ZuozPqL$&MdTd<dDLdbQ0mQ<;`)OnKzCp;9~qT
zBCu*sA^UAH9w@JpW56lJH4Fj=*a8i@-mz-fyXozH1$9fRftiEwr8t2G%jBil_qHX9
zNoWq*NDuzv0?t|Ew+juUCF;ILerpW1jWsPC<Tk^$xD6_0)}@qP!<2>V-qaHrc%@x&
z2<gKXz5Jc44Q%64!^83HRnRhg^m!1()vpq~4F;&RB1&$`tWDl2_|CMA^~WyaOjO-I
ziCFoTVSv}je`i-O!C?dPCLeuxUj&YtFXNA{6`=#<;Yof1c0L7FpFKqjb_Ugm?#WQ<
zl5N7R@w#>9S%<lu#ZQW4<v;nt0Ug?!6}~Q$bWie14bEy1q6)=Y@*HyAXoo0cDhlo-
zWz@Uw>7G{Q97&JMsyXV_61?8HEw4{m9;=oWmkFU+&dP>=ElmLw3CHAk^T9?%%3>CO
zFU!X&)BAk46*{TtSbAfilY>S?yMO>kx&v%nPlq6{PSbUq{kuW3c@>B0vBm|y{)G!I
zwn7}fA~nP}?d}~<K!p|o>7L$==9;?Ajk3b$oMLZ`hr+-Lg-<0%?$%33mT_;1JczE9
z0$7SV8}dVVRx~~W&6k)%@`~1X7fxIxhsq&r-m>N2S^P9B0V5SVOyQU#rpF31#H%e$
zl9Olk2-q`|oy>Ja6U|vN?=X#!r)tg2*j0`X2}&2PvuvBuu>Vn7%B2S(F-bD&++^B3
z3T9oFV$oN2k~Po>q#w&J%Mu~dZzMAC&o{}tNtY|$K}PVv>!`EmbVH||a9l%wJ^Ry9
zz47x6wVqj=jZYxxt&9+G9Ir6_Vw9}9!91-+=Wu|A3w!VL(@YG0Jcseq*A=}Kh0Ysy
z_`F;u^)<fyx@MCo7{bif%>a5_#vN2HLOjYE{_6|fpJ%z!g*y8sUuA0?sH(}`QTxTr
zhYsgI@EUL!uTc&q!su4^;2Y>TMXE@WudQcX7c11zT@<OHT%cnEyDybyp^P{lOya=i
z=PaxA=tR<Gr_q78@|Q_os;6N#ozU*X{$rOa(aXyQNSei`D2%an4GMY6M>JJ_v+Z}o
zbS>W~g$_~u6$?!svERVdq+4TS-CP8^ZRoo=RG;EyVGAp_1g=te5>e4~<+nK(vR^V<
zUUw!VV*en#Kt}fk7D-A^dEHK%s}WgT+e`JT&)C|m@6YRX;%<3)2KCgMC^s;oCSfD~
z?4?Y!grYZHoR8QMKNN!tiy%C*U1GO+H;(Ax^l@<#*-nZp`UJnwuOZH&>*|w%JfD+E
zH6IqScKk}k`cn|Y0|T5Q?On5KoL;CCTMjniRhOo?q%VaYQ0VLak)c@yt&nlp(*618
zQ3%~isvkDgTP8;P^Fgi`u&5{M#v-9-WaWkf^+}o%EsU*7@@1u{5nOI$6iR+AJ`V3X
zEtwQmOS)YVa(Q;lOZ`%wG=Sifve0;39gXrtCF<DkLSn6h9pgG^jQzhZ^Dzw}b%&G}
zD6)R><_eg70wRhH2NIhh?*#aq+~yvD%bKUJo`CyXG9S602tG{#xpqF-xmZmIjfv7w
z#f7SE1ZxvBX|m$X!5%mSgImm}?=CmN_4?E4%@R>q5WAL-jG`|M3=Qygufe4ZYEx>^
zjAV^lDD&$a(j}RieS&whq*TGC-1|;|lh0(`#=8;-1Jv5j3doAyxocRwQqx1F0C{r9
z6E4qZG1UJ6OX=?^HD3F9g4&$+VSoa;O|Qj-s2Bjas}a4ZzH}WADX<lir^gxy%p|MC
z02YA>9D8OFVQ(wryjAuicD1hgXbFQG6vAcA{VqrNTJbvz^ySjNhpxWxPSRT<$eP+Y
z)C_ZkB_N*T=xFT?{MXB_8hhjCJ^s+g{!(kSiD4(zPwgrXx?r#*8Ckp&BNaEs+9G?(
zvzmA78a(Z19IG>RS4TVCQV>=u`5?COg0dT`X`^~jAp~4Yt7KPFAPJUtVqm0~IHNy!
z5XVC)^3b{oUrQ@N={xSBK|oRaT{G03MiLBa01)Psqn9p8EbiUWiH)^Zn3z8v&<FNN
z1v0gaM?aNKLZR|Rors471TR?R3qVvG{xY@z39b3Dp<`V@cdKe%oTm#jwx5x1=5<cl
zxs5tgQrSSz!=OTTq^o!^?c6R;gP^=DCWmWhM6l^j?}SP+y75P}hmd!R&<A>5y&7TC
z2tb|y%(cS6ZaThZ)Pg{3eo)ai*PC}53~;eLw5fioO5^fN`!H18H|zHrc$WR8x}m!V
zh{Y`QIKq`d=pG!VG6EN5x^#F6(oUFzGJD1-G!fT=U)i0^4kxBI4l2V_+{~+6vSBdN
zSP4@<B+ra_*$vVX(1YWX+N-a&Tt&Zn)Bx7u-aJi4(NP*x=3RX{E6)jc)l9a<Izm2+
z?P$clKLz)$j&0WpU~q9=f+>FM*(xWfi>29i{Bg_gzUY#cV${koc7N(;I2ef$Ec9FY
z-4i%F-@P7j#K*RzZ%(m{n`WK61Yl$z9zQc-I*KIyxK9^oD}2O$k*I#x{}2?Pb)CNo
zfH1#wo&Ti5{Svrd6ja6bypY0Y_48RB1>ir6f1VBmzl(qWq?u-^l|qXA?pS?Mw$f;<
zoZ+A4zk0ZTQ$X#^?HruF{*a{pNgIP;#DEaKmWr0rS{YLodT!nKc{rHAy8ahQ%G1sE
zw}E7BzxunJSc$770||Vw&VoT!BHcX8V`I=S$`$}1FRms`FRdWK_=l9rU}q6ODIZ-S
z^$M`k(9+(Js0;~3l?VYI4o@29yBIT!l@wzCYGb+#wCGnEYsR`HRWHJ?rjA``=+8xZ
z5sGOHu5`+tD`1&5IvP4Ujf0VW`STt<^i&G6PZ5ZdMg<$h6TD$l93FA1y;U&!b9Mdr
zXW6L?%7q!k0z$gVOy0KvIN^9-VDvlECoz5F^(&+53F3a#y06ug=y!olxz>}%z)Bbz
z38vfkPq0Ax-VtlUx>JcnxFYc!$uY0>(A%QcR}RiT^25CAs8e&ffh67E!?%lQZpfI(
z4b*@+hEyS%w`Su7c*oDj<Wlibhf<TfB(B;!FT*bLgV@Sx^Ta!?z&V2ylhzjBTMUU;
zt3BJ1_etpmi9SP@k>GMjmGfC*?e{lJ*zNswy>;JQaP}y>qmS%Y9bu+CprCHw2#fRg
zx&R^0q=co>Rz2A2UBHu87n@c{EY$=>@11}U(5Wl61<Q++SK^L#6uIS!AEtUsQu8zK
z3TYn5`(ufldjN8(R^_QdUo&hNN_H()yMvm)e1&_T)S#+U50m2Y)v-X#^HXo}x!}jr
zKHy;t>m{{Us0b~`_ry{8O7Wd9LC*exWn%J;o!Mtye&fq_-aS7^P#1)`6>z$SyBpPk
zAKT$K>53XY>|byY%K4$q{A_z)u5Zgw%U6K-#Wr!yjgr;f61$OS)c{o;V$TEMl2e1F
zDk&Z+lw{Xwy39j>XP`*KzBVICH&!;o)9MT5hBA7J6srk{l6k*OiXlFnpXB^1Kc*{A
zmvE5Y5CxVet5~x?c-oD_wgWLWy|7XSC{^~Ojo!;%T1)_3Z9@6<GkH%b-=MBW|G=C+
z<>Hj-*-s<3ftyt?lUZN7QIpN?9#{tX6>Ejtdip$eI41AX15QLad$?V7+c2g#LH!ln
zw*)*8L6z8(xY<$@aLyg4gDFcQ%xo#m4~n9%=#)?Cz!Il6B>`y-d0|T#DH&dw+=xYo
zj$Rj^bF=hx9Jo@VH)=k<m)!+aZY-2fr?sG1GyK5VvkZEK`gPa8+%RQ2#-bp68yPK@
zdwTekYW<HX`uyNBNVJvrSt{}@1a@|Hf&2tW%<&0%o?q%PZiDY|gSTsS&649RKSM&s
zzfa8DsGW0m0s|<?f`MZ|{DX%b)MUc|{MUtlGHSf+S<jj_AUlBWSr-4_Z5uBQ68($&
zvIYI!yzz@mfCU8n7ca-(VSjgY{DOt!{n^R?>hJiI3Vb&9zx46%HjiJ}*4KYv|EuZa
zck1uE{tNU4@<(~GU;JKP0S<)=NuHrE9uS%TW&-*5Q2xyZ@*D8?DcUCio!H_5|C1-=
z&jCM=_n(|0FQnf=*K~mY#V7Jt;LBKlH(@+a=N~SNU&IlHKO*=)cryOZ{kt>c7uJ;H
zPwbyQ4dAnp=pP<te}(>&UE>#Yj`vUK|7za&EBqfl9KY!K{D0E_^7#ChLFFGD9lxXh
zl}7wS7V$!Ud8{7_v+MpwmU?kk{pY0O*JApIwBk3`?`yzW7v$kU`1@k|haBUtBYv6t
zzvmb)q~AeyMt=_Yzh)eNrT&(80RNVF{K7Vw{)zod9RH6r<c0m$J@D_z$P4<V_=8Ek
s{WCQIwL9Vx|FIKWKVS8Fexbko>|ezn%msAoND4ps>>NV2efjeL0k!c{CIA2c


From bddafc48dd2a7a260c13b7eae575cec436eaaf14 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 27 Sep 2016 01:03:24 +0300
Subject: [PATCH 027/102] Bug 1305309, backout Bug 1214805, r=backout

--HG--
extra : rebase_source : d86f67ef53b26027d739725829a2ee736d71221e
---
 dom/base/nsIDocument.h              | 14 --------------
 dom/base/nsObjectLoadingContent.cpp |  8 ++------
 layout/base/nsDocumentViewer.cpp    | 28 ++++++----------------------
 layout/printing/nsPrintEngine.cpp   | 20 --------------------
 layout/printing/nsPrintEngine.h     |  2 --
 layout/printing/nsPrintObject.cpp   |  5 -----
 layout/printing/nsPrintObject.h     |  3 ---
 7 files changed, 8 insertions(+), 72 deletions(-)

diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 0a5f750862f7..7f418d623f9b 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -2768,16 +2768,6 @@ public:
     return mHasScrollLinkedEffect;
   }
 
-  bool MayHavePluginFramesForPrinting()
-  {
-    return mMayHavePluginFramesForPrinting;
-  }
-
-  void SetMayHavePluginFramesForPrinting()
-  {
-    mMayHavePluginFramesForPrinting = true;
-  }
-
 protected:
   bool GetUseCounter(mozilla::UseCounter aUseCounter)
   {
@@ -3074,10 +3064,6 @@ protected:
   // True is document has ever been in a foreground window.
   bool mEverInForeground : 1;
 
-  // True if this document is a static clone for printing and may
-  // have elements referring to plugins in the original document.
-  bool mMayHavePluginFramesForPrinting : 1;
-
   enum Type {
     eUnknown, // should never be used
     eHTML,
diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 9456f89c3ec1..99ca67e375b1 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -2907,13 +2907,9 @@ nsObjectLoadingContent::CreateStaticClone(nsObjectLoadingContent* aDest) const
     aDest->mPrintFrame = const_cast<nsObjectLoadingContent*>(this)->GetExistingFrame();
   }
 
-  nsCOMPtr<nsIContent> content =
-    do_QueryInterface(static_cast<nsIImageLoadingContent*>(aDest));
-  if (aDest->mPrintFrame) {
-    content->OwnerDoc()->SetMayHavePluginFramesForPrinting();
-  }
-
   if (mFrameLoader) {
+    nsCOMPtr<nsIContent> content =
+      do_QueryInterface(static_cast<nsIImageLoadingContent*>(aDest));
     nsFrameLoader* fl = nsFrameLoader::Create(content->AsElement(), false);
     if (fl) {
       aDest->mFrameLoader = fl;
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 145ebd69b366..e894eda303f2 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -3762,7 +3762,9 @@ nsDocumentViewer::Print(nsIPrintSettings*       aPrintSettings,
       return rv;
     }
   }
-
+  if (mPrintEngine->HasPrintCallbackCanvas()) {
+    mBeforeAndAfterPrint = beforeAndAfterPrint;
+  }
   dom::Element* root = mDocument->GetRootElement();
   if (root && root->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdisallowselectionprint)) {
     mPrintEngine->SetDisallowSelectionPrint(true);
@@ -3770,18 +3772,7 @@ nsDocumentViewer::Print(nsIPrintSettings*       aPrintSettings,
   rv = mPrintEngine->Print(aPrintSettings, aWebProgressListener);
   if (NS_FAILED(rv)) {
     OnDonePrinting();
-  } else if (GetIsPrinting()) {
-    if (mPrintEngine->HasPrintCallbackCanvas() ||
-        mPrintEngine->MayHavePluginFrames()) {
-      mBeforeAndAfterPrint = beforeAndAfterPrint;
-    } else {
-      // Since printing cloned the document and doesn't need plugin or canvas data
-      // from the original document, we can clear the print flag in the docshell
-      // tree early, before afterprint is dispatched.
-      SetIsPrinting(false);
-    }
   }
-
   return rv;
 }
 
@@ -3846,7 +3837,9 @@ nsDocumentViewer::PrintPreview(nsIPrintSettings* aPrintSettings,
       return rv;
     }
   }
-
+  if (mPrintEngine->HasPrintCallbackCanvas()) {
+    mBeforeAndAfterPrint = beforeAndAfterPrint;
+  }
   dom::Element* root = doc->GetRootElement();
   if (root && root->HasAttr(kNameSpaceID_None, nsGkAtoms::mozdisallowselectionprint)) {
     PR_PL(("PrintPreview: found mozdisallowselectionprint"));
@@ -3856,16 +3849,7 @@ nsDocumentViewer::PrintPreview(nsIPrintSettings* aPrintSettings,
   mPrintPreviewZoomed = false;
   if (NS_FAILED(rv)) {
     OnDonePrinting();
-  } else if (GetIsPrintPreview() &&
-             (mPrintEngine->HasPrintCallbackCanvas() ||
-              mPrintEngine->MayHavePluginFrames())) {
-    mBeforeAndAfterPrint = beforeAndAfterPrint;
   }
-
-  // Unlike in printing case we don't explicitly call SetIsPrintPreview(false);
-  // here, since this ContentViewer is for the cloned document, not for the
-  // original document.
-
   return rv;
 #else
   return NS_ERROR_FAILURE;
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 739e7d2be32b..61c534ce5931 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -3560,26 +3560,6 @@ nsPrintEngine::FirePrintCompletionEvent()
     NS_WARNING("failed to dispatch print completion event");
 }
 
-bool
-nsPrintEngine::MayHavePluginFrames()
-{
-  nsPrintData* prt = mPrt;
-  if (!mPrt) {
-    prt = mPrtPreview;
-    if (!prt) {
-      prt = mOldPrtPreview;
-    }
-  }
-  if (prt) {
-    for (uint32_t i = 0; i < prt->mPrintDocList.Length(); ++i) {
-      if (prt->mPrintDocList[i]->MayHavePluginFrames()) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 //---------------------------------------------------------------
 //---------------------------------------------------------------
 //-- Debug helper routines
diff --git a/layout/printing/nsPrintEngine.h b/layout/printing/nsPrintEngine.h
index 153e6de286a1..6457e306574d 100644
--- a/layout/printing/nsPrintEngine.h
+++ b/layout/printing/nsPrintEngine.h
@@ -203,8 +203,6 @@ public:
     mDisallowSelectionPrint = aDisallowSelectionPrint;
   }
 
-  bool MayHavePluginFrames();
-
 protected:
   ~nsPrintEngine();
 
diff --git a/layout/printing/nsPrintObject.cpp b/layout/printing/nsPrintObject.cpp
index fd4377886b44..c1caf762f707 100644
--- a/layout/printing/nsPrintObject.cpp
+++ b/layout/printing/nsPrintObject.cpp
@@ -111,8 +111,3 @@ nsPrintObject::DestroyPresentation()
   mViewManager = nullptr;
 }
 
-bool
-nsPrintObject::MayHavePluginFrames()
-{
-  return mDocument && mDocument->MayHavePluginFramesForPrinting();
-}
diff --git a/layout/printing/nsPrintObject.h b/layout/printing/nsPrintObject.h
index 207d5bb05c88..5103224f049d 100644
--- a/layout/printing/nsPrintObject.h
+++ b/layout/printing/nsPrintObject.h
@@ -36,9 +36,6 @@ public:
                 bool aPrintPreview);
 
   bool IsPrintable()  { return !mDontPrint; }
-
-  bool MayHavePluginFrames();
-
   void   DestroyPresentation();
 
   // Data Members

From b2c4616ac5c0129181e11a9da21fa37d301d8425 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Tue, 27 Sep 2016 13:39:21 +0200
Subject: [PATCH 028/102] Bug 1304363 followup, fixing typo

--HG--
extra : rebase_source : 23835aa735d7ee4fbed6d4c6c0404db8f6fcc9b4
---
 browser/themes/shared/identity-block/icons.inc.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/themes/shared/identity-block/icons.inc.css b/browser/themes/shared/identity-block/icons.inc.css
index 9146683abf5f..6cf300061527 100644
--- a/browser/themes/shared/identity-block/icons.inc.css
+++ b/browser/themes/shared/identity-block/icons.inc.css
@@ -19,7 +19,7 @@
 
 @selectorPrefix@#identity-box.grantedPermissions:hover > #identity-icon:not(.no-hover)@selectorSuffix@,
 @selectorPrefix@#identity-box.grantedPermissions[open=true] > #identity-icon@selectorSuffix@ {
-  list-style-image: url(url(chrome://browser/skin/identity-icon.svg#notice-hover@iconVariant@));
+  list-style-image: url(chrome://browser/skin/identity-icon.svg#notice-hover@iconVariant@);
 }
 
 @selectorPrefix@#urlbar[pageproxystate="valid"] > #identity-box.chromeUI > #identity-icon@selectorSuffix@ {

From 8d7cb8d79e8820cedcd86fa2eeed2614f7989f54 Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 27 Sep 2016 13:49:30 +0200
Subject: [PATCH 029/102] Backed out changeset 4465b8d521ee (bug 1286911) for
 asserting  !strBufLen (strBufLen not reset after previous use!), at
 nsHtml5Tokenizer.h:173. r=backout on a CLOSED TREE

---
 parser/html/javasrc/HtmlAttributes.java       |   2 +-
 parser/html/javasrc/Tokenizer.java            | 183 ++++++------------
 parser/html/nsHtml5Tokenizer.cpp              | 140 ++++++--------
 parser/html/nsHtml5Tokenizer.h                |  41 ++--
 parser/html/nsHtml5TreeBuilderCppSupplement.h |   4 +-
 5 files changed, 131 insertions(+), 239 deletions(-)

diff --git a/parser/html/javasrc/HtmlAttributes.java b/parser/html/javasrc/HtmlAttributes.java
index 0ec25f96f0ae..029703c19fa7 100644
--- a/parser/html/javasrc/HtmlAttributes.java
+++ b/parser/html/javasrc/HtmlAttributes.java
@@ -62,7 +62,7 @@ public final class HtmlAttributes implements Attributes {
     private @Auto AttributeName[] names;
 
     private @Auto String[] values; // XXX perhaps make this @NoLength?
-    
+
     // CPPONLY: private @Auto int[] lines; // XXX perhaps make this @NoLength?
 
     // [NOCPP[
diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index 7e529035d846..14ad0c0722ab 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -817,34 +817,30 @@ public class Tokenizer implements Locator {
     }
 
     @Inline private void appendCharRefBuf(char c) {
-        // CPPONLY: assert charRefBufLen < charRefBuf.length:
-        // CPPONLY:     "RELEASE: Attempted to overrun charRefBuf!";
         charRefBuf[charRefBufLen++] = c;
     }
 
+    @Inline private void clearCharRefBufAndAppend(char c) {
+        charRefBuf[0] = c;
+        charRefBufLen = 1;
+    }
+
     private void emitOrAppendCharRefBuf(int returnState) throws SAXException {
         if ((returnState & DATA_AND_RCDATA_MASK) != 0) {
             appendCharRefBufToStrBuf();
         } else {
             if (charRefBufLen > 0) {
                 tokenHandler.characters(charRefBuf, 0, charRefBufLen);
-                charRefBufLen = 0;
             }
         }
     }
 
-    @Inline private void clearStrBufAfterUse() {
-        strBufLen = 0;
+    @Inline private void clearStrBufAndAppend(char c) {
+        strBuf[0] = c;
+        strBufLen = 1;
     }
 
-    @Inline private void clearStrBufBeforeUse() {
-        assert strBufLen == 0: "strBufLen not reset after previous use!";
-        strBufLen = 0; // no-op in the absence of bugs
-    }
-
-    @Inline private void clearStrBufAfterOneHyphen() {
-        assert strBufLen == 1: "strBufLen length not one!";
-        assert strBuf[0] == '-': "strBuf does not start with a hyphen!";
+    @Inline private void clearStrBuf() {
         strBufLen = 0;
     }
 
@@ -854,13 +850,7 @@ public class Tokenizer implements Locator {
      * @param c
      *            the UTF-16 code unit to append
      */
-    @Inline private void appendStrBuf(char c) {
-        // CPPONLY: assert strBufLen < strBuf.length: "Previous buffer length insufficient.";
-        // CPPONLY: if (strBufLen == strBuf.length) {
-        // CPPONLY:     if (!EnsureBufferSpace(1)) {
-        // CPPONLY:         assert false: "RELEASE: Unable to recover from buffer reallocation failure";
-        // CPPONLY:     } // TODO: Add telemetry when outer if fires but inner does not
-        // CPPONLY: }
+    private void appendStrBuf(char c) {
         strBuf[strBufLen++] = c;
     }
 
@@ -873,11 +863,9 @@ public class Tokenizer implements Locator {
      * @return the buffer as a string
      */
     protected String strBufToString() {
-        String str = Portability.newStringFromBuffer(strBuf, 0, strBufLen
+        return Portability.newStringFromBuffer(strBuf, 0, strBufLen
             // CPPONLY: , tokenHandler
         );
-        clearStrBufAfterUse();
-        return str;
     }
 
     /**
@@ -889,7 +877,6 @@ public class Tokenizer implements Locator {
     private void strBufToDoctypeName() {
         doctypeName = Portability.newLocalNameFromBuffer(strBuf, 0, strBufLen,
                 interner);
-        clearStrBufAfterUse();
     }
 
     /**
@@ -901,7 +888,6 @@ public class Tokenizer implements Locator {
     private void emitStrBuf() throws SAXException {
         if (strBufLen > 0) {
             tokenHandler.characters(strBuf, 0, strBufLen);
-            clearStrBufAfterUse();
         }
     }
 
@@ -948,8 +934,6 @@ public class Tokenizer implements Locator {
         switch (commentPolicy) {
             case ALTER_INFOSET:
                 strBufLen--;
-                // WARNING!!! This expands the worst case of the buffer length
-                // given the length of input!
                 appendStrBuf(' ');
                 appendStrBuf('-');
                 // FALLTHROUGH
@@ -967,15 +951,14 @@ public class Tokenizer implements Locator {
     }
 
     private void appendStrBuf(@NoLength char[] buffer, int offset, int length) {
-        int newLen = strBufLen + length;
-        // CPPONLY: assert newLen <= strBuf.length: "Previous buffer length insufficient.";
-        // CPPONLY: if (strBuf.length < newLen) {
-        // CPPONLY:     if (!EnsureBufferSpace(length)) {
-        // CPPONLY:         assert false: "RELEASE: Unable to recover from buffer reallocation failure";
-        // CPPONLY:     } // TODO: Add telemetry when outer if fires but inner does not
-        // CPPONLY: }
+        int reqLen = strBufLen + length;
+        if (strBuf.length < reqLen) {
+            char[] newBuf = new char[reqLen + (reqLen >> 1)];
+            System.arraycopy(strBuf, 0, newBuf, 0, strBuf.length);
+            strBuf = newBuf;
+        }
         System.arraycopy(buffer, offset, strBuf, strBufLen, length);
-        strBufLen = newLen;
+        strBufLen = reqLen;
     }
 
     /**
@@ -983,7 +966,6 @@ public class Tokenizer implements Locator {
      */
     @Inline private void appendCharRefBufToStrBuf() {
         appendStrBuf(charRefBuf, 0, charRefBufLen);
-        charRefBufLen = 0;
     }
 
     /**
@@ -1004,7 +986,6 @@ public class Tokenizer implements Locator {
             // [NOCPP[
         }
         // ]NOCPP]
-        clearStrBufAfterUse();
         cstart = pos + 1;
     }
 
@@ -1092,7 +1073,6 @@ public class Tokenizer implements Locator {
     private void strBufToElementNameString() {
         tagName = ElementName.elementNameByBuffer(strBuf, 0, strBufLen,
                 interner);
-        clearStrBufAfterUse();
     }
 
     private int emitCurrentTagToken(boolean selfClosing, int pos)
@@ -1144,7 +1124,6 @@ public class Tokenizer implements Locator {
                 , namePolicy != XmlViolationPolicy.ALLOW
                 // ]NOCPP]
                 , interner);
-        clearStrBufAfterUse();
 
         if (attributes == null) {
             attributes = new HtmlAttributes(mappingLangToXmlLang);
@@ -1211,8 +1190,6 @@ public class Tokenizer implements Locator {
             // ]NOCPP]
             attributeName = null; // attributeName has been adopted by the
             // |attributes| object
-        } else {
-            clearStrBufAfterUse();
         }
     }
 
@@ -1361,14 +1338,6 @@ public class Tokenizer implements Locator {
         // unifying the tokenizer and tree builder buffers in the future.
         int worstCase = strBufLen + inputLength + charRefBufLen + 2;
         tokenHandler.ensureBufferSpace(worstCase);
-        if (commentPolicy == XmlViolationPolicy.ALTER_INFOSET) {
-            // When altering infoset, if the comment contents are consecutive
-            // hyphens, each hyphen generates a space, too. These buffer
-            // contents never get emitted as characters() to the tokenHandler,
-            // which is why this calculation happens after the call to 
-            // ensureBufferSpace on tokenHandler.
-            worstCase *= 2;
-        }
         if (strBuf == null) {
             // Add an arbitrary small value to avoid immediate reallocation
             // once there are a few characters in the buffer.
@@ -1477,8 +1446,7 @@ public class Tokenizer implements Locator {
                                  * reference in data state.
                                  */
                                 flushChars(buf, pos);
-                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
-                                appendCharRefBuf(c);
+                                clearCharRefBufAndAppend(c);
                                 setAdditionalAndRememberAmpersandLocation('\u0000');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1538,8 +1506,7 @@ public class Tokenizer implements Locator {
                              * input character (add 0x0020 to the character's
                              * code point),
                              */
-                            clearStrBufBeforeUse();
-                            appendStrBuf((char) (c + 0x20));
+                            clearStrBufAndAppend((char) (c + 0x20));
                             /* then switch to the tag name state. */
                             state = transition(state, Tokenizer.TAG_NAME, reconsume, pos);
                             /*
@@ -1558,8 +1525,7 @@ public class Tokenizer implements Locator {
                             /*
                              * set its tag name to the input character,
                              */
-                            clearStrBufBeforeUse();
-                            appendStrBuf(c);
+                            clearStrBufAndAppend(c);
                             /* then switch to the tag name state. */
                             state = transition(state, Tokenizer.TAG_NAME, reconsume, pos);
                             /*
@@ -1599,8 +1565,7 @@ public class Tokenizer implements Locator {
                                 /*
                                  * Switch to the bogus comment state.
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
                             case '>':
@@ -1803,8 +1768,7 @@ public class Tokenizer implements Locator {
                                  * Set that attribute's name to the current
                                  * input character,
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 /*
                                  * and its value to the empty string.
                                  */
@@ -1950,7 +1914,7 @@ public class Tokenizer implements Locator {
                                  * attribute value (double-quoted) state.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_DOUBLE_QUOTED, reconsume, pos);
                                 break beforeattributevalueloop;
                             // continue stateloop;
@@ -1961,7 +1925,7 @@ public class Tokenizer implements Locator {
                                  * input character.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 reconsume = true;
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
                                 noteUnquotedAttributeValue();
@@ -1972,7 +1936,7 @@ public class Tokenizer implements Locator {
                                  * value (single-quoted) state.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 state = transition(state, Tokenizer.ATTRIBUTE_VALUE_SINGLE_QUOTED, reconsume, pos);
                                 continue stateloop;
                             case '>':
@@ -2016,8 +1980,7 @@ public class Tokenizer implements Locator {
                                  * character to the current attribute's value.
                                  */
                                 // CPPONLY: attributeLine = line;
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 /*
                                  * Switch to the attribute value (unquoted)
                                  * state.
@@ -2060,8 +2023,7 @@ public class Tokenizer implements Locator {
                                  * additional allowed character being U+0022
                                  * QUOTATION MARK (").
                                  */
-                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
-                                appendCharRefBuf(c);
+                                clearCharRefBufAndAppend(c);
                                 setAdditionalAndRememberAmpersandLocation('\"');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -2230,8 +2192,7 @@ public class Tokenizer implements Locator {
                                  * additional allowed character being U+003E
                                  * GREATER-THAN SIGN (>)
                                  */
-                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
-                                appendCharRefBuf(c);
+                                clearCharRefBufAndAppend(c);
                                 setAdditionalAndRememberAmpersandLocation('>');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -2370,8 +2331,7 @@ public class Tokenizer implements Locator {
                                  * Set that attribute's name to the current
                                  * input character,
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 /*
                                  * and its value to the empty string.
                                  */
@@ -2417,22 +2377,19 @@ public class Tokenizer implements Locator {
                          */
                         switch (c) {
                             case '-':
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 state = transition(state, Tokenizer.MARKUP_DECLARATION_HYPHEN, reconsume, pos);
                                 break markupdeclarationopenloop;
                             // continue stateloop;
                             case 'd':
                             case 'D':
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 index = 0;
                                 state = transition(state, Tokenizer.MARKUP_DECLARATION_OCTYPE, reconsume, pos);
                                 continue stateloop;
                             case '[':
                                 if (tokenHandler.cdataSectionAllowed()) {
-                                    clearStrBufBeforeUse();
-                                    appendStrBuf(c);
+                                    clearStrBufAndAppend(c);
                                     index = 0;
                                     state = transition(state, Tokenizer.CDATA_START, reconsume, pos);
                                     continue stateloop;
@@ -2440,7 +2397,7 @@ public class Tokenizer implements Locator {
                                 // else fall through
                             default:
                                 errBogusComment();
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 reconsume = true;
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
@@ -2457,7 +2414,7 @@ public class Tokenizer implements Locator {
                             case '\u0000':
                                 break stateloop;
                             case '-':
-                                clearStrBufAfterOneHyphen();
+                                clearStrBuf();
                                 state = transition(state, Tokenizer.COMMENT_START, reconsume, pos);
                                 break markupdeclarationhyphenloop;
                             // continue stateloop;
@@ -2811,7 +2768,6 @@ public class Tokenizer implements Locator {
                             index++;
                             continue;
                         } else {
-                            clearStrBufAfterUse();
                             cstart = pos; // start coalescing
                             reconsume = true;
                             state = transition(state, Tokenizer.CDATA_SECTION, reconsume, pos);
@@ -2925,8 +2881,7 @@ public class Tokenizer implements Locator {
                                  * + additional allowed character being U+0027
                                  * APOSTROPHE (').
                                  */
-                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
-                                appendCharRefBuf(c);
+                                clearCharRefBufAndAppend(c);
                                 setAdditionalAndRememberAmpersandLocation('\'');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -3274,8 +3229,6 @@ public class Tokenizer implements Locator {
                                         charRefBufLen - charRefBufMark);
                             }
                         }
-                        // charRefBufLen will be zeroed below!
-
                         // Check if we broke out early with c being the last
                         // character that matched as opposed to being the
                         // first one that didn't match. In the case of an 
@@ -3283,7 +3236,6 @@ public class Tokenizer implements Locator {
                         // *after* the current character and the current 
                         // character shouldn't be reconsumed.
                         boolean earlyBreak = (c == ';' && charRefBufMark == charRefBufLen);
-                        charRefBufLen = 0;
                         if ((returnState & DATA_AND_RCDATA_MASK) == 0) {
                             cstart = earlyBreak ? pos + 1 : pos;
                         }
@@ -3422,8 +3374,6 @@ public class Tokenizer implements Locator {
                     // WARNING FALLTHRU CASE TRANSITION: DON'T REORDER
                 case HANDLE_NCR_VALUE:
                     // WARNING previous state sets reconsume
-                    // We are not going to emit the contents of charRefBuf.
-                    charRefBufLen = 0;
                     // XXX inline this case if the method size can take it
                     handleNcrValue(returnState);
                     state = transition(state, returnState, reconsume, pos);
@@ -3570,8 +3520,7 @@ public class Tokenizer implements Locator {
                             /*
                              * Switch to the bogus comment state.
                              */
-                            clearStrBufBeforeUse();
-                            appendStrBuf('\n');
+                            clearStrBufAndAppend('\n');
                             state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                             break stateloop;
                         case '\n':
@@ -3581,8 +3530,7 @@ public class Tokenizer implements Locator {
                             /*
                              * Switch to the bogus comment state.
                              */
-                            clearStrBufBeforeUse();
-                            appendStrBuf(c);
+                            clearStrBufAndAppend('\n');
                             state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                             continue stateloop;
                         case '\u0000':
@@ -3602,8 +3550,7 @@ public class Tokenizer implements Locator {
                                 /*
                                  * set its tag name to the input character,
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 /*
                                  * then switch to the tag name state. (Don't
                                  * emit the token yet; further details will be
@@ -3617,8 +3564,7 @@ public class Tokenizer implements Locator {
                                 /*
                                  * Switch to the bogus comment state.
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 state = transition(state, Tokenizer.BOGUS_COMMENT, reconsume, pos);
                                 continue stateloop;
                             }
@@ -3641,8 +3587,7 @@ public class Tokenizer implements Locator {
                                  * reference in RCDATA state.
                                  */
                                 flushChars(buf, pos);
-                                assert charRefBufLen == 0: "charRefBufLen not reset after previous use!";
-                                appendCharRefBuf(c);
+                                clearCharRefBufAndAppend(c);
                                 setAdditionalAndRememberAmpersandLocation('\u0000');
                                 returnState = state;
                                 state = transition(state, Tokenizer.CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -3727,7 +3672,7 @@ public class Tokenizer implements Locator {
                                  * data end tag open state.
                                  */
                                 index = 0;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 break rawtextrcdatalessthansignloop;
                             // FALL THRU continue stateloop;
@@ -3756,7 +3701,7 @@ public class Tokenizer implements Locator {
                         c = checkChar(buf, pos);
                         /*
                          * ASSERT! when entering this state, set index to 0 and
-                         * call clearStrBufBeforeUse() assert (contentModelElement !=
+                         * call clearStrBuf() assert (contentModelElement !=
                          * null); Let's implement the above without lookahead.
                          * strBuf is the 'temporary buffer'.
                          */
@@ -3789,7 +3734,6 @@ public class Tokenizer implements Locator {
                             switch (c) {
                                 case '\r':
                                     silentCarriageReturn();
-                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                                     break stateloop;
                                 case '\n':
@@ -3805,7 +3749,6 @@ public class Tokenizer implements Locator {
                                      * appropriate end tag token, then switch to
                                      * the before attribute name state.
                                      */
-                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                                     continue stateloop;
                                 case '/':
@@ -3815,7 +3758,6 @@ public class Tokenizer implements Locator {
                                      * then switch to the self-closing start tag
                                      * state.
                                      */
-                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, Tokenizer.SELF_CLOSING_START_TAG, reconsume, pos);
                                     continue stateloop;
                                 case '>':
@@ -3825,7 +3767,6 @@ public class Tokenizer implements Locator {
                                      * end tag token, then emit the current tag
                                      * token and switch to the data state.
                                      */
-                                    clearStrBufAfterUse(); // strBuf not used
                                     state = transition(state, emitCurrentTagToken(false, pos), reconsume, pos);
                                     if (shouldSuspend) {
                                         break stateloop;
@@ -4000,7 +3941,7 @@ public class Tokenizer implements Locator {
                                  * data end tag open state.
                                  */
                                 index = 0;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 continue stateloop;
                             case '!':
@@ -4258,7 +4199,7 @@ public class Tokenizer implements Locator {
                                  * data escaped end tag open state.
                                  */
                                 index = 0;
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 returnState = Tokenizer.SCRIPT_DATA_ESCAPED;
                                 state = transition(state, Tokenizer.NON_DATA_END_TAG_NAME, reconsume, pos);
                                 continue stateloop;
@@ -4740,8 +4681,7 @@ public class Tokenizer implements Locator {
                                  * Set the token's name name to the current
                                  * input character.
                                  */
-                                clearStrBufBeforeUse();
-                                appendStrBuf(c);
+                                clearStrBufAndAppend(c);
                                 /*
                                  * Switch to the DOCTYPE name state.
                                  */
@@ -4962,7 +4902,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -4978,7 +4918,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -5049,7 +4989,7 @@ public class Tokenizer implements Locator {
                                  * token's public identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -5063,7 +5003,7 @@ public class Tokenizer implements Locator {
                                  * public identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -5214,7 +5154,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5230,7 +5170,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5295,7 +5235,7 @@ public class Tokenizer implements Locator {
                                  * token's system identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5309,7 +5249,7 @@ public class Tokenizer implements Locator {
                                  * system identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5558,7 +5498,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's system identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (double-quoted) state.
@@ -5574,7 +5514,7 @@ public class Tokenizer implements Locator {
                                  * Set the DOCTYPE token's public identifier to
                                  * the empty string (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE public identifier
                                  * (single-quoted) state.
@@ -5645,7 +5585,7 @@ public class Tokenizer implements Locator {
                                  * token's system identifier to the empty string
                                  * (not missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (double-quoted) state.
@@ -5658,7 +5598,7 @@ public class Tokenizer implements Locator {
                                  * system identifier to the empty string (not
                                  * missing),
                                  */
-                                clearStrBufBeforeUse();
+                                clearStrBuf();
                                 /*
                                  * then switch to the DOCTYPE system identifier
                                  * (single-quoted) state.
@@ -5874,9 +5814,6 @@ public class Tokenizer implements Locator {
     // ]NOCPP]
     
     private void initDoctypeFields() {
-        // Discard the characters "DOCTYPE" accumulated as a potential bogus
-        // comment into strBuf.
-        clearStrBufAfterUse();
         doctypeName = "";
         if (systemIdentifier != null) {
             Portability.releaseString(systemIdentifier);
@@ -6164,6 +6101,7 @@ public class Tokenizer implements Locator {
                     break eofloop;
                 case MARKUP_DECLARATION_OPEN:
                     errBogusComment();
+                    clearStrBuf();
                     emitComment(0, 0);
                     break eofloop;
                 case MARKUP_DECLARATION_HYPHEN:
@@ -6519,7 +6457,6 @@ public class Tokenizer implements Locator {
                                         charRefBufLen - charRefBufMark);
                             }
                         }
-                        charRefBufLen = 0;
                         state = returnState;
                         continue eofloop;
                         /*
@@ -6699,7 +6636,7 @@ public class Tokenizer implements Locator {
     }
 
     public void resetToDataState() {
-        clearStrBufAfterUse();
+        strBufLen = 0;
         charRefBufLen = 0;
         stateSave = Tokenizer.DATA;
         // line = 1; XXX line numbers
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 550d2da8ffac..24b3604d40b8 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -217,24 +217,26 @@ nsHtml5Tokenizer::emitOrAppendCharRefBuf(int32_t returnState)
   } else {
     if (charRefBufLen > 0) {
       tokenHandler->characters(charRefBuf, 0, charRefBufLen);
-      charRefBufLen = 0;
     }
   }
 }
 
+void 
+nsHtml5Tokenizer::appendStrBuf(char16_t c)
+{
+  strBuf[strBufLen++] = c;
+}
+
 nsString* 
 nsHtml5Tokenizer::strBufToString()
 {
-  nsString* str = nsHtml5Portability::newStringFromBuffer(strBuf, 0, strBufLen, tokenHandler);
-  clearStrBufAfterUse();
-  return str;
+  return nsHtml5Portability::newStringFromBuffer(strBuf, 0, strBufLen, tokenHandler);
 }
 
 void 
 nsHtml5Tokenizer::strBufToDoctypeName()
 {
   doctypeName = nsHtml5Portability::newLocalNameFromBuffer(strBuf, 0, strBufLen, interner);
-  clearStrBufAfterUse();
 }
 
 void 
@@ -242,29 +244,26 @@ nsHtml5Tokenizer::emitStrBuf()
 {
   if (strBufLen > 0) {
     tokenHandler->characters(strBuf, 0, strBufLen);
-    clearStrBufAfterUse();
   }
 }
 
 void 
 nsHtml5Tokenizer::appendStrBuf(char16_t* buffer, int32_t offset, int32_t length)
 {
-  int32_t newLen = strBufLen + length;
-  MOZ_ASSERT(newLen <= strBuf.length, "Previous buffer length insufficient.");
-  if (MOZ_UNLIKELY(strBuf.length < newLen)) {
-    if (MOZ_UNLIKELY(!EnsureBufferSpace(length))) {
-      MOZ_CRASH("Unable to recover from buffer reallocation failure");
-    }
+  int32_t reqLen = strBufLen + length;
+  if (strBuf.length < reqLen) {
+    jArray<char16_t,int32_t> newBuf = jArray<char16_t,int32_t>::newJArray(reqLen + (reqLen >> 1));
+    nsHtml5ArrayCopy::arraycopy(strBuf, newBuf, strBuf.length);
+    strBuf = newBuf;
   }
   nsHtml5ArrayCopy::arraycopy(buffer, offset, strBuf, strBufLen, length);
-  strBufLen = newLen;
+  strBufLen = reqLen;
 }
 
 void 
 nsHtml5Tokenizer::emitComment(int32_t provisionalHyphens, int32_t pos)
 {
   tokenHandler->comment(strBuf, 0, strBufLen - provisionalHyphens);
-  clearStrBufAfterUse();
   cstart = pos + 1;
 }
 
@@ -281,7 +280,6 @@ void
 nsHtml5Tokenizer::strBufToElementNameString()
 {
   tagName = nsHtml5ElementName::elementNameByBuffer(strBuf, 0, strBufLen, interner);
-  clearStrBufAfterUse();
 }
 
 int32_t 
@@ -323,7 +321,6 @@ void
 nsHtml5Tokenizer::attributeNameComplete()
 {
   attributeName = nsHtml5AttributeName::nameByBuffer(strBuf, 0, strBufLen, interner);
-  clearStrBufAfterUse();
   if (!attributes) {
     attributes = new nsHtml5HtmlAttributes(0);
   }
@@ -341,8 +338,6 @@ nsHtml5Tokenizer::addAttributeWithoutValue()
   if (attributeName) {
     attributes->addAttribute(attributeName, nsHtml5Portability::newEmptyString(), attributeLine);
     attributeName = nullptr;
-  } else {
-    clearStrBufAfterUse();
   }
 }
 
@@ -437,8 +432,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '&': {
               flushChars(buf, pos);
-              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
-              appendCharRefBuf(c);
+              clearCharRefBufAndAppend(c);
               setAdditionalAndRememberAmpersandLocation('\0');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -475,14 +469,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           c = checkChar(buf, pos);
           if (c >= 'A' && c <= 'Z') {
             endTag = false;
-            clearStrBufBeforeUse();
-            appendStrBuf((char16_t) (c + 0x20));
+            clearStrBufAndAppend((char16_t) (c + 0x20));
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
             NS_HTML5_BREAK(tagopenloop);
           } else if (c >= 'a' && c <= 'z') {
             endTag = false;
-            clearStrBufBeforeUse();
-            appendStrBuf(c);
+            clearStrBufAndAppend(c);
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
             NS_HTML5_BREAK(tagopenloop);
           }
@@ -503,8 +495,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errProcessingInstruction();
               }
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -631,8 +622,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
                 c += 0x20;
               }
               attributeLine = line;
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_NAME, reconsume, pos);
               NS_HTML5_BREAK(beforeattributenameloop);
             }
@@ -725,13 +715,13 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             case '\"': {
               attributeLine = line;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforeattributevalueloop);
             }
             case '&': {
               attributeLine = line;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               reconsume = true;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
 
@@ -739,7 +729,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             case '\'': {
               attributeLine = line;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -766,8 +756,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             default: {
               attributeLine = line;
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_UNQUOTED, reconsume, pos);
 
               NS_HTML5_CONTINUE(stateloop);
@@ -793,8 +782,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_BREAK(attributevaluedoublequotedloop);
             }
             case '&': {
-              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
-              appendCharRefBuf(c);
+              clearCharRefBufAndAppend(c);
               setAdditionalAndRememberAmpersandLocation('\"');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -914,8 +902,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '&': {
-              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
-              appendCharRefBuf(c);
+              clearCharRefBufAndAppend(c);
               setAdditionalAndRememberAmpersandLocation('>');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1000,8 +987,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (c >= 'A' && c <= 'Z') {
                 c += 0x20;
               }
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_ATTRIBUTE_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -1016,23 +1002,20 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           c = checkChar(buf, pos);
           switch(c) {
             case '-': {
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_MARKUP_DECLARATION_HYPHEN, reconsume, pos);
               NS_HTML5_BREAK(markupdeclarationopenloop);
             }
             case 'd':
             case 'D': {
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               index = 0;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_MARKUP_DECLARATION_OCTYPE, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
             case '[': {
               if (tokenHandler->cdataSectionAllowed()) {
-                clearStrBufBeforeUse();
-                appendStrBuf(c);
+                clearStrBufAndAppend(c);
                 index = 0;
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_START, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
@@ -1042,7 +1025,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errBogusComment();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               reconsume = true;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
@@ -1062,7 +1045,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_BREAK(stateloop);
             }
             case '-': {
-              clearStrBufAfterOneHyphen();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_COMMENT_START, reconsume, pos);
               NS_HTML5_BREAK(markupdeclarationhyphenloop);
             }
@@ -1326,7 +1309,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             index++;
             continue;
           } else {
-            clearStrBufAfterUse();
             cstart = pos;
             reconsume = true;
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_SECTION, reconsume, pos);
@@ -1434,8 +1416,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '&': {
-              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
-              appendCharRefBuf(c);
+              clearCharRefBufAndAppend(c);
               setAdditionalAndRememberAmpersandLocation('\'');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -1667,7 +1648,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
           }
           bool earlyBreak = (c == ';' && charRefBufMark == charRefBufLen);
-          charRefBufLen = 0;
           if (!(returnState & NS_HTML5TOKENIZER_DATA_AND_RCDATA_MASK)) {
             cstart = earlyBreak ? pos + 1 : pos;
           }
@@ -1761,7 +1741,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
         decimalloop_end: ;
       }
       case NS_HTML5TOKENIZER_HANDLE_NCR_VALUE: {
-        charRefBufLen = 0;
         handleNcrValue(returnState);
         state = P::transition(mViewSource, returnState, reconsume, pos);
         NS_HTML5_CONTINUE(stateloop);
@@ -1887,8 +1866,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             if (P::reportErrors) {
               errGarbageAfterLtSlash();
             }
-            clearStrBufBeforeUse();
-            appendStrBuf('\n');
+            clearStrBufAndAppend('\n');
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
             NS_HTML5_BREAK(stateloop);
           }
@@ -1897,8 +1875,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             if (P::reportErrors) {
               errGarbageAfterLtSlash();
             }
-            clearStrBufBeforeUse();
-            appendStrBuf(c);
+            clearStrBufAndAppend('\n');
             state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
             NS_HTML5_CONTINUE(stateloop);
           }
@@ -1911,16 +1888,14 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             }
             if (c >= 'a' && c <= 'z') {
               endTag = true;
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             } else {
               if (P::reportErrors) {
                 errGarbageAfterLtSlash();
               }
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -1940,8 +1915,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '&': {
               flushChars(buf, pos);
-              MOZ_ASSERT(!charRefBufLen, "charRefBufLen not reset after previous use!");
-              appendCharRefBuf(c);
+              clearCharRefBufAndAppend(c);
               setAdditionalAndRememberAmpersandLocation('\0');
               returnState = state;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_CONSUME_CHARACTER_REFERENCE, reconsume, pos);
@@ -2015,7 +1989,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_BREAK(rawtextrcdatalessthansignloop);
             }
@@ -2059,7 +2033,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
             switch(c) {
               case '\r': {
                 silentCarriageReturn();
-                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                 NS_HTML5_BREAK(stateloop);
               }
@@ -2069,17 +2042,14 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               case ' ':
               case '\t':
               case '\f': {
-                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_BEFORE_ATTRIBUTE_NAME, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
               }
               case '/': {
-                clearStrBufAfterUse();
                 state = P::transition(mViewSource, NS_HTML5TOKENIZER_SELF_CLOSING_START_TAG, reconsume, pos);
                 NS_HTML5_CONTINUE(stateloop);
               }
               case '>': {
-                clearStrBufAfterUse();
                 state = P::transition(mViewSource, emitCurrentTagToken(false, pos), reconsume, pos);
                 if (shouldSuspend) {
                   NS_HTML5_BREAK(stateloop);
@@ -2223,7 +2193,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2408,7 +2378,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
           switch(c) {
             case '/': {
               index = 0;
-              clearStrBufBeforeUse();
+              clearStrBuf();
               returnState = NS_HTML5TOKENIZER_SCRIPT_DATA_ESCAPED;
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_NON_DATA_END_TAG_NAME, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
@@ -2764,8 +2734,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (c >= 'A' && c <= 'Z') {
                 c += 0x20;
               }
-              clearStrBufBeforeUse();
-              appendStrBuf(c);
+              clearStrBufAndAppend(c);
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_NAME, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypenameloop);
             }
@@ -2917,7 +2886,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypePublicKeywordAndQuote();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2925,7 +2894,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypePublicKeywordAndQuote();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -2967,12 +2936,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               continue;
             }
             case '\"': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypepublicidentifierloop);
             }
             case '\'': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_PUBLIC_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3065,7 +3034,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenPublicAndSystemIds();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3073,7 +3042,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenPublicAndSystemIds();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3111,12 +3080,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               NS_HTML5_CONTINUE(stateloop);
             }
             case '\"': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(betweendoctypepublicandsystemidentifiersloop);
             }
             case '\'': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3288,7 +3257,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypeSystemKeywordAndQuote();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3296,7 +3265,7 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               if (P::reportErrors) {
                 errNoSpaceBetweenDoctypeSystemKeywordAndQuote();
               }
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
@@ -3338,12 +3307,12 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
               continue;
             }
             case '\"': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_DOUBLE_QUOTED, reconsume, pos);
               NS_HTML5_CONTINUE(stateloop);
             }
             case '\'': {
-              clearStrBufBeforeUse();
+              clearStrBuf();
               state = P::transition(mViewSource, NS_HTML5TOKENIZER_DOCTYPE_SYSTEM_IDENTIFIER_SINGLE_QUOTED, reconsume, pos);
               NS_HTML5_BREAK(beforedoctypesystemidentifierloop);
             }
@@ -3491,7 +3460,6 @@ nsHtml5Tokenizer::stateLoop(int32_t state, char16_t c, int32_t pos, char16_t* bu
 void 
 nsHtml5Tokenizer::initDoctypeFields()
 {
-  clearStrBufAfterUse();
   doctypeName = nsHtml5Atoms::emptystring;
   if (systemIdentifier) {
     nsHtml5Portability::releaseString(systemIdentifier);
@@ -3644,6 +3612,7 @@ nsHtml5Tokenizer::eof()
       }
       case NS_HTML5TOKENIZER_MARKUP_DECLARATION_OPEN: {
         errBogusComment();
+        clearStrBuf();
         emitComment(0, 0);
         NS_HTML5_BREAK(eofloop);
       }
@@ -3849,7 +3818,6 @@ nsHtml5Tokenizer::eof()
               tokenHandler->characters(charRefBuf, charRefBufMark, charRefBufLen - charRefBufMark);
             }
           }
-          charRefBufLen = 0;
           state = returnState;
           NS_HTML5_CONTINUE(eofloop);
         }
@@ -3972,7 +3940,7 @@ nsHtml5Tokenizer::isInDataState()
 void 
 nsHtml5Tokenizer::resetToDataState()
 {
-  clearStrBufAfterUse();
+  strBufLen = 0;
   charRefBufLen = 0;
   stateSave = NS_HTML5TOKENIZER_DATA;
   lastCR = false;
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index 9848a502b3a8..6a6a8ed39b78 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -158,40 +158,28 @@ class nsHtml5Tokenizer
   private:
     inline void appendCharRefBuf(char16_t c)
     {
-      MOZ_RELEASE_ASSERT(charRefBufLen < charRefBuf.length, "Attempted to overrun charRefBuf!");
       charRefBuf[charRefBufLen++] = c;
     }
 
+    inline void clearCharRefBufAndAppend(char16_t c)
+    {
+      charRefBuf[0] = c;
+      charRefBufLen = 1;
+    }
+
     void emitOrAppendCharRefBuf(int32_t returnState);
-    inline void clearStrBufAfterUse()
+    inline void clearStrBufAndAppend(char16_t c)
+    {
+      strBuf[0] = c;
+      strBufLen = 1;
+    }
+
+    inline void clearStrBuf()
     {
       strBufLen = 0;
     }
 
-    inline void clearStrBufBeforeUse()
-    {
-      MOZ_ASSERT(!strBufLen, "strBufLen not reset after previous use!");
-      strBufLen = 0;
-    }
-
-    inline void clearStrBufAfterOneHyphen()
-    {
-      MOZ_ASSERT(strBufLen == 1, "strBufLen length not one!");
-      MOZ_ASSERT(strBuf[0] == '-', "strBuf does not start with a hyphen!");
-      strBufLen = 0;
-    }
-
-    inline void appendStrBuf(char16_t c)
-    {
-      MOZ_ASSERT(strBufLen < strBuf.length, "Previous buffer length insufficient.");
-      if (MOZ_UNLIKELY(strBufLen == strBuf.length)) {
-        if (MOZ_UNLIKELY(!EnsureBufferSpace(1))) {
-          MOZ_CRASH("Unable to recover from buffer reallocation failure");
-        }
-      }
-      strBuf[strBufLen++] = c;
-    }
-
+    void appendStrBuf(char16_t c);
   protected:
     nsString* strBufToString();
   private:
@@ -212,7 +200,6 @@ class nsHtml5Tokenizer
     inline void appendCharRefBufToStrBuf()
     {
       appendStrBuf(charRefBuf, 0, charRefBufLen);
-      charRefBufLen = 0;
     }
 
     void emitComment(int32_t provisionalHyphens, int32_t pos);
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index ce040183f57b..4cd030a3e7b4 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -955,8 +955,8 @@ nsHtml5TreeBuilder::elementPopped(int32_t aNamespace, nsIAtom* aName, nsIContent
 void
 nsHtml5TreeBuilder::accumulateCharacters(const char16_t* aBuf, int32_t aStart, int32_t aLength)
 {
-  MOZ_RELEASE_ASSERT(charBufferLen + aLength <= charBuffer.length,
-                     "About to memcpy past the end of the buffer!");
+  MOZ_ASSERT(charBufferLen + aLength <= charBuffer.length,
+             "About to memcpy past the end of the buffer!");
   memcpy(charBuffer + charBufferLen, aBuf + aStart, sizeof(char16_t) * aLength);
   charBufferLen += aLength;
 }

From 905a450ea2ec2cc36eaa7db01a72ce4e353870b9 Mon Sep 17 00:00:00 2001
From: Eugen Sawin <esawin@mozilla.com>
Date: Wed, 10 Aug 2016 20:54:37 +0200
Subject: [PATCH 030/102] Bug 1291424 - [1.4] Extract and cache libs on first
 run. r=glandium,snorp

---
 mobile/android/confvars.sh | 6 ------
 old-configure.in           | 1 +
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/mobile/android/confvars.sh b/mobile/android/confvars.sh
index 665fc86803bd..448f074cd70e 100644
--- a/mobile/android/confvars.sh
+++ b/mobile/android/confvars.sh
@@ -37,12 +37,6 @@ MOZ_APP_ID={aa3c5121-dab2-40e2-81ca-7ea25febc110}
 
 MOZ_APP_STATIC_INI=1
 
-# Enable on-demand decompression.  This requires a host compile toolchain to
-# build szip to use during packaging.
-if test "$COMPILE_ENVIRONMENT"; then
-MOZ_ENABLE_SZIP=1
-fi
-
 # Enable second screen using native Android libraries.
 MOZ_NATIVE_DEVICES=1
 
diff --git a/old-configure.in b/old-configure.in
index 08e2a4c0e966..8ebc5ec6640e 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -1309,6 +1309,7 @@ AC_SUBST_LIST(SSSE3_FLAGS)
 AC_SUBST(MOZ_LINKER)
 if test -n "$MOZ_LINKER"; then
   AC_DEFINE(MOZ_LINKER)
+  MOZ_LINKER_EXTRACT=1
 fi
 
 dnl Only one oddball right now (QNX), but this gives us flexibility

From f6db690c95f08bc54f374b197c459311b3eff995 Mon Sep 17 00:00:00 2001
From: Nicholas Hurley <hurley@todesschaf.org>
Date: Thu, 22 Sep 2016 09:38:26 -0700
Subject: [PATCH 031/102] Bug 1303212 - Don't check for CLOCK_MONOTONIC on
 darwin r=glandium

MozReview-Commit-ID: 9Ppn5jzcjbP
---
 js/src/old-configure.in | 50 ++++++++++++++++++++++++-----------------
 old-configure.in        | 50 ++++++++++++++++++++++++-----------------
 2 files changed, 58 insertions(+), 42 deletions(-)

diff --git a/js/src/old-configure.in b/js/src/old-configure.in
index cbc38b9d002d..8fb4c96f01e8 100644
--- a/js/src/old-configure.in
+++ b/js/src/old-configure.in
@@ -1216,27 +1216,35 @@ AC_FUNC_MEMCMP
 AC_CHECK_FUNCS([getc_unlocked _getc_nolock gmtime_r localtime_r pthread_getname_np])
 
 dnl check for clock_gettime(), the CLOCK_MONOTONIC clock
-AC_CACHE_CHECK(for clock_gettime(CLOCK_MONOTONIC),
-               ac_cv_clock_monotonic,
-               [for libs in "" -lrt; do
-                    _SAVE_LIBS="$LIBS"
-                    LIBS="$LIBS $libs"
-                    AC_TRY_LINK([#include <time.h>],
-                                 [ struct timespec ts;
-                                   clock_gettime(CLOCK_MONOTONIC, &ts); ],
-                                 ac_cv_clock_monotonic=$libs
-                                 LIBS="$_SAVE_LIBS"
-                                 break,
-                                 ac_cv_clock_monotonic=no)
-                    LIBS="$_SAVE_LIBS"
-                done])
-if test "$ac_cv_clock_monotonic" != "no"; then
-    HAVE_CLOCK_MONOTONIC=1
-    REALTIME_LIBS=$ac_cv_clock_monotonic
-    AC_DEFINE(HAVE_CLOCK_MONOTONIC)
-    AC_SUBST(HAVE_CLOCK_MONOTONIC)
-    AC_SUBST_LIST(REALTIME_LIBS)
-fi
+dnl avoid this on Darwin, since depending on your system config, we may think
+dnl it exists but it really doesn't
+case "$OS_TARGET" in
+Darwin)
+  ;;
+*)
+  AC_CACHE_CHECK(for clock_gettime(CLOCK_MONOTONIC),
+                 ac_cv_clock_monotonic,
+                 [for libs in "" -lrt; do
+                      _SAVE_LIBS="$LIBS"
+                      LIBS="$LIBS $libs"
+                      AC_TRY_LINK([#include <time.h>],
+                                   [ struct timespec ts;
+                                     clock_gettime(CLOCK_MONOTONIC, &ts); ],
+                                   ac_cv_clock_monotonic=$libs
+                                   LIBS="$_SAVE_LIBS"
+                                   break,
+                                   ac_cv_clock_monotonic=no)
+                      LIBS="$_SAVE_LIBS"
+                  done])
+  if test "$ac_cv_clock_monotonic" != "no"; then
+      HAVE_CLOCK_MONOTONIC=1
+      REALTIME_LIBS=$ac_cv_clock_monotonic
+      AC_DEFINE(HAVE_CLOCK_MONOTONIC)
+      AC_SUBST(HAVE_CLOCK_MONOTONIC)
+      AC_SUBST_LIST(REALTIME_LIBS)
+  fi
+  ;;
+esac
 
 dnl Checks for math functions.
 dnl ========================================================
diff --git a/old-configure.in b/old-configure.in
index 8ebc5ec6640e..641aa850858f 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -1667,27 +1667,35 @@ AC_FUNC_MEMCMP
 AC_CHECK_FUNCS(stat64 lstat64 truncate64 statvfs64 statvfs statfs64 statfs getpagesize gmtime_r localtime_r arc4random arc4random_buf mallinfo gettid lchown setpriority strerror syscall)
 
 dnl check for clock_gettime(), the CLOCK_MONOTONIC clock
-AC_CACHE_CHECK(for clock_gettime(CLOCK_MONOTONIC),
-               ac_cv_clock_monotonic,
-               [for libs in "" -lrt; do
-                    _SAVE_LIBS="$LIBS"
-                    LIBS="$LIBS $libs"
-                    AC_TRY_LINK([#include <time.h>],
-                                 [ struct timespec ts;
-                                   clock_gettime(CLOCK_MONOTONIC, &ts); ],
-                                 ac_cv_clock_monotonic=$libs
-                                 LIBS="$_SAVE_LIBS"
-                                 break,
-                                 ac_cv_clock_monotonic=no)
-                    LIBS="$_SAVE_LIBS"
-                done])
-if test "$ac_cv_clock_monotonic" != "no"; then
-    HAVE_CLOCK_MONOTONIC=1
-    REALTIME_LIBS=$ac_cv_clock_monotonic
-    AC_DEFINE(HAVE_CLOCK_MONOTONIC)
-    AC_SUBST(HAVE_CLOCK_MONOTONIC)
-    AC_SUBST_LIST(REALTIME_LIBS)
-fi
+dnl avoid this on Darwin, since depending on your system config, we may think
+dnl it exists but it really doesn't
+case "$OS_TARGET" in
+Darwin)
+  ;;
+*)
+  AC_CACHE_CHECK(for clock_gettime(CLOCK_MONOTONIC),
+                 ac_cv_clock_monotonic,
+                 [for libs in "" -lrt; do
+                      _SAVE_LIBS="$LIBS"
+                      LIBS="$LIBS $libs"
+                      AC_TRY_LINK([#include <time.h>],
+                                   [ struct timespec ts;
+                                     clock_gettime(CLOCK_MONOTONIC, &ts); ],
+                                   ac_cv_clock_monotonic=$libs
+                                   LIBS="$_SAVE_LIBS"
+                                   break,
+                                   ac_cv_clock_monotonic=no)
+                      LIBS="$_SAVE_LIBS"
+                  done])
+  if test "$ac_cv_clock_monotonic" != "no"; then
+      HAVE_CLOCK_MONOTONIC=1
+      REALTIME_LIBS=$ac_cv_clock_monotonic
+      AC_DEFINE(HAVE_CLOCK_MONOTONIC)
+      AC_SUBST(HAVE_CLOCK_MONOTONIC)
+      AC_SUBST_LIST(REALTIME_LIBS)
+  fi
+  ;;
+esac
 
 AC_CACHE_CHECK(for pthread_cond_timedwait_monotonic_np,
                ac_cv_pthread_cond_timedwait_monotonic_np,

From 13501a2bea7fd2ab40a9c115c058460012712642 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 27 Sep 2016 14:15:17 +0100
Subject: [PATCH 032/102] Bug 1296661 - Use MOZ_MUST_USE in Reflect.parse
 implementation r=njn

---
 js/src/builtin/ReflectParse.cpp | 229 ++++++++++++++++----------------
 1 file changed, 118 insertions(+), 111 deletions(-)

diff --git a/js/src/builtin/ReflectParse.cpp b/js/src/builtin/ReflectParse.cpp
index 987dbff902e5..5bf8a9624757 100644
--- a/js/src/builtin/ReflectParse.cpp
+++ b/js/src/builtin/ReflectParse.cpp
@@ -254,7 +254,7 @@ class NodeBuilder
           userv(c)
     {}
 
-    bool init(HandleObject userobj = nullptr) {
+    MOZ_MUST_USE bool init(HandleObject userobj = nullptr) {
         if (src) {
             if (!atomValue(src, &srcval))
                 return false;
@@ -305,8 +305,8 @@ class NodeBuilder
     }
 
   private:
-    bool callbackHelper(HandleValue fun, const InvokeArgs& args, size_t i,
-                        TokenPos* pos, MutableHandleValue dst)
+    MOZ_MUST_USE bool callbackHelper(HandleValue fun, const InvokeArgs& args, size_t i,
+                                     TokenPos* pos, MutableHandleValue dst)
     {
         // The end of the implementation of callback(). All arguments except
         // loc have already been stored in range [0, i).
@@ -322,8 +322,8 @@ class NodeBuilder
     // that convert to HandleValue, so this isn't as template-y as it seems,
     // just variadic.
     template <typename... Arguments>
-    bool callbackHelper(HandleValue fun, const InvokeArgs& args, size_t i,
-                        HandleValue head, Arguments&&... tail)
+    MOZ_MUST_USE bool callbackHelper(HandleValue fun, const InvokeArgs& args, size_t i,
+                                     HandleValue head, Arguments&&... tail)
     {
         // Recursive loop to store the arguments into args. This eventually
         // bottoms out in a call to the non-template callbackHelper() above.
@@ -336,7 +336,7 @@ class NodeBuilder
     //     bool callback(HandleValue fun, HandleValue... args, TokenPos* pos,
     //                   MutableHandleValue dst);
     template <typename... Arguments>
-    bool callback(HandleValue fun, Arguments&&... args) {
+    MOZ_MUST_USE bool callback(HandleValue fun, Arguments&&... args) {
         InvokeArgs iargs(cx);
         if (!iargs.init(sizeof...(args) - 2 + size_t(saveLoc)))
             return false;
@@ -353,7 +353,7 @@ class NodeBuilder
         return v.isMagic(JS_SERIALIZE_NO_NODE) ? JS::UndefinedHandleValue : v;
     }
 
-    bool atomValue(const char* s, MutableHandleValue dst) {
+    MOZ_MUST_USE bool atomValue(const char* s, MutableHandleValue dst) {
         /*
          * Bug 575416: instead of Atomize, lookup constant atoms in tbl file
          */
@@ -365,7 +365,7 @@ class NodeBuilder
         return true;
     }
 
-    bool newObject(MutableHandleObject dst) {
+    MOZ_MUST_USE bool newObject(MutableHandleObject dst) {
         RootedPlainObject nobj(cx, NewBuiltinClassInstance<PlainObject>(cx));
         if (!nobj)
             return false;
@@ -374,11 +374,11 @@ class NodeBuilder
         return true;
     }
 
-    bool newArray(NodeVector& elts, MutableHandleValue dst);
+    MOZ_MUST_USE bool newArray(NodeVector& elts, MutableHandleValue dst);
 
-    bool createNode(ASTType type, TokenPos* pos, MutableHandleObject dst);
+    MOZ_MUST_USE bool createNode(ASTType type, TokenPos* pos, MutableHandleObject dst);
 
-    bool newNodeHelper(HandleObject obj, MutableHandleValue dst) {
+    MOZ_MUST_USE bool newNodeHelper(HandleObject obj, MutableHandleValue dst) {
         // The end of the implementation of newNode().
         MOZ_ASSERT(obj);
         dst.setObject(*obj);
@@ -386,8 +386,8 @@ class NodeBuilder
     }
 
     template <typename... Arguments>
-    bool newNodeHelper(HandleObject obj, const char *name, HandleValue value,
-                       Arguments&&... rest)
+    MOZ_MUST_USE bool newNodeHelper(HandleObject obj, const char *name, HandleValue value,
+                                    Arguments&&... rest)
     {
         // Recursive loop to define properties. Note that the newNodeHelper()
         // call below passes two fewer arguments than we received, as we omit
@@ -405,14 +405,14 @@ class NodeBuilder
     //                  {const char *name0, HandleValue value0,}...
     //                  MutableHandleValue dst);
     template <typename... Arguments>
-    bool newNode(ASTType type, TokenPos* pos, Arguments&&... args) {
+    MOZ_MUST_USE bool newNode(ASTType type, TokenPos* pos, Arguments&&... args) {
         RootedObject node(cx);
         return createNode(type, pos, &node) &&
                newNodeHelper(node, Forward<Arguments>(args)...);
     }
 
-    bool listNode(ASTType type, const char* propName, NodeVector& elts, TokenPos* pos,
-                  MutableHandleValue dst) {
+    MOZ_MUST_USE bool listNode(ASTType type, const char* propName, NodeVector& elts, TokenPos* pos,
+                               MutableHandleValue dst) {
         RootedValue array(cx);
         if (!newArray(elts, &array))
             return false;
@@ -424,7 +424,7 @@ class NodeBuilder
         return newNode(type, pos, propName, array, dst);
     }
 
-    bool defineProperty(HandleObject obj, const char* name, HandleValue val) {
+    MOZ_MUST_USE bool defineProperty(HandleObject obj, const char* name, HandleValue val) {
         MOZ_ASSERT_IF(val.isMagic(), val.whyMagic() == JS_SERIALIZE_NO_NODE);
 
         /*
@@ -439,9 +439,9 @@ class NodeBuilder
         return DefineProperty(cx, obj, atom->asPropertyName(), optVal);
     }
 
-    bool newNodeLoc(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool newNodeLoc(TokenPos* pos, MutableHandleValue dst);
 
-    bool setNodeLoc(HandleObject node, TokenPos* pos);
+    MOZ_MUST_USE bool setNodeLoc(HandleObject node, TokenPos* pos);
 
   public:
     /*
@@ -457,175 +457,183 @@ class NodeBuilder
      * misc nodes
      */
 
-    bool program(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool program(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool literal(HandleValue val, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool literal(HandleValue val, TokenPos* pos, MutableHandleValue dst);
 
-    bool identifier(HandleValue name, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool identifier(HandleValue name, TokenPos* pos, MutableHandleValue dst);
 
-    bool function(ASTType type, TokenPos* pos,
-                  HandleValue id, NodeVector& args, NodeVector& defaults,
-                  HandleValue body, HandleValue rest, GeneratorStyle generatorStyle,
-                  bool isExpression, MutableHandleValue dst);
+    MOZ_MUST_USE bool function(ASTType type, TokenPos* pos,
+                               HandleValue id, NodeVector& args, NodeVector& defaults,
+                               HandleValue body, HandleValue rest, GeneratorStyle generatorStyle,
+                               bool isExpression, MutableHandleValue dst);
 
-    bool variableDeclarator(HandleValue id, HandleValue init, TokenPos* pos,
-                            MutableHandleValue dst);
+    MOZ_MUST_USE bool variableDeclarator(HandleValue id, HandleValue init, TokenPos* pos,
+                                         MutableHandleValue dst);
 
-    bool switchCase(HandleValue expr, NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool switchCase(HandleValue expr, NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool catchClause(HandleValue var, HandleValue guard, HandleValue body, TokenPos* pos,
-                     MutableHandleValue dst);
+    MOZ_MUST_USE bool catchClause(HandleValue var, HandleValue guard, HandleValue body, TokenPos* pos,
+                                  MutableHandleValue dst);
 
-    bool prototypeMutation(HandleValue val, TokenPos* pos, MutableHandleValue dst);
-    bool propertyInitializer(HandleValue key, HandleValue val, PropKind kind, bool isShorthand,
-                             bool isMethod, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool prototypeMutation(HandleValue val, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool propertyInitializer(HandleValue key, HandleValue val, PropKind kind,
+                                          bool isShorthand, bool isMethod, TokenPos* pos,
+                                          MutableHandleValue dst);
 
 
     /*
      * statements
      */
 
-    bool blockStatement(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool blockStatement(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool expressionStatement(HandleValue expr, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool expressionStatement(HandleValue expr, TokenPos* pos, MutableHandleValue dst);
 
-    bool emptyStatement(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool emptyStatement(TokenPos* pos, MutableHandleValue dst);
 
-    bool ifStatement(HandleValue test, HandleValue cons, HandleValue alt, TokenPos* pos,
+    MOZ_MUST_USE bool ifStatement(HandleValue test, HandleValue cons, HandleValue alt, TokenPos* pos,
                      MutableHandleValue dst);
 
-    bool breakStatement(HandleValue label, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool breakStatement(HandleValue label, TokenPos* pos, MutableHandleValue dst);
 
-    bool continueStatement(HandleValue label, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool continueStatement(HandleValue label, TokenPos* pos, MutableHandleValue dst);
 
-    bool labeledStatement(HandleValue label, HandleValue stmt, TokenPos* pos,
+    MOZ_MUST_USE bool labeledStatement(HandleValue label, HandleValue stmt, TokenPos* pos,
                           MutableHandleValue dst);
 
-    bool throwStatement(HandleValue arg, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool throwStatement(HandleValue arg, TokenPos* pos, MutableHandleValue dst);
 
-    bool returnStatement(HandleValue arg, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool returnStatement(HandleValue arg, TokenPos* pos, MutableHandleValue dst);
 
-    bool forStatement(HandleValue init, HandleValue test, HandleValue update, HandleValue stmt,
+    MOZ_MUST_USE bool forStatement(HandleValue init, HandleValue test, HandleValue update, HandleValue stmt,
                       TokenPos* pos, MutableHandleValue dst);
 
-    bool forInStatement(HandleValue var, HandleValue expr, HandleValue stmt,
-                        bool isForEach, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool forInStatement(HandleValue var, HandleValue expr, HandleValue stmt,
+                                     bool isForEach, TokenPos* pos, MutableHandleValue dst);
 
-    bool forOfStatement(HandleValue var, HandleValue expr, HandleValue stmt, TokenPos* pos,
-                        MutableHandleValue dst);
+    MOZ_MUST_USE bool forOfStatement(HandleValue var, HandleValue expr, HandleValue stmt, TokenPos* pos,
+                                     MutableHandleValue dst);
 
-    bool withStatement(HandleValue expr, HandleValue stmt, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool withStatement(HandleValue expr, HandleValue stmt, TokenPos* pos, MutableHandleValue dst);
 
-    bool whileStatement(HandleValue test, HandleValue stmt, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool whileStatement(HandleValue test, HandleValue stmt, TokenPos* pos, MutableHandleValue dst);
 
-    bool doWhileStatement(HandleValue stmt, HandleValue test, TokenPos* pos,
-                          MutableHandleValue dst);
+    MOZ_MUST_USE bool doWhileStatement(HandleValue stmt, HandleValue test, TokenPos* pos,
+                                       MutableHandleValue dst);
 
-    bool switchStatement(HandleValue disc, NodeVector& elts, bool lexical, TokenPos* pos,
-                         MutableHandleValue dst);
+    MOZ_MUST_USE bool switchStatement(HandleValue disc, NodeVector& elts, bool lexical, TokenPos* pos,
+                                      MutableHandleValue dst);
 
-    bool tryStatement(HandleValue body, NodeVector& guarded, HandleValue unguarded,
-                      HandleValue finally, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool tryStatement(HandleValue body, NodeVector& guarded, HandleValue unguarded,
+                                   HandleValue finally, TokenPos* pos, MutableHandleValue dst);
 
-    bool debuggerStatement(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool debuggerStatement(TokenPos* pos, MutableHandleValue dst);
 
-    bool importDeclaration(NodeVector& elts, HandleValue moduleSpec, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool importDeclaration(NodeVector& elts, HandleValue moduleSpec, TokenPos* pos, MutableHandleValue dst);
 
-    bool importSpecifier(HandleValue importName, HandleValue bindingName, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool importSpecifier(HandleValue importName, HandleValue bindingName, TokenPos* pos, MutableHandleValue dst);
 
-    bool exportDeclaration(HandleValue decl, NodeVector& elts, HandleValue moduleSpec,
-                           HandleValue isDefault, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool exportDeclaration(HandleValue decl, NodeVector& elts, HandleValue moduleSpec,
+                                        HandleValue isDefault, TokenPos* pos, MutableHandleValue dst);
 
-    bool exportSpecifier(HandleValue bindingName, HandleValue exportName, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool exportSpecifier(HandleValue bindingName, HandleValue exportName, TokenPos* pos, MutableHandleValue dst);
 
-    bool exportBatchSpecifier(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool exportBatchSpecifier(TokenPos* pos, MutableHandleValue dst);
 
-    bool classDefinition(bool expr, HandleValue name, HandleValue heritage, HandleValue block, TokenPos* pos,
-                         MutableHandleValue dst);
-    bool classMethods(NodeVector& methods, MutableHandleValue dst);
-    bool classMethod(HandleValue name, HandleValue body, PropKind kind, bool isStatic, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool classDefinition(bool expr, HandleValue name, HandleValue heritage,
+                                      HandleValue block, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool classMethods(NodeVector& methods, MutableHandleValue dst);
+    MOZ_MUST_USE bool classMethod(HandleValue name, HandleValue body, PropKind kind, bool isStatic,
+                                  TokenPos* pos, MutableHandleValue dst);
 
     /*
      * expressions
      */
 
-    bool binaryExpression(BinaryOperator op, HandleValue left, HandleValue right, TokenPos* pos,
-                          MutableHandleValue dst);
+    MOZ_MUST_USE bool binaryExpression(BinaryOperator op, HandleValue left, HandleValue right,
+                                       TokenPos* pos, MutableHandleValue dst);
 
-    bool unaryExpression(UnaryOperator op, HandleValue expr, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool unaryExpression(UnaryOperator op, HandleValue expr, TokenPos* pos,
+                                      MutableHandleValue dst);
 
-    bool assignmentExpression(AssignmentOperator op, HandleValue lhs, HandleValue rhs,
-                              TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool assignmentExpression(AssignmentOperator op, HandleValue lhs, HandleValue rhs,
+                                           TokenPos* pos, MutableHandleValue dst);
 
-    bool updateExpression(HandleValue expr, bool incr, bool prefix, TokenPos* pos,
-                          MutableHandleValue dst);
+    MOZ_MUST_USE bool updateExpression(HandleValue expr, bool incr, bool prefix, TokenPos* pos,
+                                       MutableHandleValue dst);
 
-    bool logicalExpression(bool lor, HandleValue left, HandleValue right, TokenPos* pos,
-                           MutableHandleValue dst);
+    MOZ_MUST_USE bool logicalExpression(bool lor, HandleValue left, HandleValue right, TokenPos* pos,
+                                        MutableHandleValue dst);
 
-    bool conditionalExpression(HandleValue test, HandleValue cons, HandleValue alt, TokenPos* pos,
-                               MutableHandleValue dst);
+    MOZ_MUST_USE bool conditionalExpression(HandleValue test, HandleValue cons, HandleValue alt,
+                                            TokenPos* pos, MutableHandleValue dst);
 
-    bool sequenceExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool sequenceExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool newExpression(HandleValue callee, NodeVector& args, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool newExpression(HandleValue callee, NodeVector& args, TokenPos* pos,
+                                    MutableHandleValue dst);
 
-    bool callExpression(HandleValue callee, NodeVector& args, TokenPos* pos,
-                        MutableHandleValue dst);
+    MOZ_MUST_USE bool callExpression(HandleValue callee, NodeVector& args, TokenPos* pos,
+                                     MutableHandleValue dst);
 
-    bool memberExpression(bool computed, HandleValue expr, HandleValue member, TokenPos* pos,
-                          MutableHandleValue dst);
+    MOZ_MUST_USE bool memberExpression(bool computed, HandleValue expr, HandleValue member,
+                                       TokenPos* pos, MutableHandleValue dst);
 
-    bool arrayExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool arrayExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool templateLiteral(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool templateLiteral(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool taggedTemplate(HandleValue callee, NodeVector& args, TokenPos* pos,
-                        MutableHandleValue dst);
+    MOZ_MUST_USE bool taggedTemplate(HandleValue callee, NodeVector& args, TokenPos* pos,
+                                     MutableHandleValue dst);
 
-    bool callSiteObj(NodeVector& raw, NodeVector& cooked, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool callSiteObj(NodeVector& raw, NodeVector& cooked, TokenPos* pos,
+                                  MutableHandleValue dst);
 
-    bool spreadExpression(HandleValue expr, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool spreadExpression(HandleValue expr, TokenPos* pos, MutableHandleValue dst);
 
-    bool computedName(HandleValue name, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool computedName(HandleValue name, TokenPos* pos, MutableHandleValue dst);
 
-    bool objectExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool objectExpression(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool thisExpression(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool thisExpression(TokenPos* pos, MutableHandleValue dst);
 
-    bool yieldExpression(HandleValue arg, YieldKind kind, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool yieldExpression(HandleValue arg, YieldKind kind, TokenPos* pos,
+                                      MutableHandleValue dst);
 
-    bool comprehensionBlock(HandleValue patt, HandleValue src, bool isForEach, bool isForOf, TokenPos* pos,
-                            MutableHandleValue dst);
-    bool comprehensionIf(HandleValue test, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool comprehensionBlock(HandleValue patt, HandleValue src, bool isForEach,
+                                         bool isForOf, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool comprehensionIf(HandleValue test, TokenPos* pos, MutableHandleValue dst);
 
-    bool comprehensionExpression(HandleValue body, NodeVector& blocks, HandleValue filter,
-                                 bool isLegacy, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool comprehensionExpression(HandleValue body, NodeVector& blocks,
+                                              HandleValue filter, bool isLegacy, TokenPos* pos,
+                                              MutableHandleValue dst);
 
-    bool generatorExpression(HandleValue body, NodeVector& blocks, HandleValue filter,
-                             bool isLegacy, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool generatorExpression(HandleValue body, NodeVector& blocks, HandleValue filter,
+                                          bool isLegacy, TokenPos* pos, MutableHandleValue dst);
 
-    bool metaProperty(HandleValue meta, HandleValue property, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool metaProperty(HandleValue meta, HandleValue property, TokenPos* pos,
+                                   MutableHandleValue dst);
 
-    bool super(TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool super(TokenPos* pos, MutableHandleValue dst);
 
     /*
      * declarations
      */
 
-    bool variableDeclaration(NodeVector& elts, VarDeclKind kind, TokenPos* pos,
-                             MutableHandleValue dst);
+    MOZ_MUST_USE bool variableDeclaration(NodeVector& elts, VarDeclKind kind, TokenPos* pos,
+                                          MutableHandleValue dst);
 
     /*
      * patterns
      */
 
-    bool arrayPattern(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool arrayPattern(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool objectPattern(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
+    MOZ_MUST_USE bool objectPattern(NodeVector& elts, TokenPos* pos, MutableHandleValue dst);
 
-    bool propertyPattern(HandleValue key, HandleValue patt, bool isShorthand, TokenPos* pos,
-                         MutableHandleValue dst);
+    MOZ_MUST_USE bool propertyPattern(HandleValue key, HandleValue patt, bool isShorthand,
+                                      TokenPos* pos, MutableHandleValue dst);
 };
 
 } /* anonymous namespace */
@@ -734,8 +742,7 @@ NodeBuilder::setNodeLoc(HandleObject node, TokenPos* pos)
 {
     if (!saveLoc) {
         RootedValue nullVal(cx, NullValue());
-        defineProperty(node, "loc", nullVal);
-        return true;
+        return defineProperty(node, "loc", nullVal);
     }
 
     RootedValue loc(cx);

From f84225ca512ec41db4d78437e42c826f9094f5e0 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 27 Sep 2016 14:16:08 +0100
Subject: [PATCH 033/102] Bug 1305220 - Also cancel off thread Ion compilation
 on OOM r=jandem

---
 js/src/jit-test/tests/gc/bug-1305220.js | 23 +++++++++++++++++++++++
 js/src/vm/TypeInference.cpp             |  1 +
 2 files changed, 24 insertions(+)
 create mode 100644 js/src/jit-test/tests/gc/bug-1305220.js

diff --git a/js/src/jit-test/tests/gc/bug-1305220.js b/js/src/jit-test/tests/gc/bug-1305220.js
new file mode 100644
index 000000000000..30d3fa26038e
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1305220.js
@@ -0,0 +1,23 @@
+// |jit-test| allow-oom
+if (!('oomAfterAllocations' in this))
+    quit();
+s = newGlobal();
+evalcx("\
+    gczeal(10, 2);\
+    k = {\
+        [Symbol]() {}\
+    };\
+", s);
+gczeal(0);
+evalcx("\
+    var g = newGlobal();\
+    b = new Debugger;\
+    g.h = function() {\
+        g.oomAfterAllocations(1);\
+    };\
+    g.eval(\"\" + function f() g());\
+    g.eval(\"\" + function g() h());\
+    g.eval(\"(\" + function() {\
+        f();\
+    } + \")()\");\
+", s);
diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
index f8a35fc35f0e..4a019725232d 100644
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -4481,6 +4481,7 @@ AutoClearTypeInferenceStateOnOOM::~AutoClearTypeInferenceStateOnOOM()
 {
     if (oom) {
         JSRuntime* rt = zone->runtimeFromMainThread();
+        js::CancelOffThreadIonCompile(rt);
         zone->setPreservingCode(false);
         zone->discardJitCode(rt->defaultFreeOp());
         zone->types.clearAllNewScriptsOnOOM();

From cc4bbce3d9a8f1aec905fdbdc3e82a83ddba754b Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:36 +0300
Subject: [PATCH 034/102] Bug 1189901: part 1: remove code redundancy between
 tscrollx and tp5o_scroll. r=jmaher

---
 .../talos/talos/pageloader/chrome/tscroll.js  | 22 +++++++++----------
 testing/talos/talos/tests/scroll/iframe.svg   |  2 +-
 testing/talos/talos/tests/scroll/reader.htm   |  2 +-
 .../talos/tests/scroll/tiled-downscale.html   |  2 +-
 .../tests/scroll/tiled-fixed-downscale.html   |  2 +-
 .../talos/talos/tests/scroll/tiled-fixed.html |  2 +-
 testing/talos/talos/tests/scroll/tiled.html   |  2 +-
 7 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/tscroll.js b/testing/talos/talos/pageloader/chrome/tscroll.js
index 232c32363326..3ef862bf20d0 100644
--- a/testing/talos/talos/pageloader/chrome/tscroll.js
+++ b/testing/talos/talos/pageloader/chrome/tscroll.js
@@ -1,9 +1,6 @@
-// Note: The content from here upto '// End scroll test' is duplicated at:
-//       - talos/tests/scroll/scroll-test.js
-//       - inside talos/pageloader/chrome/tscroll.js
-//
-// - Please keep these copies in sync.
-// - Pleace make sure that any changes apply cleanly to all use cases.
+// Note: This file is used at both tscrollx and tp5o_scroll. With the former as
+//       unprivileged code.
+// - Please make sure that any changes apply cleanly to all use cases.
 
 function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
 {
@@ -121,12 +118,13 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
     rAF(startTest);
   }, 260);
 }
-// End scroll test - End duplicated code
 
 // This code below here is unique to tscroll.js inside of pageloader
-function handleMessageFromChrome(message) {
-  var payload = message.data.details;
-  testScroll(payload.target, payload.stepSize, 'PageLoader:RecordTime', payload.opt_numSteps);
-}
+try {
+  function handleMessageFromChrome(message) {
+    var payload = message.data.details;
+    testScroll(payload.target, payload.stepSize, 'PageLoader:RecordTime', payload.opt_numSteps);
+  }
 
-addMessageListener("PageLoader:ScrollTest", handleMessageFromChrome);
+  addMessageListener("PageLoader:ScrollTest", handleMessageFromChrome);
+} catch (e) {}
diff --git a/testing/talos/talos/tests/scroll/iframe.svg b/testing/talos/talos/tests/scroll/iframe.svg
index 18948c400360..c9005d9ac07c 100644
--- a/testing/talos/talos/tests/scroll/iframe.svg
+++ b/testing/talos/talos/tests/scroll/iframe.svg
@@ -35,5 +35,5 @@
   <!-- this has to come after the iframe for some reason -->
 	<script type="text/javascript" xlink:href="../../scripts/talos-debug.js"/>
 	<script type="text/javascript" xlink:href="../../scripts/Profiler.js"/>
-	<script type="text/javascript" xlink:href="scroll-test.js"/>
+	<script type="text/javascript" xlink:href="../../pageloader/chrome/tscroll.js"/>
 </svg>
diff --git a/testing/talos/talos/tests/scroll/reader.htm b/testing/talos/talos/tests/scroll/reader.htm
index edfbb0562097..4b23bad1bd7f 100644
--- a/testing/talos/talos/tests/scroll/reader.htm
+++ b/testing/talos/talos/tests/scroll/reader.htm
@@ -4,7 +4,7 @@
 <title>Perf test case</title>
 <link type="text/css" rel="stylesheet" href="reader.css">
 <script src="../../scripts/Profiler.js" type="text/javascript"></script>
-<script src="scroll-test.js" type="text/javascript"></script>
+<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
 <!-- 
 This resembles the layout of Google Reader as of 2009-11-23
 and exposed bug 530686.
diff --git a/testing/talos/talos/tests/scroll/tiled-downscale.html b/testing/talos/talos/tests/scroll/tiled-downscale.html
index 7676f793cc72..04284227fb91 100644
--- a/testing/talos/talos/tests/scroll/tiled-downscale.html
+++ b/testing/talos/talos/tests/scroll/tiled-downscale.html
@@ -9,7 +9,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="scroll-test.js" type="text/javascript"></script>
+	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html b/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
index eab841b63240..2659cd352ff4 100644
--- a/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
+++ b/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
@@ -10,7 +10,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="scroll-test.js" type="text/javascript"></script>
+	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled-fixed.html b/testing/talos/talos/tests/scroll/tiled-fixed.html
index 11a737599ae3..cb730d13dd9a 100644
--- a/testing/talos/talos/tests/scroll/tiled-fixed.html
+++ b/testing/talos/talos/tests/scroll/tiled-fixed.html
@@ -7,7 +7,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="scroll-test.js" type="text/javascript"></script>
+	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled.html b/testing/talos/talos/tests/scroll/tiled.html
index d1ec8054dfe7..c5bb5c547030 100644
--- a/testing/talos/talos/tests/scroll/tiled.html
+++ b/testing/talos/talos/tests/scroll/tiled.html
@@ -6,7 +6,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="scroll-test.js" type="text/javascript"></script>
+	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>

From b29aeabfb353a242fc84126de67b45655f6a4600 Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:37 +0300
Subject: [PATCH 035/102] Bug 1189901: part 2: scroll-tests: serialize asyncs
 with Promises. r=mconley

