Merge from mozilla-central.

accessible/src/base/nsAccessibilityService.cpp

@@ -36,7 +36,7 @@
 #ifdef XP_WIN
 #include "nsHTMLWin32ObjectAccessible.h"
 #endif
-#include "TextLeafAccessible.h"
+#include "TextLeafAccessibleWrap.h"
 
 #ifdef DEBUG
 #include "Logging.h"
@@ -416,7 +416,7 @@ nsAccessibilityService::CreateTextLeafAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)
 {
   Accessible* accessible =
-    new TextLeafAccessible(aContent, GetDocAccessible(aPresShell));
+    new TextLeafAccessibleWrap(aContent, GetDocAccessible(aPresShell));
   NS_ADDREF(accessible);
   return accessible;
 }

accessible/tests/mochitest/common.js

@@ -554,6 +554,13 @@ function relationTypeToString(aRelationType)
   return gAccRetrieval.getStringRelationType(aRelationType);
 }
 
+function getLoadContext() {
+  const Ci = Components.interfaces;
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIWebNavigation)
+               .QueryInterface(Ci.nsILoadContext);
+}
+
 /**
  * Return text from clipboard.
  */
@@ -566,6 +573,7 @@ function getTextFromClipboard()
 
   var trans = Components.classes["@mozilla.org/widget/transferable;1"].
     createInstance(Components.interfaces.nsITransferable);
+  trans.init(getLoadContext());
   if (!trans)
     return;
 

accessible/tests/mochitest/events/test_fromUserInput.html

@@ -68,7 +68,7 @@
         var selection = window.getSelection();
         var range = document.createRange();
         range.setStart(this.textNode, aStart);
-        range.setEnd(this.textNode, aEnd-1);
+        range.setEnd(this.textNode, aEnd);
         selection.addRange(range);
 
         synthesizeKey("VK_DELETE", {});

b2g/chrome/content/shell.js

@@ -591,16 +591,15 @@ window.addEventListener('ContentStart', function(evt) {
   });
 })();
 
-// This is the backend for Gaia's screenshot feature.
-// Gaia requests a screenshot by sending a mozContentEvent with
-// detail.type set to 'save-screenshot'.  Then we take a screenshot
-// save it in device storage (external) and send a mozChromeEvent with
-// detail.type set to 'saved-screenshot' and detail.filename set to
-// the filename.
+// This is the backend for Gaia's screenshot feature.  Gaia requests a
+// screenshot by sending a mozContentEvent with detail.type set to
+// 'take-screenshot'.  Then we take a screenshot and send a
+// mozChromeEvent with detail.type set to 'take-screenshot-success'
+// and detail.file set to the an image/png blob
 window.addEventListener('ContentStart', function ss_onContentStart() {
   let content = shell.contentBrowser.contentWindow;
   content.addEventListener('mozContentEvent', function ss_onMozContentEvent(e) {
-    if (e.detail.type !== 'save-screenshot')
+    if (e.detail.type !== 'take-screenshot')
       return;
 
     try {
@@ -619,44 +618,14 @@ window.addEventListener('ContentStart', function ss_onContentStart() {
       context.drawWindow(window, 0, 0, width, height,
                          'rgb(255,255,255)', flags);
 
-      var filename = 'screenshots/' +
-        new Date().toISOString().slice(0,-5).replace(/[:T]/g, '-') +
-        '.png';
-
-      var file = canvas.mozGetAsFile(filename, 'image/png');
-      var storage = navigator.getDeviceStorage('pictures')[0];
-      if (!storage) { // If we don't have an SD card to save to, send an error
-        shell.sendEvent(content, 'mozChromeEvent', {
-          type: 'save-screenshot-no-card'
-        });
-        return;
-      }
-
-      var saveRequest = storage.addNamed(file, filename);
-      saveRequest.onsuccess = function ss_onsuccess() {
-        try {
-          shell.sendEvent(content, 'mozChromeEvent', {
-            type: 'save-screenshot-success',
-            filename: filename
-          });
-        } catch(e) {
-          dump('exception in onsuccess ' + e + '\n');
-        }
-      };
-      saveRequest.onerror = function ss_onerror() {
-        try {
-          shell.sendEvent(content, 'mozChromeEvent', {
-            type: 'save-screenshot-error',
-            error: saveRequest.error.name
-          });
-        } catch(e) {
-          dump('exception in onerror ' + e + '\n');
-        }
-      };
-    } catch(e) {
-      dump('exception while saving screenshot: ' + e + '\n');
       shell.sendEvent(content, 'mozChromeEvent', {
-        type: 'save-screenshot-error',
+          type: 'take-screenshot-success',
+          file: canvas.mozGetAsFile('screenshot', 'image/png')
+      });
+    } catch (e) {
+      dump('exception while creating screenshot: ' + e + '\n');
+      shell.sendEvent(content, 'mozChromeEvent', {
+        type: 'take-screenshot-error',
         error: String(e)
       });
     }

browser/base/content/browser.js

@@ -2227,6 +2227,12 @@ function getPostDataStream(aStringData, aKeyword, aEncKeyword, aType) {
   return mimeStream.QueryInterface(Ci.nsIInputStream);
 }
 
+function getLoadContext() {
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIWebNavigation)
+               .QueryInterface(Ci.nsILoadContext);
+}
+
 function readFromClipboard()
 {
   var url;
@@ -2239,6 +2245,7 @@ function readFromClipboard()
     // Create transferable that will transfer the text.
     var trans = Components.classes["@mozilla.org/widget/transferable;1"]
                           .createInstance(Components.interfaces.nsITransferable);
+    trans.init(getLoadContext());
 
     trans.addDataFlavor("text/unicode");
 

browser/base/content/nsContextMenu.js

@@ -1117,7 +1117,7 @@ nsContextMenu.prototype = {
 
     var clipboard = Cc["@mozilla.org/widget/clipboardhelper;1"].
                     getService(Ci.nsIClipboardHelper);
-    clipboard.copyString(addresses);
+    clipboard.copyString(addresses, document);
   },
 
   ///////////////
@@ -1453,7 +1453,7 @@ nsContextMenu.prototype = {
   copyMediaLocation : function () {
     var clipboard = Cc["@mozilla.org/widget/clipboardhelper;1"].
                     getService(Ci.nsIClipboardHelper);
-    clipboard.copyString(this.mediaURL);
+    clipboard.copyString(this.mediaURL, document);
   },
 
   get imageURL() {

browser/base/content/pageinfo/pageInfo.js

@@ -1243,7 +1243,7 @@ function doCopy()
         elem.removeAttribute("copybuffer");
       }
     }
-    gClipboardHelper.copyString(text.join("\n"));
+    gClipboardHelper.copyString(text.join("\n"), document);
   }
 }
 

browser/base/content/sanitizeDialog.js

@@ -654,6 +654,7 @@ var gContiguousSelectionTreeHelper = {
               createInstance(Ci.nsISupportsArray);
     var trans = Cc["@mozilla.org/widget/transferable;1"].
                 createInstance(Ci.nsITransferable);
+    trans.init(null);
     trans.setTransferData('dummy-flavor', null, 0);
     arr.AppendElement(trans);
     var reg = Cc["@mozilla.org/gfx/region;1"].

browser/base/content/test/browser_bug321000.js

@@ -32,7 +32,7 @@ function test() {
   // Put a multi-line string in the clipboard.
   // Setting the clipboard value is an async OS operation, so we need to poll
   // the clipboard for valid data before going on.
-  waitForClipboard(kTestString, function() { cbHelper.copyString(kTestString); },
+  waitForClipboard(kTestString, function() { cbHelper.copyString(kTestString, document); },
                    next_test, finish);
 }
 

browser/base/content/test/browser_middleMouse_inherit.js

@@ -25,7 +25,7 @@ function test() {
       function() {
         Components.classes["@mozilla.org/widget/clipboardhelper;1"]
                   .getService(Components.interfaces.nsIClipboardHelper)
-                  .copyString(url);
+                  .copyString(url, document);
       },
       function () {
         // Middle click on the content area

browser/base/content/urlbarBindings.xml

@@ -550,7 +550,7 @@
 
             Cc["@mozilla.org/widget/clipboardhelper;1"]
               .getService(Ci.nsIClipboardHelper)
-              .copyString(val);
+              .copyString(val, document);
           },
           supportsCommand: function(aCommand) {
             switch (aCommand) {
@@ -751,7 +751,7 @@
 
         Cc["@mozilla.org/widget/clipboardhelper;1"]
           .getService(Ci.nsIClipboardHelper)
-          .copyStringToClipboard(val, Ci.nsIClipboard.kSelectionClipboard);
+          .copyStringToClipboard(val, document, Ci.nsIClipboard.kSelectionClipboard);
       ]]></handler>
     </handlers>
 

browser/components/downloads/content/downloads.js

@@ -1167,7 +1167,7 @@ DownloadsViewItemController.prototype = {
     {
       let clipboard = Cc["@mozilla.org/widget/clipboardhelper;1"]
                       .getService(Ci.nsIClipboardHelper);
-      clipboard.copyString(this.dataItem.uri);
+      clipboard.copyString(this.dataItem.uri, document);
     },
 
     downloadsCmd_doDefault: function DVIC_downloadsCmd_doDefault()

browser/components/nsBrowserGlue.js

@@ -492,13 +492,6 @@ BrowserGlue.prototype = {
     if (!aQuitType)
       aQuitType = "quit";
 
-    // Never show a prompt inside private browsing mode
-    var inPrivateBrowsing = Cc["@mozilla.org/privatebrowsing;1"].
-                            getService(Ci.nsIPrivateBrowsingService).
-                            privateBrowsingEnabled;
-    if (inPrivateBrowsing)
-      return;
-
     var showPrompt = false;
     var mostRecentBrowserWindow;
 
@@ -530,6 +523,12 @@ BrowserGlue.prototype = {
       return;
     }
 
+    var inPrivateBrowsing = Cc["@mozilla.org/privatebrowsing;1"].
+                            getService(Ci.nsIPrivateBrowsingService).
+                            privateBrowsingEnabled;
+    if (inPrivateBrowsing)
+      return;
+
     if (!showPrompt)
       return;
 

browser/components/places/content/controller.js

@@ -376,6 +376,7 @@ PlacesController.prototype = {
     // pasting of valid "text/unicode" and "text/x-moz-url" data
     var xferable = Cc["@mozilla.org/widget/transferable;1"].
                    createInstance(Ci.nsITransferable);
+    xferable.init(null);
 
     xferable.addDataFlavor(PlacesUtils.TYPE_X_MOZ_URL);
     xferable.addDataFlavor(PlacesUtils.TYPE_UNICODE);
@@ -1061,6 +1062,7 @@ PlacesController.prototype = {
     try {
       let xferable = Cc["@mozilla.org/widget/transferable;1"].
                      createInstance(Ci.nsITransferable);
+      xferable.init(null);
       xferable.addDataFlavor(PlacesUtils.TYPE_X_MOZ_PLACE_ACTION)
       this.clipboard.getData(xferable, Ci.nsIClipboard.kGlobalClipboard);
       xferable.getTransferData(PlacesUtils.TYPE_X_MOZ_PLACE_ACTION, action, {});
@@ -1090,6 +1092,7 @@ PlacesController.prototype = {
   _clearClipboard: function PC__clearClipboard() {
     let xferable = Cc["@mozilla.org/widget/transferable;1"].
                    createInstance(Ci.nsITransferable);
+    xferable.init(null);
     // Empty transferables may cause crashes, so just add an unknown type.
     const TYPE = "text/x-moz-place-empty";
     xferable.addDataFlavor(TYPE);
@@ -1135,6 +1138,7 @@ PlacesController.prototype = {
 
     let xferable = Cc["@mozilla.org/widget/transferable;1"].
                    createInstance(Ci.nsITransferable);
+    xferable.init(null);
     let hasData = false;
     // This order matters here!  It controls how this and other applications
     // select data to be inserted based on type.
@@ -1224,6 +1228,7 @@ PlacesController.prototype = {
 
     let xferable = Cc["@mozilla.org/widget/transferable;1"].
                    createInstance(Ci.nsITransferable);
+    xferable.init(null);
     // This order matters here!  It controls the preferred flavors for this
     // paste operation.
     [ PlacesUtils.TYPE_X_MOZ_PLACE,

browser/components/search/content/search.xml

@@ -67,25 +67,25 @@
       <constructor><![CDATA[
         if (this.parentNode.parentNode.localName == "toolbarpaletteitem")
           return;
-        setTimeout(function (a) { a.init(); }, 0, this);
-      ]]></constructor>
+        // Make sure we rebuild the popup in onpopupshowing
+        this._needToBuildPopup = true;
 
-      <method name="init">
-        <body><![CDATA[
-          // Make sure we rebuild the popup in onpopupshowing
-          this._needToBuildPopup = true;
-
-          // Refresh the display (updating icon, etc)
-          this.updateDisplay();
-
-          var os =
+        var os =
                Components.classes["@mozilla.org/observer-service;1"]
                          .getService(Components.interfaces.nsIObserverService);
-          os.addObserver(this, "browser-search-engine-modified", false);
+        os.addObserver(this, "browser-search-engine-modified", false);
 
-          this._addedObserver = true;
-        ]]></body>
-      </method>
+        this._addedObserver = true;
+
+        this.searchService.init((function search_init_cb(aStatus) {
+          if (Components.isSuccessCode(aStatus)) {
+            // Refresh the display (updating icon, etc)
+            this.updateDisplay();
+          } else {
+            Components.utils.reportError("Cannot initialize search service, bailing out: " + aStatus);
+          }
+        }).bind(this));
+      ]]></constructor>
 
       <destructor><![CDATA[
         if (this._addedObserver) {

browser/config/tooltool-manifests/linux32/clang.manifest

@@ -1,4 +1,5 @@
 [
+{"clang_version": "r159219"},
 {
 "size": 47,
 "digest": "2005a41fe97a5e00997063705f39d42b6a43b1cf7ba306cbc7b1513de34cdcd050fc6326efa2107f19ba0cc67914745dbf13154fa748010a93cf072481ef4aaa",
@@ -6,8 +7,8 @@
 "filename": "setup.sh"
 },
 {
-"size": 72350187, 
-"digest": "7d2fbe08aca3ae740e33b8aee872705a3b5229681dd0617ceffd6619fba75cb3cb7e1c3a071218f7cfd464003e5cd773cd8e67d16f78df9c50218fb6671580c6", 
+"size": 73555568,
+"digest": "29102005216bfd719561ce1920f4cddd3c34c5581ed4cebc3abdc30d8d3f2b4705344cd4a2571ac05b11ff35fc1e0a9584568de89cc19ba6599311adccf5397b",
 "algorithm": "sha512",
 "filename": "clang.tar.bz2"
 }

browser/config/tooltool-manifests/linux64/clang.manifest

@@ -1,4 +1,5 @@
 [
+{"clang_version": "r159219"},
 {
 "size": 47,
 "digest": "2005a41fe97a5e00997063705f39d42b6a43b1cf7ba306cbc7b1513de34cdcd050fc6326efa2107f19ba0cc67914745dbf13154fa748010a93cf072481ef4aaa",
@@ -6,8 +7,8 @@
 "filename": "setup.sh"
 },
 {
-"size": 71534797, 
-"digest": "66bd11bea6e1f07090e9e03c833e107088097605611fd455e80b280ce2b71ca71ff9841a66614f62da162469b222b5eefd5535373b199c60fd485959889b5dcb", 
+"size": 72267837,
+"digest": "15d0f9e3f1c897d06a7808edb931cdd23d82b38d271454e52740e23bd890338e204857bc87bfe3dde242fa62b38e01f15c19b814cab55e84874f0c6c5b4187e8",
 "algorithm": "sha512",
 "filename": "clang.tar.bz2"
 }

browser/config/tooltool-manifests/macosx64/clang.manifest

@@ -1,4 +1,5 @@
 [
+{"clang_version": "r159219"},
 {
 "size": 47,
 "digest": "2005a41fe97a5e00997063705f39d42b6a43b1cf7ba306cbc7b1513de34cdcd050fc6326efa2107f19ba0cc67914745dbf13154fa748010a93cf072481ef4aaa",
@@ -6,8 +7,8 @@
 "filename": "setup.sh"
 },
 {
-"size": 63015959, 
-"digest": "e0ac132a77b052d6494d4bf02f17aba475138ffcff07a5f92f17f45b1d5f27b7b0cea36c29473965271e60910af82ffd4989df94c10d24794d1bf8362bcb785b", 
+"size": 63318129,
+"digest": "cf1dbc9221ff5f751ef9b8a3b93106585eb0955e648429359feb14a02892774538f7a19d0cf949b26549dae933a9a56dbb138e3cb2d1a883e6bfc47de27c16bb",
 "algorithm": "sha512",
 "filename": "clang.tar.bz2"
 }

browser/devtools/highlighter/inspector.jsm

@@ -1104,7 +1104,7 @@ InspectorUI.prototype = {
    */
   copyInnerHTML: function IUI_copyInnerHTML()
   {
-    clipboardHelper.copyString(this.selection.innerHTML);
+    clipboardHelper.copyString(this.selection.innerHTML, this.selection.ownerDocument);
   },
 
   /**
@@ -1113,7 +1113,7 @@ InspectorUI.prototype = {
    */
   copyOuterHTML: function IUI_copyOuterHTML()
   {
-    clipboardHelper.copyString(this.selection.outerHTML);
+    clipboardHelper.copyString(this.selection.outerHTML, this.selection.ownerDocument);
   },
 
   /**

browser/devtools/sourceeditor/source-editor-orion.jsm

@@ -763,6 +763,7 @@ SourceEditor.prototype = {
     }
 
     clipboardHelper.copyStringToClipboard(text,
+                                          this.parentElement.ownerDocument,
                                           Ci.nsIClipboard.kSelectionClipboard);
   },
 

browser/devtools/sourceeditor/test/browser_bug695035_middle_click_paste.js

@@ -54,6 +54,7 @@ function editorLoaded()
     let clipboardHelper = Cc["@mozilla.org/widget/clipboardhelper;1"].
                           getService(Ci.nsIClipboardHelper);
     clipboardHelper.copyStringToClipboard(expectedString,
+                                          testWin.document,
                                           Ci.nsIClipboard.kSelectionClipboard);
   };
 

browser/devtools/sourceeditor/test/head.js

@@ -4,6 +4,12 @@
 
 "use strict";
 
+function getLoadContext() {
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIWebNavigation)
+               .QueryInterface(Ci.nsILoadContext);
+}
+
 /*
  * Polls the X11 primary selection buffer waiting for the expected value. A known
  * value different than the expected value is put on the clipboard first (and
@@ -53,6 +59,7 @@ function waitForSelection(aExpectedStringOrValidatorFn, aSetupFn,
 
       let transferable = Cc["@mozilla.org/widget/transferable;1"].
                          createInstance(Ci.nsITransferable);
+      transferable.init(getLoadContext());
       transferable.addDataFlavor(requestedFlavor);
 
       clipboard.getData(transferable, clipboard.kSelectionClipboard);
@@ -89,6 +96,7 @@ function waitForSelection(aExpectedStringOrValidatorFn, aSetupFn,
     let clipboardHelper = Cc["@mozilla.org/widget/clipboardhelper;1"].
                           getService(Ci.nsIClipboardHelper);
     clipboardHelper.copyStringToClipboard(preExpectedVal,
+                                          document,
                                           Ci.nsIClipboard.kSelectionClipboard);
 
     wait(function(aData) aData == preExpectedVal,

browser/devtools/styleinspector/CssHtmlTree.jsm

@@ -566,7 +566,7 @@ CssHtmlTree.prototype = {
 
     // Remove any MDN link titles
     text = text.replace(CssHtmlTree.HELP_LINK_TITLE, "");
-    clipboardHelper.copyString(text);
+    clipboardHelper.copyString(text, this.doc);
 
     if (aEvent) {
       aEvent.preventDefault();
@@ -596,7 +596,7 @@ CssHtmlTree.prototype = {
       let name = node.querySelector(".property-name").textContent;
       let value = node.querySelector(".property-value").textContent;
 
-      clipboardHelper.copyString(name + ": " + value + ";");
+      clipboardHelper.copyString(name + ": " + value + ";", this.doc);
     }
   },
 
@@ -621,7 +621,7 @@ CssHtmlTree.prototype = {
     }
     if (node) {
       node = node.querySelector(".property-name");
-      clipboardHelper.copyString(node.textContent);
+      clipboardHelper.copyString(node.textContent, this.doc);
     }
   },
 
@@ -646,7 +646,7 @@ CssHtmlTree.prototype = {
     }
     if (node) {
       node = node.querySelector(".property-value");
-      clipboardHelper.copyString(node.textContent);
+      clipboardHelper.copyString(node.textContent, this.doc);
     }
   },
 

browser/devtools/styleinspector/CssRuleView.jsm

@@ -1164,7 +1164,7 @@ CssRuleView.prototype = {
     rx = new RegExp("(\r?\n)" + inheritedFrom + ".*", "g");
     text = text.replace(rx, "$1");
 
-    clipboardHelper.copyString(text);
+    clipboardHelper.copyString(text, this.doc);
 
     if (aEvent) {
       aEvent.preventDefault();
@@ -1221,7 +1221,7 @@ CssRuleView.prototype = {
     }
     out += "}" + terminator;
 
-    clipboardHelper.copyString(out);
+    clipboardHelper.copyString(out, this.doc);
   },
 
   /**
@@ -1260,7 +1260,7 @@ CssRuleView.prototype = {
     let propertyValue = node.querySelector(".ruleview-propertyvalue").textContent;
     let out = propertyName + ": " + propertyValue + ";";
 
-    clipboardHelper.copyString(out);
+    clipboardHelper.copyString(out, this.doc);
   },
 
   /**
@@ -1280,7 +1280,7 @@ CssRuleView.prototype = {
     }
 
     if (node) {
-      clipboardHelper.copyString(node.textContent);
+      clipboardHelper.copyString(node.textContent, this.doc);
     }
   },
 
@@ -1301,7 +1301,7 @@ CssRuleView.prototype = {
     }
 
     if (node) {
-      clipboardHelper.copyString(node.textContent);
+      clipboardHelper.copyString(node.textContent, this.doc);
     }
   }
 };

browser/devtools/webconsole/HUDService.jsm

@@ -1012,7 +1012,7 @@ HUD_SERVICE.prototype =
         strings.push("[" + timestampString + "] " + item.clipboardText);
       }
     }
-    clipboardHelper.copyString(strings.join("\n"));
+    clipboardHelper.copyString(strings.join("\n"), this.doc);
   }
 };
 

browser/devtools/webconsole/test/browser_webconsole_bug_642615_autocomplete.js

@@ -28,7 +28,7 @@ function consoleOpened(HUD) {
     waitForClipboard(
       stringToCopy,
       function() {
-        clipboardHelper.copyString(stringToCopy);
+        clipboardHelper.copyString(stringToCopy, document);
       },
       onClipboardCopy,
       finishTest);

browser/modules/WebappsInstaller.jsm

@@ -166,7 +166,7 @@ WinNativeApp.prototype = {
    */
   install: function() {
     // Remove previously installed app (for update purposes)
-    this._removeInstallation();
+    this._removeInstallation(true);
 
     try {
       this._createDirectoryStructure();
@@ -176,7 +176,7 @@ WinNativeApp.prototype = {
       this._writeSystemKeys();
       this._createAppProfile();
     } catch (ex) {
-      this._removeInstallation();
+      this._removeInstallation(false);
       throw(ex);
     }
 
@@ -208,6 +208,15 @@ WinNativeApp.prototype = {
     }
     this.installDir.append(installDirLeaf);
 
+    this.webapprt = this.installDir.clone();
+    this.webapprt.append(this.appNameAsFilename + ".exe");
+
+    this.configJson = this.installDir.clone();
+    this.configJson.append("webapp.json");
+
+    this.webappINI = this.installDir.clone();
+    this.webappINI.append("webapp.ini");
+
     this.uninstallDir = this.installDir.clone();
     this.uninstallDir.append("uninstall");
 
@@ -220,14 +229,6 @@ WinNativeApp.prototype = {
     this.iconFile.append("default");
     this.iconFile.append("default.ico");
 
-    this.desktopShortcut = Services.dirsvc.get("Desk", Ci.nsILocalFile);
-    this.desktopShortcut.append(this.appNameAsFilename + ".lnk");
-    this.desktopShortcut.followLinks = false;
-
-    this.startMenuShortcut = Services.dirsvc.get("Progs", Ci.nsILocalFile);
-    this.startMenuShortcut.append(this.appNameAsFilename + ".lnk");
-    this.startMenuShortcut.followLinks = false;
-
     this.uninstallSubkeyStr = this.launchURI.scheme + "://" +
                               this.launchURI.hostPort;
   },
@@ -235,7 +236,7 @@ WinNativeApp.prototype = {
   /**
    * Remove the current installation
    */
-  _removeInstallation : function() {
+  _removeInstallation : function(keepProfile) {
     let uninstallKey;
     try {
       uninstallKey = Cc["@mozilla.org/windows-registry-key;1"]
@@ -253,35 +254,33 @@ WinNativeApp.prototype = {
         uninstallKey.close();
     }
 
-    try {
-      if(this.installDir.exists()) {
-        let dir = this.installDir.QueryInterface(Ci.nsILocalFile);
-        // We need to set followLinks to false so that the shortcut
-        // files can be removed even after the .exe it was pointing
-        // to was removed.
-        dir.followLinks = false;
-        dir.remove(true);
-      }
-    } catch(ex) {
+    let desktopShortcut = Services.dirsvc.get("Desk", Ci.nsILocalFile);
+    desktopShortcut.append(this.appNameAsFilename + ".lnk");
+
+    let startMenuShortcut = Services.dirsvc.get("Progs", Ci.nsILocalFile);
+    startMenuShortcut.append(this.appNameAsFilename + ".lnk");
+
+    let filesToRemove = [desktopShortcut, startMenuShortcut];
+
+    if (keepProfile) {
+      filesToRemove.push(this.iconFile);
+      filesToRemove.push(this.webapprt);
+      filesToRemove.push(this.configJson);
+      filesToRemove.push(this.webappINI);
+      filesToRemove.push(this.uninstallDir);
+    } else {
+      filesToRemove.push(this.installDir);
     }
 
-    try {
-      if(this.desktopShortcut && this.desktopShortcut.exists()) {
-        this.desktopShortcut.remove(false);
-      }
-
-      if(this.startMenuShortcut && this.startMenuShortcut.exists()) {
-        this.startMenuShortcut.remove(false);
-      }
-    } catch(ex) {
-    }
+    removeFiles(filesToRemove);
   },
 