---
 .../talos/talos/pageloader/chrome/tscroll.js  | 168 +++++++++++-------
 1 file changed, 105 insertions(+), 63 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/tscroll.js b/testing/talos/talos/pageloader/chrome/tscroll.js
index 3ef862bf20d0..6f151d0f7689 100644
--- a/testing/talos/talos/pageloader/chrome/tscroll.js
+++ b/testing/talos/talos/pageloader/chrome/tscroll.js
@@ -12,10 +12,63 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
     win = window;
   }
 
+  var report;
+  /**
+   * Sets up the value of 'report' as a function for reporting the test result[s].
+   * Chooses between the "usual" tpRecordTime which the pageloader addon injects
+   * to pages, or a custom function in case we're a framescript which pageloader
+   * added to the tested page, or a debug tpRecordTime from talos-debug.js if
+   * running in a plain browser.
+   *
+   * @returns Promise
+   */
+  function P_setupReportFn() {
+    return new Promise(function(resolve) {
+      report = opt_reportFunc || win.tpRecordTime;
+      if (report == 'PageLoader:RecordTime') {
+        report = function(duration, start, name) {
+          var msg = { time: duration, startTime: start, testName: name };
+          sendAsyncMessage('PageLoader:RecordTime', msg);
+        }
+        resolve();
+        return;
+      }
+
+      // Not part of the test and does nothing if we're within talos.
+      // Provides an alternative tpRecordTime (with some stats display) if running in a browser.
+      if (!report && document.head) {
+        var imported = document.createElement('script');
+        imported.addEventListener("load", function() {
+          report = tpRecordTime;
+          resolve();
+        });
+
+        imported.src = '../../scripts/talos-debug.js?dummy=' + Date.now(); // For some browsers to re-read
+        document.head.appendChild(imported);
+        return;
+      }
+
+      resolve();
+    });
+  }
+
+  function FP_wait(ms) {
+    return function() {
+      return new Promise(function(resolve) {
+        setTimeout(resolve, ms);
+      });
+    };
+  }
+
   function rAF(fn) {
     return content.requestAnimationFrame(fn);
   }
 
+  function P_rAF() {
+    return new Promise(function(resolve) {
+      rAF(resolve);
+    });
+  }
 
   function myNow() {
     return (win.performance && win.performance.now) ?
@@ -44,79 +97,68 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
   // For reference, rAF should fire on vsync, but Gecko currently doesn't use vsync.
   // Instead, it uses 1000/layout.frame_rate
   // (with 60 as default value when layout.frame_rate == -1).
-  function startTest()
-  {
-    // We should be at the top of the page now.
-    var start = myNow();
-    var lastScrollPos = getPos();
-    var lastScrollTime = start;
-    var durations = [];
-    var report = opt_reportFunc || tpRecordTime;
-    if (report == 'PageLoader:RecordTime') {
-      report = function(duration) {
-        var msg = { time: duration, startTime: '', testName: '' };
-        sendAsyncMessage('PageLoader:RecordTime', msg);
-      }
-    }
+  function P_syncScrollTest() {
+    return new Promise(function(resolve) {
+      // We should be at the top of the page now.
+      var start = myNow();
+      var lastScrollPos = getPos();
+      var lastScrollTime = start;
+      var durations = [];
 
-    function tick() {
-      var now = myNow();
-      var duration = now - lastScrollTime;
-      lastScrollTime = now;
+      function tick() {
+        var now = myNow();
+        var duration = now - lastScrollTime;
+        lastScrollTime = now;
 
-      durations.push(duration);
-      doScrollTick();
+        durations.push(duration);
+        doScrollTick();
 
-      /* stop scrolling if we can't scroll more, or if we've reached requested number of steps */
-      if ((getPos() == lastScrollPos) || (opt_numSteps && (durations.length >= (opt_numSteps + 2)))) {
-        if (typeof(Profiler) !== "undefined") {
-          Profiler.pause();
+        /* stop scrolling if we can't scroll more, or if we've reached requested number of steps */
+        if ((getPos() == lastScrollPos) || (opt_numSteps && (durations.length >= (opt_numSteps + 2)))) {
+          if (typeof(Profiler) !== "undefined") {
+            Profiler.pause();
+          }
+
+          // Note: The first (1-5) intervals WILL be longer than the rest.
+          // First interval might include initial rendering and be extra slow.
+          // Also requestAnimationFrame needs to sync (optimally in 1 frame) after long frames.
+          // Suggested: Ignore the first 5 intervals.
+
+          durations.pop(); // Last step was 0.
+          durations.pop(); // and the prev one was shorter and with end-of-page logic, ignore both.
+
+          if (win.talosDebug)
+            win.talosDebug.displayData = true; // In a browser: also display all data points.
+
+          // For analysis (otherwise, it's too many data points for talos):
+          var sum = 0;
+          for (var i = 0; i < durations.length; i++)
+            sum += Number(durations[i]);
+
+          // Report average interval or (failsafe) 0 if no intervls were recorded
+          resolve(durations.length ? sum / durations.length : 0);
+          return;
         }
 
-        // Note: The first (1-5) intervals WILL be longer than the rest.
-        // First interval might include initial rendering and be extra slow.
-        // Also requestAnimationFrame needs to sync (optimally in 1 frame) after long frames.
-        // Suggested: Ignore the first 5 intervals.
-
-        durations.pop(); // Last step was 0.
-        durations.pop(); // and the prev one was shorter and with end-of-page logic, ignore both.
-
-        if (win.talosDebug)
-          win.talosDebug.displayData = true; // In a browser: also display all data points.
-
-        // For analysis (otherwise, it's too many data points for talos):
-        var sum = 0;
-        for (var i = 0; i < durations.length; i++)
-          sum += Number(durations[i]);
-
-        // Report average interval or (failsafe) 0 if no intervls were recorded
-        report(durations.length ? sum / durations.length : 0);
-        return;
+        lastScrollPos = getPos();
+        rAF(tick);
       }
 
-      lastScrollPos = getPos();
+      if (typeof(Profiler) !== "undefined") {
+        Profiler.resume();
+      }
       rAF(tick);
-    }
-
-    if (typeof(Profiler) !== "undefined") {
-      Profiler.resume();
-    }
-    rAF(tick);
+    });
   }
 
-  // Not part of the test and does nothing if we're within talos,
-  // But provides an alternative tpRecordTime (with some stats display) if running in a browser
-  // If a callback is provided, then we don't need this debug reporting.
-  if(!opt_reportFunc && document.head) {
-    var imported = document.createElement('script');
-    imported.src = '../../scripts/talos-debug.js?dummy=' + Date.now(); // For some browsers to re-read
-    document.head.appendChild(imported);
-  }
-
-  setTimeout(function(){
-    gotoTop();
-    rAF(startTest);
-  }, 260);
+  P_setupReportFn()
+  .then(FP_wait(260))
+  .then(gotoTop)
+  .then(P_rAF)
+  .then(P_syncScrollTest)
+  .then(function(result) { // function since 'report' might not be ready when invoking 'then'
+    report(result);
+  });
 }
 
 // This code below here is unique to tscroll.js inside of pageloader

From b261d4517e0442eb68025e61ed029eb70bf42c74 Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:37 +0300
Subject: [PATCH 036/102] Bug 1189901: part 3: talos-powers: add generic
 ParentExec. r=mconley

---
 .../chrome/talos-powers-content.js            | 41 ++++++++++++++++++
 .../components/TalosPowersService.js          | 43 +++++++++++++++++++
 .../content/TalosPowersContent.js             | 43 +++++++++++++++++++
 3 files changed, 127 insertions(+)

diff --git a/testing/talos/talos/talos-powers/chrome/talos-powers-content.js b/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
index f5c565c36560..a71e97f864e3 100644
--- a/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
+++ b/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
@@ -2,6 +2,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+// This file is loaded as a framescript
+
 var { interfaces: Ci, utils: Cu } = Components;
 
 /**
@@ -80,3 +82,42 @@ addEventListener("TalosPowersContentGetStartupInfo", (e) => {
                               event));
   });
 });
+
+/* *
+ * Mediator for the generic ParentExec mechanism.
+ * Listens for a query event from the content, forwards it as a query message
+ * to the parent, listens to a parent reply message, and forwards it as a reply
+ * event for the content to capture.
+ * The consumer API for this mechanism is at content/TalosPowersContent.js
+ * and the callees are at ParentExecServices at components/TalosPowersService.js
+ */
+addEventListener("TalosPowers:ParentExec:QueryEvent", function (e) {
+  if (content.location.protocol != "file:" &&
+      content.location.hostname != "localhost" &&
+      content.location.hostname != "127.0.0.1") {
+    throw new Error("TalosPowers:ParentExec may only be used with local content");
+  }
+  let uniqueMessageId = "TalosPowers:ParentExec:"
+                      + content.document.documentURI + Date.now() + Math.random();
+
+  // Listener for the reply from the parent process
+  addMessageListener("TalosPowers:ParentExec:ReplyMsg", function done(reply) {
+    if (reply.data.id != uniqueMessageId)
+      return;
+
+    removeMessageListener("TalosPowers:ParentExec:ReplyMsg", done);
+
+    // reply to content via an event
+    let contentEvent = Cu.cloneInto({
+      bubbles: true,
+      detail: reply.data.result
+    }, content);
+    content.dispatchEvent(new content.CustomEvent(e.detail.listeningTo, contentEvent));
+  });
+
+  // Send the query to the parent process
+  sendAsyncMessage("TalosPowers:ParentExec:QueryMsg", {
+    command: e.detail.command,
+    id: uniqueMessageId
+  });
+}, false, true);  // wantsUntrusted since we're exposing to unprivileged
diff --git a/testing/talos/talos/talos-powers/components/TalosPowersService.js b/testing/talos/talos/talos-powers/components/TalosPowersService.js
index 49889598e189..991b73bebcee 100644
--- a/testing/talos/talos/talos-powers/components/TalosPowersService.js
+++ b/testing/talos/talos/talos-powers/components/TalosPowersService.js
@@ -41,6 +41,7 @@ TalosPowersService.prototype = {
     Services.mm.addMessageListener("TalosContentProfiler:Command", this);
     Services.mm.addMessageListener("TalosPowersContent:ForceCCAndGC", this);
     Services.mm.addMessageListener("TalosPowersContent:GetStartupInfo", this);
+    Services.mm.addMessageListener("TalosPowers:ParentExec:QueryMsg", this);
     Services.obs.addObserver(this, "xpcom-shutdown", false);
   },
 
@@ -66,6 +67,11 @@ TalosPowersService.prototype = {
       }
       case "TalosPowersContent:GetStartupInfo": {
         this.receiveGetStartupInfo(message);
+        break;
+      }
+      case "TalosPowers:ParentExec:QueryMsg": {
+        this.RecieveParentExecCommand(message);
+        break;
       }
     }
   },
@@ -256,6 +262,43 @@ TalosPowersService.prototype = {
                           startupInfo);
     }
   },
+
+  // These services are exposed to local unprivileged content.
+  // Each service is a function which accepts an argument, a callback for sending
+  // the reply (possibly async), and the parent window as a utility.
+  // arg/reply semantice are service-specific.
+  // To add a service: add a method at ParentExecServices here, then at the content:
+  // <script src="chrome://talos-powers-content/content/TalosPowersContent.js"></script>
+  // and then e.g. TalosPowersParent.exec("sampleParentService", myArg, myCallback)
+  // Sample service:
+  /*
+    // arg: anything. return: sample reply
+    sampleParentService: function(arg, callback, win) {
+      win.setTimeout(function() {
+        callback("sample reply for: " + arg);
+      }, 500);
+    },
+
+  */
+  ParentExecServices: {
+  },
+
+  RecieveParentExecCommand(msg) {
+    function sendResult(result) {
+      let mm = msg.target.messageManager;
+      mm.sendAsyncMessage("TalosPowers:ParentExec:ReplyMsg", {
+        id: msg.data.id,
+        result: result
+      });
+    }
+
+    let command = msg.data.command;
+    if (!this.ParentExecServices.hasOwnProperty(command.name))
+      throw new Error("TalosPowers:ParentExec: Invalid service '" + command.name + "'");
+
+    this.ParentExecServices[command.name](command.data, sendResult, msg.target.ownerGlobal);
+  },
+
 };
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([TalosPowersService]);
diff --git a/testing/talos/talos/talos-powers/content/TalosPowersContent.js b/testing/talos/talos/talos-powers/content/TalosPowersContent.js
index fbcc0b2dff95..673967920f53 100644
--- a/testing/talos/talos/talos-powers/content/TalosPowersContent.js
+++ b/testing/talos/talos/talos-powers/content/TalosPowersContent.js
@@ -2,7 +2,14 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+// This file should be executed by the [possibly unprivileged] consumer, e.g.:
+// <script src="chrome://talos-powers-content/content/TalosPowersContent.js"></script>
+// and then e.g. TalosPowersParent.exec("sampleParentService", myArg, myCallback)
+// It marely sends a query event and possibly listens to a reply event, and does not
+// depend on any special privileges.
+
 var TalosPowersContent;
+var TalosPowersParent;
 
 (function() {
   TalosPowersContent = {
@@ -45,4 +52,40 @@ var TalosPowersContent;
       });
     },
   };
+
+  /**
+   * Generic interface to service functions which run at the parent process.
+   */
+  // If including this script proves too much touble, you may embed the following
+  // code verbatim instead, and keep the copy up to date with its source here:
+  TalosPowersParent = {
+    replyId: 1,
+
+    // dispatch an event to the framescript and register the result/callback event
+    exec: function(commandName, arg, callback, opt_custom_window) {
+      let win = opt_custom_window || window;
+      let replyEvent = "TalosPowers:ParentExec:ReplyEvent:" + this.replyId++;
+      if (callback) {
+        win.addEventListener(replyEvent, function rvhandler(e) {
+          win.removeEventListener(replyEvent, rvhandler);
+          callback(e.detail);
+        });
+      }
+      win.dispatchEvent(
+        new win.CustomEvent("TalosPowers:ParentExec:QueryEvent", {
+          bubbles: true,
+          detail: {
+            command: {
+              name: commandName,
+              data: arg,
+            },
+            listeningTo: replyEvent,
+          }
+        })
+      );
+    },
+
+  };
+  // End of possibly embedded code
+
 })();

From 3d24ad8f2c09f9e25e20b2d980b34a4d4c351caa Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:37 +0300
Subject: [PATCH 037/102] Bug 1189901: part 4: scroll: report custom test name.
 r=jmaher

---
 .../talos/talos/pageloader/chrome/tscroll.js  | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/tscroll.js b/testing/talos/talos/pageloader/chrome/tscroll.js
index 6f151d0f7689..e786c47d46ae 100644
--- a/testing/talos/talos/pageloader/chrome/tscroll.js
+++ b/testing/talos/talos/pageloader/chrome/tscroll.js
@@ -12,6 +12,20 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
     win = window;
   }
 
+  var result = {
+    names: [],
+    values: [],
+  };
+  // We report multiple results, so we base the name on the path.
+  // Everything after '/tp5n/' if exists (for tp5o_scroll), or the file name at
+  // the path if non-empty (e.g. with tscrollx), or the last dir otherwise (e.g.
+  // 'mydir' for 'http://my.domain/dir1/mydir/').
+  var href = win.location.href;
+  var testBaseName = href.split("/tp5n/")[1]
+                  || href.split("/").pop()
+                  || href.split("/").splice(-2, 1)[0]
+                  || "REALLY_WEIRD_URI";
+
   var report;
   /**
    * Sets up the value of 'report' as a function for reporting the test result[s].
@@ -136,7 +150,9 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
             sum += Number(durations[i]);
 
           // Report average interval or (failsafe) 0 if no intervls were recorded
-          resolve(durations.length ? sum / durations.length : 0);
+          result.values.push(durations.length ? sum / durations.length : 0);
+          result.names.push(testBaseName);
+          resolve();
           return;
         }
 
@@ -156,8 +172,8 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
   .then(gotoTop)
   .then(P_rAF)
   .then(P_syncScrollTest)
-  .then(function(result) { // function since 'report' might not be ready when invoking 'then'
-    report(result);
+  .then(function() {
+    report(result.values.join(","), 0, result.names.join(","));
   });
 }
 

From 513a31e25f01e75fc956e3c14b73ac03aece44ef Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:37 +0300
Subject: [PATCH 038/102] Bug 1189901: part 5: add CSSOM scroll test - uses APZ
 when available. r=kats

---
 .../talos/talos/pageloader/chrome/tscroll.js  | 84 +++++++++++++++++++
 .../components/TalosPowersService.js          | 17 +++-
 testing/talos/talos/test.py                   |  8 +-
 3 files changed, 106 insertions(+), 3 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/tscroll.js b/testing/talos/talos/pageloader/chrome/tscroll.js
index e786c47d46ae..e947dc4e2681 100644
--- a/testing/talos/talos/pageloader/chrome/tscroll.js
+++ b/testing/talos/talos/pageloader/chrome/tscroll.js
@@ -26,6 +26,37 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
                   || href.split("/").splice(-2, 1)[0]
                   || "REALLY_WEIRD_URI";
 
+  // Verbatim copy from talos-powers/content/TalosPowersContent.js
+  // If the origin changes, this copy should be updated.
+  TalosPowersParent = {
+    replyId: 1,
+
+    // dispatch an event to the framescript and register the result/callback event
+    exec: function(commandName, arg, callback, opt_custom_window) {
+      let win = opt_custom_window || window;
+      let replyEvent = "TalosPowers:ParentExec:ReplyEvent:" + this.replyId++;
+      if (callback) {
+        win.addEventListener(replyEvent, function rvhandler(e) {
+          win.removeEventListener(replyEvent, rvhandler);
+          callback(e.detail);
+        });
+      }
+      win.dispatchEvent(
+        new win.CustomEvent("TalosPowers:ParentExec:QueryEvent", {
+          bubbles: true,
+          detail: {
+            command: {
+              name: commandName,
+              data: arg,
+            },
+            listeningTo: replyEvent,
+          }
+        })
+      );
+    },
+  };
+  // End of code from talos-powers
+
   var report;
   /**
    * Sets up the value of 'report' as a function for reporting the test result[s].
@@ -101,6 +132,12 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
   var doScrollTick = isWindow ? function() { target.scrollBy(0, stepSize); ensureScroll(); }
                               : function() { target.scrollTop += stepSize; ensureScroll(); };
 
+  var setSmooth =    isWindow ? function() { target.document.scrollingElement.style.scrollBehavior = "smooth"; }
+                              : function() { target.style.scrollBehavior = "smooth"; };
+
+  var gotoBottom =   isWindow ? function() { target.scrollTo(0, target.scrollMaxY); }
+                              : function() { target.scrollTop = target.scrollHeight; };
+
   function ensureScroll() { // Ensure scroll by reading computed values. screenY is for X11.
     if (!this.dummyEnsureScroll) {
       this.dummyEnsureScroll = 1;
@@ -167,11 +204,58 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
     });
   }
 
+  function P_testAPZScroll() {
+    var APZ_MEASURE_MS = 1000;
+
+    function startFrameTimeRecording(cb) {
+      TalosPowersParent.exec("startFrameTimeRecording", null, cb, win);
+    }
+
+    function stopFrameTimeRecording(handle, cb) {
+      TalosPowersParent.exec("stopFrameTimeRecording", handle, cb, win);
+    }
+
+    return new Promise(function(resolve, reject) {
+      setSmooth();
+      var startts = Date.now();
+
+      var handle = -1;
+      startFrameTimeRecording(function(rv) {
+        handle = rv;
+      });
+
+      // Get the measurements after APZ_MEASURE_MS of scrolling
+      setTimeout(function() {
+        var endts = Date.now();
+
+        stopFrameTimeRecording(handle, function(intervals) {
+          function average(arr) {
+              var sum = 0;
+              for(var i = 0; i < arr.length; i++)
+                sum += arr[i];
+              return arr.length ? sum / arr.length : 0;
+          }
+
+          // remove two frames on each side of the recording to get a cleaner result
+          result.values.push(average(intervals.slice(2, intervals.length - 2)));
+          result.names.push("CSSOM." + testBaseName);
+
+          resolve();
+        });
+      }, APZ_MEASURE_MS);
+
+      gotoBottom(); // trigger the APZ scroll
+    });
+  }
+
   P_setupReportFn()
   .then(FP_wait(260))
   .then(gotoTop)
   .then(P_rAF)
   .then(P_syncScrollTest)
+  .then(gotoTop)
+  .then(FP_wait(260))
+  .then(P_testAPZScroll)
   .then(function() {
     report(result.values.join(","), 0, result.names.join(","));
   });
diff --git a/testing/talos/talos/talos-powers/components/TalosPowersService.js b/testing/talos/talos/talos-powers/components/TalosPowersService.js
index 991b73bebcee..c50f62920c34 100644
--- a/testing/talos/talos/talos-powers/components/TalosPowersService.js
+++ b/testing/talos/talos/talos-powers/components/TalosPowersService.js
@@ -278,9 +278,24 @@ TalosPowersService.prototype = {
         callback("sample reply for: " + arg);
       }, 500);
     },
-
   */
   ParentExecServices: {
+
+    // arg: ignored. return: handle (number) for use with stopFrameTimeRecording
+    startFrameTimeRecording: function(arg, callback, win) {
+      var rv = win.QueryInterface(Ci.nsIInterfaceRequestor)
+                  .getInterface(Ci.nsIDOMWindowUtils)
+                  .startFrameTimeRecording();
+      callback(rv);
+    },
+
+    // arg: handle from startFrameTimeRecording. return: array with composition intervals
+    stopFrameTimeRecording: function(arg, callback, win) {
+      var rv = win.QueryInterface(Ci.nsIInterfaceRequestor)
+                  .getInterface(Ci.nsIDOMWindowUtils)
+                  .stopFrameTimeRecording(arg);
+      callback(rv);
+    },
   },
 
   RecieveParentExecCommand(msg) {
diff --git a/testing/talos/talos/test.py b/testing/talos/talos/test.py
index 1f80943459ed..0de9f19bb3a7 100644
--- a/testing/talos/talos/test.py
+++ b/testing/talos/talos/test.py
@@ -498,7 +498,9 @@ class tp5o_scroll(PageloaderTest):
     tpmozafterpaint = False
     preferences = {'layout.frame_rate': 0,
                    'docshell.event_starvation_delay_hint': 1,
-                   'dom.send_after_paint_to_content': False}
+                   'dom.send_after_paint_to_content': False,
+                   'layout.css.scroll-behavior.spring-constant': "'10'",
+                   'toolkit.framesRecording.bufferSize': 10000}
     filters = filter.ignore_first.prepare(1) + filter.median.prepare()
     unit = '1/FPS'
 
@@ -688,7 +690,9 @@ class tscrollx(PageloaderTest):
     """ ASAP mode """
     preferences = {'layout.frame_rate': 0,
                    'docshell.event_starvation_delay_hint': 1,
-                   'dom.send_after_paint_to_content': False}
+                   'dom.send_after_paint_to_content': False,
+                   'layout.css.scroll-behavior.spring-constant': "'10'",
+                   'toolkit.framesRecording.bufferSize': 10000}
     filters = filter.ignore_first.prepare(5) + filter.median.prepare()
     unit = 'ms'
 

From 70c11a1c6527484dbca5028532ce8f39b56e6b4b Mon Sep 17 00:00:00 2001
From: Avi Halachmi <avihpit@yahoo.com>
Date: Tue, 27 Sep 2016 16:43:37 +0300
Subject: [PATCH 039/102] Bug 1189901: part 6: add signed pageloader addon.
 r=jmaher

---
 testing/talos/talos/pageloader/install.rdf    |   2 +-
 .../talos/pageloader/pageloader-signed.xpi    | Bin 28966 -> 30245 bytes
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/talos/talos/pageloader/install.rdf b/testing/talos/talos/pageloader/install.rdf
index 861b9b092951..fc86699fab19 100644
--- a/testing/talos/talos/pageloader/install.rdf
+++ b/testing/talos/talos/pageloader/install.rdf
@@ -4,7 +4,7 @@
      xmlns:em="http://www.mozilla.org/2004/em-rdf#">
   <Description about="urn:mozilla:install-manifest">
     <em:id>pageloader@mozilla.org</em:id>
-    <em:version>1.0.12</em:version>
+    <em:version>1.0.13</em:version>
     <em:targetApplication>
       <Description>
         <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
diff --git a/testing/talos/talos/pageloader/pageloader-signed.xpi b/testing/talos/talos/pageloader/pageloader-signed.xpi
index 5888b529b63f82fcc8f5695fb8a430b76186b11b..49b7752f18ed24077ef56498196b8f79d9f8544f 100644
GIT binary patch
delta 8038
zcmZ9RWl)^Wy0r)QKyZh_-4iUhySuv&5+vy0?t{A%B)GdnfZ!I~-66P~ynEOA_Ss)`
zJ^kaZuD-kasan<RS|!_1#ivk2%5pHU*Z=?k5fE;{FJmR&`+k860H|RA0N9X8J3R23
zmM72LD=v3bZ48hSVjnc}`DG}l*gT4h?xV~IUsEmQQ;-PIg6L<4h&#~RoW5F8{AbD!
z33_wdUDbQvldk)?=SAQ1o7H!}+zp+sgRFzBNzV_$=AZo8!xLPkPsYjloIWRLppn;=
z`-_k>Vf6qCaioNM!fb2+B}TG&_7va_9P*jZFye^RM9}a7y=+r(2Z{S6{*SE87_&Jl
z+6U;g7-n>+NS{CVxxj?oLs4QzP{M8+=vPh?!YX+LmNs(dY=$O7vpuWQ6kX=dKzLvp
z@@ab)hAoYt9D+TZ`rCQ)VotyKUVV1gW+HEN1c*eoycY*wJ(UI5)}}NxHBy6HJZ0M6
zZfRsLU3*5MXTTvNfNhNHr=w96F{gXX_p<j{!!spDqCm!;DAS=)nBgLvnwh$~85ca2
z@tGw7x_2c+{XvQV7$GyO7o3ak{Rya=3m85s&e+YJeTNtivCPf0ml`H-iDwn8rJrPz
z?=})~uy$Dk*HB-CRLu{Zn%%)QUxC^y%bw-0DHy`AC@+R?7|dwFh?e=kpC=J%0!6rd
zgM!RaukzxRJWMCn4s=`UC>@V!8r`ic6g(7KNh1x4>>yWiG#$BCK3X*ymKzDGq>&f=
z;-9p#AFiDqH~C)2$uARUd9RPmt43=~4)xa(Byb-r2KFYi`s)gxV2r>+?R#8qT%t6L
zMw$#qtb(mSbW4dv>;1U)6L}?yEe;{j+*aD#7P%kL44}{3<9m|kE8>tQb_bQzKEYJk
zJd8*LCv@d_?S)7^pgZig?-_Y-^zczCpb#%-{@SnRZ6{@DXgs88iH;<0AF<0}s-@{n
z=)hs{-z_a)4fu-BPe=+TG5c|shSf=!cp_IuFe`RYP-hYK9amxanp8-_m8<SXF^Ool
zJ&ZTD*yF0Tg<gmVn<*VR8z+Z6Lr2wVcN&x6Pu5x<tXgq7)hz3@O6@ETRx&ZrFxJ!E
zhk}A)yaf{6=;^l`?}4o|ARyH^{-ebY4KLaN5v$)sY*3+S(HaVz_*E{3j6kARt077;
zKJDwaW82$t?Po_P*Gc)X<2gmK;(+|gB3J1`yQrlEQUa5W83abSNr^=PcrTwKqP|}w
z7|x?l;-!(~I^V>rOR|2>_{)^FaJThz_;1Uk5aVWB#|c^2J7}qp<jCfjKm^&@MqRw~
zHPtnE>3M~PL=@=2F{`;x6AZ|)lO8&z-xuLB$k6;0w5QV7<?Hb+`8{a&-E&AzyxCyI
zVV+j>Mem3x1JR4pP5M$^YNR;a$NTJAdc@psx3D;Nyi5%mK<1|^5ciuu!oNbH<vWlN
zI4AUfJxws?zQql&HrMPlW%k$t_iWI__L9Vnp2f8?{1N8BJbk2Gdp#$r4V_L=iJBd0
z$R;5h-ig2Vm#T|N?PO!ClnTt??>*T=%uI^rOZ*pxG~btoVz(@bQhksMr%R@J-gFQt
z#(!#@NS^pN!o8^)m5uB~n$nmkiU>5NJG4XaOa0Dj$JUm1?Q5Us=Qwpf${DTC9A+<Y
zI^L>Y-;FVWr{*l=ga;VAv`l$G5#5Ky4ipx5#tq>hD~!7^tMpifgvc^Vjr7}O9jj|6
zzNDHjZpE~fJMwl5`xFc!-J#z&cMPiDJ4BEX3gJs#TeA3KIdj%EXKTqK&VAOOZ0(SS
z8ww`3anjY3Vo17a)XJO<tM|NOvy9tDv59W#Qyb#IirMrI+0x%=-Fvk>$1&!myxdo$
zNvI#g0$z6y;7s~aI5r|v*N3OFN(z}9-_MV(fc;EWyRmhs9`b~G{Ek>93+)=2=)NKA
z3^R=TGi@L)(>~F@R$2y!L~uW;8%L?lIUR>={AG(aJ0mk$;R>U=ZAIutkN^7nRRE0%
zQf(-h2!t8Lltbe+Y3044zD1-Hg^HeB7i$dq(^@!v7?MHi`xV(%Wu=J-J8Z*Xs&1Vp
z6uh@|iAvtr1faM*Q-Thwnehi-U_Ov~BfM+<d{(j)bNPmexbE#5^B6Pm!vIN0TI)l6
zFN5^hh|HMm1>{^X>6P}STZiR6qIcyxM?X5a^>+zAT;_$-va%qd1j(H&rh)w9%z1o%
zJ&CBp_Mxp}jZtdn<c(KBSK9!RmU;2UDK{jR(Glx{0J{Z>th2QwhqvCrSBe^ETwE1H
zaP7`t(jsaBPtS&y;jQzMUc?E7FO)d2d7Zy|e9}8)aC<$^NZ-fZe}ZBXOHp74HK!DO
z6nD;#H7Zn=_u9UlYD&5nI4VjtDnyv=EbUs)j^tiBWB+ytNceT_N$;yy9w6}PvhG9a
z*u7Hl*CY#*TQr$zYxS#XJVramVai4RA=k6@hRE_y;EP29ULuOE^-ru)VmMkI7S%C=
z(7c8trqHctHOfGIWi*b$D8wapwm*B|i}pJ~dD~qH1CI=wI0J1MKXdCa?uHoe%Xky6
znKV|@dJ(rCZ<?=7KUKFF_i??+J6rVq>DD4?RpV6|j5=}8cyA+j*R4{&@vW_^ZhyUG
z7S9vDco<GpyP>~4*^%Aw3WD?}pGA%RBAu)Jd{QLsJIi@HrFLnj)r3sg%=>Z+{>GHS
zB-65Q0;1Q;+XlHDt4^EIc%3!$idZ&yjbjlPT{k$HI=EL}&=yXZkO3W20z3@z8PvF|
zaw~q2fVzwpr;B%k%wdnhHkMmy&rd9tnOwVb_mH?7g~DGJFqt(oD8RmK;7se<xq{?=
z2CSMd&5X~4<*l)#AM=LSw`ZTgt7S1zV#Y(r_u+YFfR9uNJ@*-j2uQ_n<m6K<{!3C!
z-bTuY>-hbESYM`wxGex>v>`EkL2+@AuwOJGI`k-%#r=mm^HO;=Q1=g)5FE+t5xati
zf`FPn-&S%iCL+YKmLbD=F1urcFMIo}cX<z0<c|3<;<gTo+S-PP?`fFeaB>WC7_%CR
zBY$b4V{$t6w4Lz6=H~Xqq`7XT!lanSq?ppEqW0{QjqtPKCq~~j%r9JgVab2ckJ^5_
z`f*suD-GN#Aaq|fB7aB;HlWRn5frq7>-{<#gmH$oa8$l(1P$_2X3RpkDELlG!BzfL
zjM9?Qx|iho3e2#uh#Wis!!sC}@zJ7}e~h)hZqG@}NVn7w&)PiI1pC|OCXa-WdQoAx
zZLT;qM}EubozGZSwbtkTWD?PEhB?PH)ZcDXw6Q-{{E&zvdWp9%$+b)W?Nt*z%_KKk
zHsVp|GT&i%<TYfxBEl^ez0n?B=UwBy{TY6sgEmYuT&tfzsTJQIoX~O&A|>B$L%Ly}
zwBV3LG775?UV)HCt04z(H#cuqx{O*imb)=&@rmjV2=&aA0HKkJvcifK&q8He+vyIQ
ziBiu_qokt6g(j2wO!&tu<F;qCh(A$Ff+lQx`nv-okB^0MJdWea6<wSs<+)jja|-nj
z8}f$KIR(Usv1R4KkbC8B)7XNXiX!J|^dvszLv*7rHM|k&znJAq%rzx=QKnf7r(#xZ
z>}Vd7z93cgbfNlt=(n4{h%4&Y_a$2d{VXk=Z{ufoYrTI2ai+~TFsRUu?k*CzNCwIf
z>cqzle{L!%w8>?B4z)yXdL$NdGQEw9*<#hP$Ly^jV;|}O$7JJ@j2UFVeN$|{A?n;R
z6V%sv0oZiB@l*mvSr*Ck7Xu%&x=fM0v@@%TbBl~j{yu5@FoAe?=XiykVhD&Q&tM%I
zFo|h5OS3)7<`k<G#_2^EanGxqXq3g{N-_-MTcT*K_v%MboOWe~6ZqpnhO4kbulZ20
z=fZ<y1&S;fb{5vPI+0*6IYAJ5j64D^MGdRA;+OuQggn<DyUydefl{EB4RbRt_6Zq(
zT^C_-Rs+_3r)2hrAV{e)^ELcg%*ObPso)WZpebk3;>R#63S?|1Z1c0|i95|0gH+_X
z*gG!vlgtc*)=X7usna12o}(-Ma7y)T{b*^od;EKF4WDrQJbOeG_brRp=}s88?UihX
zAA;_{=mitcR<+?(MsO7kON1!4;G_WWN@Z&#>hVSM+IT7)bvAvU7(-|v59tNZ{8#L2
zk((dtENyh)lkclkY`G+O5s$`BOFjY|_biI0nReg85gt=A9Bzh!pJJ5ula!qjNo4|x
zzl;fj*XC&4=->t7m)R4IJZ^j*B>H-vV=Ec=@P%Rx_BnP4kE({gU#TInV#Rvq{t4IE
z1)7e+8^hZfK{i4Z_z2+}vaJwrXBc)h_W<5TfrIf3jJF#TncULT&kMHL2Ddvu_`mCh
zvu^{HG}##7TU{Pj<<`?@TWTRv#@^EtY8OIaTlb%6&XU1OAK5icB}{J^OIZs-F)-+2
z01B1Ee*`~wg<EVeFfw<Y{fVM)Gd{TsHef3r=GC*86ujho9FG7z*Q0k@-(W*zb70;W
z+j5r;uM6M>IPDTQ{2Kx-%Zn`8$L$?19qfkF>Fa(4rz>&uR^i4Hd1T{Zzk11)UJX9u
zT&~N*boIxB0sj~!<iAD<0GRNBR4CD4h+7|P{l`5G`9P*vSfM$s>!Db2VIW$L*!3Rj
z%dm+5_Ewng5CRTPXo!BjB8LVE<P}6%f1~6CTMuP)gjk=T;{;c4hQ$hBkH9<(^<lz?
zU#6d?dqDcH4_l&ulu%KD|7rC@*Wv5RXUw-Mqkv;Ei9rqvtCCmpT$Y0p_epNW<EXW<
zJq`kNaZyaY#7(FoY=e_`ze#9vBvsYKJ4J}IxN)sElY6djeu>(hZi?v;=|Y6%7!?lc
zyO!=ibgDgY>=UC~k$Hxn`Ik5y9Un@vGvSeS8m>-UdwLBT>>aQdTQ<jY*|jJ&(WPF1
z29?>znN|9BIk?3@ix<3J*J9WOGs>I`?S}nFS?i%Fib1SHmlq@1q1hxV(~r2vPHftm
zp6WClR>f0$oe9)*t-28|eXjJ8&$~jVeda2H3@XwZhC%Cs2O93^&;q0{e8%?uI4d-d
za9uQV``R^+S!iI&^i&GgFf&Ql=y|nqg<w56dWo0jXEHpYsP7$Y>YMY4Q&U)2^t*5K
znS&eJpkKQ^5qZH?s-~bLmmDMkvkM{l@tx38jpr9}#{A*tz~A+?sCEzvoY<I9WU3Y9
zCUWN4H4Gui(Z2h@)RQTfmSx07#zmPfQy-n}Ye}_L2SG4N0?WX#cxnb*i`M(l@Kiw^
zo?@se&&|wr#qZf`{ryr3#!(U!@fKuf>&a+c8u~@*D6Bza3sDCwMEgVLewC*F)o}Z$
zm<0=+@se44ydjPq8NtE1$2nzrshuesmmdQ&$2{^D13x823EQ1+%vm=?SgU0&TY>0q
z2{aaL4Pjui*o|B;eog13W4BvG*iKEn1lt>j>Jwqa=Ivu}cHBlT$#3I_{p0JqyS1H_
zicIbep|{(8%Wv#884qE~D8w{DHaPrE>Ks8LC91i&E{sVzd{LQ#Q=8cY-bbgmRt`F=
zOff^nvYKpS2R2yIy}!}4I#V<V>qCq+KHjJf6sdvZwn(%#7xC$%S=ZJEINb#a(x6U1
z(h|aB{MZ_ow+|=mvWu2Tkdb1bmkk2SRvH`j5e9r(v4N#Ex;(^dpQ*tnli)IItVc)~
z=cp`c&t!Yp37)sBbd*YFvADA)sdU#LQhoU0)+s<S<8>1Esg`$nekjNNu*}%f%}K(v
z(<U5jDdui^i_e#xl{L4DsBTN37l4Wx{3Z6+wcd<4i~1CZ-)3Tb4xSsQG!0h}W=u3f
z9yH+0@@xAlq`3|kF$Xs)k+zKcdCmt+*zi1eZ@UDK=FHM$`Bbb@mi?uqs#^;{B*u~D
zI#K%_H!5lKhkA0_H!RI2oiO}9J)%Q&y{RlP`-Zp|Y>kZ|r{!$=w`0K)$+(^Y1l}9e
zURtl~hP^Jn9|Dg6UpW3$Ijn~}fhGyRK&Sfc-<;c5(Q7E1APxLQwkaij$rPtxz}PoC
zlHh3fP~|L5j2_-NuWF&-l)bUWB*d)CGZ)5SG}wMwtuG|ds~h3c<qtq83eciVgS#-e
z3$tvOeejlNNK;19L{Tr)$&O+QeuTGPa6VE3Al7TeNY4H9q_umkz`~Kh6rBp`1M?y3
zHwwaL5hmREa>nvfRZf(=pmrTl`REa{%!i3c?CC(}q*dGeN>QeHqa-@UWIJ~RO+*1p
z*U0W)yyv8!q-!dE0<Vo%jmem~?k*O<@MzK^_Z(~ACXNekJ5pnL4v}8P9&1!sGwY{G
zu$}FaKH1qw2@-R8bD0h#b4<rw1FQVucF7E2fzM;Nkr>&)rXFvvDAMsfJ*Cv^<%cw+
zCndoG>xAJ{uT-h(;027&JQUZ#cQ?~R{QlFrn+m$r%}%>r@(OLpJ3XFzb&Z~2WX9Uy
zgoBxVF6Dwop-};2s3Fb16ci8$GLYoZC#wouNNlwcUX=_-<2;RNl#jqeBVsb@VP?9)
z&biUEisQFewRcht)KRy<j$I5Ke)}{<O+}E<yM4fHPy}mwsljkakFRq;;CWnzcQ%{=
z<XxzV0gBu&6Y24qdrF-L_Vt0^CUhl?Ig$J6-*k}vG@K-|ZZnLz-+ZLlz2{L%8)JS*
ze5&4BlB`yA&gd|TP|M;6H64FvE(+$4Gpd4ceXs=zI<j@{EFoH15(#y8d9S+c+NPg-
zK0x8Tv24&TvVo{7>T;-Qtqbj$=ev}Tulcn11p<zb#Uj9kG<2*tRGeT^Zv{lT-DjV3
z(ui5IAQq-dgg86amCh2qGY|$w6OO2g!N`qtJl1XK2>#Hi1nmncIn;qp*bpZb5y*f^
z;Z`qm?w3I$u5CgAVcOy(8g<u(3>u%+)So`QY?SJ_?KBl0ulpUB2%^r*_>)VkJ9@<?
zRIm8K5ZYJS6il&3<zcY-aSh@G%_-{nfVg5v17q-Tw_Zn=KF0Q`X|4^W9n;yNSfH!#
zn?;>pGo{VRwvUhh>pR`e&yKA(`rppJ_vuAdLoX<|tAO}51nUcO-nl&%oIk$@G8{1h
zgrjf{Y3T2lo`PddX6ze36FI6MQ+3CKiu4XqJGaR;UXA2SIB&sP36%>L%%C8gHE$>~
z2wf&iyumOoza-Fqn<4SBprFN?pB$J#?&~Y{N<ZrJ?&$~W|AEw00?oO#Ke|!`SKogV
z|GX-)vWcZm+f=HI;<QapWxX{O!iD_?EujRPhTydz@rOgD1g1Wp$|f+Q)Lbb15HDg}
zM<pWZT>d;UP8K}7&tYDL<O1n0_xxfKkv@C+a(ZeXi46;+=8E`3nfTcx!lCW@j361Q
zR@>#6;WwdayX1OzbL7m}?AKX=D~RFgIWaN&eq6|hm3&)o<c@|iLZ(3rhu~7_g(kNl
z^DKyqf_?-FJ>EKYV`QZ=Zrdx$QYrh-mDTGT`eW2oo(}N)6xAmOp^xFXw>R~x14%jZ
z27YO@<+C}6%vU+qynl$7#Y<BdnHV}jbsmn~WM5%~NHPWc+4C3R^X>PekfX<cdTP)l
z|0uTC?8vV|iCYNNWv7AkG<S^R(%m}=1Q#wZh~9~Pz?~zcEj(HsO0!Mxxu{ZYKwsu8
zrZDPddH({wP|2=2F!SL%Dm&^wM+T-sRYtc(+m3e?q}V6-7eVv~`kkwvs*yexZc&Jo
zu3T|ll9o7BXY!>XyNNmZJ)zZk7HJ^o6#QPvT+!oLQr~Bs&D-`|D`x0tsj%zMGaTg*
z{qjZ9CL~elCxoMyZk0$Q-llGU2y0+i)wyJL;hF^8KBg|`&Q=>V8L>n)vYR0pk){|x
zNGCAi;3?p)pr5#cvnud*KW}RR@)`nZwyO92aX!M>Xdp!N4e@lBSyP0xZm7<t$Ok(>
zaawIzjr`(=x%Qy`+#_tF35Aa>BL{)6&ns4I{qiX<epCZGNxm}v7QTQIODDW6t8C^W
z2RQ}|!fWEkYl}qFp)4gYW^gufZe(7zqyyx8OWCY{R&EZ*!PGrs80h^n>De|LE+#VD
zN)t>vO)Zl$J%$<=6rm|uRGT|WI8ea>aq#RHCr%4q*f&9X#yWY%lvGk|8>Uf2RI84`
zYo53leB3My;SF%GX6yPGdAp{~=FqV#Q~n6XymPfAdIS+x)k>HL1*ra_GmR^B;0|Gt
z^#D{}z2ZrB9j%MRYh}5;%(HV|2s5#ETW!#u;g!EK)a<<Hq5zvV^D#EvL^{3R?t4^W
zWL$H`A+;0rUV0=9mFJ{Khp8U#wl~Eh4&3;@K5lNF@3WZ|!&>)AgXGLk_p5AdTa#dN
zL^u+?Gnj}#>*>h0#Vz!*6H?T;N)km3+8Nirg2CV~KXAd0RyxE>OHG9~SE-0j;c$13
z>BRAyD2dqSmVsXBKM)lZrW9zSk!9<!yLWF9E2*MgzI&~)CpU}Q`*7Oue2>|{w1#{q
z3s%VD=%ptqo)P0Ox=05Mp7Ft1Pila<$v%7zIz$Dmn@O4Hwhx8cV0~#zXk|wT<ATyE
zCu@)E%QGR@AVcci=7A?nXZ{fQVQSIpaJ<lB1_0saIzgV9BtO-|(*zYq)hGQ{`#k81
z8O7JB(bz<1KU-l2GO~_(a=R#nYFN-FN@?^AdGOhmu%*2ylPMHLE9g(XzZU{`A^)l<
zXUXyFx;f}l@WNfJa$r=!yOB$-)I9$~ip$%73bSVDO=1R2*%euf_kKJ3-9qBVoao-u
z(DX74+PjWO4&y$A0`b=#2sA|yy0V^I!9E-F5X91++Rt<bS&rtAg7cy1j(fZOLVh#B
za)>sSV8{t|k6`Tv?1zLum%&+gu8-Kk+!*F2*;<*~`uyT6JsB{9fibGOl7dYqxeAi*
z^%w|=B;qGfo!MSTw)MVRXJsPx)PA2S@B@LJof|HUAntyF)A-PFX0(ng19v=)+{=0I
z>sQi+be@NM^`2@^To0`OSQ&`310jTm=_f=*N4P$b03HR=!<S!%C2y1!!ih!&9cTm5
zLF<Fsttb8<1&8!cUZim867~eSu>ykSAay+0@SC08eVy}Y;drOzhI#(q$pc3n!i3p`
zF%juTs>#|d_cQ5#H}IFcluz_$LJAS^16#_4PSZ5wH>-j7KR>`f0|t%6!YlYjZj=ZE
z0$?Gz9PCPnA%Ac*jKmBwKE#!epyiN}fpfuV)K%<zHc-jphA74!4W3vQ+xOu6&C+Wn
z4bIU9xjqjGL0z}7+Ttlay0o#0(x?0GwSGowx;OE6L@@Knh$(@$@buEWscuHCk9y#U
z5018K`RCLVXET9<Wo21xm5h`EZH{@e0P3hjmiIRHwo8Pt?qlPMB+J^QqD}XNjK!fX
zfsuAh?4Igazf6mDGk7~IF92BC=g|#*Fnns*O7}Ix_%PjLyonnv2bIt0Vvk|eg!MJV
zTl1^kj$(^Cble?i)*2?&BPMvCQG}Lc{6;vyvoe7y;)tJcRzSG_`oix)nX}3)qD9O2
zf(AAKY1!2^H#Ai;$M_%~pS#f+)8N|hlSKRgFH*rhK2P(NOD1By0|!{IZl@wcR7Am$
z;Ai=u*6HX}OKfXPgH+ef6_7SvmNn^}eOd3#E-d5MeO-4yho<U+ZMr>SYpEeIMpUu6
zw3TvlKtrdSN7#n^(05(WPM!}*{s)5{c%dX^I-1RtlNZE-=79{ZL!C(J&6`{}*F_D=
zbvbi6{H6y)2vJYc-z30E+}hnR_;!r~7W&zzqUjn%zKbo;M?y-Ewon-HyzH!V>-jzb
z^0}Af)bot~LvZ<yAKA`n+Vamd^|?y3w9b|6YR^B8M>OeMTTOEvs9;&_`n!Iul6cvk
zBMLuAp_-SHb|TqnrsDmhPUE=mVmP<XWV852C3L4L$-XY2WG@AV<zP)FT^hD_56syz
zG-{?+(*jaYCclOPp)R}XizBT0^s1&AyrzfjCwoc{zOmxjewtSC(GOH-)*ionD>r`U
z#8Ah0iOw@U-li0vTnpOqpp$atb4pojXlQw;hg4(}bqi(1QDqNSeBJ6(1AbGnS{{oe
zs@9Hq{+$PgQkKK`zbR@75%zBgk)5nsUDO)ndMr9RDr+{HK^CIVNeRutMC{<u8Yn=F
z#-5CzQC!;gfY)|Nw680fuJuTS@2Q0=?g>jsz_;w;4D}Z|KtW@}{C7GFX|dx%{C^yx
z8$`?iL<0cKtX&)(ELhdVVF9pE0Dy)%901|pd;$uZ6!7mI{t^lj5HXAv8UV7zLJG_I
zmnlHx92ubVFd!a|T>k+T_8?;DBpgU2i1IJ5fcyb5LDO(TC>^;V(oUq%<=hZ!Cwj<@
zBMme}7((R43^BvP{tGGq04M<Y-x)>{l5funL14!Id#e8}a>xT9gv|61bPy`=zv%`5
z@bT~X&&o#y0HlJ73|ib8V&lLB9iR(Ib)fsJMuh)r0Ra4sr2*!8kZDH-NFu@i?VF<q
zxwPj7{;yo6{=Ebs3;=-gU%MAs0w98D1pnw5i#-#Jn>7G}j*idt|6lXJL=74Mn1TNr
ug8%Dq|DODzR_!6JP88(-DBnN-*!FMT^Y4fCUyBf(AkR+J@P$tQRR0I>yavhu

delta 6734
zcmY*e1yo!?vK`!mySqCH5G2^(uE8N0+y?>yLIw%$3?4K<LXg4T-5E3xV1VH6PJm5z
z|L*?ncl!0~I<Kp%y3e_FyQ}B`>FXL2wYC}xDhU7pzyy%#NvKHIR!AS?0swjh000Se
z+?^bPF!B|fxu+71u8J*BM9g<v<92iv5>)dmMMbO$#7f0vAM{hDuqK9-F}ED_5-_Q7
zG5Mz+cvOSFsUbY~a_$En_NA|Vk02fJWApZv<NMa*?Eq;&q6)ntGg&@q6%hXmvK>)I
zG7=LMnF6(Y0!c(bl>`NKR7C}8;=vu+h6wUY3yF!9l0i;6gFpZiH!KLYBokr|xa(+@
z@lujyJX}eViOCZ{ogXCV!E>iWF+r7!Uv)a(iCEWTZEPY~a;LjOwTod1l&+s*{Pa|t
zGdI26vZGje)=MvOLb<T`a#3ROjMAjV_vd=KAcf4C7$EqjZ<C+B_TGnGgpNI^rW(Q|
z)}kgB0B4hRujv~E=t9gB(R;Zz9;H$wGFR8)?v9?MEN<Z(l3iFb)st^EQS6F9f`Q4n
zhFe_JZ6sTmIgjk9u5Snc=hrRMkB!G2?b)PO;^_LAep12TYB0u^GvM>f3)DUD^=sXp
z2W3Bb|IXE!!K~c##pUljKaAul<AaEqIw>KK4=-rke#1agsO*FrVCd+|L|7?C6+G2i
zF;OT?7O-BAti5;|vTqcIES1uPX3v^%m)u~e>Y~wY%R9*(T}-j@#c_|6^eww}NrQ}Q
zoo9x?(x}p8WBD-FOaU3MFI;#MVS_=7^FjVjBBU3;Q^T?x-VBN3<t{KrRzdV-(}@iD
zGnWh#1j0e`*9HNH<+7SaH1`_*HiIsDk?iN9_uqR2W>Ol$l4vz)Q_p=SnQ`o)9JUpT
z_lekuPoyN211~0d&F}Nw3$j+0<|(>r_!Vbft~(t%z{#mL3P)S|Y6pj2TzI$skTQc}
zJ1^jwu=?t-fGR~5xym+i>mePg8u6c9gF&<jNw6)yLR-F5zFe)*nV(nuN8!s`Wmc<6
zT4|M5dS<I8Gb=Bs{hw>xivMWV6#+Ya<!y?LG1+lrvjJ`QQ^1*7fv0ZHwgz6)!b|}~
z={wiycAEnpPH%F4<$(F=QtFNHj%N*AYz_xbTsh;yfbVjjJ6gn1C_-@YON1}_)V<*j
z=+GuMebRbY*3vDF@KFQQShs9z16U#=uJD()2BsBVQ7Hnc&&{9uyS{$pvn8ebvQb<X
zeZLQklvxeVL{2$eu&G7)%P;t^-y^2hjOOmzv<|~U;h%8Jd%v}D!%lq&nrs_88~sEn
z`jNQ2j{2*wY2*4D79a+f-L?vjKLvFh^@-~6bw$xz*y+Y=y_tU>YrQGjCoK`rslJXt
zpvudT<aLa(ZZry}>y3p+vaMyZN+(<L&ng}sR*uc!@6`@AmKyThu#TTZo2Q<1tm+QG
zFxGt`Kv)Z(sHfe3+ie9|@VYEteNk^z+hK&mkC*0fQMFgBK@aii(Tu<-<2UI`KQ7cU
zD!Wknr8C;f*9Ls(oaJ_koq$OramQ*!@vDJ+vkanKK1vC+aAzq<=_<w~QM*7s*niR6
zZ8Os`_YWNq)N(KLYEMSgV(JU|8))ns3Aq^-<(edJg6e#3h=}o@pOYDz9$9^Q^#}q?
zb4~_k5>pMGMMGvx;e>;5w#MCq>|4+AxvzLa9A%E^5&V<Z{AU{dY6Tr}Sqh<|^EHxG
zN4}Mv?hmfsA3cI<hkDTO<A!A%&OPHxQSRJAv*|5o9ud7qS3grq2mKr(vSvbjY(DrC
z4F|}Ca++lLd+%MnIa!Dx?ytogqa(T7bvbWaczkIzYzCR{%OLwW;LXfulEn|6-0ror
zRT(f~#%6LavIA#a7pza%w^M<^3i#A|-EwFZdQ3LV-)ZliK4b&9)!0E#4-!=Ld}{$P
zIXu3RpyixNw<)24Bn~<~$}S#D!#U#(x0p<GLD$B0LYm&{;uf;K&kXyQT{rzv{<zj0
z(Vy6ug&>5zmYnsH8Wxjdreh=GuYGlm$Gg1mT*IRaoiqbFRUrM0k|pKCI*?KR>ue_R
z9*o(RzLs~;3KWHTI+;(J5O#M=VzirWz99N4pH4_h>l5e&YAJQls)xedPOdV|w!)2K
z^J^I@W^UHll%&L$Y>2lU=UO+A8nZ{@kOprxe8{YOZh9dp%hPxe`xvz%xS2f)#ungM
zqcOLDf8Yu_WEuGBJVbKR`lM}XaFAzY?;CU=l~!W(Bg*eN0|5$sBtqX;tRep1oRLzU
zoRPb1+C(<LQfW7ovw;jqyY-44^GH^SFy!Q$c-q`;;vD6eCwlAg(%8kU$>#3r#B<ec
zUr5e^zI%vveO~AGw6D*hq27yP5$#sz<rAYt|MB<hfELx~XRW*nY(3}M`oSB-si2OP
zS}_`Ya!mBXch>C`Sd$#}Oo<KDpQqP<nZgz8$_H|yxS;s{bz%HyQ7v9DE6!#eyEPY)
z8%<e~bIMpota^wf*+n^WhHmIB-OlItr;rY;9IQl|kEU}eZ_b8aZbUwutRe{&r}zgx
zydmk15Ov-jYLbp`3XhH@tInM~<@q?nQC7h*8%8acpbu_#6drb|eAT@fdnuKzPmOb0
z6!;$fRnXk}d0!^C%E^vL6JieOT7J_dYFM4Sq$8m&iN)s~fAik3U&D~;UHrOuE;nR(
z%b!6O)4R=<@m#s9@AY(9WoVoUvyD|?j@G7OI9;Kc(v5}7mP-X%&lRH<BYuB-e6}n$
zRB#f#u1<a<xY;fnoP%jH5jt@bLX(`<f@NHsmsS<h(lYndRg0GUT4ic?C#W^x%dJU`
z9~rdv`0mUo<666px7`}aQC+g)P8ZUGPK6spIkZI}Ylp;yiPIUMnS_B<gv!7$VHEg_
zLXa*%Hecy2F3RipstLg`lv)8t5?lop6||ra)X(YAIk=PidRBr%MS!a5Ft6av@bfIg
zx9hRUa%b^}!4nDU3@lRVMb#dYy#@ADKb6Y9aA*)@#FJ~m#;~!5@b2jKkO?8E$c5G-
zse~qZ5iX<zBwV9@!{a?YKuz7Vm2Wyk@zCBDan;7x5)ZNS?d2Uw*JDT_%p(+(xt-(l
z{UgLG1<f7lF;eTI*dIrSDXwRcIv&EV!^-lyW&jHESZRK7_fWTkGVmkz4Yz57Zn~pQ
z#SAm-ooiWEJ-$MD?S*=xtR>{u-|N0t#ipC{`A7Dmp(f6+!nmq5=3J!CF41d0wXfKM
zl(!K1d}#Vnk7IiaL_68lM~!t60ZNc+3ViUuiCii9T!xQ2L2&#@XgIkqU0ZH@rDG=J
zuJ+DzoySd+HZ!j~nSGV*X#3;%-6HWy8WM}#^u;b|^;SyN(%s??@-9dU^@#e+K2w><
zweq)k0%?33%m!A&7$_YU0<jVzY`w|<-N?b%SrW%tajaYSD+96zq49IVLn^J|DhKBY
zMEXjZOH>#hFl|e9wGzee>sN{I)ZUJ3Jyp>qClm0z?&g;h>nr=faSeA5xJKgBsu`QP
zgXnR)0q{EMSK&lk@-zg-HCIvfjyhRy9&rf;jb8^<2py~Ek=L9bL+K0^mkGXD*sVLQ
zYW@@%XWoqRylqp#NLZ)pTURwMYFLL=>}yHR=^QyK&DoHjuuY^JzDn7D)b{g>W^)o_
zkb90I1o8HF<BF<QTISx#w<`U{R5LXgeVDIB$=-|7K3Wi)fCo9;g8z_M3^)+a;&<zK
zMtiw2yo$lpzfWo%pT{%59N27op}QA`R{Zsa)}!lM=zt=uQWlpGys6wlL5D@lurc;D
zB6O=3@u2ORu?4t~S0EUL%RO6tw9fApc+}Vg1ivcN9wqe2@`&hmY3`VCvQaOM&tf03
zh$C6OTigpK>VlAD$xRQ>&78MbruluckJq(SBURzloXUPn3k7QWIAk`Y{?yiPm*C_e
zv7nz5u3wn((WavjNaTgY2{XCe2-Hs7NSOxMibn=;>8G2k@Bsnh(y)O}66&L1-X-jl
zOpnGc0Fmgv|EJu&jy&_aj65uVMw)GIh^2QV#PT{o65^%_II5oA{dO=C8^rrNxXTtf
zii&g};{&@kVV?1qVOmSQ+YB|fTkmwd(l1N+8`NE_==3Yqnl)LGHBN*xZpq>AiWg<p
zY_%Ql$7aXiXQS_%pc(Je`Wr*OqdI_tev)t2QOo1`p5pLG$CP>aZ+dWfXFd9S;%BpM
z+i6L&nS>0Qz<v^>Ozi9}?Z2I2aOL7&ov_Yo{ThNuod~BG(=B;@(y+UYn-NLheolNg
z?V3$wlZzNTf1lK8?QIPw=Bo1d@UqsUtr%zhj+dh^$I7;3M9Y)WNJx8?;cw_t&2z)c
z4-ykCva_)qDnohP{Iq+yt0`tQLD>ae7WRgjSU|*?4ie&u>KA}{hp3D^M`;)ZpH@zM
zt>3UGz51jOORAuFLT+43>F9p52t3WXd;R3$Nr}9jnv*z7E}q2mx&78|$k{EJA1j&%
zXiAFDM8WPaWaj0DWrAa_bTsJkN=KCA0=8RzwPfy)Udcp~oLuxhvw7-^yhU}=ot%hU
zNgeg;dGv3_M{ggI{(DfGb(Bz{@>Iu$*4wfmgO#C6w%tgenp`_2G$^YlNe!bSHF{04
zDLT$G;GZAW2Di`DF#v!CLMWjo3&dJ!&#36Ni`)7OqQ@gk!O!@0GxODYc@G4Zu2n9g
z;k@8QAhDGx2~buoxg4gjr_2SbKs+tmDev|98k>125}0ndiwS4>Zsi+t`;}(57Phn%
znsKwI6in@eT}>(PnS66-H<@%YNEnNSIf18|#SK!UVCAJ|V#W#XX~N2(5O`8nah-Wp
zo_VOjsngKgpKjh<W}K#^LNJFu%^xNtQ)OpTqY2#PhGD=~SCwN&&ay&$-TIBIsp?G^
zR$l!?sS-)*KCnvc4a1Q4N&jIebADX%ap;1qMXgIL`yl6s9s{JOmp?EbUVI)K*4%_m
z4NC;<<Edl`NbHh<vYp*ZAy30-yFVTrL8Y-RVISTbntS3PeI9>ICq&@LhpW1r)NpZ@
z<dt&2j23*Q7P%R5_x(|zIwUBi`sV2B{?JXxhngSFyZ{qFfW^4y=oMSdjpa^AZq~1r
z)hOS0*~uj<aOFA5=LfbMke7{jss^!EyH3nhLu)#4eI3sarT9ZAKnPa-n2Cd`3spYB
zBV4)wLq20FJlSI0{>)bnHIrWp)DA2O#c~_9B||a&dA)3KL-Qrg*f=f1^+{5B?OMWx
zkzBf`J1s=-K=W8tzn}AV`r5`JACoap>m%Q*B2Lg*wyP-dzR!XK?xmuX-E?FWs4eeZ
zGh<Q|u>_m#UBj5aJ%l{wwHqBbtuwC|MO*0^e!@ep^TXZXkE^~U>HNp1+S}ib6OUPk
z^20fr@}I+B;6Eco)GN_sa&XnjYlyfE?0EA#k^uXebW3t6?h}eH*86~4F55{Te_f@F
zMZp~6D%d|?%m#IT1k>rXVzSb9pTx{G@o$%ju1ea1lb&tjDM4V?&_q^uYSP-(m+UQb
z=H}YQU9yc3_)cS<%l3|?&{H1gF>WDkXT`)+Nz?g`553F`cR&GwnGR3!nP)2BkNwLM
zG9^S)8OZBqHjghvAZq1sxAZxd7lv^Z%$xDO*Ss1q-cS&kkAKS9Pk{{M;3!a5CF&P}
zRPjfCf4h33Lr9nheIO!<??H=C7x~2}lwW3-egw-Ax}UATkVz$D@T7;G<@cJ;b`It_
zW%0jU?@Ba!`aL2>=LbO7qDFqWWpBE|$Z*oD>>f)Hc?jmt><B>-Z9g@SOF9<}Ku5?6
zUKqv*bw%|bF@(tl1&?(70OFR>XTiza3))D3MUE62Swo7rEIg2Zo0{MhB-yE(o+vtW
z9K9X2etPb$v8o`nFz|yjewsZTOr<|sJ$lx~dGRHFT+t&w8rstZa<RL9`{}Mv@An#F
z{bbJ*6{CrSAyADz+|!Dzlaw$he=^Lp4a@V~e@HCx7zw}1ZjC(i(U59fMUh1<w_@$t
zhk2D;`wx(1c9nE+7>nMIPIF<(w(ms?`IV2pmoj@<?aHSaEP;091BQD-zII;5vr~l^
z!I6sJv=dX3`hM!?6qC#6$_K>T31!*xbSAPPYm^miyt%c(?%ynwjWqRp+S&?ps`-&;
z7}k_}mg10pszGXgzxg2NSc1r*KW|3CDbwHNia~~?B)EMbk-JSw>yTg`{1FhTWK-c-
zx~noJr#jp%^nD$471ZN}SBxUj%z!V)8A)XO{&P=+)a1v-L+?ir|L&NkgBGLzQwL1|
zykAB`NV{PvFmDsx?vOb6S!dt7D-~<+Ih4%A>p<t-IlwLM;t-VX4PkZ>UmD$|V_PX;
z&p-g;UW)km27epH=NTN<k+SHTraAuT#m3FGh+NQBgX+mSJ)~ie#A5Gs(S?j8lSp{V
zv3m>dS}Ru+`5F}Qpv<8|&r4;C+)^m6ZwThjIPbF8_Dnb(@>?-%lil6K`uY=gx&)#C
zb@f6!I*qyRFr>=JV{&q}5H`F!g>C^Uahs4!&&!brwB<8;<oPIn2eEE>*xA>jVn=S(
zjq%KaQm-sUESj5Pkfg%!n+fuSdynTG7guF;8F<|_Ir`Rl3C!ct-Cf_BDST7mC!bxv
z4*tGgwGKp|ai7DTC#ZY`h2#VSSSF$fo99!ThHlDi{DNKwEnn=sR4Nlo<0jSoKqvzF
zfaf|z6%fzOcw{%&O4Vh6NdWL!P+*>`Y-9r4$shG*sT;TLCZ9=Y=!%|Y5HX9Nd2@GK
zC#HJ{3(ySEpjBGhhXsV;YYlXQv}sN$@<q<m8aMhv*zkM#yy66Yk=0?m-Rs$b)>;eh
zv{2c|Y<31(%q8U}i8rgyHv8gwbTB|_*ap7%rk0<OgWRjO-t)E@H<EQ+c%3@Nxe7Ef
zUZU-wkT9=KP7JaVn{|vuc2TYf8=Q`{mqZteT1lFlLBx(2+=m7SLZVNxr?)Ze`a9Qx
zgV6#`N!c$4ey;mq*<VTu`F>8=mm7b57S{vU+5yNso@gS=XO{%t9E{y~=Rqvu14pSX
znPSM_*A{$9O`JBPMtoSe<Y&>K!1~r_Hyg!VVUtAkRS3PfEFlgjw=JU;C!*W<Niz>Z
zw}K}*lH)fCO+%x}&)|r%-_}3_V!wX(Vv>jxH%81<a+{3g0Sy{tvJG|hq^i+YuR%fv
zIzr##@grL+)g<GQp&-vXLi0$4{{-xsSyBU9Ozc0Go&dlfAuk>qCRlmT=x>0B@`9;q
z6olPTYf1=?P@(pwGBw#U?r6|(FiFjz=qx7I-%C<AuN~}b=&>^+WF)Rcl>~jYN$b~=
z*9Z_zViyTJ0-Gsf$#$?VFKUfzaGG9XJ1d(uqgFV{<ojin<EBw7je<4eL%OvAN)|+8
zNb8M|xG%@=%-~j6Nz7NJ44EekkDTjPG29a@#gCa>zrlWqV&JpiH#gV6ow&3|s$FOO
z`Ka_aeQ~<3f4shbgyj6zfBY^dAo=d<K)1MlcjP;E?ZfR?fwAnt_NU_`c2dP(>~~r>
zPO@QhpC=*}GUj1vMP%6IlQ@dV*;++Msb*Jq%=Y?K3bF=8tOF_MckwdhVitrS5fq4>
z8X&u>7lB&&{7LKF^373Q736wVTM@YNgS-JQv|WW9TPLX$2=TwY6vrln(d9ZkI0cu0
z##tq5g#>1zerA7q83^~c#B{pnk_~X<A54y?dq9*0OU*CY95_{=qTvJNv`__-J!ryb
zC8)-vQ4D;JVNVG{U<LsnqOKj**WO2$y9ezTZrPQC<(_5rx^{io$E}Xo{LdJ#g0CsW
zMb5_<ZH>a;L+Tid6;zS9`zm7IFK(;2;>c)l2=R<%IEmM4on?wq4O_;vhjw@?Q+g6D
zz2)0@qq_4TX^LJiNQE)jlw@@4q@P9yu@7$n9+Q)lG>qHRY-20I!+qT-Y#D5fr{Od{
zmG+RM*>+&;i%+}EZ-=@YXLMRkMdGBG)7w%!hhqYOkYrx_Wh8CzTfXi3;P`f#h~Ex7
z&fYWx%?Ud?8`kJf4a1U5jf$DkyBvL&+<DkIW^KU1bL;%#GY>U%b>Pd*p?Qz7h&<kn
zF_U(1W<RQV!Y^T65yfXab%G`lcB*T4Jp;bPTW%^=o64T^g2+5ncBI!5K1lopgB-={
z=e@O!5aqnvsYp#m6Ut7VLj_6|$Bu6J;K!cIz^xZer!H-**c~FgsqLs&gI4tKLuEj;
zSEk=>no_^`MBsb*?>zbu#9(K=QqqQhUh7eU9}M;QaFBztR1gPuC5=toJ*gGh5*Fi1
zS+MTIy2>D(N=*U#t*>m~c^RRvu<r2x$%gU%lQ#%r#p{4lxvT2w%C~;dGY<}FmApWK
zW~pZLKu4K{r(Il{f~9Ei1XIW}{qOWqjZ!{~DT$Fc=@+rsWcY;}0ByrISQfz^NC0g$
zBxDkl|IJ508{9>n{Y&&8=1usH422O70PV7+{L8?B?|87!o&f;5Kv@M1Ahg_*_74-M
zLop@>Kp7O7pzWTx&}uI_ln6=yw8fMQ`rw7j@W0#~03iJH{4GcThClB(7U-TQ!yo8?
z;(GC*Q1JkuIVOz%)Z_I>@57(ImOAI({$G$0_n<-U<%1e|&<p;h_kVq$1N_(E&K{F!
zEm{De-1SdR<$q?u69Pc1NSOrwg+6~r{Tq}dRQ}rX?}G7vqX2+EX&FGS7L?F~?62Fb
zU>=lNt-m^mp>|*fXqd+zpY;LIHUeI#nHLv|hA{vdWJ(Vm2Xml=|M{+zVfd#H;b1!C
zYYXT%Fel;vU+jP3TK+py<W)Op<2xpXzhL)wXC42{>iee>|J$HHZ6Fes6ZGyKD|(^R
HU+F&p(a@|)


From cb690a7e5666b63bc51669ede55d073fb27bc65e Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Fri, 9 Sep 2016 15:21:50 +0200
Subject: [PATCH 040/102] Bug 1301648 - Add a pref to be able to control the
 AudioCallbackDriver requested latency. r=kinetik

MozReview-Commit-ID: 19BZUjyXFlq

--HG--
extra : rebase_source : 96df59a9b5c9f8bd7e5f8211a09b854d65833b3b
---
 dom/media/AudioStream.cpp |  3 +-
 dom/media/CubebUtils.cpp  | 59 ++++++++++++++++++++++++++++++---------
 dom/media/CubebUtils.h    |  4 ++-
 dom/media/GraphDriver.cpp | 11 ++++++--
 4 files changed, 59 insertions(+), 18 deletions(-)

diff --git a/dom/media/AudioStream.cpp b/dom/media/AudioStream.cpp
index df4ee187cfbd..921ec23e6740 100644
--- a/dom/media/AudioStream.cpp
+++ b/dom/media/AudioStream.cpp
@@ -365,7 +365,8 @@ AudioStream::OpenCubeb(cubeb* aContext, cubeb_stream_params& aParams,
 
   cubeb_stream* stream = nullptr;
   /* Convert from milliseconds to frames. */
-  uint32_t latency_frames = CubebUtils::GetCubebLatency() * aParams.rate / 1000;
+  uint32_t latency_frames =
+    CubebUtils::GetCubebPlaybackLatencyInMilliseconds() * aParams.rate / 1000;
   if (cubeb_stream_init(aContext, &stream, "AudioStream",
                         nullptr, nullptr, nullptr, &aParams,
                         latency_frames,
diff --git a/dom/media/CubebUtils.cpp b/dom/media/CubebUtils.cpp
index 1f8bceeba66a..916d60525af6 100644
--- a/dom/media/CubebUtils.cpp
+++ b/dom/media/CubebUtils.cpp
@@ -19,7 +19,8 @@
 #include "prdtoa.h"
 
 #define PREF_VOLUME_SCALE "media.volume_scale"
-#define PREF_CUBEB_LATENCY "media.cubeb_latency_ms"
+#define PREF_CUBEB_LATENCY_PLAYBACK "media.cubeb_latency_playback_ms"
+#define PREF_CUBEB_LATENCY_MSG "media.cubeb_latency_msg_frames"
 
 namespace mozilla {
 
@@ -34,8 +35,10 @@ enum class CubebState {
 } sCubebState = CubebState::Uninitialized;
 cubeb* sCubebContext;
 double sVolumeScale;
-uint32_t sCubebLatency;
-bool sCubebLatencyPrefSet;
+uint32_t sCubebPlaybackLatencyInMilliseconds;
+uint32_t sCubebMSGLatencyInFrames;
+bool sCubebPlaybackLatencyPrefSet;
+bool sCubebMSGLatencyPrefSet;
 bool sAudioStreamInitEverSucceeded = false;
 StaticAutoPtr<char> sBrandName;
 
@@ -81,6 +84,8 @@ uint32_t sPreferredSampleRate;
 extern LazyLogModule gAudioStreamLog;
 
 static const uint32_t CUBEB_NORMAL_LATENCY_MS = 100;
+// Consevative default that can work on all platforms.
+static const uint32_t CUBEB_NORMAL_LATENCY_FRAMES = 1024;
 
 namespace CubebUtils {
 
@@ -95,14 +100,23 @@ void PrefChanged(const char* aPref, void* aClosure)
       NS_ConvertUTF16toUTF8 utf8(value);
       sVolumeScale = std::max<double>(0, PR_strtod(utf8.get(), nullptr));
     }
-  } else if (strcmp(aPref, PREF_CUBEB_LATENCY) == 0) {
+  } else if (strcmp(aPref, PREF_CUBEB_LATENCY_PLAYBACK) == 0) {
     // Arbitrary default stream latency of 100ms.  The higher this
     // value, the longer stream volume changes will take to become
     // audible.
-    sCubebLatencyPrefSet = Preferences::HasUserValue(aPref);
+    sCubebPlaybackLatencyPrefSet = Preferences::HasUserValue(aPref);
     uint32_t value = Preferences::GetUint(aPref, CUBEB_NORMAL_LATENCY_MS);
     StaticMutexAutoLock lock(sMutex);
-    sCubebLatency = std::min<uint32_t>(std::max<uint32_t>(value, 1), 1000);
+    sCubebPlaybackLatencyInMilliseconds = std::min<uint32_t>(std::max<uint32_t>(value, 1), 1000);
+  } else if (strcmp(aPref, PREF_CUBEB_LATENCY_MSG) == 0) {
+    sCubebMSGLatencyPrefSet = Preferences::HasUserValue(aPref);
+    uint32_t value = Preferences::GetUint(aPref, CUBEB_NORMAL_LATENCY_FRAMES);
+    StaticMutexAutoLock lock(sMutex);
+    // 128 is the block size for the Web Audio API, which limits how low the
+    // latency can be here.
+    // We don't want to limit the upper limit too much, so that people can
+    // experiment.
+    sCubebMSGLatencyInFrames = std::min<uint32_t>(std::max<uint32_t>(value, 128), 1e6);
   }
 }
 
@@ -238,24 +252,42 @@ void ReportCubebStreamInitFailure(bool aIsFirst)
                                  : CUBEB_BACKEND_INIT_FAILURE_OTHER);
 }
 
-uint32_t GetCubebLatency()
+uint32_t GetCubebPlaybackLatencyInMilliseconds()
 {
   StaticMutexAutoLock lock(sMutex);
-  return sCubebLatency;
+  return sCubebPlaybackLatencyInMilliseconds;
 }
 
-bool CubebLatencyPrefSet()
+bool CubebPlaybackLatencyPrefSet()
 {
   StaticMutexAutoLock lock(sMutex);
-  return sCubebLatencyPrefSet;
+  return sCubebPlaybackLatencyPrefSet;
+}
+
+bool CubebMSGLatencyPrefSet()
+{
+  StaticMutexAutoLock lock(sMutex);
+  return sCubebMSGLatencyPrefSet;
+}
+
+Maybe<uint32_t> GetCubebMSGLatencyInFrames()
+{
+  StaticMutexAutoLock lock(sMutex);
+  if (!sCubebMSGLatencyPrefSet) {
+    return Maybe<uint32_t>();
+  }
+  MOZ_ASSERT(sCubebMSGLatencyInFrames > 0);
+  return Some(sCubebMSGLatencyInFrames);
 }
 
 void InitLibrary()
 {
   PrefChanged(PREF_VOLUME_SCALE, nullptr);
   Preferences::RegisterCallback(PrefChanged, PREF_VOLUME_SCALE);
-  PrefChanged(PREF_CUBEB_LATENCY, nullptr);
-  Preferences::RegisterCallback(PrefChanged, PREF_CUBEB_LATENCY);
+  PrefChanged(PREF_CUBEB_LATENCY_PLAYBACK, nullptr);
+  PrefChanged(PREF_CUBEB_LATENCY_MSG, nullptr);
+  Preferences::RegisterCallback(PrefChanged, PREF_CUBEB_LATENCY_PLAYBACK);
+  Preferences::RegisterCallback(PrefChanged, PREF_CUBEB_LATENCY_MSG);
 #ifndef MOZ_WIDGET_ANDROID
   NS_DispatchToMainThread(NS_NewRunnableFunction(&InitBrandName));
 #endif
@@ -264,7 +296,8 @@ void InitLibrary()
 void ShutdownLibrary()
 {
   Preferences::UnregisterCallback(PrefChanged, PREF_VOLUME_SCALE);
-  Preferences::UnregisterCallback(PrefChanged, PREF_CUBEB_LATENCY);
+  Preferences::UnregisterCallback(PrefChanged, PREF_CUBEB_LATENCY_PLAYBACK);
+  Preferences::UnregisterCallback(PrefChanged, PREF_CUBEB_LATENCY_MSG);
 
   StaticMutexAutoLock lock(sMutex);
   if (sCubebContext) {
diff --git a/dom/media/CubebUtils.h b/dom/media/CubebUtils.h
index 2eb226ba41d8..171c244b7843 100644
--- a/dom/media/CubebUtils.h
+++ b/dom/media/CubebUtils.h
@@ -9,6 +9,7 @@
 
 #include "cubeb/cubeb.h"
 #include "mozilla/dom/AudioChannelBinding.h"
+#include "mozilla/Maybe.h"
 
 namespace mozilla {
 namespace CubebUtils {
@@ -36,7 +37,8 @@ cubeb* GetCubebContext();
 cubeb* GetCubebContextUnlocked();
 void ReportCubebStreamInitFailure(bool aIsFirstStream);
 void ReportCubebBackendUsed();
-uint32_t GetCubebLatency();
+uint32_t GetCubebPlaybackLatencyInMilliseconds();
+Maybe<uint32_t> GetCubebMSGLatencyInFrames();
 bool CubebLatencyPrefSet();
 #if defined(__ANDROID__) && defined(MOZ_B2G)
 cubeb_stream_type ConvertChannelToCubebType(dom::AudioChannel aChannel);
diff --git a/dom/media/GraphDriver.cpp b/dom/media/GraphDriver.cpp
index 2729a20b3eb9..6579c357d777 100644
--- a/dom/media/GraphDriver.cpp
+++ b/dom/media/GraphDriver.cpp
@@ -628,9 +628,14 @@ AudioCallbackDriver::Init()
     output.format = CUBEB_SAMPLE_FLOAT32NE;
   }
 
-  if (cubeb_get_min_latency(cubebContext, output, &latency_frames) != CUBEB_OK) {
-    NS_WARNING("Could not get minimal latency from cubeb.");
-    return;
+  Maybe<uint32_t> latencyPref = CubebUtils::GetCubebMSGLatencyInFrames();
+  if (latencyPref) {
+    latency_frames = latencyPref.value();
+  } else {
+    if (cubeb_get_min_latency(cubebContext, output, &latency_frames) != CUBEB_OK) {
+      NS_WARNING("Could not get minimal latency from cubeb.");
+      return;
+    }
   }
 
   input = output;

From bef76e271eb7a8cb3481d09a2e16f92634c02a07 Mon Sep 17 00:00:00 2001
From: Lee Salzman <lsalzman@mozilla.com>
Date: Tue, 27 Sep 2016 10:35:17 -0400
Subject: [PATCH 041/102] Bug 1304195 - silence warnings from
 ScopedXErrorHandler when used off main thread if acknowledged. r=nical

MozReview-Commit-ID: 34LaghDR15f
---
 gfx/gl/GLContextProviderGLX.cpp |  4 ++--
 gfx/src/X11Util.cpp             | 10 ++++++----
 gfx/src/X11Util.h               | 14 +++++++++++++-
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/gfx/gl/GLContextProviderGLX.cpp b/gfx/gl/GLContextProviderGLX.cpp
index 03df3c6d7014..9a1157f330cb 100644
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@@ -823,7 +823,7 @@ GLContextGLX::CreateGLContext(CreateContextFlags flags, const SurfaceCaps& caps,
     RefPtr<GLContextGLX> glContext;
     bool error;
 
-    ScopedXErrorHandler xErrorHandler;
+    OffMainThreadScopedXErrorHandler xErrorHandler;
 
     do {
         error = false;
@@ -1311,7 +1311,7 @@ CreateOffscreenPixmapContext(CreateContextFlags flags, const IntSize& size,
     int depth;
     FindVisualAndDepth(display, visid, &visual, &depth);
 
-    ScopedXErrorHandler xErrorHandler;
+    OffMainThreadScopedXErrorHandler xErrorHandler;
     bool error = false;
 
     Drawable drawable;
diff --git a/gfx/src/X11Util.cpp b/gfx/src/X11Util.cpp
index e1492be54511..7dd02d2fd7a8 100644
--- a/gfx/src/X11Util.cpp
+++ b/gfx/src/X11Util.cpp
@@ -57,13 +57,15 @@ ScopedXErrorHandler::ErrorHandler(Display *, XErrorEvent *ev)
     return 0;
 }
 
-ScopedXErrorHandler::ScopedXErrorHandler()
+ScopedXErrorHandler::ScopedXErrorHandler(bool aAllowOffMainThread)
 {
-    // Off main thread usage is not safe in general, but OMTC GL layers uses this
-    // with the main thread blocked, which makes it safe.
-    NS_WARNING_ASSERTION(
+    if (!aAllowOffMainThread) {
+      // Off main thread usage is not safe in general, but OMTC GL layers uses this
+      // with the main thread blocked, which makes it safe.
+      NS_WARNING_ASSERTION(
         NS_IsMainThread(),
         "ScopedXErrorHandler being called off main thread, may cause issues");
+    }
     // let sXErrorPtr point to this object's mXError object, but don't reset this mXError object!
     // think of the case of nested ScopedXErrorHandler's.
     mOldXErrorPtr = sXErrorPtr;
diff --git a/gfx/src/X11Util.h b/gfx/src/X11Util.h
index dff855ff23f9..83944d5c053c 100644
--- a/gfx/src/X11Util.h
+++ b/gfx/src/X11Util.h
@@ -118,7 +118,10 @@ public:
     static int
     ErrorHandler(Display *, XErrorEvent *ev);
 
-    ScopedXErrorHandler();
+    /**
+     * @param aAllowOffMainThread whether to warn if used off main thread
+     */
+    ScopedXErrorHandler(bool aAllowOffMainThread = false);
 
     ~ScopedXErrorHandler();
 
@@ -131,6 +134,15 @@ public:
     bool SyncAndGetError(Display *dpy, XErrorEvent *ev = nullptr);
 };
 
+class OffMainThreadScopedXErrorHandler : public ScopedXErrorHandler
+{
+public:
+  OffMainThreadScopedXErrorHandler()
+    : ScopedXErrorHandler(true)
+  {
+  }
+};
+
 } // namespace mozilla
 
 #endif  // mozilla_X11Util_h

From 7505d76cd191aee63354788f8baea700007d0481 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Tue, 27 Sep 2016 16:39:47 +0200
Subject: [PATCH 042/102] Bug 1304910 - Adding a test about
 nsTemporaryFileInputStream and PSendStream, r=jdm

--HG--
rename : dom/media/test/test_mediarecorder_record_canvas_captureStream.html => dom/media/test/test_temporary_file_blob_video_plays.html
---
 dom/media/test/mochitest.ini                  |  1 +
 .../test_temporary_file_blob_video_plays.html | 73 +++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 dom/media/test/test_temporary_file_blob_video_plays.html

diff --git a/dom/media/test/mochitest.ini b/dom/media/test/mochitest.ini
index 8eea66d99db1..87ff31f9ba20 100644
--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@@ -930,3 +930,4 @@ tags = suspend
 tags = suspend
 [test_background_video_no_suspend_disabled.html]
 tags = suspend
+[test_temporary_file_blob_video_plays.html]
diff --git a/dom/media/test/test_temporary_file_blob_video_plays.html b/dom/media/test/test_temporary_file_blob_video_plays.html
new file mode 100644
index 000000000000..c1c1867e791b
--- /dev/null
+++ b/dom/media/test/test_temporary_file_blob_video_plays.html
@@ -0,0 +1,73 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test MediaRecorder Recording canvas stream</title>
+  <script src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script src="/tests/dom/canvas/test/captureStream_common.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<div id="content">
+</div>
+<script class="testbody" type="text/javascript">
+
+function startTest() {
+  var canvas = document.createElement("canvas");
+  canvas.width = canvas.height = 100;
+  document.getElementById("content").appendChild(canvas);
+
+  var helper = new CaptureStreamTestHelper2D(100, 100);
+  helper.drawColor(canvas, helper.red);
+
+  var stream = canvas.captureStream(0);
+
+  var blob;
+
+  mediaRecorder = new MediaRecorder(stream);
+  is(mediaRecorder.stream, stream,
+     "Media recorder stream = canvas stream at the start of recording");
+
+  mediaRecorder.onwarning = () => ok(false, "warning unexpectedly fired");
+
+  mediaRecorder.onerror = () => ok(false, "Recording failed");
+
+  mediaRecorder.ondataavailable = ev => {
+    is(blob, undefined, "Should only get one dataavailable event");
+    blob = ev.data;
+  };
+
+  mediaRecorder.onstart = () => {
+    info("Got 'start' event");
+    // We just want one frame encoded, to see that the recorder produces something readable.
+    mediaRecorder.stop();
+  };
+
+  mediaRecorder.onstop = () => {
+    info("Got 'stop' event");
+    ok(blob, "Should have gotten a data blob");
+
+    var video = document.createElement("video");
+    video.id = "recorded-video";
+    video.src = URL.createObjectURL(blob);
+    video.play();
+    video.onerror = err => {
+      ok(false, "Should be able to play the recording. Got error. code=" + video.error.code);
+      SimpleTest.finish();
+    };
+    document.getElementById("content").appendChild(video);
+    helper.waitForPixelColor(video, helper.red, 128, "Should become red")
+      .then(SimpleTest.finish);
+  };
+
+  mediaRecorder.start();
+  is(mediaRecorder.state, "recording", "Media recorder should be recording");
+}
+
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({set:[["media.recorder.max_memory", 1]]}, startTest);
+
+</script>
+</pre>
+</body>
+</html>

From ea2599961bd94f1830961c729c67363ad3f2e73f Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Tue, 27 Sep 2016 16:56:20 +0200
Subject: [PATCH 043/102] Backed out changeset 3eb2ceb66ec5 (bug 1304195) for
 static build bustage

---
 gfx/gl/GLContextProviderGLX.cpp |  4 ++--
 gfx/src/X11Util.cpp             | 10 ++++------
 gfx/src/X11Util.h               | 14 +-------------
 3 files changed, 7 insertions(+), 21 deletions(-)

diff --git a/gfx/gl/GLContextProviderGLX.cpp b/gfx/gl/GLContextProviderGLX.cpp
index 9a1157f330cb..03df3c6d7014 100644
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@@ -823,7 +823,7 @@ GLContextGLX::CreateGLContext(CreateContextFlags flags, const SurfaceCaps& caps,
     RefPtr<GLContextGLX> glContext;
     bool error;
 
-    OffMainThreadScopedXErrorHandler xErrorHandler;
+    ScopedXErrorHandler xErrorHandler;
 
     do {
         error = false;
@@ -1311,7 +1311,7 @@ CreateOffscreenPixmapContext(CreateContextFlags flags, const IntSize& size,
     int depth;
     FindVisualAndDepth(display, visid, &visual, &depth);
 
-    OffMainThreadScopedXErrorHandler xErrorHandler;
+    ScopedXErrorHandler xErrorHandler;
     bool error = false;
 
     Drawable drawable;
diff --git a/gfx/src/X11Util.cpp b/gfx/src/X11Util.cpp
index 7dd02d2fd7a8..e1492be54511 100644
--- a/gfx/src/X11Util.cpp
+++ b/gfx/src/X11Util.cpp
@@ -57,15 +57,13 @@ ScopedXErrorHandler::ErrorHandler(Display *, XErrorEvent *ev)
     return 0;
 }
 
-ScopedXErrorHandler::ScopedXErrorHandler(bool aAllowOffMainThread)
+ScopedXErrorHandler::ScopedXErrorHandler()
 {
-    if (!aAllowOffMainThread) {
-      // Off main thread usage is not safe in general, but OMTC GL layers uses this
-      // with the main thread blocked, which makes it safe.
-      NS_WARNING_ASSERTION(
+    // Off main thread usage is not safe in general, but OMTC GL layers uses this
+    // with the main thread blocked, which makes it safe.
+    NS_WARNING_ASSERTION(
         NS_IsMainThread(),
         "ScopedXErrorHandler being called off main thread, may cause issues");
-    }
     // let sXErrorPtr point to this object's mXError object, but don't reset this mXError object!
     // think of the case of nested ScopedXErrorHandler's.
     mOldXErrorPtr = sXErrorPtr;
diff --git a/gfx/src/X11Util.h b/gfx/src/X11Util.h
index 83944d5c053c..dff855ff23f9 100644
--- a/gfx/src/X11Util.h
+++ b/gfx/src/X11Util.h
@@ -118,10 +118,7 @@ public:
     static int
     ErrorHandler(Display *, XErrorEvent *ev);
 
-    /**
-     * @param aAllowOffMainThread whether to warn if used off main thread
-     */
-    ScopedXErrorHandler(bool aAllowOffMainThread = false);
+    ScopedXErrorHandler();
 
     ~ScopedXErrorHandler();
 
@@ -134,15 +131,6 @@ public:
     bool SyncAndGetError(Display *dpy, XErrorEvent *ev = nullptr);
 };
 
-class OffMainThreadScopedXErrorHandler : public ScopedXErrorHandler
-{
-public:
-  OffMainThreadScopedXErrorHandler()
-    : ScopedXErrorHandler(true)
-  {
-  }
-};
-
 } // namespace mozilla
 
 #endif  // mozilla_X11Util_h

From d17a96db4af11d0274eeaefeff5d4664c56d4b3c Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:40 +0200
Subject: [PATCH 044/102] Bug 1255393 part 1 - [css-grid] Introduce a
 SizingConstraint enum type.  r=dholbert

---
 layout/generic/nsGridContainerFrame.cpp | 54 +++++++++++++++----------
 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 7a4ed142fed4..dc00afa82b7a 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -44,6 +44,14 @@ enum BaselineSharingGroup
   eLast = 1,
 };
 
+// https://drafts.csswg.org/css-sizing/#constraints
+enum class SizingConstraint
+{
+  eMinContent,  // sizing under min-content constraint
+  eMaxContent,  // sizing under max-content constraint
+  eNoConstraint // no constraint, used during Reflow
+};
+
 static void
 ReparentFrame(nsIFrame* aFrame, nsContainerFrame* aOldParent,
               nsContainerFrame* aNewParent)
@@ -1127,13 +1135,13 @@ struct nsGridContainerFrame::Tracks
    * Return true if aRange spans at least one track with an intrinsic sizing
    * function and does not span any tracks with a <flex> max-sizing function.
    * @param aRange the span of tracks to check
-   * @param aConstraint if MIN_ISIZE, treat a <flex> min-sizing as 'min-content'
+   * @param aConstraint if eMinContent, treat a <flex> min-sizing as 'min-content'
    * @param aState will be set to the union of the state bits of all the spanned
    *               tracks, unless a flex track is found - then it only contains
    *               the union of the tracks up to and including the flex track.
    */
   bool HasIntrinsicButNoFlexSizingInRange(const LineRange&      aRange,
-                                          IntrinsicISizeType    aConstraint,
+                                          SizingConstraint      aConstraint,
                                           TrackSize::StateBits* aState) const;
 
   // Some data we collect for aligning baseline-aligned items.
@@ -1178,7 +1186,7 @@ struct nsGridContainerFrame::Tracks
                             const TrackSizingFunctions& aFunctions,
                             LineRange GridArea::*       aRange,
                             nscoord                     aPercentageBasis,
-                            IntrinsicISizeType          aConstraint);
+                            SizingConstraint            aConstraint);
 
   /**
    * Helper for ResolveIntrinsicSize.  It implements step 1 "size tracks to fit
@@ -1188,7 +1196,7 @@ struct nsGridContainerFrame::Tracks
   bool ResolveIntrinsicSizeStep1(GridReflowInput&            aState,
                                  const TrackSizingFunctions& aFunctions,
                                  nscoord                     aPercentageBasis,
-                                 IntrinsicISizeType          aConstraint,
+                                 SizingConstraint            aConstraint,
                                  const LineRange&            aRange,
                                  const GridItemInfo&         aGridItem);
   /**
@@ -1547,7 +1555,7 @@ struct nsGridContainerFrame::Tracks
                       const TrackSizingFunctions& aFunctions,
                       nscoord                     aContentSize,
                       LineRange GridArea::*       aRange,
-                      IntrinsicISizeType          aConstraint);
+                      SizingConstraint            aConstraint);
 
   /**
    * Apply 'align/justify-content', whichever is relevant for this axis.
@@ -1866,7 +1874,7 @@ struct MOZ_STACK_CLASS nsGridContainerFrame::GridReflowInput
    */
   void CalculateTrackSizes(const Grid&        aGrid,
                            const LogicalSize& aContentBox,
-                           IntrinsicISizeType aConstraint);
+                           SizingConstraint   aConstraint);
 
   /**
    * Return the containing block for a grid item occupying aArea.
@@ -2331,7 +2339,7 @@ void
 nsGridContainerFrame::GridReflowInput::CalculateTrackSizes(
   const Grid&        aGrid,
   const LogicalSize& aContentBox,
-  IntrinsicISizeType aConstraint)
+  SizingConstraint   aConstraint)
 {
   mCols.Initialize(mColFunctions, mGridStyle->mGridColumnGap,
                    aGrid.mGridColEnd, aContentBox.ISize(mWM));
@@ -3702,7 +3710,7 @@ nsGridContainerFrame::Tracks::CalculateSizes(
   const TrackSizingFunctions& aFunctions,
   nscoord                     aContentBoxSize,
   LineRange GridArea::*       aRange,
-  IntrinsicISizeType          aConstraint)
+  SizingConstraint            aConstraint)
 {
   nscoord percentageBasis = aContentBoxSize;
   if (percentageBasis == NS_UNCONSTRAINEDSIZE) {
@@ -3711,7 +3719,7 @@ nsGridContainerFrame::Tracks::CalculateSizes(
   InitializeItemBaselines(aState, aGridItems);
   ResolveIntrinsicSize(aState, aGridItems, aFunctions, aRange, percentageBasis,
                        aConstraint);
-  if (aConstraint != nsLayoutUtils::MIN_ISIZE) {
+  if (aConstraint != SizingConstraint::eMinContent) {
     nscoord freeSpace = aContentBoxSize;
     if (freeSpace != NS_UNCONSTRAINEDSIZE) {
       freeSpace -= SumOfGridGaps();
@@ -3724,7 +3732,7 @@ nsGridContainerFrame::Tracks::CalculateSizes(
 bool
 nsGridContainerFrame::Tracks::HasIntrinsicButNoFlexSizingInRange(
   const LineRange&      aRange,
-  IntrinsicISizeType    aConstraint,
+  SizingConstraint      aConstraint,
   TrackSize::StateBits* aState) const
 {
   MOZ_ASSERT(!aRange.IsAuto(), "must have a definite range");
@@ -3733,8 +3741,8 @@ nsGridContainerFrame::Tracks::HasIntrinsicButNoFlexSizingInRange(
   const TrackSize::StateBits selector =
     TrackSize::eIntrinsicMinSizing |
     TrackSize::eIntrinsicMaxSizing |
-    (aConstraint == nsLayoutUtils::MIN_ISIZE ? TrackSize::eFlexMinSizing
-                                             : TrackSize::StateBits(0));
+    (aConstraint == SizingConstraint::eMinContent ? TrackSize::eFlexMinSizing :
+                                                    TrackSize::StateBits(0));
   bool foundIntrinsic = false;
   for (uint32_t i = start; i < end; ++i) {
     TrackSize::StateBits state = mSizes[i].mState;
@@ -3754,7 +3762,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
   GridReflowInput&            aState,
   const TrackSizingFunctions& aFunctions,
   nscoord                     aPercentageBasis,
-  IntrinsicISizeType          aConstraint,
+  SizingConstraint            aConstraint,
   const LineRange&            aRange,
   const GridItemInfo&         aGridItem)
 {
@@ -3768,7 +3776,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
     nscoord s = MinSize(aGridItem, aState, rc, wm, mAxis);
     sz.mBase = std::max(sz.mBase, s);
   } else if ((sz.mState & TrackSize::eMinContentMinSizing) ||
-             (aConstraint == nsLayoutUtils::MIN_ISIZE &&
+             (aConstraint == SizingConstraint::eMinContent &&
               (sz.mState & TrackSize::eFlexMinSizing))) {
     nscoord s = MinContentContribution(aGridItem, aState, rc, wm, mAxis);
     minContentContribution.emplace(s);
@@ -4083,7 +4091,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
   const TrackSizingFunctions& aFunctions,
   LineRange GridArea::*       aRange,
   nscoord                     aPercentageBasis,
-  IntrinsicISizeType          aConstraint)
+  SizingConstraint            aConstraint)
 {
   // Some data we collect on each item for Step 2 of the algorithm below.
   struct Step2ItemData
@@ -4111,9 +4119,9 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
   nsRenderingContext* rc = &aState.mRenderingContext;
   WritingMode wm = aState.mWM;
   uint32_t maxSpan = 0; // max span of the step2Items items
-  const TrackSize::StateBits flexMin =
-    aConstraint == nsLayoutUtils::MIN_ISIZE ? TrackSize::eFlexMinSizing
-                                            : TrackSize::StateBits(0);
+  TrackSize::StateBits flexMin =
+    aConstraint == SizingConstraint::eMinContent ? TrackSize::eFlexMinSizing :
+                                                   TrackSize::StateBits(0);
   iter.Reset();
   for (; !iter.AtEnd(); iter.Next()) {
     auto& gridItem = aGridItems[iter.GridItemIndex()];
@@ -5694,7 +5702,7 @@ nsGridContainerFrame::Reflow(nsPresContext*           aPresContext,
                         computedSize, aReflowInput.ComputedMaxSize());
 
     gridReflowInput.CalculateTrackSizes(grid, computedSize,
-                                        nsLayoutUtils::PREF_ISIZE);
+                                        SizingConstraint::eNoConstraint);
   } else {
     consumedBSize = GetConsumedBSize();
     gridReflowInput.InitializeForContinuation(this, consumedBSize);
@@ -5977,11 +5985,11 @@ nsGridContainerFrame::Reflow(nsPresContext*           aPresContext,
 
 nscoord
 nsGridContainerFrame::IntrinsicISize(nsRenderingContext* aRenderingContext,
-                                     IntrinsicISizeType  aConstraint)
+                                     IntrinsicISizeType  aType)
 {
   RenumberList();
 
-  // Calculate the sum of column sizes under aConstraint.
+  // Calculate the sum of column sizes under intrinsic sizing.
   // http://dev.w3.org/csswg/css-grid/#intrinsic-sizes
   GridReflowInput state(this, *aRenderingContext);
   InitImplicitNamedAreas(state.mGridStyle); // XXX optimize
@@ -6035,9 +6043,11 @@ nsGridContainerFrame::IntrinsicISize(nsRenderingContext* aRenderingContext,
   }
   state.mCols.Initialize(state.mColFunctions, state.mGridStyle->mGridColumnGap,
                          grid.mGridColEnd, NS_UNCONSTRAINEDSIZE);
+  auto constraint = aType == nsLayoutUtils::MIN_ISIZE ?
+    SizingConstraint::eMinContent : SizingConstraint::eMaxContent;
   state.mCols.CalculateSizes(state, state.mGridItems, state.mColFunctions,
                              NS_UNCONSTRAINEDSIZE, &GridArea::mCols,
-                             aConstraint);
+                             constraint);
   nscoord length = 0;
   for (const TrackSize& sz : state.mCols.mSizes) {
     length += sz.mBase;

From 0f91dea2f76e6807c8acdfa61f2c6bcc9aec980b Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:40 +0200
Subject: [PATCH 045/102] Bug 1255393 part 2 - [css-grid] Update MinSize() to
 reflect the latest spec text for min-size contribution.  r=dholbert

https://drafts.csswg.org/css-grid/#min-size-contributions
---
 layout/generic/nsGridContainerFrame.cpp | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index dc00afa82b7a..8927c46461d8 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -3664,6 +3664,8 @@ MaxContentContribution(const GridItemInfo&    aGridItem,
                              nsLayoutUtils::PREF_ISIZE);
 }
 
+// Computes the min-size contribution for a grid item, as defined at
+// https://drafts.csswg.org/css-grid/#min-size-contributions
 static nscoord
 MinSize(const GridItemInfo&    aGridItem,
         const GridReflowInput& aState,
@@ -3674,8 +3676,12 @@ MinSize(const GridItemInfo&    aGridItem,
   nsIFrame* child = aGridItem.mFrame;
   PhysicalAxis axis(aCBWM.PhysicalAxis(aAxis));
   const nsStylePosition* stylePos = child->StylePosition();
-  const nsStyleCoord& style = axis == eAxisHorizontal ? stylePos->mMinWidth
-                                                      : stylePos->mMinHeight;
+  const nsStyleCoord& sizeStyle =
+    axis == eAxisHorizontal ? stylePos->mWidth : stylePos->mHeight;
+  if (sizeStyle.GetUnit() != eStyleUnit_Auto) {
+    return MinContentContribution(aGridItem, aState, aRC, aCBWM, aAxis);
+  }
+
   // https://drafts.csswg.org/css-grid/#min-size-auto
   // This calculates the min-content contribution from either a definite
   // min-width (or min-height depending on aAxis), or the "specified /
@@ -3690,6 +3696,8 @@ MinSize(const GridItemInfo&    aGridItem,
   nscoord sz = aGridItem.mBaselineOffset[aAxis] +
     nsLayoutUtils::MinSizeContributionForAxis(axis, aRC, child,
                                               nsLayoutUtils::MIN_ISIZE);
+  const nsStyleCoord& style = axis == eAxisHorizontal ? stylePos->mMinWidth
+                                                      : stylePos->mMinHeight;
   auto unit = style.GetUnit();
   if (unit == eStyleUnit_Enumerated ||
       (unit == eStyleUnit_Auto &&

From 9ab65db5db84bb94c99727e89f806d0bb2a9d001 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:40 +0200
Subject: [PATCH 046/102] Bug 1255393 part 3 - [css-grid] Update 'auto' min
 track sizing for span=1 to the latest Grid spec.  r=dholbert

Now it returns the min/max-content contribution for intrinsic sizing.
Otherwise, i.e. during Reflow, return the min-size contribution.
(Previously, it always returned the min-size contribution.)
https://drafts.csswg.org/css-grid/#algo-content
---
 layout/generic/nsGridContainerFrame.cpp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 8927c46461d8..ee61aa66bf35 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -3781,7 +3781,15 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
   WritingMode wm = aState.mWM;
   nsRenderingContext* rc = &aState.mRenderingContext;
   if (sz.mState & TrackSize::eAutoMinSizing) {
-    nscoord s = MinSize(aGridItem, aState, rc, wm, mAxis);
+    nscoord s;
+    if (aConstraint == SizingConstraint::eMinContent) {
+      s = MinContentContribution(aGridItem, aState, rc, wm, mAxis);
+    } else if (aConstraint == SizingConstraint::eMaxContent) {
+      s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis);
+    } else {
+      MOZ_ASSERT(aConstraint == SizingConstraint::eNoConstraint);
+      s = MinSize(aGridItem, aState, rc, wm, mAxis);
+    }
     sz.mBase = std::max(sz.mBase, s);
   } else if ((sz.mState & TrackSize::eMinContentMinSizing) ||
              (aConstraint == SizingConstraint::eMinContent &&

From 9aa8eef809d46d2ff7d10b79a5746e6ef6f4f03b Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:41 +0200
Subject: [PATCH 047/102] Bug 1255393 part 4 - [css-grid] Cache min/max-content
 and min-size contributions better.  r=dholbert

---
 layout/generic/nsGridContainerFrame.cpp | 91 +++++++++++++++----------
 1 file changed, 56 insertions(+), 35 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index ee61aa66bf35..7353a5374114 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -3642,15 +3642,28 @@ ContentContribution(const GridItemInfo&               aGridItem,
   return std::max(size, 0);
 }
 
+struct CachedIntrinsicSizes
+{
+  Maybe<nscoord> mMinSize;
+  Maybe<nscoord> mMinContentContribution;
+  Maybe<nscoord> mMaxContentContribution;
+};
+
 static nscoord
 MinContentContribution(const GridItemInfo&    aGridItem,
                        const GridReflowInput& aState,
                        nsRenderingContext*    aRC,
                        WritingMode            aCBWM,
-                       LogicalAxis            aAxis)
+                       LogicalAxis            aAxis,
+                       CachedIntrinsicSizes*  aCache)
 {
-  return ContentContribution(aGridItem, aState, aRC, aCBWM, aAxis,
-                             nsLayoutUtils::MIN_ISIZE);
+  if (aCache->mMinContentContribution.isSome()) {
+    return aCache->mMinContentContribution.value();
+  }
+  nscoord s = ContentContribution(aGridItem, aState, aRC, aCBWM, aAxis,
+                                  nsLayoutUtils::MIN_ISIZE);
+  aCache->mMinContentContribution.emplace(s);
+  return s;
 }
 
 static nscoord
@@ -3658,10 +3671,16 @@ MaxContentContribution(const GridItemInfo&    aGridItem,
                        const GridReflowInput& aState,
                        nsRenderingContext*    aRC,
                        WritingMode            aCBWM,
-                       LogicalAxis            aAxis)
+                       LogicalAxis            aAxis,
+                       CachedIntrinsicSizes*  aCache)
 {
-  return ContentContribution(aGridItem, aState, aRC, aCBWM, aAxis,
-                             nsLayoutUtils::PREF_ISIZE);
+  if (aCache->mMaxContentContribution.isSome()) {
+    return aCache->mMaxContentContribution.value();
+  }
+  nscoord s = ContentContribution(aGridItem, aState, aRC, aCBWM, aAxis,
+                                  nsLayoutUtils::PREF_ISIZE);
+  aCache->mMaxContentContribution.emplace(s);
+  return s;
 }
 
 // Computes the min-size contribution for a grid item, as defined at
@@ -3671,15 +3690,22 @@ MinSize(const GridItemInfo&    aGridItem,
         const GridReflowInput& aState,
         nsRenderingContext*    aRC,
         WritingMode            aCBWM,
-        LogicalAxis            aAxis)
+        LogicalAxis            aAxis,
+        CachedIntrinsicSizes*  aCache)
 {
+  if (aCache->mMinSize.isSome()) {
+    return aCache->mMinSize.value();
+  }
   nsIFrame* child = aGridItem.mFrame;
   PhysicalAxis axis(aCBWM.PhysicalAxis(aAxis));
   const nsStylePosition* stylePos = child->StylePosition();
   const nsStyleCoord& sizeStyle =
     axis == eAxisHorizontal ? stylePos->mWidth : stylePos->mHeight;
   if (sizeStyle.GetUnit() != eStyleUnit_Auto) {
-    return MinContentContribution(aGridItem, aState, aRC, aCBWM, aAxis);
+    nscoord s =
+      MinContentContribution(aGridItem, aState, aRC, aCBWM, aAxis, aCache);
+    aCache->mMinSize.emplace(s);
+    return s;
   }
 
   // https://drafts.csswg.org/css-grid/#min-size-auto
@@ -3708,6 +3734,7 @@ MinSize(const GridItemInfo&    aGridItem,
                                           nsLayoutUtils::MIN_ISIZE,
                                           nsLayoutUtils::MIN_INTRINSIC_ISIZE));
   }
+  aCache->mMinSize.emplace(sz);
   return sz;
 }
 
@@ -3774,8 +3801,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
   const LineRange&            aRange,
   const GridItemInfo&         aGridItem)
 {
-  Maybe<nscoord> minContentContribution;
-  Maybe<nscoord> maxContentContribution;
+  CachedIntrinsicSizes cache;
   // min sizing
   TrackSize& sz = mSizes[aRange.mStart];
   WritingMode wm = aState.mWM;
@@ -3783,46 +3809,38 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
   if (sz.mState & TrackSize::eAutoMinSizing) {
     nscoord s;
     if (aConstraint == SizingConstraint::eMinContent) {
-      s = MinContentContribution(aGridItem, aState, rc, wm, mAxis);
+      s = MinContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
     } else if (aConstraint == SizingConstraint::eMaxContent) {
-      s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis);
+      s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
     } else {
       MOZ_ASSERT(aConstraint == SizingConstraint::eNoConstraint);
-      s = MinSize(aGridItem, aState, rc, wm, mAxis);
+      s = MinSize(aGridItem, aState, rc, wm, mAxis, &cache);
     }
     sz.mBase = std::max(sz.mBase, s);
   } else if ((sz.mState & TrackSize::eMinContentMinSizing) ||
              (aConstraint == SizingConstraint::eMinContent &&
               (sz.mState & TrackSize::eFlexMinSizing))) {
-    nscoord s = MinContentContribution(aGridItem, aState, rc, wm, mAxis);
-    minContentContribution.emplace(s);
-    sz.mBase = std::max(sz.mBase, minContentContribution.value());
+    auto s = MinContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
+    sz.mBase = std::max(sz.mBase, s);
   } else if (sz.mState & TrackSize::eMaxContentMinSizing) {
-    nscoord s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis);
-    maxContentContribution.emplace(s);
-    sz.mBase = std::max(sz.mBase, maxContentContribution.value());
+    auto s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
+    sz.mBase = std::max(sz.mBase, s);
   }
   // max sizing
   if (sz.mState & TrackSize::eMinContentMaxSizing) {
-    if (minContentContribution.isNothing()) {
-      nscoord s = MinContentContribution(aGridItem, aState, rc, wm, mAxis);
-      minContentContribution.emplace(s);
-    }
+    auto s = MinContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
     if (sz.mLimit == NS_UNCONSTRAINEDSIZE) {
-      sz.mLimit = minContentContribution.value();
+      sz.mLimit = s;
     } else {
-      sz.mLimit = std::max(sz.mLimit, minContentContribution.value());
+      sz.mLimit = std::max(sz.mLimit, s);
     }
   } else if (sz.mState & (TrackSize::eAutoMaxSizing |
                           TrackSize::eMaxContentMaxSizing)) {
-    if (maxContentContribution.isNothing()) {
-      nscoord s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis);
-      maxContentContribution.emplace(s);
-    }
+    auto s = MaxContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
     if (sz.mLimit == NS_UNCONSTRAINEDSIZE) {
-      sz.mLimit = maxContentContribution.value();
+      sz.mLimit = s;
     } else {
-      sz.mLimit = std::max(sz.mLimit, maxContentContribution.value());
+      sz.mLimit = std::max(sz.mLimit, s);
     }
     if (MOZ_UNLIKELY(sz.mState & TrackSize::eFitContent)) {
       // Clamp mLimit to the fit-content() size, for §12.5.1.
@@ -4163,21 +4181,22 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
           }
         }
         stateBitsPerSpan[span] |= state;
+        CachedIntrinsicSizes cache;
         nscoord minSize = 0;
         if (state & (flexMin | TrackSize::eIntrinsicMinSizing)) { // for 2.1
-          minSize = MinSize(gridItem, aState, rc, wm, mAxis);
+          minSize = MinSize(gridItem, aState, rc, wm, mAxis, &cache);
         }
         nscoord minContent = 0;
         if (state & (flexMin | TrackSize::eMinOrMaxContentMinSizing | // for 2.2
                      TrackSize::eIntrinsicMaxSizing)) {               // for 2.5
           minContent = MinContentContribution(gridItem, aState,
-                                              rc, wm, mAxis);
+                                              rc, wm, mAxis, &cache);
         }
         nscoord maxContent = 0;
         if (state & (TrackSize::eMaxContentMinSizing |         // for 2.3
                      TrackSize::eAutoOrMaxContentMaxSizing)) { // for 2.6
           maxContent = MaxContentContribution(gridItem, aState,
-                                              rc, wm, mAxis);
+                                              rc, wm, mAxis, &cache);
         }
         step2Items.AppendElement(
           Step2ItemData({span, state, lineRange, minSize,
@@ -4439,7 +4458,9 @@ nsGridContainerFrame::Tracks::FindUsedFlexFraction(
   for (; !iter.AtEnd(); iter.Next()) {
     const GridItemInfo& item = aGridItems[iter.GridItemIndex()];
     if (item.mState[mAxis] & ItemState::eIsFlexing) {
-      nscoord spaceToFill = MaxContentContribution(item, aState, rc, wm, mAxis);
+      // XXX optimize: bug 1194446
+      nscoord spaceToFill = ContentContribution(item, aState, rc, wm, mAxis,
+                                                nsLayoutUtils::PREF_ISIZE);
       if (spaceToFill <= 0) {
         continue;
       }

From 7a1dca9913fe52c9ebcd8c99a8bd520f049a9a59 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:41 +0200
Subject: [PATCH 048/102] Bug 1255393 part 5 - [css-grid] Remove dead code
 related to obsolete flex track min-sizing.  r=dholbert

---
 layout/generic/nsGridContainerFrame.cpp | 41 ++++++++-----------------
 1 file changed, 13 insertions(+), 28 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 7353a5374114..a69ce5300c21 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -146,7 +146,7 @@ struct nsGridContainerFrame::TrackSize
     eMaxContentMinSizing =     0x4,
     eMinOrMaxContentMinSizing = eMinContentMinSizing | eMaxContentMinSizing,
     eIntrinsicMinSizing = eMinOrMaxContentMinSizing | eAutoMinSizing,
-    eFlexMinSizing =           0x8, // not really used ATM due to a spec change
+    // 0x8 is unused, feel free to take it!
     eAutoMaxSizing =          0x10,
     eMinContentMaxSizing =    0x20,
     eMaxContentMaxSizing =    0x40,
@@ -1135,13 +1135,11 @@ struct nsGridContainerFrame::Tracks
    * Return true if aRange spans at least one track with an intrinsic sizing
    * function and does not span any tracks with a <flex> max-sizing function.
    * @param aRange the span of tracks to check
-   * @param aConstraint if eMinContent, treat a <flex> min-sizing as 'min-content'
    * @param aState will be set to the union of the state bits of all the spanned
    *               tracks, unless a flex track is found - then it only contains
    *               the union of the tracks up to and including the flex track.
    */
   bool HasIntrinsicButNoFlexSizingInRange(const LineRange&      aRange,
-                                          SizingConstraint      aConstraint,
                                           TrackSize::StateBits* aState) const;
 
   // Some data we collect for aligning baseline-aligned items.
@@ -1367,17 +1365,15 @@ struct nsGridContainerFrame::Tracks
     MOZ_ASSERT(aAvailableSpace > 0 && aGrowableTracks.Length() > 0);
     uint32_t numGrowable = aGrowableTracks.Length();
     if (aSelector) {
-      DebugOnly<TrackSize::StateBits> withoutFlexMin =
-        TrackSize::StateBits(aSelector & ~TrackSize::eFlexMinSizing);
-      MOZ_ASSERT(withoutFlexMin == TrackSize::eIntrinsicMinSizing ||
-                 withoutFlexMin == TrackSize::eMinOrMaxContentMinSizing ||
-                 withoutFlexMin == TrackSize::eMaxContentMinSizing);
+      MOZ_ASSERT(aSelector == (aSelector & TrackSize::eIntrinsicMinSizing) &&
+                 (aSelector & TrackSize::eMaxContentMinSizing),
+                 "Should only get here for track sizing steps 2.1 to 2.3");
       // Note that eMaxContentMinSizing is always included. We do those first:
       numGrowable = MarkExcludedTracks(aPlan, numGrowable, aGrowableTracks,
                                        TrackSize::eMaxContentMinSizing,
                                        TrackSize::eMaxContentMaxSizing,
                                        TrackSize::eSkipGrowUnlimited1);
-      // Now mark min-content/auto/<flex> min-sizing tracks if requested.
+      // Now mark min-content/auto min-sizing tracks if requested.
       auto minOrAutoSelector = aSelector & ~TrackSize::eMaxContentMinSizing;
       if (minOrAutoSelector) {
         numGrowable = MarkExcludedTracks(aPlan, numGrowable, aGrowableTracks,
@@ -3767,17 +3763,13 @@ nsGridContainerFrame::Tracks::CalculateSizes(
 bool
 nsGridContainerFrame::Tracks::HasIntrinsicButNoFlexSizingInRange(
   const LineRange&      aRange,
-  SizingConstraint      aConstraint,
   TrackSize::StateBits* aState) const
 {
   MOZ_ASSERT(!aRange.IsAuto(), "must have a definite range");
   const uint32_t start = aRange.mStart;
   const uint32_t end = aRange.mEnd;
   const TrackSize::StateBits selector =
-    TrackSize::eIntrinsicMinSizing |
-    TrackSize::eIntrinsicMaxSizing |
-    (aConstraint == SizingConstraint::eMinContent ? TrackSize::eFlexMinSizing :
-                                                    TrackSize::StateBits(0));
+    TrackSize::eIntrinsicMinSizing | TrackSize::eIntrinsicMaxSizing;
   bool foundIntrinsic = false;
   for (uint32_t i = start; i < end; ++i) {
     TrackSize::StateBits state = mSizes[i].mState;
@@ -3817,9 +3809,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(
       s = MinSize(aGridItem, aState, rc, wm, mAxis, &cache);
     }
     sz.mBase = std::max(sz.mBase, s);
-  } else if ((sz.mState & TrackSize::eMinContentMinSizing) ||
-             (aConstraint == SizingConstraint::eMinContent &&
-              (sz.mState & TrackSize::eFlexMinSizing))) {
+  } else if (sz.mState & TrackSize::eMinContentMinSizing) {
     auto s = MinContentContribution(aGridItem, aState, rc, wm, mAxis, &cache);
     sz.mBase = std::max(sz.mBase, s);
   } else if (sz.mState & TrackSize::eMaxContentMinSizing) {
@@ -4153,9 +4143,6 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
   nsRenderingContext* rc = &aState.mRenderingContext;
   WritingMode wm = aState.mWM;
   uint32_t maxSpan = 0; // max span of the step2Items items
-  TrackSize::StateBits flexMin =
-    aConstraint == SizingConstraint::eMinContent ? TrackSize::eFlexMinSizing :
-                                                   TrackSize::StateBits(0);
   iter.Reset();
   for (; !iter.AtEnd(); iter.Next()) {
     auto& gridItem = aGridItems[iter.GridItemIndex()];
@@ -4170,7 +4157,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
       }
     } else {
       TrackSize::StateBits state = TrackSize::StateBits(0);
-      if (HasIntrinsicButNoFlexSizingInRange(lineRange, aConstraint, &state)) {
+      if (HasIntrinsicButNoFlexSizingInRange(lineRange, &state)) {
         // Collect data for Step 2.
         maxSpan = std::max(maxSpan, span);
         if (span >= stateBitsPerSpan.Length()) {
@@ -4183,12 +4170,12 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
         stateBitsPerSpan[span] |= state;
         CachedIntrinsicSizes cache;
         nscoord minSize = 0;
-        if (state & (flexMin | TrackSize::eIntrinsicMinSizing)) { // for 2.1
+        if (state & TrackSize::eIntrinsicMinSizing) { // for 2.1
           minSize = MinSize(gridItem, aState, rc, wm, mAxis, &cache);
         }
         nscoord minContent = 0;
-        if (state & (flexMin | TrackSize::eMinOrMaxContentMinSizing | // for 2.2
-                     TrackSize::eIntrinsicMaxSizing)) {               // for 2.5
+        if (state & (TrackSize::eMinOrMaxContentMinSizing | // for 2.2
+                     TrackSize::eIntrinsicMaxSizing)) {     // for 2.5
           minContent = MinContentContribution(gridItem, aState,
                                               rc, wm, mAxis, &cache);
         }
@@ -4229,7 +4216,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
       }
 
       bool updatedBase = false; // Did we update any mBase in step 2.1 - 2.3?
-      TrackSize::StateBits selector(flexMin | TrackSize::eIntrinsicMinSizing);
+      TrackSize::StateBits selector(TrackSize::eIntrinsicMinSizing);
       if (stateBitsPerSpan[span] & selector) {
         // Step 2.1 MinSize to intrinsic min-sizing.
         for (i = spanGroupStartIndex; i < spanGroupEndIndex; ++i) {
@@ -4251,7 +4238,7 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
         }
       }
 
-      selector = flexMin | TrackSize::eMinOrMaxContentMinSizing;
+      selector = TrackSize::eMinOrMaxContentMinSizing;
       if (stateBitsPerSpan[span] & selector) {
         // Step 2.2 MinContentContribution to min-/max-content min-sizing.
         for (i = spanGroupStartIndex; i < spanGroupEndIndex; ++i) {
@@ -6335,8 +6322,6 @@ nsGridContainerFrame::TrackSize::Dump() const
     printf("min-content ");
   } else if (mState & eMaxContentMinSizing) {
     printf("max-content ");
-  } else if (mState & eFlexMinSizing) {
-    printf("flex ");
   }
 
   printf(" max:");

From cd4c23a4132978500eff30232dff510aaf6528fb Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:41 +0200
Subject: [PATCH 049/102] Bug 1255393 part 6 - [css-grid] Update 'auto' min
 track sizing for span>1 to the latest Grid spec.  r=dholbert

'auto' tracks now also gets an item's min/max-content contribution
(in 2.2/2.3) when sizing under a min/max-content constraint.
(Previously, 'auto' only got the min-size contribution under 2.1)
https://drafts.csswg.org/css-grid/#algo-content
---
 layout/generic/nsGridContainerFrame.cpp | 34 ++++++++++++++++---------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index a69ce5300c21..09854fc9671e 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -4143,6 +4143,15 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
   nsRenderingContext* rc = &aState.mRenderingContext;
   WritingMode wm = aState.mWM;
   uint32_t maxSpan = 0; // max span of the step2Items items
+  // Setup track selector for step 2.2:
+  const auto contentBasedMinSelector =
+    aConstraint == SizingConstraint::eMinContent ?
+    TrackSize::eIntrinsicMinSizing : TrackSize::eMinOrMaxContentMinSizing;
+  // Setup track selector for step 2.3:
+  const auto maxContentMinSelector =
+    aConstraint == SizingConstraint::eMaxContent ?
+    (TrackSize::eMaxContentMinSizing | TrackSize::eAutoMinSizing) :
+    TrackSize::eMaxContentMinSizing;
   iter.Reset();
   for (; !iter.AtEnd(); iter.Next()) {
     auto& gridItem = aGridItems[iter.GridItemIndex()];
@@ -4174,13 +4183,13 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
           minSize = MinSize(gridItem, aState, rc, wm, mAxis, &cache);
         }
         nscoord minContent = 0;
-        if (state & (TrackSize::eMinOrMaxContentMinSizing | // for 2.2
-                     TrackSize::eIntrinsicMaxSizing)) {     // for 2.5
+        if (state & (contentBasedMinSelector |          // for 2.2
+                     TrackSize::eIntrinsicMaxSizing)) { // for 2.5
           minContent = MinContentContribution(gridItem, aState,
                                               rc, wm, mAxis, &cache);
         }
         nscoord maxContent = 0;
-        if (state & (TrackSize::eMaxContentMinSizing |         // for 2.3
+        if (state & (maxContentMinSelector |                   // for 2.3
                      TrackSize::eAutoOrMaxContentMaxSizing)) { // for 2.6
           maxContent = MaxContentContribution(gridItem, aState,
                                               rc, wm, mAxis, &cache);
@@ -4238,9 +4247,10 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
         }
       }
 
-      selector = TrackSize::eMinOrMaxContentMinSizing;
+      selector = contentBasedMinSelector;
       if (stateBitsPerSpan[span] & selector) {
-        // Step 2.2 MinContentContribution to min-/max-content min-sizing.
+        // Step 2.2 MinContentContribution to min-/max-content (and 'auto' when
+        // sizing under a min-content constraint) min-sizing.
         for (i = spanGroupStartIndex; i < spanGroupEndIndex; ++i) {
           Step2ItemData& item = step2Items[i];
           if (!(item.mState & selector)) {
@@ -4260,11 +4270,13 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
         }
       }
 
-      if (stateBitsPerSpan[span] & TrackSize::eMaxContentMinSizing) {
-        // Step 2.3 MaxContentContribution to max-content min-sizing.
+      selector = maxContentMinSelector;
+      if (stateBitsPerSpan[span] & selector) {
+        // Step 2.3 MaxContentContribution to max-content (and 'auto' when
+        // sizing under a max-content constraint) min-sizing.
         for (i = spanGroupStartIndex; i < spanGroupEndIndex; ++i) {
           Step2ItemData& item = step2Items[i];
-          if (!(item.mState & TrackSize::eMaxContentMinSizing)) {
+          if (!(item.mState & selector)) {
             continue;
           }
           nscoord space = item.mMaxContentContribution;
@@ -4272,12 +4284,10 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
             continue;
           }
           tracks.ClearAndRetainStorage();
-          space = CollectGrowable(space, mSizes, item.mLineRange,
-                                  TrackSize::eMaxContentMinSizing,
+          space = CollectGrowable(space, mSizes, item.mLineRange, selector,
                                   tracks);
           if (space > 0) {
-            DistributeToTrackBases(space, plan, tracks,
-                                   TrackSize::eMaxContentMinSizing);
+            DistributeToTrackBases(space, plan, tracks, selector);
             updatedBase = true;
           }
         }

From 24e5de8ccb5feb21b2128515c5dd0dd823d2655c Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:41 +0200
Subject: [PATCH 050/102] Bug 1255393 part 7 - [css-grid] Update intrinsic max
 track sizing for span>1 to the latest Grid spec.  r=dholbert

Step 2.5 "For intrinsic maximums" now use the min-size contribution.
https://hg.csswg.org/drafts/diff/575fb847e29d/css-grid/Overview.bs
https://drafts.csswg.org/css-grid/#algo-content
---
 layout/generic/nsGridContainerFrame.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 09854fc9671e..42fec34a9869 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -4179,12 +4179,12 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
         stateBitsPerSpan[span] |= state;
         CachedIntrinsicSizes cache;
         nscoord minSize = 0;
-        if (state & TrackSize::eIntrinsicMinSizing) { // for 2.1
+        if (state & (TrackSize::eIntrinsicMinSizing |   // for 2.1
+                     TrackSize::eIntrinsicMaxSizing)) { // for 2.5
           minSize = MinSize(gridItem, aState, rc, wm, mAxis, &cache);
         }
         nscoord minContent = 0;
-        if (state & (contentBasedMinSelector |          // for 2.2
-                     TrackSize::eIntrinsicMaxSizing)) { // for 2.5
+        if (state & contentBasedMinSelector) { // for 2.2
           minContent = MinContentContribution(gridItem, aState,
                                               rc, wm, mAxis, &cache);
         }
@@ -4311,13 +4311,13 @@ nsGridContainerFrame::Tracks::ResolveIntrinsicSize(
           }
         }
 
-        // Step 2.5 MinContentContribution to intrinsic max-sizing.
+        // Step 2.5 MinSize to intrinsic max-sizing.
         for (i = spanGroupStartIndex; i < spanGroupEndIndex; ++i) {
           Step2ItemData& item = step2Items[i];
           if (!(item.mState & TrackSize::eIntrinsicMaxSizing)) {
             continue;
           }
-          nscoord space = item.mMinContentContribution;
+          nscoord space = item.mMinSize;
           if (space <= 0) {
             continue;
           }

From a35861c69d25a3deafca0ac2acc6aaa55a7d285c Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Tue, 27 Sep 2016 17:05:41 +0200
Subject: [PATCH 051/102] Bug 1255393 part 8 - [css-grid] Add/tweak reftests.

---
 .../grid-auto-min-sizing-percent-001-ref.html | 18 +++++++----
 .../grid-flex-min-sizing-001-ref.html         | 20 ++++++++----
 .../grid-flex-min-sizing-002-ref.html         | 32 +++++++++++--------
 .../css-grid/grid-flex-min-sizing-002.html    |  2 +-
 .../grid-track-percent-sizing-001-ref.html    |  4 +--
 .../css-grid/grid-track-sizing-002-ref.html   |  2 +-
 layout/reftests/css-grid/reftest.list         |  4 +--
 7 files changed, 50 insertions(+), 32 deletions(-)

diff --git a/layout/reftests/css-grid/grid-auto-min-sizing-percent-001-ref.html b/layout/reftests/css-grid/grid-auto-min-sizing-percent-001-ref.html
index 10f0f79f39ef..6a2c240a54ac 100644
--- a/layout/reftests/css-grid/grid-auto-min-sizing-percent-001-ref.html
+++ b/layout/reftests/css-grid/grid-auto-min-sizing-percent-001-ref.html
@@ -45,9 +45,15 @@ br { clear:both; }
 
 #px-border .grid { grid-template-columns: minmax(20px,0) 1fr; }
 .c100 { grid-template-columns: minmax(100px,0) 1fr; }
+.c100100 { grid-template-columns: minmax(100px,0) 100px; }
 #px-border .c100 { grid-template-columns: minmax(120px,0) 1fr; }
+#px-border .c100100 { grid-template-columns: minmax(120px,0) 120px; }
 .c10 { grid-template-columns: minmax(10px,0) 1fr; }
 #px-border .c10 { grid-template-columns: minmax(30px,0) 1fr; }
+
+#percent-border .c100 { grid-template-columns: minmax(100px,0) 11px; }
+#percent-border .c10 { grid-template-columns: minmax(10px,0) 1px; }
+#percent-border .c100100 { grid-template-columns: minmax(100px,0) 150px; }
   </style>
 </head>
 <body>
@@ -86,9 +92,9 @@ var grids = [
 "grid",
 "grid",
 "grid c100",
+"grid c100",
 "grid",
-"grid",
-"grid",
+"grid c100100",
 "grid c10",
 "grid c100",
 "grid c100",
@@ -96,13 +102,13 @@ var grids = [
 "grid",
 "grid",
 "grid",
-"grid",
+"grid c100",
 "grid c100",
 "grid",
+"grid c100100",
+"grid c10",
+"grid c100",
 "grid c100",
-"grid",
-"grid",
-"grid",
 "grid",
 "grid",
 ];
diff --git a/layout/reftests/css-grid/grid-flex-min-sizing-001-ref.html b/layout/reftests/css-grid/grid-flex-min-sizing-001-ref.html
index 5a732217cdeb..1f5b14bc2abd 100644
--- a/layout/reftests/css-grid/grid-flex-min-sizing-001-ref.html
+++ b/layout/reftests/css-grid/grid-flex-min-sizing-001-ref.html
@@ -21,10 +21,11 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 }
 
 .g1 {
- grid-template-columns: minmax(0,min-content)
+ grid-template-columns: 4px
                         minmax(0,0)
                         minmax(0,0)
                         1fr;
+ min-width:104px;
 }
 
 .g2 {
@@ -46,6 +47,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
                         minmax(1px,0)
                         minmax(1px,0)
                         1fr;
+ min-width:104px;
 }
 
 .g5 {
@@ -53,6 +55,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
                         minmax(0,0)
                         minmax(0,0)
                         1fr;
+ min-width:104px;
 }
 
 .g6 {
@@ -60,6 +63,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
                         minmax(1px,0)
                         minmax(1px,0)
                         20px;
+ min-width:124px;
 }
 
 .g7 {
@@ -81,6 +85,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
                         30px
                         minmax(0,0)
                         10px;
+ min-width:114px;
 }
 
 .gA {
@@ -88,6 +93,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
                         minmax(min-content,40px)
                         minmax(0,0)
                         20px;
+ min-width:140px;
 }
 
 .gB {
@@ -99,9 +105,10 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 
 .gC {
  grid-template-columns: minmax(0,20px)
-                        minmax(auto,40px)
+                        minmax(0,40px)
                         minmax(0,0)
                         20px;
+ min-width:124px;
 }
 
 .gD {
@@ -112,15 +119,16 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 }
 
 .gE {
- grid-template-columns: minmax(auto,20px)
-                        minmax(auto,40px)
+ grid-template-columns: minmax(0,20px)
+                        minmax(0,40px)
                         minmax(0,20px)
                         auto;
+ min-width:104px;
 }
 
 .gF {
- grid-template-columns: minmax(auto,20px)
-                        minmax(min-content,max-content)
+ grid-template-columns: minmax(0,20px)
+                        44px
                         minmax(0,40px)
                         auto;
 }
diff --git a/layout/reftests/css-grid/grid-flex-min-sizing-002-ref.html b/layout/reftests/css-grid/grid-flex-min-sizing-002-ref.html
index 9dbd91f269a9..d9af7e43c7db 100644
--- a/layout/reftests/css-grid/grid-flex-min-sizing-002-ref.html
+++ b/layout/reftests/css-grid/grid-flex-min-sizing-002-ref.html
@@ -25,21 +25,22 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 }
 
 .g1 {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: 4px
                         minmax(0,0)
                         minmax(0,0)
                         1fr;
+ min-width: 24px;
 }
 
 .g2 {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: min-content
                         0
                         0
                         1fr;
 }
 
 .g3 {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: min-content
                         0
                         0
                         1fr;
@@ -49,21 +50,22 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
  grid-template-columns: minmax(2px,0)
                         1px
                         1px
-                        1fr;
+                        20px;
 }
 
 .g5 {
  grid-template-columns: minmax(20px,0)
                         minmax(0,0)
                         minmax(0,0)
-                        0;
+                        4px;
 }
 
 .g6 {
- grid-template-columns: minmax(2px,0)
-                        minmax(1px,0)
-                        minmax(1px,0)
+ grid-template-columns: minmax(1.333333px,0)
+                        minmax(1.333333px,0)
+                        minmax(1.333333px,0)
                         20px;
+ min-width: 44px;
 }
 
 .g7 {
@@ -95,30 +97,32 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 }
 
 .gB {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: 24px
                         0
                         0
                         20px;
+ min-width: 44px;
 }
 
 .gC {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: minmax(24px,0)
                         0
                         0
                         20px;
+ min-width: 44px;
 }
 
 .gD {
- grid-template-columns: minmax(4px,0)
+ grid-template-columns: minmax(24px,0)
                         0
                         0
                         0;
 }
 
 .gE {
- grid-template-columns: minmax(2px,0)
-                        minmax(1px,0)
-                        minmax(1px,0)
+ grid-template-columns: minmax(8px,0)
+                        minmax(8px,0)
+                        minmax(8px,0)
                         0px;
 }
 
diff --git a/layout/reftests/css-grid/grid-flex-min-sizing-002.html b/layout/reftests/css-grid/grid-flex-min-sizing-002.html
index a4a5dbc467b0..e10763f5eaae 100644
--- a/layout/reftests/css-grid/grid-flex-min-sizing-002.html
+++ b/layout/reftests/css-grid/grid-flex-min-sizing-002.html
@@ -15,7 +15,6 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
 .grid {
  display: grid;
  border: 1px solid;
- float: left;
 }
 
 .g0 {
@@ -24,6 +23,7 @@ body,html { color:black; background:white; font-family:monospace; font-size:16px
  border:1px solid;
  float: left;
  margin-right: 20px;
+ justify-items: start;
 }
 
 /*
diff --git a/layout/reftests/css-grid/grid-track-percent-sizing-001-ref.html b/layout/reftests/css-grid/grid-track-percent-sizing-001-ref.html
index 963af8aeb880..3462d17502bc 100644
--- a/layout/reftests/css-grid/grid-track-percent-sizing-001-ref.html
+++ b/layout/reftests/css-grid/grid-track-percent-sizing-001-ref.html
@@ -47,11 +47,11 @@ x {
   grid-template-columns: 30px;
 }
 .tB {
-  grid-template-columns: 0;
+  grid-template-columns: 30px;
   grid-template-rows: 0;
 }
 
-.t0 x, .t2 x, .t6 x, .t7 x, .t9 x { width: 18px }
+.t0 x, .t2 x, .t6 x, .t7 x, .t9 x, .tB x { width: 18px }
 .t1 x { width: 28px }
 .t3 x, .t4 x, .t8 x { width: 0 }
 .t5 x { width: 10px }
diff --git a/layout/reftests/css-grid/grid-track-sizing-002-ref.html b/layout/reftests/css-grid/grid-track-sizing-002-ref.html
index 170283b35dda..3db89b9867e7 100644
--- a/layout/reftests/css-grid/grid-track-sizing-002-ref.html
+++ b/layout/reftests/css-grid/grid-track-sizing-002-ref.html
@@ -36,7 +36,7 @@ div div:nth-child(2n+1) {
   background: grey;
 }
 .grid.c3 div {
-  grid-column:1/span 3;
+  margin-right: 30px;
 }
 y { display: block; width: 130px; }
 </style>
diff --git a/layout/reftests/css-grid/reftest.list b/layout/reftests/css-grid/reftest.list
index 84b155fc7a7e..ae3a7945d73b 100644
--- a/layout/reftests/css-grid/reftest.list
+++ b/layout/reftests/css-grid/reftest.list
@@ -51,12 +51,12 @@ fuzzy-if(winWidget,70,130) fuzzy-if(cocoaWidget,85,180) == grid-col-max-sizing-m
 fuzzy-if(winWidget,70,130) fuzzy-if(cocoaWidget,85,180) == grid-col-max-sizing-max-content-002.html grid-col-max-sizing-max-content-002-ref.html
 == grid-min-max-content-sizing-001.html grid-min-max-content-sizing-001-ref.html
 == grid-min-max-content-sizing-002.html grid-min-max-content-sizing-002-ref.html
-fuzzy-if(winWidget,1,36) == grid-auto-min-sizing-definite-001.html grid-auto-min-sizing-definite-001-ref.html
+# fuzzy-if(winWidget,1,36) == grid-auto-min-sizing-definite-001.html grid-auto-min-sizing-definite-001-ref.html TODO: bug 1303643
 == grid-auto-min-sizing-intrinsic-001.html grid-auto-min-sizing-intrinsic-001-ref.html
 == grid-auto-min-sizing-intrinsic-002.html grid-auto-min-sizing-intrinsic-002-ref.html
 == grid-auto-min-sizing-intrinsic-003.html grid-auto-min-sizing-intrinsic-003-ref.html
 == grid-auto-min-sizing-intrinsic-004.html grid-auto-min-sizing-intrinsic-004-ref.html
-== grid-auto-min-sizing-percent-001.html grid-auto-min-sizing-percent-001-ref.html
+skip-if(Android) == grid-auto-min-sizing-percent-001.html grid-auto-min-sizing-percent-001-ref.html # bug 1305716
 == grid-track-intrinsic-sizing-001.html grid-track-intrinsic-sizing-001-ref.html
 == grid-track-intrinsic-sizing-002.html grid-track-intrinsic-sizing-002-ref.html
 == grid-track-intrinsic-sizing-003.html grid-track-intrinsic-sizing-003-ref.html

From abdba70d60e0edf87573d35817398dfe3613508c Mon Sep 17 00:00:00 2001
From: Ted Mielczarek <ted@mielczarek.org>
Date: Tue, 27 Sep 2016 06:24:24 -0400
Subject: [PATCH 052/102] bug 1301751 - work around llvm-dsymutil crash by
 building rust with debuginfo=1 instead of -g. r=froydnj

MozReview-Commit-ID: 5pK8okLw0Cl

--HG--
extra : rebase_source : f1c366ae3751bcd70272e77c7754fb4adeafdd7b
---
 config/rules.mk                       | 5 ++++-
 toolkit/library/gtest/rust/Cargo.toml | 8 ++++++--
 toolkit/library/rust/Cargo.toml       | 8 ++++++--
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/config/rules.mk b/config/rules.mk
index 9987a3871040..5aa308667b1d 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -934,9 +934,12 @@ cargo_build_flags += --verbose
 # We need to run cargo unconditionally, because cargo is the only thing that
 # has full visibility into how changes in Rust sources might affect the final
 # build.
+#
+# XXX: We're passing `-C debuginfo=1` to rustc to work around an llvm-dsymutil
+# crash (bug 1301751). This should be temporary until we upgrade to Rust 1.12.
 force-cargo-build:
 	$(REPORT_BUILD)
-	env CARGO_TARGET_DIR=. RUSTC=$(RUSTC) $(CARGO) build $(cargo_build_flags) --
+	env CARGO_TARGET_DIR=. RUSTC=$(RUSTC) RUSTFLAGS='-C debuginfo=1' $(CARGO) build $(cargo_build_flags) --
 
 $(RUST_LIBRARY_FILE): force-cargo-build
 endif # CARGO_FILE
diff --git a/toolkit/library/gtest/rust/Cargo.toml b/toolkit/library/gtest/rust/Cargo.toml
index 3e4eaf6a6b07..2fb029251ff9 100644
--- a/toolkit/library/gtest/rust/Cargo.toml
+++ b/toolkit/library/gtest/rust/Cargo.toml
@@ -22,7 +22,11 @@ harness = false
 # Explicitly specify what our profiles use.
 [profile.dev]
 opt-level = 1
-debug = true
+# XXX: We're passing `-C debuginfo=1` to rustc to work around an llvm-dsymutil
+# crash (bug 1301751), but rustc can't handle -g with that option, so
+# turn off debug for now.
+# This should be temporary until we upgrade to Rust 1.12.
+debug = false
 rpath = false
 lto = false
 debug-assertions = true
@@ -31,7 +35,7 @@ panic = "abort"
 
 [profile.release]
 opt-level = 2
-debug = true
+debug = false
 rpath = false
 # This would normally be 'true' for release configurations, but using LTO on
 # rul-gtest causes link failures due to symbols also being found in libxul's
diff --git a/toolkit/library/rust/Cargo.toml b/toolkit/library/rust/Cargo.toml
index 8553abb0e069..3740605c2c3f 100644
--- a/toolkit/library/rust/Cargo.toml
+++ b/toolkit/library/rust/Cargo.toml
@@ -22,7 +22,11 @@ harness = false
 # Explicitly specify what our profiles use.
 [profile.dev]
 opt-level = 1
-debug = true
+# XXX: We're passing `-C debuginfo=1` to rustc to work around an llvm-dsymutil
+# crash (bug 1301751), but rustc can't handle -g with that option, so
+# turn off debug for now.
+# This should be temporary until we upgrade to Rust 1.12.
+debug = false
 rpath = false
 lto = false
 debug-assertions = true
@@ -31,7 +35,7 @@ panic = "abort"
 
 [profile.release]
 opt-level = 2
-debug = true
+debug = false
 rpath = false
 lto = true
 debug-assertions = false

From c1505ef26b5bcce13d008199d4ea11d6a92f37dd Mon Sep 17 00:00:00 2001
From: Ted Mielczarek <ted@mielczarek.org>
Date: Tue, 20 Sep 2016 10:35:16 -0400
Subject: [PATCH 053/102] bug 1304042 - buildsymbols should fail if running
 dsymutil fails. r=gps

MozReview-Commit-ID: LteC4jGF3FD

--HG--
extra : rebase_source : 2465a5fd04a45d73660cf7557e706631855f24d5
---
 Makefile.in                                |  2 +-
 toolkit/crashreporter/tools/symbolstore.py | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index 88d225966132..5a8675f6f327 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -313,7 +313,7 @@ ifdef MOZ_CRASHREPORTER
 	  $(foreach dir,$(SYM_STORE_SOURCE_DIRS),-s $(dir))               \
 	  $(DUMP_SYMS_BIN)                                                \
 	  $(DIST)/crashreporter-symbols                                   \
-	  $(MAKE_SYM_STORE_PATH) | grep -iv test >                        \
+	  $(MAKE_SYM_STORE_PATH) >                                        \
 	  $(DIST)/crashreporter-symbols/$(SYMBOL_INDEX_NAME)
 	echo packing symbols
 	$(NSINSTALL) -D $(DIST)/$(PKG_PATH)
diff --git a/toolkit/crashreporter/tools/symbolstore.py b/toolkit/crashreporter/tools/symbolstore.py
index 77df850c8357..f1f32710a56c 100755
--- a/toolkit/crashreporter/tools/symbolstore.py
+++ b/toolkit/crashreporter/tools/symbolstore.py
@@ -549,15 +549,18 @@ class Dumper:
         '''Process all pending jobs and any jobs their callbacks submit.
         By default, will shutdown the executor, but for testcases that
         need multiple runs, pass stop_pool = False.'''
+        success = True
         for job, callback in JobPool.as_completed():
             try:
                 res = job.result()
             except Exception as e:
                 self.output(sys.stderr, 'Job raised exception: %s' % e)
+                success = False
                 continue
             callback(res)
         if stop_pool:
             JobPool.shutdown()
+        return 0 if success else 1
 
     def Process(self, *args):
         """Process files recursively in args."""
@@ -595,7 +598,10 @@ class Dumper:
                     yield fullpath
 
     def SubmitJob(self, file_key, func_name, args, callback):
-        """Submits a job to the pool of workers"""
+        """Submits a job to run |func_name| with |args| to the pool of
+        workers, calling |callback| when the job completes. If the function
+        call raises, the call to `Dumper.Finish` will return failure.
+        """
         JobPool.submit((self, Dumper.lock, Dumper.srcdirRepoInfo, func_name, args), callback)
 
     def ProcessFilesFinished(self, res):
@@ -971,6 +977,7 @@ class Dumper_Mac(Dumper):
             subprocess.check_call(cmd, stdout=open(os.devnull, 'w'))
         except subprocess.CalledProcessError as e:
             self.output_pid(sys.stderr, 'Error running dsymutil: %s' % str(e))
+            raise Exception('Error running dsymutil')
 
         if not os.path.exists(dsymbundle):
             # dsymutil won't produce a .dSYM for files without symbols
@@ -1043,17 +1050,17 @@ to canonical locations in the source repository. Specify
         pdbstr = os.environ.get("PDBSTR_PATH")
         if not os.path.exists(pdbstr):
             print >> sys.stderr, "Invalid path to pdbstr.exe - please set/check PDBSTR_PATH.\n"
-            sys.exit(1)
+            return 1
 
     if len(args) < 3:
         parser.error("not enough arguments")
-        exit(1)
+        return 1
 
     try:
         manifests = validate_install_manifests(options.install_manifests)
     except (IOError, ValueError) as e:
         parser.error(str(e))
-        exit(1)
+        return 1
     file_mapping = make_file_mapping(manifests)
     dumper = GetPlatformSpecificDumper(dump_syms=args[0],
                                        symbol_path=args[1],
@@ -1067,7 +1074,7 @@ to canonical locations in the source repository. Specify
                                        file_mapping=file_mapping)
 
     dumper.Process(*args[2:])
-    dumper.Finish()
+    return dumper.Finish()
 
 # run main if run directly
 if __name__ == "__main__":
@@ -1075,4 +1082,4 @@ if __name__ == "__main__":
     # note that this needs to be in the __main__ guard, or else Windows will choke
     Dumper.GlobalInit()
 
-    main()
+    sys.exit(main())

From 887e651a5fa0ace6fbb43de63155895265d86746 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 27 Sep 2016 11:09:34 -0700
Subject: [PATCH 054/102] Backed out 6 changesets (bug 1189901) for Windows
 talos g1 and s failures a=backout CLOSED TREE

Backed out changeset 14660f4f2b23 (bug 1189901)
Backed out changeset 647db9f59d9e (bug 1189901)
Backed out changeset 926a610af8a7 (bug 1189901)
Backed out changeset 610b70634239 (bug 1189901)
Backed out changeset 866c0244a7c1 (bug 1189901)
Backed out changeset 081c6b4986a9 (bug 1189901)
---
 .../talos/talos/pageloader/chrome/tscroll.js  | 284 +++++-------------
 testing/talos/talos/pageloader/install.rdf    |   2 +-
 .../talos/pageloader/pageloader-signed.xpi    | Bin 30245 -> 28966 bytes
 .../chrome/talos-powers-content.js            |  41 ---
 .../components/TalosPowersService.js          |  58 ----
 .../content/TalosPowersContent.js             |  43 ---
 testing/talos/talos/test.py                   |   8 +-
 testing/talos/talos/tests/scroll/iframe.svg   |   2 +-
 testing/talos/talos/tests/scroll/reader.htm   |   2 +-
 .../talos/tests/scroll/tiled-downscale.html   |   2 +-
 .../tests/scroll/tiled-fixed-downscale.html   |   2 +-
 .../talos/talos/tests/scroll/tiled-fixed.html |   2 +-
 testing/talos/talos/tests/scroll/tiled.html   |   2 +-
 13 files changed, 81 insertions(+), 367 deletions(-)

diff --git a/testing/talos/talos/pageloader/chrome/tscroll.js b/testing/talos/talos/pageloader/chrome/tscroll.js
index e947dc4e2681..232c32363326 100644
--- a/testing/talos/talos/pageloader/chrome/tscroll.js
+++ b/testing/talos/talos/pageloader/chrome/tscroll.js
@@ -1,6 +1,9 @@
-// Note: This file is used at both tscrollx and tp5o_scroll. With the former as
-//       unprivileged code.
-// - Please make sure that any changes apply cleanly to all use cases.
+// Note: The content from here upto '// End scroll test' is duplicated at:
+//       - talos/tests/scroll/scroll-test.js
+//       - inside talos/pageloader/chrome/tscroll.js
+//
+// - Please keep these copies in sync.
+// - Pleace make sure that any changes apply cleanly to all use cases.
 
 function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
 {
@@ -12,108 +15,10 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
     win = window;
   }
 
-  var result = {
-    names: [],
-    values: [],
-  };
-  // We report multiple results, so we base the name on the path.
-  // Everything after '/tp5n/' if exists (for tp5o_scroll), or the file name at
-  // the path if non-empty (e.g. with tscrollx), or the last dir otherwise (e.g.
-  // 'mydir' for 'http://my.domain/dir1/mydir/').
-  var href = win.location.href;
-  var testBaseName = href.split("/tp5n/")[1]
-                  || href.split("/").pop()
-                  || href.split("/").splice(-2, 1)[0]
-                  || "REALLY_WEIRD_URI";
-
-  // Verbatim copy from talos-powers/content/TalosPowersContent.js
-  // If the origin changes, this copy should be updated.
-  TalosPowersParent = {
-    replyId: 1,
-
-    // dispatch an event to the framescript and register the result/callback event
-    exec: function(commandName, arg, callback, opt_custom_window) {
-      let win = opt_custom_window || window;
-      let replyEvent = "TalosPowers:ParentExec:ReplyEvent:" + this.replyId++;
-      if (callback) {
-        win.addEventListener(replyEvent, function rvhandler(e) {
-          win.removeEventListener(replyEvent, rvhandler);
-          callback(e.detail);
-        });
-      }
-      win.dispatchEvent(
-        new win.CustomEvent("TalosPowers:ParentExec:QueryEvent", {
-          bubbles: true,
-          detail: {
-            command: {
-              name: commandName,
-              data: arg,
-            },
-            listeningTo: replyEvent,
-          }
-        })
-      );
-    },
-  };
-  // End of code from talos-powers
-
-  var report;
-  /**
-   * Sets up the value of 'report' as a function for reporting the test result[s].
-   * Chooses between the "usual" tpRecordTime which the pageloader addon injects
-   * to pages, or a custom function in case we're a framescript which pageloader
-   * added to the tested page, or a debug tpRecordTime from talos-debug.js if
-   * running in a plain browser.
-   *
-   * @returns Promise
-   */
-  function P_setupReportFn() {
-    return new Promise(function(resolve) {
-      report = opt_reportFunc || win.tpRecordTime;
-      if (report == 'PageLoader:RecordTime') {
-        report = function(duration, start, name) {
-          var msg = { time: duration, startTime: start, testName: name };
-          sendAsyncMessage('PageLoader:RecordTime', msg);
-        }
-        resolve();
-        return;
-      }
-
-      // Not part of the test and does nothing if we're within talos.
-      // Provides an alternative tpRecordTime (with some stats display) if running in a browser.
-      if (!report && document.head) {
-        var imported = document.createElement('script');
-        imported.addEventListener("load", function() {
-          report = tpRecordTime;
-          resolve();
-        });
-
-        imported.src = '../../scripts/talos-debug.js?dummy=' + Date.now(); // For some browsers to re-read
-        document.head.appendChild(imported);
-        return;
-      }
-
-      resolve();
-    });
-  }
-
-  function FP_wait(ms) {
-    return function() {
-      return new Promise(function(resolve) {
-        setTimeout(resolve, ms);
-      });
-    };
-  }
-
   function rAF(fn) {
     return content.requestAnimationFrame(fn);
   }
 
-  function P_rAF() {
-    return new Promise(function(resolve) {
-      rAF(resolve);
-    });
-  }
 
   function myNow() {
     return (win.performance && win.performance.now) ?
@@ -132,12 +37,6 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
   var doScrollTick = isWindow ? function() { target.scrollBy(0, stepSize); ensureScroll(); }
                               : function() { target.scrollTop += stepSize; ensureScroll(); };
 
-  var setSmooth =    isWindow ? function() { target.document.scrollingElement.style.scrollBehavior = "smooth"; }
-                              : function() { target.style.scrollBehavior = "smooth"; };
-
-  var gotoBottom =   isWindow ? function() { target.scrollTo(0, target.scrollMaxY); }
-                              : function() { target.scrollTop = target.scrollHeight; };
-
   function ensureScroll() { // Ensure scroll by reading computed values. screenY is for X11.
     if (!this.dummyEnsureScroll) {
       this.dummyEnsureScroll = 1;
@@ -148,125 +47,86 @@ function testScroll(target, stepSize, opt_reportFunc, opt_numSteps)
   // For reference, rAF should fire on vsync, but Gecko currently doesn't use vsync.
   // Instead, it uses 1000/layout.frame_rate
   // (with 60 as default value when layout.frame_rate == -1).
-  function P_syncScrollTest() {
-    return new Promise(function(resolve) {
-      // We should be at the top of the page now.
-      var start = myNow();
-      var lastScrollPos = getPos();
-      var lastScrollTime = start;
-      var durations = [];
+  function startTest()
+  {
+    // We should be at the top of the page now.
+    var start = myNow();
+    var lastScrollPos = getPos();
+    var lastScrollTime = start;
+    var durations = [];
+    var report = opt_reportFunc || tpRecordTime;
+    if (report == 'PageLoader:RecordTime') {
+      report = function(duration) {
+        var msg = { time: duration, startTime: '', testName: '' };
+        sendAsyncMessage('PageLoader:RecordTime', msg);
+      }
+    }
 
-      function tick() {
-        var now = myNow();
-        var duration = now - lastScrollTime;
-        lastScrollTime = now;
+    function tick() {
+      var now = myNow();
+      var duration = now - lastScrollTime;
+      lastScrollTime = now;
 
-        durations.push(duration);
-        doScrollTick();
+      durations.push(duration);
+      doScrollTick();
 
-        /* stop scrolling if we can't scroll more, or if we've reached requested number of steps */
-        if ((getPos() == lastScrollPos) || (opt_numSteps && (durations.length >= (opt_numSteps + 2)))) {
-          if (typeof(Profiler) !== "undefined") {
-            Profiler.pause();
-          }
-
-          // Note: The first (1-5) intervals WILL be longer than the rest.
-          // First interval might include initial rendering and be extra slow.
-          // Also requestAnimationFrame needs to sync (optimally in 1 frame) after long frames.
-          // Suggested: Ignore the first 5 intervals.
-
-          durations.pop(); // Last step was 0.
-          durations.pop(); // and the prev one was shorter and with end-of-page logic, ignore both.
-
-          if (win.talosDebug)
-            win.talosDebug.displayData = true; // In a browser: also display all data points.
-
-          // For analysis (otherwise, it's too many data points for talos):
-          var sum = 0;
-          for (var i = 0; i < durations.length; i++)
-            sum += Number(durations[i]);
-
-          // Report average interval or (failsafe) 0 if no intervls were recorded
-          result.values.push(durations.length ? sum / durations.length : 0);
-          result.names.push(testBaseName);
-          resolve();
-          return;
+      /* stop scrolling if we can't scroll more, or if we've reached requested number of steps */
+      if ((getPos() == lastScrollPos) || (opt_numSteps && (durations.length >= (opt_numSteps + 2)))) {
+        if (typeof(Profiler) !== "undefined") {
+          Profiler.pause();
         }
 
-        lastScrollPos = getPos();
-        rAF(tick);
+        // Note: The first (1-5) intervals WILL be longer than the rest.
+        // First interval might include initial rendering and be extra slow.
+        // Also requestAnimationFrame needs to sync (optimally in 1 frame) after long frames.
+        // Suggested: Ignore the first 5 intervals.
+
+        durations.pop(); // Last step was 0.
+        durations.pop(); // and the prev one was shorter and with end-of-page logic, ignore both.
+
+        if (win.talosDebug)
+          win.talosDebug.displayData = true; // In a browser: also display all data points.
+
+        // For analysis (otherwise, it's too many data points for talos):
+        var sum = 0;
+        for (var i = 0; i < durations.length; i++)
+          sum += Number(durations[i]);
+
+        // Report average interval or (failsafe) 0 if no intervls were recorded
+        report(durations.length ? sum / durations.length : 0);
+        return;
       }
 
-      if (typeof(Profiler) !== "undefined") {
-        Profiler.resume();
-      }
+      lastScrollPos = getPos();
       rAF(tick);
-    });
-  }
-
-  function P_testAPZScroll() {
-    var APZ_MEASURE_MS = 1000;
-
-    function startFrameTimeRecording(cb) {
-      TalosPowersParent.exec("startFrameTimeRecording", null, cb, win);
     }
 
-    function stopFrameTimeRecording(handle, cb) {
-      TalosPowersParent.exec("stopFrameTimeRecording", handle, cb, win);
+    if (typeof(Profiler) !== "undefined") {
+      Profiler.resume();
     }
-
-    return new Promise(function(resolve, reject) {
-      setSmooth();
-      var startts = Date.now();
-
-      var handle = -1;
-      startFrameTimeRecording(function(rv) {
-        handle = rv;
-      });
-
-      // Get the measurements after APZ_MEASURE_MS of scrolling
-      setTimeout(function() {
-        var endts = Date.now();
-
-        stopFrameTimeRecording(handle, function(intervals) {
-          function average(arr) {
-              var sum = 0;
-              for(var i = 0; i < arr.length; i++)
-                sum += arr[i];
-              return arr.length ? sum / arr.length : 0;
-          }
-
-          // remove two frames on each side of the recording to get a cleaner result
-          result.values.push(average(intervals.slice(2, intervals.length - 2)));
-          result.names.push("CSSOM." + testBaseName);
-
-          resolve();
-        });
-      }, APZ_MEASURE_MS);
-
-      gotoBottom(); // trigger the APZ scroll
-    });
+    rAF(tick);
   }
 
-  P_setupReportFn()
-  .then(FP_wait(260))
-  .then(gotoTop)
-  .then(P_rAF)
-  .then(P_syncScrollTest)
-  .then(gotoTop)
-  .then(FP_wait(260))
-  .then(P_testAPZScroll)
-  .then(function() {
-    report(result.values.join(","), 0, result.names.join(","));
-  });
+  // Not part of the test and does nothing if we're within talos,
+  // But provides an alternative tpRecordTime (with some stats display) if running in a browser
+  // If a callback is provided, then we don't need this debug reporting.
+  if(!opt_reportFunc && document.head) {
+    var imported = document.createElement('script');
+    imported.src = '../../scripts/talos-debug.js?dummy=' + Date.now(); // For some browsers to re-read
+    document.head.appendChild(imported);
+  }
+
+  setTimeout(function(){
+    gotoTop();
+    rAF(startTest);
+  }, 260);
 }
+// End scroll test - End duplicated code
 
 // This code below here is unique to tscroll.js inside of pageloader
-try {
-  function handleMessageFromChrome(message) {
-    var payload = message.data.details;
-    testScroll(payload.target, payload.stepSize, 'PageLoader:RecordTime', payload.opt_numSteps);
-  }
+function handleMessageFromChrome(message) {
+  var payload = message.data.details;
+  testScroll(payload.target, payload.stepSize, 'PageLoader:RecordTime', payload.opt_numSteps);
+}
 
-  addMessageListener("PageLoader:ScrollTest", handleMessageFromChrome);
-} catch (e) {}
+addMessageListener("PageLoader:ScrollTest", handleMessageFromChrome);
diff --git a/testing/talos/talos/pageloader/install.rdf b/testing/talos/talos/pageloader/install.rdf
index fc86699fab19..861b9b092951 100644
--- a/testing/talos/talos/pageloader/install.rdf
+++ b/testing/talos/talos/pageloader/install.rdf
@@ -4,7 +4,7 @@
      xmlns:em="http://www.mozilla.org/2004/em-rdf#">
   <Description about="urn:mozilla:install-manifest">
     <em:id>pageloader@mozilla.org</em:id>
-    <em:version>1.0.13</em:version>
+    <em:version>1.0.12</em:version>
     <em:targetApplication>
       <Description>
         <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
diff --git a/testing/talos/talos/pageloader/pageloader-signed.xpi b/testing/talos/talos/pageloader/pageloader-signed.xpi
index 49b7752f18ed24077ef56498196b8f79d9f8544f..5888b529b63f82fcc8f5695fb8a430b76186b11b 100644
GIT binary patch
delta 6734
zcmY*e1yo!?vK`!mySqCH5G2^(uE8N0+y?>yLIw%$3?4K<LXg4T-5E3xV1VH6PJm5z
z|L*?ncl!0~I<Kp%y3e_FyQ}B`>FXL2wYC}xDhU7pzyy%#NvKHIR!AS?0swjh000Se
z+?^bPF!B|fxu+71u8J*BM9g<v<92iv5>)dmMMbO$#7f0vAM{hDuqK9-F}ED_5-_Q7
zG5Mz+cvOSFsUbY~a_$En_NA|Vk02fJWApZv<NMa*?Eq;&q6)ntGg&@q6%hXmvK>)I
zG7=LMnF6(Y0!c(bl>`NKR7C}8;=vu+h6wUY3yF!9l0i;6gFpZiH!KLYBokr|xa(+@
z@lujyJX}eViOCZ{ogXCV!E>iWF+r7!Uv)a(iCEWTZEPY~a;LjOwTod1l&+s*{Pa|t
zGdI26vZGje)=MvOLb<T`a#3ROjMAjV_vd=KAcf4C7$EqjZ<C+B_TGnGgpNI^rW(Q|
z)}kgB0B4hRujv~E=t9gB(R;Zz9;H$wGFR8)?v9?MEN<Z(l3iFb)st^EQS6F9f`Q4n
zhFe_JZ6sTmIgjk9u5Snc=hrRMkB!G2?b)PO;^_LAep12TYB0u^GvM>f3)DUD^=sXp
z2W3Bb|IXE!!K~c##pUljKaAul<AaEqIw>KK4=-rke#1agsO*FrVCd+|L|7?C6+G2i
zF;OT?7O-BAti5;|vTqcIES1uPX3v^%m)u~e>Y~wY%R9*(T}-j@#c_|6^eww}NrQ}Q
zoo9x?(x}p8WBD-FOaU3MFI;#MVS_=7^FjVjBBU3;Q^T?x-VBN3<t{KrRzdV-(}@iD
zGnWh#1j0e`*9HNH<+7SaH1`_*HiIsDk?iN9_uqR2W>Ol$l4vz)Q_p=SnQ`o)9JUpT
z_lekuPoyN211~0d&F}Nw3$j+0<|(>r_!Vbft~(t%z{#mL3P)S|Y6pj2TzI$skTQc}
zJ1^jwu=?t-fGR~5xym+i>mePg8u6c9gF&<jNw6)yLR-F5zFe)*nV(nuN8!s`Wmc<6
zT4|M5dS<I8Gb=Bs{hw>xivMWV6#+Ya<!y?LG1+lrvjJ`QQ^1*7fv0ZHwgz6)!b|}~
z={wiycAEnpPH%F4<$(F=QtFNHj%N*AYz_xbTsh;yfbVjjJ6gn1C_-@YON1}_)V<*j
z=+GuMebRbY*3vDF@KFQQShs9z16U#=uJD()2BsBVQ7Hnc&&{9uyS{$pvn8ebvQb<X
zeZLQklvxeVL{2$eu&G7)%P;t^-y^2hjOOmzv<|~U;h%8Jd%v}D!%lq&nrs_88~sEn
z`jNQ2j{2*wY2*4D79a+f-L?vjKLvFh^@-~6bw$xz*y+Y=y_tU>YrQGjCoK`rslJXt
zpvudT<aLa(ZZry}>y3p+vaMyZN+(<L&ng}sR*uc!@6`@AmKyThu#TTZo2Q<1tm+QG
zFxGt`Kv)Z(sHfe3+ie9|@VYEteNk^z+hK&mkC*0fQMFgBK@aii(Tu<-<2UI`KQ7cU
zD!Wknr8C;f*9Ls(oaJ_koq$OramQ*!@vDJ+vkanKK1vC+aAzq<=_<w~QM*7s*niR6
zZ8Os`_YWNq)N(KLYEMSgV(JU|8))ns3Aq^-<(edJg6e#3h=}o@pOYDz9$9^Q^#}q?
zb4~_k5>pMGMMGvx;e>;5w#MCq>|4+AxvzLa9A%E^5&V<Z{AU{dY6Tr}Sqh<|^EHxG
zN4}Mv?hmfsA3cI<hkDTO<A!A%&OPHxQSRJAv*|5o9ud7qS3grq2mKr(vSvbjY(DrC
z4F|}Ca++lLd+%MnIa!Dx?ytogqa(T7bvbWaczkIzYzCR{%OLwW;LXfulEn|6-0ror
zRT(f~#%6LavIA#a7pza%w^M<^3i#A|-EwFZdQ3LV-)ZliK4b&9)!0E#4-!=Ld}{$P
zIXu3RpyixNw<)24Bn~<~$}S#D!#U#(x0p<GLD$B0LYm&{;uf;K&kXyQT{rzv{<zj0
z(Vy6ug&>5zmYnsH8Wxjdreh=GuYGlm$Gg1mT*IRaoiqbFRUrM0k|pKCI*?KR>ue_R
z9*o(RzLs~;3KWHTI+;(J5O#M=VzirWz99N4pH4_h>l5e&YAJQls)xedPOdV|w!)2K
z^J^I@W^UHll%&L$Y>2lU=UO+A8nZ{@kOprxe8{YOZh9dp%hPxe`xvz%xS2f)#ungM
zqcOLDf8Yu_WEuGBJVbKR`lM}XaFAzY?;CU=l~!W(Bg*eN0|5$sBtqX;tRep1oRLzU
zoRPb1+C(<LQfW7ovw;jqyY-44^GH^SFy!Q$c-q`;;vD6eCwlAg(%8kU$>#3r#B<ec
zUr5e^zI%vveO~AGw6D*hq27yP5$#sz<rAYt|MB<hfELx~XRW*nY(3}M`oSB-si2OP
zS}_`Ya!mBXch>C`Sd$#}Oo<KDpQqP<nZgz8$_H|yxS;s{bz%HyQ7v9DE6!#eyEPY)
z8%<e~bIMpota^wf*+n^WhHmIB-OlItr;rY;9IQl|kEU}eZ_b8aZbUwutRe{&r}zgx
zydmk15Ov-jYLbp`3XhH@tInM~<@q?nQC7h*8%8acpbu_#6drb|eAT@fdnuKzPmOb0
z6!;$fRnXk}d0!^C%E^vL6JieOT7J_dYFM4Sq$8m&iN)s~fAik3U&D~;UHrOuE;nR(
z%b!6O)4R=<@m#s9@AY(9WoVoUvyD|?j@G7OI9;Kc(v5}7mP-X%&lRH<BYuB-e6}n$
zRB#f#u1<a<xY;fnoP%jH5jt@bLX(`<f@NHsmsS<h(lYndRg0GUT4ic?C#W^x%dJU`
z9~rdv`0mUo<666px7`}aQC+g)P8ZUGPK6spIkZI}Ylp;yiPIUMnS_B<gv!7$VHEg_
zLXa*%Hecy2F3RipstLg`lv)8t5?lop6||ra)X(YAIk=PidRBr%MS!a5Ft6av@bfIg
zx9hRUa%b^}!4nDU3@lRVMb#dYy#@ADKb6Y9aA*)@#FJ~m#;~!5@b2jKkO?8E$c5G-
zse~qZ5iX<zBwV9@!{a?YKuz7Vm2Wyk@zCBDan;7x5)ZNS?d2Uw*JDT_%p(+(xt-(l
z{UgLG1<f7lF;eTI*dIrSDXwRcIv&EV!^-lyW&jHESZRK7_fWTkGVmkz4Yz57Zn~pQ
z#SAm-ooiWEJ-$MD?S*=xtR>{u-|N0t#ipC{`A7Dmp(f6+!nmq5=3J!CF41d0wXfKM
zl(!K1d}#Vnk7IiaL_68lM~!t60ZNc+3ViUuiCii9T!xQ2L2&#@XgIkqU0ZH@rDG=J
zuJ+DzoySd+HZ!j~nSGV*X#3;%-6HWy8WM}#^u;b|^;SyN(%s??@-9dU^@#e+K2w><
zweq)k0%?33%m!A&7$_YU0<jVzY`w|<-N?b%SrW%tajaYSD+96zq49IVLn^J|DhKBY
zMEXjZOH>#hFl|e9wGzee>sN{I)ZUJ3Jyp>qClm0z?&g;h>nr=faSeA5xJKgBsu`QP
zgXnR)0q{EMSK&lk@-zg-HCIvfjyhRy9&rf;jb8^<2py~Ek=L9bL+K0^mkGXD*sVLQ
zYW@@%XWoqRylqp#NLZ)pTURwMYFLL=>}yHR=^QyK&DoHjuuY^JzDn7D)b{g>W^)o_
zkb90I1o8HF<BF<QTISx#w<`U{R5LXgeVDIB$=-|7K3Wi)fCo9;g8z_M3^)+a;&<zK
zMtiw2yo$lpzfWo%pT{%59N27op}QA`R{Zsa)}!lM=zt=uQWlpGys6wlL5D@lurc;D
zB6O=3@u2ORu?4t~S0EUL%RO6tw9fApc+}Vg1ivcN9wqe2@`&hmY3`VCvQaOM&tf03
zh$C6OTigpK>VlAD$xRQ>&78MbruluckJq(SBURzloXUPn3k7QWIAk`Y{?yiPm*C_e
zv7nz5u3wn((WavjNaTgY2{XCe2-Hs7NSOxMibn=;>8G2k@Bsnh(y)O}66&L1-X-jl
zOpnGc0Fmgv|EJu&jy&_aj65uVMw)GIh^2QV#PT{o65^%_II5oA{dO=C8^rrNxXTtf
zii&g};{&@kVV?1qVOmSQ+YB|fTkmwd(l1N+8`NE_==3Yqnl)LGHBN*xZpq>AiWg<p
zY_%Ql$7aXiXQS_%pc(Je`Wr*OqdI_tev)t2QOo1`p5pLG$CP>aZ+dWfXFd9S;%BpM
z+i6L&nS>0Qz<v^>Ozi9}?Z2I2aOL7&ov_Yo{ThNuod~BG(=B;@(y+UYn-NLheolNg
z?V3$wlZzNTf1lK8?QIPw=Bo1d@UqsUtr%zhj+dh^$I7;3M9Y)WNJx8?;cw_t&2z)c
z4-ykCva_)qDnohP{Iq+yt0`tQLD>ae7WRgjSU|*?4ie&u>KA}{hp3D^M`;)ZpH@zM
zt>3UGz51jOORAuFLT+43>F9p52t3WXd;R3$Nr}9jnv*z7E}q2mx&78|$k{EJA1j&%
zXiAFDM8WPaWaj0DWrAa_bTsJkN=KCA0=8RzwPfy)Udcp~oLuxhvw7-^yhU}=ot%hU
zNgeg;dGv3_M{ggI{(DfGb(Bz{@>Iu$*4wfmgO#C6w%tgenp`_2G$^YlNe!bSHF{04
zDLT$G;GZAW2Di`DF#v!CLMWjo3&dJ!&#36Ni`)7OqQ@gk!O!@0GxODYc@G4Zu2n9g
z;k@8QAhDGx2~buoxg4gjr_2SbKs+tmDev|98k>125}0ndiwS4>Zsi+t`;}(57Phn%
znsKwI6in@eT}>(PnS66-H<@%YNEnNSIf18|#SK!UVCAJ|V#W#XX~N2(5O`8nah-Wp
zo_VOjsngKgpKjh<W}K#^LNJFu%^xNtQ)OpTqY2#PhGD=~SCwN&&ay&$-TIBIsp?G^
zR$l!?sS-)*KCnvc4a1Q4N&jIebADX%ap;1qMXgIL`yl6s9s{JOmp?EbUVI)K*4%_m
z4NC;<<Edl`NbHh<vYp*ZAy30-yFVTrL8Y-RVISTbntS3PeI9>ICq&@LhpW1r)NpZ@
z<dt&2j23*Q7P%R5_x(|zIwUBi`sV2B{?JXxhngSFyZ{qFfW^4y=oMSdjpa^AZq~1r
z)hOS0*~uj<aOFA5=LfbMke7{jss^!EyH3nhLu)#4eI3sarT9ZAKnPa-n2Cd`3spYB
zBV4)wLq20FJlSI0{>)bnHIrWp)DA2O#c~_9B||a&dA)3KL-Qrg*f=f1^+{5B?OMWx
zkzBf`J1s=-K=W8tzn}AV`r5`JACoap>m%Q*B2Lg*wyP-dzR!XK?xmuX-E?FWs4eeZ
zGh<Q|u>_m#UBj5aJ%l{wwHqBbtuwC|MO*0^e!@ep^TXZXkE^~U>HNp1+S}ib6OUPk
z^20fr@}I+B;6Eco)GN_sa&XnjYlyfE?0EA#k^uXebW3t6?h}eH*86~4F55{Te_f@F
zMZp~6D%d|?%m#IT1k>rXVzSb9pTx{G@o$%ju1ea1lb&tjDM4V?&_q^uYSP-(m+UQb
z=H}YQU9yc3_)cS<%l3|?&{H1gF>WDkXT`)+Nz?g`553F`cR&GwnGR3!nP)2BkNwLM
zG9^S)8OZBqHjghvAZq1sxAZxd7lv^Z%$xDO*Ss1q-cS&kkAKS9Pk{{M;3!a5CF&P}
zRPjfCf4h33Lr9nheIO!<??H=C7x~2}lwW3-egw-Ax}UATkVz$D@T7;G<@cJ;b`It_
zW%0jU?@Ba!`aL2>=LbO7qDFqWWpBE|$Z*oD>>f)Hc?jmt><B>-Z9g@SOF9<}Ku5?6
zUKqv*bw%|bF@(tl1&?(70OFR>XTiza3))D3MUE62Swo7rEIg2Zo0{MhB-yE(o+vtW
z9K9X2etPb$v8o`nFz|yjewsZTOr<|sJ$lx~dGRHFT+t&w8rstZa<RL9`{}Mv@An#F
z{bbJ*6{CrSAyADz+|!Dzlaw$he=^Lp4a@V~e@HCx7zw}1ZjC(i(U59fMUh1<w_@$t
zhk2D;`wx(1c9nE+7>nMIPIF<(w(ms?`IV2pmoj@<?aHSaEP;091BQD-zII;5vr~l^
z!I6sJv=dX3`hM!?6qC#6$_K>T31!*xbSAPPYm^miyt%c(?%ynwjWqRp+S&?ps`-&;
z7}k_}mg10pszGXgzxg2NSc1r*KW|3CDbwHNia~~?B)EMbk-JSw>yTg`{1FhTWK-c-
zx~noJr#jp%^nD$471ZN}SBxUj%z!V)8A)XO{&P=+)a1v-L+?ir|L&NkgBGLzQwL1|
zykAB`NV{PvFmDsx?vOb6S!dt7D-~<+Ih4%A>p<t-IlwLM;t-VX4PkZ>UmD$|V_PX;
z&p-g;UW)km27epH=NTN<k+SHTraAuT#m3FGh+NQBgX+mSJ)~ie#A5Gs(S?j8lSp{V
zv3m>dS}Ru+`5F}Qpv<8|&r4;C+)^m6ZwThjIPbF8_Dnb(@>?-%lil6K`uY=gx&)#C
zb@f6!I*qyRFr>=JV{&q}5H`F!g>C^Uahs4!&&!brwB<8;<oPIn2eEE>*xA>jVn=S(
zjq%KaQm-sUESj5Pkfg%!n+fuSdynTG7guF;8F<|_Ir`Rl3C!ct-Cf_BDST7mC!bxv
z4*tGgwGKp|ai7DTC#ZY`h2#VSSSF$fo99!ThHlDi{DNKwEnn=sR4Nlo<0jSoKqvzF
zfaf|z6%fzOcw{%&O4Vh6NdWL!P+*>`Y-9r4$shG*sT;TLCZ9=Y=!%|Y5HX9Nd2@GK
zC#HJ{3(ySEpjBGhhXsV;YYlXQv}sN$@<q<m8aMhv*zkM#yy66Yk=0?m-Rs$b)>;eh
zv{2c|Y<31(%q8U}i8rgyHv8gwbTB|_*ap7%rk0<OgWRjO-t)E@H<EQ+c%3@Nxe7Ef
zUZU-wkT9=KP7JaVn{|vuc2TYf8=Q`{mqZteT1lFlLBx(2+=m7SLZVNxr?)Ze`a9Qx
zgV6#`N!c$4ey;mq*<VTu`F>8=mm7b57S{vU+5yNso@gS=XO{%t9E{y~=Rqvu14pSX
znPSM_*A{$9O`JBPMtoSe<Y&>K!1~r_Hyg!VVUtAkRS3PfEFlgjw=JU;C!*W<Niz>Z
zw}K}*lH)fCO+%x}&)|r%-_}3_V!wX(Vv>jxH%81<a+{3g0Sy{tvJG|hq^i+YuR%fv
zIzr##@grL+)g<GQp&-vXLi0$4{{-xsSyBU9Ozc0Go&dlfAuk>qCRlmT=x>0B@`9;q
z6olPTYf1=?P@(pwGBw#U?r6|(FiFjz=qx7I-%C<AuN~}b=&>^+WF)Rcl>~jYN$b~=
z*9Z_zViyTJ0-Gsf$#$?VFKUfzaGG9XJ1d(uqgFV{<ojin<EBw7je<4eL%OvAN)|+8
zNb8M|xG%@=%-~j6Nz7NJ44EekkDTjPG29a@#gCa>zrlWqV&JpiH#gV6ow&3|s$FOO
z`Ka_aeQ~<3f4shbgyj6zfBY^dAo=d<K)1MlcjP;E?ZfR?fwAnt_NU_`c2dP(>~~r>
zPO@QhpC=*}GUj1vMP%6IlQ@dV*;++Msb*Jq%=Y?K3bF=8tOF_MckwdhVitrS5fq4>
z8X&u>7lB&&{7LKF^373Q736wVTM@YNgS-JQv|WW9TPLX$2=TwY6vrln(d9ZkI0cu0
z##tq5g#>1zerA7q83^~c#B{pnk_~X<A54y?dq9*0OU*CY95_{=qTvJNv`__-J!ryb
zC8)-vQ4D;JVNVG{U<LsnqOKj**WO2$y9ezTZrPQC<(_5rx^{io$E}Xo{LdJ#g0CsW
zMb5_<ZH>a;L+Tid6;zS9`zm7IFK(;2;>c)l2=R<%IEmM4on?wq4O_;vhjw@?Q+g6D
zz2)0@qq_4TX^LJiNQE)jlw@@4q@P9yu@7$n9+Q)lG>qHRY-20I!+qT-Y#D5fr{Od{
zmG+RM*>+&;i%+}EZ-=@YXLMRkMdGBG)7w%!hhqYOkYrx_Wh8CzTfXi3;P`f#h~Ex7
z&fYWx%?Ud?8`kJf4a1U5jf$DkyBvL&+<DkIW^KU1bL;%#GY>U%b>Pd*p?Qz7h&<kn
zF_U(1W<RQV!Y^T65yfXab%G`lcB*T4Jp;bPTW%^=o64T^g2+5ncBI!5K1lopgB-={
z=e@O!5aqnvsYp#m6Ut7VLj_6|$Bu6J;K!cIz^xZer!H-**c~FgsqLs&gI4tKLuEj;
zSEk=>no_^`MBsb*?>zbu#9(K=QqqQhUh7eU9}M;QaFBztR1gPuC5=toJ*gGh5*Fi1
zS+MTIy2>D(N=*U#t*>m~c^RRvu<r2x$%gU%lQ#%r#p{4lxvT2w%C~;dGY<}FmApWK
zW~pZLKu4K{r(Il{f~9Ei1XIW}{qOWqjZ!{~DT$Fc=@+rsWcY;}0ByrISQfz^NC0g$
zBxDkl|IJ508{9>n{Y&&8=1usH422O70PV7+{L8?B?|87!o&f;5Kv@M1Ahg_*_74-M
zLop@>Kp7O7pzWTx&}uI_ln6=yw8fMQ`rw7j@W0#~03iJH{4GcThClB(7U-TQ!yo8?
z;(GC*Q1JkuIVOz%)Z_I>@57(ImOAI({$G$0_n<-U<%1e|&<p;h_kVq$1N_(E&K{F!
zEm{De-1SdR<$q?u69Pc1NSOrwg+6~r{Tq}dRQ}rX?}G7vqX2+EX&FGS7L?F~?62Fb
zU>=lNt-m^mp>|*fXqd+zpY;LIHUeI#nHLv|hA{vdWJ(Vm2Xml=|M{+zVfd#H;b1!C
zYYXT%Fel;vU+jP3TK+py<W)Op<2xpXzhL)wXC42{>iee>|J$HHZ6Fes6ZGyKD|(^R
HU+F&p(a@|)