   /**
    * Creates the main directory structure.
    */
   _createDirectoryStructure: function() {
-    this.installDir.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
+    if (!this.installDir.exists())
+      this.installDir.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
     this.uninstallDir.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
   },
 
@@ -295,17 +294,19 @@ WinNativeApp.prototype = {
     let profSvc = Cc["@mozilla.org/toolkit/profile-service;1"]
                     .getService(Ci.nsIToolkitProfileService);
 
-    this.appProfile = profSvc.createDefaultProfileForApp(this.installDir.leafName,
-                                                         null, null);
+    try {
+      this.appProfile = profSvc.createDefaultProfileForApp(this.installDir.leafName,
+                                                           null, null);
+    } catch (ex if ex.result == Cr.NS_ERROR_ALREADY_INITIALIZED) {}
   },
 
   /**
    * Copy the pre-built files into their destination folders.
    */
   _copyPrebuiltFiles: function() {
-    let webapprt = this.runtimeFolder.clone();
-    webapprt.append("webapprt-stub.exe");
-    webapprt.copyTo(this.installDir, this.appNameAsFilename + ".exe");
+    let webapprtPre = this.runtimeFolder.clone();
+    webapprtPre.append("webapprt-stub.exe");
+    webapprtPre.copyTo(this.installDir, this.webapprt.leafName);
 
     let uninstaller = this.runtimeFolder.clone();
     uninstaller.append("webapp-uninstaller.exe");
@@ -317,18 +318,13 @@ WinNativeApp.prototype = {
    */
   _createConfigFiles: function() {
     // ${InstallDir}/webapp.json
-    let configJson = this.installDir.clone();
-    configJson.append("webapp.json");
-    writeToFile(configJson, JSON.stringify(this.webappJson), function() {});
-
-    // ${InstallDir}/webapp.ini
-    let webappINI = this.installDir.clone().QueryInterface(Ci.nsILocalFile);
-    webappINI.append("webapp.ini");
+    writeToFile(this.configJson, JSON.stringify(this.webappJson), function() {});
 
     let factory = Cc["@mozilla.org/xpcom/ini-processor-factory;1"]
                     .getService(Ci.nsIINIParserFactory);
 
-    let writer = factory.createINIParser(webappINI).QueryInterface(Ci.nsIINIParserWriter);
+    // ${InstallDir}/webapp.ini
+    let writer = factory.createINIParser(this.webappINI).QueryInterface(Ci.nsIINIParserWriter);
     writer.setString("Webapp", "Name", this.appName);
     writer.setString("Webapp", "Profile", this.installDir.leafName);
     writer.setString("Webapp", "Executable", this.appNameAsFilename);
@@ -345,9 +341,6 @@ WinNativeApp.prototype = {
     writer.setString("TASKBAR", "Migrated", "true");
     writer.writeFile(null, Ci.nsIINIParserWriter.WRITE_UTF16);
 
-    writer = null;
-    factory = null;
-
     // ${UninstallDir}/uninstall.log
     let uninstallContent = 
       "File: \\webapp.ini\r\n" +
@@ -407,7 +400,7 @@ WinNativeApp.prototype = {
     shortcut.append(this.appNameAsFilename + ".lnk");
 
     let target = this.installDir.clone();
-    target.append(this.appNameAsFilename + ".exe");
+    target.append(this.webapprt.leafName);
 
     /* function nsILocalFileWin.setShortcut(targetFile, workingDir, args,
                                             description, iconFile, iconIndex) */
@@ -458,7 +451,8 @@ WinNativeApp.prototype = {
       throw("processIcon - Failure converting icon (" + e + ")");
     }
 
-    this.iconFile.parent.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
+    if (!this.iconFile.parent.exists())
+      this.iconFile.parent.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
     let outputStream = FileUtils.openSafeFileOutputStream(this.iconFile);
     NetUtil.asyncCopy(iconStream, outputStream);
   }
@@ -524,24 +518,13 @@ MacNativeApp.prototype = {
   },
 
   _removeInstallation: function(keepProfile) {
-    try {
-      if(this.installDir.exists()) {
-        this.installDir.followLinks = false;
-        this.installDir.remove(true);
-      }
-    } catch(ex) {
+    let filesToRemove = [this.installDir];
+
+    if (!keepProfile) {
+      filesToRemove.push(this.appProfileDir);
     }
 
-   if (keepProfile)
-     return;
-
-   try {
-      if(this.appProfileDir.exists()) {
-        this.appProfileDir.followLinks = false;
-        this.appProfileDir.remove(true);
-      }
-    } catch(ex) {
-    }
+    removeFiles(filesToRemove);
   },
 
   _createDirectoryStructure: function() {
@@ -560,8 +543,10 @@ MacNativeApp.prototype = {
     let profSvc = Cc["@mozilla.org/toolkit/profile-service;1"]
                     .getService(Ci.nsIToolkitProfileService);
 
-    this.appProfile = profSvc.createDefaultProfileForApp(this.appProfileDir.leafName,
-                                                         null, null);
+    try {
+      this.appProfile = profSvc.createDefaultProfileForApp(this.appProfileDir.leafName,
+                                                           null, null);
+    } catch (ex if ex.result == Cr.NS_ERROR_ALREADY_INITIALIZED) {}
   },
 
   _copyPrebuiltFiles: function() {
@@ -701,6 +686,12 @@ LinuxNativeApp.prototype = {
     this.webapprt = this.installDir.clone();
     this.webapprt.append("webapprt-stub");
 
+    this.configJson = this.installDir.clone();
+    this.configJson.append("webapp.json");
+
+    this.webappINI = this.installDir.clone();
+    this.webappINI.append("webapp.ini");
+
     let env = Cc["@mozilla.org/process/environment;1"]
                 .getService(Ci.nsIEnvironment);
     let xdg_data_home_env = env.get("XDG_DATA_HOME");
@@ -720,7 +711,7 @@ LinuxNativeApp.prototype = {
   },
 
   install: function() {
-    this._removeInstallation();
+    this._removeInstallation(true);
 
     try {
       this._createDirectoryStructure();
@@ -728,26 +719,31 @@ LinuxNativeApp.prototype = {
       this._createConfigFiles();
       this._createAppProfile();
     } catch (ex) {
-      this._removeInstallation();
+      this._removeInstallation(false);
       throw(ex);
     }
 
     getIconForApp(this, function() {});
   },
 
-  _removeInstallation: function() {
-    try {
-      if (this.installDir.exists())
-        this.installDir.remove(true);
+  _removeInstallation: function(keepProfile) {
+    let filesToRemove = [this.desktopINI];
 
-      if (this.desktopINI.exists())
-        this.desktopINI.remove(false);
-    } catch(ex) {
+    if (keepProfile) {
+      filesToRemove.push(this.iconFile);
+      filesToRemove.push(this.webapprt);
+      filesToRemove.push(this.configJson);
+      filesToRemove.push(this.webappINI);
+    } else {
+      filesToRemove.push(this.installDir);
     }
+
+    removeFiles(filesToRemove);
   },
 
   _createDirectoryStructure: function() {
-    this.installDir.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
+    if (!this.installDir.exists())
+      this.installDir.create(Ci.nsIFile.DIRECTORY_TYPE, 0755);
   },
 
   _copyPrebuiltFiles: function() {
@@ -763,24 +759,21 @@ LinuxNativeApp.prototype = {
     let profSvc = Cc["@mozilla.org/toolkit/profile-service;1"]
                     .getService(Ci.nsIToolkitProfileService);
 
-    return profSvc.createDefaultProfileForApp(this.installDir.leafName,
-                                              null, null);
+    try {
+      this.appProfile = profSvc.createDefaultProfileForApp(this.installDir.leafName,
+                                                           null, null);
+    } catch (ex if ex.result == Cr.NS_ERROR_ALREADY_INITIALIZED) {}
   },
 
   _createConfigFiles: function() {
     // ${InstallDir}/webapp.json
-    let configJson = this.installDir.clone();
-    configJson.append("webapp.json");
-    writeToFile(configJson, JSON.stringify(this.webappJson), function() {});
-
-    // ${InstallDir}/webapp.ini
-    let webappINI = this.installDir.clone();
-    webappINI.append("webapp.ini");
+    writeToFile(this.configJson, JSON.stringify(this.webappJson), function() {});
 
     let factory = Cc["@mozilla.org/xpcom/ini-processor-factory;1"]
                     .getService(Ci.nsIINIParserFactory);
 
-    let writer = factory.createINIParser(webappINI).QueryInterface(Ci.nsIINIParserWriter);
+    // ${InstallDir}/webapp.ini
+    let writer = factory.createINIParser(this.webappINI).QueryInterface(Ci.nsIINIParserWriter);
     writer.setString("Webapp", "Name", this.appName);
     writer.setString("Webapp", "Profile", this.uniqueName);
     writer.setString("WebappRT", "InstallDir", this.runtimeFolder.path);
@@ -917,6 +910,22 @@ function getAvailableFile(aFolder, aName, aExtension) {
   return null;
 }
 
+/**
+ * Attempts to remove files or directories.
+ *
+ * @param aFiles An array with nsIFile objects to be removed
+ */
+function removeFiles(aFiles) {
+  for (let file of aFiles) {
+    try {
+      if (file.exists()) {
+        file.followLinks = false;
+        file.remove(true);
+      }
+    } catch(ex) {}
+  }
+}
+
 function escapeXML(aStr) {
   return aStr.toString()
              .replace(/&/g, "&")

build/unix/build-clang/build-clang.py

@@ -3,7 +3,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-llvm_revision = "158160"
+llvm_revision = "159219"
 moz_version = "moz0"
 
 ##############################################
@@ -96,10 +96,7 @@ if not os.path.exists(source_dir):
            compiler_rt_source_dir, llvm_revision)
     os.symlink("../../clang", llvm_source_dir + "/tools/clang")
     os.symlink("../../compiler-rt", llvm_source_dir + "/projects/compiler-rt")
-    if isDarwin:
-        patch("clang-no-ios.patch", 0, clang_source_dir)
-        patch("compiler-rt-no-ios.patch", 0, compiler_rt_source_dir)
-    else:
+    if not isDarwin:
         patch("old-ld-hack.patch", 1, llvm_source_dir)
         patch("compiler-rt-gnu89-inline.patch", 0, compiler_rt_source_dir)
 

build/unix/build-clang/clang-no-ios.patch

@@ -1,15 +0,0 @@
-Index: runtime/compiler-rt/Makefile
-===================================================================
---- runtime/compiler-rt/Makefile	(revision 157958)
-+++ runtime/compiler-rt/Makefile	(working copy)
-@@ -74,8 +74,8 @@
- ifeq ($(OS),Darwin)
- RuntimeDirs += darwin
- RuntimeLibrary.darwin.Configs := \
--	eprintf 10.4 osx ios cc_kext \
--	asan_osx profile_osx profile_ios
-+	eprintf 10.4 osx  \
-+	asan_osx profile_osx
- endif
- 
- # On Linux, include a library which has all the runtime functions.

build/unix/build-clang/compiler-rt-no-ios.patch

@@ -1,29 +0,0 @@
-Index: make/platform/clang_darwin.mk
-===================================================================
---- make/platform/clang_darwin.mk	(revision 157958)
-+++ make/platform/clang_darwin.mk	(working copy)
-@@ -47,7 +47,7 @@
- # Configuration for targetting iOS, for some ARMv6 functions, which must be
- # in the same linkage unit, and for a couple of other functions that didn't
- # make it into libSystem.
--Configs += ios
-+#Configs += ios
- UniversalArchs.ios := $(call CheckArches,i386 x86_64 armv6 armv7,ios)
- 
- # Configuration for targetting OSX. These functions may not be in libSystem
-@@ -56,13 +56,13 @@
- UniversalArchs.osx := $(call CheckArches,i386 x86_64,osx)
- 
- # Configuration for use with kernel/kexts.
--Configs += cc_kext
-+#Configs += cc_kext
- UniversalArchs.cc_kext := $(call CheckArches,armv6 armv7 i386 x86_64,cc_kext)
- 
- # Configurations which define the profiling support functions.
- Configs += profile_osx
- UniversalArchs.profile_osx := $(call CheckArches,i386 x86_64,profile_osx)
--Configs += profile_ios
-+#Configs += profile_ios
- UniversalArchs.profile_ios := $(call CheckArches,i386 x86_64 armv6 armv7,profile_ios)
- 
- # Configurations which define the ASAN support functions.

content/base/public/Element.h

@@ -57,8 +57,8 @@ class Link;
 
 // IID for the dom::Element interface
 #define NS_ELEMENT_IID \
-{ 0x8493dd61, 0x4d59, 0x410a, \
-  { 0x97, 0x40, 0xd0, 0xa0, 0xc2, 0x03, 0xff, 0x52 } }
+{ 0xc6c049a1, 0x96e8, 0x4580, \
+  { 0xa6, 0x93, 0xb9, 0x5f, 0x53, 0xbe, 0xe8, 0x1c } }
 
 class Element : public nsIContent
 {

content/base/public/nsCopySupport.h

@@ -17,6 +17,7 @@ class nsITransferable;
 class nsACString;
 class nsAString;
 class nsIPresShell;
+class nsILoadContext;
 
 class nsCopySupport
 {
@@ -33,6 +34,7 @@ class nsCopySupport
     static nsresult GetContents(const nsACString& aMimeType, PRUint32 aFlags, nsISelection *aSel, nsIDocument *aDoc, nsAString& outdata);
     
     static nsresult ImageCopy(nsIImageLoadingContent* aImageElement,
+                              nsILoadContext* aLoadContext,
                               PRInt32 aCopyFlags);
 