delta 8038
zcmZ9RWl)^Wy0r)QKyZh_-4iUhySuv&5+vy0?t{A%B)GdnfZ!I~-66P~ynEOA_Ss)`
zJ^kaZuD-kasan<RS|!_1#ivk2%5pHU*Z=?k5fE;{FJmR&`+k860H|RA0N9X8J3R23
zmM72LD=v3bZ48hSVjnc}`DG}l*gT4h?xV~IUsEmQQ;-PIg6L<4h&#~RoW5F8{AbD!
z33_wdUDbQvldk)?=SAQ1o7H!}+zp+sgRFzBNzV_$=AZo8!xLPkPsYjloIWRLppn;=
z`-_k>Vf6qCaioNM!fb2+B}TG&_7va_9P*jZFye^RM9}a7y=+r(2Z{S6{*SE87_&Jl
z+6U;g7-n>+NS{CVxxj?oLs4QzP{M8+=vPh?!YX+LmNs(dY=$O7vpuWQ6kX=dKzLvp
z@@ab)hAoYt9D+TZ`rCQ)VotyKUVV1gW+HEN1c*eoycY*wJ(UI5)}}NxHBy6HJZ0M6
zZfRsLU3*5MXTTvNfNhNHr=w96F{gXX_p<j{!!spDqCm!;DAS=)nBgLvnwh$~85ca2
z@tGw7x_2c+{XvQV7$GyO7o3ak{Rya=3m85s&e+YJeTNtivCPf0ml`H-iDwn8rJrPz
z?=})~uy$Dk*HB-CRLu{Zn%%)QUxC^y%bw-0DHy`AC@+R?7|dwFh?e=kpC=J%0!6rd
zgM!RaukzxRJWMCn4s=`UC>@V!8r`ic6g(7KNh1x4>>yWiG#$BCK3X*ymKzDGq>&f=
z;-9p#AFiDqH~C)2$uARUd9RPmt43=~4)xa(Byb-r2KFYi`s)gxV2r>+?R#8qT%t6L
zMw$#qtb(mSbW4dv>;1U)6L}?yEe;{j+*aD#7P%kL44}{3<9m|kE8>tQb_bQzKEYJk
zJd8*LCv@d_?S)7^pgZig?-_Y-^zczCpb#%-{@SnRZ6{@DXgs88iH;<0AF<0}s-@{n
z=)hs{-z_a)4fu-BPe=+TG5c|shSf=!cp_IuFe`RYP-hYK9amxanp8-_m8<SXF^Ool
zJ&ZTD*yF0Tg<gmVn<*VR8z+Z6Lr2wVcN&x6Pu5x<tXgq7)hz3@O6@ETRx&ZrFxJ!E
zhk}A)yaf{6=;^l`?}4o|ARyH^{-ebY4KLaN5v$)sY*3+S(HaVz_*E{3j6kARt077;
zKJDwaW82$t?Po_P*Gc)X<2gmK;(+|gB3J1`yQrlEQUa5W83abSNr^=PcrTwKqP|}w
z7|x?l;-!(~I^V>rOR|2>_{)^FaJThz_;1Uk5aVWB#|c^2J7}qp<jCfjKm^&@MqRw~
zHPtnE>3M~PL=@=2F{`;x6AZ|)lO8&z-xuLB$k6;0w5QV7<?Hb+`8{a&-E&AzyxCyI
zVV+j>Mem3x1JR4pP5M$^YNR;a$NTJAdc@psx3D;Nyi5%mK<1|^5ciuu!oNbH<vWlN
zI4AUfJxws?zQql&HrMPlW%k$t_iWI__L9Vnp2f8?{1N8BJbk2Gdp#$r4V_L=iJBd0
z$R;5h-ig2Vm#T|N?PO!ClnTt??>*T=%uI^rOZ*pxG~btoVz(@bQhksMr%R@J-gFQt
z#(!#@NS^pN!o8^)m5uB~n$nmkiU>5NJG4XaOa0Dj$JUm1?Q5Us=Qwpf${DTC9A+<Y
zI^L>Y-;FVWr{*l=ga;VAv`l$G5#5Ky4ipx5#tq>hD~!7^tMpifgvc^Vjr7}O9jj|6
zzNDHjZpE~fJMwl5`xFc!-J#z&cMPiDJ4BEX3gJs#TeA3KIdj%EXKTqK&VAOOZ0(SS
z8ww`3anjY3Vo17a)XJO<tM|NOvy9tDv59W#Qyb#IirMrI+0x%=-Fvk>$1&!myxdo$
zNvI#g0$z6y;7s~aI5r|v*N3OFN(z}9-_MV(fc;EWyRmhs9`b~G{Ek>93+)=2=)NKA
z3^R=TGi@L)(>~F@R$2y!L~uW;8%L?lIUR>={AG(aJ0mk$;R>U=ZAIutkN^7nRRE0%
zQf(-h2!t8Lltbe+Y3044zD1-Hg^HeB7i$dq(^@!v7?MHi`xV(%Wu=J-J8Z*Xs&1Vp
z6uh@|iAvtr1faM*Q-Thwnehi-U_Ov~BfM+<d{(j)bNPmexbE#5^B6Pm!vIN0TI)l6
zFN5^hh|HMm1>{^X>6P}STZiR6qIcyxM?X5a^>+zAT;_$-va%qd1j(H&rh)w9%z1o%
zJ&CBp_Mxp}jZtdn<c(KBSK9!RmU;2UDK{jR(Glx{0J{Z>th2QwhqvCrSBe^ETwE1H
zaP7`t(jsaBPtS&y;jQzMUc?E7FO)d2d7Zy|e9}8)aC<$^NZ-fZe}ZBXOHp74HK!DO
z6nD;#H7Zn=_u9UlYD&5nI4VjtDnyv=EbUs)j^tiBWB+ytNceT_N$;yy9w6}PvhG9a
z*u7Hl*CY#*TQr$zYxS#XJVramVai4RA=k6@hRE_y;EP29ULuOE^-ru)VmMkI7S%C=
z(7c8trqHctHOfGIWi*b$D8wapwm*B|i}pJ~dD~qH1CI=wI0J1MKXdCa?uHoe%Xky6
znKV|@dJ(rCZ<?=7KUKFF_i??+J6rVq>DD4?RpV6|j5=}8cyA+j*R4{&@vW_^ZhyUG
z7S9vDco<GpyP>~4*^%Aw3WD?}pGA%RBAu)Jd{QLsJIi@HrFLnj)r3sg%=>Z+{>GHS
zB-65Q0;1Q;+XlHDt4^EIc%3!$idZ&yjbjlPT{k$HI=EL}&=yXZkO3W20z3@z8PvF|
zaw~q2fVzwpr;B%k%wdnhHkMmy&rd9tnOwVb_mH?7g~DGJFqt(oD8RmK;7se<xq{?=
z2CSMd&5X~4<*l)#AM=LSw`ZTgt7S1zV#Y(r_u+YFfR9uNJ@*-j2uQ_n<m6K<{!3C!
z-bTuY>-hbESYM`wxGex>v>`EkL2+@AuwOJGI`k-%#r=mm^HO;=Q1=g)5FE+t5xati
zf`FPn-&S%iCL+YKmLbD=F1urcFMIo}cX<z0<c|3<;<gTo+S-PP?`fFeaB>WC7_%CR
zBY$b4V{$t6w4Lz6=H~Xqq`7XT!lanSq?ppEqW0{QjqtPKCq~~j%r9JgVab2ckJ^5_
z`f*suD-GN#Aaq|fB7aB;HlWRn5frq7>-{<#gmH$oa8$l(1P$_2X3RpkDELlG!BzfL
zjM9?Qx|iho3e2#uh#Wis!!sC}@zJ7}e~h)hZqG@}NVn7w&)PiI1pC|OCXa-WdQoAx
zZLT;qM}EubozGZSwbtkTWD?PEhB?PH)ZcDXw6Q-{{E&zvdWp9%$+b)W?Nt*z%_KKk
zHsVp|GT&i%<TYfxBEl^ez0n?B=UwBy{TY6sgEmYuT&tfzsTJQIoX~O&A|>B$L%Ly}
zwBV3LG775?UV)HCt04z(H#cuqx{O*imb)=&@rmjV2=&aA0HKkJvcifK&q8He+vyIQ
ziBiu_qokt6g(j2wO!&tu<F;qCh(A$Ff+lQx`nv-okB^0MJdWea6<wSs<+)jja|-nj
z8}f$KIR(Usv1R4KkbC8B)7XNXiX!J|^dvszLv*7rHM|k&znJAq%rzx=QKnf7r(#xZ
z>}Vd7z93cgbfNlt=(n4{h%4&Y_a$2d{VXk=Z{ufoYrTI2ai+~TFsRUu?k*CzNCwIf
z>cqzle{L!%w8>?B4z)yXdL$NdGQEw9*<#hP$Ly^jV;|}O$7JJ@j2UFVeN$|{A?n;R
z6V%sv0oZiB@l*mvSr*Ck7Xu%&x=fM0v@@%TbBl~j{yu5@FoAe?=XiykVhD&Q&tM%I
zFo|h5OS3)7<`k<G#_2^EanGxqXq3g{N-_-MTcT*K_v%MboOWe~6ZqpnhO4kbulZ20
z=fZ<y1&S;fb{5vPI+0*6IYAJ5j64D^MGdRA;+OuQggn<DyUydefl{EB4RbRt_6Zq(
zT^C_-Rs+_3r)2hrAV{e)^ELcg%*ObPso)WZpebk3;>R#63S?|1Z1c0|i95|0gH+_X
z*gG!vlgtc*)=X7usna12o}(-Ma7y)T{b*^od;EKF4WDrQJbOeG_brRp=}s88?UihX
zAA;_{=mitcR<+?(MsO7kON1!4;G_WWN@Z&#>hVSM+IT7)bvAvU7(-|v59tNZ{8#L2
zk((dtENyh)lkclkY`G+O5s$`BOFjY|_biI0nReg85gt=A9Bzh!pJJ5ula!qjNo4|x
zzl;fj*XC&4=->t7m)R4IJZ^j*B>H-vV=Ec=@P%Rx_BnP4kE({gU#TInV#Rvq{t4IE
z1)7e+8^hZfK{i4Z_z2+}vaJwrXBc)h_W<5TfrIf3jJF#TncULT&kMHL2Ddvu_`mCh
zvu^{HG}##7TU{Pj<<`?@TWTRv#@^EtY8OIaTlb%6&XU1OAK5icB}{J^OIZs-F)-+2
z01B1Ee*`~wg<EVeFfw<Y{fVM)Gd{TsHef3r=GC*86ujho9FG7z*Q0k@-(W*zb70;W
z+j5r;uM6M>IPDTQ{2Kx-%Zn`8$L$?19qfkF>Fa(4rz>&uR^i4Hd1T{Zzk11)UJX9u
zT&~N*boIxB0sj~!<iAD<0GRNBR4CD4h+7|P{l`5G`9P*vSfM$s>!Db2VIW$L*!3Rj
z%dm+5_Ewng5CRTPXo!BjB8LVE<P}6%f1~6CTMuP)gjk=T;{;c4hQ$hBkH9<(^<lz?
zU#6d?dqDcH4_l&ulu%KD|7rC@*Wv5RXUw-Mqkv;Ei9rqvtCCmpT$Y0p_epNW<EXW<
zJq`kNaZyaY#7(FoY=e_`ze#9vBvsYKJ4J}IxN)sElY6djeu>(hZi?v;=|Y6%7!?lc
zyO!=ibgDgY>=UC~k$Hxn`Ik5y9Un@vGvSeS8m>-UdwLBT>>aQdTQ<jY*|jJ&(WPF1
z29?>znN|9BIk?3@ix<3J*J9WOGs>I`?S}nFS?i%Fib1SHmlq@1q1hxV(~r2vPHftm
zp6WClR>f0$oe9)*t-28|eXjJ8&$~jVeda2H3@XwZhC%Cs2O93^&;q0{e8%?uI4d-d
za9uQV``R^+S!iI&^i&GgFf&Ql=y|nqg<w56dWo0jXEHpYsP7$Y>YMY4Q&U)2^t*5K
znS&eJpkKQ^5qZH?s-~bLmmDMkvkM{l@tx38jpr9}#{A*tz~A+?sCEzvoY<I9WU3Y9
zCUWN4H4Gui(Z2h@)RQTfmSx07#zmPfQy-n}Ye}_L2SG4N0?WX#cxnb*i`M(l@Kiw^
zo?@se&&|wr#qZf`{ryr3#!(U!@fKuf>&a+c8u~@*D6Bza3sDCwMEgVLewC*F)o}Z$
zm<0=+@se44ydjPq8NtE1$2nzrshuesmmdQ&$2{^D13x823EQ1+%vm=?SgU0&TY>0q
z2{aaL4Pjui*o|B;eog13W4BvG*iKEn1lt>j>Jwqa=Ivu}cHBlT$#3I_{p0JqyS1H_
zicIbep|{(8%Wv#884qE~D8w{DHaPrE>Ks8LC91i&E{sVzd{LQ#Q=8cY-bbgmRt`F=
zOff^nvYKpS2R2yIy}!}4I#V<V>qCq+KHjJf6sdvZwn(%#7xC$%S=ZJEINb#a(x6U1
z(h|aB{MZ_ow+|=mvWu2Tkdb1bmkk2SRvH`j5e9r(v4N#Ex;(^dpQ*tnli)IItVc)~
z=cp`c&t!Yp37)sBbd*YFvADA)sdU#LQhoU0)+s<S<8>1Esg`$nekjNNu*}%f%}K(v
z(<U5jDdui^i_e#xl{L4DsBTN37l4Wx{3Z6+wcd<4i~1CZ-)3Tb4xSsQG!0h}W=u3f
z9yH+0@@xAlq`3|kF$Xs)k+zKcdCmt+*zi1eZ@UDK=FHM$`Bbb@mi?uqs#^;{B*u~D
zI#K%_H!5lKhkA0_H!RI2oiO}9J)%Q&y{RlP`-Zp|Y>kZ|r{!$=w`0K)$+(^Y1l}9e
zURtl~hP^Jn9|Dg6UpW3$Ijn~}fhGyRK&Sfc-<;c5(Q7E1APxLQwkaij$rPtxz}PoC
zlHh3fP~|L5j2_-NuWF&-l)bUWB*d)CGZ)5SG}wMwtuG|ds~h3c<qtq83eciVgS#-e
z3$tvOeejlNNK;19L{Tr)$&O+QeuTGPa6VE3Al7TeNY4H9q_umkz`~Kh6rBp`1M?y3
zHwwaL5hmREa>nvfRZf(=pmrTl`REa{%!i3c?CC(}q*dGeN>QeHqa-@UWIJ~RO+*1p
z*U0W)yyv8!q-!dE0<Vo%jmem~?k*O<@MzK^_Z(~ACXNekJ5pnL4v}8P9&1!sGwY{G
zu$}FaKH1qw2@-R8bD0h#b4<rw1FQVucF7E2fzM;Nkr>&)rXFvvDAMsfJ*Cv^<%cw+
zCndoG>xAJ{uT-h(;027&JQUZ#cQ?~R{QlFrn+m$r%}%>r@(OLpJ3XFzb&Z~2WX9Uy
zgoBxVF6Dwop-};2s3Fb16ci8$GLYoZC#wouNNlwcUX=_-<2;RNl#jqeBVsb@VP?9)
z&biUEisQFewRcht)KRy<j$I5Ke)}{<O+}E<yM4fHPy}mwsljkakFRq;;CWnzcQ%{=
z<XxzV0gBu&6Y24qdrF-L_Vt0^CUhl?Ig$J6-*k}vG@K-|ZZnLz-+ZLlz2{L%8)JS*
ze5&4BlB`yA&gd|TP|M;6H64FvE(+$4Gpd4ceXs=zI<j@{EFoH15(#y8d9S+c+NPg-
zK0x8Tv24&TvVo{7>T;-Qtqbj$=ev}Tulcn11p<zb#Uj9kG<2*tRGeT^Zv{lT-DjV3
z(ui5IAQq-dgg86amCh2qGY|$w6OO2g!N`qtJl1XK2>#Hi1nmncIn;qp*bpZb5y*f^
z;Z`qm?w3I$u5CgAVcOy(8g<u(3>u%+)So`QY?SJ_?KBl0ulpUB2%^r*_>)VkJ9@<?
zRIm8K5ZYJS6il&3<zcY-aSh@G%_-{nfVg5v17q-Tw_Zn=KF0Q`X|4^W9n;yNSfH!#
zn?;>pGo{VRwvUhh>pR`e&yKA(`rppJ_vuAdLoX<|tAO}51nUcO-nl&%oIk$@G8{1h
zgrjf{Y3T2lo`PddX6ze36FI6MQ+3CKiu4XqJGaR;UXA2SIB&sP36%>L%%C8gHE$>~
z2wf&iyumOoza-Fqn<4SBprFN?pB$J#?&~Y{N<ZrJ?&$~W|AEw00?oO#Ke|!`SKogV
z|GX-)vWcZm+f=HI;<QapWxX{O!iD_?EujRPhTydz@rOgD1g1Wp$|f+Q)Lbb15HDg}
zM<pWZT>d;UP8K}7&tYDL<O1n0_xxfKkv@C+a(ZeXi46;+=8E`3nfTcx!lCW@j361Q
zR@>#6;WwdayX1OzbL7m}?AKX=D~RFgIWaN&eq6|hm3&)o<c@|iLZ(3rhu~7_g(kNl
z^DKyqf_?-FJ>EKYV`QZ=Zrdx$QYrh-mDTGT`eW2oo(}N)6xAmOp^xFXw>R~x14%jZ
z27YO@<+C}6%vU+qynl$7#Y<BdnHV}jbsmn~WM5%~NHPWc+4C3R^X>PekfX<cdTP)l
z|0uTC?8vV|iCYNNWv7AkG<S^R(%m}=1Q#wZh~9~Pz?~zcEj(HsO0!Mxxu{ZYKwsu8
zrZDPddH({wP|2=2F!SL%Dm&^wM+T-sRYtc(+m3e?q}V6-7eVv~`kkwvs*yexZc&Jo
zu3T|ll9o7BXY!>XyNNmZJ)zZk7HJ^o6#QPvT+!oLQr~Bs&D-`|D`x0tsj%zMGaTg*
z{qjZ9CL~elCxoMyZk0$Q-llGU2y0+i)wyJL;hF^8KBg|`&Q=>V8L>n)vYR0pk){|x
zNGCAi;3?p)pr5#cvnud*KW}RR@)`nZwyO92aX!M>Xdp!N4e@lBSyP0xZm7<t$Ok(>
zaawIzjr`(=x%Qy`+#_tF35Aa>BL{)6&ns4I{qiX<epCZGNxm}v7QTQIODDW6t8C^W
z2RQ}|!fWEkYl}qFp)4gYW^gufZe(7zqyyx8OWCY{R&EZ*!PGrs80h^n>De|LE+#VD
zN)t>vO)Zl$J%$<=6rm|uRGT|WI8ea>aq#RHCr%4q*f&9X#yWY%lvGk|8>Uf2RI84`
zYo53leB3My;SF%GX6yPGdAp{~=FqV#Q~n6XymPfAdIS+x)k>HL1*ra_GmR^B;0|Gt
z^#D{}z2ZrB9j%MRYh}5;%(HV|2s5#ETW!#u;g!EK)a<<Hq5zvV^D#EvL^{3R?t4^W
zWL$H`A+;0rUV0=9mFJ{Khp8U#wl~Eh4&3;@K5lNF@3WZ|!&>)AgXGLk_p5AdTa#dN
zL^u+?Gnj}#>*>h0#Vz!*6H?T;N)km3+8Nirg2CV~KXAd0RyxE>OHG9~SE-0j;c$13
z>BRAyD2dqSmVsXBKM)lZrW9zSk!9<!yLWF9E2*MgzI&~)CpU}Q`*7Oue2>|{w1#{q
z3s%VD=%ptqo)P0Ox=05Mp7Ft1Pila<$v%7zIz$Dmn@O4Hwhx8cV0~#zXk|wT<ATyE
zCu@)E%QGR@AVcci=7A?nXZ{fQVQSIpaJ<lB1_0saIzgV9BtO-|(*zYq)hGQ{`#k81
z8O7JB(bz<1KU-l2GO~_(a=R#nYFN-FN@?^AdGOhmu%*2ylPMHLE9g(XzZU{`A^)l<
zXUXyFx;f}l@WNfJa$r=!yOB$-)I9$~ip$%73bSVDO=1R2*%euf_kKJ3-9qBVoao-u
z(DX74+PjWO4&y$A0`b=#2sA|yy0V^I!9E-F5X91++Rt<bS&rtAg7cy1j(fZOLVh#B
za)>sSV8{t|k6`Tv?1zLum%&+gu8-Kk+!*F2*;<*~`uyT6JsB{9fibGOl7dYqxeAi*
z^%w|=B;qGfo!MSTw)MVRXJsPx)PA2S@B@LJof|HUAntyF)A-PFX0(ng19v=)+{=0I
z>sQi+be@NM^`2@^To0`OSQ&`310jTm=_f=*N4P$b03HR=!<S!%C2y1!!ih!&9cTm5
zLF<Fsttb8<1&8!cUZim867~eSu>ykSAay+0@SC08eVy}Y;drOzhI#(q$pc3n!i3p`
zF%juTs>#|d_cQ5#H}IFcluz_$LJAS^16#_4PSZ5wH>-j7KR>`f0|t%6!YlYjZj=ZE
z0$?Gz9PCPnA%Ac*jKmBwKE#!epyiN}fpfuV)K%<zHc-jphA74!4W3vQ+xOu6&C+Wn
z4bIU9xjqjGL0z}7+Ttlay0o#0(x?0GwSGowx;OE6L@@Knh$(@$@buEWscuHCk9y#U
z5018K`RCLVXET9<Wo21xm5h`EZH{@e0P3hjmiIRHwo8Pt?qlPMB+J^QqD}XNjK!fX
zfsuAh?4Igazf6mDGk7~IF92BC=g|#*Fnns*O7}Ix_%PjLyonnv2bIt0Vvk|eg!MJV
zTl1^kj$(^Cble?i)*2?&BPMvCQG}Lc{6;vyvoe7y;)tJcRzSG_`oix)nX}3)qD9O2
zf(AAKY1!2^H#Ai;$M_%~pS#f+)8N|hlSKRgFH*rhK2P(NOD1By0|!{IZl@wcR7Am$
z;Ai=u*6HX}OKfXPgH+ef6_7SvmNn^}eOd3#E-d5MeO-4yho<U+ZMr>SYpEeIMpUu6
zw3TvlKtrdSN7#n^(05(WPM!}*{s)5{c%dX^I-1RtlNZE-=79{ZL!C(J&6`{}*F_D=
zbvbi6{H6y)2vJYc-z30E+}hnR_;!r~7W&zzqUjn%zKbo;M?y-Ewon-HyzH!V>-jzb
z^0}Af)bot~LvZ<yAKA`n+Vamd^|?y3w9b|6YR^B8M>OeMTTOEvs9;&_`n!Iul6cvk
zBMLuAp_-SHb|TqnrsDmhPUE=mVmP<XWV852C3L4L$-XY2WG@AV<zP)FT^hD_56syz
zG-{?+(*jaYCclOPp)R}XizBT0^s1&AyrzfjCwoc{zOmxjewtSC(GOH-)*ionD>r`U
z#8Ah0iOw@U-li0vTnpOqpp$atb4pojXlQw;hg4(}bqi(1QDqNSeBJ6(1AbGnS{{oe
zs@9Hq{+$PgQkKK`zbR@75%zBgk)5nsUDO)ndMr9RDr+{HK^CIVNeRutMC{<u8Yn=F
z#-5CzQC!;gfY)|Nw680fuJuTS@2Q0=?g>jsz_;w;4D}Z|KtW@}{C7GFX|dx%{C^yx
z8$`?iL<0cKtX&)(ELhdVVF9pE0Dy)%901|pd;$uZ6!7mI{t^lj5HXAv8UV7zLJG_I
zmnlHx92ubVFd!a|T>k+T_8?;DBpgU2i1IJ5fcyb5LDO(TC>^;V(oUq%<=hZ!Cwj<@
zBMme}7((R43^BvP{tGGq04M<Y-x)>{l5funL14!Id#e8}a>xT9gv|61bPy`=zv%`5
z@bT~X&&o#y0HlJ73|ib8V&lLB9iR(Ib)fsJMuh)r0Ra4sr2*!8kZDH-NFu@i?VF<q
zxwPj7{;yo6{=Ebs3;=-gU%MAs0w98D1pnw5i#-#Jn>7G}j*idt|6lXJL=74Mn1TNr
ug8%Dq|DODzR_!6JP88(-DBnN-*!FMT^Y4fCUyBf(AkR+J@P$tQRR0I>yavhu

diff --git a/testing/talos/talos/talos-powers/chrome/talos-powers-content.js b/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
index a71e97f864e3..f5c565c36560 100644
--- a/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
+++ b/testing/talos/talos/talos-powers/chrome/talos-powers-content.js
@@ -2,8 +2,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// This file is loaded as a framescript
-
 var { interfaces: Ci, utils: Cu } = Components;
 
 /**
@@ -82,42 +80,3 @@ addEventListener("TalosPowersContentGetStartupInfo", (e) => {
                               event));
   });
 });
-
-/* *
- * Mediator for the generic ParentExec mechanism.
- * Listens for a query event from the content, forwards it as a query message
- * to the parent, listens to a parent reply message, and forwards it as a reply
- * event for the content to capture.
- * The consumer API for this mechanism is at content/TalosPowersContent.js
- * and the callees are at ParentExecServices at components/TalosPowersService.js
- */
-addEventListener("TalosPowers:ParentExec:QueryEvent", function (e) {
-  if (content.location.protocol != "file:" &&
-      content.location.hostname != "localhost" &&
-      content.location.hostname != "127.0.0.1") {
-    throw new Error("TalosPowers:ParentExec may only be used with local content");
-  }
-  let uniqueMessageId = "TalosPowers:ParentExec:"
-                      + content.document.documentURI + Date.now() + Math.random();
-
-  // Listener for the reply from the parent process
-  addMessageListener("TalosPowers:ParentExec:ReplyMsg", function done(reply) {
-    if (reply.data.id != uniqueMessageId)
-      return;
-
-    removeMessageListener("TalosPowers:ParentExec:ReplyMsg", done);
-
-    // reply to content via an event
-    let contentEvent = Cu.cloneInto({
-      bubbles: true,
-      detail: reply.data.result
-    }, content);
-    content.dispatchEvent(new content.CustomEvent(e.detail.listeningTo, contentEvent));
-  });
-
-  // Send the query to the parent process
-  sendAsyncMessage("TalosPowers:ParentExec:QueryMsg", {
-    command: e.detail.command,
-    id: uniqueMessageId
-  });
-}, false, true);  // wantsUntrusted since we're exposing to unprivileged
diff --git a/testing/talos/talos/talos-powers/components/TalosPowersService.js b/testing/talos/talos/talos-powers/components/TalosPowersService.js
index c50f62920c34..49889598e189 100644
--- a/testing/talos/talos/talos-powers/components/TalosPowersService.js
+++ b/testing/talos/talos/talos-powers/components/TalosPowersService.js
@@ -41,7 +41,6 @@ TalosPowersService.prototype = {
     Services.mm.addMessageListener("TalosContentProfiler:Command", this);
     Services.mm.addMessageListener("TalosPowersContent:ForceCCAndGC", this);
     Services.mm.addMessageListener("TalosPowersContent:GetStartupInfo", this);
-    Services.mm.addMessageListener("TalosPowers:ParentExec:QueryMsg", this);
     Services.obs.addObserver(this, "xpcom-shutdown", false);
   },
 
@@ -67,11 +66,6 @@ TalosPowersService.prototype = {
       }
       case "TalosPowersContent:GetStartupInfo": {
         this.receiveGetStartupInfo(message);
-        break;
-      }
-      case "TalosPowers:ParentExec:QueryMsg": {
-        this.RecieveParentExecCommand(message);
-        break;
       }
     }
   },
@@ -262,58 +256,6 @@ TalosPowersService.prototype = {
                           startupInfo);
     }
   },
-
-  // These services are exposed to local unprivileged content.
-  // Each service is a function which accepts an argument, a callback for sending
-  // the reply (possibly async), and the parent window as a utility.
-  // arg/reply semantice are service-specific.
-  // To add a service: add a method at ParentExecServices here, then at the content:
-  // <script src="chrome://talos-powers-content/content/TalosPowersContent.js"></script>
-  // and then e.g. TalosPowersParent.exec("sampleParentService", myArg, myCallback)
-  // Sample service:
-  /*
-    // arg: anything. return: sample reply
-    sampleParentService: function(arg, callback, win) {
-      win.setTimeout(function() {
-        callback("sample reply for: " + arg);
-      }, 500);
-    },
-  */
-  ParentExecServices: {
-
-    // arg: ignored. return: handle (number) for use with stopFrameTimeRecording
-    startFrameTimeRecording: function(arg, callback, win) {
-      var rv = win.QueryInterface(Ci.nsIInterfaceRequestor)
-                  .getInterface(Ci.nsIDOMWindowUtils)
-                  .startFrameTimeRecording();
-      callback(rv);
-    },
-
-    // arg: handle from startFrameTimeRecording. return: array with composition intervals
-    stopFrameTimeRecording: function(arg, callback, win) {
-      var rv = win.QueryInterface(Ci.nsIInterfaceRequestor)
-                  .getInterface(Ci.nsIDOMWindowUtils)
-                  .stopFrameTimeRecording(arg);
-      callback(rv);
-    },
-  },
-
-  RecieveParentExecCommand(msg) {
-    function sendResult(result) {
-      let mm = msg.target.messageManager;
-      mm.sendAsyncMessage("TalosPowers:ParentExec:ReplyMsg", {
-        id: msg.data.id,
-        result: result
-      });
-    }
-
-    let command = msg.data.command;
-    if (!this.ParentExecServices.hasOwnProperty(command.name))
-      throw new Error("TalosPowers:ParentExec: Invalid service '" + command.name + "'");
-
-    this.ParentExecServices[command.name](command.data, sendResult, msg.target.ownerGlobal);
-  },
-
 };
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([TalosPowersService]);
diff --git a/testing/talos/talos/talos-powers/content/TalosPowersContent.js b/testing/talos/talos/talos-powers/content/TalosPowersContent.js
index 673967920f53..fbcc0b2dff95 100644
--- a/testing/talos/talos/talos-powers/content/TalosPowersContent.js
+++ b/testing/talos/talos/talos-powers/content/TalosPowersContent.js
@@ -2,14 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// This file should be executed by the [possibly unprivileged] consumer, e.g.:
-// <script src="chrome://talos-powers-content/content/TalosPowersContent.js"></script>
-// and then e.g. TalosPowersParent.exec("sampleParentService", myArg, myCallback)
-// It marely sends a query event and possibly listens to a reply event, and does not
-// depend on any special privileges.
-
 var TalosPowersContent;
-var TalosPowersParent;
 
 (function() {
   TalosPowersContent = {
@@ -52,40 +45,4 @@ var TalosPowersParent;
       });
     },
   };
-
-  /**
-   * Generic interface to service functions which run at the parent process.
-   */
-  // If including this script proves too much touble, you may embed the following
-  // code verbatim instead, and keep the copy up to date with its source here:
-  TalosPowersParent = {
-    replyId: 1,
-
-    // dispatch an event to the framescript and register the result/callback event
-    exec: function(commandName, arg, callback, opt_custom_window) {
-      let win = opt_custom_window || window;
-      let replyEvent = "TalosPowers:ParentExec:ReplyEvent:" + this.replyId++;
-      if (callback) {
-        win.addEventListener(replyEvent, function rvhandler(e) {
-          win.removeEventListener(replyEvent, rvhandler);
-          callback(e.detail);
-        });
-      }
-      win.dispatchEvent(
-        new win.CustomEvent("TalosPowers:ParentExec:QueryEvent", {
-          bubbles: true,
-          detail: {
-            command: {
-              name: commandName,
-              data: arg,
-            },
-            listeningTo: replyEvent,
-          }
-        })
-      );
-    },
-
-  };
-  // End of possibly embedded code
-
 })();
diff --git a/testing/talos/talos/test.py b/testing/talos/talos/test.py
index 0de9f19bb3a7..1f80943459ed 100644
--- a/testing/talos/talos/test.py
+++ b/testing/talos/talos/test.py
@@ -498,9 +498,7 @@ class tp5o_scroll(PageloaderTest):
     tpmozafterpaint = False
     preferences = {'layout.frame_rate': 0,
                    'docshell.event_starvation_delay_hint': 1,
-                   'dom.send_after_paint_to_content': False,
-                   'layout.css.scroll-behavior.spring-constant': "'10'",
-                   'toolkit.framesRecording.bufferSize': 10000}
+                   'dom.send_after_paint_to_content': False}
     filters = filter.ignore_first.prepare(1) + filter.median.prepare()
     unit = '1/FPS'
 
@@ -690,9 +688,7 @@ class tscrollx(PageloaderTest):
     """ ASAP mode """
     preferences = {'layout.frame_rate': 0,
                    'docshell.event_starvation_delay_hint': 1,
-                   'dom.send_after_paint_to_content': False,
-                   'layout.css.scroll-behavior.spring-constant': "'10'",
-                   'toolkit.framesRecording.bufferSize': 10000}
+                   'dom.send_after_paint_to_content': False}
     filters = filter.ignore_first.prepare(5) + filter.median.prepare()
     unit = 'ms'
 
diff --git a/testing/talos/talos/tests/scroll/iframe.svg b/testing/talos/talos/tests/scroll/iframe.svg
index c9005d9ac07c..18948c400360 100644
--- a/testing/talos/talos/tests/scroll/iframe.svg
+++ b/testing/talos/talos/tests/scroll/iframe.svg
@@ -35,5 +35,5 @@
   <!-- this has to come after the iframe for some reason -->
 	<script type="text/javascript" xlink:href="../../scripts/talos-debug.js"/>
 	<script type="text/javascript" xlink:href="../../scripts/Profiler.js"/>
-	<script type="text/javascript" xlink:href="../../pageloader/chrome/tscroll.js"/>
+	<script type="text/javascript" xlink:href="scroll-test.js"/>
 </svg>
diff --git a/testing/talos/talos/tests/scroll/reader.htm b/testing/talos/talos/tests/scroll/reader.htm
index 4b23bad1bd7f..edfbb0562097 100644
--- a/testing/talos/talos/tests/scroll/reader.htm
+++ b/testing/talos/talos/tests/scroll/reader.htm
@@ -4,7 +4,7 @@
 <title>Perf test case</title>
 <link type="text/css" rel="stylesheet" href="reader.css">
 <script src="../../scripts/Profiler.js" type="text/javascript"></script>
-<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
+<script src="scroll-test.js" type="text/javascript"></script>
 <!-- 
 This resembles the layout of Google Reader as of 2009-11-23
 and exposed bug 530686.
diff --git a/testing/talos/talos/tests/scroll/tiled-downscale.html b/testing/talos/talos/tests/scroll/tiled-downscale.html
index 04284227fb91..7676f793cc72 100644
--- a/testing/talos/talos/tests/scroll/tiled-downscale.html
+++ b/testing/talos/talos/tests/scroll/tiled-downscale.html
@@ -9,7 +9,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
+	<script src="scroll-test.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html b/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
index 2659cd352ff4..eab841b63240 100644
--- a/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
+++ b/testing/talos/talos/tests/scroll/tiled-fixed-downscale.html
@@ -10,7 +10,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
+	<script src="scroll-test.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled-fixed.html b/testing/talos/talos/tests/scroll/tiled-fixed.html
index cb730d13dd9a..11a737599ae3 100644
--- a/testing/talos/talos/tests/scroll/tiled-fixed.html
+++ b/testing/talos/talos/tests/scroll/tiled-fixed.html
@@ -7,7 +7,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
+	<script src="scroll-test.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>
diff --git a/testing/talos/talos/tests/scroll/tiled.html b/testing/talos/talos/tests/scroll/tiled.html
index c5bb5c547030..d1ec8054dfe7 100644
--- a/testing/talos/talos/tests/scroll/tiled.html
+++ b/testing/talos/talos/tests/scroll/tiled.html
@@ -6,7 +6,7 @@
 	}
 	</style>
 	<script src="../../scripts/Profiler.js" type="text/javascript"></script>
-	<script src="../../pageloader/chrome/tscroll.js" type="text/javascript"></script>
+	<script src="scroll-test.js" type="text/javascript"></script>
 </head>
 <body onload = "testScroll(window, 5)">
 <P>

From 0baf8d2b406e202bb7d380e08ffe377b98e20389 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 23 Sep 2016 12:09:43 -0400
Subject: [PATCH 055/102] Bug 1300908 - Avoid using expanded principals as the
 loading principal of XHR; r=smaug

---
 dom/xhr/XMLHttpRequestMainThread.cpp          | 21 +++++++++++++++++++
 .../tests/unit/test_allowedDomainsXHR.js      |  5 +++++
 2 files changed, 26 insertions(+)

diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 895c80d3c02c..24e98c91e432 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -2414,6 +2414,27 @@ XMLHttpRequestMainThread::CreateChannel()
     secFlags |= nsILoadInfo::SEC_COOKIES_OMIT;
   }
 
+  nsCOMPtr<nsIExpandedPrincipal> ep = do_QueryInterface(mPrincipal);
+  if (ep) {
+    // If we have an expanded principal, instead of using that, select the
+    // principal in the whitelist which can load our URL, and use that instead.
+    nsTArray<nsCOMPtr<nsIPrincipal>>* whitelist = nullptr;
+    ep->GetWhiteList(&whitelist);
+    if (!whitelist) {
+      return NS_ERROR_FAILURE;
+    }
+    MOZ_ASSERT(!(secFlags & nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS));
+    bool dataInherits = (secFlags &
+      (nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS |
+       nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS)) != 0;
+    for (const auto& principal : *whitelist) {
+      if (NS_SUCCEEDED(principal->CheckMayLoad(mRequestURL, false, dataInherits))) {
+        mPrincipal = principal;
+        break;
+      }
+    }
+  }
+
   // Use the responsibleDocument if we have it, except for dedicated workers
   // where it will be the parent document, which is not the one we want to use.
   nsresult rv;
diff --git a/js/xpconnect/tests/unit/test_allowedDomainsXHR.js b/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
index dab2dd1c431c..fd7c17c34de3 100644
--- a/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
+++ b/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
@@ -54,6 +54,11 @@ function run_test()
   var res = cu.evalInSandbox('var sync = createXHR("4444/simple"); sync.send(null); sync', sb);
   do_check_true(checkResults(res));
 
+  var principal = res.responseXML.nodePrincipal;
+  do_check_true(principal.isCodebasePrincipal);
+  var requestURL = "http://localhost:4444/simple";
+  do_check_eq(principal.URI.spec, requestURL);
+
   // negative test sync XHR sending (to ensure that the xhr do not have chrome caps, see bug 779821)
   try {
     cu.evalInSandbox('var createXHR = ' + createXHR.toString(), sb);

From 3014d2c1e72e5ccde1d5b69ae8fbf9b2fe5284b0 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 27 Sep 2016 12:49:18 -0700
Subject: [PATCH 056/102] Backed out changeset f82827622145 (bug 1304042) for
 making the build fail on existing failures a=backout

---
 Makefile.in                                |  2 +-
 toolkit/crashreporter/tools/symbolstore.py | 19 ++++++-------------
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index 5a8675f6f327..88d225966132 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -313,7 +313,7 @@ ifdef MOZ_CRASHREPORTER
 	  $(foreach dir,$(SYM_STORE_SOURCE_DIRS),-s $(dir))               \
 	  $(DUMP_SYMS_BIN)                                                \
 	  $(DIST)/crashreporter-symbols                                   \
-	  $(MAKE_SYM_STORE_PATH) >                                        \
+	  $(MAKE_SYM_STORE_PATH) | grep -iv test >                        \
 	  $(DIST)/crashreporter-symbols/$(SYMBOL_INDEX_NAME)
 	echo packing symbols
 	$(NSINSTALL) -D $(DIST)/$(PKG_PATH)
diff --git a/toolkit/crashreporter/tools/symbolstore.py b/toolkit/crashreporter/tools/symbolstore.py
index f1f32710a56c..77df850c8357 100755
--- a/toolkit/crashreporter/tools/symbolstore.py
+++ b/toolkit/crashreporter/tools/symbolstore.py
@@ -549,18 +549,15 @@ class Dumper:
         '''Process all pending jobs and any jobs their callbacks submit.
         By default, will shutdown the executor, but for testcases that
         need multiple runs, pass stop_pool = False.'''
-        success = True
         for job, callback in JobPool.as_completed():
             try:
                 res = job.result()
             except Exception as e:
                 self.output(sys.stderr, 'Job raised exception: %s' % e)
-                success = False
                 continue
             callback(res)
         if stop_pool:
             JobPool.shutdown()
-        return 0 if success else 1
 
     def Process(self, *args):
         """Process files recursively in args."""
@@ -598,10 +595,7 @@ class Dumper:
                     yield fullpath
 
     def SubmitJob(self, file_key, func_name, args, callback):
-        """Submits a job to run |func_name| with |args| to the pool of
-        workers, calling |callback| when the job completes. If the function
-        call raises, the call to `Dumper.Finish` will return failure.
-        """
+        """Submits a job to the pool of workers"""
         JobPool.submit((self, Dumper.lock, Dumper.srcdirRepoInfo, func_name, args), callback)
 
     def ProcessFilesFinished(self, res):
@@ -977,7 +971,6 @@ class Dumper_Mac(Dumper):
             subprocess.check_call(cmd, stdout=open(os.devnull, 'w'))
         except subprocess.CalledProcessError as e:
             self.output_pid(sys.stderr, 'Error running dsymutil: %s' % str(e))
-            raise Exception('Error running dsymutil')
 
         if not os.path.exists(dsymbundle):
             # dsymutil won't produce a .dSYM for files without symbols
@@ -1050,17 +1043,17 @@ to canonical locations in the source repository. Specify
         pdbstr = os.environ.get("PDBSTR_PATH")
         if not os.path.exists(pdbstr):
             print >> sys.stderr, "Invalid path to pdbstr.exe - please set/check PDBSTR_PATH.\n"
-            return 1
+            sys.exit(1)
 
     if len(args) < 3:
         parser.error("not enough arguments")
-        return 1
+        exit(1)
 
     try:
         manifests = validate_install_manifests(options.install_manifests)
     except (IOError, ValueError) as e:
         parser.error(str(e))
-        return 1
+        exit(1)
     file_mapping = make_file_mapping(manifests)
     dumper = GetPlatformSpecificDumper(dump_syms=args[0],
                                        symbol_path=args[1],
@@ -1074,7 +1067,7 @@ to canonical locations in the source repository. Specify
                                        file_mapping=file_mapping)
 
     dumper.Process(*args[2:])
-    return dumper.Finish()
+    dumper.Finish()
 
 # run main if run directly
 if __name__ == "__main__":
@@ -1082,4 +1075,4 @@ if __name__ == "__main__":
     # note that this needs to be in the __main__ guard, or else Windows will choke
     Dumper.GlobalInit()
 
-    sys.exit(main())
+    main()

From 588f79ddd9c7ca42211dca6216b385ec4285cff8 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 27 Sep 2016 15:36:41 -0400
Subject: [PATCH 057/102] Bug 1301777 - Use nsCOMPtr for stack variables.
 r=mccr8

--HG--
extra : rebase_source : cdbc82c57f3904ea98d5392a9587351447496763
---
 dom/base/nsINode.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dom/base/nsINode.cpp b/dom/base/nsINode.cpp
index 5887b8520d09..1e8743c98a11 100644
--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -1765,7 +1765,8 @@ nsINode::Before(const Sequence<OwningNodeOrString>& aNodes,
     return;
   }
 
-  nsINode* viablePreviousSibling = FindViablePreviousSibling(*this, aNodes);
+  nsCOMPtr<nsINode> viablePreviousSibling =
+    FindViablePreviousSibling(*this, aNodes);
 
   nsCOMPtr<nsINode> node =
     ConvertNodesOrStringsIntoNode(aNodes, OwnerDoc(), aRv);
@@ -1788,7 +1789,7 @@ nsINode::After(const Sequence<OwningNodeOrString>& aNodes,
     return;
   }
 
-  nsINode* viableNextSibling = FindViableNextSibling(*this, aNodes);
+  nsCOMPtr<nsINode> viableNextSibling = FindViableNextSibling(*this, aNodes);
 
   nsCOMPtr<nsINode> node =
     ConvertNodesOrStringsIntoNode(aNodes, OwnerDoc(), aRv);
@@ -1808,7 +1809,7 @@ nsINode::ReplaceWith(const Sequence<OwningNodeOrString>& aNodes,
     return;
   }
 
-  nsINode* viableNextSibling = FindViableNextSibling(*this, aNodes);
+  nsCOMPtr<nsINode> viableNextSibling = FindViableNextSibling(*this, aNodes);
 
   nsCOMPtr<nsINode> node =
     ConvertNodesOrStringsIntoNode(aNodes, OwnerDoc(), aRv);

From 176384949f2206fa0837ed911c4047bc9df7d24d Mon Sep 17 00:00:00 2001
From: Alessio Placitelli <alessio.placitelli@gmail.com>
Date: Tue, 27 Sep 2016 01:32:00 -0400
Subject: [PATCH 058/102] Bug 1305654 - Fix the SetMaximum C++ API for Scalars.
 r=gfritzsche

--HG--
extra : rebase_source : 0336b8ab252e6e17c821692cff56cfdf8abafe87
---
 toolkit/components/telemetry/TelemetryScalar.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/telemetry/TelemetryScalar.cpp b/toolkit/components/telemetry/TelemetryScalar.cpp
index 6b0d847711a3..3ffd07d1c81b 100644
--- a/toolkit/components/telemetry/TelemetryScalar.cpp
+++ b/toolkit/components/telemetry/TelemetryScalar.cpp
@@ -1697,7 +1697,7 @@ TelemetryScalar::SetMaximum(mozilla::Telemetry::ScalarID aId, uint32_t aValue)
     return;
   }
 
-  scalar->SetValue(aValue);
+  scalar->SetMaximum(aValue);
 }
 
 /**
@@ -1718,7 +1718,7 @@ TelemetryScalar::SetMaximum(mozilla::Telemetry::ScalarID aId, const nsAString& a
     return;
   }
 
-  scalar->SetValue(aKey, aValue);
+  scalar->SetMaximum(aKey, aValue);
 }
 
 /**

From cb2e7d319fafe13e5fb7769d3d9b02037a082993 Mon Sep 17 00:00:00 2001
From: Jed Davis <jld@mozilla.com>
Date: Mon, 26 Sep 2016 16:32:00 -0400
Subject: [PATCH 059/102] Bug 1304220 - Allow media plugins to use the times(2)
 syscall. r=gcp

--HG--
extra : rebase_source : 595bf264b48968ec25d02c82866ef02ef87a59fa
---
 security/sandbox/linux/SandboxFilter.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp
index b57c1bde9d8d..1f4a726be8e8 100644
--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -841,6 +841,10 @@ public:
         .Else(Trap(SchedTrap, nullptr));
     }
 
+    // For clock(3) on older glibcs; bug 1304220.
+    case __NR_times:
+      return Allow();
+
     default:
       return SandboxPolicyCommon::EvaluateSyscall(sysno);
     }

From 75b81d566f23148d5b0f02228c60ec519c62cb1f Mon Sep 17 00:00:00 2001
From: Jed Davis <jld@mozilla.com>
Date: Mon, 26 Sep 2016 16:10:00 -0400
Subject: [PATCH 060/102] Bug 1303813 - Allow media plugins to call madvise
 with MADV_FREE. r=gcp

--HG--
extra : rebase_source : 42fa66774311cc1dcf2c18643c7118483acff89d
---
 security/sandbox/linux/SandboxFilter.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp
index 1f4a726be8e8..6c0089b33a0b 100644
--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -42,6 +42,11 @@ using namespace sandbox::bpf_dsl;
 #define MADV_DONTDUMP 16
 #endif
 
+// Added in Linux 4.5; see bug 1303813.
+#ifndef MADV_FREE
+#define MADV_FREE 8
+#endif
+
 #ifndef PR_SET_PTRACER
 #define PR_SET_PTRACER 0x59616d61
 #endif
@@ -822,6 +827,7 @@ public:
     case __NR_madvise: {
       Arg<int> advice(2);
       return If(advice == MADV_DONTNEED, Allow())
+        .ElseIf(advice == MADV_FREE, Allow())
 #ifdef MOZ_ASAN
         .ElseIf(advice == MADV_NOHUGEPAGE, Allow())
         .ElseIf(advice == MADV_DONTDUMP, Allow())

From c57d400961ffa980ae4634a7d0c952b7df8f90ee Mon Sep 17 00:00:00 2001
From: Kate McKinley <kmckinley@mozilla.com>
Date: Tue, 27 Sep 2016 11:27:00 -0400
Subject: [PATCH 061/102] Bug 1246540 - HSTS Priming Proof of Concept.
 r=ckerschb, r=mayhemer, r=jld, r=smaug, r=dkeeler, r=jmaher, p=ally

HSTS priming changes the order of mixed-content blocking and HSTS
upgrades, and adds a priming request to check if a mixed-content load is
accesible over HTTPS and the server supports upgrading via the
Strict-Transport-Security header.

Every call site that uses AsyncOpen2 passes through the mixed-content
blocker, and has a LoadInfo. If the mixed-content blocker marks the load as
needing HSTS priming, nsHttpChannel will build and send an HSTS priming
request on the same URI with the scheme upgraded to HTTPS. If the server
allows the upgrade, then channel performs an internal redirect to the HTTPS URI,
otherwise use the result of mixed-content blocker to allow or block the
load.

nsISiteSecurityService adds an optional boolean out parameter to
determine if the HSTS state is already cached for negative assertions.
If the host has been probed within the previous 24 hours, no HSTS
priming check will be sent.

MozReview-Commit-ID: ES1JruCtDdX

--HG--
extra : rebase_source : 2ac6c93c49f2862fc0b9e595eb0598cd1ea4bedf
---
 browser/base/content/test/general/browser.ini |   1 +
 ...nsole_block_mixedcontent_securityerrors.js |   4 +-
 .../test/browser_webconsole_bug_632817.js     |   7 +
 docshell/base/nsDocShell.cpp                  |  23 +-
 dom/base/nsIDocument.h                        |  43 ++-
 dom/base/test/bug704320.sjs                   |   6 +
 dom/base/test/referrerHelper.js               |   3 +
 dom/html/test/test_anchor_ping.html           |   3 +
 dom/ipc/ContentParent.cpp                     |   6 +-
 dom/ipc/ContentParent.h                       |   3 +-
 dom/ipc/PContent.ipdl                         |   2 +-
 dom/security/moz.build                        |   1 +
 dom/security/nsContentSecurityManager.cpp     |  12 +-
 dom/security/nsMixedContentBlocker.cpp        | 197 +++++++++++-
 dom/security/nsMixedContentBlocker.h          |  36 ++-
 dom/security/test/hsts/browser.ini            |   9 +
 .../test/hsts/browser_hsts-priming_main.js    | 296 ++++++++++++++++++
 dom/security/test/hsts/file_1x1.png           | Bin 0 -> 17811 bytes
 dom/security/test/hsts/file_priming-top.html  |  84 +++++
 dom/security/test/hsts/file_priming.js        |   4 +
 dom/security/test/hsts/file_stylesheet.css    |   0
 dom/security/test/hsts/file_testserver.sjs    |  66 ++++
 .../test/mixedcontentblocker/test_main.html   |   3 +
 dom/security/test/moz.build                   |   1 +
 image/imgLoader.cpp                           |  13 +
 ipc/glue/BackgroundUtils.cpp                  |   9 +-
 modules/libpref/init/all.js                   |  14 +
 netwerk/base/LoadInfo.cpp                     |  40 ++-
 netwerk/base/LoadInfo.h                       |   7 +-
 netwerk/base/nsILoadInfo.idl                  |  26 ++
 netwerk/base/nsNetUtil.cpp                    |   2 +-
 netwerk/base/security-prefs.js                |  12 +
 netwerk/ipc/NeckoChannelParams.ipdlh          |   2 +
 netwerk/protocol/http/HSTSPrimerListener.cpp  | 258 +++++++++++++++
 netwerk/protocol/http/HSTSPrimerListener.h    | 108 +++++++
 netwerk/protocol/http/HttpChannelChild.cpp    |  13 +-
 netwerk/protocol/http/HttpChannelParent.cpp   |  13 +-
 netwerk/protocol/http/HttpChannelParent.h     |   4 +-
 netwerk/protocol/http/PHttpChannel.ipdl       |   3 +-
 netwerk/protocol/http/moz.build               |   2 +
 netwerk/protocol/http/nsHttpChannel.cpp       | 142 ++++++++-
 netwerk/protocol/http/nsHttpChannel.h         |   6 +
 netwerk/protocol/http/nsHttpHandler.cpp       |   3 +-
 .../protocol/http/nsIHstsPrimingCallback.idl  |  50 +++
 .../manager/ssl/SSLServerCertVerification.cpp |   2 +
 .../manager/ssl/nsISiteSecurityService.idl    |  18 +-
 .../manager/ssl/nsSiteSecurityService.cpp     |  67 +++-
 security/manager/ssl/nsSiteSecurityService.h  |   6 +-
 .../content/SpecialPowersObserverAPI.js       |   5 +-
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-blocks.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   3 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 .../no-opt-in-allows.https.html.ini           |   2 +
 toolkit/components/telemetry/Histograms.json  |  16 +
 109 files changed, 1762 insertions(+), 55 deletions(-)
 create mode 100644 dom/security/test/hsts/browser.ini
 create mode 100644 dom/security/test/hsts/browser_hsts-priming_main.js
 create mode 100644 dom/security/test/hsts/file_1x1.png
 create mode 100644 dom/security/test/hsts/file_priming-top.html
 create mode 100644 dom/security/test/hsts/file_priming.js
 create mode 100644 dom/security/test/hsts/file_stylesheet.css
 create mode 100644 dom/security/test/hsts/file_testserver.sjs
 create mode 100644 netwerk/protocol/http/HSTSPrimerListener.cpp
 create mode 100644 netwerk/protocol/http/HSTSPrimerListener.h
 create mode 100644 netwerk/protocol/http/nsIHstsPrimingCallback.idl
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
 create mode 100644 testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index f8b7b1b30eb2..b53a8d5b3338 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -118,6 +118,7 @@ support-files =
   file_bug1045809_2.html
   file_csp_block_all_mixedcontent.html
   file_csp_block_all_mixedcontent.js
+  !/image/test/mochitest/blue.png
   !/toolkit/components/passwordmgr/test/browser/form_basic.html
   !/toolkit/components/passwordmgr/test/browser/insecure_test.html
   !/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html
diff --git a/devtools/client/webconsole/test/browser_webconsole_block_mixedcontent_securityerrors.js b/devtools/client/webconsole/test/browser_webconsole_block_mixedcontent_securityerrors.js
index 6d9f4e0c0af7..ff4157a3b116 100644
--- a/devtools/client/webconsole/test/browser_webconsole_block_mixedcontent_securityerrors.js
+++ b/devtools/client/webconsole/test/browser_webconsole_block_mixedcontent_securityerrors.js
@@ -60,7 +60,9 @@ function pushPrefEnv() {
   let options = {
     "set": [
       ["security.mixed_content.block_active_content", true],
-      ["security.mixed_content.block_display_content", true]
+      ["security.mixed_content.block_display_content", true],
+      ["security.mixed_content.use_hsts", false],
+      ["security.mixed_content.send_hsts_priming", false],
     ]
   };
   SpecialPowers.pushPrefEnv(options, deferred.resolve);
diff --git a/devtools/client/webconsole/test/browser_webconsole_bug_632817.js b/devtools/client/webconsole/test/browser_webconsole_bug_632817.js
index 58138623dea8..561e3b112d52 100644
--- a/devtools/client/webconsole/test/browser_webconsole_bug_632817.js
+++ b/devtools/client/webconsole/test/browser_webconsole_bug_632817.js
@@ -94,6 +94,13 @@ function testXhrWarn() {
   });
 
   let lastRequest = yield waitForFinishedRequest(XHR_WARN_REQUEST_PREDICATE);
+  if (lastRequest.request.method == "HEAD") {
+    // in non-e10s, we get the HEAD request that priming sends, so make sure
+    // a priming request should be sent, and then get the actual request
+    is(Services.prefs.getBoolPref("security.mixed_content.send_hsts_priming"),
+        true, "Found HSTS Priming Request");
+    lastRequest = yield waitForFinishedRequest(XHR_WARN_REQUEST_PREDICATE);
+  }
 
   ok(lastRequest, "testXhrWarn() was logged");
   is(lastRequest.request.method, "GET", "Method is correct");
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 2dd26e455a57..dde9ad47da8e 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -4986,10 +4986,10 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
             do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
           NS_ENSURE_SUCCESS(rv, rv);
           rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aURI,
-                                flags, &isStsHost);
+                                flags, nullptr, &isStsHost);
           NS_ENSURE_SUCCESS(rv, rv);
           rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HPKP, aURI,
-                                flags, &isPinnedHost);
+                                flags, nullptr, &isPinnedHost);
           NS_ENSURE_SUCCESS(rv, rv);
         } else {
           mozilla::dom::ContentChild* cc =
@@ -9862,6 +9862,25 @@ nsDocShell::InternalLoad(nsIURI* aURI,
     return NS_ERROR_CONTENT_BLOCKED;
   }
 
+  // If HSTS priming was set by nsMixedContentBlocker::ShouldLoad, and we
+  // would block due to mixed content, go ahead and block here. If we try to
+  // proceed with priming, we will error out later on.
+  nsCOMPtr<nsIDocShell> docShell = NS_CP_GetDocShellFromContext(context);
+  NS_ENSURE_TRUE(docShell, NS_OK);
+  if (docShell) {
+    nsIDocument* document = docShell->GetDocument();
+    NS_ENSURE_TRUE(document, NS_OK);
+
+    HSTSPrimingState state = document->GetHSTSPrimingStateForLocation(aURI);
+    if (state == HSTSPrimingState::eHSTS_PRIMING_BLOCK) {
+      // HSTS Priming currently disabled for InternalLoad, so we need to clear
+      // the location that was added by nsMixedContentBlocker::ShouldLoad
+      // Bug 1269815 will address images loaded via InternalLoad
+      document->ClearHSTSPrimingLocation(aURI);
+      return NS_ERROR_CONTENT_BLOCKED;
+    }
+  }
+
   nsCOMPtr<nsIPrincipal> principalToInherit = aPrincipalToInherit;
   //
   // Get a principal from the current document if necessary.  Note that we only
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 7f418d623f9b..f5a9b29e718d 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -21,7 +21,8 @@
 #include "nsIUUIDGenerator.h"
 #include "nsPIDOMWindow.h"               // for use in inline functions
 #include "nsPropertyTable.h"             // for member
-#include "nsTHashtable.h"                // for member
+#include "nsDataHashtable.h"             // for member
+#include "nsURIHashKey.h"                // for member
 #include "mozilla/net/ReferrerPolicy.h"  // for member
 #include "nsWeakReference.h"
 #include "mozilla/UseCounter.h"
@@ -175,6 +176,13 @@ enum DocumentFlavor {
   DocumentFlavorPlain, // Just a Document
 };
 
+// Enum for HSTS priming states
+enum class HSTSPrimingState {
+  eNO_HSTS_PRIMING = 0,    // don't do HSTS Priming
+  eHSTS_PRIMING_ALLOW = 1, // if HSTS priming fails, allow the load to proceed
+  eHSTS_PRIMING_BLOCK = 2  // if HSTS priming fails, block the load
+};
+
 // Document states
 
 // RTL locale: specific to the XUL localedir attribute
@@ -364,6 +372,34 @@ public:
     mReferrer = aReferrer;
   }
 
+  /**
+   * Check to see if a subresource we want to load requires HSTS priming
+   * to be done.
+   */
+  HSTSPrimingState GetHSTSPrimingStateForLocation(nsIURI* aContentLocation) const
+  {
+    HSTSPrimingState state;
+    if (mHSTSPrimingURIList.Get(aContentLocation, &state)) {
+      return state;
+    }
+    return HSTSPrimingState::eNO_HSTS_PRIMING;
+  }
+
+  /**
+   * Add a subresource to the HSTS priming list. If this URI is
+   * not in the HSTS cache, it will trigger an HSTS priming request
+   * when we try to load it.
+   */
+  void AddHSTSPrimingLocation(nsIURI* aContentLocation, HSTSPrimingState aState)
+  {
+    mHSTSPrimingURIList.Put(aContentLocation, aState);
+  }
+
+  void ClearHSTSPrimingLocation(nsIURI* aContentLocation)
+  {
+    mHSTSPrimingURIList.Remove(aContentLocation);
+  }
+
   /**
    * Set the principal responsible for this document.
    */
@@ -2856,6 +2892,11 @@ protected:
   bool mUpgradeInsecureRequests;
   bool mUpgradeInsecurePreloads;
 
+  // if nsMixedContentBlocker requires sending an HSTS priming request,
+  // temporarily store that in the document so that it can be propogated to the
+  // LoadInfo and eventually the HTTP Channel
+  nsDataHashtable<nsURIHashKey, HSTSPrimingState> mHSTSPrimingURIList;
+
   mozilla::WeakPtr<nsDocShell> mDocumentContainer;
 
   nsCString mCharacterSet;
diff --git a/dom/base/test/bug704320.sjs b/dom/base/test/bug704320.sjs
index e0f54953328d..dff77f4b3ffd 100644
--- a/dom/base/test/bug704320.sjs
+++ b/dom/base/test/bug704320.sjs
@@ -194,6 +194,12 @@ function createPolicyTest(policy, optionalEarlierPolicy) {
 }
 
 function handleRequest(request, response) {
+  if (request.method == 'HEAD') {
+    // respond to a HEAD request with a 418 so that we can easily distinguish
+    // HSTS priming responses and ignore them
+    response.setStatusLine('1.1', 418, "I'm a teapot");
+    return;
+  }
   var sharedKey = 'bug704320.sjs';
   var params = request.queryString.split('&');
   var action = params[0].split('=')[1];
diff --git a/dom/base/test/referrerHelper.js b/dom/base/test/referrerHelper.js
index 01a22829c2d0..207bf5f15f64 100644
--- a/dom/base/test/referrerHelper.js
+++ b/dom/base/test/referrerHelper.js
@@ -25,6 +25,9 @@ function doXHR(url, onSuccess, onFail) {
   xhr.onload = function () {
     if (xhr.status == 200) {
       onSuccess(xhr);
+    } else if (xhr.status == 418) {
+      // Ignore HSTS priming responses
+      return;
     } else {
       onFail(xhr);
     }
diff --git a/dom/html/test/test_anchor_ping.html b/dom/html/test/test_anchor_ping.html
index 74b8b2ac887a..4a39bcefee7c 100644
--- a/dom/html/test/test_anchor_ping.html
+++ b/dom/html/test/test_anchor_ping.html
@@ -41,11 +41,14 @@ let tests = [
     Services.prefs.setBoolPref("browser.send_pings", true);
     Services.prefs.setIntPref("browser.send_pings.max_per_link", -1);
     Services.prefs.setBoolPref("security.mixed_content.block_active_content", false);
+    // The server we create can't handle the priming HEAD requests
+    Services.prefs.setBoolPref("security.mixed_content.send_hsts_priming", false);
 
     SimpleTest.registerCleanupFunction(() => {
       Services.prefs.clearUserPref("browser.send_pings");
       Services.prefs.clearUserPref("browser.send_pings.max_per_link");
       Services.prefs.clearUserPref("security.mixed_content.block_active_content");
+      Services.prefs.clearUserPref("security.mixed_content.send_hsts_priming");
     });
   },
 
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 957f878cc86d..8cf5d32112b0 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -3901,18 +3901,18 @@ ContentParent::RecvIsSecureURI(const uint32_t& type,
   if (!ourURI) {
     return false;
   }
-  nsresult rv = sss->IsSecureURI(type, ourURI, flags, isSecureURI);
+  nsresult rv = sss->IsSecureURI(type, ourURI, flags, nullptr, isSecureURI);
   return NS_SUCCEEDED(rv);
 }
 
 bool
-ContentParent::RecvAccumulateMixedContentHSTS(const URIParams& aURI, const bool& aActive)
+ContentParent::RecvAccumulateMixedContentHSTS(const URIParams& aURI, const bool& aActive, const bool& aHSTSPriming)
 {
   nsCOMPtr<nsIURI> ourURI = DeserializeURI(aURI);
   if (!ourURI) {
     return false;
   }
-  nsMixedContentBlocker::AccumulateMixedContentHSTS(ourURI, aActive);
+  nsMixedContentBlocker::AccumulateMixedContentHSTS(ourURI, aActive, aHSTSPriming);
   return true;
 }
 
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 8192f61a152d..924fe3804652 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -789,7 +789,8 @@ private:
                                const uint32_t& aFlags, bool* aIsSecureURI) override;
 
   virtual bool RecvAccumulateMixedContentHSTS(const URIParams& aURI,
-                                              const bool& aActive) override;
+                                              const bool& aActive,
+                                              const bool& aHSTSPriming) override;
 
   virtual bool DeallocPHalParent(PHalParent*) override;
 
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 3703183c1238..eaffc5446530 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -838,7 +838,7 @@ parent:
     sync IsSecureURI(uint32_t type, URIParams uri, uint32_t flags)
         returns (bool isSecureURI);
 
-    async AccumulateMixedContentHSTS(URIParams uri, bool active);
+    async AccumulateMixedContentHSTS(URIParams uri, bool active, bool hasHSTSPriming);
 
     sync GetLookAndFeelCache()
         returns (LookAndFeelInt[] lookAndFeelIntCache);
diff --git a/dom/security/moz.build b/dom/security/moz.build
index e24403433c74..00f7376a85ab 100644
--- a/dom/security/moz.build
+++ b/dom/security/moz.build
@@ -20,6 +20,7 @@ EXPORTS.mozilla.dom += [
 
 EXPORTS += [
     'nsContentSecurityManager.h',
+    'nsMixedContentBlocker.h',
 ]
 
 UNIFIED_SOURCES += [
diff --git a/dom/security/nsContentSecurityManager.cpp b/dom/security/nsContentSecurityManager.cpp
index 165db210c79f..0f7d7d2816f0 100644
--- a/dom/security/nsContentSecurityManager.cpp
+++ b/dom/security/nsContentSecurityManager.cpp
@@ -6,6 +6,8 @@
 #include "nsContentUtils.h"
 #include "nsCORSListenerProxy.h"
 #include "nsIStreamListener.h"
+#include "nsIDocument.h"
+#include "nsMixedContentBlocker.h"
 
 #include "mozilla/dom/Element.h"
 
@@ -381,6 +383,14 @@ DoContentSecurityChecks(nsIChannel* aChannel, nsILoadInfo* aLoadInfo)
   if (NS_CP_REJECTED(shouldLoad)) {
     return NS_ERROR_CONTENT_BLOCKED;
   }
+
+  if (nsMixedContentBlocker::sSendHSTSPriming) {
+    rv = nsMixedContentBlocker::MarkLoadInfoForPriming(uri,
+                                                       requestingContext,
+                                                       aLoadInfo);
+    return rv;
+  }
+
   return NS_OK;
 }
 
@@ -489,7 +499,7 @@ nsContentSecurityManager::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
       rv = nsContentUtils::GetSecurityManager()->
         CheckLoadURIWithPrincipal(oldPrincipal, newOriginalURI, flags);
   }
-  NS_ENSURE_SUCCESS(rv, rv);  
+  NS_ENSURE_SUCCESS(rv, rv);
 
   aCb->OnRedirectVerifyCallback(NS_OK);
   return NS_OK;
diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp
index 30f74d851923..e65b41613af9 100644
--- a/dom/security/nsMixedContentBlocker.cpp
+++ b/dom/security/nsMixedContentBlocker.cpp
@@ -54,6 +54,11 @@ bool nsMixedContentBlocker::sBlockMixedScript = false;
 // Is mixed display content blocking (images, audio, video, <a ping>) enabled?
 bool nsMixedContentBlocker::sBlockMixedDisplay = false;
 
+// Do we move HSTS before mixed-content
+bool nsMixedContentBlocker::sUseHSTS = false;
+// Do we send an HSTS priming request
+bool nsMixedContentBlocker::sSendHSTSPriming = false;
+
 // Fired at the document that attempted to load mixed content.  The UI could
 // handle this event, for example, by displaying an info bar that offers the
 // choice to reload the page with mixed content permitted.
@@ -195,6 +200,14 @@ nsMixedContentBlocker::nsMixedContentBlocker()
   // Cache the pref for mixed display blocking
   Preferences::AddBoolVarCache(&sBlockMixedDisplay,
                                "security.mixed_content.block_display_content");
+
+  // Cache the pref for HSTS
+  Preferences::AddBoolVarCache(&sUseHSTS,
+                               "security.mixed_content.use_hsts");
+
+  // Cache the pref for sending HSTS priming
+  Preferences::AddBoolVarCache(&sSendHSTSPriming,
+                               "security.mixed_content.send_hsts_priming");
 }
 
 nsMixedContentBlocker::~nsMixedContentBlocker()
@@ -238,8 +251,6 @@ LogMixedContentMessage(MixedContentTypes aClassification,
                                   messageLookupKey.get(), strings, ArrayLength(strings));
 }
 
-
-
 /* nsIChannelEventSink implementation
  * This code is called when a request is redirected.
  * We check the channel associated with the new uri is allowed to load
@@ -309,17 +320,35 @@ nsMixedContentBlocker::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
+  nsCOMPtr<nsISupports> requestingContext = loadInfo->LoadingNode();
+
   int16_t decision = REJECT_REQUEST;
   rv = ShouldLoad(contentPolicyType,
                   newUri,
                   requestingLocation,
-                  loadInfo->LoadingNode(),
+                  requestingContext,
                   EmptyCString(),       // aMimeGuess
                   nullptr,              // aExtra
                   requestingPrincipal,
                   &decision);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (nsMixedContentBlocker::sSendHSTSPriming) {
+    // The LoadInfo passed in is for the original channel, HSTS priming needs to
+    // be set on the new channel, if required. If the redirect changes
+    // http->https, or vice-versa, the need for priming may change.
+    nsCOMPtr<nsILoadInfo> newLoadInfo;
+    rv = aNewChannel->GetLoadInfo(getter_AddRefs(newLoadInfo));
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = nsMixedContentBlocker::MarkLoadInfoForPriming(newUri,
+                                                       requestingContext,
+                                                       newLoadInfo);
+    if (NS_FAILED(rv)) {
+      decision = REJECT_REQUEST;
+      newLoadInfo->ClearHSTSPriming();
+    }
+  }
+
   // If the channel is about to load mixed content, abort the channel
   if (!NS_CP_ACCEPTED(decision)) {
     autoCallback.DontCallback();
@@ -463,7 +492,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
       *aDecision = ACCEPT;
       return NS_OK;
 
-
     // Static display content is considered moderate risk for mixed content so
     // these will be blocked according to the mixed display preference
     case TYPE_IMAGE:
@@ -497,7 +525,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
     // This content policy works as a whitelist.
     default:
       MOZ_ASSERT(false, "Mixed content of unknown type");
-      break;
   }
 
   // Make sure to get the URI the load started with. No need to check
@@ -677,7 +704,9 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
   bool isHttpScheme = false;
   rv = innerContentLocation->SchemeIs("http", &isHttpScheme);
   NS_ENSURE_SUCCESS(rv, rv);
-  if (isHttpScheme && docShell->GetDocument()->GetUpgradeInsecureRequests(isPreload)) {
+  nsIDocument* document = docShell->GetDocument();
+  MOZ_ASSERT(document, "Expected a document");
+  if (isHttpScheme && document->GetUpgradeInsecureRequests(isPreload)) {
     *aDecision = ACCEPT;
     return NS_OK;
   }
@@ -688,7 +717,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
   // Block all non secure loads in case the CSP directive is present. Please note
   // that at this point we already know, based on |schemeSecure| that the load is
   // not secure, so we can bail out early at this point.
-  if (docShell->GetDocument()->GetBlockAllMixedContent(isPreload)) {
+  if (document->GetBlockAllMixedContent(isPreload)) {
     // log a message to the console before returning.
     nsAutoCString spec;
     rv = aContentLocation->GetSpec(spec);
@@ -703,7 +732,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
                         0, // aLineNumber
                         0, // aColumnNumber
                         nsIScriptError::errorFlag, "CSP",
-                        docShell->GetDocument()->InnerWindowID());
+                        document->InnerWindowID());
     *aDecision = REJECT_REQUEST;
     return NS_OK;
   }
@@ -796,6 +825,34 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
   }
   nsresult stateRV = securityUI->GetState(&state);
 
+  bool doHSTSPriming = false;
+  if (isHttpScheme) {
+    bool hsts = false;
+    bool cached = false;
+    nsCOMPtr<nsISiteSecurityService> sss =
+      do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aContentLocation,
+        0, &cached, &hsts);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (hsts && sUseHSTS) {
+      // assume we will be upgraded later
+      *aDecision = ACCEPT;
+      return NS_OK;
+    }
+
+    // Send a priming request if the result is not already cached and priming
+    // requests are allowed
+    if (!cached && sSendHSTSPriming) {
+      // add this URI as a priming location
+      doHSTSPriming = true;
+      document->AddHSTSPrimingLocation(innerContentLocation,
+          HSTSPrimingState::eHSTS_PRIMING_ALLOW);
+      *aDecision = ACCEPT;
+    }
+  }
+
   // At this point we know that the request is mixed content, and the only
   // question is whether we block it.  Record telemetry at this point as to
   // whether HSTS would have fixed things by making the content location
@@ -811,14 +868,14 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
   bool active = (classification == eMixedScript);
   if (!aHadInsecureImageRedirect) {
     if (XRE_IsParentProcess()) {
-      AccumulateMixedContentHSTS(innerContentLocation, active);
+      AccumulateMixedContentHSTS(innerContentLocation, active, doHSTSPriming);
     } else {
       // Ask the parent process to do the same call
       mozilla::dom::ContentChild* cc = mozilla::dom::ContentChild::GetSingleton();
       if (cc) {
         mozilla::ipc::URIParams uri;
         SerializeURI(innerContentLocation, uri);
-        cc->SendAccumulateMixedContentHSTS(uri, active);
+        cc->SendAccumulateMixedContentHSTS(uri, active, doHSTSPriming);
       }
     }
   }
@@ -861,7 +918,13 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
         }
       }
     } else {
-      *aDecision = nsIContentPolicy::REJECT_REQUEST;
+      if (doHSTSPriming) {
+        document->AddHSTSPrimingLocation(innerContentLocation,
+            HSTSPrimingState::eHSTS_PRIMING_BLOCK);
+        *aDecision = nsIContentPolicy::ACCEPT;
+      } else {
+        *aDecision = nsIContentPolicy::REJECT_REQUEST;
+      }
       LogMixedContentMessage(classification, aContentLocation, rootDoc, eBlocked);
       if (!rootDoc->GetHasMixedDisplayContentBlocked() && NS_SUCCEEDED(stateRV)) {
         rootDoc->SetHasMixedDisplayContentBlocked(true);
@@ -907,7 +970,13 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
       }
     } else {
       //User has not overriden the pref by Disabling protection. Reject the request and update the security state.
-      *aDecision = nsIContentPolicy::REJECT_REQUEST;
+      if (doHSTSPriming) {
+        document->AddHSTSPrimingLocation(innerContentLocation,
+            HSTSPrimingState::eHSTS_PRIMING_BLOCK);
+        *aDecision = nsIContentPolicy::ACCEPT;
+      } else {
+        *aDecision = nsIContentPolicy::REJECT_REQUEST;
+      }
       LogMixedContentMessage(classification, aContentLocation, rootDoc, eBlocked);
       // See if the pref will change here. If it will, only then do we need to call OnSecurityChange() to update the UI.
       if (rootDoc->GetHasMixedActiveContentBlocked()) {
@@ -922,7 +991,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
       }
       return NS_OK;
     }
-
   } else {
     // The content is not blocked by the mixed content prefs.
 
@@ -973,10 +1041,24 @@ enum MixedContentHSTSState {
   MCB_HSTS_ACTIVE_WITH_HSTS  = 3
 };
 
+// Similar to the existing mixed-content HSTS, except MCB_HSTS_*_NO_HSTS is
+// broken into two distinct states, indicating whether we plan to send a priming
+// request or not. If we decided not go send a priming request, it could be
+// because it is a type we do not support, or because we cached a previous
+// negative response.
+enum MixedContentHSTSPrimingState {
+  eMCB_HSTS_PASSIVE_WITH_HSTS  = 0,
+  eMCB_HSTS_ACTIVE_WITH_HSTS   = 1,
+  eMCB_HSTS_PASSIVE_NO_PRIMING = 2,
+  eMCB_HSTS_PASSIVE_DO_PRIMING = 3,
+  eMCB_HSTS_ACTIVE_NO_PRIMING  = 4,
+  eMCB_HSTS_ACTIVE_DO_PRIMING  = 5
+};
+
 // Record information on when HSTS would have made mixed content not mixed
 // content (regardless of whether it was actually blocked)
 void
-nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive)
+nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive, bool aHasHSTSPriming)
 {
   // This method must only be called in the parent, because
   // nsSiteSecurityService is only available in the parent
@@ -991,28 +1073,113 @@ nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive)
   if (NS_FAILED(rv)) {
     return;
   }
-  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aURI, 0, &hsts);
+  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aURI, 0, nullptr, &hsts);
   if (NS_FAILED(rv)) {
     return;
   }
 
+  // states: would upgrade, would prime, hsts info cached
+  // active, passive
+  //
   if (!aActive) {
     if (!hsts) {
       Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
                             MCB_HSTS_PASSIVE_NO_HSTS);
+      if (aHasHSTSPriming) {
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                              eMCB_HSTS_PASSIVE_DO_PRIMING);
+      } else {
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                              eMCB_HSTS_PASSIVE_NO_PRIMING);
+      }
     }
     else {
       Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
                             MCB_HSTS_PASSIVE_WITH_HSTS);
+      Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                            eMCB_HSTS_PASSIVE_WITH_HSTS);
     }
   } else {
     if (!hsts) {
       Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
                             MCB_HSTS_ACTIVE_NO_HSTS);
+      if (aHasHSTSPriming) {
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                              eMCB_HSTS_ACTIVE_DO_PRIMING);
+      } else {
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                              eMCB_HSTS_ACTIVE_NO_PRIMING);
+      }
     }
     else {
       Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
                             MCB_HSTS_ACTIVE_WITH_HSTS);
+      Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
+                            eMCB_HSTS_ACTIVE_WITH_HSTS);
     }
   }
 }
+
+//static
+nsresult
+nsMixedContentBlocker::MarkLoadInfoForPriming(nsIURI* aURI,
+                                              nsISupports* aRequestingContext,
+                                              nsILoadInfo* aLoadInfo)
+{
+  nsresult rv;
+  bool sendPriming = false;
+  bool mixedContentWouldBlock = false;
+  rv = GetHSTSPrimingFromRequestingContext(aURI,
+                                           aRequestingContext,
+                                           &sendPriming,
+                                           &mixedContentWouldBlock);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (sendPriming) {
+    aLoadInfo->SetHSTSPriming(mixedContentWouldBlock);
+  }
+
+  return NS_OK;
+}
+
+//static
+nsresult
+nsMixedContentBlocker::GetHSTSPrimingFromRequestingContext(nsIURI* aURI,
+    nsISupports* aRequestingContext,
+    bool* aSendPrimingRequest,
+    bool* aMixedContentWouldBlock)
+{
+  *aSendPrimingRequest = false;
+  *aMixedContentWouldBlock = false;
+  // If we marked for priming, we used the innermost URI, so get that
+  nsCOMPtr<nsIURI> innerURI = NS_GetInnermostURI(aURI);
+  if (!innerURI) {
+    NS_ERROR("Can't get innerURI from aContentLocation");
+    return NS_ERROR_CONTENT_BLOCKED;
+  }
+
+  bool isHttp = false;
+  innerURI->SchemeIs("http", &isHttp);
+  if (!isHttp) {
+    // there is nothign to do
+    return NS_OK;
+  }
+
+  // If the DocShell was marked for HSTS priming, propagate that to the LoadInfo
+  nsCOMPtr<nsIDocShell> docShell = NS_CP_GetDocShellFromContext(aRequestingContext);
+  if (!docShell) {
+    return NS_OK;
+  }
+  nsCOMPtr<nsIDocument> document = docShell->GetDocument();
+  if (!document) {
+    return NS_OK;
+  }
+
+  HSTSPrimingState status = document->GetHSTSPrimingStateForLocation(innerURI);
+  if (status != HSTSPrimingState::eNO_HSTS_PRIMING) {
+    *aSendPrimingRequest = (status != HSTSPrimingState::eNO_HSTS_PRIMING);
+    *aMixedContentWouldBlock = (status == HSTSPrimingState::eHSTS_PRIMING_BLOCK);
+  }
+
+  return NS_OK;
+}
diff --git a/dom/security/nsMixedContentBlocker.h b/dom/security/nsMixedContentBlocker.h
index 216466fd83b2..2f10dabab16a 100644
--- a/dom/security/nsMixedContentBlocker.h
+++ b/dom/security/nsMixedContentBlocker.h
@@ -28,6 +28,8 @@ enum MixedContentTypes {
 #include "nsIChannelEventSink.h"
 #include "imgRequest.h"
 
+class nsILoadInfo; // forward declaration
+
 class nsMixedContentBlocker : public nsIContentPolicy,
                               public nsIChannelEventSink
 {
@@ -59,9 +61,41 @@ public:
                              nsISupports* aExtra,
                              nsIPrincipal* aRequestPrincipal,
                              int16_t* aDecision);
-  static void AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive);
+  static void AccumulateMixedContentHSTS(nsIURI* aURI,
+                                         bool aActive,
+                                         bool aHasHSTSPriming);
+  /* If the document associated with aRequestingContext requires priming for
+   * aURI, propagate that to the LoadInfo so the HttpChannel will find out about
+   * it.
+   *
+   * @param aURI The URI associated with the load
+   * @param aRequestingContext the requesting context passed to ShouldLoad
+   * @param aLoadInfo the LoadInfo for the load
+   */
+  static nsresult MarkLoadInfoForPriming(nsIURI* aURI,
+                                         nsISupports* aRequestingContext,
+                                         nsILoadInfo* aLoadInfo);
+
+  /* Given a context, return whether HSTS was marked on the document associated
+   * with the load for the given URI. This is used by MarkLoadInfoForPriming and
+   * directly by the image loader to determine whether to allow a load to occur
+   * from the cache.
+   *
+   * @param aURI The URI associated with the load
+   * @param aRequestingContext the requesting context passed to ShouldLoad
+   * @param aSendPrimingRequest out true if priming is required on the channel
+   * @param aMixedContentWouldBlock out true if mixed content would block
+   */
+  static nsresult GetHSTSPrimingFromRequestingContext(nsIURI* aURI,
+                                                      nsISupports* aRequestingContext,
+                                                      bool* aSendPrimingRequest,
+                                                      bool* aMixedContentWouldBlock);
+
+
   static bool sBlockMixedScript;
   static bool sBlockMixedDisplay;
+  static bool sUseHSTS;
+  static bool sSendHSTSPriming;
 };
 
 #endif /* nsMixedContentBlocker_h___ */
diff --git a/dom/security/test/hsts/browser.ini b/dom/security/test/hsts/browser.ini
new file mode 100644
index 000000000000..6fe1ec38bffe
--- /dev/null
+++ b/dom/security/test/hsts/browser.ini
@@ -0,0 +1,9 @@
+[DEFAULT]
+support-files =
+  file_priming-top.html
+  file_testserver.sjs
+  file_1x1.png
+  file_priming.js
+  file_stylesheet.css
+
+[browser_hsts-priming_main.js]
diff --git a/dom/security/test/hsts/browser_hsts-priming_main.js b/dom/security/test/hsts/browser_hsts-priming_main.js
new file mode 100644
index 000000000000..2fc120f1cd32
--- /dev/null
+++ b/dom/security/test/hsts/browser_hsts-priming_main.js
@@ -0,0 +1,296 @@
+/*
+ * Description of the test:
+ *   Check that HSTS priming occurs correctly with mixed content
+ *
+ *   This test uses three hostnames, each of which treats an HSTS priming
+ *   request differently.
+ *   * no-ssl never returns an ssl response
+ *   * reject-upgrade returns an ssl response, but with no STS header
+ *   * prime-hsts returns an ssl response with the appropriate STS header
+ *
+ *   For each server, test that it response appropriately when the we allow
+ *   or block active or display content, as well as when we send an hsts priming
+ *   request, but do not change the order of mixed-content and HSTS.
+ *
+ *   This test uses http-on-examine-response, so must be run in browser context.
+ */
+'use strict';
+
+var TOP_URI = "https://example.com/browser/dom/security/test/hsts/file_priming-top.html";
+
+var test_servers = {
+  // a test server that does not support TLS
+  'no-ssl': {
+    host: 'example.co.jp',
+    response: false,
+    id: 'no-ssl',
+  },
+  // a test server which does not support STS upgrade
+  'reject-upgrade': {
+    host: 'example.org',
+    response: true,
+    id: 'reject-upgrade',
+  },
+  // a test server when sends an STS header when priming
+  'prime-hsts': {
+    host: 'test1.example.com',
+    response: true,
+    id: 'prime-hsts'
+  },
+};
+// The number of priming responses we expect to see
+var priming_count = 2;
+
+var test_settings = {
+  // mixed active content is allowed, priming will upgrade
+  allow_active: {
+    block_active: false,
+    block_display: false,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'script',
+    result: {
+      'no-ssl': 'insecure',
+      'reject-upgrade': 'insecure',
+      'prime-hsts': 'secure',
+    },
+  },
+  // mixed active content is blocked, priming will upgrade
+  block_active: {
+    block_active: true,
+    block_display: false,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'script',
+    result: {
+      'no-ssl': 'blocked',
+      'reject-upgrade': 'blocked',
+      'prime-hsts': 'secure',
+    },
+  },
+  // keep the original order of mixed-content and HSTS, but send
+  // priming requests
+  hsts_after_mixed: {
+    block_active: true,
+    block_display: false,
+    use_hsts: false,
+    send_hsts_priming: true,
+    type: 'script',
+    result: {
+      'no-ssl': 'blocked',
+      'reject-upgrade': 'blocked',
+      'prime-hsts': 'blocked',
+    },
+  },
+  // mixed display content is allowed, priming will upgrade
+  allow_display: {
+    block_active: true,
+    block_display: false,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'img',
+    result: {
+      'no-ssl': 'insecure',
+      'reject-upgrade': 'insecure',
+      'prime-hsts': 'secure',
+    },
+  },
+  // mixed display content is blocked, priming will upgrade
+  block_display: {
+    block_active: true,
+    block_display: true,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'img',
+    result: {
+      'no-ssl': 'blocked',
+      'reject-upgrade': 'blocked',
+      'prime-hsts': 'secure',
+    },
+  },
+  // mixed active content is blocked, priming will upgrade (css)
+  block_active_css: {
+    block_active: true,
+    block_display: false,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'css',
+    result: {
+      'no-ssl': 'blocked',
+      'reject-upgrade': 'blocked',
+      'prime-hsts': 'secure',
+    },
+  },
+  // mixed active content is blocked, priming will upgrade
+  // redirect to the same host
+  block_active_with_redir_same: {
+    block_active: true,
+    block_display: false,
+    use_hsts: true,
+    send_hsts_priming: true,
+    type: 'script',
+    redir: 'same',
+    result: {
+      'no-ssl': 'blocked',
+      'reject-upgrade': 'blocked',
+      'prime-hsts': 'secure',
+    },
+  },
+}
+// track which test we are on
+var which_test = "";
+
+const Observer = {
+  observe: function (subject, topic, data) {
+    switch (topic) {
+      case 'console-api-log-event':
+        return Observer.console_api_log_event(subject, topic, data);
+      case 'http-on-examine-response':
+        return Observer.http_on_examine_response(subject, topic, data);
+    }
+    throw "Can't handle topic "+topic;
+  },
+  // When a load is blocked which results in an error event within a page, the
+  // test logs to the console.
+  console_api_log_event: function (subject, topic, data) {
+    var message = subject.wrappedJSObject.arguments[0];
+    // when we are blocked, this will match the message we sent to the console,
+    // ignore everything else.
+    var re = RegExp(/^HSTS_PRIMING: Blocked ([-\w]+).*$/);
+    if (!re.test(message)) {
+      return;
+    }
+
+    let id = message.replace(re, '$1');
+    let curTest =test_servers[id];
+
+    if (!curTest) {
+      ok(false, "HSTS priming got a console message blocked, "+
+          "but doesn't match expectations "+id+" (msg="+message);
+      return;
+    }
+
+    is("blocked", test_settings[which_test].result[curTest.id], "HSTS priming "+
+        which_test+":"+curTest.id+" expected "+
+        test_settings[which_test].result[curTest.id]+", got blocked");
+    test_settings[which_test].finished[curTest.id] = "blocked";
+  },
+  // When we see a response come back, peek at the response and test it is secure
+  // or insecure as needed. Addtionally, watch the response for priming requests.
+  http_on_examine_response: function (subject, topic, data) {
+    let curTest = null;
+    let channel = subject.QueryInterface(Ci.nsIHttpChannel);
+    for (let item in test_servers) {
+      let re = RegExp('https?://'+test_servers[item].host);
+      if (re.test(channel.URI.asciiSpec)) {
+        curTest = test_servers[item];
+        break;
+      }
+    }
+
+    if (!curTest) {
+      return;
+    }
+
+    let result = (channel.URI.asciiSpec.startsWith('https:')) ? "secure" : "insecure";
+
+    // This is a priming request, go ahead and validate we were supposed to see
+    // a response from the server
+    if (channel.requestMethod == 'HEAD') {
+      is(true, curTest.response, "HSTS priming response found " + curTest.id);
+      test_settings[which_test].priming[curTest.id] = true;
+      return;
+    }
+
+    // This is the response to our query, make sure it matches
+    is(result, test_settings[which_test].result[curTest.id],
+        "HSTS priming result " + which_test + ":" + curTest.id);
+    test_settings[which_test].finished[curTest.id] = result;
+  },
+};
+
+// opens `uri' in a new tab and focuses it.
+// returns the newly opened tab
+function openTab(uri) {
+  let tab = gBrowser.addTab(uri);
+
+  // select tab and make sure its browser is focused
+  gBrowser.selectedTab = tab;
+  tab.ownerDocument.defaultView.focus();
+
+  return tab;
+}
+
+function clear_sts_data() {
+  for (let test in test_servers) {
+    SpecialPowers.cleanUpSTSData('http://'+test_servers[test].host);
+  }
+}
+
+function do_cleanup() {
+  clear_sts_data();
+
+  Services.obs.removeObserver(Observer, "console-api-log-event");
+  Services.obs.removeObserver(Observer, "http-on-examine-response");
+}
+
+function SetupPrefTestEnvironment(which) {
+  which_test = which;
+  clear_sts_data();
+
+  var settings = test_settings[which];
+  // priming counts how many priming requests we saw
+  settings.priming = {};
+  // priming counts how many tests were finished
+  settings.finished= {};
+
+  SpecialPowers.pushPrefEnv({'set': [["security.mixed_content.block_active_content",
+                                      settings.block_active],
+                                     ["security.mixed_content.block_display_content",
+                                      settings.block_display],
+                                     ["security.mixed_content.use_hsts",
+                                      settings.use_hsts],
+                                     ["security.mixed_content.send_hsts_priming",
+                                      settings.send_hsts_priming]]});
+}
+
+// make the top-level test uri
+function build_test_uri(base_uri, host, test_id, type) {
+  return base_uri +
+          "?host=" + escape(host) +
+          "&id=" + escape(test_id) +
+          "&type=" + escape(type);
+}
+
+// open a new tab, load the test, and wait for it to finish
+function execute_test(test, mimetype) {
+  var src = build_test_uri(TOP_URI, test_servers[test].host,
+      test, test_settings[which_test].type);
+
+  let tab = openTab(src);
+  test_servers[test]['tab'] = tab;
+
+  let browser = gBrowser.getBrowserForTab(tab);
+  yield BrowserTestUtils.browserLoaded(browser);
+
+  yield BrowserTestUtils.removeTab(tab);
+}
+
+//jscs:disable
+add_task(function*() {
+  //jscs:enable
+  Services.obs.addObserver(Observer, "console-api-log-event", false);
+  Services.obs.addObserver(Observer, "http-on-examine-response", false);
+  registerCleanupFunction(do_cleanup);
+  requestLongerTimeout(4);
+
+  for (let which of Object.keys(test_settings)) {
+    SetupPrefTestEnvironment(which);
+
+    for (let server of Object.keys(test_servers)) {
+      yield execute_test(server, test_settings[which].mimetype);
+    }
+
+    SpecialPowers.popPrefEnv();
+  }
+});
diff --git a/dom/security/test/hsts/file_1x1.png b/dom/security/test/hsts/file_1x1.png
new file mode 100644
index 0000000000000000000000000000000000000000..1ba31ba1a62313908f41f844a9fb2e74663a4cd2
GIT binary patch
literal 17811
zcmeI4c{o)4`^S%cDJn&wC)21<X0gnenHXVY36-rO#ViL?W`>!Gu|?%6lJrn1m6qQl
zT9h8NqlKg_Y2hK1r^RE5kZj5KpwOx2>bid4-#@==&UKAB_vik+@B5tB=l*=oIdfe{
z+!`kvB}ENI005NiY$?vrx5Vg2UKaYRrCJmReJKRmdhh{Y+U(Jf1dw`k9snrbVp&<O
zS>w+YaQXh+K!lx@6(W$w^<@Qs03fW(I_T%>QoEpdq_6RV<*L}|{g0MAOH0bfH~}&(
zKH7`+uZT5Rl=-)6kaWrR-SX~&nbNl}0fxI{WuBj)-XdEpP;4boXR03P+h!x|sUGUC
z4jakqxL%l7LmX=7ccv(<2)~tLUz{nsVlM?9uiWLQvt)5joc#(wZVpyrc>!Ww>s(b;
z2>{#mc_^Y)RvLJD!OVN9>fI51>YZFK2|z^#ICIC#LK)yG0xVTqkOw#@1E=HPI1>SP
zS-`=A?raFS%K>G3f;duuZ!6)26mVJ}PXYi<08!N+;UNq3Y6ICl(&{`wV>U2<vE?7q
z(Q5JldAmcw%xHH22qqGz{SM^50(=e(a>?pZJq~W6-2>`N7ZgqdfPIqI*PIQa^gb2p
z*qlE^xGN3#AO7o+Kj0&Qcvd^@uA9EyF;(Ji<icCheoHN1Eurqy+-G{*a;s0j^s>KR
zeOht|bEJM*QV(5+dKv5a1~aR2_nLu>F4v<6HRl-JZaL-CDBbLLZ;3--n(o$W>1N-O
znAH~)*0dN}=Pu=6*QahNIa*&DAo=;VM|auZk4mS<oi)9adkb*@9p{pj@?h94%{k~P
zb8AqnePwz4+II&Y(%r(;%=I@t*0Jx6M9kcdkVHl+1-+c!@lqN+QxUOxJyH&kr|NE4
zIvZp@sNL#(hLBL6EI+^f?~1)n93alFw7tvwQ<DS&h|ac6uH*PcpHKuSgfl^Dl27e`
z-0M2H9A#ioenp$yHp_!17n%Uz{R)XKKHJgrw(C*1nGtqq3MJ-lM@&a9R7>(9%Ohs<
zR>;QFi08Li>h8?Sp8bGkK7acrf~?L7g^D{eS0zne;_G*noQT;fRI+-nuyU64LZl#O
z+rP+_u|#@2L3@6YoPs5CpZ_8SI}5{^3a3^a)Nb2H|5IAeMj45_fAPNhYe}9`i{%1j
z{(VIEf`Q$1T_y08Y^DrJ>CK6){sfKq3M->W*8XJAXwJ%qkL+`m*%ZtPlSf0DDv=4w
zjOeunYQB4F8T0jl_@bms0*9ShMZ2?|&#Rm(@yu3kN1rZg^zjaqo-b8$ulCi=z>`-A
zM}aHyS5&SjtlN9;9_}A>Q^!AHK~`6_grtpH-1xqtp7(M6(?8K878cC${@pyGa8F@k
zXGs)tro8_4#kY^mw6{evXC0h{pY>5iL!KRjw$!2>vR%}w!j5Y!vPB-()lpLkncWuK
z92XKhTvWMeX=&_h2gN0elNbG&_owsYwa&|0lv@_F_Mf-F>x3t1ms)l^cdK>Nc+&>d
zt{peEulkefd{ghze*Fg;_Uh?ryu;lw-P`QbQ`eYf=A1#cZrY^YOXyvimooVKY3rPm
zGLPOqo|9XitDTFlv#OIL9phLuKTdAp4f=*D4I_uuhjTQn$}JKymbk7@cRyL38Eo?|
zi{#PZ)v!9UAgmzl%%ENG`c|&-eGN4Y35|$^0~)Fte#T+OJ8|l%PN{#S5>t;DCvMvK
zWd0-MCJ%oZmO`Flt}<)G(^iJhbeENY)h%iXq3mkezkVu*4mvC_iuWipz1PlEW^HDz
zuGw3&@zjQskxuJN?@-nB7py9)yF<F&>Kl2CjxFZe*X>VmY0aoVY<SAZZP&Tv(=LBL
zIl=dCK8Id!Vr#NK<OnCZ!^P}qT0&z$esS2)2XtHh;Ri=sac<Z=|JJxOi67QRY7YAk
zgM+(1a9d|+&eMpQXR8#f>18Zr+&6r!;j7+(4ZzJerq3Ig7q=&P-Z7J~;%eWaOU3Pm
z9~Xbzcc~yK^U|IE6G0hWnQ`fMM@v1EWs@^b&vDtyy56GvB>2ffBki2Sz7NYcl`lA)
zTuyv@`0b6d<z+Vd`Y08BJk{7^I<=MBt>1&%j5<!O%8JNR^KkQQ$XP<=pU=ta^L%mH
zg6+jNWG@Zi)SkM`xr}_Ce|bZ&aQTeoaU0S%B$|~sR+1|Vstaniy_wmRU462&>78*7
ztMtib$F@Ts?^Zoq+b;aO>r(PTmqSlHGt@HrD)1GO&5F(8XhDikiW|Bd-Ff=C)9NDy
z+(D^zJKG#;lrFrx@S>r<fywFR?C9|A(CY}V4<|S{&GDPvd{(aU?hD3&5|2bo8Yhic
zIXf*Xv^E?J|E*W!5RItKzSpE4*|?-JqH{;1z1HQ`yDKHM(l1`ZytwkXk65#R*=zS8
z??I0taNyZMes9Q!l!4<PwG`e@r_Oq$7Avz;T1_TcmL*dxb3o2)8eXA7{({m1#ULdQ
zwa03^XDH2RP^-IZ^in~HyLl4Zm#s=mxx;EQXnNCBsT}~#Ae2$nVVcpE$_T@U5eJ#>
zE{iDL$SXGFgunK9&gp#~aHl=9RyD_)vfLVz*bz%B(vKx-^ypQa2d`>>ML0*W_6oll
z_Nl%<wf~QpTQNz};6J%Vs&OVsACf3`<)uZh`(K}Z-9)tD2UoNlZzEj^<n)<73|;kh
z!;y<7-lik<lD#sYWOQ8K>nZ5jxD<404;=W^<hrpn?dd{`XrGjqdHa^tFP!ht<Fw2!
z{BXyyjY;HvO~)>oF|bcea*TTtbXT~d!%|dJ^UOCdT5dRG`|%LLqJE#%1G`e9c2yE{
z6&hvib(Kj=dFt+|>xS<3%H>z>)Aw>e5dXU3A^V`w8|MMX-w)99PnlHeTts&E{L^2o
zlj4v5L;u>fr@k%s(lI?ddZIjbu3ti}E~pm{q`t{t_Q`#|SKN7r4YdUi1a7y_etx#_
z+_{=H)y#_nky)?mlJc}_7N6g&ht;KScyxu#jAWnmJb6CbZ%56}Ve_V~D#K5&Re`TM
z63lnUSl7h=7QZUKkgXDM{d3NfO3*x!?ewDlS~2@!K~_vwQdYzBh%0U>{s&*Dd|)5H
zmLDV+Zd0{4arxZ#o9?81!3g>Rx)=?5P&|4#ISuPWqLx+a7kW2&S7qBoRo*kx4*xy8
zv;9@axfk5*Lg7e_)G4VM$~)%=oX^eFH=_{thx}XI)PMK4!oaO(&OAQ1^upj)3XkIP
z+lI(9_wrA_&HP-2%Ja`U6`alCG`wSMD@kp8*ER#6t+6}tZcuU8y28_+>LQV!C_{D?
zrGqYSGd>>mJ&N8$(MZ87<3POLk>u1H6*0$H+^$W;;UjmsHWeDjvj`cHoK?%x^G<AO
zkN7;$gl9cJGEIH%VBOqY^MXUduEzA*6cT2acR|?V{s+a%g?oF}<zGz8e;fL)Y)eJ&
zX-$ra2KRcS>F|xV&Wz;^Bu(zM7n=&+1>H#BymDRJZ!eb5?T~HE=Ou=8-W&GlyK(*1
zb*&F&@79uMlIIC^xAu3eZTz3Al5@vj9-m|OOz1i2Fyiq>t2)Y9w_$&Cm{d5IoEZA~
z>gq>*gId={`m4R)Z~uJiLweQ2REg$oIXiCexZ+(N`fS8=Fzkb4)A7`(j?m4$AD?>H
z7jl#rEB6*A=WB)+w(RKGrLC0_6`-|OW9vt~<|qH!R{1qlKJzAclM0qZL=vy}Yj&-#
z4QcB{ncs;rRez|incNLV0KhE(a9k}XjFOH{lfHFTX~kO2&ieomy{9iMx=XqHMd(c%
zDIi*Ng&9EMNq9X6oOlvt&w+p0z*?_pD*6N(eYV*<`AEk<rXAL7$y+IV6C!N^gr`(Q
zr@E#lTSIebqfE4!r2mj{W4Q!i+zKe~C&<Q7>ODuATSwaOk4SgDQII=JNV5X~5}M^o
z6;K@=NDM9;O=EKDAX>-{gzkI+z|>qANMmdU1qeFm$KseFJ8u*s5iF(|avjbQ>lkPS
z`m=1qc%Vy|lPe=^GlR%Pnv)exg(N5d8x+tGLUsU$PZF9T$KsNp{n2I&5;4|Au-Oc0
zF`5uTbzFn6;_^TQ4vj}K3=9kqCPcIWj$mYn(?=L$4R9DN5o3TwVGT$ISdt+Y@nu7j
z6`?&-9@CfPOj-FQ9b}my{RM(R5(X0z5`qpfLUVb37y}}ah`}0S3=L6G4-`L?BcKUU
z9KQB=kgstlAfLfw1qxVP4q`Mejn3U7Fhe3o6HRPi&Wjy5k%+_p!VaQ{5z+!N252ni
zCn85j(K0sshf2P{Iv6^VFK70{gnZY~KoH{$^0`}h4A43l<OsBXbP!C&M4Z4aynr!2
zOa=xF0NId)4;{S04-X;m>m$#E{F}p=aR2n|1uWmm!TClz>iMY*6taFI8}*FK#!6v)
zgiN9OBU$l4nt;o5<#Gea<5f2Kzy>|9jaC&x*OA6xaYmow^h_~u(d39v#seud0Z4|l
zcofzcg~hoV;7M3K$q<Lanvk&ADM7}2!eTf=)z72}XulHWo4)WkTqesm^p~Pc_WU-6
zqa(?V!xzvv4A723hRz+$Vlhb|fk31&aWs@M9*ajA8`0<}0-c6M(dl$14#XPx5}1s!
zll)fxU1$oIv1PQBpwQz}pUGuF;U@}&gs0OC3`~r1C?jaPqo7?PipZo9p+q>4X~4u8
zfkw2iiKYbmF41Zp3tE|I0aN;no(mI7=8MJQalR&oC?=84L>U_!8=>eprZEZ!4FL^{
zhf*3EeNFL$FyE!JW$~eU3Y}7CP_>P%JuYC-x2<0t0j#k#B#_4AgQHW^4Ec3#PAobT
zYs#o*Y>Ja;jM3GH%or_TkZFqfrgieLCX`=ftnY{O*AR@ypCbQxju3y4BdYwzLyh(N
zc@RF=R}ezuffjyHh5Xvw9FP005T3vkGrC>}u>KE*f=>(n-wnjC&8z<>12I|241XHO
z4`h-tUyJx_!>^6q_=tWxyS~oY?`NYalR@(3^4K&1nZ>60ftWy!pDAXtaWbdr<T_-<
z4dC(|xlE7@tpz`7{-Fx`!Eep@?|ozniys(33!N&S;+>)%y}*&6bq1<=+SvRyFvWb=
z2JcTDT`vN*jP*A$#6lZ%8w71%q*L8+sfTFkR5x5YsdVG81Z2Z6*<j66RHIj6(iln?
z=!Ov_<8e46oGAw03|FjS3Bdp=g#}$H_@gTxL}W|?Z~vjr<0rZ)?O$}`Wi;i+Zfu1Z
zZ-s6fp*vR0#4YQ0i^s$&``_G|JfZ()R9Gx=5*QHCrWluKJ}|Es7YvAKQ;bVAADCB+
z3kF2ADaIw556mmZ1p^}56yp-j2j&&yf&me2igAhN1M`Y;!GMT1#kfTCfqBKaU_eBh
zVqBv6z`SByFd(8$F)q=3U|umU7!c8>7?)^1Fs~RF42Wn`j7u~hm{*Jo21K+e#wD5$
z%qzwP10vcK;}XpW<`v_D0TFGAaf#*w^NMl7fQUB5xJ2`TdBwP3Kt!8jT%!5FykcB1
zAfin%F425oUNJ5h5YeU>muNmPuNW5$h-g!cOEe#tSBwh=M6@Z!C7KV+E5-!_BH9#*
zOL6igP>=(?`56Me;@OwCOBZ@Q6v41{b_4*94gl~k0upjL01%o50IO912?gjMp<w?4
zfLZs}^F0ipzO(Hp7OuiNdjH6XxfEoNj7S0UpCms&N#8<)Ou)|CiE_cxXZwEu!3lHX

literal 0
HcmV?d00001

diff --git a/dom/security/test/hsts/file_priming-top.html b/dom/security/test/hsts/file_priming-top.html
new file mode 100644
index 000000000000..b1d1bfa402ba
--- /dev/null
+++ b/dom/security/test/hsts/file_priming-top.html
@@ -0,0 +1,84 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1246540</title>
+  <meta http-equiv='content-type' content="text/html;charset=utf-8" />
+</head>
+<body>
+  <p id="display"></p>
+  <div id="content" style="visibility: hidden">
+  </div>
+
+<script type="text/javascript">
+/*
+ * Description of the test:
+ * Attempt to load an insecure resource. If the resource responds to HSTS
+ * priming with an STS header, the load should continue securely.
+ * If it does not, the load should continue be blocked or continue insecurely.
+ */
+
+function parse_query_string() {
+  var q = {};
+  document.location.search.substr(1).
+    split('&').forEach(function (item, idx, ar) {
+      let [k, v] = item.split('=');
+      q[k] = unescape(v);
+    });
+  return q;
+}
+
+var args = parse_query_string();
+
+var subresources = {
+  css: { mimetype: 'text/css', file: 'file_stylesheet.css' },
+  img: { mimetype: 'image/png', file: 'file_1x1.png' },
+  script: { mimetype: 'text/javascript', file: 'file_priming.js' },
+};
+
+function handler(ev) {
+  console.log("HSTS_PRIMING: Blocked "+args.id);
+}
+
+function loadCss(src) {
+  let head = document.getElementsByTagName("head")[0];
+  let link = document.createElement("link");
+  link.setAttribute("rel", "stylesheet");
+  link.setAttribute("type", subresources[args.type].mimetype);
+  link.setAttribute("href", src);
+  head.appendChild(link);
+}
+
+function loadResource(src) {
+  let content = document.getElementById("content");
+  let testElem = document.createElement(args.type);
+  testElem.setAttribute("id", args.id);
+  testElem.setAttribute("charset", "UTF-8");
+  testElem.onerror = handler;
+  content.appendChild(testElem);
+  testElem.src = src;
+}
+
+function loadTest() {
+  let subresource = subresources[args.type];
+
+  let src = "http://"
+    + args.host
+    + "/browser/dom/security/test/hsts/file_testserver.sjs"
+    + "?file=" +escape("browser/dom/security/test/hsts/" + subresource.file)
+    + "&primer=" + escape(args.id)
+    + "&mimetype=" + escape(subresource.mimetype)
+    ;
+  if (args.type == 'css') {
+    loadCss(src);
+    return;
+  }
+
+  loadResource(src);
+}
+
+// start running the tests
+loadTest();
+
+</script>
+</body>
+</html>
diff --git a/dom/security/test/hsts/file_priming.js b/dom/security/test/hsts/file_priming.js
new file mode 100644
index 000000000000..023022da67cd
--- /dev/null
+++ b/dom/security/test/hsts/file_priming.js
@@ -0,0 +1,4 @@
+function completed() {
+  return;
+}
+completed();
diff --git a/dom/security/test/hsts/file_stylesheet.css b/dom/security/test/hsts/file_stylesheet.css
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/dom/security/test/hsts/file_testserver.sjs b/dom/security/test/hsts/file_testserver.sjs
new file mode 100644
index 000000000000..d5cd6b17a06e
--- /dev/null
+++ b/dom/security/test/hsts/file_testserver.sjs
@@ -0,0 +1,66 @@
+// SJS file for HSTS mochitests
+
+Components.utils.import("resource://gre/modules/NetUtil.jsm");
+Components.utils.importGlobalProperties(["URLSearchParams"]);
+
+function loadFromFile(path) {
+  // Load the HTML to return in the response from file.
+  // Since it's relative to the cwd of the test runner, we start there and
+  // append to get to the actual path of the file.
+  var testFile =
+    Components.classes["@mozilla.org/file/directory_service;1"].
+    getService(Components.interfaces.nsIProperties).
+    get("CurWorkD", Components.interfaces.nsILocalFile);
+  var dirs = path.split("/");
+  for (var i = 0; i < dirs.length; i++) {
+    testFile.append(dirs[i]);
+  }
+  var testFileStream =
+    Components.classes["@mozilla.org/network/file-input-stream;1"].
+    createInstance(Components.interfaces.nsIFileInputStream);
+  testFileStream.init(testFile, -1, 0, 0);
+  var test = NetUtil.readInputStreamToString(testFileStream, testFileStream.available());
+  return test;
+}
+
+function handleRequest(request, response)
+{
+  const query = new URLSearchParams(request.queryString);
+
+  redir = query.get('redir');
+  if (redir == 'same') {
+    query.delete("redir");
+    response.setStatus(302);
+    let newURI = request.uri;
+    newURI.queryString = query.serialize();
+    response.setHeader("Location", newURI.spec)
+  }
+
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  // if we have a priming header, check for required behavior
+  // and set header appropriately
+  if (request.hasHeader('Upgrade-Insecure-Requests')) {
+    var expected = query.get('primer');
+    if (expected == 'prime-hsts') {
+      // set it for 5 minutes
+      response.setHeader("Strict-Transport-Security", "max-age="+(60*5), false);
+    } else if (expected == 'reject-upgrade') {
+      response.setHeader("Strict-Transport-Security", "max-age=0", false);
+    }
+    response.write('');
+    return;
+  }
+
+  var file = query.get('file');
+  if (file) {
+    var mimetype = unescape(query.get('mimetype'));
+    response.setHeader("Content-Type", mimetype, false);
+    response.write(loadFromFile(unescape(file)));
+    return;
+  }
+
+  response.setHeader("Content-Type", "application/json", false);
+  response.write('{}');
+}
diff --git a/dom/security/test/mixedcontentblocker/test_main.html b/dom/security/test/mixedcontentblocker/test_main.html
index dfec03fa9794..249ead1ebf5a 100644
--- a/dom/security/test/mixedcontentblocker/test_main.html
+++ b/dom/security/test/mixedcontentblocker/test_main.html
@@ -162,6 +162,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=62178
   }
 
   function startTest() {
+    // Set prefs to use mixed-content before HSTS
+    SpecialPowers.pushPrefEnv({'set': [["security.mixed_content.use_hsts", false],
+                                       ["security.mixed_content.send_hsts_priming", false]]});
     //Set the first set of mixed content settings and increment the counter.
     //Enable <picture> and <img srcset> for the test.
     changePrefs([[ "dom.image.srcset.enabled", true ], [ "dom.image.picture.enabled", true ]],
diff --git a/dom/security/test/moz.build b/dom/security/test/moz.build
index 74f0fefef75d..80e86b6c006f 100644
--- a/dom/security/test/moz.build
+++ b/dom/security/test/moz.build
@@ -27,4 +27,5 @@ MOCHITEST_CHROME_MANIFESTS += [
 BROWSER_CHROME_MANIFESTS += [
     'contentverifier/browser.ini',
     'csp/browser.ini',
+    'hsts/browser.ini',
 ]
diff --git a/image/imgLoader.cpp b/image/imgLoader.cpp
index a9ab899d18a8..1e9ebf9a4f47 100644
--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -607,6 +607,19 @@ ShouldLoadCachedImage(imgRequest* aImgRequest,
     }
   }
 
+  bool sendPriming = false;
+  bool mixedContentWouldBlock = false;
+  rv = nsMixedContentBlocker::GetHSTSPrimingFromRequestingContext(contentLocation,
+      aLoadingContext, &sendPriming, &mixedContentWouldBlock);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+  if (sendPriming && mixedContentWouldBlock) {
+    // if either of the securty checks above would cause a priming request, we
+    // can't load this image from the cache, so go ahead and return false here
+    return false;
+  }
+
   return true;
 }
 
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 0e12ad710d8d..b0d248ee4671 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -266,7 +266,9 @@ LoadInfoToLoadInfoArgs(nsILoadInfo *aLoadInfo,
       redirectChain,
       aLoadInfo->CorsUnsafeHeaders(),
       aLoadInfo->GetForcePreflight(),
-      aLoadInfo->GetIsPreflight());
+      aLoadInfo->GetIsPreflight(),
+      aLoadInfo->GetForceHSTSPriming(),
+      aLoadInfo->GetMixedContentWouldBlock());
 
   return NS_OK;
 }
@@ -338,7 +340,10 @@ LoadInfoArgsToLoadInfo(const OptionalLoadInfoArgs& aOptionalLoadInfoArgs,
                           redirectChain,
                           loadInfoArgs.corsUnsafeHeaders(),
                           loadInfoArgs.forcePreflight(),
-                          loadInfoArgs.isPreflight());
+                          loadInfoArgs.isPreflight(),
+                          loadInfoArgs.forceHSTSPriming(),
+                          loadInfoArgs.mixedContentWouldBlock()
+                          );
 
    loadInfo.forget(outLoadInfo);
    return NS_OK;
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index e7bd38bb3678..cede4fa506b4 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -5556,3 +5556,17 @@ pref("media.block-autoplay-until-in-foreground", true);
 // Is the Servo-backed style system enabled?
 pref("layout.css.servo.enabled", true);
 #endif
+
+// HSTS Priming
+// If a request is mixed-content, send an HSTS priming request to attempt to
+// see if it is available over HTTPS.
+pref("security.mixed_content.send_hsts_priming", true);
+#ifdef RELEASE_BUILD
+// Don't change the order of evaluation of mixed-content and HSTS upgrades in
+// order to be most compatible with current standards
+pref("security.mixed_content.use_hsts", false);
+#else
+// Change the order of evaluation so HSTS upgrades happen before
+// mixed-content blocking
+pref("security.mixed_content.use_hsts", true);
+#endif
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 6ce2bf1c1b72..4453faaddc08 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -62,6 +62,8 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mIsThirdPartyContext(false)
   , mForcePreflight(false)
   , mIsPreflight(false)
+  , mForceHSTSPriming(false)
+  , mMixedContentWouldBlock(false)
 {
   MOZ_ASSERT(mLoadingPrincipal);
   MOZ_ASSERT(mTriggeringPrincipal);
@@ -233,6 +235,8 @@ LoadInfo::LoadInfo(nsPIDOMWindowOuter* aOuterWindow,
   , mIsThirdPartyContext(false) // NB: TYPE_DOCUMENT implies not third-party.
   , mForcePreflight(false)
   , mIsPreflight(false)
+  , mForceHSTSPriming(false)
+  , mMixedContentWouldBlock(false)
 {
   // Top-level loads are never third-party
   // Grab the information we can out of the window.
@@ -297,6 +301,8 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
   , mCorsUnsafeHeaders(rhs.mCorsUnsafeHeaders)
   , mForcePreflight(rhs.mForcePreflight)
   , mIsPreflight(rhs.mIsPreflight)
+  , mForceHSTSPriming(rhs.mForceHSTSPriming)
+  , mMixedContentWouldBlock(rhs.mMixedContentWouldBlock)
 {
 }
 
@@ -322,7 +328,9 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
                    nsTArray<nsCOMPtr<nsIPrincipal>>& aRedirectChain,
                    const nsTArray<nsCString>& aCorsUnsafeHeaders,
                    bool aForcePreflight,
-                   bool aIsPreflight)
+                   bool aIsPreflight,
+                   bool aForceHSTSPriming,
+                   bool aMixedContentWouldBlock)
   : mLoadingPrincipal(aLoadingPrincipal)
   , mTriggeringPrincipal(aTriggeringPrincipal)
   , mPrincipalToInherit(aPrincipalToInherit)
@@ -344,6 +352,8 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
   , mCorsUnsafeHeaders(aCorsUnsafeHeaders)
   , mForcePreflight(aForcePreflight)
   , mIsPreflight(aIsPreflight)
+  , mForceHSTSPriming (aForceHSTSPriming)
+  , mMixedContentWouldBlock(aMixedContentWouldBlock)
 {
   // Only top level TYPE_DOCUMENT loads can have a null loadingPrincipal
   MOZ_ASSERT(mLoadingPrincipal || aContentPolicyType == nsIContentPolicy::TYPE_DOCUMENT);
@@ -833,6 +843,34 @@ LoadInfo::GetIsPreflight(bool* aIsPreflight)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetForceHSTSPriming(bool* aForceHSTSPriming)
+{
+  *aForceHSTSPriming = mForceHSTSPriming;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadInfo::GetMixedContentWouldBlock(bool *aMixedContentWouldBlock)
+{
+  *aMixedContentWouldBlock = mMixedContentWouldBlock;
+  return NS_OK;
+}
+
+void
+LoadInfo::SetHSTSPriming(bool aMixedContentWouldBlock)
+{
+  mForceHSTSPriming = true;
+  mMixedContentWouldBlock = aMixedContentWouldBlock;
+}
+
+void
+LoadInfo::ClearHSTSPriming()
+{
+  mForceHSTSPriming = false;
+  mMixedContentWouldBlock = false;
+}
+
 NS_IMETHODIMP
 LoadInfo::GetTainting(uint32_t* aTaintingOut)
 {
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 8d90beb53378..261f85349d72 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -106,7 +106,9 @@ private:
            nsTArray<nsCOMPtr<nsIPrincipal>>& aRedirectChain,
            const nsTArray<nsCString>& aUnsafeHeaders,
            bool aForcePreflight,
-           bool aIsPreflight);
+           bool aIsPreflight,
+           bool aForceHSTSPriming,
+           bool aMixedContentWouldBlock);
   LoadInfo(const LoadInfo& rhs);
 
   friend nsresult
@@ -149,6 +151,9 @@ private:
   nsTArray<nsCString>              mCorsUnsafeHeaders;
   bool                             mForcePreflight;
   bool                             mIsPreflight;
+
+  bool                             mForceHSTSPriming : 1;
+  bool                             mMixedContentWouldBlock : 1;
 };
 
 } // namespace net
diff --git a/netwerk/base/nsILoadInfo.idl b/netwerk/base/nsILoadInfo.idl
index 6894aa565e3b..9770490b6444 100644
--- a/netwerk/base/nsILoadInfo.idl
+++ b/netwerk/base/nsILoadInfo.idl
@@ -601,6 +601,32 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] readonly attribute boolean isPreflight;
 
+  /**
+   * When this request would be mixed-content and we do not have an
+   * entry in the HSTS cache, we send an HSTS priming request to
+   * determine if it is ok to upgrade the request to HTTPS.
+   */
+  /**
+   * True if this is a mixed-content load and HSTS priming request will be sent.
+   */
+  [noscript, infallible] readonly attribute boolean forceHSTSPriming;
+  /**
+   * Carry the decision whether this load would be blocked by mixed content so
+   * that if HSTS priming fails, the correct decision can be made.
+   */
+  [noscript, infallible] readonly attribute boolean mixedContentWouldBlock;
+
+  /**
+   * Mark this LoadInfo as needing HSTS Priming
+   *
+   * @param wouldBlock Carry the decision of Mixed Content Blocking to be
+   * applied when HSTS priming is complete.
+   */
+  [noscript, notxpcom, nostdcall]
+  void setHSTSPriming(in boolean mixeContentWouldBlock);
+  [noscript, notxpcom, nostdcall]
+  void clearHSTSPriming();
+
   /**
   * Constants reflecting the channel tainting.  These are mainly defined here
   * for script.  Internal C++ code should use the enum defined in LoadTainting.h.
diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
index a4d927079097..39fa8a2ccab7 100644
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -2311,7 +2311,7 @@ NS_ShouldSecureUpgrade(nsIURI* aURI,
     bool isStsHost = false;
     uint32_t flags = aPrivateBrowsing ? nsISocketProvider::NO_PERMANENT_STORAGE : 0;
     rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aURI, flags,
-                          &isStsHost);
+                          nullptr, &isStsHost);
 
     // if the SSS check fails, it's likely because this load is on a
     // malformed URI or something else in the setup is wrong, so any error
diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js
index 5550e49d518e..94a9ea10f889 100644
--- a/netwerk/base/security-prefs.js
+++ b/netwerk/base/security-prefs.js
@@ -98,3 +98,15 @@ pref("security.ssl.errorReporting.automatic", false);
 // blacking themselves out by setting a bad pin.  (60 days by default)
 // https://tools.ietf.org/html/rfc7469#section-4.1
 pref("security.cert_pinning.max_max_age_seconds", 5184000);
+
+// If a request is mixed-content, send an HSTS priming request to attempt to
+// see if it is available over HTTPS.
+pref("security.mixed_content.send_hsts_priming", true);
+#ifdef RELEASE_BUILD
+// Don't change the order of evaluation of mixed-content and HSTS upgrades
+pref("security.mixed_content.use_hsts", false);
+#else
+// Change the order of evaluation so HSTS upgrades happen before
+// mixed-content blocking
+pref("security.mixed_content.use_hsts", true);
+#endif
diff --git a/netwerk/ipc/NeckoChannelParams.ipdlh b/netwerk/ipc/NeckoChannelParams.ipdlh
index 2b421d9efaa0..5d2659b654f7 100644
--- a/netwerk/ipc/NeckoChannelParams.ipdlh
+++ b/netwerk/ipc/NeckoChannelParams.ipdlh
@@ -51,6 +51,8 @@ struct LoadInfoArgs
   nsCString[]           corsUnsafeHeaders;
   bool                  forcePreflight;
   bool                  isPreflight;
+  bool                  forceHSTSPriming;
+  bool                  mixedContentWouldBlock;
 };
 
 /**
diff --git a/netwerk/protocol/http/HSTSPrimerListener.cpp b/netwerk/protocol/http/HSTSPrimerListener.cpp
new file mode 100644
index 000000000000..e0b79dc6de35
--- /dev/null
+++ b/netwerk/protocol/http/HSTSPrimerListener.cpp
@@ -0,0 +1,258 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsHttp.h"
+
+#include "HSTSPrimerListener.h"
+#include "nsIHstsPrimingCallback.h"
+#include "nsIPrincipal.h"
+#include "nsSecurityHeaderParser.h"
+#include "nsISiteSecurityService.h"
+#include "nsISocketProvider.h"
+#include "nsISSLStatus.h"
+#include "nsISSLStatusProvider.h"
+#include "nsStreamUtils.h"
+#include "nsHttpChannel.h"
+#include "LoadInfo.h"
+
+namespace mozilla {
+namespace net {
+
+using namespace mozilla;
+
+NS_IMPL_ISUPPORTS(HSTSPrimingListener, nsIStreamListener,
+                  nsIRequestObserver, nsIInterfaceRequestor)
+
+NS_IMETHODIMP
+HSTSPrimingListener::GetInterface(const nsIID & aIID, void **aResult)
+{
+  return QueryInterface(aIID, aResult);
+}
+
+NS_IMETHODIMP
+HSTSPrimingListener::OnStartRequest(nsIRequest *aRequest,
+                                    nsISupports *aContext)
+{
+  nsresult rv = CheckHSTSPrimingRequestStatus(aRequest);
+  nsCOMPtr<nsIHstsPrimingCallback> callback(mCallback);
+  mCallback = nullptr;
+
+  if (NS_FAILED(rv)) {
+    LOG(("HSTS Priming Failed (request was not approved)"));
+    return callback->OnHSTSPrimingFailed(rv, false);
+  }
+
+  LOG(("HSTS Priming Succeeded (request was approved)"));
+  return callback->OnHSTSPrimingSucceeded(false);
+}
+
+NS_IMETHODIMP
+HSTSPrimingListener::OnStopRequest(nsIRequest *aRequest,
+                                   nsISupports *aContext,
+                                   nsresult aStatus)
+{
+  return NS_OK;
+}
+
+nsresult
+HSTSPrimingListener::CheckHSTSPrimingRequestStatus(nsIRequest* aRequest)
+{
+  nsresult status;
+  nsresult rv = aRequest->GetStatus(&status);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(status)) {
+    return NS_ERROR_CONTENT_BLOCKED;
+  }
+
+  // Test that things worked on a HTTP level
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aRequest);
+  NS_ENSURE_STATE(httpChannel);
+  nsCOMPtr<nsIHttpChannelInternal> internal = do_QueryInterface(aRequest);
+  NS_ENSURE_STATE(internal);
+
+  bool succeedded;
+  rv = httpChannel->GetRequestSucceeded(&succeedded);
+  if (NS_FAILED(rv) || !succeedded) {
+    // If the request did not return a 2XX response, don't process it
+    return NS_ERROR_CONTENT_BLOCKED;
+  }
+
+  bool synthesized = false;
+  nsHttpChannel* rawHttpChannel = static_cast<nsHttpChannel*>(httpChannel.get());
+  rv = rawHttpChannel->GetResponseSynthesized(&synthesized);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (synthesized) {
+    // Don't consider synthesized responses
+    return NS_ERROR_CONTENT_BLOCKED;
+  }
+
+  // check to see if the HSTS cache was updated
+  nsCOMPtr<nsISiteSecurityService> sss = do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIURI> uri;
+  rv = httpChannel->GetURI(getter_AddRefs(uri));
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(uri, NS_ERROR_CONTENT_BLOCKED);
+
+  bool hsts;
+  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, uri, 0, nullptr, &hsts);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (hsts) {
+    // An HSTS upgrade was found
+    return NS_OK;
+  }
+
+  // There is no HSTS upgrade available
+  return NS_ERROR_CONTENT_BLOCKED;
+}
+
+/** nsIStreamListener methods **/
+
+NS_IMETHODIMP
+HSTSPrimingListener::OnDataAvailable(nsIRequest *aRequest,
+                                     nsISupports *ctxt,
+                                     nsIInputStream *inStr,
+                                     uint64_t sourceOffset,
+                                     uint32_t count)
+{
+  uint32_t totalRead;
+  return inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &totalRead);
+}
+
+// static
+nsresult
+HSTSPrimingListener::StartHSTSPriming(nsIChannel* aRequestChannel,
+                                      nsIHstsPrimingCallback* aCallback)
+{
+
+  nsCOMPtr<nsIURI> finalChannelURI;
+  nsresult rv = NS_GetFinalChannelURI(aRequestChannel, getter_AddRefs(finalChannelURI));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIURI> uri;
+  rv = NS_GetSecureUpgradedURI(finalChannelURI, getter_AddRefs(uri));
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  // check the HSTS cache
+  bool hsts;
+  bool cached;
+  nsCOMPtr<nsISiteSecurityService> sss = do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, uri, 0, &cached, &hsts);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (hsts) {
+    // already saw this host and will upgrade if allowed by preferences
+    return aCallback->OnHSTSPrimingSucceeded(true);
+  }
+
+  if (cached) {
+    // there is a non-expired entry in the cache that doesn't allow us to
+    // upgrade, so go ahead and fail early.
+    return aCallback->OnHSTSPrimingFailed(NS_ERROR_CONTENT_BLOCKED, true);
+  }
+
+  // Either it wasn't cached or the cached result has expired. Build a
+  // channel for the HEAD request.
+
+  nsCOMPtr<nsILoadInfo> originalLoadInfo = aRequestChannel->GetLoadInfo();
+  MOZ_ASSERT(originalLoadInfo, "can not perform HSTS priming without a loadInfo");
+  if (!originalLoadInfo) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsILoadInfo> loadInfo = static_cast<mozilla::LoadInfo*>
+    (originalLoadInfo.get())->CloneForNewRequest();
+
+  // the LoadInfo must have a security flag set in order to pass through priming
+  // if none of these security flags are set, go ahead and fail now instead of
+  // crashing in nsContentSecurityManager::ValidateSecurityFlags
+  nsSecurityFlags securityMode = loadInfo->GetSecurityMode();
+  if (securityMode != nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS &&
+      securityMode != nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_IS_BLOCKED &&
+      securityMode != nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS &&
+      securityMode != nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL &&
+      securityMode != nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS) {
+    return aCallback->OnHSTSPrimingFailed(NS_ERROR_CONTENT_BLOCKED, true);
+  }
+
+  nsCOMPtr<nsILoadGroup> loadGroup;
+  rv = aRequestChannel->GetLoadGroup(getter_AddRefs(loadGroup));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsLoadFlags loadFlags;
+  rv = aRequestChannel->GetLoadFlags(&loadFlags);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  loadFlags &= HttpBaseChannel::INHIBIT_CACHING |
+               HttpBaseChannel::INHIBIT_PERSISTENT_CACHING |
+               HttpBaseChannel::LOAD_BYPASS_CACHE |
+               HttpBaseChannel::LOAD_FROM_CACHE |
+               HttpBaseChannel::VALIDATE_ALWAYS;
+  // Priming requests should never be intercepted by service workers and
+  // are always anonymous.
+  loadFlags |= nsIChannel::LOAD_BYPASS_SERVICE_WORKER |
+               nsIRequest::LOAD_ANONYMOUS;
+
+  // Create a new channel to send the priming request
+  nsCOMPtr<nsIChannel> primingChannel;
+  rv = NS_NewChannelInternal(getter_AddRefs(primingChannel),
+                             uri,
+                             loadInfo,
+                             loadGroup,
+                             nullptr,   // aCallbacks are set later
+                             loadFlags);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Set method and headers
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(primingChannel);
+  if (!httpChannel) {
+    NS_ERROR("HSTSPrimingListener: Failed to QI to nsIHttpChannel!");
+    return NS_ERROR_FAILURE;
+  }
+
+  // Currently using HEAD per the draft, but under discussion to change to GET
+  // with credentials so if the upgrade is approved the result is already cached.
+  rv = httpChannel->SetRequestMethod(NS_LITERAL_CSTRING("HEAD"));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = httpChannel->
+    SetRequestHeader(NS_LITERAL_CSTRING("Upgrade-Insecure-Requests"),
+                     NS_LITERAL_CSTRING("1"), false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // attempt to set the class of service flags on the new channel
+  nsCOMPtr<nsIClassOfService> requestClass = do_QueryInterface(aRequestChannel);
+  if (!requestClass) {
+    NS_ERROR("HSTSPrimingListener: aRequestChannel is not an nsIClassOfService");
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIClassOfService> primingClass = do_QueryInterface(httpChannel);
+  if (!primingClass) {
+    NS_ERROR("HSTSPrimingListener: aRequestChannel is not an nsIClassOfService");
+    return NS_ERROR_FAILURE;
+  }
+
+  uint32_t classFlags = 0;
+  rv = requestClass ->GetClassFlags(&classFlags);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = primingClass->SetClassFlags(classFlags);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Set up listener which will start the original channel
+  nsCOMPtr<nsIStreamListener> primingListener(new HSTSPrimingListener(aCallback));
+
+  // Start priming
+  rv = primingChannel->AsyncOpen2(primingListener);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+} // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/http/HSTSPrimerListener.h b/netwerk/protocol/http/HSTSPrimerListener.h
new file mode 100644
index 000000000000..05089911bfe7
--- /dev/null
+++ b/netwerk/protocol/http/HSTSPrimerListener.h
@@ -0,0 +1,108 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef HSTSPrimingListener_h__
+#define HSTSPrimingListener_h__
+
+#include "nsCOMPtr.h"
+#include "nsIChannelEventSink.h"
+#include "nsIInterfaceRequestor.h"
+#include "nsIStreamListener.h"
+#include "nsIThreadRetargetableStreamListener.h"
+
+#include "mozilla/Attributes.h"
+
+class nsIPrincipal;
+class nsINetworkInterceptController;
+class nsIHstsPrimingCallback;
+
+namespace mozilla {
+namespace net {
+
+class HttpChannelParent;
+class nsHttpChannel;
+
+/*
+ * How often do we get back an HSTS priming result which upgrades the connection to HTTPS?
+ */
+enum HSTSPrimingResult {
+  // This site has been seen before and won't be upgraded
+  eHSTS_PRIMING_CACHED_NO_UPGRADE = 0,
+  // This site has been seen before and will be upgraded
+  eHSTS_PRIMING_CACHED_DO_UPGRADE = 1,
+  // This site has been seen before and will be blocked
+  eHSTS_PRIMING_CACHED_BLOCK      = 2,
+  // The request was already upgraded, probably through
+  // upgrade-insecure-requests
+  eHSTS_PRIMING_ALREADY_UPGRADED  = 3,
+  // HSTS priming is successful and the connection will be upgraded to HTTPS
+  eHSTS_PRIMING_SUCCEEDED         = 4,
+  // When priming succeeds, but preferences require preservation of the order
+  // of mixed-content and hsts, and mixed-content blocks the load
+  eHSTS_PRIMING_SUCCEEDED_BLOCK   = 5,
+  // When priming succeeds, but preferences require preservation of the order
+  // of mixed-content and hsts, and mixed-content allows the load over http
+  eHSTS_PRIMING_SUCCEEDED_HTTP    = 6,
+  // HSTS priming failed, and the load is blocked by mixed-content
+  eHSTS_PRIMING_FAILED_BLOCK      = 7,
+  // HSTS priming failed, and the load is allowed by mixed-content
+  eHSTS_PRIMING_FAILED_ACCEPT     = 8
+};
+
+//////////////////////////////////////////////////////////////////////////
+// Class used as streamlistener and notification callback when
+// doing the HEAD request for an HSTS Priming check. Needs to be an
+// nsIStreamListener in order to receive events from AsyncOpen2
+class HSTSPrimingListener final : public nsIStreamListener,
+                                  public nsIInterfaceRequestor
+{
+public:
+  explicit HSTSPrimingListener(nsIHstsPrimingCallback* aCallback)
+   : mCallback(aCallback)
+  {
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSISTREAMLISTENER
+  NS_DECL_NSIREQUESTOBSERVER
+  NS_DECL_NSIINTERFACEREQUESTOR
+
+private:
+  ~HSTSPrimingListener() {}
+
+  // Only nsHttpChannel can invoke HSTS priming
+  friend class mozilla::net::nsHttpChannel;
+
+  /**
+   * Start the HSTS priming request. This will send an anonymous HEAD request to
+   * the URI aRequestChannel is attempting to load. On success, the new HSTS
+   * priming channel is allocated in aHSTSPrimingChannel.
+   *
+   * @param aRequestChannel the reference channel used to initialze the HSTS
+   *        priming channel
+   * @param aCallback the callback stored to handle the results of HSTS priming.
+   * @param aHSTSPrimingChannel if the new HSTS priming channel is allocated
+   *        successfully, it will be placed here.
+   */
+  static nsresult StartHSTSPriming(nsIChannel* aRequestChannel,
+                                   nsIHstsPrimingCallback* aCallback);
+
+  /**
+   * Given a request, return NS_OK if it has resulted in a cached HSTS update.
+   * We don't need to check for the header as that has already been done for us.
+   */
+  nsresult CheckHSTSPrimingRequestStatus(nsIRequest* aRequest);
+
+  /**
+   * the nsIHttpChannel to notify with the result of HSTS priming.
+   */
+  nsCOMPtr<nsIHstsPrimingCallback> mCallback;
+};
+
+
+}} // mozilla::net
+
+#endif // HSTSPrimingListener_h__
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 9ffc84e9f224..1272010194ed 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -1592,6 +1592,7 @@ NS_IMETHODIMP
 HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
 {
   LOG(("HttpChannelChild::OnRedirectVerifyCallback [this=%p]\n", this));
+  nsresult rv;
   OptionalURIParams redirectURI;
   nsCOMPtr<nsIHttpChannel> newHttpChannel =
       do_QueryInterface(mRedirectChannelChild);
@@ -1607,9 +1608,18 @@ HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
     result = NS_ERROR_DOM_BAD_URI;
   }
 
+  bool forceHSTSPriming = false;
+  bool mixedContentWouldBlock = false;
   if (newHttpChannel) {
     // Must not be called until after redirect observers called.
     newHttpChannel->SetOriginalURI(mOriginalURI);
+
+    nsCOMPtr<nsILoadInfo> newLoadInfo;
+    rv = newHttpChannel->GetLoadInfo(getter_AddRefs(newLoadInfo));
+    if (NS_SUCCEEDED(rv) && newLoadInfo) {
+      forceHSTSPriming = newLoadInfo->GetForceHSTSPriming();
+      mixedContentWouldBlock = newLoadInfo->GetMixedContentWouldBlock();
+    }
   }
 
   if (mRedirectingForSubsequentSynthesizedResponse) {
@@ -1673,7 +1683,8 @@ HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
 
   if (mIPCOpen)
     SendRedirect2Verify(result, *headerTuples, loadFlags, redirectURI,
-                        corsPreflightArgs);
+                        corsPreflightArgs, forceHSTSPriming,
+                        mixedContentWouldBlock);
 
   return NS_OK;
 }
diff --git a/netwerk/protocol/http/HttpChannelParent.cpp b/netwerk/protocol/http/HttpChannelParent.cpp
index 78a92fe15531..8231d57deed7 100644
--- a/netwerk/protocol/http/HttpChannelParent.cpp
+++ b/netwerk/protocol/http/HttpChannelParent.cpp
@@ -631,10 +631,13 @@ HttpChannelParent::RecvRedirect2Verify(const nsresult& result,
                                        const RequestHeaderTuples& changedHeaders,
                                        const uint32_t& loadFlags,
                                        const OptionalURIParams& aAPIRedirectURI,
-                                       const OptionalCorsPreflightArgs& aCorsPreflightArgs)
+                                       const OptionalCorsPreflightArgs& aCorsPreflightArgs,
+                                       const bool& aForceHSTSPriming,
+                                       const bool& aMixedContentWouldBlock)
 {
   LOG(("HttpChannelParent::RecvRedirect2Verify [this=%p result=%x]\n",
        this, result));
+  nsresult rv;
   if (NS_SUCCEEDED(result)) {
     nsCOMPtr<nsIHttpChannel> newHttpChannel =
         do_QueryInterface(mRedirectChannel);
@@ -668,6 +671,14 @@ HttpChannelParent::RecvRedirect2Verify(const nsresult& result,
         const CorsPreflightArgs& args = aCorsPreflightArgs.get_CorsPreflightArgs();
         newInternalChannel->SetCorsPreflightParameters(args.unsafeHeaders());
       }
+
+      if (aForceHSTSPriming) {
+        nsCOMPtr<nsILoadInfo> newLoadInfo;
+        rv = newHttpChannel->GetLoadInfo(getter_AddRefs(newLoadInfo));
+        if (NS_SUCCEEDED(rv) && newLoadInfo) {
+          newLoadInfo->SetHSTSPriming(aMixedContentWouldBlock);
+        }
+      }
     }
   }
 
diff --git a/netwerk/protocol/http/HttpChannelParent.h b/netwerk/protocol/http/HttpChannelParent.h
index 4232517ff13f..d14637fac815 100644
--- a/netwerk/protocol/http/HttpChannelParent.h
+++ b/netwerk/protocol/http/HttpChannelParent.h
@@ -155,7 +155,9 @@ protected:
                                    const RequestHeaderTuples& changedHeaders,
                                    const uint32_t& loadFlags,
                                    const OptionalURIParams& apiRedirectUri,
-                                   const OptionalCorsPreflightArgs& aCorsPreflightArgs) override;
+                                   const OptionalCorsPreflightArgs& aCorsPreflightArgs,
+                                   const bool& aForceHSTSPriming,
+                                   const bool& aMixedContentWouldBlock) override;
   virtual bool RecvUpdateAssociatedContentSecurity(const int32_t& broken,
                                                    const int32_t& no) override;
   virtual bool RecvDocumentChannelCleanup() override;
diff --git a/netwerk/protocol/http/PHttpChannel.ipdl b/netwerk/protocol/http/PHttpChannel.ipdl
index d7c0da64ac6f..221e7cd3135e 100644
--- a/netwerk/protocol/http/PHttpChannel.ipdl
+++ b/netwerk/protocol/http/PHttpChannel.ipdl
@@ -46,7 +46,8 @@ parent:
   // Reports approval/veto of redirect by child process redirect observers
   async Redirect2Verify(nsresult result, RequestHeaderTuples changedHeaders,
                         uint32_t loadFlags, OptionalURIParams apiRedirectTo,
-                        OptionalCorsPreflightArgs corsPreflightArgs);
+                        OptionalCorsPreflightArgs corsPreflightArgs,
+                        bool forceHSTSPriming, bool mixedContentWouldBlock);
 
   // For document loads we keep this protocol open after child's
   // OnStopRequest, and send this msg (instead of __delete__) to allow
diff --git a/netwerk/protocol/http/moz.build b/netwerk/protocol/http/moz.build
index 467cdfde22ba..3c92112de857 100644
--- a/netwerk/protocol/http/moz.build
+++ b/netwerk/protocol/http/moz.build
@@ -5,6 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 XPIDL_SOURCES += [
+    'nsIHstsPrimingCallback.idl',
     'nsIHttpActivityObserver.idl',
     'nsIHttpAuthenticableChannel.idl',
     'nsIHttpAuthenticator.idl',
@@ -59,6 +60,7 @@ UNIFIED_SOURCES += [
     'AltDataOutputStreamParent.cpp',
     'CacheControlParser.cpp',
     'ConnectionDiagnostics.cpp',
+    'HSTSPrimerListener.cpp',
     'Http2Compression.cpp',
     'Http2Push.cpp',
     'Http2Session.cpp',
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index a5b5bc327254..ed1c6429d9fc 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -100,6 +100,8 @@
 #include "nsISocketProvider.h"
 #include "mozilla/net/Predictor.h"
 #include "CacheControlParser.h"
+#include "nsMixedContentBlocker.h"
+#include "HSTSPrimerListener.h"
 
 namespace mozilla { namespace net {
 
@@ -407,12 +409,50 @@ nsHttpChannel::Connect()
         // otherwise, let's just proceed without using the cache.
     }
 
+    return TryHSTSPriming();
+}
+
+nsresult
+nsHttpChannel::TryHSTSPriming()
+{
+    if (mLoadInfo) {
+        // HSTS priming requires the LoadInfo provided with AsyncOpen2
+        bool requireHSTSPriming =
+            mLoadInfo->GetForceHSTSPriming();
+
+        if (requireHSTSPriming &&
+                nsMixedContentBlocker::sSendHSTSPriming &&
+                mInterceptCache == DO_NOT_INTERCEPT) {
+            bool isHttpsScheme;
+            nsresult rv = mURI->SchemeIs("https", &isHttpsScheme);
+            NS_ENSURE_SUCCESS(rv, rv);
+            if (!isHttpsScheme) {
+                rv = HSTSPrimingListener::StartHSTSPriming(this, this);
+
+                if (NS_FAILED(rv)) {
+                    CloseCacheEntry(false);
+                    return rv;
+                }
+
+                return NS_OK;
+            }
+
+            // The request was already upgraded, for example by
+            // upgrade-insecure-requests or a prior successful priming request
+            Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                    HSTSPrimingResult::eHSTS_PRIMING_ALREADY_UPGRADED);
+            mLoadInfo->ClearHSTSPriming();
+        }
+    }
+
     return ContinueConnect();
 }
 
 nsresult
 nsHttpChannel::ContinueConnect()
 {
+    // If we have had HSTS priming, we need to reevaluate whether we need
+    // a CORS preflight. Bug: 1272440
     // If we need to start a CORS preflight, do it now!
     // Note that it is important to do this before the early returns below.
     if (!mIsCorsPreflightDone && mRequireCORSPreflight &&
@@ -4138,7 +4178,7 @@ nsHttpChannel::OnCacheEntryAvailableInternal(nsICacheEntry *entry,
         return NS_OK;
     }
 
-    return ContinueConnect();
+    return TryHSTSPriming();
 }
 
 nsresult
@@ -5499,6 +5539,7 @@ NS_INTERFACE_MAP_BEGIN(nsHttpChannel)
     NS_INTERFACE_MAP_ENTRY(nsIDNSListener)
     NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
     NS_INTERFACE_MAP_ENTRY(nsICorsPreflightCallback)
+    NS_INTERFACE_MAP_ENTRY(nsIHstsPrimingCallback)
     NS_INTERFACE_MAP_ENTRY(nsIChannelWithDivertableParentListener)
     // we have no macro that covers this case.
     if (aIID.Equals(NS_GET_IID(nsHttpChannel)) ) {
@@ -7886,6 +7927,105 @@ nsHttpChannel::OnPreflightFailed(nsresult aError)
     return NS_OK;
 }
 
+//-----------------------------------------------------------------------------
+// nsIHstsPrimingCallback functions
+//-----------------------------------------------------------------------------
+
+/*
+ * May be invoked synchronously if HSTS priming has already been performed
+ * for the host.
+ */
+nsresult
+nsHttpChannel::OnHSTSPrimingSucceeded(bool aCached)
+{
+    if (nsMixedContentBlocker::sUseHSTS) {
+        // redirect the channel to HTTPS if the pref
+        // "security.mixed_content.use_hsts" is true
+        LOG(("HSTS Priming succeeded, redirecting to HTTPS [this=%p]", this));
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                (aCached) ? HSTSPrimingResult::eHSTS_PRIMING_CACHED_DO_UPGRADE :
+                            HSTSPrimingResult::eHSTS_PRIMING_SUCCEEDED);
+        return AsyncCall(&nsHttpChannel::HandleAsyncRedirectChannelToHttps);
+    }
+
+    // If "security.mixed_content.use_hsts" is false, record the result of
+    // HSTS priming and block or proceed with the load as required by
+    // mixed-content blocking
+    bool wouldBlock = mLoadInfo->GetMixedContentWouldBlock();
+
+    // preserve the mixed-content-before-hsts order and block if required
+    if (wouldBlock) {
+        LOG(("HSTS Priming succeeded, blocking for mixed-content [this=%p]",
+                    this));
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                              HSTSPrimingResult::eHSTS_PRIMING_SUCCEEDED_BLOCK);
+        CloseCacheEntry(false);
+        return AsyncAbort(NS_ERROR_CONTENT_BLOCKED);
+    }
+
+    LOG(("HSTS Priming succeeded, loading insecure: [this=%p]", this));
+    Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                          HSTSPrimingResult::eHSTS_PRIMING_SUCCEEDED_HTTP);
+
+    nsresult rv = ContinueConnect();
+    if (NS_FAILED(rv)) {
+        CloseCacheEntry(false);
+        return AsyncAbort(rv);
+    }
+
+    return NS_OK;
+}
+
+/*
+ * May be invoked synchronously if HSTS priming has already been performed
+ * for the host.
+ */
+nsresult
+nsHttpChannel::OnHSTSPrimingFailed(nsresult aError, bool aCached)
+{
+    bool wouldBlock = mLoadInfo->GetMixedContentWouldBlock();
+
+    LOG(("HSTS Priming Failed [this=%p], %s the load", this,
+                (wouldBlock) ? "blocking" : "allowing"));
+    if (aCached) {
+        // Between the time we marked for priming and started the priming request,
+        // the host was found to not allow the upgrade, probably from another
+        // priming request.
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                (wouldBlock) ?  HSTSPrimingResult::eHSTS_PRIMING_CACHED_BLOCK :
+                                HSTSPrimingResult::eHSTS_PRIMING_CACHED_NO_UPGRADE);
+    } else {
+        // A priming request was sent, and no HSTS header was found that allows
+        // the upgrade.
+        Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING_RESULT,
+                (wouldBlock) ?  HSTSPrimingResult::eHSTS_PRIMING_FAILED_BLOCK :
+                                HSTSPrimingResult::eHSTS_PRIMING_FAILED_ACCEPT);
+    }
+
+    // Don't visit again for at least one day
+    nsISiteSecurityService* sss = gHttpHandler->GetSSService();
+    NS_ENSURE_TRUE(sss, NS_ERROR_OUT_OF_MEMORY);
+    nsresult rv = sss->CacheNegativeHSTSResult(mURI, 24 * 60 * 60);
+    if (NS_FAILED(rv)) {
+        NS_ERROR("nsISiteSecurityService::CacheNegativeHSTSResult failed");
+    }
+
+    // If we would block, go ahead and abort with the error provided
+    if (wouldBlock) {
+        CloseCacheEntry(false);
+        return AsyncAbort(aError);
+    }
+
+    // we can continue the load and the UI has been updated as mixed content
+    rv = ContinueConnect();
+    if (NS_FAILED(rv)) {
+        CloseCacheEntry(false);
+        return AsyncAbort(rv);
+    }
+
+    return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // AChannelHasDivertableParentChannelAsListener internal functions
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index d5fa26c00daf..c720aceb3068 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -28,6 +28,7 @@
 #include "nsISupportsPrimitives.h"
 #include "nsICorsPreflightCallback.h"
 #include "AlternateServices.h"
+#include "nsIHstsPrimingCallback.h"
 
 class nsDNSPrefetch;
 class nsICancelable;
@@ -75,6 +76,7 @@ class nsHttpChannel final : public HttpBaseChannel
                           , public nsSupportsWeakReference
                           , public nsICorsPreflightCallback
                           , public nsIChannelWithDivertableParentListener
+                          , public nsIHstsPrimingCallback
 {
 public:
     NS_DECL_ISUPPORTS_INHERITED
@@ -90,6 +92,7 @@ public:
     NS_DECL_NSIAPPLICATIONCACHECONTAINER
     NS_DECL_NSIAPPLICATIONCACHECHANNEL
     NS_DECL_NSIASYNCVERIFYREDIRECTCALLBACK
+    NS_DECL_NSIHSTSPRIMINGCALLBACK
     NS_DECL_NSITHREADRETARGETABLEREQUEST
     NS_DECL_NSIDNSLISTENER
     NS_DECL_NSICHANNELWITHDIVERTABLEPARENTLISTENER
@@ -204,6 +207,9 @@ public: /* internal necko use only */
     nsresult OpenCacheEntry(bool usingSSL);
     nsresult ContinueConnect();
 
+    // If the load is mixed-content, build and send an HSTS priming request.
+    nsresult TryHSTSPriming();
+
     nsresult StartRedirectChannelToURI(nsIURI *, uint32_t);
 
     // This allows cache entry to be marked as foreign even after channel itself
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index b49eea182d93..caeaed21effb 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -2240,7 +2240,8 @@ nsHttpHandler::SpeculativeConnectInternal(nsIURI *aURI,
         flags |= nsISocketProvider::NO_PERMANENT_STORAGE;
     nsCOMPtr<nsIURI> clone;
     if (NS_SUCCEEDED(sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS,
-                                      aURI, flags, &isStsHost)) && isStsHost) {
+                                      aURI, flags, nullptr, &isStsHost)) &&
+                                      isStsHost) {
         if (NS_SUCCEEDED(NS_GetSecureUpgradedURI(aURI,
                                                  getter_AddRefs(clone)))) {
             aURI = clone.get();
diff --git a/netwerk/protocol/http/nsIHstsPrimingCallback.idl b/netwerk/protocol/http/nsIHstsPrimingCallback.idl
new file mode 100644
index 000000000000..01f53a5b212d
--- /dev/null
+++ b/netwerk/protocol/http/nsIHstsPrimingCallback.idl
@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * HSTS priming attempts to prevent mixed-content by looking for the
+ * Strict-Transport-Security header as a signal from the server that it is
+ * safe to upgrade HTTP to HTTPS.
+ *
+ * Since mixed-content blocking happens very early in the process in AsyncOpen2,
+ * the status of mixed-content blocking is stored in the LoadInfo and then used
+ * to determine whether to send a priming request or not.
+ *
+ * This interface is implemented by nsHttpChannel so that it can receive the
+ * result of HSTS priming.
+ */
+[builtinclass, uuid(eca6daca-3f2a-4a2a-b3bf-9f24f79bc999)]
+interface nsIHstsPrimingCallback : nsISupports
+{
+  /**
+   * HSTS priming has succeeded with an STS header, and the site asserts it is
+   * safe to upgrade the request from HTTP to HTTPS. The request may still be
+   * blocked based on the user's preferences.
+   *
+   * May be invoked synchronously if HSTS priming has already been performed
+   * for the host.
+   *
+   * @param aCached whether the result was already in the HSTS cache
+   */
+  [noscript, nostdcall]
+  void onHSTSPrimingSucceeded(in bool aCached);
+  /**
+   * HSTS priming has seen no STS header, the request itself has failed,
+   * or some other failure which does not constitute a positive signal that the
+   * site can be upgraded safely to HTTPS. The request may still be allowed
+   * based on the user's preferences.
+   *
+   * May be invoked synchronously if HSTS priming has already been performed
+   * for the host.
+   *
+   * @param aError The error which caused this failure, or NS_ERROR_CONTENT_BLOCKED
+   * @param aCached whether the result was already in the HSTS cache
+   */
+  [noscript, nostdcall]
+  void onHSTSPrimingFailed(in nsresult aError, in bool aCached);
+};
diff --git a/security/manager/ssl/SSLServerCertVerification.cpp b/security/manager/ssl/SSLServerCertVerification.cpp
index c3c726054cc1..13d9605e1ce0 100644
--- a/security/manager/ssl/SSLServerCertVerification.cpp
+++ b/security/manager/ssl/SSLServerCertVerification.cpp
@@ -509,6 +509,7 @@ CertErrorRunnable::CheckCertOverrides()
   nsresult nsrv = sss->IsSecureHost(nsISiteSecurityService::HEADER_HSTS,
                                     mInfoObject->GetHostNameRaw(),
                                     mProviderFlags,
+                                    nullptr,
                                     &strictTransportSecurityEnabled);
   if (NS_FAILED(nsrv)) {
     MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
@@ -519,6 +520,7 @@ CertErrorRunnable::CheckCertOverrides()
   nsrv = sss->IsSecureHost(nsISiteSecurityService::HEADER_HPKP,
                            mInfoObject->GetHostNameRaw(),
                            mProviderFlags,
+                           nullptr,
                            &hasPinningInformation);
   if (NS_FAILED(nsrv)) {
     MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
diff --git a/security/manager/ssl/nsISiteSecurityService.idl b/security/manager/ssl/nsISiteSecurityService.idl
index 0eca3041ad47..a6e3416e43c6 100644
--- a/security/manager/ssl/nsISiteSecurityService.idl
+++ b/security/manager/ssl/nsISiteSecurityService.idl
@@ -115,10 +115,13 @@ interface nsISiteSecurityService : nsISupports
      * @param aHost the hostname (punycode) to query for state.
      * @param aFlags  options for this request as defined in nsISocketProvider:
      *                  NO_PERMANENT_STORAGE
+     * @param aCached true if we have cached information regarding whether or not
+     *                  the host is HSTS, false otherwise.
      */
     boolean isSecureHost(in uint32_t aType,
                          in string aHost,
-                         in uint32_t aFlags);
+                         in uint32_t aFlags,
+                         [optional] out boolean aCached);
 
     /**
      * Checks whether or not the URI's hostname has a given security state set.
@@ -133,8 +136,11 @@ interface nsISiteSecurityService : nsISupports
      * @param aURI the URI to query for STS state.
      * @param aFlags  options for this request as defined in nsISocketProvider:
      *                  NO_PERMANENT_STORAGE
+     * @param aCached true if we have cached information regarding whether or not
+     *                  the host is HSTS, false otherwise.
      */
-    boolean isSecureURI(in uint32_t aType, in nsIURI aURI, in uint32_t aFlags);
+    boolean isSecureURI(in uint32_t aType, in nsIURI aURI, in uint32_t aFlags,
+                        [optional] out boolean aCached);
 
     /**
      * Removes all security state by resetting to factory-original settings.
@@ -174,6 +180,14 @@ interface nsISiteSecurityService : nsISupports
                         in unsigned long aMaxAge, in unsigned long aPinCount,
                         [array, size_is(aPinCount)] in string aSha256Pins);
 
+    /**
+     * Mark a host as declining to provide a given security state so that features
+     * such as HSTS priming will not flood a server with requests.
+     *
+     * @param aURI the nsIURI that this applies to
+     * @param aMaxAge lifetime (in seconds) of this negative cache
+     */
+    [noscript] void cacheNegativeHSTSResult(in nsIURI aURI, in unsigned long long aMaxAge);
 };
 
 %{C++
diff --git a/security/manager/ssl/nsSiteSecurityService.cpp b/security/manager/ssl/nsSiteSecurityService.cpp
index b3df457ff52e..1211edd595b8 100644
--- a/security/manager/ssl/nsSiteSecurityService.cpp
+++ b/security/manager/ssl/nsSiteSecurityService.cpp
@@ -314,7 +314,8 @@ nsSiteSecurityService::SetHSTSState(uint32_t aType,
                                     nsIURI* aSourceURI,
                                     int64_t maxage,
                                     bool includeSubdomains,
-                                    uint32_t flags)
+                                    uint32_t flags,
+                                    SecurityPropertyState aHSTSState)
 {
   // If max-age is zero, that's an indication to immediately remove the
   // security state, so here's a shortcut.
@@ -322,8 +323,12 @@ nsSiteSecurityService::SetHSTSState(uint32_t aType,
     return RemoveState(aType, aSourceURI, flags);
   }
 
+  MOZ_ASSERT((aHSTSState == SecurityPropertySet ||
+              aHSTSState == SecurityPropertyNegative),
+      "HSTS State must be SecurityPropertySet or SecurityPropertyNegative");
+
   int64_t expiretime = ExpireTimeFromMaxAge(maxage);
-  SiteHSTSState siteState(expiretime, SecurityPropertySet, includeSubdomains);
+  SiteHSTSState siteState(expiretime, aHSTSState, includeSubdomains);
   nsAutoCString stateString;
   siteState.ToString(stateString);
   nsAutoCString hostname;
@@ -342,6 +347,14 @@ nsSiteSecurityService::SetHSTSState(uint32_t aType,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSiteSecurityService::CacheNegativeHSTSResult(nsIURI* aSourceURI,
+                                               uint64_t aMaxAge)
+{
+  return SetHSTSState(nsISiteSecurityService::HEADER_HSTS, aSourceURI,
+                      aMaxAge, false, 0, SecurityPropertyNegative);
+}
+
 NS_IMETHODIMP
 nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI,
                                    uint32_t aFlags)
@@ -864,7 +877,7 @@ nsSiteSecurityService::ProcessSTSHeader(nsIURI* aSourceURI,
 
   // record the successfully parsed header data.
   nsresult rv = SetHSTSState(aType, aSourceURI, maxAge, foundIncludeSubdomains,
-                             aFlags);
+                             aFlags, SecurityPropertySet);
   if (NS_FAILED(rv)) {
     SSSLOG(("SSS: failed to set STS state"));
     if (aFailureResult) {
@@ -888,7 +901,8 @@ nsSiteSecurityService::ProcessSTSHeader(nsIURI* aSourceURI,
 
 NS_IMETHODIMP
 nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
-                                   uint32_t aFlags, bool* aResult)
+                                   uint32_t aFlags, bool* aCached,
+                                   bool* aResult)
 {
    // Child processes are not allowed direct access to this.
    if (!XRE_IsParentProcess() && aType != nsISiteSecurityService::HEADER_HSTS) {
@@ -912,7 +926,7 @@ nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
     return NS_OK;
   }
 
-  return IsSecureHost(aType, hostname.get(), aFlags, aResult);
+  return IsSecureHost(aType, hostname.get(), aFlags, aCached, aResult);
 }
 
 int STSPreloadCompare(const void *key, const void *entry)
@@ -942,7 +956,8 @@ nsSiteSecurityService::GetPreloadListEntry(const char *aHost)
 
 NS_IMETHODIMP
 nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
-                                    uint32_t aFlags, bool* aResult)
+                                    uint32_t aFlags, bool* aCached,
+                                    bool* aResult)
 {
    // Child processes are not allowed direct access to this.
    if (!XRE_IsParentProcess() && aType != nsISiteSecurityService::HEADER_HSTS) {
@@ -959,6 +974,9 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
 
   // set default in case if we can't find any STS information
   *aResult = false;
+  if (aCached) {
+    *aCached = false;
+  }
 
   /* An IP address never qualifies as a secure URI. */
   if (HostIsIPAddress(aHost)) {
@@ -984,6 +1002,9 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
   nsAutoCString host(PublicKeyPinningService::CanonicalizeHostname(aHost));
   if (host.EqualsLiteral("chart.apis.google.com") ||
       StringEndsWith(host, NS_LITERAL_CSTRING(".chart.apis.google.com"))) {
+    if (aCached) {
+      *aCached = true;
+    }
     return NS_OK;
   }
 
@@ -1007,9 +1028,17 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
   if (siteState.mHSTSState != SecurityPropertyUnset) {
     SSSLOG(("Found entry for %s", host.get()));
     bool expired = siteState.IsExpired(aType);
-    if (!expired && siteState.mHSTSState == SecurityPropertySet) {
-      *aResult = true;
-      return NS_OK;
+    if (!expired) {
+      if (aCached) {
+        *aCached = true;
+      }
+      if (siteState.mHSTSState == SecurityPropertySet) {
+        *aResult = true;
+        return NS_OK;
+      } else if (siteState.mHSTSState == SecurityPropertyNegative) {
+        *aResult = false;
+        return NS_OK;
+      }
     }
 
     // If the entry is expired and not in the preload list, we can remove it.
@@ -1022,6 +1051,9 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
   else if (GetPreloadListEntry(host.get())) {
     SSSLOG(("%s is a preloaded STS host", host.get()));
     *aResult = true;
+    if (aCached) {
+      *aCached = true;
+    }
     return NS_OK;
   }
 
@@ -1054,9 +1086,17 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
     if (siteState.mHSTSState != SecurityPropertyUnset) {
       SSSLOG(("Found entry for %s", subdomain));
       bool expired = siteState.IsExpired(aType);
-      if (!expired && siteState.mHSTSState == SecurityPropertySet) {
-        *aResult = siteState.mHSTSIncludeSubdomains;
-        break;
+      if (!expired) {
+        if (aCached) {
+          *aCached = true;
+        }
+        if (siteState.mHSTSState == SecurityPropertySet) {
+          *aResult = siteState.mHSTSIncludeSubdomains;
+          break;
+        } else if (siteState.mHSTSState == SecurityPropertyNegative) {
+          *aResult = false;
+          break;
+        }
       }
 
       // If the entry is expired and not in the preload list, we can remove it.
@@ -1070,6 +1110,9 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
       if (preload->mIncludeSubdomains) {
         SSSLOG(("%s is a preloaded STS host", subdomain));
         *aResult = true;
+        if (aCached) {
+          *aCached = true;
+        }
         break;
       }
     }
diff --git a/security/manager/ssl/nsSiteSecurityService.h b/security/manager/ssl/nsSiteSecurityService.h
index cba010917cb6..c3eafda4d566 100644
--- a/security/manager/ssl/nsSiteSecurityService.h
+++ b/security/manager/ssl/nsSiteSecurityService.h
@@ -34,7 +34,8 @@ class nsISSLStatus;
 enum SecurityPropertyState {
   SecurityPropertyUnset = 0,
   SecurityPropertySet = 1,
-  SecurityPropertyKnockout = 2
+  SecurityPropertyKnockout = 2,
+  SecurityPropertyNegative = 3,
 };
 
 /**
@@ -128,7 +129,8 @@ protected:
 private:
   nsresult GetHost(nsIURI *aURI, nsACString &aResult);
   nsresult SetHSTSState(uint32_t aType, nsIURI* aSourceURI, int64_t maxage,
-                        bool includeSubdomains, uint32_t flags);
+                        bool includeSubdomains, uint32_t flags,
+                        SecurityPropertyState aHSTSState);
   nsresult ProcessHeaderInternal(uint32_t aType, nsIURI* aSourceURI,
                                  const char* aHeader, nsISSLStatus* aSSLStatus,
                                  uint32_t aFlags, uint64_t* aMaxAge,
diff --git a/testing/specialpowers/content/SpecialPowersObserverAPI.js b/testing/specialpowers/content/SpecialPowersObserverAPI.js
index dc5f47d68ee9..30fb3b9b90df 100644
--- a/testing/specialpowers/content/SpecialPowersObserverAPI.js
+++ b/testing/specialpowers/content/SpecialPowersObserverAPI.js
@@ -324,10 +324,10 @@ SpecialPowersObserverAPI.prototype = {
           case "BOOL":
             if (aMessage.json.op == "get")
               return(prefs.getBoolPref(prefName));
-            else 
+            else
               return(prefs.setBoolPref(prefName, prefValue));
           case "INT":
-            if (aMessage.json.op == "get") 
+            if (aMessage.json.op == "get")
               return(prefs.getIntPref(prefName));
             else
               return(prefs.setIntPref(prefName, prefValue));
@@ -563,6 +563,7 @@ SpecialPowersObserverAPI.prototype = {
         let sss = Cc["@mozilla.org/ssservice;1"].
                   getService(Ci.nsISiteSecurityService);
         sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, uri, flags);
+        return undefined;
       }
 
       case "SPLoadExtension": {
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..5e03208871cd
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks-https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/cross-origin-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/fetch-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/link-css-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/object-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/picture-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/script-tag/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/keep-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/no-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
new file mode 100644
index 000000000000..e142723ce432
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/blockable/no-opt-in/same-host-http/xhr-request/top-level/swap-scheme-redirect/no-opt-in-blocks.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-blocks.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
index 08f9ebfe1b95..daf4eda9bc21 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: cross-origin-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: no-redirect\n                                 subresource: link-prefetch-tag\n                                 expectation: allowed]
     expected: FAIL
     bug: haven't implement prefetch link as an optionally blockable item
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
index c54692784d7a..d92511b46b47 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: cross-origin-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: swap-scheme-redirect\n                                 subresource: link-prefetch-tag\n                                 expectation: allowed]
     expected: FAIL
     bug: haven't implement prefetch link as an optionally blockable item
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
index 5b8f14cdac0d..816099748d53 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: cross-origin-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: keep-scheme-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
index bb26f6222cd0..8d0841c66c99 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: cross-origin-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: no-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
index b7c967ec1e42..8da087bd753f 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/cross-origin-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: cross-origin-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: swap-scheme-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/audio-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
new file mode 100644
index 000000000000..4680d0183c19
--- /dev/null
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/img-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -0,0 +1,3 @@
+[no-opt-in-allows.https.html]
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
index 4be874e1dc73..dca89065324a 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: keep-scheme-redirect\n                                 subresource: link-prefetch-tag\n                                 expectation: allowed]
     expected: FAIL
     bug: haven't implement prefetch link as an optionally blockable item
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
index 13f6d97f1d30..69c503fd514b 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: no-redirect\n                                 subresource: link-prefetch-tag\n                                 expectation: allowed]
     expected: FAIL
     bug: haven't implement prefetch link as an optionally blockable item
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
index 8a652d5a0de9..53f3b7d9c734 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/link-prefetch-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: swap-scheme-redirect\n                                 subresource: link-prefetch-tag\n                                 expectation: allowed]
     expected: FAIL
     bug: haven't implement prefetch link as an optionally blockable item
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
index 18350af87754..a5959e8ada78 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/keep-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: keep-scheme-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
index d7608b515cb9..0120de45be04 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/no-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: no-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
index 311eaa4f5de5..1013b7df5023 100644
--- a/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
+++ b/testing/web-platform/meta/mixed-content/optionally-blockable/no-opt-in/same-host-http/video-tag/top-level/swap-scheme-redirect/no-opt-in-allows.https.html.ini
@@ -1,5 +1,7 @@
 [no-opt-in-allows.https.html]
   type: testharness
+  prefs: [security.mixed_content.send_hsts_priming:false,
+          security.mixed_content.use_hsts:false]
   [opt_in_method: no-opt-in\n                                 origin: same-host-http\n                                 source_scheme: https\n                                 context_nesting: top-level\n                                 redirection: swap-scheme-redirect\n                                 subresource: video-tag\n                                 expectation: allowed]
     expected:
       if (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index e9770a573b79..4382d649d8b4 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -7697,6 +7697,22 @@
     "n_values": 10,
     "description": "How often would blocked mixed content be allowed if HSTS upgrades were allowed? 0=display/no-HSTS, 1=display/HSTS, 2=active/no-HSTS, 3=active/HSTS"
   },
+  "MIXED_CONTENT_HSTS_PRIMING": {
+    "alert_emails": ["seceng@mozilla.org"],
+    "bug_numbers": [1246540],
+    "expires_in_version": "60",
+    "kind": "enumerated",
+    "n_values": 16,
+    "description": "How often would blocked mixed content be allowed if HSTS upgrades were allowed, including how often would we send an HSTS priming request? 0=display/no-HSTS, 1=display/HSTS, 2=active/no-HSTS, 3=active/HSTS, 4=display/no-HSTS-priming, 5=display/do-HSTS-priming, 6=active/no-HSTS-priming, 7=active/do-HSTS-priming"
+  },
+  "MIXED_CONTENT_HSTS_PRIMING_RESULT": {
+    "alert_emails": ["seceng@mozilla.org"],
+    "bug_numbers": [1246540],
+    "expires_in_version": "60",
+    "kind": "enumerated",
+    "n_values": 16,
+    "description": "How often do we get back an HSTS priming result which upgrades the connection to HTTPS? 0=cached (no upgrade), 1=cached (do upgrade), 2=cached (blocked), 3=already upgraded, 4=priming succeeded, 5=priming succeeded (block due to pref), 6=priming succeeded (no upgrade due to pref), 7=priming failed (block), 8=priming failed (accept)"
+  },
   "MIXED_CONTENT_OBJECT_SUBREQUEST": {
     "alert_emails": ["seceng@mozilla.org"],
     "bug_numbers": [1244116],

From a1246ef4ea15feeeef653a7e8a05b07c12cea1e0 Mon Sep 17 00:00:00 2001
From: Richard Marti <richard.marti@gmail.com>
Date: Tue, 27 Sep 2016 19:49:04 +0200
Subject: [PATCH 062/102] Bug 1305698 - Add a margin of 48px to
 #disabled-unsigned-addons-info in Add-on manager. r=Gijs

--HG--
extra : rebase_source : d7b0125a3a636162f8af2ceb9c5af78c9bd81f9c
---
 toolkit/themes/shared/extensions/extensions.inc.css | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/toolkit/themes/shared/extensions/extensions.inc.css b/toolkit/themes/shared/extensions/extensions.inc.css
index 3774a76d8815..c4523bbe64e2 100644
--- a/toolkit/themes/shared/extensions/extensions.inc.css
+++ b/toolkit/themes/shared/extensions/extensions.inc.css
@@ -1062,7 +1062,8 @@ button.button-link:not([disabled="true"]):active:hover {
 
 #disabled-unsigned-addons-info {
   margin-bottom: 2em;
-  margin-inline-end: 48px;
+  margin-right: 48px;
+  margin-left: 48px;
 }
 
 #disabled-unsigned-addons-heading {

From 8ec7ee57a1515ab17d195a77270ce5b7ec5d080a Mon Sep 17 00:00:00 2001
From: Cory Price <cprice@mozilla.com>
Date: Fri, 23 Sep 2016 09:56:26 -0700
Subject: [PATCH 063/102] Bug 1302414 - Theme preview is not working.
 r=sebastian

--HG--
extra : rebase_source : 53c8b40b3666e30d53852ce8633c91e1eaf7c25e
---
 mobile/android/app/mobile.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index dbe760937a7b..c9e47a856326 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -195,8 +195,7 @@ pref("dom.forms.number", true);
 /* extension manager and xpinstall */
 pref("xpinstall.whitelist.directRequest", false);
 pref("xpinstall.whitelist.fileRequest", false);
-pref("xpinstall.whitelist.add", "https://addons.mozilla.org");
-pref("xpinstall.whitelist.add", "https://testpilot.firefox.com");
+pref("xpinstall.whitelist.add", "https://addons.mozilla.org,https://testpilot.firefox.com");
 
 pref("xpinstall.signatures.required", true);
 

From f2d63fa10f00b5e7d0f5917c4f7ffd07c11ac9e0 Mon Sep 17 00:00:00 2001
From: Dylan Roeh <droeh@mozilla.com>
Date: Tue, 27 Sep 2016 11:07:24 -0500
Subject: [PATCH 064/102] Bug 1294821 - De-singletonize EventDispatcher and
 make it application-specific. r=jchen

---
 .../org/mozilla/gecko/AccountsHelper.java     |  4 +-
 .../mozilla/gecko/ActionBarTextSelection.java |  4 +-
 .../java/org/mozilla/gecko/BrowserApp.java    |  1 +
 .../org/mozilla/gecko/DoorHangerPopup.java    |  4 +-
 .../java/org/mozilla/gecko/FindInPageBar.java |  4 +-
 .../org/mozilla/gecko/FormAssistPopup.java    |  4 +-
 .../base/java/org/mozilla/gecko/GeckoApp.java | 30 +++++--
 .../org/mozilla/gecko/MediaCastingBar.java    |  5 +-
 .../org/mozilla/gecko/MediaPlayerManager.java | 20 ++---
 .../gecko/SharedPreferencesHelper.java        |  4 +-
 .../base/java/org/mozilla/gecko/Tabs.java     |  1 -
 .../java/org/mozilla/gecko/ZoomedView.java    |  4 +-
 .../org/mozilla/gecko/home/BrowserSearch.java |  5 +-
 .../gecko/home/CombinedHistoryPanel.java      |  2 +
 .../org/mozilla/gecko/home/HomeBanner.java    |  5 +-
 .../mozilla/gecko/home/HomePanelsManager.java |  7 ++
 .../mozilla/gecko/home/PanelInfoManager.java  |  5 +-
 .../mozilla/gecko/home/RecentTabsAdapter.java |  9 +-
 .../notifications/NotificationHelper.java     |  4 +
 .../gecko/preferences/GeckoPreferences.java   | 12 +--
 .../preferences/SearchPreferenceCategory.java |  5 +-
 .../mozilla/gecko/prompts/PromptService.java  |  5 +-
 .../org/mozilla/gecko/push/PushService.java   |  5 +-
 .../gecko/reader/ReadingListHelper.java       |  5 +-
 .../text/FloatingToolbarTextSelection.java    |  5 +-
 .../gecko/toolbar/PageActionLayout.java       |  5 +-
 .../gecko/toolbar/SiteIdentityPopup.java      | 12 ++-
 .../org/mozilla/gecko/BaseGeckoInterface.java |  7 ++
 .../org/mozilla/gecko/EventDispatcher.java    | 84 ++++++++++---------
 .../java/org/mozilla/gecko/GeckoAppShell.java | 11 ++-
 .../java/org/mozilla/gecko/GeckoEditable.java |  4 +-
 .../java/org/mozilla/gecko/GeckoThread.java   |  1 +
 .../org/mozilla/gecko/FennecNativeDriver.java |  2 +-
 .../mozilla/gecko/tests/testFilePicker.java   |  5 +-
 .../mozilla/gecko/tests/testFindInPage.java   |  8 +-
 .../gecko/tests/testTrackingProtection.java   | 11 ++-
 36 files changed, 192 insertions(+), 117 deletions(-)

diff --git a/mobile/android/base/java/org/mozilla/gecko/AccountsHelper.java b/mobile/android/base/java/org/mozilla/gecko/AccountsHelper.java
index 9eeafb3971f2..bd2c02babbe9 100644
--- a/mobile/android/base/java/org/mozilla/gecko/AccountsHelper.java
+++ b/mobile/android/base/java/org/mozilla/gecko/AccountsHelper.java
@@ -52,7 +52,7 @@ public class AccountsHelper implements NativeEventListener {
         mContext = context;
         mProfile = profile;
 
-        EventDispatcher dispatcher = EventDispatcher.getInstance();
+        EventDispatcher dispatcher = GeckoApp.getEventDispatcher();
         if (dispatcher == null) {
             Log.e(LOGTAG, "Gecko event dispatcher must not be null", new RuntimeException());
             return;
@@ -68,7 +68,7 @@ public class AccountsHelper implements NativeEventListener {
     }
 
     public synchronized void uninit() {
-        EventDispatcher dispatcher = EventDispatcher.getInstance();
+        EventDispatcher dispatcher = GeckoApp.getEventDispatcher();
         if (dispatcher == null) {
             Log.e(LOGTAG, "Gecko event dispatcher must not be null", new RuntimeException());
             return;
diff --git a/mobile/android/base/java/org/mozilla/gecko/ActionBarTextSelection.java b/mobile/android/base/java/org/mozilla/gecko/ActionBarTextSelection.java
index 0e137e4b5d7f..8351931201ff 100644
--- a/mobile/android/base/java/org/mozilla/gecko/ActionBarTextSelection.java
+++ b/mobile/android/base/java/org/mozilla/gecko/ActionBarTextSelection.java
@@ -69,7 +69,7 @@ class ActionBarTextSelection implements TextSelection, GeckoEventListener {
         if (anchorHandle == null) {
             Log.e(LOGTAG, "Failed to initialize text selection because at least one handle is null");
         } else {
-            EventDispatcher.getInstance().registerGeckoThreadListener(this,
+            GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
                 "TextSelection:ActionbarInit",
                 "TextSelection:ActionbarStatus",
                 "TextSelection:ActionbarUninit",
@@ -88,7 +88,7 @@ class ActionBarTextSelection implements TextSelection, GeckoEventListener {
         if (anchorHandle == null) {
             Log.e(LOGTAG, "Do not unregister TextSelection:* listeners since anchorHandle is null");
         } else {
-            EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+            GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
                     "TextSelection:ActionbarInit",
                     "TextSelection:ActionbarStatus",
                     "TextSelection:ActionbarUninit",
diff --git a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
index 2099e013caed..b4718485fe47 100644
--- a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
+++ b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
@@ -578,6 +578,7 @@ public class BrowserApp extends GeckoApp
         // widget code and BrowserToolbar need it, and they're created by the
         // layout, which GeckoApp takes care of.
         ((GeckoApplication) getApplication()).prepareLightweightTheme();
+
         super.onCreate(savedInstanceState);
 
         final Context appContext = getApplicationContext();
diff --git a/mobile/android/base/java/org/mozilla/gecko/DoorHangerPopup.java b/mobile/android/base/java/org/mozilla/gecko/DoorHangerPopup.java
index a607d29fa6f0..f2a818f06d02 100644
--- a/mobile/android/base/java/org/mozilla/gecko/DoorHangerPopup.java
+++ b/mobile/android/base/java/org/mozilla/gecko/DoorHangerPopup.java
@@ -42,7 +42,7 @@ public class DoorHangerPopup extends AnchoredPopup
 
         mDoorHangers = new HashSet<DoorHanger>();
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "Doorhanger:Add",
             "Doorhanger:Remove");
         Tabs.registerOnTabsChangedListener(this);
@@ -51,7 +51,7 @@ public class DoorHangerPopup extends AnchoredPopup
     }
 
     void destroy() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "Doorhanger:Add",
             "Doorhanger:Remove");
         Tabs.unregisterOnTabsChangedListener(this);
diff --git a/mobile/android/base/java/org/mozilla/gecko/FindInPageBar.java b/mobile/android/base/java/org/mozilla/gecko/FindInPageBar.java
index 30bf20f68156..993d7f207053 100644
--- a/mobile/android/base/java/org/mozilla/gecko/FindInPageBar.java
+++ b/mobile/android/base/java/org/mozilla/gecko/FindInPageBar.java
@@ -67,7 +67,7 @@ public class FindInPageBar extends LinearLayout implements TextWatcher, View.OnC
         mStatusText = (TextView) content.findViewById(R.id.find_status);
 
         mInflated = true;
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "TextSelection:Data");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "TextSelection:Data");
     }
 
     public void show() {
@@ -110,7 +110,7 @@ public class FindInPageBar extends LinearLayout implements TextWatcher, View.OnC
         if (!mInflated) {
             return;
         }
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "TextSelection:Data");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "TextSelection:Data");
     }
 
     // TextWatcher implementation
diff --git a/mobile/android/base/java/org/mozilla/gecko/FormAssistPopup.java b/mobile/android/base/java/org/mozilla/gecko/FormAssistPopup.java
index 727429ae5cd1..5c7f932c0088 100644
--- a/mobile/android/base/java/org/mozilla/gecko/FormAssistPopup.java
+++ b/mobile/android/base/java/org/mozilla/gecko/FormAssistPopup.java
@@ -91,14 +91,14 @@ public class FormAssistPopup extends RelativeLayout implements GeckoEventListene
 
         setFocusable(false);
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "FormAssist:AutoComplete",
             "FormAssist:ValidationMessage",
             "FormAssist:Hide");
     }
 
     void destroy() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "FormAssist:AutoComplete",
             "FormAssist:ValidationMessage",
             "FormAssist:Hide");
diff --git a/mobile/android/base/java/org/mozilla/gecko/GeckoApp.java b/mobile/android/base/java/org/mozilla/gecko/GeckoApp.java
index 7dd0aac93ac3..ea9561ca363c 100644
--- a/mobile/android/base/java/org/mozilla/gecko/GeckoApp.java
+++ b/mobile/android/base/java/org/mozilla/gecko/GeckoApp.java
@@ -201,6 +201,8 @@ public abstract class GeckoApp
     protected boolean mShouldRestore;
     private boolean mSessionRestoreParsingFinished = false;
 
+    private EventDispatcher eventDispatcher;
+
     private static final class LastSessionParser extends SessionParser {
         private JSONArray tabs;
         private JSONObject windowObject;
@@ -1105,6 +1107,8 @@ public abstract class GeckoApp
     public void onCreate(Bundle savedInstanceState) {
         GeckoAppShell.ensureCrashHandling();
 
+        eventDispatcher = new EventDispatcher();
+
         // Enable Android Strict Mode for developers' local builds (the "default" channel).
         if ("default".equals(AppConstants.MOZ_UPDATE_CHANNEL)) {
             enableStrictMode();
@@ -1204,12 +1208,12 @@ public abstract class GeckoApp
         // GeckoThread has to register for "Gecko:Ready" first, so GeckoApp registers
         // for events after initializing GeckoThread but before launching it.
 