     // Get the selection as a transferable. Similar to HTMLCopy except does

content/base/public/nsIContent.h

@@ -45,8 +45,8 @@ enum nsLinkState {
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID \
-{ 0xa887c108, 0xc25e, 0x42ab, \
-  { 0x87, 0xef, 0xad, 0x4b, 0xee, 0x50, 0x28, 0x28 } }
+{ 0x98fb308d, 0xc6dd, 0x4c6d, \
+  { 0xb7, 0x7c, 0x91, 0x18, 0x0c, 0xf0, 0x6f, 0x23 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -876,6 +876,7 @@ public:
   virtual bool IsPurple() = 0;
   virtual void RemovePurple() = 0;
 
+  virtual bool OwnedOnlyByTheDOMTree() { return false; }
 protected:
   /**
    * Hook for implementing GetID.  This is guaranteed to only be

content/base/public/nsIDocument.h

@@ -35,6 +35,7 @@
 #include "nsEventStates.h"
 #include "nsIStructuredCloneContainer.h"
 #include "nsIBFCacheEntry.h"
+#include "nsILoadContext.h"
 
 class nsIContent;
 class nsPresContext;
@@ -887,6 +888,19 @@ public:
     return container;
   }
 
+  /**
+   * Get the container's load context for this document.
+   */
+  nsILoadContext* GetLoadContext() const
+  {
+    nsCOMPtr<nsISupports> container = GetContainer();
+    if (container) {
+      nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
+      return loadContext;
+    }
+    return nsnull;
+  }
+
   /**
    * Set and get XML declaration. If aVersion is null there is no declaration.
    * aStandalone takes values -1, 0 and 1 indicating respectively that there

content/base/src/nsCCUncollectableMarker.cpp

@@ -265,6 +265,8 @@ nsCCUncollectableMarker::Observe(nsISupports* aSubject, const char* aTopic,
                                  const PRUnichar* aData)
 {
   if (!strcmp(aTopic, "xpcom-shutdown")) {
+    nsGenericElement::ClearContentUnbinder();
+
     nsCOMPtr<nsIObserverService> obs =
       mozilla::services::GetObserverService();
     if (!obs)
@@ -289,7 +291,9 @@ nsCCUncollectableMarker::Observe(nsISupports* aSubject, const char* aTopic,
     !strcmp(aTopic, "cycle-collector-forget-skippable");
 
   bool prepareForCC = !strcmp(aTopic, "cycle-collector-begin");
-    
+  if (prepareForCC) {
+    nsGenericElement::ClearContentUnbinder();
+  }
 
   // Increase generation to effectivly unmark all current objects
   if (!++sGeneration) {

content/base/src/nsCopySupport.cpp

@@ -182,6 +182,7 @@ SelectionCopyHelper(nsISelection *aSel, nsIDocument *aDoc,
     // Create a transferable for putting data on the Clipboard
     nsCOMPtr<nsITransferable> trans = do_CreateInstance(kCTransferableCID);
     if (trans) {
+      trans->Init(aDoc->GetLoadContext());
       if (bIsHTMLCopy) {
         // Set up a format converter so that clipboard flavor queries work.
         // This converter isn't really used for conversions.
@@ -459,6 +460,7 @@ nsCopySupport::GetContents(const nsACString& aMimeType, PRUint32 aFlags, nsISele
 
 nsresult
 nsCopySupport::ImageCopy(nsIImageLoadingContent* aImageElement,
+                         nsILoadContext* aLoadContext,
                          PRInt32 aCopyFlags)
 {
   nsresult rv;
@@ -466,6 +468,7 @@ nsCopySupport::ImageCopy(nsIImageLoadingContent* aImageElement,
   // create a transferable for putting data on the Clipboard
   nsCOMPtr<nsITransferable> trans(do_CreateInstance(kCTransferableCID, &rv));
   NS_ENSURE_SUCCESS(rv, rv);
+  trans->Init(aLoadContext);
 
   if (aCopyFlags & nsIContentViewerEdit::COPY_IMAGE_TEXT) {
     // get the location from the element

content/base/src/nsDocument.cpp

@@ -8991,6 +8991,7 @@ nsDocument::RequestFullScreen(Element* aElement, bool aWasCallerChrome)
   // to the document's principal's host, if it has one.
   if (!mIsApprovedForFullscreen) {
     mIsApprovedForFullscreen =
+      GetWindow()->IsPartOfApp() ||
       nsContentUtils::IsSitePermAllow(NodePrincipal(), "fullscreen");
   }
 

content/base/src/nsGenericDOMDataNode.h

@@ -309,6 +309,11 @@ protected:
   nsTextFragment mText;
 
 public:
+  virtual bool OwnedOnlyByTheDOMTree()
+  {
+    return GetParent() && mRefCnt.get() == 1;
+  }
+
   virtual bool IsPurple()
   {
     return mRefCnt.IsPurple();

content/base/src/nsGenericElement.cpp

@@ -1045,6 +1045,44 @@ nsGenericElement::GetScrollWidth(PRInt32 *aScrollWidth)
   return NS_OK;
 }
 
+PRInt32
+nsGenericElement::GetScrollLeftMax()
+{
+  nsIScrollableFrame* sf = GetScrollFrame();
+  if (!sf) {
+    return 0;
+  }
+
+  return nsPresContext::AppUnitsToIntCSSPixels(sf->GetScrollRange().XMost());
+}
+
+NS_IMETHODIMP
+nsGenericElement::GetScrollLeftMax(PRInt32 *aScrollLeftMax)
+{
+  *aScrollLeftMax = GetScrollLeftMax();
+
+  return NS_OK;
+}
+
+PRInt32
+nsGenericElement::GetScrollTopMax()
+{
+  nsIScrollableFrame* sf = GetScrollFrame();
+  if (!sf) {
+    return 0;
+  }
+
+  return nsPresContext::AppUnitsToIntCSSPixels(sf->GetScrollRange().YMost());
+}
+
+NS_IMETHODIMP
+nsGenericElement::GetScrollTopMax(PRInt32 *aScrollTopMax)
+{
+  *aScrollTopMax = GetScrollTopMax();
+
+  return NS_OK;
+}
+
 nsRect
 nsGenericElement::GetClientAreaRect()
 {
@@ -2809,6 +2847,16 @@ public:
     return NS_OK;
   }
 
+  static void UnbindAll()
+  {
+    nsRefPtr<ContentUnbinder> ub = sContentUnbinder;
+    sContentUnbinder = nsnull;
+    while (ub) {
+      ub->Run();
+      ub = ub->mNext;
+    }
+  }
+
   static void Append(nsIContent* aSubtreeRoot)
   {
     if (!sContentUnbinder) {
@@ -2835,6 +2883,12 @@ private:
 
 ContentUnbinder* ContentUnbinder::sContentUnbinder = nsnull;
 
+void
+nsGenericElement::ClearContentUnbinder()
+{
+  ContentUnbinder::UnbindAll();
+}
+
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGenericElement)
   nsINode::Unlink(tmp);
 
@@ -3078,19 +3132,29 @@ nsGenericElement::CanSkipInCC(nsINode* aNode)
 }
 
 nsAutoTArray<nsINode*, 1020>* gPurpleRoots = nsnull;
+nsAutoTArray<nsIContent*, 1020>* gNodesToUnbind = nsnull;
 
-void ClearPurpleRoots()
+void ClearCycleCollectorCleanupData()
 {
-  if (!gPurpleRoots) {
-    return;
+  if (gPurpleRoots) {
+    PRUint32 len = gPurpleRoots->Length();
+    for (PRUint32 i = 0; i < len; ++i) {
+      nsINode* n = gPurpleRoots->ElementAt(i);
+      n->SetIsPurpleRoot(false);
+    }
+    delete gPurpleRoots;
+    gPurpleRoots = nsnull;
   }
-  PRUint32 len = gPurpleRoots->Length();
-  for (PRUint32 i = 0; i < len; ++i) {
-    nsINode* n = gPurpleRoots->ElementAt(i);
-    n->SetIsPurpleRoot(false);
+  if (gNodesToUnbind) {
+    PRUint32 len = gNodesToUnbind->Length();
+    for (PRUint32 i = 0; i < len; ++i) {
+      nsIContent* c = gNodesToUnbind->ElementAt(i);
+      c->SetIsPurpleRoot(false);
+      ContentUnbinder::Append(c);
+    }
+    delete gNodesToUnbind;
+    gNodesToUnbind = nsnull;
   }
-  delete gPurpleRoots;
-  gPurpleRoots = nsnull;
 }
 
 static bool
@@ -3164,8 +3228,8 @@ nsGenericElement::CanSkip(nsINode* aNode, bool aRemovingAllowed)
     return false;
   }
  
-  // Subtree has been traversed already, and aNode
-  // wasn't removed from purple buffer. No need to do more here.
+  // Subtree has been traversed already, and aNode has
+  // been handled in a way that doesn't require revisiting it.
   if (root->IsPurpleRoot()) {
     return false;
   }
@@ -3175,8 +3239,12 @@ nsGenericElement::CanSkip(nsINode* aNode, bool aRemovingAllowed)
   nsAutoTArray<nsIContent*, 1020> nodesToClear;
 
   bool foundBlack = root->IsBlack();
+  bool domOnlyCycle = false;
   if (root != currentDoc) {
     currentDoc = nsnull;
+    if (!foundBlack) {
+      domOnlyCycle = static_cast<nsIContent*>(root)->OwnedOnlyByTheDOMTree();
+    }
     if (ShouldClearPurple(static_cast<nsIContent*>(root))) {
       nodesToClear.AppendElement(static_cast<nsIContent*>(root));
     }
@@ -3190,6 +3258,7 @@ nsGenericElement::CanSkip(nsINode* aNode, bool aRemovingAllowed)
        node = node->GetNextNode(root)) {
     foundBlack = foundBlack || node->IsBlack();
     if (foundBlack) {
+      domOnlyCycle = false;
       if (currentDoc) {
         // If we can mark the whole document black, no need to optimize
         // so much, since when the next purple node in the document will be
@@ -3202,19 +3271,36 @@ nsGenericElement::CanSkip(nsINode* aNode, bool aRemovingAllowed)
         node->RemovePurple();
       }
       MarkNodeChildren(node);
-    } else if (ShouldClearPurple(node)) {
-      // Collect interesting nodes which we can clear if we find that
-      // they are kept alive in a black tree.
-      nodesToClear.AppendElement(node);
+    } else {
+      domOnlyCycle = domOnlyCycle && node->OwnedOnlyByTheDOMTree();
+      if (ShouldClearPurple(node)) {
+        // Collect interesting nodes which we can clear if we find that
+        // they are kept alive in a black tree or are in a DOM-only cycle.
+        nodesToClear.AppendElement(node);
+      }
     }
   }
 
   if (!currentDoc || !foundBlack) { 
-    if (!gPurpleRoots) {
-      gPurpleRoots = new nsAutoTArray<nsINode*, 1020>();
-    }
     root->SetIsPurpleRoot(true);
-    gPurpleRoots->AppendElement(root);
+    if (domOnlyCycle) {
+      if (!gNodesToUnbind) {
+        gNodesToUnbind = new nsAutoTArray<nsIContent*, 1020>();
+      }
+      gNodesToUnbind->AppendElement(static_cast<nsIContent*>(root));
+      for (PRUint32 i = 0; i < nodesToClear.Length(); ++i) {
+        nsIContent* n = nodesToClear[i];
+        if ((n != aNode || aRemovingAllowed) && n->IsPurple()) {
+          n->RemovePurple();
+        }
+      }
+      return true;
+    } else {
+      if (!gPurpleRoots) {
+        gPurpleRoots = new nsAutoTArray<nsINode*, 1020>();
+      }
+      gPurpleRoots->AppendElement(root);
+    }
   }
 
   if (!foundBlack) {
@@ -3261,7 +3347,7 @@ nsGenericElement::CanSkipThis(nsINode* aNode)
 void
 nsGenericElement::InitCCCallbacks()
 {
-  nsCycleCollector_setForgetSkippableCallback(ClearPurpleRoots);
+  nsCycleCollector_setForgetSkippableCallback(ClearCycleCollectorCleanupData);
   nsCycleCollector_setBeforeUnlinkCallback(ClearBlackMarkedNodes);
 }
 
@@ -4676,6 +4762,11 @@ nsGenericElement::MozRequestPointerLock()
 static const char*
 GetFullScreenError(nsIDocument* aDoc)
 {
+  nsCOMPtr<nsPIDOMWindow> win = aDoc->GetWindow();
+  if (win && win->IsPartOfApp()) {
+    return nsnull;
+  }
+
   if (!nsContentUtils::IsRequestFullScreenAllowed()) {
     return "FullScreenDeniedNotInputDriven";
   }

content/base/src/nsGenericElement.h

@@ -547,6 +547,8 @@ public:
   PRInt32 GetScrollLeft();
   PRInt32 GetScrollHeight();
   PRInt32 GetScrollWidth();
+  PRInt32 GetScrollLeftMax();
+  PRInt32 GetScrollTopMax();
   PRInt32 GetClientTop()
   {
     return nsPresContext::AppUnitsToIntCSSPixels(GetClientAreaRect().y);
@@ -591,6 +593,16 @@ public:
    */
   void FireNodeRemovedForChildren();
 