-        EventDispatcher.getInstance().registerGeckoThreadListener((GeckoEventListener)this,
+        getAppEventDispatcher().registerGeckoThreadListener((GeckoEventListener)this,
             "Gecko:Ready",
             "Gecko:Exited",
             "Accessibility:Event");
 
-        EventDispatcher.getInstance().registerGeckoThreadListener((NativeEventListener)this,
+        getAppEventDispatcher().registerGeckoThreadListener((NativeEventListener)this,
             "Accessibility:Ready",
             "Bookmark:Insert",
             "Contact:Add",
@@ -1383,7 +1387,7 @@ public abstract class GeckoApp
                 // through "onDestroy" -- essentially the same as the lifecycle
                 // of the activity itself.
                 final String profilePath = getProfile().getDir().getAbsolutePath();
-                final EventDispatcher dispatcher = EventDispatcher.getInstance();
+                final EventDispatcher dispatcher = getAppEventDispatcher();
 
                 // This is the locale prior to fixing it up.
                 final Locale osLocale = Locale.getDefault();
@@ -1692,11 +1696,11 @@ public abstract class GeckoApp
             public void run() {
                 if (TabQueueHelper.TAB_QUEUE_ENABLED && TabQueueHelper.shouldOpenTabQueueUrls(GeckoApp.this)) {
 
-                    EventDispatcher.getInstance().registerGeckoThreadListener(new NativeEventListener() {
+                    getAppEventDispatcher().registerGeckoThreadListener(new NativeEventListener() {
                         @Override
                         public void handleMessage(String event, NativeJSObject message, EventCallback callback) {
                             if ("Tabs:TabsOpened".equals(event)) {
-                                EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Tabs:TabsOpened");
+                                getAppEventDispatcher().unregisterGeckoThreadListener(this, "Tabs:TabsOpened");
                                 openTabsRunnable.run();
                             }
                         }
@@ -1755,6 +1759,16 @@ public abstract class GeckoApp
         }
     }
 
+    public static EventDispatcher getEventDispatcher() {
+        final GeckoApp geckoApp = (GeckoApp) GeckoAppShell.getGeckoInterface();
+        return geckoApp.getAppEventDispatcher();
+    }
+
+    @Override
+    public EventDispatcher getAppEventDispatcher() {
+        return eventDispatcher;
+    }
+
     @Override
     public GeckoProfile getProfile() {
         return GeckoThread.getActiveProfile();
@@ -2108,6 +2122,8 @@ public abstract class GeckoApp
             return;
         }
 
+        GeckoAppShell.setGeckoInterface(this);
+
         int newOrientation = getResources().getConfiguration().orientation;
         if (GeckoScreenOrientation.getInstance().update(newOrientation)) {
             refreshChrome();
@@ -2259,12 +2275,12 @@ public abstract class GeckoApp
             return;
         }
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener((GeckoEventListener)this,
+        getAppEventDispatcher().unregisterGeckoThreadListener((GeckoEventListener)this,
             "Gecko:Ready",
             "Gecko:Exited",
             "Accessibility:Event");
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener((NativeEventListener)this,
+        getAppEventDispatcher().unregisterGeckoThreadListener((NativeEventListener)this,
             "Accessibility:Ready",
             "Bookmark:Insert",
             "Contact:Add",
diff --git a/mobile/android/base/java/org/mozilla/gecko/MediaCastingBar.java b/mobile/android/base/java/org/mozilla/gecko/MediaCastingBar.java
index 734b5d32b35b..bd109058cd39 100644
--- a/mobile/android/base/java/org/mozilla/gecko/MediaCastingBar.java
+++ b/mobile/android/base/java/org/mozilla/gecko/MediaCastingBar.java
@@ -4,6 +4,7 @@
 
 package org.mozilla.gecko;
 
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.util.GeckoEventListener;
 import org.mozilla.gecko.util.ThreadUtils;
 
@@ -32,7 +33,7 @@ public class MediaCastingBar extends RelativeLayout implements View.OnClickListe
     public MediaCastingBar(Context context, AttributeSet attrs) {
         super(context, attrs);
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "Casting:Started",
             "Casting:Paused",
             "Casting:Playing",
@@ -71,7 +72,7 @@ public class MediaCastingBar extends RelativeLayout implements View.OnClickListe
     }
 
     public void onDestroy() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "Casting:Started",
             "Casting:Paused",
             "Casting:Playing",
diff --git a/mobile/android/base/java/org/mozilla/gecko/MediaPlayerManager.java b/mobile/android/base/java/org/mozilla/gecko/MediaPlayerManager.java
index a9f983e2a148..1757650ae9e0 100644
--- a/mobile/android/base/java/org/mozilla/gecko/MediaPlayerManager.java
+++ b/mobile/android/base/java/org/mozilla/gecko/MediaPlayerManager.java
@@ -69,22 +69,22 @@ public class MediaPlayerManager extends Fragment implements NativeEventListener
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
-                "MediaPlayer:Load",
-                "MediaPlayer:Start",
-                "MediaPlayer:Stop",
-                "MediaPlayer:Play",
-                "MediaPlayer:Pause",
-                "MediaPlayer:End",
-                "MediaPlayer:Mirror",
-                "MediaPlayer:Message");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
+                                                                  "MediaPlayer:Load",
+                                                                  "MediaPlayer:Start",
+                                                                  "MediaPlayer:Stop",
+                                                                  "MediaPlayer:Play",
+                                                                  "MediaPlayer:Pause",
+                                                                  "MediaPlayer:End",
+                                                                  "MediaPlayer:Mirror",
+                                                                  "MediaPlayer:Message");
     }
 
     @Override
     @JNITarget
     public void onDestroy() {
         super.onDestroy();
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
                                                                     "MediaPlayer:Load",
                                                                     "MediaPlayer:Start",
                                                                     "MediaPlayer:Stop",
diff --git a/mobile/android/base/java/org/mozilla/gecko/SharedPreferencesHelper.java b/mobile/android/base/java/org/mozilla/gecko/SharedPreferencesHelper.java
index 07f0bd283b1d..1066da0799da 100644
--- a/mobile/android/base/java/org/mozilla/gecko/SharedPreferencesHelper.java
+++ b/mobile/android/base/java/org/mozilla/gecko/SharedPreferencesHelper.java
@@ -64,7 +64,7 @@ public final class SharedPreferencesHelper
 
         mListeners = new HashMap<String, SharedPreferences.OnSharedPreferenceChangeListener>();
 
-        EventDispatcher dispatcher = EventDispatcher.getInstance();
+        EventDispatcher dispatcher = GeckoApp.getEventDispatcher();
         if (dispatcher == null) {
             Log.e(LOGTAG, "Gecko event dispatcher must not be null", new RuntimeException());
             return;
@@ -76,7 +76,7 @@ public final class SharedPreferencesHelper
     }
 
     public synchronized void uninit() {
-        EventDispatcher dispatcher = EventDispatcher.getInstance();
+        EventDispatcher dispatcher = GeckoApp.getEventDispatcher();
         if (dispatcher == null) {
             Log.e(LOGTAG, "Gecko event dispatcher must not be null", new RuntimeException());
             return;
diff --git a/mobile/android/base/java/org/mozilla/gecko/Tabs.java b/mobile/android/base/java/org/mozilla/gecko/Tabs.java
index 413809c81b16..75784aff048c 100644
--- a/mobile/android/base/java/org/mozilla/gecko/Tabs.java
+++ b/mobile/android/base/java/org/mozilla/gecko/Tabs.java
@@ -489,7 +489,6 @@ public class Tabs implements GeckoEventListener {
                                           message.getString("title"),
                                           message.getBoolean("isPrivate"),
                                           message.getInt("tabIndex"));
-
                     // If we added the tab as a stub, we should have already
                     // selected it, so ignore this flag for stubbed tabs.
                     if (message.getBoolean("selected"))
diff --git a/mobile/android/base/java/org/mozilla/gecko/ZoomedView.java b/mobile/android/base/java/org/mozilla/gecko/ZoomedView.java
index a4bd4bfab28d..c0c9307dcf78 100644
--- a/mobile/android/base/java/org/mozilla/gecko/ZoomedView.java
+++ b/mobile/android/base/java/org/mozilla/gecko/ZoomedView.java
@@ -240,7 +240,7 @@ public class ZoomedView extends FrameLayout implements LayerView.DynamicToolbarL
             }
         };
         touchListener = new ZoomedViewTouchListener();
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
                 "Gesture:clusteredLinksClicked", "Window:Resize", "Content:LocationChange",
                 "Gesture:CloseZoomedView", "Browser:ZoomToPageWidth", "Browser:ZoomToRect",
                 "FormAssist:AutoComplete", "FormAssist:Hide");
@@ -252,7 +252,7 @@ public class ZoomedView extends FrameLayout implements LayerView.DynamicToolbarL
             prefObserver = null;
         }
         ThreadUtils.removeCallbacksFromUiThread(requestRenderRunnable);
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
                 "Gesture:clusteredLinksClicked", "Window:Resize", "Content:LocationChange",
                 "Gesture:CloseZoomedView", "Browser:ZoomToPageWidth", "Browser:ZoomToRect",
                 "FormAssist:AutoComplete", "FormAssist:Hide");
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/BrowserSearch.java b/mobile/android/base/java/org/mozilla/gecko/home/BrowserSearch.java
index 1b731992edc1..0eada49cb36c 100644
--- a/mobile/android/base/java/org/mozilla/gecko/home/BrowserSearch.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/BrowserSearch.java
@@ -21,6 +21,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoSharedPrefs;
 import org.mozilla.gecko.PrefsHelper;
@@ -308,7 +309,7 @@ public class BrowserSearch extends HomeFragment
     public void onDestroyView() {
         super.onDestroyView();
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "SearchEngines:Data");
 
         mSearchEngineBar.setAdapter(null);
@@ -408,7 +409,7 @@ public class BrowserSearch extends HomeFragment
         });
 
         registerForContextMenu(mList);
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "SearchEngines:Data");
 
         mSearchEngineBar.setOnSearchBarClickListener(this);
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/CombinedHistoryPanel.java b/mobile/android/base/java/org/mozilla/gecko/home/CombinedHistoryPanel.java
index 4f5a6feadac3..955f5e767054 100644
--- a/mobile/android/base/java/org/mozilla/gecko/home/CombinedHistoryPanel.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/CombinedHistoryPanel.java
@@ -38,6 +38,7 @@ import android.widget.TextView;
 import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.R;
@@ -532,6 +533,7 @@ public class CombinedHistoryPanel extends HomeFragment implements RemoteClientsD
                 try {
                     final JSONObject json = new JSONObject();
                     json.put("type", "Menu:Open");
+                    GeckoApp.getEventDispatcher().dispatchEvent(json, null);
                     EventDispatcher.getInstance().dispatchEvent(json, null);
                 } catch (JSONException e) {
                     Log.e(LOGTAG, "Error forming JSON for Private Browsing contextual hint", e);
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/HomeBanner.java b/mobile/android/base/java/org/mozilla/gecko/home/HomeBanner.java
index eef36d0800bb..50cabd92411d 100644
--- a/mobile/android/base/java/org/mozilla/gecko/home/HomeBanner.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/HomeBanner.java
@@ -8,6 +8,7 @@ package org.mozilla.gecko.home;
 import org.json.JSONObject;
 import org.mozilla.gecko.AppConstants.Versions;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
@@ -114,14 +115,14 @@ public class HomeBanner extends LinearLayout
             }
         });
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "HomeBanner:Data");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "HomeBanner:Data");
     }
 
     @Override
     public void onDetachedFromWindow() {
         super.onDetachedFromWindow();
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "HomeBanner:Data");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "HomeBanner:Data");
     }
 
     public void setScrollingPages(boolean scrollingPages) {
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/HomePanelsManager.java b/mobile/android/base/java/org/mozilla/gecko/home/HomePanelsManager.java
index a1b3b4dcd89c..bfd6c5624ad0 100644
--- a/mobile/android/base/java/org/mozilla/gecko/home/HomePanelsManager.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/HomePanelsManager.java
@@ -73,6 +73,7 @@ public class HomePanelsManager implements GeckoEventListener {
 
     private Context mContext;
     private HomeConfig mHomeConfig;
+    private boolean mInitialized;
 
     private final Queue<ConfigChange> mPendingChanges = new ConcurrentLinkedQueue<ConfigChange>();
     private final Runnable mInvalidationRunnable = new InvalidationRunnable();
@@ -82,6 +83,10 @@ public class HomePanelsManager implements GeckoEventListener {
     }
 
     public void init(Context context) {
+        if (mInitialized) {
+            return;
+        }
+
         mContext = context;
         mHomeConfig = HomeConfig.getDefault(context);
 
@@ -90,6 +95,8 @@ public class HomePanelsManager implements GeckoEventListener {
             EVENT_HOMEPANELS_UNINSTALL,
             EVENT_HOMEPANELS_UPDATE,
             EVENT_HOMEPANELS_REFRESH);
+
+        mInitialized = true;
     }
 
     public void onLocaleReady(final String locale) {
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/PanelInfoManager.java b/mobile/android/base/java/org/mozilla/gecko/home/PanelInfoManager.java
index cc208193daf6..089e178376a4 100644
--- a/mobile/android/base/java/org/mozilla/gecko/home/PanelInfoManager.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/PanelInfoManager.java
@@ -14,6 +14,7 @@ import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.home.HomeConfig.PanelConfig;
 import org.mozilla.gecko.util.GeckoEventListener;
@@ -77,7 +78,7 @@ public class PanelInfoManager implements GeckoEventListener {
         synchronized (sCallbacks) {
             // If there are no pending callbacks, register the event listener.
             if (sCallbacks.size() == 0) {
-                EventDispatcher.getInstance().registerGeckoThreadListener(this,
+                GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
                     "HomePanels:Data");
             }
             sCallbacks.put(requestId, callback);
@@ -136,7 +137,7 @@ public class PanelInfoManager implements GeckoEventListener {
 
                 // Unregister the event listener if there are no more pending callbacks.
                 if (sCallbacks.size() == 0) {
-                    EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+                    GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
                         "HomePanels:Data");
                 }
             }
diff --git a/mobile/android/base/java/org/mozilla/gecko/home/RecentTabsAdapter.java b/mobile/android/base/java/org/mozilla/gecko/home/RecentTabsAdapter.java
index b3cae7cc2248..1ba17850e49e 100755
--- a/mobile/android/base/java/org/mozilla/gecko/home/RecentTabsAdapter.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/RecentTabsAdapter.java
@@ -18,6 +18,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.AboutPages;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.R;
@@ -80,22 +81,22 @@ public class RecentTabsAdapter extends RecyclerView.Adapter<CombinedHistoryItem>
     }
 
     public void startListeningForClosedTabs() {
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "ClosedTabs:Data");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "ClosedTabs:Data");
         GeckoAppShell.notifyObservers("ClosedTabs:StartNotifications", null);
     }
 
     public void stopListeningForClosedTabs() {
         GeckoAppShell.notifyObservers("ClosedTabs:StopNotifications", null);
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "ClosedTabs:Data");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "ClosedTabs:Data");
         recentlyClosedTabsReceived = false;
     }
 
     public void startListeningForHistorySanitize() {
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Sanitize:Finished");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "Sanitize:Finished");
     }
 
     public void stopListeningForHistorySanitize() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Sanitize:Finished");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "Sanitize:Finished");
     }
 
     @Override
diff --git a/mobile/android/base/java/org/mozilla/gecko/notifications/NotificationHelper.java b/mobile/android/base/java/org/mozilla/gecko/notifications/NotificationHelper.java
index 19b62395b580..729a99e8dd9d 100644
--- a/mobile/android/base/java/org/mozilla/gecko/notifications/NotificationHelper.java
+++ b/mobile/android/base/java/org/mozilla/gecko/notifications/NotificationHelper.java
@@ -82,6 +82,10 @@ public final class NotificationHelper implements GeckoEventListener {
     }
 
     public void init() {
+        if (mInitialized) {
+            return;
+        }
+
         mClearableNotifications = new HashMap<String, String>();
         EventDispatcher.getInstance().registerGeckoThreadListener(this,
             "Notification:Show",
diff --git a/mobile/android/base/java/org/mozilla/gecko/preferences/GeckoPreferences.java b/mobile/android/base/java/org/mozilla/gecko/preferences/GeckoPreferences.java
index 92694a6a20bf..b59cc1f97dd8 100644
--- a/mobile/android/base/java/org/mozilla/gecko/preferences/GeckoPreferences.java
+++ b/mobile/android/base/java/org/mozilla/gecko/preferences/GeckoPreferences.java
@@ -16,6 +16,7 @@ import org.mozilla.gecko.DataReportingNotification;
 import org.mozilla.gecko.DynamicToolbar;
 import org.mozilla.gecko.EventDispatcher;
 import org.mozilla.gecko.GeckoActivityStatus;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoApplication;
 import org.mozilla.gecko.GeckoProfile;
@@ -370,9 +371,9 @@ OnSharedPreferenceChangeListener
         // Use setResourceToOpen to specify these extras.
         Bundle intentExtras = getIntent().getExtras();
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Sanitize:Finished");
-
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Snackbar:Show");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
+                                                                  "Sanitize:Finished",
+                                                                  "Snackbar:Show");
 
         // Add handling for long-press click.
         // This is only for Android 3.0 and below (which use the long-press-context-menu paradigm).
@@ -506,9 +507,10 @@ OnSharedPreferenceChangeListener
     @Override
     protected void onDestroy() {
         super.onDestroy();
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Sanitize:Finished");
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Snackbar:Show");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
+                                                                    "Sanitize:Finished", 
+                                                                    "Snackbar:Show");
 
         if (mPrefsRequest != null) {
             PrefsHelper.removeObserver(mPrefsRequest);
diff --git a/mobile/android/base/java/org/mozilla/gecko/preferences/SearchPreferenceCategory.java b/mobile/android/base/java/org/mozilla/gecko/preferences/SearchPreferenceCategory.java
index 08d65caa339a..47db8b9b08e7 100644
--- a/mobile/android/base/java/org/mozilla/gecko/preferences/SearchPreferenceCategory.java
+++ b/mobile/android/base/java/org/mozilla/gecko/preferences/SearchPreferenceCategory.java
@@ -14,6 +14,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.Telemetry;
 import org.mozilla.gecko.TelemetryContract;
@@ -41,7 +42,7 @@ public class SearchPreferenceCategory extends CustomListCategory implements Geck
         super.onAttachedToActivity();
 
         // Register for SearchEngines messages and request list of search engines from Gecko.
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "SearchEngines:Data");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "SearchEngines:Data");
         GeckoAppShell.notifyObservers("SearchEngines:GetVisible", null);
     }
 
@@ -49,7 +50,7 @@ public class SearchPreferenceCategory extends CustomListCategory implements Geck
     protected void onPrepareForRemoval() {
         super.onPrepareForRemoval();
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "SearchEngines:Data");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "SearchEngines:Data");
     }
 
     @Override
diff --git a/mobile/android/base/java/org/mozilla/gecko/prompts/PromptService.java b/mobile/android/base/java/org/mozilla/gecko/prompts/PromptService.java
index 29cd6d018fc8..8155cc1c64a8 100644
--- a/mobile/android/base/java/org/mozilla/gecko/prompts/PromptService.java
+++ b/mobile/android/base/java/org/mozilla/gecko/prompts/PromptService.java
@@ -8,6 +8,7 @@ package org.mozilla.gecko.prompts;
 import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.util.GeckoEventListener;
 import org.mozilla.gecko.util.ThreadUtils;
@@ -21,14 +22,14 @@ public class PromptService implements GeckoEventListener {
     private final Context mContext;
 
     public PromptService(Context context) {
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "Prompt:Show",
             "Prompt:ShowTop");
         mContext = context;
     }
 
     public void destroy() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "Prompt:Show",
             "Prompt:ShowTop");
     }
diff --git a/mobile/android/base/java/org/mozilla/gecko/push/PushService.java b/mobile/android/base/java/org/mozilla/gecko/push/PushService.java
index 8d3a92e480ed..b10e0fb594e8 100644
--- a/mobile/android/base/java/org/mozilla/gecko/push/PushService.java
+++ b/mobile/android/base/java/org/mozilla/gecko/push/PushService.java
@@ -14,6 +14,7 @@ import android.util.Log;
 import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.GeckoService;
@@ -245,12 +246,12 @@ public class PushService implements BundleEventListener {
 
     protected void registerGeckoEventListener() {
         Log.d(LOG_TAG, "Registered Gecko event listener.");
-        EventDispatcher.getInstance().registerBackgroundThreadListener(this, GECKO_EVENTS);
+        GeckoApp.getEventDispatcher().registerBackgroundThreadListener(this, GECKO_EVENTS);
     }
 
     protected void unregisterGeckoEventListener() {
         Log.d(LOG_TAG, "Unregistered Gecko event listener.");
-        EventDispatcher.getInstance().unregisterBackgroundThreadListener(this, GECKO_EVENTS);
+        GeckoApp.getEventDispatcher().unregisterBackgroundThreadListener(this, GECKO_EVENTS);
     }
 
     @Override
diff --git a/mobile/android/base/java/org/mozilla/gecko/reader/ReadingListHelper.java b/mobile/android/base/java/org/mozilla/gecko/reader/ReadingListHelper.java
index ac7bd416a82a..e01ff79aca33 100644
--- a/mobile/android/base/java/org/mozilla/gecko/reader/ReadingListHelper.java
+++ b/mobile/android/base/java/org/mozilla/gecko/reader/ReadingListHelper.java
@@ -9,6 +9,7 @@ import org.json.JSONObject;
 
 import org.mozilla.gecko.AboutPages;
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.db.BrowserDB;
@@ -35,12 +36,12 @@ public final class ReadingListHelper implements NativeEventListener {
         this.context = context;
         this.db = BrowserDB.from(profile);
 
-        EventDispatcher.getInstance().registerGeckoThreadListener((NativeEventListener) this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener((NativeEventListener) this,
             "Reader:FaviconRequest", "Reader:AddedToCache");
     }
 
     public void uninit() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener((NativeEventListener) this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener((NativeEventListener) this,
             "Reader:FaviconRequest", "Reader:AddedToCache");
     }
 
diff --git a/mobile/android/base/java/org/mozilla/gecko/text/FloatingToolbarTextSelection.java b/mobile/android/base/java/org/mozilla/gecko/text/FloatingToolbarTextSelection.java
index e1bce840fc98..4c85d896fdd5 100644
--- a/mobile/android/base/java/org/mozilla/gecko/text/FloatingToolbarTextSelection.java
+++ b/mobile/android/base/java/org/mozilla/gecko/text/FloatingToolbarTextSelection.java
@@ -16,6 +16,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.Telemetry;
 import org.mozilla.gecko.TelemetryContract;
@@ -94,7 +95,7 @@ public class FloatingToolbarTextSelection implements TextSelection, GeckoEventLi
     }
 
     private void registerForEvents() {
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
                 "TextSelection:ActionbarInit",
                 "TextSelection:ActionbarStatus",
                 "TextSelection:ActionbarUninit",
@@ -103,7 +104,7 @@ public class FloatingToolbarTextSelection implements TextSelection, GeckoEventLi
     }
 
     private void unregisterFromEvents() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
                 "TextSelection:ActionbarInit",
                 "TextSelection:ActionbarStatus",
                 "TextSelection:ActionbarUninit",
diff --git a/mobile/android/base/java/org/mozilla/gecko/toolbar/PageActionLayout.java b/mobile/android/base/java/org/mozilla/gecko/toolbar/PageActionLayout.java
index 8ec9e4809c2b..c4aae0bfb6b9 100644
--- a/mobile/android/base/java/org/mozilla/gecko/toolbar/PageActionLayout.java
+++ b/mobile/android/base/java/org/mozilla/gecko/toolbar/PageActionLayout.java
@@ -6,6 +6,7 @@
 package org.mozilla.gecko.toolbar;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.gfx.BitmapUtils;
@@ -61,14 +62,14 @@ public class PageActionLayout extends LinearLayout implements NativeEventListene
     protected void onAttachedToWindow() {
         super.onAttachedToWindow();
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
             "PageActions:Add",
             "PageActions:Remove");
     }
 
     @Override
     protected void onDetachedFromWindow() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
             "PageActions:Add",
             "PageActions:Remove");
 
diff --git a/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java b/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java
index 221116547e08..26f6d91233f0 100644
--- a/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java
+++ b/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java
@@ -20,6 +20,7 @@ import org.mozilla.gecko.AboutPages;
 import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.EventDispatcher;
 import org.mozilla.gecko.R;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.SiteIdentity;
 import org.mozilla.gecko.SiteIdentity.SecurityMode;
@@ -96,8 +97,10 @@ public class SiteIdentityPopup extends AnchoredPopup implements GeckoEventListen
         mResources = mContext.getResources();
 
         mContentButtonClickListener = new ContentNotificationButtonListener();
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Doorhanger:Logins");
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Permissions:CheckResult");
+
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this,
+                                                                  "Doorhanger:Logins",
+                                                                  "Permissions:CheckResult");
     }
 
     @Override
@@ -546,8 +549,9 @@ public class SiteIdentityPopup extends AnchoredPopup implements GeckoEventListen
     }
 
     void destroy() {
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Doorhanger:Logins");
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Permissions:CheckResult");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this,
+                                                                    "Doorhanger:Logins",
+                                                                    "Permissions:CheckResult");
     }
 
     @Override
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/BaseGeckoInterface.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/BaseGeckoInterface.java
index 9adfbdc1873a..f7e4edc78f30 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/BaseGeckoInterface.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/BaseGeckoInterface.java
@@ -26,9 +26,16 @@ public class BaseGeckoInterface implements GeckoAppShell.GeckoInterface {
 
     private final Context mContext;
     private GeckoProfile mProfile;
+    private final EventDispatcher eventDispatcher;
 
     public BaseGeckoInterface(Context context) {
         mContext = context;
+        eventDispatcher = new EventDispatcher();
+    }
+
+    @Override
+    public EventDispatcher getAppEventDispatcher() {
+        return eventDispatcher;
     }
 
     @Override
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/EventDispatcher.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/EventDispatcher.java
index 40ab5cfed481..61a72f83880a 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/EventDispatcher.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/EventDispatcher.java
@@ -32,7 +32,7 @@ import java.util.concurrent.CopyOnWriteArrayList;
 @RobocopTarget
 public final class EventDispatcher {
     private static final String LOGTAG = "GeckoEventDispatcher";
-    private static final String GUID = "__guid__";
+    /* package */ static final String GUID = "__guid__";
     private static final String STATUS_ERROR = "error";
     private static final String STATUS_SUCCESS = "success";
 
@@ -63,7 +63,7 @@ public final class EventDispatcher {
         return INSTANCE;
     }
 
-    private EventDispatcher() {
+    public EventDispatcher() {
     }
 
     private <T> void registerListener(final Class<?> listType,
@@ -191,18 +191,31 @@ public final class EventDispatcher {
         unregisterListener(mBackgroundThreadListeners, listener, events);
     }
 
-    public void dispatchEvent(final NativeJSContainer message) {
-        // First try native listeners.
-        final String type = message.optString("type", null);
-        if (type == null) {
-            Log.e(LOGTAG, "JSON message must have a type property");
-            return;
-        }
-
+    private List<NativeEventListener> getNativeListeners(final String type) {
         final List<NativeEventListener> listeners;
         synchronized (mGeckoThreadNativeListeners) {
             listeners = mGeckoThreadNativeListeners.get(type);
         }
+        return listeners;
+    }
+
+    private List<GeckoEventListener> getGeckoListeners(final String type) {
+        final List<GeckoEventListener> listeners;
+        synchronized (mGeckoThreadJSONListeners) {
+            listeners = mGeckoThreadJSONListeners.get(type);
+        }
+        return listeners;
+    }
+
+    public boolean dispatchEvent(final NativeJSContainer message) {
+        // First try native listeners.
+        final String type = message.optString("type", null);
+        if (type == null) {
+            Log.e(LOGTAG, "JSON message must have a type property");
+            return true; // It may seem odd to return true here, but it's necessary to preserve the correct behavior.
+        }
+
+        final List<NativeEventListener> listeners = getNativeListeners(type);
 
         final String guid = message.optString(GUID, null);
         EventCallback callback = null;
@@ -214,11 +227,11 @@ public final class EventDispatcher {
             if (listeners.isEmpty()) {
                 Log.w(LOGTAG, "No listeners for " + type);
 
-                // There were native listeners, and they're gone.  Dispatch an error rather than
-                // looking for JSON listeners.
-                if (callback != null) {
-                    callback.sendError("No listeners for request");
-                }
+                // There were native listeners, and they're gone.  Return a failure rather than
+                // looking for JSON listeners. This is an optimization, as we can safely assume
+                // that an event which previously had native listeners will never have JSON
+                // listeners.
+                return false;
             }
             try {
                 for (final NativeEventListener listener : listeners) {
@@ -229,7 +242,7 @@ public final class EventDispatcher {
             }
             // If we found native listeners, we assume we don't have any other types of listeners
             // and return early. This assumption is checked when registering listeners.
-            return;
+            return true;
         }
 
         // Check for thread event listeners before checking for JSON event listeners,
@@ -238,17 +251,19 @@ public final class EventDispatcher {
         if (dispatchToThreads(type, message, /* bundle */ null, callback)) {
             // If we found thread listeners, we assume we don't have any other types of listeners
             // and return early. This assumption is checked when registering listeners.
-            return;
+            return true;
         }
 
         try {
             // If we didn't find native listeners, try JSON listeners.
-            dispatchEvent(new JSONObject(message.toString()), callback);
+            return dispatchEvent(new JSONObject(message.toString()), callback);
         } catch (final JSONException e) {
             Log.e(LOGTAG, "Cannot parse JSON", e);
         } catch (final UnsupportedOperationException e) {
             Log.e(LOGTAG, "Cannot convert message to JSON", e);
         }
+
+        return true;
     }
 
     /**
@@ -315,7 +330,7 @@ public final class EventDispatcher {
         }
 
         if (jsMessage == null) {
-            Log.w(LOGTAG, "No listeners for " + type);
+            Log.w(LOGTAG, "No listeners for " + type + " in dispatchToThreads");
         }
 
         if (!AppConstants.RELEASE_BUILD && jsMessage == null) {
@@ -355,14 +370,10 @@ public final class EventDispatcher {
             }
 
             if (listeners.isEmpty()) {
-                Log.w(LOGTAG, "No listeners for " + type);
+                Log.w(LOGTAG, "No listeners for " + type + " in dispatchToThread");
 
                 // There were native listeners, and they're gone.
-                // Dispatch an error rather than looking for more listeners.
-                if (callback != null) {
-                    callback.sendError("No listeners for request");
-                }
-                return true;
+                return false;
             }
 
             final Bundle messageAsBundle;
@@ -386,7 +397,7 @@ public final class EventDispatcher {
         }
     }
 
-    public void dispatchEvent(final JSONObject message, final EventCallback callback) {
+    public boolean dispatchEvent(final JSONObject message, final EventCallback callback) {
         // {
         //   "type": "value",
         //   "event_specific": "value",
@@ -394,25 +405,22 @@ public final class EventDispatcher {
         try {
             final String type = message.getString("type");
 
-            List<GeckoEventListener> listeners;
-            synchronized (mGeckoThreadJSONListeners) {
-                listeners = mGeckoThreadJSONListeners.get(type);
-            }
-            if (listeners == null || listeners.isEmpty()) {
-                Log.w(LOGTAG, "No listeners for " + type);
+            final List<GeckoEventListener> listeners = getGeckoListeners(type);
 
-                // If there are no listeners, dispatch an error.
-                if (callback != null) {
-                    callback.sendError("No listeners for request");
-                }
-                return;
+            if (listeners == null || listeners.isEmpty()) {
+                Log.w(LOGTAG, "No listeners for " + type + " in dispatchEvent");
+
+                return false;
             }
+
             for (final GeckoEventListener listener : listeners) {
                 listener.handleMessage(type, message);
             }
         } catch (final JSONException e) {
             Log.e(LOGTAG, "handleGeckoMessage throws " + e, e);
         }
+
+        return true;
     }
 
     @RobocopTarget
@@ -446,7 +454,7 @@ public final class EventDispatcher {
         }
     }
 
-    private static class GeckoEventCallback implements EventCallback {
+    /* package */ static class GeckoEventCallback implements EventCallback {
         private final String guid;
         private final String type;
         private boolean sent;
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java
index 30c6cce455fc..58651edd5da9 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java
@@ -1719,6 +1719,7 @@ public class GeckoAppShell
     }
 
     public interface GeckoInterface {
+        public EventDispatcher getAppEventDispatcher();
         public GeckoProfile getProfile();
         public Activity getActivity();
         public String getDefaultUAString();
@@ -1949,7 +1950,15 @@ public class GeckoAppShell
 
     @WrapForJNI(calledFrom = "gecko")
     private static void handleGeckoMessage(final NativeJSContainer message) {
-        EventDispatcher.getInstance().dispatchEvent(message);
+        final boolean success = EventDispatcher.getInstance().dispatchEvent(message) |
+                                getGeckoInterface().getAppEventDispatcher().dispatchEvent(message);
+        if (!success) {
+            final String type = message.optString("type", null);
+            final String guid = message.optString(EventDispatcher.GUID, null);
+            if (type != null && guid != null) {
+                (new EventDispatcher.GeckoEventCallback(guid, type)).sendError("No listeners for request");
+            }
+        }
         message.disposeNative();
     }
 
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoEditable.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoEditable.java
index c621e7a89ae9..49866802af7f 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoEditable.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoEditable.java
@@ -943,12 +943,12 @@ final class GeckoEditable extends JNIObject
             // cases, and we don't want to unregister an event that was not registered.
             mGeckoFocused = false;
             mSuppressCompositions = false;
-            EventDispatcher.getInstance().
+            GeckoAppShell.getGeckoInterface().getAppEventDispatcher().
                 unregisterGeckoThreadListener(this, "TextSelection:DraggingHandle");
         } else if (type == NOTIFY_IME_OF_FOCUS) {
             mGeckoFocused = true;
             mSuppressCompositions = false;
-            EventDispatcher.getInstance().
+            GeckoAppShell.getGeckoInterface().getAppEventDispatcher().
                 registerGeckoThreadListener(this, "TextSelection:DraggingHandle");
         }
     }
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
index 11c4ac8ef798..b1c66ad62caa 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java
@@ -518,6 +518,7 @@ public class GeckoThread extends Thread {
         try {
             final JSONObject msg = new JSONObject();
             msg.put("type", "Gecko:Exited");
+            GeckoAppShell.getGeckoInterface().getAppEventDispatcher().dispatchEvent(msg, null);
             EventDispatcher.getInstance().dispatchEvent(msg, null);
         } catch (final JSONException e) {
             Log.e(LOGTAG, "unable to dispatch event", e);
diff --git a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/FennecNativeDriver.java b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/FennecNativeDriver.java
index 02a63b4291c9..3931b7e206cf 100644
--- a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/FennecNativeDriver.java
+++ b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/FennecNativeDriver.java
@@ -248,7 +248,7 @@ public class FennecNativeDriver implements Driver {
 
     @Override
     public void setupScrollHandling() {
-        EventDispatcher.getInstance().registerGeckoThreadListener(new GeckoEventListener() {
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(new GeckoEventListener() {
             @Override
             public void handleMessage(final String event, final JSONObject message) {
                 try {
diff --git a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFilePicker.java b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFilePicker.java
index 1c338e02b321..c613eca8f330 100644
--- a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFilePicker.java
+++ b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFilePicker.java
@@ -7,6 +7,7 @@ package org.mozilla.gecko.tests;
 import static org.mozilla.gecko.tests.helpers.AssertionHelper.fFail;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.util.GeckoEventListener;
 
@@ -39,13 +40,13 @@ public class testFilePicker extends JavascriptTest implements GeckoEventListener
     public void setUp() throws Exception {
         super.setUp();
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "FilePicker:Show");
+        GeckoApp.getEventDispatcher().registerGeckoThreadListener(this, "FilePicker:Show");
     }
 
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "FilePicker:Show");
+        GeckoApp.getEventDispatcher().unregisterGeckoThreadListener(this, "FilePicker:Show");
     }
 }
diff --git a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFindInPage.java b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFindInPage.java
index 124fe4d81109..2797fdf5b3f2 100644
--- a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFindInPage.java
+++ b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testFindInPage.java
@@ -52,8 +52,8 @@ public class testFindInPage extends JavascriptTest implements GeckoEventListener
         super.setUp();
 
         EventDispatcher.getInstance().registerGeckoThreadListener(this,
-                "Test:FindInPage",
-                "Test:CloseFindInPage");
+                                                                  "Test:FindInPage",
+                                                                  "Test:CloseFindInPage");
     }
 
     @Override
@@ -61,8 +61,8 @@ public class testFindInPage extends JavascriptTest implements GeckoEventListener
         super.tearDown();
 
         EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
-                "Test:FindInPage",
-                "Test:CloseFindInPage");
+                                                                    "Test:FindInPage",
+                                                                    "Test:CloseFindInPage");
     }
 
     public void findText(String text, int nrOfMatches){
diff --git a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testTrackingProtection.java b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testTrackingProtection.java
index 866a463633ec..c27ff0094f02 100644
--- a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testTrackingProtection.java
+++ b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testTrackingProtection.java
@@ -7,6 +7,7 @@ package org.mozilla.gecko.tests;
 import static org.mozilla.gecko.tests.helpers.AssertionHelper.fFail;
 
 import org.mozilla.gecko.EventDispatcher;
+import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.util.GeckoEventListener;
 
@@ -48,15 +49,17 @@ public class testTrackingProtection extends JavascriptTest implements GeckoEvent
     public void setUp() throws Exception {
         super.setUp();
 
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Content:SecurityChange");
-        EventDispatcher.getInstance().registerGeckoThreadListener(this, "Test:Expected");
+        EventDispatcher.getInstance().registerGeckoThreadListener(this,
+                                                                  "Content:SecurityChange",
+                                                                  "Test:Expected");
     }
 
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
 
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Content:SecurityChange");
-        EventDispatcher.getInstance().unregisterGeckoThreadListener(this, "Test:Expected");
+        EventDispatcher.getInstance().unregisterGeckoThreadListener(this,
+                                                                    "Content:SecurityChange",
+                                                                    "Test:Expected");
     }
 }

From 10262ed0cb5771f9a44a24f8c3aa357fbfa23157 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 27 Sep 2016 15:58:01 -0400
Subject: [PATCH 065/102] Backed out changeset 4bdbbae12cb3 (bug 918719) for
 causing webcompat issues.

--HG--
extra : rebase_source : 58d99de7d9ee9e32383b9d18e4fb80a1bc59d0ad
---
 dom/tests/mochitest/bugs/bug918719.sjs        | 47 ----------
 dom/tests/mochitest/bugs/mochitest.ini        |  2 -
 dom/tests/mochitest/bugs/test_bug918719.html  | 89 -------------------
 dom/xhr/XMLHttpRequestMainThread.cpp          |  5 +-
 dom/xhr/XMLHttpRequestMainThread.h            |  8 --
 modules/libpref/init/all.js                   |  4 -
 .../event-readystatechange-loaded.htm.ini     |  5 ++
 7 files changed, 6 insertions(+), 154 deletions(-)
 delete mode 100644 dom/tests/mochitest/bugs/bug918719.sjs
 delete mode 100644 dom/tests/mochitest/bugs/test_bug918719.html
 create mode 100644 testing/web-platform/meta/XMLHttpRequest/event-readystatechange-loaded.htm.ini

diff --git a/dom/tests/mochitest/bugs/bug918719.sjs b/dom/tests/mochitest/bugs/bug918719.sjs
deleted file mode 100644
index 2413e4c78bc0..000000000000
--- a/dom/tests/mochitest/bugs/bug918719.sjs
+++ /dev/null
@@ -1,47 +0,0 @@
-// Keep track of one in-flight XHR by allowing secondary ones to
-// tell us when the client has received a Progress event and wants
-// more data or to stop the in-flight XHR.
-
-const STATE_NAME = "bug918719_loading_event_test";
-const CHUNK_DATA = "chunk";
-
-function setReq(req) {
-  setObjectState(STATE_NAME, req);
-}
-
-function getReq() {
-  let req;
-  getObjectState(STATE_NAME, function(v) {
-    req = v;
-  });
-  return req;
-}
-
-function handleRequest(request, response)
-{
-  var pairs = request.queryString.split("&");
-  var command = pairs.shift();
-
-  response.setHeader("Content-Type", "text/plain");
-  response.setHeader("Cache-Control", "no-cache", false);
-
-  switch(command) {
-    case "more":
-      getReq().write(CHUNK_DATA);
-      break;
-
-    case "done":
-      getReq().finish();
-      setReq(null);
-      break;
-
-    default:
-      response.processAsync();
-      response.write(CHUNK_DATA);
-      setReq(response);
-      return;
-  }
-
-  response.setHeader("Content-Length", "2", false);
-  response.write("ok");
-}
diff --git a/dom/tests/mochitest/bugs/mochitest.ini b/dom/tests/mochitest/bugs/mochitest.ini
index b0817e6c063c..dce49b928d61 100644
--- a/dom/tests/mochitest/bugs/mochitest.ini
+++ b/dom/tests/mochitest/bugs/mochitest.ini
@@ -7,7 +7,6 @@ support-files =
   bug346659-parent-echoer.html
   bug346659-parent.html
   bug458091_child.html
-  bug918719.sjs
   child_bug260264.html
   devicemotion_inner.html
   devicemotion_outer.html
@@ -156,7 +155,6 @@ skip-if = (buildapp == 'b2g' && toolkit != 'gonk') #Bug 931116, b2g desktop spec
 [test_bug857555.html]
 [test_bug862540.html]
 [test_bug876098.html]
-[test_bug918719.html]
 [test_bug927901.html]
 [test_devicemotion_multiple_listeners.html]
 skip-if = toolkit == 'android' #bug 775227
diff --git a/dom/tests/mochitest/bugs/test_bug918719.html b/dom/tests/mochitest/bugs/test_bug918719.html
deleted file mode 100644
index ef0b1388cca6..000000000000
--- a/dom/tests/mochitest/bugs/test_bug918719.html
+++ /dev/null
@@ -1,89 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=918719
--->
-<head>
-  <title>Test for Bug 918719</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=918719">Mozilla Bug 918719</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-<script class="testbody" type="text/javascript">
-
-SimpleTest.waitForExplicitFinish();
-
-const SERVER_URL = "bug918719.sjs";
-
-function sendCommand(cmd) {
-  let xhr = new XMLHttpRequest();
-  xhr.open("get", SERVER_URL + "?" + cmd);
-  xhr.send();
-}
-
-function runTest() {
-  // Manipulate one in-flight XHR using secondary command XHRs, to guarantee
-  // that multiple OnDataAvailable events are triggered (which are where
-  // LOADING readystatechanges are triggered). We return a promise that will
-  // resolve with a count of the number of LOADING events that were detected.
-
-  return new Promise((resolve, reject) => {
-    let xhr = new XMLHttpRequest();
-    let numProgressEvents = 0;
-    let numLoadingEvents = 0;
-
-    xhr.onreadystatechange = e => {
-      if (xhr.readyState === xhr.LOADING) {
-        ++numLoadingEvents;
-      }
-    };
-
-    xhr.onprogress = e => {
-      if (++numProgressEvents < 2) {
-        sendCommand("more");
-      } else {
-        sendCommand("done");
-      }
-    };
-
-    xhr.onerror = e => {
-      reject(e);
-    };
-
-    xhr.onloadend = e => {
-      resolve(numLoadingEvents);
-    };
-
-    xhr.open("GET", SERVER_URL);
-    xhr.send();
-  });
-}
-
-function prefChangePromise(args) {
-  return new Promise(function(resolve) {
-    SpecialPowers.pushPrefEnv(args, resolve);
-  });
-}
-
-runTest().then(function(count) {
-  ok(count === 1, "Only one loading readystatechange event should have been fired with the pref off.");
-}).then(function() {
-  return prefChangePromise({"set": [["dom.fire_extra_xhr_loading_readystatechanges", true]]});
-}).then(function() {
-  return runTest();
-}).then(function(count) {
-  ok(count > 1, "Multiple loading readystatechange events should have been fired with the pref on.");
-  SimpleTest.finish();
-});
-
-</script>
-</pre>
-</body>
-</html>
-
diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 24e98c91e432..496ee55c0937 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -169,7 +169,6 @@ XMLHttpRequestMainThread::XMLHttpRequestMainThread()
     mFlagSyncLooping(false), mFlagBackgroundRequest(false),
     mFlagHadUploadListenersOnSend(false), mFlagACwithCredentials(false),
     mFlagTimedOut(false), mFlagDeleted(false), mFlagSend(false),
-    mSendExtraLoadingEvents(Preferences::GetBool("dom.fire_extra_xhr_loading_readystatechanges", true)),
     mUploadTransferred(0), mUploadTotal(0), mUploadComplete(true),
     mProgressSinceLastProgressEvent(false),
     mRequestSentTime(0), mTimeoutMilliseconds(0),
@@ -1715,9 +1714,7 @@ XMLHttpRequestMainThread::OnDataAvailable(nsIRequest *request,
 
   mDataAvailable += totalRead;
 
-  if (mState == State::headers_received || mSendExtraLoadingEvents) {
-    ChangeState(State::loading);
-  }
+  ChangeState(State::loading);
 
   if (!mFlagSynchronous && !mProgressTimerIsActive) {
     StartProgressEventTimer();
diff --git a/dom/xhr/XMLHttpRequestMainThread.h b/dom/xhr/XMLHttpRequestMainThread.h
index 5bc686b26cf2..9fa711f66ff6 100644
--- a/dom/xhr/XMLHttpRequestMainThread.h
+++ b/dom/xhr/XMLHttpRequestMainThread.h
@@ -686,14 +686,6 @@ protected:
   // late, and ensure the XHR only handles one in-flight request at once.
   bool mFlagSend;
 
-  // Before ProgressEvents were a thing, multiple readystatechange events were
-  // fired during the loading state to give sites a way to monitor XHR progress.
-  // The XHR spec now has proper progress events and dictates that only one
-  // "loading" readystatechange should be fired per send. However, it's possible
-  // that some content still relies on this old behavior, so we're keeping it
-  // (behind a preference) for now. See bug 918719.
-  bool mSendExtraLoadingEvents;
-
   RefPtr<XMLHttpRequestUpload> mUpload;
   int64_t mUploadTransferred;
   int64_t mUploadTotal;
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index cede4fa506b4..8591809abf18 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -5088,10 +5088,6 @@ pref("dom.voicemail.defaultServiceId", 0);
 // Enable mapped array buffer by default.
 pref("dom.mapped_arraybuffer.enabled", true);
 
-// Whether to send more than one "loading" readystatechange during XHRs to
-// simulate progress events for sites still not using modern progress events.
-pref("dom.fire_extra_xhr_loading_readystatechanges", false);
-
 // The tables used for Safebrowsing phishing and malware checks.
 pref("urlclassifier.malwareTable", "goog-malware-shavar,goog-unwanted-shavar,test-malware-simple,test-unwanted-simple");
 
diff --git a/testing/web-platform/meta/XMLHttpRequest/event-readystatechange-loaded.htm.ini b/testing/web-platform/meta/XMLHttpRequest/event-readystatechange-loaded.htm.ini
new file mode 100644
index 000000000000..5cf0e5fade89
--- /dev/null
+++ b/testing/web-platform/meta/XMLHttpRequest/event-readystatechange-loaded.htm.ini
@@ -0,0 +1,5 @@
+[event-readystatechange-loaded.htm]
+  type: testharness
+  [XMLHttpRequest: the LOADING state change should only happen once]
+    expected: FAIL
+

From 865f4251ec2fa0a4a2cda4a3972e87b5330cb585 Mon Sep 17 00:00:00 2001
From: George Wright <george@mozilla.com>
Date: Tue, 27 Sep 2016 16:10:02 -0400
Subject: [PATCH 066/102] Bug 1304360 - Add Windows 7 w/Intel drivers less than
 or equal to build ID 1749 to the blocklist for D3D9 layers r=milan

---
 widget/windows/GfxInfo.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/widget/windows/GfxInfo.cpp b/widget/windows/GfxInfo.cpp
index d62b1b18a6ee..0041d364c942 100644
--- a/widget/windows/GfxInfo.cpp
+++ b/widget/windows/GfxInfo.cpp
@@ -1195,6 +1195,12 @@ GfxInfo::GetGfxDriverInfo()
       nsIGfxInfo::FEATURE_DIRECT3D_11_ANGLE, nsIGfxInfo::FEATURE_BLOCKED_DEVICE,
       DRIVER_LESS_THAN, GfxDriverInfo::allDriverVersions, "FEATURE_FAILURE_BUG_1153381");
 
+    /* Bug 1304360: Graphical artifacts with D3D9 on Windows 7. */
+    APPEND_TO_DRIVER_BLOCKLIST2(OperatingSystem::Windows7,
+      (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorIntel), (GfxDeviceFamily*)GfxDriverInfo::GetDeviceFamily(IntelGMAX3000),
+      nsIGfxInfo::FEATURE_DIRECT3D_9_LAYERS, nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION,
+      DRIVER_BUILD_ID_LESS_THAN_OR_EQUAL, 1749, "FEATURE_FAILURE_INTEL_W7_D3D9_LAYERS");
+
     ////////////////////////////////////
     // WebGL
 

From ea061497c38d6a588c1c69dd5683f23d0b869b70 Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@mozilla.com>
Date: Tue, 27 Sep 2016 13:15:55 -0700
Subject: [PATCH 067/102] Fix vsync sometimes not firing after the GPU process
 crashes. (bug 1305628, r=mattwoodrow)

---
 gfx/ipc/RemoteCompositorSession.cpp             |  1 +
 widget/nsBaseWidget.cpp                         | 16 +++++++++-------
 widget/windows/InProcessWinCompositorWidget.cpp |  5 +++--
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/gfx/ipc/RemoteCompositorSession.cpp b/gfx/ipc/RemoteCompositorSession.cpp
index 0ccabaaa7ed8..8ebcc88e6f84 100644
--- a/gfx/ipc/RemoteCompositorSession.cpp
+++ b/gfx/ipc/RemoteCompositorSession.cpp
@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "RemoteCompositorSession.h"
+#include "mozilla/VsyncDispatcher.h"
 #include "mozilla/layers/APZChild.h"
 #include "mozilla/layers/APZCTreeManagerChild.h"
 #include "nsBaseWidget.h"
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 129cd91af61a..c5b5538cfa99 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -260,6 +260,15 @@ nsBaseWidget::Shutdown()
 
 void nsBaseWidget::DestroyCompositor()
 {
+  // We release this before releasing the compositor, since it may hold the
+  // last reference to our ClientLayerManager. ClientLayerManager's dtor can
+  // trigger a paint, creating a new compositor, and we don't want to re-use
+  // the old vsync dispatcher.
+  if (mCompositorVsyncDispatcher) {
+    mCompositorVsyncDispatcher->Shutdown();
+    mCompositorVsyncDispatcher = nullptr;
+  }
+
   // The compositor shutdown sequence looks like this:
   //  1. CompositorSession calls CompositorBridgeChild::Destroy.
   //  2. CompositorBridgeChild synchronously sends WillClose.
@@ -284,13 +293,6 @@ void nsBaseWidget::DestroyCompositor()
     RefPtr<CompositorSession> session = mCompositorSession.forget();
     session->Shutdown();
   }
-
-  // Can have base widgets that are things like tooltips
-  // which don't have CompositorVsyncDispatchers
-  if (mCompositorVsyncDispatcher) {
-    mCompositorVsyncDispatcher->Shutdown();
-    mCompositorVsyncDispatcher = nullptr;
-  }
 }
 
 void nsBaseWidget::ReleaseContentController()
diff --git a/widget/windows/InProcessWinCompositorWidget.cpp b/widget/windows/InProcessWinCompositorWidget.cpp
index f88c94ac161d..685eaf5ca62c 100644
--- a/widget/windows/InProcessWinCompositorWidget.cpp
+++ b/widget/windows/InProcessWinCompositorWidget.cpp
@@ -32,8 +32,9 @@ InProcessWinCompositorWidget::RealWidget()
 void
 InProcessWinCompositorWidget::ObserveVsync(VsyncObserver* aObserver)
 {
-  RefPtr<CompositorVsyncDispatcher> cvd = mWindow->GetCompositorVsyncDispatcher();
-  cvd->SetCompositorVsyncObserver(aObserver);
+  if (RefPtr<CompositorVsyncDispatcher> cvd = mWindow->GetCompositorVsyncDispatcher()) {
+    cvd->SetCompositorVsyncObserver(aObserver);
+  }
 }
 
 } // namespace widget

From 9d11cb086818023760d0459c403c0f9de6f3d076 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Mon, 26 Sep 2016 10:19:07 -0700
Subject: [PATCH 068/102] Bug 1301301, part 3 - Implement Begin and
 EndCycleCollectionCallback in CCJSContext. r=smaug

This will let my later patch run code at the start and end of each CC.

This patch should not change any behavior.

MozReview-Commit-ID: Fu6v3wo8qKB
---
 dom/workers/RuntimeService.cpp         | 10 ----------
 js/xpconnect/src/XPCJSContext.cpp      |  2 ++
 xpcom/base/CycleCollectedJSContext.cpp | 10 ++++++++++
 xpcom/base/CycleCollectedJSContext.h   |  4 ++--
 4 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index cd7c0d18d7c1..f14177acab0f 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -1099,16 +1099,6 @@ public:
   {
   }
 
-  virtual void
-  BeginCycleCollectionCallback() override
-  {
-  }
-
-  virtual void
-  EndCycleCollectionCallback(CycleCollectorResults &aResults) override
-  {
-  }
-
   void
   DispatchDeferredDeletion(bool aContinuation, bool aPurge) override
   {
diff --git a/js/xpconnect/src/XPCJSContext.cpp b/js/xpconnect/src/XPCJSContext.cpp
index 909e54b8e028..1fbe657387b8 100644
--- a/js/xpconnect/src/XPCJSContext.cpp
+++ b/js/xpconnect/src/XPCJSContext.cpp
@@ -665,6 +665,7 @@ XPCJSContext::PrepareForForgetSkippable()
 void
 XPCJSContext::BeginCycleCollectionCallback()
 {
+    CycleCollectedJSContext::BeginCycleCollectionCallback();
     nsJSContext::BeginCycleCollectionCallback();
 
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
@@ -676,6 +677,7 @@ XPCJSContext::BeginCycleCollectionCallback()
 void
 XPCJSContext::EndCycleCollectionCallback(CycleCollectorResults& aResults)
 {
+    CycleCollectedJSContext::EndCycleCollectionCallback(aResults);
     nsJSContext::EndCycleCollectionCallback(aResults);
 
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
diff --git a/xpcom/base/CycleCollectedJSContext.cpp b/xpcom/base/CycleCollectedJSContext.cpp
index 93b0dc3d839f..b0b4347685b6 100644
--- a/xpcom/base/CycleCollectedJSContext.cpp
+++ b/xpcom/base/CycleCollectedJSContext.cpp
@@ -1330,6 +1330,16 @@ CycleCollectedJSContext::DumpJSHeap(FILE* aFile)
   js::DumpHeap(Context(), aFile, js::CollectNurseryBeforeDump);
 }
 
+void
+CycleCollectedJSContext::BeginCycleCollectionCallback()
+{
+}
+
+void
+CycleCollectedJSContext::EndCycleCollectionCallback(CycleCollectorResults& aResults)
+{
+}
+
 void
 CycleCollectedJSContext::ProcessStableStateQueue()
 {
diff --git a/xpcom/base/CycleCollectedJSContext.h b/xpcom/base/CycleCollectedJSContext.h
index 9415634b8951..130734b44969 100644
--- a/xpcom/base/CycleCollectedJSContext.h
+++ b/xpcom/base/CycleCollectedJSContext.h
@@ -321,8 +321,8 @@ public:
   void DumpJSHeap(FILE* aFile);
 
   virtual void PrepareForForgetSkippable() = 0;
-  virtual void BeginCycleCollectionCallback() = 0;
-  virtual void EndCycleCollectionCallback(CycleCollectorResults& aResults) = 0;
+  virtual void BeginCycleCollectionCallback();
+  virtual void EndCycleCollectionCallback(CycleCollectorResults& aResults);
   virtual void DispatchDeferredDeletion(bool aContinuation, bool aPurge = false) = 0;
 
   JSContext* Context() const

From 5a97b708ad5e385909e3649e697d4308258967bc Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Mon, 26 Sep 2016 10:19:07 -0700
Subject: [PATCH 069/102] Bug 1301301, part 4 - Make calls to JS::TraceChildren
 go through a single method on CCJSContext. r=smaug

In this patch I add a new tracer base class, CCJSTracer, and make all
of the code in CycleCollectedJSContext that used to do
JS::TraceChildren depend on it. This will let me record the number of
calls to JS::TraceChildren in one place, in a later patch.

This should not change any behavior.

MozReview-Commit-ID: LdDu5rnpvX0
---
 xpcom/base/CycleCollectedJSContext.cpp | 62 ++++++++++++++++++--------
 xpcom/base/CycleCollectedJSContext.h   |  4 +-
 2 files changed, 47 insertions(+), 19 deletions(-)

diff --git a/xpcom/base/CycleCollectedJSContext.cpp b/xpcom/base/CycleCollectedJSContext.cpp
index b0b4347685b6..fe77801cb286 100644
--- a/xpcom/base/CycleCollectedJSContext.cpp
+++ b/xpcom/base/CycleCollectedJSContext.cpp
@@ -127,11 +127,29 @@ public:
 
 } // namespace mozilla
 
-struct NoteWeakMapChildrenTracer : public JS::CallbackTracer
+struct CCJSTracer : public JS::CallbackTracer
 {
-  NoteWeakMapChildrenTracer(JSContext* aCx,
+protected:
+  CCJSTracer(CycleCollectedJSContext* aCx,
+             WeakMapTraceKind aWeakTraceKind = TraceWeakMapValues)
+    : JS::CallbackTracer(aCx->Context(), aWeakTraceKind)
+    , mCx(aCx)
+  {}
+
+public:
+  void TraceChildren(JS::GCCellPtr aThing)
+  {
+    mCx->TraceJSChildren(this, aThing);
+  }
+
+  CycleCollectedJSContext* mCx;
+};
+
+struct NoteWeakMapChildrenTracer : public CCJSTracer
+{
+  NoteWeakMapChildrenTracer(CycleCollectedJSContext* aCx,
                             nsCycleCollectionNoteRootCallback& aCb)
-    : JS::CallbackTracer(aCx), mCb(aCb), mTracedAny(false), mMap(nullptr),
+    : CCJSTracer(aCx), mCb(aCb), mTracedAny(false), mMap(nullptr),
       mKey(nullptr), mKeyDelegate(nullptr)
   {
   }
@@ -158,14 +176,15 @@ NoteWeakMapChildrenTracer::onChild(const JS::GCCellPtr& aThing)
     mCb.NoteWeakMapping(mMap, mKey, mKeyDelegate, aThing);
     mTracedAny = true;
   } else {
-    JS::TraceChildren(this, aThing);
+    TraceChildren(aThing);
   }
 }
 
 struct NoteWeakMapsTracer : public js::WeakMapTracer
 {
-  NoteWeakMapsTracer(JSContext* aCx, nsCycleCollectionNoteRootCallback& aCccb)
-    : js::WeakMapTracer(aCx), mCb(aCccb), mChildTracer(aCx, aCccb)
+  NoteWeakMapsTracer(CycleCollectedJSContext* aCx,
+                     nsCycleCollectionNoteRootCallback& aCccb)
+    : js::WeakMapTracer(aCx->Context()), mCb(aCccb), mChildTracer(aCx, aCccb)
   {
   }
   void trace(JSObject* aMap, JS::GCCellPtr aKey, JS::GCCellPtr aValue) override;
@@ -213,7 +232,7 @@ NoteWeakMapsTracer::trace(JSObject* aMap, JS::GCCellPtr aKey,
     mChildTracer.mKeyDelegate = kdelegate;
 
     if (!aValue.is<JSString>()) {
-      JS::TraceChildren(&mChildTracer, aValue);
+      mChildTracer.TraceChildren(aValue);
     }
 
     // The delegate could hold alive the key, so report something to the CC
@@ -324,12 +343,13 @@ JSZoneParticipant::Traverse(void* aPtr, nsCycleCollectionTraversalCallback& aCb)
   return NS_OK;
 }
 
-struct TraversalTracer : public JS::CallbackTracer
+struct TraversalTracer : public CCJSTracer
 {
-  TraversalTracer(JSContext* aCx, nsCycleCollectionTraversalCallback& aCb)
-    : JS::CallbackTracer(aCx, DoNotTraceWeakMaps), mCb(aCb)
-  {
-  }
+  TraversalTracer(CycleCollectedJSContext* aCx,
+                  nsCycleCollectionTraversalCallback& aCb)
+    : CCJSTracer(aCx, DoNotTraceWeakMaps)
+    , mCb(aCb)
+  {}
   void onChild(const JS::GCCellPtr& aThing) override;
   nsCycleCollectionTraversalCallback& mCb;
 };
@@ -366,7 +386,7 @@ TraversalTracer::onChild(const JS::GCCellPtr& aThing)
     // be traced.
     JS_TraceObjectGroupCycleCollectorChildren(this, aThing);
   } else if (!aThing.is<JSString>()) {
-    JS::TraceChildren(this, aThing);
+    TraceChildren(aThing);
   }
 }
 
@@ -630,11 +650,11 @@ CycleCollectedJSContext::DescribeGCThing(bool aIsMarked, JS::GCCellPtr aThing,
 
 void
 CycleCollectedJSContext::NoteGCThingJSChildren(JS::GCCellPtr aThing,
-                                               nsCycleCollectionTraversalCallback& aCb) const
+                                               nsCycleCollectionTraversalCallback& aCb)
 {
   MOZ_ASSERT(mJSContext);
-  TraversalTracer trc(mJSContext, aCb);
-  JS::TraceChildren(&trc, aThing);
+  TraversalTracer trc(this, aCb);
+  trc.TraceChildren(aThing);
 }
 
 void
@@ -733,7 +753,7 @@ CycleCollectedJSContext::TraverseZone(JS::Zone* aZone,
    * iterate over. Edges between compartments in the same zone will add
    * unnecessary loop edges to the graph (bug 842137).
    */
-  TraversalTracer trc(mJSContext, aCb);
+  TraversalTracer trc(this, aCb);
   js::VisitGrayWrapperTargets(aZone, NoteJSChildGrayWrapperShim, &trc);
 
   /*
@@ -1212,7 +1232,7 @@ CycleCollectedJSContext::TraverseRoots(nsCycleCollectionNoteRootCallback& aCb)
 
   TraverseNativeRoots(aCb);
 
-  NoteWeakMapsTracer trc(mJSContext, aCb);
+  NoteWeakMapsTracer trc(this, aCb);
   js::TraceWeakMaps(&trc);
 
   return NS_OK;
@@ -1679,6 +1699,12 @@ CycleCollectedJSContext::OnLargeAllocationFailure()
   AnnotateAndSetOutOfMemory(&mLargeAllocationFailureState, OOMState::Reported);
 }
 
+void
+CycleCollectedJSContext::TraceJSChildren(JSTracer* aTrc, JS::GCCellPtr aThing)
+{
+  JS::TraceChildren(aTrc, aThing);
+}
+
 void
 CycleCollectedJSContext::PrepareWaitingZonesForGC()
 {
diff --git a/xpcom/base/CycleCollectedJSContext.h b/xpcom/base/CycleCollectedJSContext.h
index 130734b44969..6299624b14a1 100644
--- a/xpcom/base/CycleCollectedJSContext.h
+++ b/xpcom/base/CycleCollectedJSContext.h
@@ -176,7 +176,7 @@ private:
 
   void
   NoteGCThingJSChildren(JS::GCCellPtr aThing,
-                        nsCycleCollectionTraversalCallback& aCb) const;
+                        nsCycleCollectionTraversalCallback& aCb);
 
   void
   NoteGCThingXPCOMChildren(const js::Class* aClasp, JSObject* aObj,
@@ -395,6 +395,8 @@ public:
     mZonesWaitingForGC.PutEntry(aZone);
   }
 
+  void TraceJSChildren(JSTracer* aTrc, JS::GCCellPtr aThing);
+
   // Prepare any zones for GC that have been passed to AddZoneWaitingForGC()
   // since the last GC or since the last call to PrepareWaitingZonesForGC(),
   // whichever was most recent. If there were no such zones, prepare for a

From 068861044a4e730a6db6229ee0f1eeae4705ca74 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Mon, 26 Sep 2016 10:19:07 -0700
Subject: [PATCH 070/102] Bug 1301301, part 5 - In debug builds, check if there
 are too many calls to JS::TraceChildren. r=smaug

This can indicate that we are repeatedly calling TraceChildren on
non-AddToCCKind GC things.

MozReview-Commit-ID: C2udI1zg5R9
---
 xpcom/base/CycleCollectedJSContext.cpp | 35 ++++++++++++++++++++++++++
 xpcom/base/CycleCollectedJSContext.h   |  5 ++++
 2 files changed, 40 insertions(+)

diff --git a/xpcom/base/CycleCollectedJSContext.cpp b/xpcom/base/CycleCollectedJSContext.cpp
index fe77801cb286..b5f4a13230ca 100644
--- a/xpcom/base/CycleCollectedJSContext.cpp
+++ b/xpcom/base/CycleCollectedJSContext.cpp
@@ -462,6 +462,10 @@ CycleCollectedJSContext::CycleCollectedJSContext()
   , mDisableMicroTaskCheckpoint(false)
   , mOutOfMemoryState(OOMState::OK)
   , mLargeAllocationFailureState(OOMState::OK)
+#ifdef DEBUG
+  , mNumTraversedGCThings(0)
+  , mNumTraceChildren(0)
+#endif // DEBUG
 {
   nsCOMPtr<nsIThread> thread = do_GetCurrentThread();
   mOwningThread = thread.forget().downcast<nsThread>().take();
@@ -711,6 +715,10 @@ CycleCollectedJSContext::TraverseGCThing(TraverseSelect aTs, JS::GCCellPtr aThin
     return;
   }
 
+#ifdef DEBUG
+  ++mNumTraversedGCThings;
+#endif
+
   if (aTs == TRAVERSE_FULL) {
     NoteGCThingJSChildren(aThing, aCb);
   }
@@ -1353,11 +1361,35 @@ CycleCollectedJSContext::DumpJSHeap(FILE* aFile)
 void
 CycleCollectedJSContext::BeginCycleCollectionCallback()
 {
+#ifdef DEBUG
+  mNumTraversedGCThings = 0;
+  mNumTraceChildren = 0;
+#endif
 }
 
 void
 CycleCollectedJSContext::EndCycleCollectionCallback(CycleCollectorResults& aResults)
 {
+#ifdef DEBUG
+
+  // GC things that the cycle collector calls Traverse on (ie things
+  // in the CC graph) will also get JS::TraceChildren() called on
+  // them. If a child of a GC thing in the CC graph does not have an
+  // AddToCCKind(), then the CC calls JS::TraceChildren() on it
+  // without adding it to the graph. If there are many such objects
+  // that are referred to by many objects in the CC graph, then the CC
+  // can spend a lot of time in JS::TraceChildren(). If you add a new
+  // TraceKind and are hitting this assertion, adding it to
+  // AddToCCKind might help. (The check is not done for small CC
+  // graphs to avoid noise.)
+  if (mNumTraceChildren > 1000 && mNumTraversedGCThings > 0) {
+    double traceRatio = ((double)mNumTraceChildren) / ((double)mNumTraversedGCThings);
+    MOZ_ASSERT(traceRatio < 2.2, "Excessive calls to JS::TraceChildren by the cycle collector");
+  }
+
+  mNumTraversedGCThings = 0;
+  mNumTraceChildren = 0;
+#endif
 }
 
 void
@@ -1702,6 +1734,9 @@ CycleCollectedJSContext::OnLargeAllocationFailure()
 void
 CycleCollectedJSContext::TraceJSChildren(JSTracer* aTrc, JS::GCCellPtr aThing)
 {
+#ifdef DEBUG
+  ++mNumTraceChildren;
+#endif // DEBUG
   JS::TraceChildren(aTrc, aThing);
 }
 
diff --git a/xpcom/base/CycleCollectedJSContext.h b/xpcom/base/CycleCollectedJSContext.h
index 6299624b14a1..5cc0026d214b 100644
--- a/xpcom/base/CycleCollectedJSContext.h
+++ b/xpcom/base/CycleCollectedJSContext.h
@@ -478,6 +478,11 @@ private:
     void invoke(JS::HandleObject scope, Closure& closure) override;
   };
   EnvironmentPreparer mEnvironmentPreparer;
+
+#ifdef DEBUG
+  uint32_t mNumTraversedGCThings;
+  uint32_t mNumTraceChildren;
+#endif // DEBUG
 };
 
 void TraceScriptHolder(nsISupports* aHolder, JSTracer* aTracer);

From 06e9d640a1fa22e33416a4a26264c59bd82375b2 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Fri, 23 Sep 2016 02:25:01 -0700
Subject: [PATCH 071/102] Bug 1269722 - Make GenericPrinter::put return < 0
 *only* when an error is reported, and don't attempt to support partial puts. 
 r=jandem

--HG--
extra : rebase_source : f1ff2667364150acadd05fb816e0faeef0aa0845
---
 js/src/vm/Printer.cpp | 103 ++++++++++++++++++++++++------------------
 1 file changed, 60 insertions(+), 43 deletions(-)

diff --git a/js/src/vm/Printer.cpp b/js/src/vm/Printer.cpp
index d72fbfebf9d1..61166837b7f5 100644
--- a/js/src/vm/Printer.cpp
+++ b/js/src/vm/Printer.cpp
@@ -6,6 +6,8 @@
 
 #include "vm/Printer.h"
 
+#include "mozilla/PodOperations.h"
+
 #include <ctype.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -16,6 +18,8 @@
 
 #include "ds/LifoAlloc.h"
 
+using mozilla::PodCopy;
+
 namespace js {
 
 GenericPrinter::GenericPrinter()
@@ -238,7 +242,7 @@ Sprinter::putString(JSString* s)
 
     JS::AutoCheckCannotGC nogc;
     if (linear->hasLatin1Chars())
-        mozilla::PodCopy(reinterpret_cast<Latin1Char*>(buffer), linear->latin1Chars(nogc), length);
+        PodCopy(reinterpret_cast<Latin1Char*>(buffer), linear->latin1Chars(nogc), length);
     else
         DeflateStringToBuffer(nullptr, linear->twoByteChars(nogc), length, buffer, &size);
 
@@ -442,19 +446,17 @@ Fprinter::put(const char* s, size_t len)
 {
     MOZ_ASSERT(file_);
     int i = fwrite(s, len, 1, file_);
-    if (i == -1 || i != int(len))
+    if (size_t(i) != len) {
         reportOutOfMemory();
+        return -1;
+    }
     return i;
 }
 
 int
 Fprinter::put(const char* s)
 {
-    MOZ_ASSERT(file_);
-    int i = fputs(s, file_);
-    if (i == -1)
-        reportOutOfMemory();
-    return i;
+    return put(s, strlen(s));
 }
 
 int
@@ -516,53 +518,68 @@ LSprinter::clear()
 int
 LSprinter::put(const char* s, size_t len)
 {
-    size_t origLen = len;
+    // Compute how much data will fit in the current chunk.
+    size_t existingSpaceWrite = 0;
+    size_t overflow = len;
     if (unused_ > 0 && tail_) {
-        size_t minLen = unused_ < len ? unused_ : len;
-        js_memcpy(tail_->end() - unused_, s, minLen);
-        unused_ -= minLen;
-        len -= minLen;
-        s += minLen;
+        existingSpaceWrite = std::min(unused_, len);
+        overflow = len - existingSpaceWrite;
     }
 
-    if (len == 0)
-        return origLen;
-
-    size_t allocLength = AlignBytes(sizeof(Chunk) + len, js::detail::LIFO_ALLOC_ALIGN);
+    // If necessary, allocate a new chunk for overflow data.
+    size_t allocLength = 0;
     Chunk* last = nullptr;
-    {
+    if (overflow > 0) {
+        allocLength = AlignBytes(sizeof(Chunk) + overflow, js::detail::LIFO_ALLOC_ALIGN);
+
         LifoAlloc::AutoFallibleScope fallibleAllocator(alloc_);
         last = reinterpret_cast<Chunk*>(alloc_->alloc(allocLength));
-    }
-    if (!last) {
-        reportOutOfMemory();
-        return origLen - len;
+        if (!last) {
+            reportOutOfMemory();
+            return -1;
+        }
     }
 
-    if (tail_ && reinterpret_cast<char*>(last) == tail_->end()) {
-        // tail_ and last are next to each others in memory, knowing that the
-        // TempAlloctator has no meta data and is just a bump allocator, we
-        // append the new allocated space to the tail_.
-        unused_ = allocLength;
-        tail_->length += allocLength;
-    } else {
-        // Remove the size of the header from the allocated length.
-        allocLength -= sizeof(Chunk);
-        last->next = nullptr;
-        last->length = allocLength;
-        unused_ = allocLength;
-        if (!head_)
-            head_ = last;
-        else
-            tail_->next = last;
+    // All fallible operations complete: now fill up existing space, then
+    // overflow space in any new chunk.
+    MOZ_ASSERT(existingSpaceWrite + overflow == len);
 
-        tail_ = last;
+    if (existingSpaceWrite > 0) {
+        PodCopy(tail_->end() - unused_, s, existingSpaceWrite);
+        unused_ -= existingSpaceWrite;
+        s += existingSpaceWrite;
     }
 
-    MOZ_ASSERT(tail_->length >= unused_);
-    js_memcpy(tail_->end() - unused_, s, len);
-    unused_ -= len;
-    return origLen;
+    if (overflow > 0) {
+        if (tail_ && reinterpret_cast<char*>(last) == tail_->end()) {
+            // tail_ and last are consecutive in memory.  LifoAlloc has no
+            // metadata and is just a bump allocator, so we can cheat by
+            // appending the newly-allocated space to tail_.
+            unused_ = allocLength;
+            tail_->length += allocLength;
+        } else {
+            // Remove the size of the header from the allocated length.
+            size_t availableSpace = allocLength - sizeof(Chunk);
+            last->next = nullptr;
+            last->length = availableSpace;
+
+            unused_ = availableSpace;
+            if (!head_)
+                head_ = last;
+            else
+                tail_->next = last;
+
+            tail_ = last;
+        }
+
+        PodCopy(tail_->end() - unused_, s, overflow);
+
+        MOZ_ASSERT(unused_ >= overflow);
+        unused_ -= overflow;
+    }
+
+    MOZ_ASSERT(len <= INT_MAX);
+    return int(len);
 }
 
 int

From e600ef69d7a173245aa739952e3b7368a86eadfd Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Fri, 23 Sep 2016 02:25:06 -0700
Subject: [PATCH 072/102] Bug 1269722 - Make GenericPrinter::put(const char*)
 inline, delegating to the length-delimited put(), as its algorithm is now
 identical everywhere.  r=jandem

--HG--
extra : rebase_source : 0e36601b8812c9862ddaf36d1259ce5e22808cc7
---
 js/src/vm/Printer.cpp | 18 ------------------
 js/src/vm/Printer.h   | 11 +++++++----
 2 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/js/src/vm/Printer.cpp b/js/src/vm/Printer.cpp
index 61166837b7f5..54cb939e689a 100644
--- a/js/src/vm/Printer.cpp
+++ b/js/src/vm/Printer.cpp
@@ -41,12 +41,6 @@ GenericPrinter::hadOutOfMemory() const
     return hadOOM_;
 }
 
-int
-GenericPrinter::put(const char* s)
-{
-    return put(s, strlen(s));
-}
-
 int
 GenericPrinter::printf(const char* fmt, ...)
 {
@@ -453,12 +447,6 @@ Fprinter::put(const char* s, size_t len)
     return i;
 }
 
-int
-Fprinter::put(const char* s)
-{
-    return put(s, strlen(s));
-}
-
 int
 Fprinter::printf(const char* fmt, ...)
 {
@@ -582,12 +570,6 @@ LSprinter::put(const char* s, size_t len)
     return int(len);
 }
 
-int
-LSprinter::put(const char* s)
-{
-    return put(s, strlen(s));
-}
-
 int
 LSprinter::printf(const char* fmt, ...)
 {
diff --git a/js/src/vm/Printer.h b/js/src/vm/Printer.h
index c8aa43f268ef..b64a81aa5987 100644
--- a/js/src/vm/Printer.h
+++ b/js/src/vm/Printer.h
@@ -36,7 +36,10 @@ class GenericPrinter
     // Puts |len| characters from |s| at the current position and return an offset to
     // the beginning of this new data.
     virtual int put(const char* s, size_t len) = 0;
-    virtual int put(const char* s);
+
+    inline int put(const char* s) {
+        return put(s, strlen(s));
+    }
 
     // Prints a formatted string into the buffer.
     virtual int printf(const char* fmt, ...);
@@ -105,8 +108,8 @@ class Sprinter final : public GenericPrinter
 
     // Puts |len| characters from |s| at the current position and return an offset to
     // the beginning of this new data.
-    using GenericPrinter::put;
     virtual int put(const char* s, size_t len) override;
+    using GenericPrinter::put; // pick up |inline int put(const char* s);|
 
     // Prints a formatted string into the buffer.
     virtual int vprintf(const char* fmt, va_list ap) override;
@@ -145,7 +148,7 @@ class Fprinter final : public GenericPrinter
     // Puts |len| characters from |s| at the current position and return an
     // offset to the beginning of this new data.
     virtual int put(const char* s, size_t len) override;
-    virtual int put(const char* s) override;
+    using GenericPrinter::put; // pick up |inline int put(const char* s);|
 
     // Prints a formatted string into the buffer.
     virtual int printf(const char* fmt, ...) override;
@@ -191,7 +194,7 @@ class LSprinter final : public GenericPrinter
     // Puts |len| characters from |s| at the current position and return an
     // offset to the beginning of this new data.
     virtual int put(const char* s, size_t len) override;
-    virtual int put(const char* s) override;
+    using GenericPrinter::put; // pick up |inline int put(const char* s);|
 
     // Prints a formatted string into the buffer.
     virtual int printf(const char* fmt, ...) override;

From 1627aee084ef6c9298894c5b987ff27067c5776a Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Fri, 23 Sep 2016 19:20:31 -0700
Subject: [PATCH 073/102] Bug 1269722 - Remove the standalone Sprint function
 that almost no one error-checks in favor of a member function, and
 error-check every use of it.  r=jandem

--HG--
extra : rebase_source : 21506b36159c77148510dae70bb584a526828196
---
 js/src/jsopcode.cpp   | 221 +++++++++++++---------
 js/src/jsopcode.h     |  15 +-
 js/src/shell/js.cpp   | 422 ++++++++++++++++++++++++++++--------------
 js/src/vm/Printer.cpp |  43 +++--
 js/src/vm/Printer.h   |   8 +-
 5 files changed, 448 insertions(+), 261 deletions(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 229aec9fe715..63a77d9ba566 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -12,6 +12,7 @@
 
 #define __STDC_FORMAT_MACROS
 
+#include "mozilla/Attributes.h"
 #include "mozilla/SizePrintfMacros.h"
 #include "mozilla/Sprintf.h"
 
@@ -147,28 +148,40 @@ js::StackDefs(JSScript* script, jsbytecode* pc)
 
 const char * PCCounts::numExecName = "interp";
 
-void
-js::DumpIonScriptCounts(Sprinter* sp, HandleScript script,
-        jit::IonScriptCounts* ionCounts)
+static MOZ_MUST_USE bool
+DumpIonScriptCounts(Sprinter* sp, HandleScript script, jit::IonScriptCounts* ionCounts)
 {
-    Sprint(sp, "IonScript [%lu blocks]:\n", ionCounts->numBlocks());
+    if (!sp->jsprintf("IonScript [%lu blocks]:\n", ionCounts->numBlocks()))
+        return false;
+
     for (size_t i = 0; i < ionCounts->numBlocks(); i++) {
         const jit::IonBlockCounts& block = ionCounts->block(i);
         unsigned lineNumber = 0, columnNumber = 0;
         lineNumber = PCToLineNumber(script, script->offsetToPC(block.offset()), &columnNumber);
-        Sprint(sp, "BB #%lu [%05u,%u,%u]", block.id(), block.offset(),
-               lineNumber, columnNumber);
-        if (block.description())
-            Sprint(sp, " [inlined %s]", block.description());
-        for (size_t j = 0; j < block.numSuccessors(); j++)
-            Sprint(sp, " -> #%lu", block.successor(j));
-        Sprint(sp, " :: %llu hits\n", block.hitCount());
-        Sprint(sp, "%s\n", block.code());
+        if (!sp->jsprintf("BB #%lu [%05u,%u,%u]",
+                          block.id(), block.offset(), lineNumber, columnNumber))
+        {
+            return false;
+        }
+        if (block.description()) {
+            if (!sp->jsprintf(" [inlined %s]", block.description()))
+                return false;
+        }
+        for (size_t j = 0; j < block.numSuccessors(); j++) {
+            if (!sp->jsprintf(" -> #%lu", block.successor(j)))
+                return false;
+        }
+        if (!sp->jsprintf(" :: %llu hits\n", block.hitCount()))
+            return false;
+        if (!sp->jsprintf("%s\n", block.code()))
+            return false;
     }
+
+    return true;
 }
 
-void
-js::DumpPCCounts(JSContext* cx, HandleScript script, Sprinter* sp)
+static MOZ_MUST_USE bool
+DumpPCCounts(JSContext* cx, HandleScript script, Sprinter* sp)
 {
     MOZ_ASSERT(script->hasScriptCounts());
 
@@ -178,28 +191,35 @@ js::DumpPCCounts(JSContext* cx, HandleScript script, Sprinter* sp)
         jsbytecode* next = GetNextPc(pc);
 
         if (!Disassemble1(cx, script, pc, script->pcToOffset(pc), true, sp))
-            return;
+            return false;
+
+        if (sp->put("                  {") < 0)
+            return false;
 
-        Sprint(sp, "                  {");
         PCCounts* counts = script->maybeGetPCCounts(pc);
-        double val = counts ? counts->numExec() : 0.0;
-        if (val)
-            Sprint(sp, "\"%s\": %.0f", PCCounts::numExecName, val);
-        Sprint(sp, "}\n");
+        if (double val = counts ? counts->numExec() : 0.0) {
+            if (!sp->jsprintf("\"%s\": %.0f", PCCounts::numExecName, val))
+                return false;
+        }
+        if (sp->put("}\n") < 0)
+            return false;
 
         pc = next;
     }
 #endif
 
     jit::IonScriptCounts* ionCounts = script->getIonCounts();
-
     while (ionCounts) {
-        DumpIonScriptCounts(sp, script, ionCounts);
+        if (!DumpIonScriptCounts(sp, script, ionCounts))
+            return false;
+
         ionCounts = ionCounts->previous();
     }
+
+    return true;
 }
 
-void
+bool
 js::DumpCompartmentPCCounts(JSContext* cx)
 {
     Rooted<GCVector<JSScript*>> scripts(cx, GCVector<JSScript*>(cx));
@@ -207,21 +227,26 @@ js::DumpCompartmentPCCounts(JSContext* cx)
         JSScript* script = iter;
         if (script->compartment() != cx->compartment())
             continue;
-        if (script->hasScriptCounts() && !scripts.append(script))
-            return;
+        if (script->hasScriptCounts()) {
+            if (!scripts.append(script))
+                return false;
+        }
     }
 
     for (uint32_t i = 0; i < scripts.length(); i++) {
         HandleScript script = scripts[i];
         Sprinter sprinter(cx);
         if (!sprinter.init())
-            return;
+            return false;
 
         fprintf(stdout, "--- SCRIPT %s:%" PRIuSIZE " ---\n", script->filename(), script->lineno());
-        DumpPCCounts(cx, script, &sprinter);
+        if (!DumpPCCounts(cx, script, &sprinter))
+            return false;
         fputs(sprinter.string(), stdout);
         fprintf(stdout, "--- END SCRIPT %s:%" PRIuSIZE " ---\n", script->filename(), script->lineno());
     }
+
+    return true;
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -642,47 +667,65 @@ js::ReconstructStackDepth(JSContext* cx, JSScript* script, jsbytecode* pc, uint3
  * current line. If showAll is true, include the source note type and the
  * entry stack depth.
  */
-static bool
+static MOZ_MUST_USE bool
 DisassembleAtPC(JSContext* cx, JSScript* scriptArg, bool lines,
                 jsbytecode* pc, bool showAll, Sprinter* sp)
 {
     RootedScript script(cx, scriptArg);
     BytecodeParser parser(cx, script);
 
-    if (showAll && !parser.parse())
+    if (showAll) {
+        if (!parser.parse())
+            return false;
+
+        if (!sp->jsprintf("%s:%u\n", script->filename(), unsigned(script->lineno())))
+            return false;
+    }
+
+    if (pc != nullptr) {
+        if (sp->put("    ") < 0)
+            return false;
+    }
+    if (showAll) {
+        if (sp->put("sn stack ") < 0)
+            return false;
+    }
+    if (sp->put("loc   ") < 0)
+        return false;
+    if (lines) {
+        if (sp->put("line") < 0)
+            return false;
+    }
+    if (sp->put("  op\n") < 0)
         return false;
 
-    if (showAll)
-        Sprint(sp, "%s:%" PRIuSIZE "\n", script->filename(), script->lineno());
-
-    if (pc != nullptr)
-        sp->put("    ");
-    if (showAll)
-        sp->put("sn stack ");
-    sp->put("loc   ");
-    if (lines)
-        sp->put("line");
-    sp->put("  op\n");
-
-    if (pc != nullptr)
-        sp->put("    ");
-    if (showAll)
-        sp->put("-- ----- ");
-    sp->put("----- ");
-    if (lines)
-        sp->put("----");
-    sp->put("  --\n");
+    if (pc != nullptr) {
+        if (sp->put("    ") < 0)
+            return false;
+    }
+    if (showAll) {
+        if (sp->put("-- ----- ") < 0)
+            return false;
+    }
+    if (sp->put("----- ") < 0)
+        return false;
+    if (lines) {
+        if (sp->put("----") < 0)
+            return false;
+    }
+    if (sp->put("  --\n") < 0)
+        return false;
 
     jsbytecode* next = script->code();
     jsbytecode* end = script->codeEnd();
     while (next < end) {
-        if (next == script->main())
-            sp->put("main:\n");
+        if (next == script->main()) {
+            if (sp->put("main:\n") < 0)
+                return false;
+        }
         if (pc != nullptr) {
-            if (pc == next)
-                sp->put("--> ");
-            else
-                sp->put("    ");
+            if (sp->put(pc == next ? "--> " : "    ") < 0)
+                return false;
         }
         if (showAll) {
             jssrcnote* sn = GetSrcNote(cx, script, next);
@@ -690,24 +733,32 @@ DisassembleAtPC(JSContext* cx, JSScript* scriptArg, bool lines,
                 MOZ_ASSERT(!SN_IS_TERMINATOR(sn));
                 jssrcnote* next = SN_NEXT(sn);
                 while (!SN_IS_TERMINATOR(next) && SN_DELTA(next) == 0) {
-                    Sprint(sp, "%02u\n    ", SN_TYPE(sn));
+                    if (!sp->jsprintf("%02u\n    ", SN_TYPE(sn)))
+                        return false;
                     sn = next;
                     next = SN_NEXT(sn);
                 }
-                Sprint(sp, "%02u ", SN_TYPE(sn));
+                if (!sp->jsprintf("%02u ", SN_TYPE(sn)))
+                    return false;
+            } else {
+                if (sp->put("   ") < 0)
+                    return false;
+            }
+            if (parser.isReachable(next)) {
+                if (!sp->jsprintf("%05u ", parser.stackDepthAtPC(next)))
+                    return false;
+            } else {
+                if (sp->put("      ") < 0)
+                    return false;
             }
-            else
-                sp->put("   ");
-            if (parser.isReachable(next))
-                Sprint(sp, "%05u ", parser.stackDepthAtPC(next));
-            else
-                Sprint(sp, "      ");
         }
         unsigned len = Disassemble1(cx, script, next, script->pcToOffset(next), lines, sp);
         if (!len)
             return false;
+
         next += len;
     }
+
     return true;
 }
 
@@ -886,11 +937,13 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
     }
     const JSCodeSpec* cs = &CodeSpec[op];
     ptrdiff_t len = (ptrdiff_t) cs->length;
-    if (Sprint(sp, "%05u:", loc) == -1)
+    if (!sp->jsprintf("%05u:", loc))
         return 0;
-    if (lines && Sprint(sp, "%4u", PCToLineNumber(script, pc)) == -1)
-        return 0;
-    if (Sprint(sp, "  %s", CodeName[op]) == -1)
+    if (lines) {
+        if (!sp->jsprintf("%4u", PCToLineNumber(script, pc)))
+            return 0;
+    }
+    if (!sp->jsprintf("  %s", CodeName[op]))
         return 0;
 
     int i;
@@ -906,9 +959,9 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
               for(i = 0; i < trynotes->length; i++) {
                   JSTryNote note = trynotes->vector[i];
                   if (note.kind == JSTRY_CATCH && note.start == loc + 1) {
-                      if (Sprint(sp, " %u (%+d)",
-                                 (unsigned int) (loc+note.length+1),
-                                 (int) (note.length+1)) == -1)
+                      if (!sp->jsprintf(" %u (%+d)",
+                                        unsigned(loc + note.length + 1),
+                                        int(note.length + 1)))
                       {
                           return 0;
                       }
@@ -920,7 +973,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
 
       case JOF_JUMP: {
         ptrdiff_t off = GET_JUMP_OFFSET(pc);
-        if (Sprint(sp, " %u (%+d)", loc + (int) off, (int) off) == -1)
+        if (!sp->jsprintf(" %u (%+d)", unsigned(loc + int(off)), int(off)))
             return 0;
         break;
       }
@@ -930,7 +983,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         JSAutoByteString bytes;
         if (!ToDisassemblySource(cx, scope, &bytes))
             return 0;
-        if (Sprint(sp, " %s", bytes.ptr()) == -1)
+        if (!sp->jsprintf(" %s", bytes.ptr()))
             return 0;
         break;
       }
@@ -942,7 +995,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         if (!ToDisassemblySource(cx, v, &bytes))
             return 0;
         EnvironmentCoordinate ec(pc);
-        if (Sprint(sp, " %s (hops = %u, slot = %u)", bytes.ptr(), ec.hops(), ec.slot()) == -1)
+        if (!sp->jsprintf(" %s (hops = %u, slot = %u)", bytes.ptr(), ec.hops(), ec.slot()))
             return 0;
         break;
       }
@@ -952,7 +1005,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         JSAutoByteString bytes;
         if (!ToDisassemblySource(cx, v, &bytes))
             return 0;
-        if (Sprint(sp, " %s", bytes.ptr()) == -1)
+        if (!sp->jsprintf(" %s", bytes.ptr()))
             return 0;
         break;
       }
@@ -962,7 +1015,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         JSAutoByteString bytes;
         if (!ToDisassemblySource(cx, v, &bytes))
             return 0;
-        if (Sprint(sp, " %s", bytes.ptr()) == -1)
+        if (!sp->jsprintf(" %s", bytes.ptr()))
             return 0;
         break;
       }
@@ -970,7 +1023,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
       case JOF_OBJECT: {
         /* Don't call obj.toSource if analysis/inference is active. */
         if (script->zone()->types.activeAnalysis) {
-            if (Sprint(sp, " object") == -1)
+            if (!sp->jsprintf(" object"))
                 return 0;
             break;
         }
@@ -981,7 +1034,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
             RootedValue v(cx, ObjectValue(*obj));
             if (!ToDisassemblySource(cx, v, &bytes))
                 return 0;
-            if (Sprint(sp, " %s", bytes.ptr()) == -1)
+            if (!sp->jsprintf(" %s", bytes.ptr()))
                 return 0;
         }
         break;
@@ -993,7 +1046,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         RootedValue v(cx, ObjectValue(*obj));
         if (!ToDisassemblySource(cx, v, &bytes))
             return 0;
-        if (Sprint(sp, " %s", bytes.ptr()) == -1)
+        if (!sp->jsprintf(" %s", bytes.ptr()))
             return 0;
         break;
       }
@@ -1008,11 +1061,11 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         pc2 += JUMP_OFFSET_LEN;
         high = GET_JUMP_OFFSET(pc2);
         pc2 += JUMP_OFFSET_LEN;
-        if (Sprint(sp, " defaultOffset %d low %d high %d", int(off), low, high) == -1)
+        if (!sp->jsprintf(" defaultOffset %d low %d high %d", int(off), low, high))
             return 0;
         for (i = low; i <= high; i++) {
             off = GET_JUMP_OFFSET(pc2);
-            if (Sprint(sp, "\n\t%d: %d", i, int(off)) == -1)
+            if (!sp->jsprintf("\n\t%d: %d", i, int(off)))
                 return 0;
             pc2 += JUMP_OFFSET_LEN;
         }
@@ -1021,17 +1074,17 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
       }
 
       case JOF_QARG:
-        if (Sprint(sp, " %u", GET_ARGNO(pc)) == -1)
+        if (!sp->jsprintf(" %u", GET_ARGNO(pc)))
             return 0;
         break;
 
       case JOF_LOCAL:
-        if (Sprint(sp, " %u", GET_LOCALNO(pc)) == -1)
+        if (!sp->jsprintf(" %u", GET_LOCALNO(pc)))
             return 0;
         break;
 
       case JOF_UINT32:
-        if (Sprint(sp, " %u", GET_UINT32(pc)) == -1)
+        if (!sp->jsprintf(" %u", GET_UINT32(pc)))
             return 0;
         break;
 
@@ -1056,7 +1109,7 @@ js::Disassemble1(JSContext* cx, HandleScript script, jsbytecode* pc,
         MOZ_ASSERT(op == JSOP_INT32);
         i = GET_INT32(pc);
       print_int:
-        if (Sprint(sp, " %d", i) == -1)
+        if (!sp->jsprintf(" %d", i))
             return 0;
         break;
 
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index dbeb6a03d209..4f78596656ab 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -11,6 +11,8 @@
  * JS bytecode definitions.
  */
 
+#include "mozilla/Attributes.h"
+
 #include "jsbytecode.h"
 #include "jstypes.h"
 #include "NamespaceImports.h"
@@ -847,7 +849,7 @@ GetNextPc(jsbytecode* pc)
 /*
  * Disassemblers, for debugging only.
  */
-bool
+extern MOZ_MUST_USE bool
 Disassemble(JSContext* cx, JS::Handle<JSScript*> script, bool lines, Sprinter* sp);
 
 unsigned
@@ -856,16 +858,9 @@ Disassemble1(JSContext* cx, JS::Handle<JSScript*> script, jsbytecode* pc, unsign
 
 #endif
 
-void
-DumpPCCounts(JSContext* cx, JS::Handle<JSScript*> script, Sprinter* sp);
-
-namespace jit { struct IonScriptCounts; }
-void
-DumpIonScriptCounts(js::Sprinter* sp, HandleScript script,
-                    jit::IonScriptCounts* ionCounts);
-
-void
+extern MOZ_MUST_USE bool
 DumpCompartmentPCCounts(JSContext* cx);
+
 } // namespace js
 
 #endif /* jsopcode_h */
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 6e4c9a387a78..24390b137ee8 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -8,11 +8,13 @@
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Atomics.h"
+#include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/GuardObjects.h"
 #include "mozilla/IntegerPrintfMacros.h"
 #include "mozilla/mozalloc.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/ScopeExit.h"
 #include "mozilla/SizePrintfMacros.h"
 #include "mozilla/Sprintf.h"
 #include "mozilla/TimeStamp.h"
@@ -108,6 +110,7 @@ using namespace js::shell;
 
 using mozilla::ArrayLength;
 using mozilla::Atomic;
+using mozilla::MakeScopeExit;
 using mozilla::Maybe;
 using mozilla::Nothing;
 using mozilla::NumberEqualsInt32;
@@ -2332,13 +2335,17 @@ UpdateSwitchTableBounds(JSContext* cx, HandleScript script, unsigned offset,
     *end = *start + (unsigned)(n * jmplen);
 }
 
-static void
+static MOZ_MUST_USE bool
 SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
 {
-    Sprint(sp, "\nSource notes:\n");
-    Sprint(sp, "%4s %4s %5s %6s %-8s %s\n",
-           "ofs", "line", "pc", "delta", "desc", "args");
-    Sprint(sp, "---- ---- ----- ------ -------- ------\n");
+    if (sp->put("\nSource notes:\n") < 0 ||
+        !sp->jsprintf("%4s %4s %5s %6s %-8s %s\n",
+                      "ofs", "line", "pc", "delta", "desc", "args") ||
+        sp->put("---- ---- ----- ------ -------- ------\n") < 0)
+    {
+        return false;
+    }
+
     unsigned offset = 0;
     unsigned colspan = 0;
     unsigned lineno = script->lineno();
@@ -2349,7 +2356,12 @@ SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
         offset += delta;
         SrcNoteType type = (SrcNoteType) SN_TYPE(sn);
         const char* name = js_SrcNoteSpec[type].name;
-        Sprint(sp, "%3u: %4u %5u [%4u] %-8s", unsigned(sn - notes), lineno, offset, delta, name);
+        if (!sp->jsprintf("%3u: %4u %5u [%4u] %-8s",
+                          unsigned(sn - notes), lineno, offset, delta, name))
+        {
+            return false;
+        }
+
         switch (type) {
           case SRC_NULL:
           case SRC_IF:
@@ -2363,12 +2375,14 @@ SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
 
           case SRC_COLSPAN:
             colspan = SN_OFFSET_TO_COLSPAN(GetSrcNoteOffset(sn, 0));
-            Sprint(sp, "%d", colspan);
+            if (!sp->jsprintf("%d", colspan))
+                return false;
             break;
 
           case SRC_SETLINE:
             lineno = GetSrcNoteOffset(sn, 0);
-            Sprint(sp, " lineno %u", lineno);
+            if (!sp->jsprintf(" lineno %u", lineno))
+                return false;
             break;
 
           case SRC_NEWLINE:
@@ -2376,31 +2390,38 @@ SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
             break;
 
           case SRC_FOR:
-            Sprint(sp, " cond %u update %u tail %u",
-                   unsigned(GetSrcNoteOffset(sn, 0)),
-                   unsigned(GetSrcNoteOffset(sn, 1)),
-                   unsigned(GetSrcNoteOffset(sn, 2)));
+            if (!sp->jsprintf(" cond %u update %u tail %u",
+                              unsigned(GetSrcNoteOffset(sn, 0)),
+                              unsigned(GetSrcNoteOffset(sn, 1)),
+                              unsigned(GetSrcNoteOffset(sn, 2))))
+            {
+                return false;
+            }
             break;
 
           case SRC_IF_ELSE:
-            Sprint(sp, " else %u", unsigned(GetSrcNoteOffset(sn, 0)));
+            if (!sp->jsprintf(" else %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
             break;
 
           case SRC_FOR_IN:
           case SRC_FOR_OF:
-            Sprint(sp, " closingjump %u", unsigned(GetSrcNoteOffset(sn, 0)));
+            if (!sp->jsprintf(" closingjump %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
             break;
 
           case SRC_COND:
           case SRC_WHILE:
           case SRC_NEXTCASE:
-            Sprint(sp, " offset %u", unsigned(GetSrcNoteOffset(sn, 0)));
+            if (!sp->jsprintf(" offset %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
             break;
 
           case SRC_TABLESWITCH: {
             JSOp op = JSOp(script->code()[offset]);
             MOZ_ASSERT(op == JSOP_TABLESWITCH);
-            Sprint(sp, " length %u", unsigned(GetSrcNoteOffset(sn, 0)));
+            if (!sp->jsprintf(" length %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
             UpdateSwitchTableBounds(cx, script, offset,
                                     &switchTableStart, &switchTableEnd);
             break;
@@ -2408,10 +2429,12 @@ SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
           case SRC_CONDSWITCH: {
             JSOp op = JSOp(script->code()[offset]);
             MOZ_ASSERT(op == JSOP_CONDSWITCH);
-            Sprint(sp, " length %u", unsigned(GetSrcNoteOffset(sn, 0)));
-            unsigned caseOff = (unsigned) GetSrcNoteOffset(sn, 1);
-            if (caseOff)
-                Sprint(sp, " first case offset %u", caseOff);
+            if (!sp->jsprintf(" length %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
+            if (unsigned caseOff = (unsigned) GetSrcNoteOffset(sn, 1)) {
+                if (!sp->jsprintf(" first case offset %u", caseOff))
+                    return false;
+            }
             UpdateSwitchTableBounds(cx, script, offset,
                                     &switchTableStart, &switchTableEnd);
             break;
@@ -2419,15 +2442,18 @@ SrcNotes(JSContext* cx, HandleScript script, Sprinter* sp)
 
           case SRC_TRY:
             MOZ_ASSERT(JSOp(script->code()[offset]) == JSOP_TRY);
-            Sprint(sp, " offset to jump %u", unsigned(GetSrcNoteOffset(sn, 0)));
+            if (!sp->jsprintf(" offset to jump %u", unsigned(GetSrcNoteOffset(sn, 0))))
+                return false;
             break;
 
           default:
-            MOZ_ASSERT(0);
-            break;
+            MOZ_ASSERT_UNREACHABLE("unrecognized srcnote");
         }
-        Sprint(sp, "\n");
+        if (sp->put("\n") < 0)
+            return false;
     }
+
+    return true;
 }
 
 static bool
@@ -2443,7 +2469,8 @@ Notes(JSContext* cx, unsigned argc, Value* vp)
         if (!script)
             return false;
 
-        SrcNotes(cx, script, &sprinter);
+        if (!SrcNotes(cx, script, &sprinter))
+            return false;
     }
 
     JSString* str = JS_NewStringCopyZ(cx, sprinter.string());
@@ -2459,87 +2486,124 @@ JS_STATIC_ASSERT(JSTRY_FOR_IN == 2);
 
 static const char* const TryNoteNames[] = { "catch", "finally", "for-in", "for-of", "loop" };
 
-static bool
+static MOZ_MUST_USE bool
 TryNotes(JSContext* cx, HandleScript script, Sprinter* sp)
 {
     if (!script->hasTrynotes())
         return true;
 
+    if (sp->put("\nException table:\nkind      stack    start      end\n") < 0)
+        return false;
+
     JSTryNote* tn = script->trynotes()->vector;
     JSTryNote* tnlimit = tn + script->trynotes()->length;
-    Sprint(sp, "\nException table:\nkind      stack    start      end\n");
     do {
         MOZ_ASSERT(tn->kind < ArrayLength(TryNoteNames));
         uint8_t startOff = script->pcToOffset(script->main()) + tn->start;
-        Sprint(sp, " %-7s %6u %8u %8u\n",
-               TryNoteNames[tn->kind], tn->stackDepth,
-               startOff, startOff + tn->length);
+        if (!sp->jsprintf(" %-7s %6u %8u %8u\n",
+                          TryNoteNames[tn->kind], tn->stackDepth,
+                          startOff, startOff + tn->length))
+        {
+            return false;
+        }
     } while (++tn != tnlimit);
     return true;
 }
 
-static bool
+static MOZ_MUST_USE bool
 ScopeNotes(JSContext* cx, HandleScript script, Sprinter* sp)
 {
     if (!script->hasScopeNotes())
         return true;
 
-    Sprint(sp, "\nScope notes:\n   index   parent    start      end\n");
+    if (sp->put("\nScope notes:\n   index   parent    start      end\n") < 0)
+        return false;
 
     ScopeNoteArray* notes = script->scopeNotes();
     for (uint32_t i = 0; i < notes->length; i++) {
         const ScopeNote* note = &notes->vector[i];
-        if (note->index == ScopeNote::NoScopeIndex)
-            Sprint(sp, "%8s ", "(none)");
-        else
-            Sprint(sp, "%8u ", note->index);
-        if (note->parent == ScopeNote::NoScopeIndex)
-            Sprint(sp, "%8s ", "(none)");
-        else
-            Sprint(sp, "%8u ", note->parent);
-        Sprint(sp, "%8u %8u\n", note->start, note->start + note->length);
+        if (note->index == ScopeNote::NoScopeIndex) {
+            if (!sp->jsprintf("%8s ", "(none)"))
+                return false;
+        } else {
+            if (!sp->jsprintf("%8u ", note->index))
+                return false;
+        }
+        if (note->parent == ScopeNote::NoScopeIndex) {
+            if (!sp->jsprintf("%8s ", "(none)"))
+                return false;
+        } else {
+            if (!sp->jsprintf("%8u ", note->parent))
+                return false;
+        }
+        if (!sp->jsprintf("%8u %8u\n", note->start, note->start + note->length))
+            return false;
     }
     return true;
 }
 
-static bool
+static MOZ_MUST_USE bool
 DisassembleScript(JSContext* cx, HandleScript script, HandleFunction fun,
                   bool lines, bool recursive, bool sourceNotes, Sprinter* sp)
 {
     if (fun) {
-        Sprint(sp, "flags:");
-        if (fun->isLambda())
-            Sprint(sp, " LAMBDA");
-        if (fun->needsCallObject())
-            Sprint(sp, " NEEDS_CALLOBJECT");
-        if (fun->needsExtraBodyVarEnvironment())
-            Sprint(sp, " NEEDS_EXTRABODYVARENV");
-        if (fun->needsNamedLambdaEnvironment())
-            Sprint(sp, " NEEDS_NAMEDLAMBDAENV");
-        if (fun->isConstructor())
-            Sprint(sp, " CONSTRUCTOR");
-        if (fun->isExprBody())
-            Sprint(sp, " EXPRESSION_CLOSURE");
-        if (fun->isSelfHostedBuiltin())
-            Sprint(sp, " SELF_HOSTED");
-        if (fun->isArrow())
-            Sprint(sp, " ARROW");
-        Sprint(sp, "\n");
+        if (sp->put("flags:") < 0)
+            return false;
+        if (fun->isLambda()) {
+            if (sp->put(" LAMBDA") < 0)
+                return false;
+        }
+        if (fun->needsCallObject()) {
+            if (sp->put(" NEEDS_CALLOBJECT") < 0)
+                return false;
+        }
+        if (fun->needsExtraBodyVarEnvironment()) {
+            if (sp->put(" NEEDS_EXTRABODYVARENV") < 0)
+                return false;
+        }
+        if (fun->needsNamedLambdaEnvironment()) {
+            if (sp->put(" NEEDS_NAMEDLAMBDAENV") < 0)
+                return false;
+        }
+        if (fun->isConstructor()) {
+            if (sp->put(" CONSTRUCTOR") < 0)
+                return false;
+        }
+        if (fun->isExprBody()) {
+            if (sp->put(" EXPRESSION_CLOSURE") < 0)
+                return false;
+        }
+        if (fun->isSelfHostedBuiltin()) {
+            if (sp->put(" SELF_HOSTED") < 0)
+                return false;
+        }
+        if (fun->isArrow()) {
+            if (sp->put(" ARROW") < 0)
+                return false;
+        }
+        if (sp->put("\n") < 0)
+            return false;
     }
 
     if (!Disassemble(cx, script, lines, sp))
         return false;
-    if (sourceNotes)
-        SrcNotes(cx, script, sp);
-    TryNotes(cx, script, sp);
-    ScopeNotes(cx, script, sp);
+    if (sourceNotes) {
+        if (!SrcNotes(cx, script, sp))
+            return false;
+    }
+    if (!TryNotes(cx, script, sp))
+        return false;
+    if (!ScopeNotes(cx, script, sp))
+        return false;
 
     if (recursive && script->hasObjects()) {
         ObjectArray* objects = script->objects();
         for (unsigned i = 0; i != objects->length; ++i) {
             JSObject* obj = objects->vector[i];
             if (obj->is<JSFunction>()) {
-                Sprint(sp, "\n");
+                if (sp->put("\n") < 0)
+                    return false;
+
                 RootedFunction fun(cx, &obj->as<JSFunction>());
                 if (fun->isInterpreted()) {
                     RootedScript script(cx, fun->getOrCreateScript(cx));
@@ -2548,11 +2612,13 @@ DisassembleScript(JSContext* cx, HandleScript script, HandleFunction fun,
                             return false;
                     }
                 } else {
-                    Sprint(sp, "[native code]\n");
+                    if (sp->put("[native code]\n") < 0)
+                        return false;
                 }
             }
         }
     }
+
     return true;
 }
 
@@ -2606,9 +2672,12 @@ DisassembleToSprinter(JSContext* cx, unsigned argc, Value* vp, Sprinter* sprinte
             JSAutoCompartment ac(cx, script);
             if (!Disassemble(cx, script, p.lines, sprinter))
                 return false;
-            SrcNotes(cx, script, sprinter);
-            TryNotes(cx, script, sprinter);
-            ScopeNotes(cx, script, sprinter);
+            if (!SrcNotes(cx, script, sprinter))
+                return false;
+            if (!TryNotes(cx, script, sprinter))
+                return false;
+            if (!ScopeNotes(cx, script, sprinter))
+                return false;
         }
     } else {
         for (unsigned i = 0; i < p.argc; i++) {
@@ -2733,13 +2802,11 @@ DisassWithSrc(JSContext* cx, unsigned argc, Value* vp)
 
     const size_t lineBufLen = 512;
     unsigned len, line1, line2, bupline;
-    FILE* file;
     char linebuf[lineBufLen];
     static const char sep[] = ";-------------------------";
 
-    bool ok = true;
     RootedScript script(cx);
-    for (unsigned i = 0; ok && i < args.length(); i++) {
+    for (unsigned i = 0; i < args.length(); i++) {
         script = ValueToScript(cx, args[i]);
         if (!script)
            return false;
@@ -2750,22 +2817,21 @@ DisassWithSrc(JSContext* cx, unsigned argc, Value* vp)
             return false;
         }
 
-        file = fopen(script->filename(), "r");
+        FILE* file = fopen(script->filename(), "r");
         if (!file) {
             JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
                                  JSSMSG_CANT_OPEN, script->filename(),
                                  strerror(errno));
             return false;
         }
+        auto closeFile = MakeScopeExit([file]() { fclose(file); });
 
         jsbytecode* pc = script->code();
         jsbytecode* end = script->codeEnd();
 
         Sprinter sprinter(cx);
-        if (!sprinter.init()) {
-            ok = false;
-            goto bail;
-        }
+        if (!sprinter.init())
+            return false;
 
         /* burn the leading lines */
         line2 = PCToLineNumber(script, pc);
@@ -2773,8 +2839,7 @@ DisassWithSrc(JSContext* cx, unsigned argc, Value* vp)
             char* tmp = fgets(linebuf, lineBufLen, file);
             if (!tmp) {
                 JS_ReportError(cx, "failed to read %s fully", script->filename());
-                ok = false;
-                goto bail;
+                return false;
             }
         }
 
@@ -2785,49 +2850,40 @@ DisassWithSrc(JSContext* cx, unsigned argc, Value* vp)
             if (line2 < line1) {
                 if (bupline != line2) {
                     bupline = line2;
-                    if (Sprint(&sprinter, "%s %3u: BACKUP\n", sep, line2) == -1) {
-                        ok = false;
-                        goto bail;
-                    }
+                    if (!sprinter.jsprintf("%s %3u: BACKUP\n", sep, line2))
+                        return false;
                 }
             } else {
-                if (bupline && line1 == line2)
-                    if (Sprint(&sprinter, "%s %3u: RESTORE\n", sep, line2) == -1) {
-                        ok = false;
-                        goto bail;
-                    }
+                if (bupline && line1 == line2) {
+                    if (!sprinter.jsprintf("%s %3u: RESTORE\n", sep, line2))
+                        return false;
+                }
                 bupline = 0;
                 while (line1 < line2) {
                     if (!fgets(linebuf, lineBufLen, file)) {
                         JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
                                              JSSMSG_UNEXPECTED_EOF,
                                              script->filename());
-                        ok = false;
-                        goto bail;
+                        return false;
                     }
                     line1++;
-                    if (Sprint(&sprinter, "%s %3u: %s", sep, line1, linebuf) == -1) {
-                        ok = false;
-                        goto bail;
-                    }
+                    if (!sprinter.jsprintf("%s %3u: %s", sep, line1, linebuf))
+                        return false;
                 }
             }
 
             len = Disassemble1(cx, script, pc, script->pcToOffset(pc), true, &sprinter);
-            if (!len) {
-                ok = false;
-                goto bail;
-            }
+            if (!len)
+                return false;
+
             pc += len;
         }
 
         fprintf(gOutFile->fp, "%s\n", sprinter.string());
-
-      bail:
-        fclose(file);
     }
+
     args.rval().setUndefined();
-    return ok;
+    return true;
 }
 
 #endif /* DEBUG */
@@ -4910,61 +4966,110 @@ class SprintOptimizationTypeInfoOp : public JS::ForEachTrackedOptimizationTypeIn
 {
     Sprinter* sp;
     bool startedTypes_;
+    bool hadError_;
 
   public:
     explicit SprintOptimizationTypeInfoOp(Sprinter* sp)
       : sp(sp),
-        startedTypes_(false)
+        startedTypes_(false),
+        hadError_(false)
     { }
 
     void readType(const char* keyedBy, const char* name,
                   const char* location, Maybe<unsigned> lineno) override
     {
-        if (!startedTypes_) {
-            startedTypes_ = true;
-            Sprint(sp, "{\"typeset\": [");
-        }
-        Sprint(sp, "{\"keyedBy\":\"%s\"", keyedBy);
-        if (name)
-            Sprint(sp, ",\"name\":\"%s\"", name);
-        if (location) {
-            char buf[512];
-            PutEscapedString(buf, mozilla::ArrayLength(buf), location, strlen(location), '"');
-            Sprint(sp, ",\"location\":%s", buf);
-        }
-        if (lineno.isSome())
-            Sprint(sp, ",\"line\":%u", *lineno);
-        Sprint(sp, "},");
+        if (hadError_)
+            return;
+
+        do {
+            if (!startedTypes_) {
+                startedTypes_ = true;
+                if (sp->put("{\"typeset\": [") < 0)
+                    break;
+            }
+
+            if (!sp->jsprintf("{\"keyedBy\":\"%s\"", keyedBy))
+                break;
+
+            if (name) {
+                if (!sp->jsprintf(",\"name\":\"%s\"", name))
+                    break;
+            }
+
+            if (location) {
+                char buf[512];
+                PutEscapedString(buf, mozilla::ArrayLength(buf), location, strlen(location), '"');
+                if (!sp->jsprintf(",\"location\":%s", buf))
+                    break;
+            }
+            if (lineno.isSome()) {
+                if (!sp->jsprintf(",\"line\":%u", *lineno))
+                    break;
+            }
+            if (sp->put("},") < 0)
+                break;
+
+            return;
+        } while (false);
+
+        hadError_ = true;
     }
 
     void operator()(JS::TrackedTypeSite site, const char* mirType) override {
-        if (startedTypes_) {
-            // Clear trailing ,
-            if ((*sp)[sp->getOffset() - 1] == ',')
-                (*sp)[sp->getOffset() - 1] = ' ';
-            Sprint(sp, "],");
-            startedTypes_ = false;
-        } else {
-            Sprint(sp, "{");
-        }
+        if (hadError_)
+            return;
 
-        Sprint(sp, "\"site\":\"%s\",\"mirType\":\"%s\"},",
-               TrackedTypeSiteString(site), mirType);
+        do {
+            if (startedTypes_) {
+                // Clear trailing ,
+                if ((*sp)[sp->getOffset() - 1] == ',')
+                    (*sp)[sp->getOffset() - 1] = ' ';
+                if (sp->put("],") < 0)
+                    break;
+
+                startedTypes_ = false;
+            } else {
+                if (sp->put("{") < 0)
+                    break;
+            }
+
+            if (!sp->jsprintf("\"site\":\"%s\",\"mirType\":\"%s\"},",
+                              TrackedTypeSiteString(site), mirType))
+            {
+                break;
+            }
+
+            return;
+        } while (false);
+
+        hadError_ = true;
+    }
+
+    bool hadError() const {
+        return hadError_;
     }
 };
 
 class SprintOptimizationAttemptsOp : public JS::ForEachTrackedOptimizationAttemptOp
 {
     Sprinter* sp;
+    bool hadError_;
 
   public:
     explicit SprintOptimizationAttemptsOp(Sprinter* sp)
-      : sp(sp)
+      : sp(sp), hadError_(false)
     { }
 
     void operator()(JS::TrackedStrategy strategy, JS::TrackedOutcome outcome) override {
-        Sprint(sp, "{\"strategy\":\"%s\",\"outcome\":\"%s\"},",
-               TrackedStrategyString(strategy), TrackedOutcomeString(outcome));
+        if (hadError_)
+            return;
+
+        hadError_ = !sp->jsprintf("{\"strategy\":\"%s\",\"outcome\":\"%s\"},",
+                                  TrackedStrategyString(strategy), TrackedOutcomeString(outcome));
+    }
+
+    bool hadError() const {
+        return hadError_;
     }
 };
 
@@ -5018,7 +5123,9 @@ ReflectTrackedOptimizations(JSContext* cx, unsigned argc, Value* vp)
     const jit::IonTrackedOptimizationsRegionTable* regions =
         entry.ionEntry().trackedOptimizationsRegionTable();
 
-    Sprint(&sp, "{\"regions\": [");
+    if (sp.put("{\"regions\": [") < 0)
+        return false;
+
     for (uint32_t i = 0; i < regions->numEntries(); i++) {
         jit::IonTrackedOptimizationsRegion region = regions->entry(i);
         jit::IonTrackedOptimizationsRegion::RangeIterator iter = region.ranges();
@@ -5026,6 +5133,7 @@ ReflectTrackedOptimizations(JSContext* cx, unsigned argc, Value* vp)
             uint32_t startOffset, endOffset;
             uint8_t index;
             iter.readNext(&startOffset, &endOffset, &index);
+
             JSScript* script;
             jsbytecode* pc;
             // Use endOffset, as startOffset may be associated with a
@@ -5035,31 +5143,54 @@ ReflectTrackedOptimizations(JSContext* cx, unsigned argc, Value* vp)
             // the second region and not the first.
             uint8_t* addr = ion->method()->raw() + endOffset;
             entry.youngestFrameLocationAtAddr(rt, addr, &script, &pc);
-            Sprint(&sp, "{\"location\":\"%s:%u\",\"offset\":%u,\"index\":%u}%s",
-                   script->filename(), script->lineno(), script->pcToOffset(pc), index,
-                   iter.more() ? "," : "");
+
+            if (!sp.jsprintf("{\"location\":\"%s:%u\",\"offset\":%u,\"index\":%u}%s",
+                             script->filename(), script->lineno(), script->pcToOffset(pc), index,
+                             iter.more() ? "," : ""))
+            {
+                return false;
+            }
         }
     }
-    Sprint(&sp, "],");
 
-    Sprint(&sp, "\"opts\": [");
+    if (sp.put("],") < 0)
+        return false;
+
+    if (sp.put("\"opts\": [") < 0)
+        return false;
+
     for (uint8_t i = 0; i < entry.ionEntry().numOptimizationAttempts(); i++) {
-        Sprint(&sp, "%s{\"typeinfo\":[", i == 0 ? "" : ",");
+        if (!sp.jsprintf("%s{\"typeinfo\":[", i == 0 ? "" : ","))
+            return false;
+
         SprintOptimizationTypeInfoOp top(&sp);
         jit::IonTrackedOptimizationsTypeInfo::ForEachOpAdapter adapter(top);
         entry.trackedOptimizationTypeInfo(i).forEach(adapter, entry.allTrackedTypes());
+        if (top.hadError())
+            return false;
+
         // Clear the trailing ,
         if (sp[sp.getOffset() - 1] == ',')
             sp[sp.getOffset() - 1] = ' ';
-        Sprint(&sp, "],\"attempts\":[");
+
+        if (sp.put("],\"attempts\":[") < 0)
+            return false;
+
         SprintOptimizationAttemptsOp aop(&sp);
         entry.trackedOptimizationAttempts(i).forEach(aop);
+        if (aop.hadError())
+            return false;
+
         // Clear the trailing ,
         if (sp[sp.getOffset() - 1] == ',')
             sp[sp.getOffset() - 1] = ' ';
-        Sprint(&sp, "]}");
+
+        if (sp.put("]}") < 0)
+            return false;
     }
-    Sprint(&sp, "]}");
+
+    if (sp.put("]}") < 0)
+        return false;
 
     if (sp.hadOutOfMemory())
         return false;
@@ -7292,8 +7423,11 @@ Shell(JSContext* cx, OptionParser* op, char** envp)
     if (sc->exitCode)
         result = sc->exitCode;
 
-    if (enableDisassemblyDumps)
-        js::DumpCompartmentPCCounts(cx);
+    if (enableDisassemblyDumps) {
+        AutoReportException are(cx);
+        if (!js::DumpCompartmentPCCounts(cx))
+            result = EXITCODE_OUT_OF_MEMORY;
+    }
 
     if (!op->getBoolOption("no-js-cache-per-process")) {
         if (jsCacheAsmJSPath) {
diff --git a/js/src/vm/Printer.cpp b/js/src/vm/Printer.cpp
index 54cb939e689a..88350a4bd5a2 100644
--- a/js/src/vm/Printer.cpp
+++ b/js/src/vm/Printer.cpp
@@ -260,23 +260,20 @@ Sprinter::reportOutOfMemory()
     hadOOM_ = true;
 }
 
-ptrdiff_t
-Sprint(Sprinter* sp, const char* format, ...)
+bool
+Sprinter::jsprintf(const char* format, ...)
 {
     va_list ap;
-    char* bp;
-    ptrdiff_t offset;
-
     va_start(ap, format);
-    bp = JS_vsmprintf(format, ap);      /* XXX vsaprintf */
+
+    UniquePtr<char, JS::FreePolicy> chars(JS_vsmprintf(format, ap));      /* XXX vsaprintf */
     va_end(ap);
-    if (!bp) {
-        sp->reportOutOfMemory();
-        return -1;
+    if (!chars) {
+        reportOutOfMemory();
+        return false;
     }
-    offset = sp->put(bp);
-    js_free(bp);
-    return offset;
+
+    return put(chars.get()) >= 0;
 }
 
 const char js_EscapeMap[] = {
@@ -299,8 +296,10 @@ QuoteString(Sprinter* sp, const CharT* s, size_t length, char16_t quote)
     /* Sample off first for later return value pointer computation. */
     ptrdiff_t offset = sp->getOffset();
 
-    if (quote && Sprint(sp, "%c", char(quote)) < 0)
-        return nullptr;
+    if (quote) {
+        if (!sp->jsprintf("%c", char(quote)))
+            return nullptr;
+    }
 
     const CharT* end = s + length;
 
@@ -331,7 +330,7 @@ QuoteString(Sprinter* sp, const CharT* s, size_t length, char16_t quote)
         /* Use js_EscapeMap, \u, or \x only if necessary. */
         const char* escape;
         if (!(c >> 8) && c != 0 && (escape = strchr(js_EscapeMap, int(c))) != nullptr) {
-            if (Sprint(sp, "\\%c", escape[1]) < 0)
+            if (!sp->jsprintf("\\%c", escape[1]))
                 return nullptr;
         } else {
             /*
@@ -339,21 +338,25 @@ QuoteString(Sprinter* sp, const CharT* s, size_t length, char16_t quote)
              * because ECMA-262 allows only \u, not \x, in Unicode identifiers
              * (see bug 621814).
              */
-            if (Sprint(sp, (quote && !(c >> 8)) ? "\\x%02X" : "\\u%04X", c) < 0)
+            if (!sp->jsprintf((quote && !(c >> 8)) ? "\\x%02X" : "\\u%04X", c))
                 return nullptr;
         }
     }
 
     /* Sprint the closing quote and return the quoted string. */
-    if (quote && Sprint(sp, "%c", char(quote)) < 0)
-        return nullptr;
+    if (quote) {
+        if (!sp->jsprintf("%c", char(quote)))
+            return nullptr;
+    }
 
     /*
      * If we haven't Sprint'd anything yet, Sprint an empty string so that
      * the return below gives a valid result.
      */
-    if (offset == sp->getOffset() && Sprint(sp, "") < 0)
-        return nullptr;
+    if (offset == sp->getOffset()) {
+        if (sp->put("") < 0)
+            return nullptr;
+    }
 
     return sp->stringAt(offset);
 }
diff --git a/js/src/vm/Printer.h b/js/src/vm/Printer.h
index b64a81aa5987..0cc19c342fcb 100644
--- a/js/src/vm/Printer.h
+++ b/js/src/vm/Printer.h
@@ -111,6 +111,11 @@ class Sprinter final : public GenericPrinter
     virtual int put(const char* s, size_t len) override;
     using GenericPrinter::put; // pick up |inline int put(const char* s);|
 
+    // Format the given format/arguments as if by JS_vsmprintf, then put it.
+    // Return true on success, else return false and report an error (typically
+    // OOM).
+    MOZ_MUST_USE bool jsprintf(const char* fmt, ...);
+
     // Prints a formatted string into the buffer.
     virtual int vprintf(const char* fmt, va_list ap) override;
 
@@ -209,9 +214,6 @@ class LSprinter final : public GenericPrinter
     virtual bool hadOutOfMemory() const override;
 };
 
-extern ptrdiff_t
-Sprint(Sprinter* sp, const char* format, ...);
-
 // Map escaped code to the letter/symbol escaped with a backslash.
 extern const char       js_EscapeMap[];
 

From 96c052cf1f971d8c6abda0bf6b151d2f523cf9b4 Mon Sep 17 00:00:00 2001
From: Aaron Klotz <aklotz@mozilla.com>
Date: Thu, 22 Sep 2016 15:07:01 -0600
Subject: [PATCH 074/102] Bug 1304883: Modify mscom::MainThreadInvoker and
 Win32 widget to use atomic boolean to flag pending APCs; r=jimm

MozReview-Commit-ID: 7fXoDkBEd2V

--HG--
extra : rebase_source : 1960f9bf8294bfea15209554dd7fdc0ce1df5dcc
---
 ipc/mscom/MainThreadInvoker.cpp | 34 +++++++---------------------
 widget/windows/WinUtils.cpp     | 40 ++++++++++++++++++++++++++++++++-
 widget/windows/WinUtils.h       |  4 ++++
 3 files changed, 51 insertions(+), 27 deletions(-)

diff --git a/ipc/mscom/MainThreadInvoker.cpp b/ipc/mscom/MainThreadInvoker.cpp
index 2c6406ae0fc4..9e57d9a29ebc 100644
--- a/ipc/mscom/MainThreadInvoker.cpp
+++ b/ipc/mscom/MainThreadInvoker.cpp
@@ -14,8 +14,7 @@
 #include "mozilla/HangMonitor.h"
 #include "mozilla/RefPtr.h"
 #include "private/prpriv.h" // For PR_GetThreadID
-
-#include <winternl.h> // For NTSTATUS and NTAPI
+#include "WinUtils.h"
 
 namespace {
 
@@ -42,15 +41,12 @@ private:
   nsCOMPtr<nsIRunnable> mRunnable;
 };
 
-typedef NTSTATUS (NTAPI* NtTestAlertPtr)(VOID);
-
 } // anonymous namespace
 
 namespace mozilla {
 namespace mscom {
 
 HANDLE MainThreadInvoker::sMainThread = nullptr;
-StaticRefPtr<nsIRunnable> MainThreadInvoker::sAlertRunnable;
 
 /* static */ bool
 MainThreadInvoker::InitStatics()
@@ -67,25 +63,11 @@ MainThreadInvoker::InitStatics()
   }
   PRUint32 tid = ::PR_GetThreadID(mainPrThread);
   sMainThread = ::OpenThread(SYNCHRONIZE | THREAD_SET_CONTEXT, FALSE, tid);
-  if (!sMainThread) {
-    return false;
-  }
-  NtTestAlertPtr NtTestAlert =
-    reinterpret_cast<NtTestAlertPtr>(
-        ::GetProcAddress(::GetModuleHandleW(L"ntdll.dll"), "NtTestAlert"));
-  sAlertRunnable = ::NS_NewRunnableFunction([NtTestAlert]() -> void {
-    // We're using NtTestAlert() instead of SleepEx() so that the main thread
-    // never gives up its quantum if there are no APCs pending.
-    NtTestAlert();
-  }).take();
-  if (sAlertRunnable) {
-    ClearOnShutdown(&sAlertRunnable);
-  }
-  return !!sAlertRunnable;
+  return !!sMainThread;
 }
 
 MainThreadInvoker::MainThreadInvoker()
-  : mDoneEvent(::CreateEvent(nullptr, FALSE, FALSE, nullptr))
+  : mDoneEvent(::CreateEventW(nullptr, FALSE, FALSE, nullptr))
 {
   static const bool gotStatics = InitStatics();
   MOZ_ASSERT(gotStatics);
@@ -129,11 +111,11 @@ MainThreadInvoker::Invoke(already_AddRefed<nsIRunnable>&& aRunnable,
     wrappedRunnable->Release();
     return false;
   }
-  // We should enqueue a call to NtTestAlert() so that the main thread will
-  // check for APCs during event processing. If we omit this then the main
-  // thread will not check its APC queue until it is idle. Note that failing to
-  // dispatch this event is non-fatal, but it will delay execution of the APC.
-  Unused << NS_WARN_IF(NS_FAILED(NS_DispatchToMainThread(sAlertRunnable)));
+  // We should ensure a call to NtTestAlert() is made on the main thread so
+  // that the main thread will check for APCs during event processing. If we
+  // omit this then the main thread will not check its APC queue until it is
+  // idle.
+  widget::WinUtils::SetAPCPending();
   return WaitForCompletion(aTimeout);
 }
 
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index e44bf79b93d3..66ee0cc412d0 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -452,6 +452,11 @@ struct CoTaskMemFreePolicy
 
 SetThreadDpiAwarenessContextProc WinUtils::sSetThreadDpiAwarenessContext = NULL;
 EnableNonClientDpiScalingProc WinUtils::sEnableNonClientDpiScaling = NULL;
+#ifdef ACCESSIBILITY
+typedef NTSTATUS (NTAPI* NtTestAlertPtr)(VOID);
+static NtTestAlertPtr sNtTestAlert = nullptr;
+#endif
+
 
 /* static */
 void
@@ -486,6 +491,12 @@ WinUtils::Initialize()
         ::GetProcAddress(user32Dll, "SetThreadDpiAwarenessContext");
     }
   }
+
+#ifdef ACCESSIBILITY
+  sNtTestAlert = reinterpret_cast<NtTestAlertPtr>(
+      ::GetProcAddress(::GetModuleHandleW(L"ntdll.dll"), "NtTestAlert"));
+  MOZ_ASSERT(sNtTestAlert);
+#endif
 }
 
 // static
@@ -691,11 +702,31 @@ WinUtils::MonitorFromRect(const gfx::Rect& rect)
   return ::MonitorFromRect(&globalWindowBounds, MONITOR_DEFAULTTONEAREST);
 }
 
+#ifdef ACCESSIBILITY
+#ifndef STATUS_SUCCESS
+#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
+#endif
+
+static Atomic<bool> sAPCPending;
+
+/* static */
+void
+WinUtils::SetAPCPending()
+{
+  sAPCPending = true;
+}
+#endif // ACCESSIBILITY
+
 /* static */
 bool
 WinUtils::PeekMessage(LPMSG aMsg, HWND aWnd, UINT aFirstMessage,
                       UINT aLastMessage, UINT aOption)
 {
+#ifdef ACCESSIBILITY
+  if (NS_IsMainThread() && sAPCPending.exchange(false)) {
+    while (sNtTestAlert() != STATUS_SUCCESS) ;
+  }
+#endif
 #ifdef NS_ENABLE_TSF
   ITfMessagePump* msgPump = TSFTextStore::GetMessagePump();
   if (msgPump) {
@@ -764,14 +795,21 @@ WinUtils::WaitForMessage(DWORD aTimeoutMs)
     if (result == WAIT_TIMEOUT) {
       break;
     }
+#if defined(ACCESSIBILITY)
     if (result == WAIT_IO_COMPLETION) {
       if (NS_IsMainThread()) {
+        if (sAPCPending.exchange(false)) {
+          // Clear out any pending APCs
+          while (sNtTestAlert() != STATUS_SUCCESS) ;
+        }
         // We executed an APC that would have woken up the hang monitor. Since
-        // we're now going to sleep again, we should notify the hang monitor.
+        // there are no more APCs pending and we are now going to sleep again,
+        // we should notify the hang monitor.
         mozilla::HangMonitor::Suspend();
       }
       continue;
     }
+#endif // defined(ACCESSIBILITY)
 
     // Sent messages (via SendMessage and friends) are processed differently
     // than queued messages (via PostMessage); the destination window procedure
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index 299f9bad1e40..69d73528cb7f 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -519,6 +519,10 @@ public:
    */
   static bool GetAppInitDLLs(nsAString& aOutput);
 
+#ifdef ACCESSIBILITY
+  static void SetAPCPending();
+#endif
+
 private:
   typedef HRESULT (WINAPI * SHCreateItemFromParsingNamePtr)(PCWSTR pszPath,
                                                             IBindCtx *pbc,

From a47ce92ac2266eb80591193fa3009a9de04e8bbb Mon Sep 17 00:00:00 2001
From: James Andreou <jandreou25@gmail.com>
Date: Tue, 30 Aug 2016 17:54:58 -0400
Subject: [PATCH 075/102] Bug 1282124 - Remove nsILoadInfo.usePrivateBrowsing
 and the SEC_FORCE_PRIVATE_BROWSING flag; r=smaug,jryans

---
 devtools/shared/DevToolsUtils.js           | 70 ++++++++++------------
 docshell/base/nsDocShell.cpp               |  4 --
 dom/html/HTMLMediaElement.cpp              | 10 ----
 image/imgLoader.cpp                        | 20 +++++--
 image/imgLoader.h                          |  3 -
 image/test/unit/test_private_channel.js    | 15 +++--
 netwerk/base/LoadInfo.cpp                  | 43 +++++--------
 netwerk/base/nsILoadInfo.idl               | 18 +-----
 netwerk/base/nsNetUtil.cpp                 | 17 +-----
 netwerk/protocol/http/HttpChannelChild.cpp |  3 -
 netwerk/test/unit/test_cacheflags.js       | 25 ++++----
 11 files changed, 91 insertions(+), 137 deletions(-)

diff --git a/devtools/shared/DevToolsUtils.js b/devtools/shared/DevToolsUtils.js
index 1cecf6159e77..d44184fd6b8e 100644
--- a/devtools/shared/DevToolsUtils.js
+++ b/devtools/shared/DevToolsUtils.js
@@ -380,7 +380,8 @@ exports.defineLazyGetter(this, "NetworkHelper", () => {
  *        - window: the window to get the loadGroup from
  *        - charset: the charset to use if the channel doesn't provide one
  *        - principal: the principal to use, if omitted, the request is loaded
- *                     with the system principal
+ *                     with a codebase principal corresponding to the url being
+ *                     loaded, using the origin attributes of the window, if any.
  *        - cacheKey: when loading from cache, use this key to retrieve a cache
  *                    specific to a given SHEntry. (Allows loading POST
  *                    requests from cache)
@@ -526,51 +527,44 @@ function mainThreadFetch(aURL, aOptions = { loadFromCache: true,
  */
 function newChannelForURL(url, { policy, window, principal }) {
   var securityFlags = Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL;
-  if (window) {
-    // Respect private browsing.
-    var req = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                    .getInterface(Ci.nsIWebNavigation)
-                    .QueryInterface(Ci.nsIDocumentLoader)
-                    .loadGroup;
-    if (req) {
-      var nc = req.notificationCallbacks;
-      if (nc) {
-        try {
-          var lc = nc.getInterface(Ci.nsILoadContext);
-          if (lc) {
-            if (lc.usePrivateBrowsing) {
-              securityFlags |= Ci.nsILoadInfo.SEC_FORCE_PRIVATE_BROWSING;
-            }
-          }
-        } catch (ex) {}
-      }
-    }
-  }
-
-  let channelOptions = {
-    contentPolicyType: policy,
-    securityFlags: securityFlags,
-    uri: url
-  };
-  if (principal) {
-    // contentPolicyType is required when loading with a custom principal
-    if (!channelOptions.contentPolicyType) {
-      channelOptions.contentPolicyType = Ci.nsIContentPolicy.TYPE_OTHER;
-    }
-    channelOptions.loadingPrincipal = principal;
-  } else {
-    channelOptions.loadUsingSystemPrincipal = true;
-  }
 
+  let uri;
   try {
-    return NetUtil.newChannel(channelOptions);
+    uri = Services.io.newURI(url, null, null);
   } catch (e) {
     // In the xpcshell tests, the script url is the absolute path of the test
     // file, which will make a malformed URI error be thrown. Add the file
     // scheme to see if it helps.
-    channelOptions.uri = "file://" + url;
+    uri = Services.io.newURI("file://" + url, null, null);
+  }
+  let channelOptions = {
+    contentPolicyType: policy,
+    securityFlags: securityFlags,
+    uri: uri
+  };
+  let prin = principal;
+  if (!prin) {
+    let oa = {};
+    if (window) {
+      oa = window.document.nodePrincipal.originAttributes;
+    }
+    prin = Services.scriptSecurityManager
+                   .createCodebasePrincipal(uri, oa);
+  }
+  // contentPolicyType is required when specifying a principal
+  if (!channelOptions.contentPolicyType) {
+    channelOptions.contentPolicyType = Ci.nsIContentPolicy.TYPE_OTHER;
+  }
+  channelOptions.loadingPrincipal = prin;
 
+  try {
     return NetUtil.newChannel(channelOptions);
+  } catch (e) {
+    // In xpcshell tests on Windows, nsExternalProtocolHandler::NewChannel()
+    // can throw NS_ERROR_UNKNOWN_PROTOCOL if the external protocol isn't
+    // supported by Windows, so we also need to handle the exception here if
+    // parsing the URL above doesn't throw.
+    return newChannelForURL("file://" + url, { policy, window, principal });
   }
 }
 
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index dde9ad47da8e..7288de9bb256 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -10857,10 +10857,6 @@ nsDocShell::DoURILoad(nsIURI* aURI,
     securityFlags |= nsILoadInfo::SEC_SANDBOXED;
   }
 
-  if (UsePrivateBrowsing()) {
-    securityFlags |= nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING;
-  }
-
   nsCOMPtr<nsILoadInfo> loadInfo =
     (aContentPolicyType == nsIContentPolicy::TYPE_DOCUMENT) ?
       new LoadInfo(loadingWindow, triggeringPrincipal,
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index c96a5fb12fb3..3bccb6e0f800 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -565,16 +565,6 @@ public:
       ? nsIContentPolicy::TYPE_INTERNAL_AUDIO :
         nsIContentPolicy::TYPE_INTERNAL_VIDEO;
 
-    nsCOMPtr<nsIDocShell> docShell = aElement->OwnerDoc()->GetDocShell();
-    if (docShell) {
-      nsDocShell* docShellPtr = nsDocShell::Cast(docShell);
-      bool privateBrowsing;
-      docShellPtr->GetUsePrivateBrowsing(&privateBrowsing);
-      if (privateBrowsing) {
-        securityFlags |= nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING;
-      }
-    }
-
     nsCOMPtr<nsILoadGroup> loadGroup = aElement->GetDocumentLoadGroup();
     nsCOMPtr<nsIChannel> channel;
     nsresult rv = NS_NewChannel(getter_AddRefs(channel),
diff --git a/image/imgLoader.cpp b/image/imgLoader.cpp
index 1e9ebf9a4f47..71515a1e8480 100644
--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -729,10 +729,6 @@ NewImageChannel(nsIChannel** aResult,
   }
   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 
-  if (aRespectPrivacy) {
-    securityFlags |= nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING;
-  }
-
   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
   // node and a principal. This is for things like background images that are
   // specified by user stylesheets, where the document is being styled, but
@@ -763,6 +759,22 @@ NewImageChannel(nsIChannel** aResult,
                        nullptr,   // loadGroup
                        callbacks,
                        aLoadFlags);
+
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+
+    // Use the OriginAttributes from the loading principal, if one is available,
+    // and adjust the private browsing ID based on what kind of load the caller
+    // has asked us to perform.
+    NeckoOriginAttributes neckoAttrs;
+    if (aLoadingPrincipal) {
+      neckoAttrs.InheritFromDocToNecko(BasePrincipal::Cast(aLoadingPrincipal)->OriginAttributesRef());
+    }
+    neckoAttrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
+
+    nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->GetLoadInfo();
+    rv = loadInfo->SetOriginAttributes(neckoAttrs);
   }
 
   if (NS_FAILED(rv)) {
diff --git a/image/imgLoader.h b/image/imgLoader.h
index 9bff3a82ec0b..20022cd0c2fd 100644
--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -255,9 +255,6 @@ public:
   /**
    * Get the Private Browsing image loader instance that is used by gecko code,
    * creating it if necessary.
-   *
-   * The nsIChannel objects that this instance creates are created with the
-   * nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING flag.
    */
   static imgLoader* PrivateBrowsingLoader();
 
diff --git a/image/test/unit/test_private_channel.js b/image/test/unit/test_private_channel.js
index bf20af59526f..960d6d69bd21 100644
--- a/image/test/unit/test_private_channel.js
+++ b/image/test/unit/test_private_channel.js
@@ -33,6 +33,7 @@ var requests = [];
 var listeners = [];
 
 function NotificationCallbacks(isPrivate) {
+  this.originAttributes.privateBrowsingId = isPrivate ? 1 : 0;
   this.usePrivateBrowsing = isPrivate;
 }
 
@@ -48,7 +49,9 @@ NotificationCallbacks.prototype = {
       return this;
     throw Cr.NS_ERROR_NO_INTERFACE;
   },
-  originAttributes: {}
+  originAttributes: {
+    privateBrowsingId: 0
+  }
 };
 
 var gImgPath = 'http://localhost:' + server.identity.primaryPort + '/image.png';
@@ -56,11 +59,11 @@ var gImgPath = 'http://localhost:' + server.identity.primaryPort + '/image.png';
 function setup_chan(path, isPrivate, callback) {
   var uri = NetUtil.newURI(gImgPath);
   var securityFlags = Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL;
-  if (isPrivate) {
-    securityFlags |= Ci.nsILoadInfo.SEC_FORCE_PRIVATE_BROWSING;
-  }
-  var chan =  NetUtil.newChannel({uri: uri, loadUsingSystemPrincipal: true,
-                                  securityFlags: securityFlags});
+  var principal = Services.scriptSecurityManager
+                          .createCodebasePrincipal(uri, {privateBrowsingId: isPrivate ? 1 : 0});
+  var chan =  NetUtil.newChannel({uri: uri, loadingPrincipal: principal,
+                                  securityFlags: securityFlags,
+                                  contentPolicyType: Ci.nsIContentPolicy.TYPE_INTERNAL_IMAGE});
   chan.notificationCallbacks = new NotificationCallbacks(isPrivate);
   var channelListener = new ChannelListener();
   chan.asyncOpen2(channelListener);
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 4453faaddc08..1617fd84c10b 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -177,31 +177,31 @@ LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
       }
     }
 
-  if (!(mSecurityFlags & nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING)) {
-    if (aLoadingContext) {
-      nsCOMPtr<nsILoadContext> loadContext =
-        aLoadingContext->OwnerDoc()->GetLoadContext();
-      if (loadContext) {
-        bool usePrivateBrowsing;
-        nsresult rv = loadContext->GetUsePrivateBrowsing(&usePrivateBrowsing);
-        if (NS_SUCCEEDED(rv) && usePrivateBrowsing) {
-          mSecurityFlags |= nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING;
-        }
+  InheritOriginAttributes(mLoadingPrincipal, mOriginAttributes);
+
+  // We need to do this after inheriting the document's origin attributes
+  // above, in case the loading principal ends up being the system principal.
+  if (aLoadingContext) {
+    nsCOMPtr<nsILoadContext> loadContext =
+      aLoadingContext->OwnerDoc()->GetLoadContext();
+    nsCOMPtr<nsIDocShell> docShell = aLoadingContext->OwnerDoc()->GetDocShell();
+    if (loadContext && docShell &&
+        docShell->ItemType() == nsIDocShellTreeItem::typeContent) {
+      bool usePrivateBrowsing;
+      nsresult rv = loadContext->GetUsePrivateBrowsing(&usePrivateBrowsing);
+      if (NS_SUCCEEDED(rv)) {
+        mOriginAttributes.SyncAttributesWithPrivateBrowsing(usePrivateBrowsing);
       }
     }
   }
 
-  InheritOriginAttributes(mLoadingPrincipal, mOriginAttributes);
-
   // For chrome docshell, the mPrivateBrowsingId remains 0 even its
   // UsePrivateBrowsing() is true, so we only update the mPrivateBrowsingId in
   // origin attributes if the type of the docshell is content.
   if (aLoadingContext) {
     nsCOMPtr<nsIDocShell> docShell = aLoadingContext->OwnerDoc()->GetDocShell();
     if (docShell) {
-      if (docShell->ItemType() == nsIDocShellTreeItem::typeContent) {
-        mOriginAttributes.SyncAttributesWithPrivateBrowsing(GetUsePrivateBrowsing());
-      } else if (docShell->ItemType() == nsIDocShellTreeItem::typeChrome) {
+      if (docShell->ItemType() == nsIDocShellTreeItem::typeChrome) {
         MOZ_ASSERT(mOriginAttributes.mPrivateBrowsingId == 0,
                    "chrome docshell shouldn't have mPrivateBrowsingId set.");
       }
@@ -264,10 +264,7 @@ LoadInfo::LoadInfo(nsPIDOMWindowOuter* aOuterWindow,
   const DocShellOriginAttributes attrs =
     nsDocShell::Cast(docShell)->GetOriginAttributes();
 
-  if (docShell->ItemType() == nsIDocShellTreeItem::typeContent) {
-    MOZ_ASSERT(GetUsePrivateBrowsing() == (attrs.mPrivateBrowsingId != 0),
-               "docshell and mSecurityFlags have different value for PrivateBrowsing().");
-  } else if (docShell->ItemType() == nsIDocShellTreeItem::typeChrome) {
+  if (docShell->ItemType() == nsIDocShellTreeItem::typeChrome) {
     MOZ_ASSERT(attrs.mPrivateBrowsingId == 0,
                "chrome docshell shouldn't have mPrivateBrowsingId set.");
   }
@@ -586,14 +583,6 @@ LoadInfo::GetDontFollowRedirects(bool* aResult)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-LoadInfo::GetUsePrivateBrowsing(bool* aUsePrivateBrowsing)
-{
-  *aUsePrivateBrowsing = (mSecurityFlags &
-                          nsILoadInfo::SEC_FORCE_PRIVATE_BROWSING);
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 LoadInfo::GetLoadErrorPage(bool* aResult)
 {
diff --git a/netwerk/base/nsILoadInfo.idl b/netwerk/base/nsILoadInfo.idl
index 9770490b6444..fa66bf3792a2 100644
--- a/netwerk/base/nsILoadInfo.idl
+++ b/netwerk/base/nsILoadInfo.idl
@@ -174,20 +174,11 @@ interface nsILoadInfo : nsISupports
    */
   const unsigned long SEC_DONT_FOLLOW_REDIRECTS = (1<<12);
 
-  /**
-   * Force private browsing. Setting this flag the private browsing can be
-   * enforce even when a loading is not happening in the context of a document.
-   *
-   * If the flag is true, even if a document context is present,
-   * GetUsePrivateBrowsing will always return true.
-   */
-  const unsigned long SEC_FORCE_PRIVATE_BROWSING = (1<<13);
-
   /**
    * Load an error page, it should be one of following : about:neterror,
    * about:certerror, about:blocked, or about:tabcrashed.
    */
-  const unsigned long SEC_LOAD_ERROR_PAGE = (1<<14);
+  const unsigned long SEC_LOAD_ERROR_PAGE = (1<<13);
 
   /**
    * This is the principal of the network request's caller/requester where
@@ -350,13 +341,6 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] readonly attribute boolean aboutBlankInherits;
 
-  /**
-   * If usePrivateBrowsing is true, private browsing will be used.
-   * This value equals to originAttributes.privateBrowsingId in *content*
-   * side.
-   */
-  [infallible] readonly attribute boolean usePrivateBrowsing;
-
   /**
    * If allowChrome is true, then use nsIScriptSecurityManager::ALLOW_CHROME
    * when calling CheckLoadURIWithPrincipal().
diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
index 39fa8a2ccab7..ca777cde8e37 100644
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -2424,21 +2424,12 @@ NS_CompareLoadInfoAndLoadContext(nsIChannel *aChannel)
   DocShellOriginAttributes originAttrsLoadContext;
   loadContext->GetOriginAttributes(originAttrsLoadContext);
 
-  bool loadInfoUsePB = loadInfo->GetUsePrivateBrowsing();
-  bool loadContextUsePB = false;
-  rv = loadContext->GetUsePrivateBrowsing(&loadContextUsePB);
-  if (NS_FAILED(rv)) {
-    return NS_ERROR_UNEXPECTED;
-  }
-
-  LOG(("NS_CompareLoadInfoAndLoadContext - loadInfo: %d, %d, %d, %d, %d; "
-       "loadContext: %d %d, %d, %d, %d. [channel=%p]",
+  LOG(("NS_CompareLoadInfoAndLoadContext - loadInfo: %d, %d, %d, %d; "
+       "loadContext: %d %d, %d, %d. [channel=%p]",
        originAttrsLoadInfo.mAppId, originAttrsLoadInfo.mInIsolatedMozBrowser,
        originAttrsLoadInfo.mUserContextId, originAttrsLoadInfo.mPrivateBrowsingId,
-       loadInfoUsePB,
        loadContextAppId, loadContextIsInBE,
        originAttrsLoadContext.mUserContextId, originAttrsLoadContext.mPrivateBrowsingId,
-       loadContextUsePB,
        aChannel));
 
   MOZ_ASSERT(originAttrsLoadInfo.mAppId == loadContextAppId,
@@ -2460,10 +2451,6 @@ NS_CompareLoadInfoAndLoadContext(nsIChannel *aChannel)
              "The value of mPrivateBrowsingId in the loadContext and in the "
              "loadInfo are not the same!");
 
-  MOZ_ASSERT(loadInfoUsePB == loadContextUsePB,
-             "The value of usePrivateBrowsing in the loadContext and in the loadInfo "
-             "are not the same!");
-
   return NS_OK;
 }
 
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 1272010194ed..1ea1fac720a1 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -1795,9 +1795,6 @@ HttpChannelChild::AsyncOpen(nsIStreamListener *listener, nsISupports *aContext)
 
   LOG(("HttpChannelChild::AsyncOpen [this=%p uri=%s]\n", this, mSpec.get()));
 
-  MOZ_ASSERT(mLoadInfo->GetUsePrivateBrowsing() == (mLoadInfo->GetOriginAttributes().mPrivateBrowsingId != 0),
-             "PrivateBrowsing mismatch on LoadInfo.");
-
 #ifdef DEBUG
   CheckPrivateBrowsing();
 #endif
diff --git a/netwerk/test/unit/test_cacheflags.js b/netwerk/test/unit/test_cacheflags.js
index 65fd347fe80a..28c24b14c4ef 100644
--- a/netwerk/test/unit/test_cacheflags.js
+++ b/netwerk/test/unit/test_cacheflags.js
@@ -1,5 +1,6 @@
 Cu.import("resource://testing-common/httpd.js");
 Cu.import("resource://gre/modules/NetUtil.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 
 var httpserver = new HttpServer();
 httpserver.start(-1);
@@ -23,7 +24,9 @@ function LoadContext(usePrivateBrowsing) {
 }
 
 LoadContext.prototype = {
-  originAttributes: {},
+  originAttributes: {
+    privateBrowsingId : 0
+  },
   usePrivateBrowsing: false,
   // don't bother defining rest of nsILoadContext fields: don't need 'em
 
@@ -38,24 +41,26 @@ LoadContext.prototype = {
       return this;
     throw Cr.NS_ERROR_NO_INTERFACE;
   },
-
-  originAttributes: {}
 };
 
-PrivateBrowsingLoadContext = new LoadContext(true);
+var PrivateBrowsingLoadContext = new LoadContext(true);
 
 function make_channel(url, flags, usePrivateBrowsing) {
   var securityFlags = Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL;
-  if (usePrivateBrowsing) {
-    securityFlags |= Ci.nsILoadInfo.SEC_FORCE_PRIVATE_BROWSING;
-  }
-  var req = NetUtil.newChannel({uri: url, loadUsingSystemPrincipal: true,
-                                securityFlags: securityFlags});
+
+  var uri = Services.io.newURI(url, null, null);
+  var principal = Services.scriptSecurityManager.createCodebasePrincipal(uri,
+    { privateBrowsingId : usePrivateBrowsing ? 1 : 0 });
+
+  var req = NetUtil.newChannel({uri: uri,
+                                loadingPrincipal: principal,
+                                securityFlags: securityFlags,
+                                contentPolicyType: Ci.nsIContentPolicy.TYPE_OTHER});
+
   req.loadFlags = flags;
   if (usePrivateBrowsing) {
     req.notificationCallbacks = PrivateBrowsingLoadContext;
   }
-  req.loadInfo.originAttributes = {privateBrowsingId: usePrivateBrowsing ? 1 : 0};
   return req;
 }
 

From 318e608e5789a5fb3bfa0948848c8ec0706b8abd Mon Sep 17 00:00:00 2001
From: Matthew Gregan <kinetik@flim.org>
Date: Tue, 27 Sep 2016 13:09:21 +1300
Subject: [PATCH 076/102] Bug 1305596 - Convert debug-only asserts added in bug
 1303247 to release asserts.  r=rillian

---
 media/libstagefright/binding/MP4Metadata.cpp | 35 ++++++++++----------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/media/libstagefright/binding/MP4Metadata.cpp b/media/libstagefright/binding/MP4Metadata.cpp
index f4f43b410942..f29ac29c061d 100644
--- a/media/libstagefright/binding/MP4Metadata.cpp
+++ b/media/libstagefright/binding/MP4Metadata.cpp
@@ -282,30 +282,31 @@ MP4Metadata::GetTrackInfo(mozilla::TrackInfo::TrackType aType,
 
 #ifndef RELEASE_BUILD
   if (mRustTestMode && info) {
-    MOZ_ASSERT(infoRust);
-    MOZ_ASSERT(infoRust->mId == info->mId);
-    MOZ_ASSERT(infoRust->mKind == info->mKind);
-    MOZ_ASSERT(infoRust->mLabel == info->mLabel);
-    MOZ_ASSERT(infoRust->mLanguage == info->mLanguage);
-    MOZ_ASSERT(infoRust->mEnabled == info->mEnabled);
-    MOZ_ASSERT(infoRust->mTrackId == info->mTrackId);
-    MOZ_ASSERT(infoRust->mMimeType == info->mMimeType);
-    MOZ_ASSERT(infoRust->mDuration == info->mDuration);
-    MOZ_ASSERT(infoRust->mMediaTime == info->mMediaTime);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mId == info->mId);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mKind == info->mKind);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mLabel == info->mLabel);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mLanguage == info->mLanguage);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mEnabled == info->mEnabled);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mTrackId == info->mTrackId);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mMimeType == info->mMimeType);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mDuration == info->mDuration);
+    MOZ_DIAGNOSTIC_ASSERT(infoRust->mMediaTime == info->mMediaTime);
     switch (aType) {
     case mozilla::TrackInfo::kAudioTrack: {
       AudioInfo *audioRust = infoRust->GetAsAudioInfo(), *audio = info->GetAsAudioInfo();
-      MOZ_ASSERT(audioRust->mRate == audio->mRate);
-      MOZ_ASSERT(audioRust->mChannels == audio->mChannels);
-      MOZ_ASSERT(audioRust->mBitDepth == audio->mBitDepth);
-      //MOZ_ASSERT(audioRust->mProfile == audio->mProfile);
-      //MOZ_ASSERT(audioRust->mExtendedProfile == audio->mExtendedProfile);
+      MOZ_DIAGNOSTIC_ASSERT(audioRust->mRate == audio->mRate);
+      MOZ_DIAGNOSTIC_ASSERT(audioRust->mChannels == audio->mChannels);
+      MOZ_DIAGNOSTIC_ASSERT(audioRust->mBitDepth == audio->mBitDepth);
+      // TODO: These fields aren't implemented in the Rust demuxer yet.
+      //MOZ_DIAGNOSTIC_ASSERT(audioRust->mProfile != audio->mProfile);
+      //MOZ_DIAGNOSTIC_ASSERT(audioRust->mExtendedProfile != audio->mExtendedProfile);
       break;
     }
     case mozilla::TrackInfo::kVideoTrack: {
       VideoInfo *videoRust = infoRust->GetAsVideoInfo(), *video = info->GetAsVideoInfo();
-      MOZ_ASSERT(videoRust->mDisplay == video->mDisplay);
-      MOZ_ASSERT(videoRust->mImage == video->mImage);
+      MOZ_DIAGNOSTIC_ASSERT(videoRust->mDisplay == video->mDisplay);
+      MOZ_DIAGNOSTIC_ASSERT(videoRust->mImage == video->mImage);
       break;
     }
     default:

From de2a95a064ba76a101dd849dae4e0feb45baefdd Mon Sep 17 00:00:00 2001
From: Matthew Gregan <kinetik@flim.org>
Date: Wed, 28 Sep 2016 10:07:47 +1300
Subject: [PATCH 077/102] Bug 1305604 - Convert dashes to underscores in crate
 name when generating --extern option.  r=froydnj

---
 python/mozbuild/mozbuild/backend/recursivemake.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 30ef77284ff4..a681e7a47d01 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -1274,7 +1274,7 @@ class RecursiveMakeBackend(CommonBackend):
             for rlib in rlibs:
                 rlib_relpath = pretty_relpath(rlib)
                 backend_file.write('RUST_PRELINK_FLAGS += --extern %s=%s/%s\n'
-                                   % (rlib.basename, rlib_relpath, rlib.import_name))
+                                   % (rlib.basename.replace('-', '_'), rlib_relpath, rlib.import_name))
                 backend_file.write('RUST_PRELINK_FLAGS += -L %s/%s\n'
                                    % (rlib_relpath, rlib.deps_path))
                 backend_file.write('RUST_PRELINK_DEPS += %s/%s\n'

From a026f5edf997e9789704f90e0c8ddc5381287ecd Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 27 Sep 2016 23:21:47 +0200
Subject: [PATCH 078/102] Backed out changeset 7bcb0c169466 (bug 1305628) for
 crashing with mozilla::OffTheBooksMutex::Lock. r=backout

---
 gfx/ipc/RemoteCompositorSession.cpp             |  1 -
 widget/nsBaseWidget.cpp                         | 16 +++++++---------
 widget/windows/InProcessWinCompositorWidget.cpp |  5 ++---
 3 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/gfx/ipc/RemoteCompositorSession.cpp b/gfx/ipc/RemoteCompositorSession.cpp
index 8ebcc88e6f84..0ccabaaa7ed8 100644
--- a/gfx/ipc/RemoteCompositorSession.cpp
+++ b/gfx/ipc/RemoteCompositorSession.cpp
@@ -5,7 +5,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "RemoteCompositorSession.h"
-#include "mozilla/VsyncDispatcher.h"
 #include "mozilla/layers/APZChild.h"
 #include "mozilla/layers/APZCTreeManagerChild.h"
 #include "nsBaseWidget.h"
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index c5b5538cfa99..129cd91af61a 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -260,15 +260,6 @@ nsBaseWidget::Shutdown()
 
 void nsBaseWidget::DestroyCompositor()
 {
-  // We release this before releasing the compositor, since it may hold the
-  // last reference to our ClientLayerManager. ClientLayerManager's dtor can
-  // trigger a paint, creating a new compositor, and we don't want to re-use
-  // the old vsync dispatcher.
-  if (mCompositorVsyncDispatcher) {
-    mCompositorVsyncDispatcher->Shutdown();
-    mCompositorVsyncDispatcher = nullptr;
-  }
-
   // The compositor shutdown sequence looks like this:
   //  1. CompositorSession calls CompositorBridgeChild::Destroy.
   //  2. CompositorBridgeChild synchronously sends WillClose.
@@ -293,6 +284,13 @@ void nsBaseWidget::DestroyCompositor()
     RefPtr<CompositorSession> session = mCompositorSession.forget();
     session->Shutdown();
   }
+
+  // Can have base widgets that are things like tooltips
+  // which don't have CompositorVsyncDispatchers
+  if (mCompositorVsyncDispatcher) {
+    mCompositorVsyncDispatcher->Shutdown();
+    mCompositorVsyncDispatcher = nullptr;
+  }
 }
 
 void nsBaseWidget::ReleaseContentController()
diff --git a/widget/windows/InProcessWinCompositorWidget.cpp b/widget/windows/InProcessWinCompositorWidget.cpp
index 685eaf5ca62c..f88c94ac161d 100644
--- a/widget/windows/InProcessWinCompositorWidget.cpp
+++ b/widget/windows/InProcessWinCompositorWidget.cpp
@@ -32,9 +32,8 @@ InProcessWinCompositorWidget::RealWidget()
 void
 InProcessWinCompositorWidget::ObserveVsync(VsyncObserver* aObserver)
 {
-  if (RefPtr<CompositorVsyncDispatcher> cvd = mWindow->GetCompositorVsyncDispatcher()) {
-    cvd->SetCompositorVsyncObserver(aObserver);
-  }
+  RefPtr<CompositorVsyncDispatcher> cvd = mWindow->GetCompositorVsyncDispatcher();
+  cvd->SetCompositorVsyncObserver(aObserver);
 }
 
 } // namespace widget

From 792cfa85a277afae6de9805a386da2cc74e78236 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Tue, 27 Sep 2016 14:22:25 -0700
Subject: [PATCH 079/102] Bug 1269722 - Add a missing #include for non-unified.
  r=bustage

--HG--
extra : rebase_source : 6eb14e043d0fedfb79bca6e2c8013e8216dd5ac9
---
 js/src/vm/Printer.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/vm/Printer.h b/js/src/vm/Printer.h
index 0cc19c342fcb..ae70d59fa114 100644
--- a/js/src/vm/Printer.h
+++ b/js/src/vm/Printer.h
@@ -12,6 +12,7 @@
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
+#include <string.h>
 
 class JSString;
 

From 2e88e8e508d6879bcfb33487b276bd18d3ebfe00 Mon Sep 17 00:00:00 2001
From: Edwin Flores <eflores@mozilla.com>
Date: Tue, 27 Sep 2016 19:52:17 +0100
Subject: [PATCH 080/102] Bug 1306234 - Back out changeset f7aeb4b3ccb1 (bug
 1279398) for causing top crashes. r=edwin

--HG--
extra : rebase_source : 24aee74e09242f1cae18a1df48654268a2e91769
---
 gfx/thebes/gfxASurface.cpp |  2 +-
 gfx/thebes/gfxASurface.h   | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/gfx/thebes/gfxASurface.cpp b/gfx/thebes/gfxASurface.cpp
index 18831d8443cb..31f185596507 100644
--- a/gfx/thebes/gfxASurface.cpp
+++ b/gfx/thebes/gfxASurface.cpp
@@ -171,7 +171,7 @@ gfxASurface::Wrap (cairo_surface_t *csurf, const IntSize& aSize)
     }
 #endif
     else {
-        MOZ_CRASH("Unknown cairo surface type");
+        result = new gfxUnknownSurface(csurf, aSize);
     }
 
     // fprintf(stderr, "New wrapper for %p -> %p\n", csurf, result);
diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 3e0818e4532a..ca7535e5607d 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -183,4 +183,22 @@ protected:
     bool mSurfaceValid;
 };
 
+/**
+ * An Unknown surface; used to wrap unknown cairo_surface_t returns from cairo
+ */
+class gfxUnknownSurface : public gfxASurface {
+public:
+    gfxUnknownSurface(cairo_surface_t *surf, const mozilla::gfx::IntSize& aSize)
+        : mSize(aSize)
+    {
+        Init(surf, true);
+    }
+
+    virtual ~gfxUnknownSurface() { }
+    virtual const mozilla::gfx::IntSize GetSize() const override { return mSize; }
+
+private:
+    mozilla::gfx::IntSize mSize;
+};
+
 #endif /* GFX_ASURFACE_H */

From 705201543914b424a9f4f724d89e1e94eb7f2651 Mon Sep 17 00:00:00 2001
From: Lee Salzman <lsalzman@mozilla.com>
Date: Tue, 27 Sep 2016 12:28:57 -0400
Subject: [PATCH 081/102] Bug 1304195 - silence warnings from
 ScopedXErrorHandler when used off main thread if acknowledged. r=nical

MozReview-Commit-ID: 34LaghDR15f
---
 gfx/gl/GLContextProviderGLX.cpp |  4 ++--
 gfx/src/X11Util.cpp             | 10 ++++++----
 gfx/src/X11Util.h               | 14 +++++++++++++-
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/gfx/gl/GLContextProviderGLX.cpp b/gfx/gl/GLContextProviderGLX.cpp
index 03df3c6d7014..9a1157f330cb 100644
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@@ -823,7 +823,7 @@ GLContextGLX::CreateGLContext(CreateContextFlags flags, const SurfaceCaps& caps,
     RefPtr<GLContextGLX> glContext;
     bool error;
 
-    ScopedXErrorHandler xErrorHandler;
+    OffMainThreadScopedXErrorHandler xErrorHandler;
 
     do {
         error = false;
@@ -1311,7 +1311,7 @@ CreateOffscreenPixmapContext(CreateContextFlags flags, const IntSize& size,
     int depth;
     FindVisualAndDepth(display, visid, &visual, &depth);
 
-    ScopedXErrorHandler xErrorHandler;
+    OffMainThreadScopedXErrorHandler xErrorHandler;
     bool error = false;
 
     Drawable drawable;
diff --git a/gfx/src/X11Util.cpp b/gfx/src/X11Util.cpp
index e1492be54511..7dd02d2fd7a8 100644
--- a/gfx/src/X11Util.cpp
+++ b/gfx/src/X11Util.cpp
@@ -57,13 +57,15 @@ ScopedXErrorHandler::ErrorHandler(Display *, XErrorEvent *ev)
     return 0;
 }
 
-ScopedXErrorHandler::ScopedXErrorHandler()
+ScopedXErrorHandler::ScopedXErrorHandler(bool aAllowOffMainThread)
 {
-    // Off main thread usage is not safe in general, but OMTC GL layers uses this
-    // with the main thread blocked, which makes it safe.
-    NS_WARNING_ASSERTION(
+    if (!aAllowOffMainThread) {
+      // Off main thread usage is not safe in general, but OMTC GL layers uses this
+      // with the main thread blocked, which makes it safe.
+      NS_WARNING_ASSERTION(
         NS_IsMainThread(),
         "ScopedXErrorHandler being called off main thread, may cause issues");
+    }
     // let sXErrorPtr point to this object's mXError object, but don't reset this mXError object!
     // think of the case of nested ScopedXErrorHandler's.
     mOldXErrorPtr = sXErrorPtr;
diff --git a/gfx/src/X11Util.h b/gfx/src/X11Util.h
index dff855ff23f9..e04913342d93 100644
--- a/gfx/src/X11Util.h
+++ b/gfx/src/X11Util.h
@@ -118,7 +118,10 @@ public:
     static int
     ErrorHandler(Display *, XErrorEvent *ev);
 
-    ScopedXErrorHandler();
+    /**
+     * @param aAllowOffMainThread whether to warn if used off main thread
+     */
+    explicit ScopedXErrorHandler(bool aAllowOffMainThread = false);
 
     ~ScopedXErrorHandler();
 
@@ -131,6 +134,15 @@ public:
     bool SyncAndGetError(Display *dpy, XErrorEvent *ev = nullptr);
 };
 
+class OffMainThreadScopedXErrorHandler : public ScopedXErrorHandler
+{
+public:
+  OffMainThreadScopedXErrorHandler()
+    : ScopedXErrorHandler(true)
+  {
+  }
+};
+
 } // namespace mozilla
 
 #endif  // mozilla_X11Util_h

From 632d270fe0df43943321f5cd5c7ae79ffd23955b Mon Sep 17 00:00:00 2001
From: Lee Salzman <lsalzman@mozilla.com>
Date: Tue, 27 Sep 2016 17:31:13 -0400
Subject: [PATCH 082/102] Bug 1305312 - write putImageData pixels as opaque for
 opaque canvas. r=jrmuizel

MozReview-Commit-ID: 5mVzeNwY28u
---
 dom/canvas/CanvasRenderingContext2D.cpp | 6 ++++--
 dom/canvas/crashtests/1305312-1.html    | 5 +++++
 dom/canvas/crashtests/crashtests.list   | 1 +
 3 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 dom/canvas/crashtests/1305312-1.html

diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index c7e5122b5a5c..644203797d70 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -5768,6 +5768,8 @@ CanvasRenderingContext2D::PutImageData_explicit(int32_t aX, int32_t aY, uint32_t
   //uint8_t *src = aArray->Data();
   uint8_t *dst = imgsurf->Data();
   uint8_t* srcLine = aArray->Data() + copyY * (aW * 4) + copyX * 4;
+  // For opaque canvases, we must still premultiply the RGB components, but write the alpha as opaque.
+  uint8_t alphaMask = mOpaque ? 255 : 0;
 #if 0
   printf("PutImageData_explicit: dirty x=%d y=%d w=%d h=%d copy x=%d y=%d w=%d h=%d ext x=%d y=%d w=%d h=%d\n",
        dirtyRect.x, dirtyRect.y, copyWidth, copyHeight,
@@ -5787,9 +5789,9 @@ CanvasRenderingContext2D::PutImageData_explicit(int32_t aX, int32_t aY, uint32_t
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + b];
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + g];
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + r];
-      *dst++ = a;
+      *dst++ = a | alphaMask;
 #else
-      *dst++ = a;
+      *dst++ = a | alphaMask;
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + r];
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + g];
       *dst++ = gfxUtils::sPremultiplyTable[a * 256 + b];
diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html
new file mode 100644
index 000000000000..3bd0b8c00424
--- /dev/null
+++ b/dom/canvas/crashtests/1305312-1.html
@@ -0,0 +1,5 @@
+<canvas id='cid'></canvas>
+<script>
+var x=document.getElementById('cid').getContext('2d',{alpha: false});
+x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23);
+</script>
\ No newline at end of file
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
index 1960a97fc257..eaf366d9ddb4 100644
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@@ -37,4 +37,5 @@ load 1290628-1.html
 load 1283113-1.html
 load 1286458-1.html
 load 1299062-1.html
+load 1305312-1.html
 

From 99dc13308fc1f33093e211fa8ac7a8013fdb4144 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 27 Sep 2016 17:31:59 -0400
Subject: [PATCH 083/102] Backed out changeset 5285464565a8 for landing with
 the wrong bug number in the commit message.

--HG--
extra : rebase_source : 9aff59b0badc1d7fb1a173471fb829f9320e311d
---
 gfx/thebes/gfxASurface.cpp |  2 +-
 gfx/thebes/gfxASurface.h   | 18 ------------------
 2 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/gfx/thebes/gfxASurface.cpp b/gfx/thebes/gfxASurface.cpp
index 31f185596507..18831d8443cb 100644
--- a/gfx/thebes/gfxASurface.cpp
+++ b/gfx/thebes/gfxASurface.cpp
@@ -171,7 +171,7 @@ gfxASurface::Wrap (cairo_surface_t *csurf, const IntSize& aSize)
     }
 #endif
     else {
-        result = new gfxUnknownSurface(csurf, aSize);
+        MOZ_CRASH("Unknown cairo surface type");
     }
 
     // fprintf(stderr, "New wrapper for %p -> %p\n", csurf, result);
diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index ca7535e5607d..3e0818e4532a 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -183,22 +183,4 @@ protected:
     bool mSurfaceValid;
 };
 
-/**
- * An Unknown surface; used to wrap unknown cairo_surface_t returns from cairo
- */
-class gfxUnknownSurface : public gfxASurface {
-public:
-    gfxUnknownSurface(cairo_surface_t *surf, const mozilla::gfx::IntSize& aSize)
-        : mSize(aSize)
-    {
-        Init(surf, true);
-    }
-
-    virtual ~gfxUnknownSurface() { }
-    virtual const mozilla::gfx::IntSize GetSize() const override { return mSize; }
-
-private:
-    mozilla::gfx::IntSize mSize;
-};
-
 #endif /* GFX_ASURFACE_H */

From d6dab74e60457ad247b1e89228365e9f8cd28bf3 Mon Sep 17 00:00:00 2001
From: Edwin Flores <eflores@mozilla.com>
Date: Tue, 27 Sep 2016 19:52:17 +0100
Subject: [PATCH 084/102] Bug 1305234 - Back out changeset f7aeb4b3ccb1 (bug
 1279398) for causing top crashes. r=edwin DONTBUILD

--HG--
extra : rebase_source : 17ccf89223eeca1bc08c3e45ec7e22d3456c2d00
extra : source : 5285464565a804f3766f273b20fb7147f92db53e
---
 gfx/thebes/gfxASurface.cpp |  2 +-
 gfx/thebes/gfxASurface.h   | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/gfx/thebes/gfxASurface.cpp b/gfx/thebes/gfxASurface.cpp
index 18831d8443cb..31f185596507 100644
--- a/gfx/thebes/gfxASurface.cpp
+++ b/gfx/thebes/gfxASurface.cpp
@@ -171,7 +171,7 @@ gfxASurface::Wrap (cairo_surface_t *csurf, const IntSize& aSize)
     }
 #endif
     else {
-        MOZ_CRASH("Unknown cairo surface type");
+        result = new gfxUnknownSurface(csurf, aSize);
     }
 
     // fprintf(stderr, "New wrapper for %p -> %p\n", csurf, result);
diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 3e0818e4532a..ca7535e5607d 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -183,4 +183,22 @@ protected:
     bool mSurfaceValid;
 };
 
+/**
+ * An Unknown surface; used to wrap unknown cairo_surface_t returns from cairo
+ */
+class gfxUnknownSurface : public gfxASurface {
+public:
+    gfxUnknownSurface(cairo_surface_t *surf, const mozilla::gfx::IntSize& aSize)
+        : mSize(aSize)
+    {
+        Init(surf, true);
+    }
+
+    virtual ~gfxUnknownSurface() { }
+    virtual const mozilla::gfx::IntSize GetSize() const override { return mSize; }
+
+private:
+    mozilla::gfx::IntSize mSize;
+};
+
 #endif /* GFX_ASURFACE_H */

From 69fd23cff2e396eef072b35fa996f1dc4eacb65e Mon Sep 17 00:00:00 2001
From: Geoff Brown <gbrown@mozilla.com>
Date: Tue, 27 Sep 2016 15:34:28 -0600
Subject: [PATCH 085/102] Bug 1204281 - Adjust chunks and max run time for
 Android mochitests; r=me

---
 taskcluster/ci/android-test/tests.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/taskcluster/ci/android-test/tests.yml b/taskcluster/ci/android-test/tests.yml
index 5aa2de3474da..24b03be87d0c 100644
--- a/taskcluster/ci/android-test/tests.yml
+++ b/taskcluster/ci/android-test/tests.yml
@@ -93,13 +93,16 @@ mochitest:
     suite: mochitest/plain-chunked
     treeherder-symbol: tc-M()
     instance-size: xlarge
-    chunks: 20
+    chunks:
+        by-test-platform:
+            android-4.3-arm7-api-15/debug: 26
+            default: 20
     loopback-video: true
     e10s: false
     max-run-time:
         by-test-platform:
             android-4.3-arm7-api-15/debug: 10800
-            default: 3600
+            default: 5400
     mozharness:
         script: android_emulator_unittest.py
         no-read-buildbot-config: true

From 1af5239b389e812cb9cc56a7e4b528eef55e4325 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <billm@mozilla.com>
Date: Tue, 27 Sep 2016 15:15:25 -0700
Subject: [PATCH 086/102] Bug 1283681 - Update list of CPOW-whitelisted add-ons
 based on new data

---
 browser/app/profile/firefox.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 9bb75e6e28b2..b3ddb27916d7 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1452,7 +1452,7 @@ pref("dom.ipc.cpows.forbid-unsafe-from-browser", true);
 pref("dom.ipc.cpows.forbid-cpows-in-compat-addons", true);
 
 // ...except for these add-ons:
-pref("dom.ipc.cpows.allow-cpows-in-compat-addons", "{b9db16a4-6edc-47ec-a1f4-b86292ed211d},privateTab@infocatcher,mousegesturessuite@lemon_juice.addons.mozilla.org,firegestures@xuldev.org,treestyletab@piro.sakura.ne.jp,{DDC359D1-844A-42a7-9AA1-88A850A938A8},ich@maltegoetz.de,{AE93811A-5C9A-4d34-8462-F7B864FC4696}");
+pref("dom.ipc.cpows.allow-cpows-in-compat-addons", "{b9db16a4-6edc-47ec-a1f4-b86292ed211d},firegestures@xuldev.org,{DDC359D1-844A-42a7-9AA1-88A850A938A8},privateTab@infocatcher,mousegesturessuite@lemon_juice.addons.mozilla.org,treestyletab@piro.sakura.ne.jp,cliqz@cliqz.com,{AE93811A-5C9A-4d34-8462-F7B864FC4696},contextsearch2@lwz.addons.mozilla.org,{EF522540-89F5-46b9-B6FE-1829E2B572C6},{677a8f98-fd64-40b0-a883-b8c95d0cbf17},images@wink.su,fx-devtools,toolkit/require,url_advisor@kaspersky.com,{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d},{dc572301-7619-498c-a57d-39143191b318},dta@downthemall.net,{86095750-AD15-46d8-BF32-C0789F7E6A32},screenwise-prod@google.com,{91aa5abe-9de4-4347-b7b5-322c38dd9271},secureLogin@blueimp.net,ich@maltegoetz.de,come.back.block.image.from@cat-in-136.blogspot.com,{7b1bf0b6-a1b9-42b0-b75d-252036438bdc},s3crypto@data,{1e0fd655-5aea-4b4c-a583-f76ef1e3af9c},akahuku.fx.sp@toshiakisp.github.io,{aff87fa2-a58e-4edd-b852-0a20203c1e17},{1018e4d6-728f-4b20-ad56-37578a4de76b},rehostimage@engy.us,lazarus@interclue.com,{b2e69492-2358-071a-7056-24ad0c3defb1},flashstopper@byo.co.il,{e4a8a97b-f2ed-450b-b12d-ee082ba24781},jid1-f3mYMbCpz2AZYl@jetpack,{8c550e28-88c9-4764-bb52-aa489cf2efcd},{37fa1426-b82d-11db-8314-0800200c9a66},{ac2cfa60-bc96-11e0-962b-0800200c9a66},igetter@presenta.net,killspinners@byo.co.il,abhere2@moztw.org,{fc6339b8-9581-4fc7-b824-dffcb091fcb7},wampi@wink.su,backtrack@byalexv.co.uk,Gladiator_X@mail.ru,{73a6fe31-595d-460b-a920-fcc0f8843232},{46551EC9-40F0-4e47-8E18-8E5CF550CFB8},acewebextension_unlisted@acestream.org,@screen_maker,yasearch@yandex.ru,sp@avast.com,s3google@translator,igetterextension@presenta.net,{C1A2A613-35F1-4FCF-B27F-2840527B6556},screenwise-testing@google.com,helper-sig@savefrom.net,browser-loader,ImageSaver@Merci.chao,proxtube@abz.agency,wrc@avast.com,{9AA46F4F-4DC7-4c06-97AF-5035170634FE},jid1-CikLKKPVkw6ipw@jetpack,artur.dubovoy@gmail.com,nlgfeb@nlgfeb.ext,{A065A84F-95B6-433A-A0C8-4C040B77CE8A},fdm_ffext@freedownloadmanager.org");
 
 // Enable e10s hang monitoring (slow script checking and plugin hang
 // detection).