+  virtual bool OwnedOnlyByTheDOMTree()
+  {
+    PRUint32 rc = mRefCnt.get();
+    if (GetParent()) {
+      --rc;
+    }
+    rc -= mAttrsAndChildren.ChildCount();
+    return rc == 0;
+  }
+
   virtual bool IsPurple()
   {
     return mRefCnt.IsPurple();
@@ -601,6 +613,7 @@ public:
     mRefCnt.RemovePurple();
   }
 
+  static void ClearContentUnbinder();
   static bool CanSkip(nsINode* aNode, bool aRemovingAllowed);
   static bool CanSkipInCC(nsINode* aNode);
   static bool CanSkipThis(nsINode* aNode);

content/base/src/nsRange.cpp

@@ -2017,30 +2017,23 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
   return NS_OK;
 }
 
-nsresult
-nsRange::CloneRange(nsRange** aReturn) const
+already_AddRefed<nsRange>
+nsRange::CloneRange() const
 {
-  if (aReturn == 0)
-    return NS_ERROR_NULL_POINTER;
-
   nsRefPtr<nsRange> range = new nsRange();
 
   range->SetMaySpanAnonymousSubtrees(mMaySpanAnonymousSubtrees);
 
   range->DoSetRange(mStartParent, mStartOffset, mEndParent, mEndOffset, mRoot);
 
-  range.forget(aReturn);
-
-  return NS_OK;
+  return range.forget();
 }
 
 NS_IMETHODIMP
 nsRange::CloneRange(nsIDOMRange** aReturn)
 {
-  nsRefPtr<nsRange> range;
-  nsresult rv = CloneRange(getter_AddRefs(range));
-  range.forget(aReturn);
-  return rv;
+  *aReturn = CloneRange().get();
+  return NS_OK;
 }
 
 NS_IMETHODIMP

content/base/src/nsRange.h

@@ -118,7 +118,7 @@ public:
   void Reset();
   nsresult SetStart(nsINode* aParent, PRInt32 aOffset);
   nsresult SetEnd(nsINode* aParent, PRInt32 aOffset);
-  nsresult CloneRange(nsRange** aNewRange) const;
+  already_AddRefed<nsRange> CloneRange() const;
 
   nsresult Set(nsINode* aStartParent, PRInt32 aStartOffset,
                nsINode* aEndParent, PRInt32 aEndOffset)

content/base/test/test_bug166235.html

@@ -22,6 +22,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=166235
 
 /** Test for Bug 166235 **/
   var Cc = SpecialPowers.wrap(Components).classes;
+  var Ci = SpecialPowers.wrap(Components).interfaces;
 
   var webnav = SpecialPowers.wrap(window).QueryInterface(Components.interfaces.nsIInterfaceRequestor)
                                          .getInterface(Components.interfaces.nsIWebNavigation)
@@ -36,6 +37,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=166235
 
   var textarea = SpecialPowers.wrap(document).getElementById('input');
 
+  function getLoadContext() {
+    return SpecialPowers.wrap(window).QueryInterface(Ci.nsIInterfaceRequestor)
+                                     .getInterface(Ci.nsIWebNavigation)
+                                     .QueryInterface(Ci.nsILoadContext);
+  }
+
   function copyChildrenToClipboard(id) {
     textarea.blur();
     clipboard.emptyClipboard(1);
@@ -48,6 +55,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=166235
   function getClipboardData(mime) {
     var transferable = Cc['@mozilla.org/widget/transferable;1']
                          .createInstance(Components.interfaces.nsITransferable);
+    transferable.init(getLoadContext());
     transferable.addDataFlavor(mime);
     clipboard.getData(transferable, 1);
     var data = SpecialPowers.wrap({});

content/base/test/test_copypaste.html

@@ -35,6 +35,13 @@ function modifySelection(s) {
   }, 0)
 }
 
+function getLoadContext() {
+  var Ci = SpecialPowers.wrap(Components).interfaces;
+  return SpecialPowers.wrap(window).QueryInterface(Ci.nsIInterfaceRequestor)
+                                   .getInterface(Ci.nsIWebNavigation)
+                                   .QueryInterface(Ci.nsILoadContext);
+}
+
 function testCopyPaste () {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
@@ -86,6 +93,7 @@ function testCopyPaste () {
   function getClipboardData(mime) {
     var transferable = Components.classes['@mozilla.org/widget/transferable;1']
                                  .createInstance(Components.interfaces.nsITransferable);
+    transferable.init(getLoadContext());
     transferable.addDataFlavor(mime);
     clipboard.getData(transferable, 1);
     var data = {};

content/canvas/src/WebGLContextGL.cpp

@@ -2447,7 +2447,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         case LOCAL_GL_COMPRESSED_TEXTURE_FORMATS:
         {
             uint32_t length = mCompressedTextureFormats.Length();
-            JSObject* obj = Uint32Array::Create(cx, length, mCompressedTextureFormats.Elements());
+            JSObject* obj = Uint32Array::Create(cx, this, length, mCompressedTextureFormats.Elements());
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }
@@ -2524,7 +2524,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         {
             GLfloat fv[2] = { 0 };
             gl->fGetFloatv(pname, fv);
-            JSObject* obj = Float32Array::Create(cx, 2, fv);
+            JSObject* obj = Float32Array::Create(cx, this, 2, fv);
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }
@@ -2536,7 +2536,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         {
             GLfloat fv[4] = { 0 };
             gl->fGetFloatv(pname, fv);
-            JSObject* obj = Float32Array::Create(cx, 4, fv);
+            JSObject* obj = Float32Array::Create(cx, this, 4, fv);
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }
@@ -2547,7 +2547,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         {
             GLint iv[2] = { 0 };
             gl->fGetIntegerv(pname, iv);
-            JSObject* obj = Int32Array::Create(cx, 2, iv);
+            JSObject* obj = Int32Array::Create(cx, this, 2, iv);
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }
@@ -2559,7 +2559,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         {
             GLint iv[4] = { 0 };
             gl->fGetIntegerv(pname, iv);
-            JSObject* obj = Int32Array::Create(cx, 4, iv);
+            JSObject* obj = Int32Array::Create(cx, this, 4, iv);
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }
@@ -3323,7 +3323,7 @@ WebGLContext::GetUniform(JSContext* cx, WebGLProgram *prog,
         if (unitSize == 1) {
             return JS::DoubleValue(fv[0]);
         } else {
-            JSObject* obj = Float32Array::Create(cx, unitSize, fv);
+            JSObject* obj = Float32Array::Create(cx, this, unitSize, fv);
             if (!obj) {
                 rv.Throw(NS_ERROR_OUT_OF_MEMORY);
             }
@@ -3335,7 +3335,7 @@ WebGLContext::GetUniform(JSContext* cx, WebGLProgram *prog,
         if (unitSize == 1) {
             return JS::Int32Value(iv[0]);
         } else {
-            JSObject* obj = Int32Array::Create(cx, unitSize, iv);
+            JSObject* obj = Int32Array::Create(cx, this, unitSize, iv);
             if (!obj) {
                 rv.Throw(NS_ERROR_OUT_OF_MEMORY);
             }
@@ -3462,7 +3462,7 @@ WebGLContext::GetVertexAttrib(JSContext* cx, WebGLuint index, WebGLenum pname,
                 vec[2] = mVertexAttrib0Vector[2];
                 vec[3] = mVertexAttrib0Vector[3];
             }
-            JSObject* obj = Float32Array::Create(cx, 4, vec);
+            JSObject* obj = Float32Array::Create(cx, this, 4, vec);
             if (!obj) {
                 rv.Throw(NS_ERROR_OUT_OF_MEMORY);
             }

content/events/src/nsDOMDataTransfer.cpp

@@ -627,8 +627,11 @@ nsDOMDataTransfer::Clone(PRUint32 aEventType, bool aUserCancelled,
 }
 
 void
-nsDOMDataTransfer::GetTransferables(nsISupportsArray** aArray)
+nsDOMDataTransfer::GetTransferables(nsISupportsArray** aArray,
+                                    nsIDOMNode* aDragTarget)
 {
+  MOZ_ASSERT(aDragTarget);
+
   *aArray = nsnull;
 
   nsCOMPtr<nsISupportsArray> transArray =
@@ -636,6 +639,14 @@ nsDOMDataTransfer::GetTransferables(nsISupportsArray** aArray)
   if (!transArray)
     return;
 
+  nsCOMPtr<nsINode> dragNode = do_QueryInterface(aDragTarget);
+  if (!dragNode)
+    return;
+  nsIDocument* doc = dragNode->GetCurrentDoc();
+  if (!doc)
+    return;
+  nsILoadContext* loadContext = doc->GetLoadContext();
+
   bool added = false;
   PRUint32 count = mItems.Length();
   for (PRUint32 i = 0; i < count; i++) {
@@ -649,6 +660,7 @@ nsDOMDataTransfer::GetTransferables(nsISupportsArray** aArray)
       do_CreateInstance("@mozilla.org/widget/transferable;1");
     if (!transferable)
       return;
+    transferable->Init(loadContext);
 
     for (PRUint32 f = 0; f < count; f++) {
       TransferItem& formatitem = item[f];

content/events/src/nsDOMDataTransfer.h

@@ -97,7 +97,8 @@ public:
 
   // converts the data into an array of nsITransferable objects to be used for
   // drag and drop or clipboard operations.
-  void GetTransferables(nsISupportsArray** transferables);
+  void GetTransferables(nsISupportsArray** transferables,
+                        nsIDOMNode* aDragTarget);
 
   // converts the data in the variant to an nsISupportString if possible or
   // an nsISupports or null otherwise.

content/events/src/nsEventStateManager.cpp

@@ -2317,7 +2317,7 @@ nsEventStateManager::DoDefaultDragStart(nsPresContext* aPresContext,
   nsIDOMElement* dragImage = aDataTransfer->GetDragImage(&imageX, &imageY);
 
   nsCOMPtr<nsISupportsArray> transArray;
-  aDataTransfer->GetTransferables(getter_AddRefs(transArray));
+  aDataTransfer->GetTransferables(getter_AddRefs(transArray), dragTarget);
   if (!transArray)
     return false;
 

content/html/content/src/nsGenericHTMLElement.cpp

@@ -4286,3 +4286,41 @@ nsGenericHTMLElement::GetProperties(nsIDOMHTMLPropertiesCollection** aReturn)
   return NS_OK;
 }
 
+nsSize
+nsGenericHTMLElement::GetWidthHeightForImage(imgIRequest *aImageRequest)
+{
+  nsSize size(0,0);
+
+  nsIFrame* frame = GetPrimaryFrame(Flush_Layout);
+
+  if (frame) {
+    size = frame->GetContentRect().Size();
+
+    size.width = nsPresContext::AppUnitsToIntCSSPixels(size.width);
+    size.height = nsPresContext::AppUnitsToIntCSSPixels(size.height);
+  } else {
+    const nsAttrValue* value;
+    nsCOMPtr<imgIContainer> image;
+    if (aImageRequest) {
+      aImageRequest->GetImage(getter_AddRefs(image));
+    }
+
+    if ((value = GetParsedAttr(nsGkAtoms::width)) &&
+        value->Type() == nsAttrValue::eInteger) {
+      size.width = value->GetIntegerValue();
+    } else if (image) {
+      image->GetWidth(&size.width);
+    }
+
+    if ((value = GetParsedAttr(nsGkAtoms::height)) &&
+        value->Type() == nsAttrValue::eInteger) {
+      size.height = value->GetIntegerValue();
+    } else if (image) {
+      image->GetHeight(&size.height);
+    }
+  }
+
+  NS_ASSERTION(size.width >= 0, "negative width");
+  NS_ASSERTION(size.height >= 0, "negative height");
+  return size;
+}

content/html/content/src/nsGenericHTMLElement.h

@@ -147,6 +147,11 @@ public:
   nsresult ClearDataset();
   nsresult GetContextMenu(nsIDOMHTMLMenuElement** aContextMenu);
 
+  /**
+   * Get width and height, using given image request if attributes are unset.
+   */
+  nsSize GetWidthHeightForImage(imgIRequest *aImageRequest);
+
 protected:
   nsresult GetMarkup(bool aIncludeSelf, nsAString& aMarkup);
 

content/html/content/src/nsHTMLImageElement.cpp

@@ -196,49 +196,10 @@ nsHTMLImageElement::GetY(PRInt32* aY)
   return NS_OK;
 }
 
-nsSize
-nsHTMLImageElement::GetWidthHeight()
-{
-  nsSize size(0,0);
-
-  nsIFrame* frame = GetPrimaryFrame(Flush_Layout);
-
-  if (frame) {
-    size = frame->GetContentRect().Size();
-
-    size.width = nsPresContext::AppUnitsToIntCSSPixels(size.width);
-    size.height = nsPresContext::AppUnitsToIntCSSPixels(size.height);
-  } else {
-    const nsAttrValue* value;
-    nsCOMPtr<imgIContainer> image;
-    if (mCurrentRequest) {
-      mCurrentRequest->GetImage(getter_AddRefs(image));
-    }
-
-    if ((value = GetParsedAttr(nsGkAtoms::width)) &&
-        value->Type() == nsAttrValue::eInteger) {
-      size.width = value->GetIntegerValue();
-    } else if (image) {
-      image->GetWidth(&size.width);
-    }
-
-    if ((value = GetParsedAttr(nsGkAtoms::height)) &&
-        value->Type() == nsAttrValue::eInteger) {
-      size.height = value->GetIntegerValue();
-    } else if (image) {
-      image->GetHeight(&size.height);
-    }
-  }
-
-  NS_ASSERTION(size.width >= 0, "negative width");
-  NS_ASSERTION(size.height >= 0, "negative height");
-  return size;
-}
-
 NS_IMETHODIMP
 nsHTMLImageElement::GetHeight(PRUint32* aHeight)
 {
-  *aHeight = GetWidthHeight().height;
+  *aHeight = GetWidthHeightForImage(mCurrentRequest).height;
 
   return NS_OK;
 }
@@ -246,17 +207,13 @@ nsHTMLImageElement::GetHeight(PRUint32* aHeight)
 NS_IMETHODIMP
 nsHTMLImageElement::SetHeight(PRUint32 aHeight)
 {
-  nsAutoString val;
-  val.AppendInt(aHeight);
-
-  return nsGenericHTMLElement::SetAttr(kNameSpaceID_None, nsGkAtoms::height,
-                                       val, true);
+  return nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::height, aHeight);
 }
 