From d6f48852a6fcef2ac2e32af6b142c7156957797b Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Wed, 28 Sep 2016 11:34:48 +1300
Subject: [PATCH 087/102] Bug 1305213 - Make sure the cached
 CanUseHardwareVideoDecoding value is updated when DeviceMangerDx is
 initialized. r=dvander

---
 gfx/thebes/gfxPlatform.cpp        | 8 +++++---
 gfx/thebes/gfxPlatform.h          | 2 +-
 gfx/thebes/gfxWindowsPlatform.cpp | 6 +++++-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 3706356266f4..343ca9fa1d12 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -2098,13 +2098,15 @@ static mozilla::Atomic<bool> sLayersAccelerationPrefsInitialized(false);
 void VideoDecodingFailedChangedCallback(const char* aPref, void*)
 {
   sLayersHardwareVideoDecodingFailed = Preferences::GetBool(aPref, false);
-  gfxPlatform::GetPlatform()->UpdateCanUseHardareVideoDecoding();
+  gfxPlatform::GetPlatform()->UpdateCanUseHardwareVideoDecoding();
 }
 
 void
-gfxPlatform::UpdateCanUseHardareVideoDecoding()
+gfxPlatform::UpdateCanUseHardwareVideoDecoding()
 {
-  gfxVars::SetCanUseHardwareVideoDecoding(CanUseHardwareVideoDecoding());
+  if (XRE_IsParentProcess()) {
+    gfxVars::SetCanUseHardwareVideoDecoding(CanUseHardwareVideoDecoding());
+  }
 }
 
 void
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 2d630386f7fd..ba4673de94eb 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -456,7 +456,7 @@ public:
 
     static bool OffMainThreadCompositingEnabled();
 
-    void UpdateCanUseHardareVideoDecoding();
+    void UpdateCanUseHardwareVideoDecoding();
 
     // Returns a prioritized list of all available compositor backends.
     void GetCompositorBackends(bool useAcceleration, nsTArray<mozilla::layers::LayersBackend>& aBackends);
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index 697c90ef0f4e..0bff2a793bff 100755
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -365,6 +365,10 @@ gfxWindowsPlatform::InitAcceleration()
   DeviceManagerDx::Init();
   DeviceManagerD3D9::Init();
 
+  // CanUseHardwareVideoDecoding depends on DeviceManagerDx state,
+  // so update the cached value now.
+  UpdateCanUseHardwareVideoDecoding();
+
   InitializeConfig();
   InitializeDevices();
   UpdateANGLEConfig();
@@ -2030,7 +2034,7 @@ gfxWindowsPlatform::ImportGPUDeviceData(const mozilla::gfx::GPUDeviceData& aData
 
   // CanUseHardwareVideoDecoding depends on d3d11 state, so update
   // the cached value now.
-  UpdateCanUseHardareVideoDecoding();
+  UpdateCanUseHardwareVideoDecoding();
 
   // For completeness (and messaging in about:support). Content recomputes this
   // on its own, and we won't use ANGLE in the UI process if we're using a GPU

From aa23cf7561e7602077cd17620504798faad644a5 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Wed, 28 Sep 2016 04:44:11 -0400
Subject: [PATCH 088/102] Bug 1305814 - fix -Wreorder warning in
 MessageChannel; r=billm

Initializer lists are supposed to initialize member variables in the
order they're listed in the class definition.
---
 ipc/glue/MessageChannel.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ipc/glue/MessageChannel.cpp b/ipc/glue/MessageChannel.cpp
index 49d488a70956..7c266df31fcf 100644
--- a/ipc/glue/MessageChannel.cpp
+++ b/ipc/glue/MessageChannel.cpp
@@ -484,6 +484,9 @@ MessageChannel::MessageChannel(MessageListener *aListener)
     mTransactionStack(nullptr),
     mTimedOutMessageSeqno(0),
     mTimedOutMessagePriority(0),
+#if defined(MOZ_CRASHREPORTER) && defined(OS_WIN)
+    mPending(AnnotateAllocator<Message>(*this)),
+#endif
     mRemoteStackDepthGuess(false),
     mSawInterruptOutMsg(false),
     mIsWaitingForIncoming(false),
@@ -492,9 +495,6 @@ MessageChannel::MessageChannel(MessageListener *aListener)
     mFlags(REQUIRE_DEFAULT),
     mPeerPidSet(false),
     mPeerPid(-1)
-#if defined(MOZ_CRASHREPORTER) && defined(OS_WIN)
-    , mPending(AnnotateAllocator<Message>(*this))
-#endif
 {
     MOZ_COUNT_CTOR(ipc::MessageChannel);
 

From e26fb466f232b3d92a6a7df44292df24c3c41e4c Mon Sep 17 00:00:00 2001
From: Bill McCloskey <billm@mozilla.com>
Date: Tue, 27 Sep 2016 13:49:59 -0700
Subject: [PATCH 089/102] Bug 1304359 - Don't break browser for tabswitch
 assertions (r=mconley)

---
 browser/base/content/tabbrowser.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index e29eb7231ac4..303a2e702fcc 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -3678,7 +3678,11 @@
             assert: function(cond) {
               if (!cond) {
                 dump("Assertion failure\n" + Error().stack);
-                throw new Error("Assertion failure");
+
+                // Don't break a user's browser if an assertion fails.
+                if (this.tabbrowser.AppConstants.DEBUG) {
+                  throw new Error("Assertion failure");
+                }
               }
             },
 

From 6148c4595299b27d33a47a4af2ee050c34901e74 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <billm@mozilla.com>
Date: Fri, 23 Sep 2016 15:11:43 -0700
Subject: [PATCH 090/102] Bug 1305165 -
 UpdateDisplayPortMarginsFromPendingMessages should use PCompositorBridge
 channel (r=kats)

---
 layout/base/nsLayoutUtils.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 18bda54dadb1..2f39b2d42433 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -108,6 +108,7 @@
 #include "nsFrameSelection.h"
 #include "FrameLayerBuilder.h"
 #include "mozilla/layers/APZCTreeManager.h"
+#include "mozilla/layers/CompositorBridgeChild.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/EventStateManager.h"
@@ -9292,10 +9293,11 @@ static void UpdateDisplayPortMarginsForPendingMetrics(FrameMetrics& aMetrics) {
 }
 
 /* static */ void
-nsLayoutUtils::UpdateDisplayPortMarginsFromPendingMessages() {
+nsLayoutUtils::UpdateDisplayPortMarginsFromPendingMessages()
+{
   if (mozilla::dom::ContentChild::GetSingleton() &&
       mozilla::dom::ContentChild::GetSingleton()->GetIPCChannel()) {
-    mozilla::dom::ContentChild::GetSingleton()->GetIPCChannel()->PeekMessages(
+    CompositorBridgeChild::Get()->GetIPCChannel()->PeekMessages(
       [](const IPC::Message& aMsg) -> bool {
         if (aMsg.type() == mozilla::layers::PAPZ::Msg_RequestContentRepaint__ID) {
           PickleIterator iter(aMsg);

From 52de92c14c477f8fcbca5b598b282c7ae515a34b Mon Sep 17 00:00:00 2001
From: Xidorn Quan <me@upsuper.org>
Date: Tue, 27 Sep 2016 16:37:07 +1000
Subject: [PATCH 091/102] Bug 1304692 - Make puppet widget get coordinate
 rounding from parent. r=smaug

MozReview-Commit-ID: A3ornUMDmt8
---
 dom/ipc/ContentChild.cpp |  5 +++--
 dom/ipc/PBrowser.ipdl    |  8 +++++++-
 dom/ipc/TabChild.cpp     | 25 +++++++++++++++++++++++--
 dom/ipc/TabChild.h       |  4 ++++
 dom/ipc/TabParent.cpp    | 20 +++++++++++++++++---
 dom/ipc/TabParent.h      |  3 +++
 widget/PuppetWidget.cpp  | 15 +++++++++++++++
 widget/PuppetWidget.h    |  6 +++++-
 8 files changed, 77 insertions(+), 9 deletions(-)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index dc5c381ae8d9..1bad3d422221 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -822,14 +822,15 @@ ContentChild::ProvideWindowCommon(TabChild* aTabOpener,
     renderFrame = nullptr;
   }
 
-  ShowInfo showInfo(EmptyString(), false, false, true, false, 0, 0);
+  ShowInfo showInfo(EmptyString(), false, false, true, false, 0, 0, 0);
   auto* opener = nsPIDOMWindowOuter::From(aParent);
   nsIDocShell* openerShell;
   if (opener && (openerShell = opener->GetDocShell())) {
     nsCOMPtr<nsILoadContext> context = do_QueryInterface(openerShell);
     showInfo = ShowInfo(EmptyString(), false,
                         context->UsePrivateBrowsing(), true, false,
-                        aTabOpener->mDPI, aTabOpener->mDefaultScale);
+                        aTabOpener->mDPI, aTabOpener->mRounding,
+                        aTabOpener->mDefaultScale);
   }
 
   // Unfortunately we don't get a window unless we've shown the frame.  That's
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index 9e76fe9a23ef..d5af87a5aaea 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -101,6 +101,7 @@ struct ShowInfo
   bool fakeShowInfo;
   bool isTransparent;
   float dpi;
+  int32_t widgetRounding;
   double defaultScale;
 };
 
@@ -375,6 +376,11 @@ parent:
      */
     sync GetDefaultScale() returns (double value);
 
+    /**
+     * Gets the rounding of coordinates in the widget.
+     */
+    sync GetWidgetRounding() returns (int32_t value);
+
     /**
      * Gets maximum of touch points at current device.
      */
@@ -793,7 +799,7 @@ child:
      * value (-1) but in the majority of the cases this saves us from two
      * sync requests from the child to the parent.
      */
-    async UIResolutionChanged(float dpi, double scale);
+    async UIResolutionChanged(float dpi, int32_t rounding, double scale);
 
     /**
      * Tell the child that the system theme has changed, and that a repaint
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index bfec7b6eee47..ced61fc55b03 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -541,6 +541,7 @@ TabChild::TabChild(nsIContentChild* aManager,
   , mDestroyed(false)
   , mUniqueId(aTabId)
   , mDPI(0)
+  , mRounding(0)
   , mDefaultScale(0)
   , mIsTransparent(false)
   , mIPCOpen(false)
@@ -1549,6 +1550,7 @@ TabChild::ApplyShowInfo(const ShowInfo& aInfo)
     }
   }
   mDPI = aInfo.dpi();
+  mRounding = aInfo.widgetRounding();
   mDefaultScale = aInfo.defaultScale();
   mIsTransparent = aInfo.isTransparent();
 }
@@ -2942,6 +2944,22 @@ TabChild::GetDefaultScale(double* aScale)
     SendGetDefaultScale(aScale);
 }
 
+void
+TabChild::GetWidgetRounding(int32_t* aRounding)
+{
+  *aRounding = 1;
+  if (!mRemoteFrame) {
+    return;
+  }
+  if (mRounding > 0) {
+    *aRounding = mRounding;
+    return;
+  }
+
+  // Fallback to a sync call if needed.
+  SendGetWidgetRounding(aRounding);
+}
+
 void
 TabChild::GetMaxTouchPoints(uint32_t* aTouchPoints)
 {
@@ -3285,12 +3303,15 @@ TabChild::RecvRequestNotifyAfterRemotePaint()
 }
 
 bool
-TabChild::RecvUIResolutionChanged(const float& aDpi, const double& aScale)
+TabChild::RecvUIResolutionChanged(const float& aDpi,
+                                  const int32_t& aRounding,
+                                  const double& aScale)
 {
   ScreenIntSize oldScreenSize = GetInnerSize();
   mDPI = 0;
+  mRounding = 0;
   mDefaultScale = 0;
-  static_cast<PuppetWidget*>(mPuppetWidget.get())->UpdateBackingScaleCache(aDpi, aScale);
+  static_cast<PuppetWidget*>(mPuppetWidget.get())->UpdateBackingScaleCache(aDpi, aRounding, aScale);
   nsCOMPtr<nsIDocument> document(GetDocument());
   nsCOMPtr<nsIPresShell> presShell = document->GetShell();
   if (presShell) {
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index 8ff3b7c5a5fc..e9e9dd157129 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -484,6 +484,8 @@ public:
 
   void GetDefaultScale(double *aScale);
 
+  void GetWidgetRounding(int32_t* aRounding);
+
   bool IsTransparent() const { return mIsTransparent; }
 
   void GetMaxTouchPoints(uint32_t* aTouchPoints);
@@ -572,6 +574,7 @@ public:
   }
 
   virtual bool RecvUIResolutionChanged(const float& aDpi,
+                                       const int32_t& aRounding,
                                        const double& aScale) override;
 
   virtual bool
@@ -777,6 +780,7 @@ private:
 
   friend class ContentChild;
   float mDPI;
+  int32_t mRounding;
   double mDefaultScale;
 
   bool mIsTransparent;
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 9143b1adf14d..8051435342c1 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -277,6 +277,7 @@ TabParent::TabParent(nsIContentParent* aManager,
   , mDimensions(0, 0)
   , mOrientation(0)
   , mDPI(0)
+  , mRounding(0)
   , mDefaultScale(0)
   , mUpdatedDimensions(false)
   , mSizeMode(nsSizeMode_Normal)
@@ -1030,7 +1031,8 @@ TabParent::UIResolutionChanged()
     // fails to cache the values, then mDefaultScale.scale might be invalid.
     // We don't want to send that value to content. Just send -1 for it too in
     // that case.
-    Unused << SendUIResolutionChanged(mDPI, mDPI < 0 ? -1.0 : mDefaultScale.scale);
+    Unused << SendUIResolutionChanged(mDPI, mRounding,
+                                      mDPI < 0 ? -1.0 : mDefaultScale.scale);
   }
 }
 
@@ -2499,6 +2501,17 @@ TabParent::RecvGetDefaultScale(double* aValue)
   return true;
 }
 
+bool
+TabParent::RecvGetWidgetRounding(int32_t* aValue)
+{
+  TryCacheDPIAndScale();
+
+  MOZ_ASSERT(mRounding > 0,
+             "Must not ask for rounding before OwnerElement is received!");
+  *aValue = mRounding;
+  return true;
+}
+
 bool
 TabParent::RecvGetMaxTouchPoints(uint32_t* aTouchPoints)
 {
@@ -2766,6 +2779,7 @@ TabParent::TryCacheDPIAndScale()
 
   if (widget) {
     mDPI = widget->GetDPI();
+    mRounding = widget->RoundsWidgetCoordinatesTo();
     mDefaultScale = widget->GetDefaultScale();
   }
 }
@@ -3374,11 +3388,11 @@ TabParent::GetShowInfo()
       nsContentUtils::IsChromeDoc(mFrameElement->OwnerDoc()) &&
       mFrameElement->HasAttr(kNameSpaceID_None, nsGkAtoms::transparent);
     return ShowInfo(name, allowFullscreen, isPrivate, false,
-                    isTransparent, mDPI, mDefaultScale.scale);
+                    isTransparent, mDPI, mRounding, mDefaultScale.scale);
   }
 
   return ShowInfo(EmptyString(), false, false, false,
-                  false, mDPI, mDefaultScale.scale);
+                  false, mDPI, mRounding, mDefaultScale.scale);
 }
 
 void
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index aff413e2609a..13738229d807 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -321,6 +321,8 @@ public:
 
   virtual bool RecvGetDefaultScale(double* aValue) override;
 
+  virtual bool RecvGetWidgetRounding(int32_t* aValue) override;
+
   virtual bool RecvGetMaxTouchPoints(uint32_t* aTouchPoints) override;
 
   virtual bool RecvGetWidgetNativeData(WindowsHandle* aValue) override;
@@ -635,6 +637,7 @@ protected:
   ScreenIntSize mDimensions;
   ScreenOrientationInternal mOrientation;
   float mDPI;
+  int32_t mRounding;
   CSSToLayoutDeviceScale mDefaultScale;
   bool mUpdatedDimensions;
   nsSizeMode mSizeMode;
diff --git a/widget/PuppetWidget.cpp b/widget/PuppetWidget.cpp
index 967352ffa867..3382a4000e77 100644
--- a/widget/PuppetWidget.cpp
+++ b/widget/PuppetWidget.cpp
@@ -79,6 +79,7 @@ PuppetWidget::PuppetWidget(TabChild* aTabChild)
   : mTabChild(aTabChild)
   , mMemoryPressureObserver(nullptr)
   , mDPI(-1)
+  , mRounding(-1)
   , mDefaultScale(-1)
   , mCursorHotspotX(0)
   , mCursorHotspotY(0)
@@ -1194,6 +1195,20 @@ PuppetWidget::GetDefaultScaleInternal()
   return mDefaultScale;
 }
 
+int32_t
+PuppetWidget::RoundsWidgetCoordinatesTo()
+{
+  if (mRounding < 0) {
+    if (mTabChild) {
+      mTabChild->GetWidgetRounding(&mRounding);
+    } else {
+      mRounding = 1;
+    }
+  }
+
+  return mRounding;
+}
+
 void*
 PuppetWidget::GetNativeData(uint32_t aDataType)
 {
diff --git a/widget/PuppetWidget.h b/widget/PuppetWidget.h
index dc70c7647f1b..5d0581356c62 100644
--- a/widget/PuppetWidget.h
+++ b/widget/PuppetWidget.h
@@ -135,6 +135,8 @@ public:
   virtual LayoutDeviceIntPoint WidgetToScreenOffset() override
   { return LayoutDeviceIntPoint::FromUnknownPoint(GetWindowPosition() + GetChromeDimensions()); }
 
+  int32_t RoundsWidgetCoordinatesTo() override;
+
   void InitEvent(WidgetGUIEvent& aEvent,
                  LayoutDeviceIntPoint* aPoint = nullptr);
 
@@ -202,9 +204,10 @@ public:
 
   virtual TabChild* GetOwningTabChild() override { return mTabChild; }
 
-  void UpdateBackingScaleCache(float aDpi, double aScale)
+  void UpdateBackingScaleCache(float aDpi, int32_t aRounding, double aScale)
   {
     mDPI = aDpi;
+    mRounding = aRounding;
     mDefaultScale = aScale;
   }
 
@@ -358,6 +361,7 @@ private:
 
   // The DPI of the screen corresponding to this widget
   float mDPI;
+  int32_t mRounding;
   double mDefaultScale;
 
   // Precomputed answers for ExecuteNativeKeyBinding

From a1db43df464dcf9d1c69294ff5fa050b37f8944f Mon Sep 17 00:00:00 2001
From: Xidorn Quan <me@upsuper.org>
Date: Wed, 28 Sep 2016 12:11:18 +1000
Subject: [PATCH 092/102] Bug 1279814 followup - Add crashtest for this bug.
 r=jfkthame

MozReview-Commit-ID: HViGSGNbscY

--HG--
extra : source : 0706234a33fd0d5b519700f051554bdcda3dd558
---
 layout/generic/crashtests/1279814.html    | 35 +++++++++++++++++++++++
 layout/generic/crashtests/crashtests.list |  1 +
 2 files changed, 36 insertions(+)
 create mode 100644 layout/generic/crashtests/1279814.html

diff --git a/layout/generic/crashtests/1279814.html b/layout/generic/crashtests/1279814.html
new file mode 100644
index 000000000000..71a9a6e3b416
--- /dev/null
+++ b/layout/generic/crashtests/1279814.html
@@ -0,0 +1,35 @@
+<!-- 128 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+<!-- 64 PDI -->
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+<!-- 64 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 01e70ed16bbb..96099570be05 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -631,6 +631,7 @@ asserts(2) load 1272983-1.html # bug 586628
 asserts(2) load 1272983-2.html # bug 586628
 load 1275059.html
 load 1278007.html
+load 1279814.html
 load large-border-radius-dashed.html
 load large-border-radius-dashed2.html
 load large-border-radius-dotted.html

From fb058e68f63db2c7ed9a12fa57e12873b4096676 Mon Sep 17 00:00:00 2001
From: Thomas Wisniewski <wisniewskit@gmail.com>
Date: Thu, 15 Sep 2016 14:19:23 -0400
Subject: [PATCH 093/102] Bug 1303121 - Do not fire one last progress event on
 XHR errors, to match a spec change. r=annevk

---
 dom/base/test/test_bug435425.html             | 22 +++----
 dom/xhr/XMLHttpRequestMainThread.cpp          |  7 +--
 ...progress-events-response-data-gzip.htm.ini |  5 --
 .../tests/XMLHttpRequest/abort-after-send.htm | 39 +++++-------
 .../XMLHttpRequest/abort-during-upload.htm    |  2 +-
 .../XMLHttpRequest/abort-event-order.htm      |  2 +-
 .../XMLHttpRequest/event-timeout-order.htm    |  2 +-
 .../progress-events-response-data-gzip.htm    | 28 +++++----
 .../resources/xmlhttprequest-event-order.js   | 59 +++++++++++++++++--
 .../send-response-event-order.htm             | 37 ++----------
 10 files changed, 107 insertions(+), 96 deletions(-)
 delete mode 100644 testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini

diff --git a/dom/base/test/test_bug435425.html b/dom/base/test/test_bug435425.html
index 0e4e3a4ebd28..828931d67d17 100644
--- a/dom/base/test/test_bug435425.html
+++ b/dom/base/test/test_bug435425.html
@@ -217,7 +217,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -236,7 +236,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -255,7 +255,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -274,7 +274,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -293,7 +293,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -317,10 +317,10 @@ var tests =
     { method: "POST", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -351,10 +351,10 @@ var tests =
     { method: "POST", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -385,10 +385,10 @@ var tests =
     { method: "POST", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 496ee55c0937..99162070b899 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -1038,10 +1038,8 @@ XMLHttpRequestMainThread::CloseRequestWithError(const ProgressEventType aType)
     if (!mFlagSyncLooping) {
       if (mUpload && !mUploadComplete) {
         mUploadComplete = true;
-        DispatchProgressEvent(mUpload, ProgressEventType::progress, 0, 0);
         DispatchProgressEvent(mUpload, aType, 0, 0);
       }
-      DispatchProgressEvent(this, ProgressEventType::progress, 0, 0);
       DispatchProgressEvent(this, aType, 0, 0);
     }
   }
@@ -2184,10 +2182,9 @@ XMLHttpRequestMainThread::ChangeStateToDone()
   // Per spec, fire readystatechange=4/done before final error events.
   ChangeState(State::done, true);
 
-  // Per spec, if we failed in the upload phase, fire a final progress, error,
-  // and loadend event for the upload after readystatechange=4/done.
+  // Per spec, if we failed in the upload phase, fire a final error
+  // and loadend events for the upload after readystatechange=4/done.
   if (!mFlagSynchronous && mUpload && !mUploadComplete) {
-    DispatchProgressEvent(mUpload, ProgressEventType::progress, 0, 0);
     DispatchProgressEvent(mUpload, ProgressEventType::error, 0, 0);
   }
 
diff --git a/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini b/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini
deleted file mode 100644
index 5adf572e37d3..000000000000
--- a/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[progress-events-response-data-gzip.htm]
-  type: testharness
-  [XMLHttpRequest: progress events and GZIP encoding]
-    expected: FAIL
-
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm b/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
index c4885c9911b0..523a0d616b64 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
@@ -4,6 +4,7 @@
     <title>XMLHttpRequest: abort() after send()</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
+    <script src="resources/xmlhttprequest-event-order.js"></script>
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-abort()-method" data-tested-assertations="following-sibling::ol/li[1] following-sibling::ol/li[3] following-sibling::ol/li[4] following-sibling::ol/li[4]/ol/li[1] following-sibling::ol/li[4]/ol/li[3] following-sibling::ol/li[4]/ol/li[4] following-sibling::ol/li[4]/ol/li[5] following-sibling::ol/li[4]/ol/li[6] following-sibling::ol/li[5]" />
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-responsetext-attribute" data-tested-assertations="following::ol/li[3]" />
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-responsexml-attribute" data-tested-assertations="following::ol/li[3]" />
@@ -19,36 +20,26 @@
       var test = async_test()
       test.step(function() {
         var client = new XMLHttpRequest(),
-            control_flag = false,
-            result = [],
-            expected = [1, 4, 'progress', 'abort', 'loadend'] // open() -> 1, abort() -> 4
-        client.onreadystatechange = function() {
-          test.step(function() {
-            result.push(client.readyState)
-            if(client.readyState == 4) {
-              control_flag = true
-              assert_equals(client.responseXML, null)
-              assert_equals(client.responseText, "")
-              assert_equals(client.status, 0)
-              assert_equals(client.statusText, "")
-              assert_equals(client.getAllResponseHeaders(), "")
-              assert_equals(client.getResponseHeader('Content-Type'), null)
-            }
-          })
-        }
+            control_flag = false;
+        prepare_xhr_for_event_order_test(client);
+        client.addEventListener("readystatechange", test.step_func(function() {
+          if(client.readyState == 4) {
+            control_flag = true
+            assert_equals(client.responseXML, null)
+            assert_equals(client.responseText, "")
+            assert_equals(client.status, 0)
+            assert_equals(client.statusText, "")
+            assert_equals(client.getAllResponseHeaders(), "")
+            assert_equals(client.getResponseHeader('Content-Type'), null)
+          }
+        }))
         client.open("GET", "resources/well-formed.xml", true)
         client.send(null)
-        client.addEventListener('progress', logEvt)
-        client.addEventListener('abort', logEvt)
-        client.addEventListener('loadend', logEvt)
         client.abort()
         assert_true(control_flag)
         assert_equals(client.readyState, 0)
-        assert_array_equals(result, expected)
+        assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "abort(0,0,false)", "loadend(0,0,false)"])
         test.done()
-        function logEvt (e) {
-          result.push(e.type)
-        }
       })
     </script>
   </body>
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm b/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
index 766dcc4693d8..9fbc8b9bbb47 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
@@ -18,7 +18,7 @@
         client.open("POST", "resources/delay.py?ms=1000")
         client.addEventListener("loadend", function(e) {
           test.step(function() {
-            assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,9999,true)", 4, "upload.progress(0,0,false)", "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
+            assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,9999,true)", 4, "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
             test.done()
           })
         });
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm b/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
index cb405a71accf..f05c20628c4a 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
@@ -37,7 +37,7 @@
             {
                 test.step(function()
                 {
-                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "upload.progress(0,0,false)", "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
+                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
 
                     assert_equals(xhr.readyState, 0, 'state should be UNSENT');
                     test.done();
diff --git a/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm b/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
index 1d9ba31d6e06..7376ca2f8b14 100644
--- a/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
@@ -20,7 +20,7 @@
             prepare_xhr_for_event_order_test(xhr);
             xhr.addEventListener("loadend", function() {
                 test.step(function() {
-                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", 4, "upload.progress(0,0,false)", "upload.timeout(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "timeout(0,0,false)", "loadend(0,0,false)"]);
+                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", 4, "upload.timeout(0,0,false)", "upload.loadend(0,0,false)", "timeout(0,0,false)", "loadend(0,0,false)"]);
                     test.done();
                 });
             });
diff --git a/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm b/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
index dc166a2396a4..058064636d43 100644
--- a/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
@@ -36,17 +36,20 @@
 
           * If lengthComputable is true:
               * Event.total must match Content-length header
-              * event.loaded should be a smaller number while resource is loading
-                and match Content-length when loading is finished
-              * Setting event.loaded to equal event.total for each progress event if the
-                resource is not fully downloaded would be cheating
+              * event.loaded must only ever increase in progress events
+                (and may never repeat its value).
+              * event.loaded must never exceed the Content-length.
 
           * If lengthComputable is false:
               * event.total should be 0
+              * event.loaded must only ever increase in progress events
+                (and may never repeat its value).
               * event.loaded should be the length of the decompressed content, i.e.
                 bigger than Content-length header value when finished loading
 
         */
+        var lastTotal;
+        var lastLoaded = -1;
         client.addEventListener('loadend', test.step_func(function(e){
           var len = parseInt(client.getResponseHeader('content-length'), 10)
           if(e.lengthComputable){
@@ -59,14 +62,17 @@
           test.done();
         }), false)
         client.addEventListener('progress', test.step_func(function(e){
-          if(e.lengthComputable && e.total && e.loaded && e.target.readyState < 4){
-            assert_not_equals(e.total, e.loaded, 'total should not equal loaded while download/decode is incomplete')
-            // We should only do this assertation once
-            // it's theoretically possible that all the data would get in
-            // and a progress event fire before the readyState switches from 3 to 4 -
-            // in this case we might report bogus and random failures. Better to remove the event listener again..
-            client.removeEventListener('progress', arguments.callee, false);
+          if(lastTotal === undefined){
+            lastTotal = e.total;
           }
+          if(e.lengthComputable && e.total && e.loaded){
+            assert_equals(e.total, lastTotal, 'event.total should remain invariant')
+            assert_less_than_equal(e.loaded, lastTotal, 'event.loaded should not exceed content-length')
+          }else{
+            assert_equals(e.total, 0, 'event.total should be 0')
+          }
+          assert_greater_than(e.loaded, lastLoaded, 'event.loaded should only ever increase')
+          lastLoaded = e.loaded;
         }), false)
         // image.gif is 165375 bytes compressed. Sending 45000 bytes at a time with 1 second delay will load it in 4 seconds
         client.open("GET", "resources/image.gif?pipe=gzip|trickle(45000:d1:r2)", true)
diff --git a/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js b/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
index 820f9ee22143..77fc0e784ef9 100644
--- a/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
+++ b/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
@@ -21,13 +21,60 @@
     }
   }
 
+  function getNextEvent(arr) {
+    var eventStr = arr.shift();
+
+    // we can only handle strings, numbers (readystates) and undefined
+    if (eventStr === undefined) {
+      return event;
+    }
+    if (typeof eventStr !== "string") {
+      if (Number.isInteger(eventStr)) {
+        eventStr = "readystatechange(" + eventStr + ")";
+      } else {
+        throw "Test error: unexpected event type " + eventStr;
+      }
+    }
+
+    // parse out the general type, loaded and total values
+    var type = eventStr.type = eventStr.split("(")[0].split(".").pop();
+    eventStr.mayFollowOptionalProgressEvents = type == "progress" ||
+      type == "load" || type == "abort" || type == "error";
+    var loadedAndTotal = eventStr.match(/\((\d)+,(\d)+/);
+    if (loadedAndTotal) {
+      eventStr.loaded = parseInt(loadedAndTotal[0]);
+      eventStr.total = parseInt(loadedAndTotal[1]);
+    }
+
+    return eventStr;
+  }
+
   global.assert_xhr_event_order_matches = function(expected) {
-    try {
-      assert_array_equals(recorded_xhr_events, expected);
-    } catch(e) {
-      e.message += "\nRecorded events were:" + recorded_xhr_events.join(", ");
-      e.message += "\nExpected events were:" + expected.join(", ");
-      throw e;
+    var recorded = recorded_xhr_events;
+    var lastRecordedLoaded = -1;
+
+    while(expected.length && recorded.length) {
+      var currentExpected = getNextEvent(expected),
+          currentRecorded = getNextEvent(recorded);
+
+      // skip to the last progress event if we've hit one
+      while (recorded.length && currentRecorded.type == "progress") {
+        assert_greater(currentRecorded.loaded, lastRecordedLoaded,
+                       "progress event 'loaded' values must only increase");
+        lastRecordedLoaded = currentRecorded.loaded;
+        currentRecorded = getNextEvent(recorded);
+      }
+      if (currentRecorded.type == "loadstart") {
+        lastRecordedLoaded = -1;
+      }
+
+      assert_equals(currentRecorded, currentExpected);
+    }
+    if (recorded.length) {
+      throw "\nUnexpected extra events: " + recorded.join(", ");
+    }
+    if (expected.length) {
+      throw "\nExpected more events: " + expected.join(", ");
     }
   }
 }(this));
diff --git a/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm b/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
index 64dfaa670f82..041cb23c6ea8 100644
--- a/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
@@ -12,6 +12,7 @@
     <link rel="help" href="https://xhr.spec.whatwg.org/#switch-done" data-tested-assertations="following::ol[1]/li[3] following::ol[1]/li[4] following::ol[1]/li[5] following::ol[1]/li[6] following::ol[1]/li[7]" />
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
+    <script src="resources/xmlhttprequest-event-order.js"></script>
     <title>XMLHttpRequest: The send() method: event order when synchronous flag is unset</title>
 </head>
 
@@ -24,38 +25,12 @@
         test.step(function()
         {
             var xhr = new XMLHttpRequest();
-            var expect =  ["loadstart", "upload.loadstart", "upload.progress", "upload.load", "upload.loadend", "progress", 4, "load", "loadend"];
-            var actual = [];
+            prepare_xhr_for_event_order_test(xhr);
 
-            xhr.onreadystatechange = function()
-            {
-                test.step(function()
-                {
-                    if (xhr.readyState == 4)
-                    {
-                        actual.push(xhr.readyState);
-                    }
-                });
-            };
-
-            xhr.onloadstart        = function(e){ actual.push(e.type); };
-            xhr.onload             = function(e){ actual.push(e.type); };
-            xhr.onloadend          = function(e){ actual.push(e.type); VerifyResult()};
-            xhr.onprogress         = function(e){ actual.push(e.type);};
-
-            xhr.upload.onloadstart = function(e){ actual.push("upload." + e.type); };
-            xhr.upload.onload      = function(e){ actual.push("upload." + e.type); };
-            xhr.upload.onloadend   = function(e){ actual.push("upload." + e.type);};
-            xhr.upload.onprogress  = function(e){ actual.push("upload." + e.type);};
-
-            function VerifyResult()
-            {
-                test.step(function()
-                {
-                    assert_array_equals(actual, expect);
-                    test.done();
-                });
-            };
+            xhr.addEventListener("loadend", test.step_func(function() {
+                assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", "upload.progress(12,12,true)", "upload.load(12,12,true)", "upload.loadend(12,12,true)", 2, 3, "progress(12,12,true)", 4, "load(12,12,true)", "loadend(12,12,true)"]);
+                test.done();
+            }));
 
             xhr.open("POST", "./resources/content.py", true);
             xhr.send("Test Message");

From 1748bfae57f2a5ff0ebe8fa8d3f73b726c0f821a Mon Sep 17 00:00:00 2001
From: David Parks <dparks@mozilla.com>
Date: Sat, 24 Sep 2016 02:54:12 -0700
Subject: [PATCH 094/102] Bug 1269114 - [x86_64] Last picked directory not
 saved when using Flash Player uploader. r=jimm

Adds a couple of registry paths to the broker's ALLOW policy.
---
 .../win/src/sandboxbroker/sandboxBroker.cpp        | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
index f9c1e45a5644..58c205076a44 100644
--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ -311,6 +311,20 @@ SandboxBroker::SetSecurityLevelForPluginProcess(int32_t aSandboxLevel)
   SANDBOX_ENSURE_SUCCESS(result,
                          "With these static arguments AddRule should never fail, what happened?");
 
+  // These register keys are used by the file-browser dialog box.  They
+  // remember the most-recently-used folders.
+  result = mPolicy->AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                            sandbox::TargetPolicy::REG_ALLOW_ANY,
+                            L"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU\\*");
+  SANDBOX_ENSURE_SUCCESS(result,
+                         "With these static arguments AddRule should never fail, what happened?");
+
+  result = mPolicy->AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                            sandbox::TargetPolicy::REG_ALLOW_ANY,
+                            L"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRULegacy\\*");
+  SANDBOX_ENSURE_SUCCESS(result,
+                         "With these static arguments AddRule should never fail, what happened?");
+
   return true;
 }
 

From f40bbc42f7934551509eec77b41bc8df10d7cfff Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Tue, 27 Sep 2016 15:01:06 +1300
Subject: [PATCH 095/102] Bug 1305552 - Add telemetry to track uses of
 MediaKeySession.generateRequest. r=francois,gerald

This allows us to track how often EME CDMs are used, rather than just created.
The telemetry I added in bug 1304207 is reports whenever a CDM is created, but
some sites, such as the Shaka Player demo site, create CDMs without using them,
so that telemetry isn't a great measure in helping us detect when CDMs aren't
being used. Whereas the telemetry added here will report when the CDMs are used
to negotiate a license, i.e. when the CDMs are actually being used.


MozReview-Commit-ID: ExMIcIIBvS1
---
 dom/media/eme/EMEUtils.cpp                   | 13 ++++++++++++
 dom/media/eme/EMEUtils.h                     | 10 +++++++++
 dom/media/eme/MediaKeySession.cpp            |  3 +++
 dom/media/eme/MediaKeys.cpp                  | 22 +-------------------
 toolkit/components/telemetry/Histograms.json |  9 ++++++++
 5 files changed, 36 insertions(+), 21 deletions(-)

diff --git a/dom/media/eme/EMEUtils.cpp b/dom/media/eme/EMEUtils.cpp
index 3600de750734..ece3636bd662 100644
--- a/dom/media/eme/EMEUtils.cpp
+++ b/dom/media/eme/EMEUtils.cpp
@@ -154,4 +154,17 @@ IsClearkeyKeySystem(const nsAString& aKeySystem)
   return !CompareUTF8toUTF16(kEMEKeySystemClearkey, aKeySystem);
 }
 
+CDMType
+ToCDMTypeTelemetryEnum(const nsString& aKeySystem)
+{
+  if (!CompareUTF8toUTF16(kEMEKeySystemWidevine, aKeySystem)) {
+    return CDMType::eWidevine;
+  } else if (!CompareUTF8toUTF16(kEMEKeySystemClearkey, aKeySystem)) {
+    return CDMType::eClearKey;
+  } else if (!CompareUTF8toUTF16(kEMEKeySystemPrimetime, aKeySystem)) {
+    return CDMType::ePrimetime;
+  }
+  return CDMType::eUnknown;
+}
+
 } // namespace mozilla
diff --git a/dom/media/eme/EMEUtils.h b/dom/media/eme/EMEUtils.h
index f21e3b1563a2..bbeaf1226cfa 100644
--- a/dom/media/eme/EMEUtils.h
+++ b/dom/media/eme/EMEUtils.h
@@ -106,6 +106,16 @@ KeySystemToGMPName(const nsAString& aKeySystem);
 bool
 IsClearkeyKeySystem(const nsAString& aKeySystem);
 
+enum CDMType {
+  eClearKey = 0,
+  ePrimetime = 1,
+  eWidevine = 2,
+  eUnknown = 3
+};
+
+CDMType
+ToCDMTypeTelemetryEnum(const nsString& aKeySystem);
+
 } // namespace mozilla
 
 #endif // EME_LOG_H_
diff --git a/dom/media/eme/MediaKeySession.cpp b/dom/media/eme/MediaKeySession.cpp
index e4f472a2cf01..103c77e64fce 100644
--- a/dom/media/eme/MediaKeySession.cpp
+++ b/dom/media/eme/MediaKeySession.cpp
@@ -199,6 +199,9 @@ MediaKeySession::GenerateRequest(const nsAString& aInitDataType,
     return promise.forget();
   }
 
+  Telemetry::Accumulate(Telemetry::VIDEO_CDM_GENERATE_REQUEST_CALLED,
+                        ToCDMTypeTelemetryEnum(mKeySystem));
+
   // Convert initData to base64 for easier logging.
   // Note: CreateSession() Move()s the data out of the array, so we have
   // to copy it here.
diff --git a/dom/media/eme/MediaKeys.cpp b/dom/media/eme/MediaKeys.cpp
index b972ffaa4c8b..a7a24c824c80 100644
--- a/dom/media/eme/MediaKeys.cpp
+++ b/dom/media/eme/MediaKeys.cpp
@@ -401,26 +401,6 @@ MediaKeys::Init(ErrorResult& aRv)
   return promise.forget();
 }
 
-enum CDMCreatedType {
-  eClearKey = 0,
-  ePrimetime = 1,
-  eWidevine = 2,
-  eUnknown = 3
-};
-
-static CDMCreatedType
-ToCDMCreatedTelemetryEnum(const nsString& aKeySystem)
-{
-  if (!CompareUTF8toUTF16(kEMEKeySystemWidevine, aKeySystem)) {
-    return CDMCreatedType::eWidevine;
-  } else if (!CompareUTF8toUTF16(kEMEKeySystemClearkey, aKeySystem)) {
-    return CDMCreatedType::eClearKey;
-  } else if (!CompareUTF8toUTF16(kEMEKeySystemPrimetime, aKeySystem)) {
-    return CDMCreatedType::ePrimetime;
-  }
-  return CDMCreatedType::eUnknown;
-}
-
 void
 MediaKeys::OnCDMCreated(PromiseId aId, const nsACString& aNodeId, const uint32_t aPluginId)
 {
@@ -440,7 +420,7 @@ MediaKeys::OnCDMCreated(PromiseId aId, const nsACString& aNodeId, const uint32_t
                                         mKeySystem,
                                         MediaKeySystemStatus::Cdm_created);
 
-  Telemetry::Accumulate(Telemetry::VIDEO_CDM_CREATED, ToCDMCreatedTelemetryEnum(mKeySystem));
+  Telemetry::Accumulate(Telemetry::VIDEO_CDM_CREATED, ToCDMTypeTelemetryEnum(mKeySystem));
 }
 
 already_AddRefed<MediaKeySession>
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 4382d649d8b4..e9190548719f 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -8716,6 +8716,15 @@
     "description": "Note the type of CDM (0=ClearKey, 1=Primetime, 2=Widevine, 3=unknown) every time we successfully instantiate an EME MediaKeys object.",
     "releaseChannelCollection": "opt-out"
   },
+  "VIDEO_CDM_GENERATE_REQUEST_CALLED": {
+    "alert_emails": ["cpearce@mozilla.com"],
+    "expires_in_version": "58",
+    "bug_numbers": [1305552],
+    "kind": "enumerated",
+    "n_values": 6,
+    "description": "Note the type of CDM (0=ClearKey, 1=Primetime, 2=Widevine, 3=unknown) every time we call MediaKeySession.generateRequest().",
+    "releaseChannelCollection": "opt-out"
+  },
   "MEDIA_CODEC_USED": {
     "alert_emails": ["cpearce@mozilla.com"],
     "expires_in_version": "never",

From fe7b5b55fe7c0870b8bb5986b751731ab9188f14 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 28 Sep 2016 13:34:57 +1300
Subject: [PATCH 096/102] Bug 1300069 - Consider a media encrypted if it
 contains a track with crypto metadata, rather than only if the media contains
 encryption init data. r=jya

Some encrypted MP4 streams don't contain PSSH boxes in their MOOV boxes, but
they still have tracks with valid TENC boxes which we still parse. So we need
to consider media encrypted if any of its tracks have crypto meta data, rather
than only if the media has crypto init data.

The WebM demuxer's crypto init data is all the tracks' crypto meta data, so
WebM isn't broken by this change.


MozReview-Commit-ID: 1qOi4uTtCE3

--HG--
extra : amend_source : 0f266976a3d65fb8dc720cd40d70bd6da1712420
---
 dom/media/MediaFormatReader.cpp | 11 +++++++----
 dom/media/MediaFormatReader.h   | 10 +++-------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/dom/media/MediaFormatReader.cpp b/dom/media/MediaFormatReader.cpp
index 103fc3f077af..3c410224181f 100644
--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -72,7 +72,6 @@ MediaFormatReader::MediaFormatReader(AbstractMediaDecoder* aDecoder,
   , mPreviousDecodedKeyframeTime_us(sNoPreviousDecodedKeyframe)
   , mLayersBackendType(aLayersBackend)
   , mInitDone(false)
-  , mIsEncrypted(false)
   , mTrackDemuxersMayBlock(false)
   , mDemuxOnly(false)
   , mSeekScheduled(false)
@@ -337,9 +336,6 @@ MediaFormatReader::OnDemuxerInitDone(nsresult)
   }
 
   UniquePtr<EncryptionInfo> crypto = mDemuxer->GetCrypto();
-
-  mIsEncrypted = crypto && crypto->IsEncrypted();
-
   if (mDecoder && crypto && crypto->IsEncrypted()) {
 #ifdef MOZ_EME
     // Try and dispatch 'encrypted'. Won't go if ready state still HAVE_NOTHING.
@@ -375,6 +371,13 @@ MediaFormatReader::OnDemuxerInitDone(nsresult)
   mMetadataPromise.Resolve(metadata, __func__);
 }
 
+bool
+MediaFormatReader::IsEncrypted() const
+{
+  return (HasAudio() && mInfo.mAudio.mCrypto.mValid) ||
+         (HasVideo() && mInfo.mVideo.mCrypto.mValid);
+}
+
 void
 MediaFormatReader::OnDemuxerInitFailed(const MediaResult& aError)
 {
diff --git a/dom/media/MediaFormatReader.h b/dom/media/MediaFormatReader.h
index 64646ef28dc4..afc90cffa989 100644
--- a/dom/media/MediaFormatReader.h
+++ b/dom/media/MediaFormatReader.h
@@ -105,8 +105,8 @@ public:
 
 private:
 
-  bool HasVideo() { return mVideo.mTrackDemuxer; }
-  bool HasAudio() { return mAudio.mTrackDemuxer; }
+  bool HasVideo() const { return mVideo.mTrackDemuxer; }
+  bool HasAudio() const { return mAudio.mTrackDemuxer; }
 
   bool IsWaitingOnCDMResource();
 
@@ -528,11 +528,7 @@ private:
   // True if we've read the streams' metadata.
   bool mInitDone;
   MozPromiseHolder<MetadataPromise> mMetadataPromise;
-  bool IsEncrypted()
-  {
-    return mIsEncrypted;
-  }
-  bool mIsEncrypted;
+  bool IsEncrypted() const;
 
   // Set to true if any of our track buffers may be blocking.
   bool mTrackDemuxersMayBlock;

From 22b3d811556aab4f87ffd2308fd07efdfbcb4567 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 28 Sep 2016 13:45:25 +1300
Subject: [PATCH 097/102] Bug 1300069 - Remove
 TrackBuffersManager::mIsEncrypted. r=jya

It's write only, so there's no point storing this, and it's not accurate
anyway, as it's actually tracking whether there's encrypted init data in
the media, not whether its got encrypted tracks.


MozReview-Commit-ID: 78iFUyXwRBV

--HG--
extra : rebase_source : f500b90d32da042a550172128a4c79c142048a98
extra : amend_source : c4e31f686e2c0f2c400225919c45c3a530373a8c
---
 dom/media/mediasource/TrackBuffersManager.cpp | 1 -
 dom/media/mediasource/TrackBuffersManager.h   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/dom/media/mediasource/TrackBuffersManager.cpp b/dom/media/mediasource/TrackBuffersManager.cpp
index 32b84c8bc33f..50ead759a487 100644
--- a/dom/media/mediasource/TrackBuffersManager.cpp
+++ b/dom/media/mediasource/TrackBuffersManager.cpp
@@ -1075,7 +1075,6 @@ TrackBuffersManager::OnDemuxerInitDone(nsresult)
     // We clear our crypto init data array, so the MediaFormatReader will
     // not emit an encrypted event for the same init data again.
     info.mCrypto.mInitDatas.Clear();
-    mEncrypted = true;
   }
 
   {
diff --git a/dom/media/mediasource/TrackBuffersManager.h b/dom/media/mediasource/TrackBuffersManager.h
index 455e20288268..bbaf8411768f 100644
--- a/dom/media/mediasource/TrackBuffersManager.h
+++ b/dom/media/mediasource/TrackBuffersManager.h
@@ -240,7 +240,6 @@ private:
   void OnDemuxerInitFailed(const MediaResult& aFailure);
   void OnDemuxerResetDone(nsresult);
   MozPromiseRequestHolder<MediaDataDemuxer::InitPromise> mDemuxerInitRequest;
-  bool mEncrypted;
 
   void OnDemuxFailed(TrackType aTrack, const MediaResult& aError);
   void DoDemuxVideo();

From 556a8f6ea1f4452ba81593e37f43685e3841d69d Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Tue, 27 Sep 2016 19:49:17 -0700
Subject: [PATCH 098/102] Backed out 3 changesets (bug 1301301) for crashing

Backed out changeset da70c5abd73a (bug 1301301)
Backed out changeset 6186eae0c2b7 (bug 1301301)
Backed out changeset 45fb9c1ce63a (bug 1301301)
---
 dom/workers/RuntimeService.cpp         |  10 +++
 js/xpconnect/src/XPCJSContext.cpp      |   2 -
 xpcom/base/CycleCollectedJSContext.cpp | 107 +++++--------------------
 xpcom/base/CycleCollectedJSContext.h   |  13 +--
 4 files changed, 31 insertions(+), 101 deletions(-)

diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index f14177acab0f..cd7c0d18d7c1 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -1099,6 +1099,16 @@ public:
   {
   }
 
+  virtual void
+  BeginCycleCollectionCallback() override
+  {
+  }
+
+  virtual void
+  EndCycleCollectionCallback(CycleCollectorResults &aResults) override
+  {
+  }
+
   void
   DispatchDeferredDeletion(bool aContinuation, bool aPurge) override
   {
diff --git a/js/xpconnect/src/XPCJSContext.cpp b/js/xpconnect/src/XPCJSContext.cpp
index 1fbe657387b8..909e54b8e028 100644
--- a/js/xpconnect/src/XPCJSContext.cpp
+++ b/js/xpconnect/src/XPCJSContext.cpp
@@ -665,7 +665,6 @@ XPCJSContext::PrepareForForgetSkippable()
 void
 XPCJSContext::BeginCycleCollectionCallback()
 {
-    CycleCollectedJSContext::BeginCycleCollectionCallback();
     nsJSContext::BeginCycleCollectionCallback();
 
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
@@ -677,7 +676,6 @@ XPCJSContext::BeginCycleCollectionCallback()
 void
 XPCJSContext::EndCycleCollectionCallback(CycleCollectorResults& aResults)
 {
-    CycleCollectedJSContext::EndCycleCollectionCallback(aResults);
     nsJSContext::EndCycleCollectionCallback(aResults);
 
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
diff --git a/xpcom/base/CycleCollectedJSContext.cpp b/xpcom/base/CycleCollectedJSContext.cpp
index b5f4a13230ca..93b0dc3d839f 100644
--- a/xpcom/base/CycleCollectedJSContext.cpp
+++ b/xpcom/base/CycleCollectedJSContext.cpp
@@ -127,29 +127,11 @@ public:
 
 } // namespace mozilla
 
-struct CCJSTracer : public JS::CallbackTracer
+struct NoteWeakMapChildrenTracer : public JS::CallbackTracer
 {
-protected:
-  CCJSTracer(CycleCollectedJSContext* aCx,
-             WeakMapTraceKind aWeakTraceKind = TraceWeakMapValues)
-    : JS::CallbackTracer(aCx->Context(), aWeakTraceKind)
-    , mCx(aCx)
-  {}
-
-public:
-  void TraceChildren(JS::GCCellPtr aThing)
-  {
-    mCx->TraceJSChildren(this, aThing);
-  }
-
-  CycleCollectedJSContext* mCx;
-};
-
-struct NoteWeakMapChildrenTracer : public CCJSTracer
-{
-  NoteWeakMapChildrenTracer(CycleCollectedJSContext* aCx,
+  NoteWeakMapChildrenTracer(JSContext* aCx,
                             nsCycleCollectionNoteRootCallback& aCb)
-    : CCJSTracer(aCx), mCb(aCb), mTracedAny(false), mMap(nullptr),
+    : JS::CallbackTracer(aCx), mCb(aCb), mTracedAny(false), mMap(nullptr),
       mKey(nullptr), mKeyDelegate(nullptr)
   {
   }
@@ -176,15 +158,14 @@ NoteWeakMapChildrenTracer::onChild(const JS::GCCellPtr& aThing)
     mCb.NoteWeakMapping(mMap, mKey, mKeyDelegate, aThing);
     mTracedAny = true;
   } else {
-    TraceChildren(aThing);
+    JS::TraceChildren(this, aThing);
   }
 }
 
 struct NoteWeakMapsTracer : public js::WeakMapTracer
 {
-  NoteWeakMapsTracer(CycleCollectedJSContext* aCx,
-                     nsCycleCollectionNoteRootCallback& aCccb)
-    : js::WeakMapTracer(aCx->Context()), mCb(aCccb), mChildTracer(aCx, aCccb)
+  NoteWeakMapsTracer(JSContext* aCx, nsCycleCollectionNoteRootCallback& aCccb)
+    : js::WeakMapTracer(aCx), mCb(aCccb), mChildTracer(aCx, aCccb)
   {
   }
   void trace(JSObject* aMap, JS::GCCellPtr aKey, JS::GCCellPtr aValue) override;
@@ -232,7 +213,7 @@ NoteWeakMapsTracer::trace(JSObject* aMap, JS::GCCellPtr aKey,
     mChildTracer.mKeyDelegate = kdelegate;
 
     if (!aValue.is<JSString>()) {
-      mChildTracer.TraceChildren(aValue);
+      JS::TraceChildren(&mChildTracer, aValue);
     }
 
     // The delegate could hold alive the key, so report something to the CC
@@ -343,13 +324,12 @@ JSZoneParticipant::Traverse(void* aPtr, nsCycleCollectionTraversalCallback& aCb)
   return NS_OK;
 }
 
-struct TraversalTracer : public CCJSTracer
+struct TraversalTracer : public JS::CallbackTracer
 {
-  TraversalTracer(CycleCollectedJSContext* aCx,
-                  nsCycleCollectionTraversalCallback& aCb)
-    : CCJSTracer(aCx, DoNotTraceWeakMaps)
-    , mCb(aCb)
-  {}
+  TraversalTracer(JSContext* aCx, nsCycleCollectionTraversalCallback& aCb)
+    : JS::CallbackTracer(aCx, DoNotTraceWeakMaps), mCb(aCb)
+  {
+  }
   void onChild(const JS::GCCellPtr& aThing) override;
   nsCycleCollectionTraversalCallback& mCb;
 };
@@ -386,7 +366,7 @@ TraversalTracer::onChild(const JS::GCCellPtr& aThing)
     // be traced.
     JS_TraceObjectGroupCycleCollectorChildren(this, aThing);
   } else if (!aThing.is<JSString>()) {
-    TraceChildren(aThing);
+    JS::TraceChildren(this, aThing);
   }
 }
 
@@ -462,10 +442,6 @@ CycleCollectedJSContext::CycleCollectedJSContext()
   , mDisableMicroTaskCheckpoint(false)
   , mOutOfMemoryState(OOMState::OK)
   , mLargeAllocationFailureState(OOMState::OK)
-#ifdef DEBUG
-  , mNumTraversedGCThings(0)
-  , mNumTraceChildren(0)
-#endif // DEBUG
 {
   nsCOMPtr<nsIThread> thread = do_GetCurrentThread();
   mOwningThread = thread.forget().downcast<nsThread>().take();
@@ -654,11 +630,11 @@ CycleCollectedJSContext::DescribeGCThing(bool aIsMarked, JS::GCCellPtr aThing,
 
 void
 CycleCollectedJSContext::NoteGCThingJSChildren(JS::GCCellPtr aThing,
-                                               nsCycleCollectionTraversalCallback& aCb)
+                                               nsCycleCollectionTraversalCallback& aCb) const
 {
   MOZ_ASSERT(mJSContext);
-  TraversalTracer trc(this, aCb);
-  trc.TraceChildren(aThing);
+  TraversalTracer trc(mJSContext, aCb);
+  JS::TraceChildren(&trc, aThing);
 }
 
 void
@@ -715,10 +691,6 @@ CycleCollectedJSContext::TraverseGCThing(TraverseSelect aTs, JS::GCCellPtr aThin
     return;
   }
 
-#ifdef DEBUG
-  ++mNumTraversedGCThings;
-#endif
-
   if (aTs == TRAVERSE_FULL) {
     NoteGCThingJSChildren(aThing, aCb);
   }
@@ -761,7 +733,7 @@ CycleCollectedJSContext::TraverseZone(JS::Zone* aZone,
    * iterate over. Edges between compartments in the same zone will add
    * unnecessary loop edges to the graph (bug 842137).
    */
-  TraversalTracer trc(this, aCb);
+  TraversalTracer trc(mJSContext, aCb);
   js::VisitGrayWrapperTargets(aZone, NoteJSChildGrayWrapperShim, &trc);
 
   /*
@@ -1240,7 +1212,7 @@ CycleCollectedJSContext::TraverseRoots(nsCycleCollectionNoteRootCallback& aCb)
 
   TraverseNativeRoots(aCb);
 
-  NoteWeakMapsTracer trc(this, aCb);
+  NoteWeakMapsTracer trc(mJSContext, aCb);
   js::TraceWeakMaps(&trc);
 
   return NS_OK;
@@ -1358,40 +1330,6 @@ CycleCollectedJSContext::DumpJSHeap(FILE* aFile)
   js::DumpHeap(Context(), aFile, js::CollectNurseryBeforeDump);
 }
 
-void
-CycleCollectedJSContext::BeginCycleCollectionCallback()
-{
-#ifdef DEBUG
-  mNumTraversedGCThings = 0;
-  mNumTraceChildren = 0;
-#endif
-}
-
-void
-CycleCollectedJSContext::EndCycleCollectionCallback(CycleCollectorResults& aResults)
-{
-#ifdef DEBUG
-
-  // GC things that the cycle collector calls Traverse on (ie things
-  // in the CC graph) will also get JS::TraceChildren() called on
-  // them. If a child of a GC thing in the CC graph does not have an
-  // AddToCCKind(), then the CC calls JS::TraceChildren() on it
-  // without adding it to the graph. If there are many such objects
-  // that are referred to by many objects in the CC graph, then the CC
-  // can spend a lot of time in JS::TraceChildren(). If you add a new
-  // TraceKind and are hitting this assertion, adding it to
-  // AddToCCKind might help. (The check is not done for small CC
-  // graphs to avoid noise.)
-  if (mNumTraceChildren > 1000 && mNumTraversedGCThings > 0) {
-    double traceRatio = ((double)mNumTraceChildren) / ((double)mNumTraversedGCThings);
-    MOZ_ASSERT(traceRatio < 2.2, "Excessive calls to JS::TraceChildren by the cycle collector");
-  }
-
-  mNumTraversedGCThings = 0;
-  mNumTraceChildren = 0;
-#endif
-}
-
 void
 CycleCollectedJSContext::ProcessStableStateQueue()
 {
@@ -1731,15 +1669,6 @@ CycleCollectedJSContext::OnLargeAllocationFailure()
   AnnotateAndSetOutOfMemory(&mLargeAllocationFailureState, OOMState::Reported);
 }
 
-void
-CycleCollectedJSContext::TraceJSChildren(JSTracer* aTrc, JS::GCCellPtr aThing)
-{
-#ifdef DEBUG
-  ++mNumTraceChildren;
-#endif // DEBUG
-  JS::TraceChildren(aTrc, aThing);
-}
-
 void
 CycleCollectedJSContext::PrepareWaitingZonesForGC()
 {
diff --git a/xpcom/base/CycleCollectedJSContext.h b/xpcom/base/CycleCollectedJSContext.h
index 5cc0026d214b..9415634b8951 100644
--- a/xpcom/base/CycleCollectedJSContext.h
+++ b/xpcom/base/CycleCollectedJSContext.h
@@ -176,7 +176,7 @@ private:
 
   void
   NoteGCThingJSChildren(JS::GCCellPtr aThing,
-                        nsCycleCollectionTraversalCallback& aCb);
+                        nsCycleCollectionTraversalCallback& aCb) const;
 
   void
   NoteGCThingXPCOMChildren(const js::Class* aClasp, JSObject* aObj,
@@ -321,8 +321,8 @@ public:
   void DumpJSHeap(FILE* aFile);
 
   virtual void PrepareForForgetSkippable() = 0;
-  virtual void BeginCycleCollectionCallback();
-  virtual void EndCycleCollectionCallback(CycleCollectorResults& aResults);
+  virtual void BeginCycleCollectionCallback() = 0;
+  virtual void EndCycleCollectionCallback(CycleCollectorResults& aResults) = 0;
   virtual void DispatchDeferredDeletion(bool aContinuation, bool aPurge = false) = 0;
 
   JSContext* Context() const
@@ -395,8 +395,6 @@ public:
     mZonesWaitingForGC.PutEntry(aZone);
   }
 
-  void TraceJSChildren(JSTracer* aTrc, JS::GCCellPtr aThing);
-
   // Prepare any zones for GC that have been passed to AddZoneWaitingForGC()
   // since the last GC or since the last call to PrepareWaitingZonesForGC(),
   // whichever was most recent. If there were no such zones, prepare for a
@@ -478,11 +476,6 @@ private:
     void invoke(JS::HandleObject scope, Closure& closure) override;
   };
   EnvironmentPreparer mEnvironmentPreparer;
-
-#ifdef DEBUG
-  uint32_t mNumTraversedGCThings;
-  uint32_t mNumTraceChildren;
-#endif // DEBUG
 };
 
 void TraceScriptHolder(nsISupports* aHolder, JSTracer* aTracer);

From 07037f896bf7e5f929a0b58e52ef3624413592d0 Mon Sep 17 00:00:00 2001
From: Alexandre Lissy <lissyx@lissyx.dyndns.org>
Date: Tue, 27 Sep 2016 10:46:41 +0200
Subject: [PATCH 099/102] Bug 1305655 - Decouple Gonk TextureForwarder and
 CompositableForwarder (followup bug 1281456) r=nical

MozReview-Commit-ID: 1sUiqnFEPdx
---
 dom/canvas/WebGLContext.cpp                                | 2 +-
 dom/media/platforms/gonk/GonkVideoDecoderManager.cpp       | 6 +++---
 gfx/gl/SurfaceTypes.cpp                                    | 2 +-
 gfx/gl/SurfaceTypes.h                                      | 4 ++--
 gfx/layers/GrallocImages.cpp                               | 4 ++--
 gfx/layers/GrallocImages.h                                 | 2 +-
 gfx/layers/client/TextureClient.cpp                        | 2 +-
 gfx/layers/client/TextureClient.h                          | 1 +
 gfx/layers/ipc/ImageBridgeChild.cpp                        | 4 ++--
 gfx/layers/opengl/GrallocTextureClient.cpp                 | 7 ++-----
 gfx/layers/opengl/GrallocTextureClient.h                   | 1 +
 widget/gonk/nativewindow/GonkBufferQueueJB.cpp             | 2 +-
 widget/gonk/nativewindow/GonkBufferQueueKK.cpp             | 2 +-
 .../GonkBufferQueueLL/GonkBufferQueueProducer.cpp          | 2 +-
 14 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/dom/canvas/WebGLContext.cpp b/dom/canvas/WebGLContext.cpp
index f61cb3b85141..87ede3fcaad0 100644
--- a/dom/canvas/WebGLContext.cpp
+++ b/dom/canvas/WebGLContext.cpp
@@ -569,7 +569,7 @@ BaseCaps(const WebGLContextOptions& options, WebGLContext* webgl)
         if (!forwarder)
             break;
 
-        baseCaps.surfaceAllocator = static_cast<layers::ISurfaceAllocator*>(forwarder);
+        baseCaps.surfaceAllocator = forwarder->GetTextureForwarder();
     } while (false);
 #endif
 
diff --git a/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp b/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp
index 06e0cb298462..0c7b3b6af95f 100644
--- a/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp
+++ b/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp
@@ -52,7 +52,7 @@ public:
     , mGrallocFormat(aGrallocFormat)
   {}
 
-  already_AddRefed<TextureClient> Allocate(TextureForwarder* aAllocator) override
+  already_AddRefed<TextureClient> Allocate(KnowsCompositor* aAllocator) override
   {
     uint32_t usage = android::GraphicBuffer::USAGE_SW_READ_OFTEN |
                      android::GraphicBuffer::USAGE_SW_WRITE_OFTEN |
@@ -60,7 +60,7 @@ public:
 
     GrallocTextureData* texData = GrallocTextureData::Create(mSize, mGrallocFormat,
                                                              gfx::BackendType::NONE,
-                                                             usage, aAllocator);
+                                                             usage, aAllocator->GetTextureForwarder());
     if (!texData) {
       return nullptr;
     }
@@ -69,7 +69,7 @@ public:
       return nullptr;
     }
     RefPtr<TextureClient> textureClient =
-      TextureClient::CreateWithData(texData, TextureFlags::DEALLOCATE_CLIENT, aAllocator);
+      TextureClient::CreateWithData(texData, TextureFlags::DEALLOCATE_CLIENT, aAllocator->GetTextureForwarder());
     return textureClient.forget();
   }
 
diff --git a/gfx/gl/SurfaceTypes.cpp b/gfx/gl/SurfaceTypes.cpp
index bdaebb5384f1..9c3e8a2e140f 100644
--- a/gfx/gl/SurfaceTypes.cpp
+++ b/gfx/gl/SurfaceTypes.cpp
@@ -5,7 +5,7 @@
 
 #include "SurfaceTypes.h"
 
-#include "mozilla/layers/ISurfaceAllocator.h"
+#include "mozilla/layers/TextureForwarder.h"
 
 namespace mozilla {
 namespace gl {
diff --git a/gfx/gl/SurfaceTypes.h b/gfx/gl/SurfaceTypes.h
index b3b9a127ac4d..aae21e0a9f73 100644
--- a/gfx/gl/SurfaceTypes.h
+++ b/gfx/gl/SurfaceTypes.h
@@ -12,7 +12,7 @@
 
 namespace mozilla {
 namespace layers {
-class ISurfaceAllocator;
+class LayersIPCChannel;
 } // namespace layers
 
 namespace gl {
@@ -29,7 +29,7 @@ struct SurfaceCaps final
 
     // The surface allocator that we want to create this
     // for.  May be null.
-    RefPtr<layers::ISurfaceAllocator> surfaceAllocator;
+    RefPtr<layers::LayersIPCChannel> surfaceAllocator;
 
     SurfaceCaps();
     SurfaceCaps(const SurfaceCaps& other);
diff --git a/gfx/layers/GrallocImages.cpp b/gfx/layers/GrallocImages.cpp
index 909fd0a71a3a..ed18d8b56d39 100644
--- a/gfx/layers/GrallocImages.cpp
+++ b/gfx/layers/GrallocImages.cpp
@@ -73,7 +73,7 @@ GrallocImage::SetData(const Data& aData)
     return false;
   }
 
-  RefPtr<ClientIPCAllocator> allocator = ImageBridgeChild::GetSingleton();
+  RefPtr<LayersIPCChannel> allocator = ImageBridgeChild::GetSingleton();
   GrallocTextureData* texData = GrallocTextureData::Create(mData.mYSize, HAL_PIXEL_FORMAT_YV12,
                                                            gfx::BackendType::NONE,
                                                            GraphicBuffer::USAGE_SW_READ_OFTEN |
@@ -469,7 +469,7 @@ GrallocImage::GetNativeBuffer()
 }
 
 TextureClient*
-GrallocImage::GetTextureClient(TextureForwarder* aForwarder)
+GrallocImage::GetTextureClient(KnowsCompositor* aForwarder)
 {
   return mTextureClient;
 }
diff --git a/gfx/layers/GrallocImages.h b/gfx/layers/GrallocImages.h
index 8d6e4a47146f..22b4bdc9b883 100644
--- a/gfx/layers/GrallocImages.h
+++ b/gfx/layers/GrallocImages.h
@@ -93,7 +93,7 @@ public:
 
   virtual bool IsValid() { return !!mTextureClient; }
 
-  virtual TextureClient* GetTextureClient(TextureForwarder* aForwarder) override;
+  virtual TextureClient* GetTextureClient(KnowsCompositor* aForwarder) override;
 
   virtual GrallocImage* AsGrallocImage() override
   {
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index 0a9a29d39a71..a3b9092a3a6c 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -1132,7 +1132,7 @@ TextureClient::CreateForDrawing(TextureForwarder* aAllocator,
 #endif
 
 #ifdef MOZ_WIDGET_GONK
-  if (!data) {
+  if (!data && aSize.width <= aMaxTextureSize && aSize.height <= aMaxTextureSize) {
     data = GrallocTextureData::CreateForDrawing(aSize, aFormat, moz2DBackend,
                                                 aAllocator);
   }
diff --git a/gfx/layers/client/TextureClient.h b/gfx/layers/client/TextureClient.h
index 308d2cef2532..f8cce039a8a7 100644
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@@ -21,6 +21,7 @@
 #include "mozilla/ipc/Shmem.h"          // for Shmem
 #include "mozilla/layers/AtomicRefCountedWithFinalize.h"
 #include "mozilla/layers/CompositorTypes.h"  // for TextureFlags, etc
+#include "mozilla/layers/ISurfaceAllocator.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/LayersSurfaces.h"  // for SurfaceDescriptor
 #include "mozilla/mozalloc.h"           // for operator delete
diff --git a/gfx/layers/ipc/ImageBridgeChild.cpp b/gfx/layers/ipc/ImageBridgeChild.cpp
index 8f4ef09e5ed7..c82c5d92bf5b 100644
--- a/gfx/layers/ipc/ImageBridgeChild.cpp
+++ b/gfx/layers/ipc/ImageBridgeChild.cpp
@@ -335,9 +335,9 @@ ImageBridgeChild::NotifyNotUsedToNonRecycle(uint64_t aTextureId, uint64_t aTrans
   // Release TextureClient on allocator's message loop.
   RefPtr<TextureClientReleaseTask> task =
     MakeAndAddRef<TextureClientReleaseTask>(client);
-  RefPtr<ClientIPCAllocator> allocator = client->GetAllocator();
+  RefPtr<LayersIPCChannel> allocator = client->GetAllocator();
   client = nullptr;
-  allocator->AsClientAllocator()->GetMessageLoop()->PostTask(task.forget());
+  allocator->GetMessageLoop()->PostTask(task.forget());
 #else
   NS_RUNTIMEABORT("not reached");
 #endif
diff --git a/gfx/layers/opengl/GrallocTextureClient.cpp b/gfx/layers/opengl/GrallocTextureClient.cpp
index e01c137e2808..93a20d969fc5 100644
--- a/gfx/layers/opengl/GrallocTextureClient.cpp
+++ b/gfx/layers/opengl/GrallocTextureClient.cpp
@@ -8,7 +8,7 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/layers/AsyncTransactionTracker.h" // for AsyncTransactionTracker
 #include "mozilla/layers/GrallocTextureClient.h"
-#include "mozilla/layers/CompositableForwarder.h"
+#include "mozilla/layers/TextureForwarder.h"
 #include "mozilla/layers/ISurfaceAllocator.h"
 #include "mozilla/layers/ShadowLayerUtilsGralloc.h"
 #include "mozilla/layers/SharedBufferManagerChild.h"
@@ -295,10 +295,6 @@ GrallocTextureData::Create(gfx::IntSize aSize, AndroidFormat aAndroidFormat,
   if (!aAllocator || !aAllocator->IPCOpen()) {
     return nullptr;
   }
-  int32_t maxSize = aAllocator->AsClientAllocator()->GetMaxTextureSize();
-  if (aSize.width > maxSize || aSize.height > maxSize) {
-    return nullptr;
-  }
   gfx::SurfaceFormat format;
   switch (aAndroidFormat) {
   case android::PIXEL_FORMAT_RGBA_8888:
@@ -447,6 +443,7 @@ GrallocTextureData::TextureClientFromSharedSurface(gl::SharedSurface* abstractSu
 
 TextureData*
 GrallocTextureData::CreateSimilar(LayersIPCChannel* aAllocator,
+                                  LayersBackend aLayersBackend,
                                   TextureFlags aFlags,
                                   TextureAllocationFlags aAllocFlags) const
 {
diff --git a/gfx/layers/opengl/GrallocTextureClient.h b/gfx/layers/opengl/GrallocTextureClient.h
index fe4c36d2a348..f728e560ff45 100644
--- a/gfx/layers/opengl/GrallocTextureClient.h
+++ b/gfx/layers/opengl/GrallocTextureClient.h
@@ -75,6 +75,7 @@ public:
 
   virtual TextureData*
   CreateSimilar(LayersIPCChannel* aAllocator,
+                LayersBackend aLayersBackend,
                 TextureFlags aFlags = TextureFlags::DEFAULT,
                 TextureAllocationFlags aAllocFlags = ALLOC_DEFAULT) const override;
 
diff --git a/widget/gonk/nativewindow/GonkBufferQueueJB.cpp b/widget/gonk/nativewindow/GonkBufferQueueJB.cpp
index c353546a07cf..81502f81eecd 100644
--- a/widget/gonk/nativewindow/GonkBufferQueueJB.cpp
+++ b/widget/gonk/nativewindow/GonkBufferQueueJB.cpp
@@ -424,7 +424,7 @@ status_t GonkBufferQueue::dequeueBuffer(int *outBuf, sp<Fence>* outFence,
     if (returnFlags & IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION) {
 
         usage |= GraphicBuffer::USAGE_HW_TEXTURE;
-        RefPtr<ClientIPCAllocator> allocator = ImageBridgeChild::GetSingleton();
+        RefPtr<LayersIPCChannel> allocator = ImageBridgeChild::GetSingleton();
         GrallocTextureData* texData = GrallocTextureData::Create(IntSize(w,h), format,
                                                                  gfx::BackendType::NONE, usage,
                                                                  allocator);
diff --git a/widget/gonk/nativewindow/GonkBufferQueueKK.cpp b/widget/gonk/nativewindow/GonkBufferQueueKK.cpp
index 379ae4c7f66e..0c5cdfeb9f40 100644
--- a/widget/gonk/nativewindow/GonkBufferQueueKK.cpp
+++ b/widget/gonk/nativewindow/GonkBufferQueueKK.cpp
@@ -443,7 +443,7 @@ status_t GonkBufferQueue::dequeueBuffer(int *outBuf, sp<Fence>* outFence, bool a
 
     if (returnFlags & IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION) {
 
-        RefPtr<ClientIPCAllocator> allocator = ImageBridgeChild::GetSingleton();
+        RefPtr<LayersIPCChannel> allocator = ImageBridgeChild::GetSingleton();
         usage |= GraphicBuffer::USAGE_HW_TEXTURE;
         GrallocTextureData* texData = GrallocTextureData::Create(IntSize(w, h), format,
                                                                  gfx::BackendType::NONE, usage,
diff --git a/widget/gonk/nativewindow/GonkBufferQueueLL/GonkBufferQueueProducer.cpp b/widget/gonk/nativewindow/GonkBufferQueueLL/GonkBufferQueueProducer.cpp
index 3dcf6c321b76..d3436756fb86 100644
--- a/widget/gonk/nativewindow/GonkBufferQueueLL/GonkBufferQueueProducer.cpp
+++ b/widget/gonk/nativewindow/GonkBufferQueueLL/GonkBufferQueueProducer.cpp
@@ -342,7 +342,7 @@ status_t GonkBufferQueueProducer::dequeueBuffer(int *outSlot,
     } // Autolock scope
 
     if (returnFlags & BUFFER_NEEDS_REALLOCATION) {
-        RefPtr<ClientIPCAllocator> allocator = ImageBridgeChild::GetSingleton();
+        RefPtr<LayersIPCChannel> allocator = ImageBridgeChild::GetSingleton();
         usage |= GraphicBuffer::USAGE_HW_TEXTURE;
         GrallocTextureData* texData = GrallocTextureData::Create(IntSize(width,height), format,
                                                                  gfx::BackendType::NONE,

From fd9e045dcb4cd1a84e65579d83e5f691cb048ff9 Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Wed, 28 Sep 2016 14:12:54 +0900
Subject: [PATCH 100/102] Bug 1304970 - Check encoding of js.msg-like files.
 r=jandem,gps

---
 config/check_js_msg_encoding.py | 63 +++++++++++++++++++++++++++++++++
 dom/bindings/Errors.msg         |  2 +-
 js/src/Makefile.in              |  5 ++-
 testing/mach_commands.py        |  6 +++-
 4 files changed, 73 insertions(+), 3 deletions(-)
 create mode 100644 config/check_js_msg_encoding.py

diff --git a/config/check_js_msg_encoding.py b/config/check_js_msg_encoding.py
new file mode 100644
index 000000000000..9c6b739d402f
--- /dev/null
+++ b/config/check_js_msg_encoding.py
@@ -0,0 +1,63 @@
+# vim: set ts=8 sts=4 et sw=4 tw=99:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#----------------------------------------------------------------------------
+# This script checks encoding of the files that define JSErrorFormatStrings.
+#
+# JSErrorFormatString.format member should be in ASCII encoding.
+#----------------------------------------------------------------------------
+
+from __future__ import print_function
+
+import os
+import sys
+from check_utils import get_all_toplevel_filenames
+
+scriptname = os.path.basename(__file__);
+expected_encoding = 'ascii'
+
+# The following files don't define JSErrorFormatString.
+ignore_files = [
+    'dom/base/domerr.msg',
+    'js/xpconnect/src/xpc.msg',
+]
+
+def log_pass(filename, text):
+    print('TEST-PASS | {} | {} | {}'.format(scriptname, filename, text))
+
+def log_fail(filename, text):
+    print('TEST-UNEXPECTED-FAIL | {} | {} | {}'.format(scriptname, filename,
+                                                       text))
+
+def check_single_file(filename):
+    with open(filename, 'rb') as f:
+        data = f.read()
+        try:
+            data.decode(expected_encoding)
+        except:
+            log_fail(filename, 'not in {} encoding'.format(expected_encoding))
+
+    log_pass(filename, 'ok')
+    return True
+
+def check_files():
+    result = True
+
+    for filename in get_all_toplevel_filenames():
+        if filename.endswith('.msg'):
+            if filename not in ignore_files:
+                if not check_single_file(filename):
+                    result = False
+
+    return result
+
+def main():
+    if not check_files():
+        sys.exit(1)
+
+    sys.exit(0)
+
+if __name__ == '__main__':
+    main()
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index 0ef297a03597..047bc8101975 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -94,7 +94,7 @@ MSG_DEF(MSG_SW_INSTALL_ERROR, 2, JSEXN_TYPEERR, "ServiceWorker script at {0} for
 MSG_DEF(MSG_SW_SCRIPT_THREW, 2, JSEXN_TYPEERR, "ServiceWorker script at {0} for scope {1} threw an exception during script evaluation.")
 MSG_DEF(MSG_TYPEDARRAY_IS_SHARED, 1, JSEXN_TYPEERR, "{0} can't be a typed array on SharedArrayBuffer")
 MSG_DEF(MSG_CACHE_ADD_FAILED_RESPONSE, 3, JSEXN_TYPEERR, "Cache got {0} response with bad status {1} while trying to add request {2}")
-MSG_DEF(MSG_SW_UPDATE_BAD_REGISTRATION, 2, JSEXN_TYPEERR, "Failed to update the ServiceWorker for scope {0] because the registration has been {1} since the update was scheduled.")
+MSG_DEF(MSG_SW_UPDATE_BAD_REGISTRATION, 2, JSEXN_TYPEERR, "Failed to update the ServiceWorker for scope {0} because the registration has been {1} since the update was scheduled.")
 MSG_DEF(MSG_INVALID_DURATION_ERROR, 1, JSEXN_TYPEERR, "Invalid duration '{0}'.")
 MSG_DEF(MSG_INVALID_EASING_ERROR, 1, JSEXN_TYPEERR, "Invalid easing '{0}'.")
 MSG_DEF(MSG_INVALID_SPACING_MODE_ERROR, 1, JSEXN_TYPEERR, "Invalid spacing '{0}'.")
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index fc37686501db..054c2e99489d 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -88,6 +88,9 @@ check-style::
 check-masm::
 	(cd $(srcdir) && $(PYTHON) $(topsrcdir)/config/check_macroassembler_style.py);
 
+check-js-msg::
+	(cd $(topsrcdir) && $(PYTHON) $(topsrcdir)/config/check_js_msg_encoding.py);
+
 check-jit-test::
 	$(JITTEST_SANITIZER_ENV) $(wildcard $(RUN_TEST_PROGRAM)) $(PYTHON) -u $(srcdir)/jit-test/jit_test.py \
 	        --no-slow --no-progress --format=automation --jitflags=all \
@@ -95,7 +98,7 @@ check-jit-test::
 			$(JITTEST_EXTRA_ARGS) \
 	        $(DIST)/bin/$(JS_SHELL_NAME)$(BIN_SUFFIX) $(JITTEST_TEST_ARGS)
 
-check:: check-style check-masm
+check:: check-style check-masm check-js-msg
 
 check-jstests:
 	$(wildcard $(RUN_TEST_PROGRAM)) $(PYTHON) -u $(srcdir)/tests/jstests.py \
diff --git a/testing/mach_commands.py b/testing/mach_commands.py
index 26ee9531dee9..0612d111b33b 100644
--- a/testing/mach_commands.py
+++ b/testing/mach_commands.py
@@ -471,7 +471,11 @@ class CheckSpiderMonkeyCommand(MachCommandBase):
         check_masm_cmd = [sys.executable, os.path.join(self.topsrcdir, 'config', 'check_macroassembler_style.py')]
         check_masm_result = subprocess.call(check_masm_cmd, cwd=os.path.join(self.topsrcdir, 'js', 'src'))
 
-        all_passed = jittest_result and jstest_result and jsapi_tests_result and check_style_result and check_masm_result
+        print('running check-js-msg-encoding')
+        check_js_msg_cmd = [sys.executable, os.path.join(self.topsrcdir, 'config', 'check_js_msg_encoding.py')]
+        check_js_msg_result = subprocess.call(check_js_msg_cmd, cwd=self.topsrcdir)
+
+        all_passed = jittest_result and jstest_result and jsapi_tests_result and check_style_result and check_masm_result and check_js_msg_result
 
         return all_passed
 

From 70a2171f15ead58e566c1e6193f956e1b430581e Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Wed, 28 Sep 2016 14:12:54 +0900
Subject: [PATCH 101/102] Bug 1300133 - Fix js-ctypes test harness to print
 assertion failure message and stack properly. r=bholley

---
 .../tests/chrome/xpcshellTestHarnessAdaptor.js | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/ctypes/tests/chrome/xpcshellTestHarnessAdaptor.js b/toolkit/components/ctypes/tests/chrome/xpcshellTestHarnessAdaptor.js
index ba11e0d5147a..eec85025b5c5 100644
--- a/toolkit/components/ctypes/tests/chrome/xpcshellTestHarnessAdaptor.js
+++ b/toolkit/components/ctypes/tests/chrome/xpcshellTestHarnessAdaptor.js
@@ -18,17 +18,31 @@ var Components = {
 };
 
 function do_throw(message, stack) {
+  do_print("error: " + message);
+  do_print("stack: " + (stack ? stack : new Error().stack));
   throw message;
 }
 
 function do_check_neq(left, right, stack) {
-  if (left == right)
+  if (left == right) {
+    var text = "do_check_neq failed";
+    try {
+      text += ": " + left + " == " + right;
+    } catch (e) {
+    }
     do_throw(text, stack);
+  }
 }
 
 function do_check_eq(left, right, stack) {
-  if (left != right)
+  if (left != right) {
+    var text = "do_check_eq failed";
+    try {
+      text += ": " + left + " != " + right;
+    } catch (e) {
+    }
     do_throw(text, stack);
+  }
 }
 
 function do_check_true(condition, stack) {

From 398815ad9b0efc62eef01215b05c498c5562817b Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Tue, 27 Sep 2016 22:39:00 -0700
Subject: [PATCH 102/102] Backed out changeset 490c671f8047 (bug 1303121) for
 failures in test_CrossSiteXHR.html

---
 dom/base/test/test_bug435425.html             | 22 +++----
 dom/xhr/XMLHttpRequestMainThread.cpp          |  7 ++-
 ...progress-events-response-data-gzip.htm.ini |  5 ++
 .../tests/XMLHttpRequest/abort-after-send.htm | 39 +++++++-----
 .../XMLHttpRequest/abort-during-upload.htm    |  2 +-
 .../XMLHttpRequest/abort-event-order.htm      |  2 +-
 .../XMLHttpRequest/event-timeout-order.htm    |  2 +-
 .../progress-events-response-data-gzip.htm    | 28 ++++-----
 .../resources/xmlhttprequest-event-order.js   | 59 ++-----------------
 .../send-response-event-order.htm             | 37 ++++++++++--
 10 files changed, 96 insertions(+), 107 deletions(-)
 create mode 100644 testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini

diff --git a/dom/base/test/test_bug435425.html b/dom/base/test/test_bug435425.html
index 828931d67d17..0e4e3a4ebd28 100644
--- a/dom/base/test/test_bug435425.html
+++ b/dom/base/test/test_bug435425.html
@@ -217,7 +217,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -236,7 +236,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -255,7 +255,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -274,7 +274,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -293,7 +293,7 @@ var tests =
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -317,10 +317,10 @@ var tests =
     { method: "POST", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: true},
+                       {target: UPLOAD, type: "progress", optional: false},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -351,10 +351,10 @@ var tests =
     { method: "POST", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: true},
+                       {target: UPLOAD, type: "progress", optional: false},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
@@ -385,10 +385,10 @@ var tests =
     { method: "POST", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: true},
+                       {target: UPLOAD, type: "progress", optional: false},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: true},
+                       {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 99162070b899..496ee55c0937 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -1038,8 +1038,10 @@ XMLHttpRequestMainThread::CloseRequestWithError(const ProgressEventType aType)
     if (!mFlagSyncLooping) {
       if (mUpload && !mUploadComplete) {
         mUploadComplete = true;
+        DispatchProgressEvent(mUpload, ProgressEventType::progress, 0, 0);
         DispatchProgressEvent(mUpload, aType, 0, 0);
       }
+      DispatchProgressEvent(this, ProgressEventType::progress, 0, 0);
       DispatchProgressEvent(this, aType, 0, 0);
     }
   }
@@ -2182,9 +2184,10 @@ XMLHttpRequestMainThread::ChangeStateToDone()
   // Per spec, fire readystatechange=4/done before final error events.
   ChangeState(State::done, true);
 
-  // Per spec, if we failed in the upload phase, fire a final error
-  // and loadend events for the upload after readystatechange=4/done.
+  // Per spec, if we failed in the upload phase, fire a final progress, error,
+  // and loadend event for the upload after readystatechange=4/done.
   if (!mFlagSynchronous && mUpload && !mUploadComplete) {
+    DispatchProgressEvent(mUpload, ProgressEventType::progress, 0, 0);
     DispatchProgressEvent(mUpload, ProgressEventType::error, 0, 0);
   }
 
diff --git a/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini b/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini
new file mode 100644
index 000000000000..5adf572e37d3
--- /dev/null
+++ b/testing/web-platform/meta/XMLHttpRequest/progress-events-response-data-gzip.htm.ini
@@ -0,0 +1,5 @@
+[progress-events-response-data-gzip.htm]
+  type: testharness
+  [XMLHttpRequest: progress events and GZIP encoding]
+    expected: FAIL
+
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm b/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
index 523a0d616b64..c4885c9911b0 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-after-send.htm
@@ -4,7 +4,6 @@
     <title>XMLHttpRequest: abort() after send()</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
-    <script src="resources/xmlhttprequest-event-order.js"></script>
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-abort()-method" data-tested-assertations="following-sibling::ol/li[1] following-sibling::ol/li[3] following-sibling::ol/li[4] following-sibling::ol/li[4]/ol/li[1] following-sibling::ol/li[4]/ol/li[3] following-sibling::ol/li[4]/ol/li[4] following-sibling::ol/li[4]/ol/li[5] following-sibling::ol/li[4]/ol/li[6] following-sibling::ol/li[5]" />
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-responsetext-attribute" data-tested-assertations="following::ol/li[3]" />
     <link rel="help" href="https://xhr.spec.whatwg.org/#the-responsexml-attribute" data-tested-assertations="following::ol/li[3]" />
@@ -20,26 +19,36 @@
       var test = async_test()
       test.step(function() {
         var client = new XMLHttpRequest(),
-            control_flag = false;
-        prepare_xhr_for_event_order_test(client);
-        client.addEventListener("readystatechange", test.step_func(function() {
-          if(client.readyState == 4) {
-            control_flag = true
-            assert_equals(client.responseXML, null)
-            assert_equals(client.responseText, "")
-            assert_equals(client.status, 0)
-            assert_equals(client.statusText, "")
-            assert_equals(client.getAllResponseHeaders(), "")
-            assert_equals(client.getResponseHeader('Content-Type'), null)
-          }
-        }))
+            control_flag = false,
+            result = [],
+            expected = [1, 4, 'progress', 'abort', 'loadend'] // open() -> 1, abort() -> 4
+        client.onreadystatechange = function() {
+          test.step(function() {
+            result.push(client.readyState)
+            if(client.readyState == 4) {
+              control_flag = true
+              assert_equals(client.responseXML, null)
+              assert_equals(client.responseText, "")
+              assert_equals(client.status, 0)
+              assert_equals(client.statusText, "")
+              assert_equals(client.getAllResponseHeaders(), "")
+              assert_equals(client.getResponseHeader('Content-Type'), null)
+            }
+          })
+        }
         client.open("GET", "resources/well-formed.xml", true)
         client.send(null)
+        client.addEventListener('progress', logEvt)
+        client.addEventListener('abort', logEvt)
+        client.addEventListener('loadend', logEvt)
         client.abort()
         assert_true(control_flag)
         assert_equals(client.readyState, 0)
-        assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "abort(0,0,false)", "loadend(0,0,false)"])
+        assert_array_equals(result, expected)
         test.done()
+        function logEvt (e) {
+          result.push(e.type)
+        }
       })
     </script>
   </body>
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm b/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
index 9fbc8b9bbb47..766dcc4693d8 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-during-upload.htm
@@ -18,7 +18,7 @@
         client.open("POST", "resources/delay.py?ms=1000")
         client.addEventListener("loadend", function(e) {
           test.step(function() {
-            assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,9999,true)", 4, "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
+            assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,9999,true)", 4, "upload.progress(0,0,false)", "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
             test.done()
           })
         });
diff --git a/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm b/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
index f05c20628c4a..cb405a71accf 100644
--- a/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/abort-event-order.htm
@@ -37,7 +37,7 @@
             {
                 test.step(function()
                 {
-                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
+                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "upload.progress(0,0,false)", "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"]);
 
                     assert_equals(xhr.readyState, 0, 'state should be UNSENT');
                     test.done();
diff --git a/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm b/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
index 7376ca2f8b14..1d9ba31d6e06 100644
--- a/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/event-timeout-order.htm
@@ -20,7 +20,7 @@
             prepare_xhr_for_event_order_test(xhr);
             xhr.addEventListener("loadend", function() {
                 test.step(function() {
-                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", 4, "upload.timeout(0,0,false)", "upload.loadend(0,0,false)", "timeout(0,0,false)", "loadend(0,0,false)"]);
+                    assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", 4, "upload.progress(0,0,false)", "upload.timeout(0,0,false)", "upload.loadend(0,0,false)", "progress(0,0,false)", "timeout(0,0,false)", "loadend(0,0,false)"]);
                     test.done();
                 });
             });
diff --git a/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm b/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
index 058064636d43..dc166a2396a4 100644
--- a/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/progress-events-response-data-gzip.htm
@@ -36,20 +36,17 @@
 
           * If lengthComputable is true:
               * Event.total must match Content-length header
-              * event.loaded must only ever increase in progress events
-                (and may never repeat its value).
-              * event.loaded must never exceed the Content-length.
+              * event.loaded should be a smaller number while resource is loading
+                and match Content-length when loading is finished
+              * Setting event.loaded to equal event.total for each progress event if the
+                resource is not fully downloaded would be cheating
 
           * If lengthComputable is false:
               * event.total should be 0
-              * event.loaded must only ever increase in progress events
-                (and may never repeat its value).
               * event.loaded should be the length of the decompressed content, i.e.
                 bigger than Content-length header value when finished loading
 
         */
-        var lastTotal;
-        var lastLoaded = -1;
         client.addEventListener('loadend', test.step_func(function(e){
           var len = parseInt(client.getResponseHeader('content-length'), 10)
           if(e.lengthComputable){
@@ -62,17 +59,14 @@
           test.done();
         }), false)
         client.addEventListener('progress', test.step_func(function(e){
-          if(lastTotal === undefined){
-            lastTotal = e.total;
+          if(e.lengthComputable && e.total && e.loaded && e.target.readyState < 4){
+            assert_not_equals(e.total, e.loaded, 'total should not equal loaded while download/decode is incomplete')
+            // We should only do this assertation once
+            // it's theoretically possible that all the data would get in
+            // and a progress event fire before the readyState switches from 3 to 4 -
+            // in this case we might report bogus and random failures. Better to remove the event listener again..
+            client.removeEventListener('progress', arguments.callee, false);
           }
-          if(e.lengthComputable && e.total && e.loaded){
-            assert_equals(e.total, lastTotal, 'event.total should remain invariant')
-            assert_less_than_equal(e.loaded, lastTotal, 'event.loaded should not exceed content-length')
-          }else{
-            assert_equals(e.total, 0, 'event.total should be 0')
-          }
-          assert_greater_than(e.loaded, lastLoaded, 'event.loaded should only ever increase')
-          lastLoaded = e.loaded;
         }), false)
         // image.gif is 165375 bytes compressed. Sending 45000 bytes at a time with 1 second delay will load it in 4 seconds
         client.open("GET", "resources/image.gif?pipe=gzip|trickle(45000:d1:r2)", true)
diff --git a/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js b/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
index 77fc0e784ef9..820f9ee22143 100644
--- a/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
+++ b/testing/web-platform/tests/XMLHttpRequest/resources/xmlhttprequest-event-order.js
@@ -21,60 +21,13 @@
     }
   }
 
-  function getNextEvent(arr) {
-    var eventStr = arr.shift();
-
-    // we can only handle strings, numbers (readystates) and undefined
-    if (eventStr === undefined) {
-      return event;
-    }
-    if (typeof eventStr !== "string") {
-      if (Number.isInteger(eventStr)) {
-        eventStr = "readystatechange(" + eventStr + ")";
-      } else {
-        throw "Test error: unexpected event type " + eventStr;
-      }
-    }
-
-    // parse out the general type, loaded and total values
-    var type = eventStr.type = eventStr.split("(")[0].split(".").pop();
-    eventStr.mayFollowOptionalProgressEvents = type == "progress" ||
-      type == "load" || type == "abort" || type == "error";
-    var loadedAndTotal = eventStr.match(/\((\d)+,(\d)+/);
-    if (loadedAndTotal) {
-      eventStr.loaded = parseInt(loadedAndTotal[0]);
-      eventStr.total = parseInt(loadedAndTotal[1]);
-    }
-
-    return eventStr;
-  }
-
   global.assert_xhr_event_order_matches = function(expected) {
-    var recorded = recorded_xhr_events;
-    var lastRecordedLoaded = -1;
-
-    while(expected.length && recorded.length) {
-      var currentExpected = getNextEvent(expected),
-          currentRecorded = getNextEvent(recorded);
-
-      // skip to the last progress event if we've hit one
-      while (recorded.length && currentRecorded.type == "progress") {
-        assert_greater(currentRecorded.loaded, lastRecordedLoaded,
-                       "progress event 'loaded' values must only increase");
-        lastRecordedLoaded = currentRecorded.loaded;
-        currentRecorded = getNextEvent(recorded);
-      }
-      if (currentRecorded.type == "loadstart") {
-        lastRecordedLoaded = -1;
-      }
-
-      assert_equals(currentRecorded, currentExpected);
-    }
-    if (recorded.length) {
-      throw "\nUnexpected extra events: " + recorded.join(", ");
-    }
-    if (expected.length) {
-      throw "\nExpected more events: " + expected.join(", ");
+    try {
+      assert_array_equals(recorded_xhr_events, expected);
+    } catch(e) {
+      e.message += "\nRecorded events were:" + recorded_xhr_events.join(", ");
+      e.message += "\nExpected events were:" + expected.join(", ");
+      throw e;
     }
   }
 }(this));
diff --git a/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm b/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
index 041cb23c6ea8..64dfaa670f82 100644
--- a/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
+++ b/testing/web-platform/tests/XMLHttpRequest/send-response-event-order.htm
@@ -12,7 +12,6 @@
     <link rel="help" href="https://xhr.spec.whatwg.org/#switch-done" data-tested-assertations="following::ol[1]/li[3] following::ol[1]/li[4] following::ol[1]/li[5] following::ol[1]/li[6] following::ol[1]/li[7]" />
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
-    <script src="resources/xmlhttprequest-event-order.js"></script>
     <title>XMLHttpRequest: The send() method: event order when synchronous flag is unset</title>
 </head>
 
@@ -25,12 +24,38 @@
         test.step(function()
         {
             var xhr = new XMLHttpRequest();
-            prepare_xhr_for_event_order_test(xhr);
+            var expect =  ["loadstart", "upload.loadstart", "upload.progress", "upload.load", "upload.loadend", "progress", 4, "load", "loadend"];
+            var actual = [];
 
-            xhr.addEventListener("loadend", test.step_func(function() {
-                assert_xhr_event_order_matches([1, "loadstart(0,0,false)", "upload.loadstart(0,12,true)", "upload.progress(12,12,true)", "upload.load(12,12,true)", "upload.loadend(12,12,true)", 2, 3, "progress(12,12,true)", 4, "load(12,12,true)", "loadend(12,12,true)"]);
-                test.done();
-            }));
+            xhr.onreadystatechange = function()
+            {
+                test.step(function()
+                {
+                    if (xhr.readyState == 4)
+                    {
+                        actual.push(xhr.readyState);
+                    }
+                });
+            };
+
+            xhr.onloadstart        = function(e){ actual.push(e.type); };
+            xhr.onload             = function(e){ actual.push(e.type); };
+            xhr.onloadend          = function(e){ actual.push(e.type); VerifyResult()};
+            xhr.onprogress         = function(e){ actual.push(e.type);};
+
+            xhr.upload.onloadstart = function(e){ actual.push("upload." + e.type); };
+            xhr.upload.onload      = function(e){ actual.push("upload." + e.type); };
+            xhr.upload.onloadend   = function(e){ actual.push("upload." + e.type);};
+            xhr.upload.onprogress  = function(e){ actual.push("upload." + e.type);};
+
+            function VerifyResult()
+            {
+                test.step(function()
+                {
+                    assert_array_equals(actual, expect);
+                    test.done();
+                });
+            };
 
             xhr.open("POST", "./resources/content.py", true);
             xhr.send("Test Message");