 NS_IMETHODIMP
 nsHTMLImageElement::GetWidth(PRUint32* aWidth)
 {
-  *aWidth = GetWidthHeight().width;
+  *aWidth = GetWidthHeightForImage(mCurrentRequest).width;
 
   return NS_OK;
 }
@@ -264,11 +221,7 @@ nsHTMLImageElement::GetWidth(PRUint32* aWidth)
 NS_IMETHODIMP
 nsHTMLImageElement::SetWidth(PRUint32 aWidth)
 {
-  nsAutoString val;
-  val.AppendInt(aWidth);
-
-  return nsGenericHTMLElement::SetAttr(kNameSpaceID_None, nsGkAtoms::width,
-                                       val, true);
+  return nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::width, aWidth);
 }
 
 bool

content/html/content/src/nsHTMLImageElement.h

@@ -102,7 +102,6 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 protected:
   nsIntPoint GetXY();
-  nsSize GetWidthHeight();
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
 };

content/html/content/src/nsHTMLInputElement.cpp

@@ -858,6 +858,19 @@ NS_IMPL_STRING_ATTR(nsHTMLInputElement, Placeholder, placeholder)
 NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(nsHTMLInputElement, Type, type,
                                 kInputDefaultType->tag)
 
+NS_IMETHODIMP
+nsHTMLInputElement::GetHeight(PRUint32 *aHeight)
+{
+  *aHeight = GetWidthHeightForImage(mCurrentRequest).height;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLInputElement::SetHeight(PRUint32 aHeight)
+{
+  return nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::height, aHeight);
+}
+
 NS_IMETHODIMP
 nsHTMLInputElement::GetIndeterminate(bool* aValue)
 {
@@ -889,6 +902,19 @@ nsHTMLInputElement::SetIndeterminate(bool aValue)
   return SetIndeterminateInternal(aValue, true);
 }
 
+NS_IMETHODIMP
+nsHTMLInputElement::GetWidth(PRUint32 *aWidth)
+{
+  *aWidth = GetWidthHeightForImage(mCurrentRequest).width;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLInputElement::SetWidth(PRUint32 aWidth)
+{
+  return nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::width, aWidth);
+}
+
 NS_IMETHODIMP
 nsHTMLInputElement::GetValue(nsAString& aValue)
 {

content/html/content/test/forms/test_input_attributes_reflection.html

@@ -99,7 +99,12 @@ reflectString({
   otherValues: [ "_blank", "_self", "_parent", "_top" ],
 });
 
-// TODO: height (non-negative integer)
+// .height
+reflectUnsignedInt({
+  element: document.createElement("input"),
+  attribute: "height",
+  nonZero: false
+});
 
 // .indeterminate doesn't reflect a content attribute.
 
@@ -204,7 +209,12 @@ todo("valueAsNumber" in document.createElement("input"),
 todo("selectedOption" in document.createElement("input"),
      "selectedOption isn't implemented yet");
 
-// TODO: width (non-negative integer)
+// .width
+reflectUnsignedInt({
+  element: document.createElement("input"),
+  attribute: "width",
+  nonZero: false
+});
 
 // .willValidate doesn't reflect a content attribute.
 // .validity doesn't reflect a content attribute.

dom/base/nsDOMClassInfo.cpp

@@ -470,12 +470,7 @@
 #include "nsHTMLSelectElement.h"
 #include "nsHTMLLegendElement.h"
 
-#include "DOMSVGLengthList.h"
-#include "DOMSVGNumberList.h"
-#include "DOMSVGPathSegList.h"
-#include "DOMSVGPointList.h"
 #include "DOMSVGStringList.h"
-#include "DOMSVGTransformList.h"
 
 #include "mozilla/dom/indexedDB/IDBWrapperCache.h"
 #include "mozilla/dom/indexedDB/IDBFactory.h"
@@ -780,10 +775,10 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(DOMException, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(DOMTokenList, nsDOMTokenListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(DOMSettableTokenList, nsDOMTokenListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(DOMTokenList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(DOMSettableTokenList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(DocumentFragment, nsNodeSH, NODE_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(Element, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
@@ -1262,14 +1257,14 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGLength, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGLengthList, nsSVGLengthListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(SVGLengthList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGMatrix, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGNumber, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGNumberList, nsSVGNumberListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)    
+  NS_DEFINE_CLASSINFO_DATA(SVGNumberList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPathSegArcAbs, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPathSegArcRel, nsDOMGenericSH,
@@ -1304,16 +1299,16 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPathSegLinetoVerticalRel, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGPathSegList, nsSVGPathSegListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(SVGPathSegList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPathSegMovetoAbs, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPathSegMovetoRel, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPoint, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGPointList, nsSVGPointListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(SVGPointList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGPreserveAspectRatio, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGRect, nsDOMGenericSH,
@@ -1322,8 +1317,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            ARRAY_SCRIPTABLE_FLAGS)    
   NS_DEFINE_CLASSINFO_DATA(SVGTransform, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGTransformList, nsSVGTransformListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(SVGTransformList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGZoomEvent, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
@@ -1397,8 +1392,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
 
   NS_DEFINE_CLASSINFO_DATA(ClientRect, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(ClientRectList, nsClientRectListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(ClientRectList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(SVGForeignObjectElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
@@ -1411,8 +1406,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
   NS_DEFINE_CLASSINFO_DATA(OfflineResourceList, nsOfflineResourceListSH,
                            ARRAY_SCRIPTABLE_FLAGS)
 
-  NS_DEFINE_CLASSINFO_DATA(FileList, nsFileListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(FileList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(Blob, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(File, nsDOMGenericSH,
@@ -1578,8 +1573,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
 
   NS_DEFINE_CLASSINFO_DATA(PaintRequest, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(PaintRequestList, nsPaintRequestListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(PaintRequestList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(ScrollAreaEvent, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
@@ -1637,8 +1632,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
 
   NS_DEFINE_CLASSINFO_DATA(Touch, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(TouchList, nsDOMTouchListSH,
-                           ARRAY_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(TouchList, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(TouchEvent, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
@@ -8351,27 +8346,6 @@ nsStringListSH::GetStringAt(nsISupports *aNative, PRInt32 aIndex,
 }
 
 
-// DOMTokenList scriptable helper
-
-nsresult
-nsDOMTokenListSH::GetStringAt(nsISupports *aNative, PRInt32 aIndex,
-                              nsAString& aResult)
-{
-  nsCOMPtr<nsIDOMDOMTokenList> list(do_QueryInterface(aNative));
-  NS_ENSURE_TRUE(list, NS_ERROR_UNEXPECTED);
-
-  nsresult rv = list->Item(aIndex, aResult);
-#ifdef DEBUG
-  if (DOMStringIsNull(aResult)) {
-    PRUint32 length = 0;
-    list->GetLength(&length);
-    NS_ASSERTION(PRUint32(aIndex) >= length, "Item should only return null for out-of-bounds access");
-  }
-#endif
-  return rv;
-}
-
-
 // Named Array helper
 
 NS_IMETHODIMP
@@ -10287,36 +10261,6 @@ nsCSSRuleListSH::GetItemAt(nsISupports *aNative, PRUint32 aIndex,
   return list->GetItemAt(aIndex, aResult);
 }
 
-// ClientRectList scriptable helper
-
-nsISupports*
-nsClientRectListSH::GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                              nsWrapperCache **aCache, nsresult *aResult)
-{
-  nsClientRectList* list = nsClientRectList::FromSupports(aNative);
-
-  return list->GetItemAt(aIndex);
-}
-
-// PaintRequestList scriptable helper
-
-nsISupports*
-nsPaintRequestListSH::GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                nsWrapperCache **aCache, nsresult *aResult)
-{
-  nsPaintRequestList* list = nsPaintRequestList::FromSupports(aNative);
-
-  return list->GetItemAt(aIndex);
-}
-
-nsISupports*
-nsDOMTouchListSH::GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                            nsWrapperCache **aCache, nsresult *aResult)
-{
-  nsDOMTouchList* list = static_cast<nsDOMTouchList*>(aNative);
-  return list->GetItemAt(aIndex);
-}
-
 #ifdef MOZ_XUL
 // TreeColumns helper
 
@@ -10755,39 +10699,6 @@ nsOfflineResourceListSH::GetStringAt(nsISupports *aNative, PRInt32 aIndex,
   return rv;
 }
 
-// nsFileListSH
-nsISupports*
-nsFileListSH::GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                        nsWrapperCache **aCache, nsresult *aResult)
-{
-  nsDOMFileList* list = nsDOMFileList::FromSupports(aNative);
-
-  return list->GetItemAt(aIndex);
-}
-
-// Template for SVGXXXList helpers
-template<class ListInterfaceType, class ListType> nsISupports*
-nsSVGListSH<ListInterfaceType, ListType>::GetItemAt(nsISupports *aNative,
-                                                    PRUint32 aIndex,
-                                                    nsWrapperCache **aCache,
-                                                    nsresult *aResult)
-{
-  ListType* list = static_cast<ListType*>(static_cast<ListInterfaceType*>(aNative));
-#ifdef DEBUG
-  {
-    nsCOMPtr<ListInterfaceType> list_qi = do_QueryInterface(aNative);
-
-    // If this assertion fires the QI implementation for the object in
-    // question doesn't use the nsIDOMSVGXXXList pointer as the nsISupports
-    // pointer. That must be fixed, or we'll crash...
-    NS_ABORT_IF_FALSE(list_qi == list, "Uh, fix QI!");
-  }
-#endif
-
-  return list->GetItemAt(aIndex);
-}
-
-
 // SVGStringList helper
 
 nsresult

dom/base/nsDOMClassInfo.h

@@ -1088,31 +1088,6 @@ public:
 };
 
 
-// DOMTokenList scriptable helper
-
-class nsDOMTokenListSH : public nsStringArraySH
-{
-protected:
-  nsDOMTokenListSH(nsDOMClassInfoData* aData) : nsStringArraySH(aData)
-  {
-  }
-
-  virtual ~nsDOMTokenListSH()
-  {
-  }
-
-  virtual nsresult GetStringAt(nsISupports *aNative, PRInt32 aIndex,
-                               nsAString& aResult);
-
-public:
-
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsDOMTokenListSH(aData);
-  }
-};
-
-
 // MediaList helper
 
 class nsMediaListSH : public nsStringArraySH
@@ -1235,74 +1210,6 @@ public:
   }
 };
 
-// ClientRectList helper
-
-class nsClientRectListSH : public nsArraySH
-{
-protected:
-  nsClientRectListSH(nsDOMClassInfoData* aData) : nsArraySH(aData)
-  {
-  }
-
-  virtual ~nsClientRectListSH()
-  {
-  }
-
-  virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                 nsWrapperCache **aCache, nsresult *aResult);
-
-public:
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsClientRectListSH(aData);
-  }
-};
-
-
-// PaintRequestList helper
-
-class nsPaintRequestListSH : public nsArraySH
-{
-protected:
-  nsPaintRequestListSH(nsDOMClassInfoData* aData) : nsArraySH(aData)
-  {
-  }
-
-  virtual ~nsPaintRequestListSH()
-  {
-  }
-
-  virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                 nsWrapperCache **aCache, nsresult *aResult);
-
-public:
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsPaintRequestListSH(aData);
-  }
-};
-
-class nsDOMTouchListSH : public nsArraySH
-{
-protected:
-  nsDOMTouchListSH(nsDOMClassInfoData* aData) : nsArraySH(aData)
-  {
-  }
-
-  virtual ~nsDOMTouchListSH()
-  {
-  }
-
-  virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                 nsWrapperCache **aCache, nsresult *aResult);
-
-public:
-  static nsIClassInfo* doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsDOMTouchListSH(aData);
-  }
-};
-
 #ifdef MOZ_XUL
 // TreeColumns helper
 
@@ -1507,53 +1414,6 @@ public:
   }
 };
 
-class nsFileListSH : public nsArraySH
-{
-protected:
-  nsFileListSH(nsDOMClassInfoData *aData) : nsArraySH(aData)
-  {
-  }
-
-  virtual ~nsFileListSH()
-  {
-  }
-
-  virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                 nsWrapperCache **aCache, nsresult *aResult);
-
-public:
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsFileListSH(aData);
-  }
-};
-
-// Template for SVGXXXList helpers
- 
-template<class ListInterfaceType, class ListType>
-class nsSVGListSH : public nsArraySH
-{
-protected:
-  nsSVGListSH(nsDOMClassInfoData* aData) : nsArraySH(aData)
-  {
-  }
-
-public:
-  virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
-                                 nsWrapperCache **aCache, nsresult *aResult);
- 
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsSVGListSH(aData);
-  }
-};
-
-typedef nsSVGListSH<nsIDOMSVGLengthList, mozilla::DOMSVGLengthList> nsSVGLengthListSH;
-typedef nsSVGListSH<nsIDOMSVGNumberList, mozilla::DOMSVGNumberList> nsSVGNumberListSH;
-typedef nsSVGListSH<nsIDOMSVGPathSegList, mozilla::DOMSVGPathSegList> nsSVGPathSegListSH;
-typedef nsSVGListSH<nsIDOMSVGPointList, mozilla::DOMSVGPointList> nsSVGPointListSH;
-typedef nsSVGListSH<nsIDOMSVGTransformList, mozilla::DOMSVGTransformList> nsSVGTransformListSH;
-
 // SVGStringList helper
 
 class nsSVGStringListSH : public nsStringArraySH

dom/base/nsDOMWindowUtils.cpp

@@ -50,7 +50,7 @@
 #include "nsIMarkupDocumentViewer.h"
 #include "nsClientRect.h"
 
-#if defined(MOZ_X11) && defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_X11) && defined(MOZ_WIDGET_GTK)
 #include <gdk/gdk.h>
 #include <gdk/gdkx.h>
 #endif
@@ -213,8 +213,8 @@ nsDOMWindowUtils::Redraw(PRUint32 aCount, PRUint32 *aDurationOut)
       for (PRUint32 i = 0; i < aCount; i++)
         rootFrame->InvalidateWithFlags(r, nsIFrame::INVALIDATE_IMMEDIATE);
 
-#if defined(MOZ_X11) && defined(MOZ_WIDGET_GTK2)
-      XSync(GDK_DISPLAY(), False);
+#if defined(MOZ_X11) && defined(MOZ_WIDGET_GTK)
+      XSync(GDK_DISPLAY_XDISPLAY(gdk_display_get_default()), False);
 #endif
 
       *aDurationOut = PR_IntervalToMilliseconds(PR_IntervalNow() - iStart);

dom/base/nsGlobalWindow.h

@@ -340,6 +340,7 @@ public:
   virtual NS_HIDDEN_(bool) DispatchCustomEvent(const char *aEventName);
   virtual NS_HIDDEN_(void) RefreshCompartmentPrincipal();
   virtual NS_HIDDEN_(nsresult) SetFullScreenInternal(bool aIsFullScreen, bool aRequireTrust);
+  virtual NS_HIDDEN_(bool) IsPartOfApp();
 
   // nsIDOMStorageIndexedDB
   NS_DECL_NSIDOMSTORAGEINDEXEDDB
@@ -545,13 +546,6 @@ public:
   void AddEventTargetObject(nsDOMEventTargetHelper* aObject);
   void RemoveEventTargetObject(nsDOMEventTargetHelper* aObject);
 
-  /**
-   * Returns if the window is part of an application.
-   * It will check for the window app state and its parents until a window has
-   * an app state different from |TriState_Unknown|.
-   */
-  bool IsPartOfApp();
-
 protected:
   friend class HashchangeCallback;
   friend class nsBarProp;

dom/base/nsJSEnvironment.cpp

@@ -2960,10 +2960,70 @@ nsJSContext::ShrinkGCBuffersNow()
   JS_ShrinkGCBuffers(nsJSRuntime::sRuntime);
 }
 
-//Static
+// Return true if any JSContext has a "global object" with a gray
+// parent. The intent is to look for JS Object windows. We don't merge
+// system compartments, so we don't use them to trigger merging CCs.
+static bool
+AnyGrayGlobalParent()
+{
+  if (!nsJSRuntime::sRuntime) {
+    return false;
+  }
+  JSContext *iter = nsnull;
+  JSContext *cx;
+  while ((cx = JS_ContextIterator(nsJSRuntime::sRuntime, &iter))) {
+    if (JSObject *global = JS_GetGlobalObject(cx)) {
+      if (JSObject *parent = js::GetObjectParent(global)) {
+        if (js::GCThingIsMarkedGray(parent) &&
+            !js::IsSystemCompartment(js::GetGCThingCompartment(parent))) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+static bool
+DoMergingCC(bool aForced)
+{
+  // Don't merge too many times in a row, and do at least a minimum
+  // number of unmerged CCs in a row.
+  static const PRInt32 kMinConsecutiveUnmerged = 3;
+  static const PRInt32 kMaxConsecutiveMerged = 3;
+
+  static PRInt32 sUnmergedNeeded = 0;
+  static PRInt32 sMergedInARow = 0;
+
+  MOZ_ASSERT(0 <= sUnmergedNeeded <= kMinConsecutiveUnmerged);
+  MOZ_ASSERT(0 <= sMergedInARow <= kMaxConsecutiveMerged);
+
+  if (sMergedInARow == kMaxConsecutiveMerged) {
+    MOZ_ASSERT(sUnmergedNeeded == 0);
+    sUnmergedNeeded = kMinConsecutiveUnmerged;
+  }
+
+  if (sUnmergedNeeded > 0) {
+    sUnmergedNeeded--;
+    sMergedInARow = 0;
+    return false;
+  }
+
+  if (!aForced && AnyGrayGlobalParent()) {
+    sMergedInARow++;
+    return true;
+  } else {
+    sMergedInARow = 0;
+    return false;
+  }
+
+}
+
+//static
 void
 nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
-                             PRInt32 aExtraForgetSkippableCalls)
+                             PRInt32 aExtraForgetSkippableCalls,
+                             bool aForced)
 {
   if (!NS_IsMainThread()) {
     return;
@@ -2995,8 +3055,10 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
     ++sCleanupsSinceLastGC;
   }
 
+  bool mergingCC = DoMergingCC(aForced);
+
   nsCycleCollectorResults ccResults;
-  nsCycleCollector_collect(&ccResults, aListener);
+  nsCycleCollector_collect(mergingCC, &ccResults, aListener);
   sCCollectedWaitingForGC += ccResults.mFreedRefCounted + ccResults.mFreedGCed;
 
   // If we collected a substantial amount of cycles, poke the GC since more objects
@@ -3024,13 +3086,18 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
       sFirstCollectionTime = now;
     }
 
+    nsCString mergeMsg;
+    if (mergingCC) {
+      mergeMsg.AssignLiteral(" merged");
+    }
+
     nsCString gcMsg;
     if (ccResults.mForcedGC) {
       gcMsg.AssignLiteral(", forced a GC");
     }
 
     NS_NAMED_MULTILINE_LITERAL_STRING(kFmt,
-      NS_LL("CC(T+%.1f) duration: %llums, suspected: %lu, visited: %lu RCed and %lu GCed, collected: %lu RCed and %lu GCed (%lu waiting for GC)%s\n")
+      NS_LL("CC(T+%.1f) duration: %llums, suspected: %lu, visited: %lu RCed and %lu%s GCed, collected: %lu RCed and %lu GCed (%lu waiting for GC)%s\n")
       NS_LL("ForgetSkippable %lu times before CC, min: %lu ms, max: %lu ms, avg: %lu ms, total: %lu ms, removed: %lu"));
     nsString msg;
     PRUint32 cleanups = sForgetSkippableBeforeCC ? sForgetSkippableBeforeCC : 1;
@@ -3038,7 +3105,7 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
       ? 0 : sMinForgetSkippableTime;
     msg.Adopt(nsTextFormatter::smprintf(kFmt.get(), double(delta) / PR_USEC_PER_SEC,
                                         (now - start) / PR_USEC_PER_MSEC, suspected,
-                                        ccResults.mVisitedRefCounted, ccResults.mVisitedGCed,
+                                        ccResults.mVisitedRefCounted, ccResults.mVisitedGCed, mergeMsg.get(),
                                         ccResults.mFreedRefCounted, ccResults.mFreedGCed,
                                         sCCollectedWaitingForGC, gcMsg.get(),
                                         sForgetSkippableBeforeCC,
@@ -3191,7 +3258,7 @@ CCTimerFired(nsITimer *aTimer, void *aClosure)
     } else {
       // We are in the final timer fire and still meet the conditions for
       // triggering a CC.
-      nsJSContext::CycleCollectNow();
+      nsJSContext::CycleCollectNow(nsnull, 0, false);
     }
   } else if ((sPreviousSuspectedCount + 100) <= suspected) {
     // Only do a forget skippable if there are more than a few new objects.

dom/base/nsJSEnvironment.h

@@ -153,7 +153,8 @@ public:
   // If aExtraForgetSkippableCalls is -1, forgetSkippable won't be
   // called even if the previous collection was GC.
   static void CycleCollectNow(nsICycleCollectorListener *aListener = nsnull,
-                              PRInt32 aExtraForgetSkippableCalls = 0);
+                              PRInt32 aExtraForgetSkippableCalls = 0,
+                              bool aForced = true);
 
   static void PokeGC(js::gcreason::Reason aReason, int aDelay = 0);
   static void KillGCTimer();

dom/base/nsPIDOMWindow.h

@@ -592,6 +592,13 @@ public:
    */
   virtual void RefreshCompartmentPrincipal() = 0;
 
+  /**
+   * Returns if the window is part of an application.
+   * It will check for the window app state and its parents until a window has
+   * an app state different from |TriState_Unknown|.
+   */
+  virtual bool IsPartOfApp() = 0;
+
 protected:
   // The nsPIDOMWindow constructor. The aOuterWindow argument should
   // be null if and only if the created window itself is an outer

dom/bindings/TypedArray.h

@@ -44,7 +44,15 @@ struct TypedArray : public TypedArray_base<T,U,GetData,GetLength> {
   {}
   
   static inline JSObject*
-  Create(JSContext* cx, uint32_t length, T* data = NULL) {
+  Create(JSContext* cx, nsWrapperCache* creator, uint32_t length,
+         T* data = NULL) {
+    JSObject* creatorWrapper;
+    JSAutoEnterCompartment ac;
+    if (creator && (creatorWrapper = creator->GetWrapperPreserveColor())) {
+      if (!ac.enter(cx, creatorWrapper)) {
+        return NULL;
+      }
+    }
     JSObject* obj = CreateNew(cx, length);
     if (!obj) {
       return NULL;
@@ -64,7 +72,7 @@ typedef TypedArray<uint8_t, uint8_t, JS_GetUint8ArrayData,
                    JS_GetTypedArrayLength, JS_NewUint8Array>
         Uint8Array;
 typedef TypedArray<uint8_t, uint8_t, JS_GetUint8ClampedArrayData,
-                   JS_GetTypedArrayLength, JS_NewUint8Array>
+                   JS_GetTypedArrayLength, JS_NewUint8ClampedArray>
         Uint8ClampedArray;
 typedef TypedArray<int16_t, int16_t, JS_GetInt16ArrayData,
                    JS_GetTypedArrayLength, JS_NewInt16Array>

dom/devicestorage/Makefile.in

@@ -32,6 +32,8 @@ LOCAL_INCLUDES = \
 		-I$(topsrcdir)/content/events/src \
 		$(NULL)
 
+TEST_DIRS += test
+
 include $(topsrcdir)/config/config.mk
 include $(topsrcdir)/ipc/chromium/chromium-config.mk
 include $(topsrcdir)/config/rules.mk

dom/devicestorage/nsDeviceStorage.cpp

@@ -28,9 +28,11 @@ public:
 
   nsCOMPtr<nsIFile> mFile;
   nsString mPath;
+  bool mEditable;
 
   DeviceStorageFile(nsIFile* aFile, const nsAString& aPath)
   : mPath(aPath)
+  , mEditable(false)
   {
     NS_ASSERTION(aFile, "Must not create a DeviceStorageFile with a null nsIFile");
     // always take a clone
@@ -43,6 +45,7 @@ public:
   }
 
   DeviceStorageFile(nsIFile* aFile)
+  : mEditable(false)
   {
     NS_ASSERTION(aFile, "Must not create a DeviceStorageFile with a null nsIFile");
     // always take a clone
@@ -56,6 +59,11 @@ public:
     NormalizeFilePath();
   }
 
+  void
+  setEditable(bool aEditable) {
+    mEditable = aEditable;
+  }
+
   NS_DECL_ISUPPORTS
 
   // we want to make sure that the names of file can't reach
@@ -220,12 +228,12 @@ nsDOMDeviceStorage::SetRootFileForType(const nsAString& aType, const PRInt32 aIn
   return typeResult;
 }
 
-static jsval nsIFileToJsval(nsPIDOMWindow* aWindow, DeviceStorageFile* aFile, bool aEditable)
+static jsval nsIFileToJsval(nsPIDOMWindow* aWindow, DeviceStorageFile* aFile)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   NS_ASSERTION(aWindow, "Null Window");
 
-  if (aEditable) {
+  if (aFile->mEditable) {
     // TODO - needs janv's file handle support.
     return JSVAL_NULL;
   }
@@ -309,7 +317,6 @@ public:
   nsDOMDeviceStorageCursor(nsIDOMWindow* aWindow,
                            nsIURI* aURI,
                            DeviceStorageFile* aFile,
-                           bool aEditable,
                            PRUint64 aSince);
 
 private:
@@ -321,7 +328,6 @@ protected:
   bool mOkToCallContinue;
   nsRefPtr<DeviceStorageFile> mFile;
   nsCOMPtr<nsIURI> mURI;
-  bool mEditable;
   PRUint64 mSince;
 
   // to access mFiles
@@ -453,7 +459,7 @@ public:
     else {
       nsRefPtr<DeviceStorageFile> file = cursor->mFiles[0];
       cursor->mFiles.RemoveElementAt(0);
-      val = nsIFileToJsval(cursor->GetOwner(), file, cursor->mEditable);
+      val = nsIFileToJsval(cursor->GetOwner(), file);
       cursor->mOkToCallContinue = true;
     }
 
@@ -578,13 +584,11 @@ NS_IMPL_RELEASE_INHERITED(nsDOMDeviceStorageCursor, DOMRequest)
 nsDOMDeviceStorageCursor::nsDOMDeviceStorageCursor(nsIDOMWindow* aWindow,
                                                    nsIURI* aURI,
                                                    DeviceStorageFile* aFile,
-                                                   bool aEditable,
                                                    PRUint64 aSince)
   : DOMRequest(aWindow)
   , mOkToCallContinue(false)
   , mFile(aFile)
   , mURI(aURI)
-  , mEditable(aEditable)
   , mSince(aSince)
 {
 }
@@ -677,9 +681,8 @@ nsDOMDeviceStorageCursor::Continue()
 class PostResultEvent : public nsRunnable
 {
 public:
-  PostResultEvent(nsRefPtr<DOMRequest>& aRequest, bool aEditable, DeviceStorageFile* aFile)
-    : mEditable(aEditable)
-    , mFile(aFile)
+  PostResultEvent(nsRefPtr<DOMRequest>& aRequest, DeviceStorageFile* aFile)
+    : mFile(aFile)
     {
       mRequest.swap(aRequest);
     }
@@ -698,7 +701,7 @@ public:
 
     jsval result = JSVAL_NULL;
     if (mFile) {
-      result = nsIFileToJsval(mRequest->GetOwner(), mFile, mEditable);
+      result = nsIFileToJsval(mRequest->GetOwner(), mFile);
     } else {
       result = StringToJsval(mRequest->GetOwner(), mPath);
     }
@@ -709,7 +712,6 @@ public:
   }
 
 private:
-  bool mEditable;
   nsRefPtr<DeviceStorageFile> mFile;
   nsString mPath;
   nsRefPtr<DOMRequest> mRequest;
@@ -808,16 +810,12 @@ private:
   nsRefPtr<DeviceStorageFile> mFile;
   nsRefPtr<DOMRequest> mRequest;
 };
-
-
 class ReadFileEvent : public nsRunnable
 {
 public:
     ReadFileEvent(DeviceStorageFile* aFile,
-                  bool aEditable,
                   nsRefPtr<DOMRequest>& aRequest)
   : mFile(aFile)
-  , mEditable(aEditable)
     {
       mRequest.swap(aRequest);
     }
@@ -830,7 +828,7 @@ public:
 
     nsRefPtr<nsRunnable> r;
 
-    if (!mEditable) {
+    if (!mFile->mEditable) {
       bool check = false;
       mFile->mFile->Exists(&check);
       if (!check) {
@@ -839,7 +837,7 @@ public:
     }
 
     if (!r) {
-      r = new PostResultEvent(mRequest, mEditable, mFile);
+      r = new PostResultEvent(mRequest, mFile);
     }
     NS_DispatchToMainThread(r);
     return NS_OK;
@@ -847,7 +845,6 @@ public:
 
 private:
   nsRefPtr<DeviceStorageFile> mFile;
-  bool mEditable;
   nsRefPtr<DOMRequest> mRequest;
 };
 
@@ -902,14 +899,12 @@ public:
                          nsIURI *aURI,
                          DeviceStorageFile *aFile,
                          DOMRequest* aRequest,
-                         bool aEditable,
                          nsIDOMBlob *aBlob = nsnull)
         : mRequestType(aRequestType)
         , mWindow(aWindow)
         , mURI(aURI)
         , mFile(aFile)
         , mRequest(aRequest)
-        , mEditable(aEditable)
         , mBlob(aBlob) {}
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -982,7 +977,7 @@ public:
       }
       case DEVICE_STORAGE_REQUEST_READ:
       {
-        r = new ReadFileEvent(mFile, mEditable, mRequest);
+        r = new ReadFileEvent(mFile, mRequest);
         break;
       }
       case DEVICE_STORAGE_REQUEST_DELETE:
@@ -1007,7 +1002,6 @@ private:
   nsRefPtr<DeviceStorageFile> mFile;
 
   nsRefPtr<DOMRequest> mRequest;
-  bool mEditable;
   nsCOMPtr<nsIDOMBlob> mBlob;
 };
 
@@ -1165,7 +1159,7 @@ nsDOMDeviceStorage::AddNamed(nsIDOMBlob *aBlob,
   }
   else {
     r = new DeviceStorageRequest(DeviceStorageRequest::DEVICE_STORAGE_REQUEST_WRITE,
-                                 win, mURI, dsf, request, true, aBlob);
+                                 win, mURI, dsf, request, aBlob);
   }
   NS_DispatchToMainThread(r);
   return NS_OK;
@@ -1215,12 +1209,13 @@ nsDOMDeviceStorage::GetInternal(const JS::Value & aPath,
   }
 
   nsRefPtr<DeviceStorageFile> dsf = new DeviceStorageFile(mFile, path);
+  dsf->setEditable(aEditable);
 
   if (!dsf->isSafePath()) {
     r = new PostErrorEvent(request, POST_ERROR_EVENT_ILLEGAL_FILE_NAME, dsf);
   } else {
     r = new DeviceStorageRequest(DeviceStorageRequest::DEVICE_STORAGE_REQUEST_READ,
-                                 win, mURI, dsf, request, aEditable);
+                                 win, mURI, dsf, request);
   }
   NS_DispatchToMainThread(r);
   return NS_OK;
@@ -1255,7 +1250,7 @@ nsDOMDeviceStorage::Delete(const JS::Value & aPath, JSContext* aCx, nsIDOMDOMReq
   }
   else {
     r = new DeviceStorageRequest(DeviceStorageRequest::DEVICE_STORAGE_REQUEST_DELETE,
-                                 win, mURI, dsf, request, true);
+                                 win, mURI, dsf, request);
   }
   NS_DispatchToMainThread(r);
   return NS_OK;
@@ -1336,7 +1331,9 @@ nsDOMDeviceStorage::EnumerateInternal(const JS::Value & aName,
   }
   
   nsRefPtr<DeviceStorageFile> dsf = new DeviceStorageFile(mFile, path);
-  nsRefPtr<nsDOMDeviceStorageCursor> cursor = new nsDOMDeviceStorageCursor(win, mURI, dsf, aEditable, since);
+  dsf->setEditable(aEditable);
+
+  nsRefPtr<nsDOMDeviceStorageCursor> cursor = new nsDOMDeviceStorageCursor(win, mURI, dsf, since);
   nsRefPtr<DeviceStorageCursorRequest> r = new DeviceStorageCursorRequest(cursor);
 
   NS_ADDREF(*aRetval = cursor);

dom/devicestorage/test/Makefile.in

@@ -2,11 +2,11 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-DEPTH		= ../../../..
+DEPTH		= ../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
-relativesrcdir	= dom/tests/mochitest/devicestorage
+relativesrcdir	= dom/devicestorage/test/
 
 include $(DEPTH)/config/autoconf.mk
 

dom/interfaces/core/nsIDOMElement.idl

@@ -156,6 +156,12 @@ interface nsIDOMElement : nsIDOMNode
    */
   readonly attribute long             clientHeight;
 
+  /* The maximum offset that the element can be scrolled to
+     (i.e., the value that scrollLeft/scrollTop would be clamped to if they were
+     set to arbitrarily large values. */
+  readonly attribute long             scrollLeftMax;
+  readonly attribute long             scrollTopMax;
+
 
   // Selectors API
   /**

dom/interfaces/html/nsIDOMHTMLInputElement.idl

@@ -20,7 +20,7 @@ interface nsIDOMValidityState;
   * http://www.whatwg.org/specs/web-apps/current-work/
   */
 
-[scriptable, uuid(05FEDF7E-3050-4143-AB97-B994F3CC9329)]
+[scriptable, uuid(ac2e2b14-b987-452c-a071-5823b2406b85)]
 interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
 {
            attribute DOMString             accept;
@@ -40,6 +40,7 @@ interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
 
   readonly attribute nsIDOMFileList        files;
 
+           attribute unsigned long height;
            attribute boolean               indeterminate;
 
   readonly attribute nsIDOMHTMLElement     list;
@@ -56,6 +57,7 @@ interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
            attribute DOMString             align;
 
            attribute unsigned long         size;
+           attribute unsigned long width;
            attribute DOMString             src;
 
            attribute DOMString             type;

dom/ipc/ContentChild.cpp

@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
 #endif
 
@@ -218,7 +218,7 @@ ContentChild::Init(MessageLoop* aIOLoop,
                    base::ProcessHandle aParentHandle,
                    IPC::Channel* aChannel)
 {
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
     // sigh
     gtk_init(NULL, NULL);
 #endif

dom/ipc/ContentParent.cpp

@@ -507,6 +507,7 @@ ContentParent::RecvSetClipboardText(const nsString& text, const PRInt32& whichCl
     
     nsCOMPtr<nsITransferable> trans = do_CreateInstance("@mozilla.org/widget/transferable;1", &rv);
     NS_ENSURE_SUCCESS(rv, true);
+    trans->Init(nsnull);
     
     // If our data flavor has already been added, this will fail. But we don't care
     trans->AddDataFlavor(kUnicodeMime);
@@ -531,6 +532,7 @@ ContentParent::RecvGetClipboardText(const PRInt32& whichClipboard, nsString* tex
 
     nsCOMPtr<nsITransferable> trans = do_CreateInstance("@mozilla.org/widget/transferable;1", &rv);
     NS_ENSURE_SUCCESS(rv, true);
+    trans->Init(nsnull);
     
     clipboard->GetData(trans, whichClipboard);
     nsCOMPtr<nsISupports> tmp;

dom/plugins/base/nsNPAPIPlugin.cpp

@@ -56,11 +56,13 @@
 #endif
 
 // needed for nppdf plugin
-#ifdef MOZ_WIDGET_GTK2
+#if (MOZ_WIDGET_GTK)
 #include <gdk/gdk.h>
 #include <gdk/gdkx.h>
+#if (MOZ_WIDGET_GTK == 2)
 #include "gtk2xtbin.h"
 #endif
+#endif
 
 #ifdef XP_OS2
 #define INCL_DOS
@@ -2013,7 +2015,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 
   case NPNVToolkit: {
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
     *((NPNToolkitType*)result) = NPNVGtk2;
 #endif
 
@@ -2028,7 +2030,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 
   case NPNVSupportsXEmbedBool: {
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
     *(NPBool*)result = true;
 #elif defined(MOZ_WIDGET_QT)
     // Desktop Flash fail to initialize if browser does not support NPNVSupportsXEmbedBool
@@ -2055,7 +2057,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
 
   case NPNVSupportsWindowless: {
 #if defined(XP_WIN) || defined(XP_MACOSX) || \
-    (defined(MOZ_X11) && (defined(MOZ_WIDGET_GTK2) || defined(MOZ_WIDGET_QT)))
+    (defined(MOZ_X11) && (defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)))
     *(NPBool*)result = true;
 #else
     *(NPBool*)result = false;

dom/plugins/base/nsPluginInstanceOwner.cpp

@@ -734,7 +734,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetNetscapeWindow(void *value)
   }
 
   return rv;
-#elif (defined(MOZ_WIDGET_GTK2) || defined(MOZ_WIDGET_QT)) && defined(MOZ_X11)
+#elif (defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)) && defined(MOZ_X11)
   // X11 window managers want the toplevel window for WM_TRANSIENT_FOR.
   nsIWidget* win = mObjectFrame->GetNearestWidget();
   if (!win)
@@ -2432,7 +2432,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
         nsIntPoint rootPoint(-1,-1);
         if (widget)
           rootPoint = anEvent.refPoint + widget->WidgetToScreenOffset();
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
         Window root = GDK_ROOT_WINDOW();
 #elif defined(MOZ_WIDGET_QT)
         Window root = RootWindowOfScreen(DefaultScreenOfDisplay(mozilla::DefaultXDisplay()));
@@ -2520,7 +2520,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
       if (anEvent.pluginEvent)
         {
           XKeyEvent &event = pluginEvent.xkey;
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
           event.root = GDK_ROOT_WINDOW();
           event.time = anEvent.time;
           const GdkEventKey* gdkEvent =
@@ -3046,17 +3046,11 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
   aContext->Translate(pluginRect.TopLeft());
 
   Renderer renderer(window, this, pluginSize, pluginDirtyRect);
-#ifdef MOZ_WIDGET_GTK2
-  // This is the visual used by the widgets, 24-bit if available.
-  GdkVisual* gdkVisual = gdk_rgb_get_visual();
-  Visual* visual = gdk_x11_visual_get_xvisual(gdkVisual);
-  Screen* screen =
-    gdk_x11_screen_get_xscreen(gdk_visual_get_screen(gdkVisual));
-#else
+
   Display* dpy = mozilla::DefaultXDisplay();
   Screen* screen = DefaultScreenOfDisplay(dpy);
   Visual* visual = DefaultVisualOfScreen(screen);
-#endif
+
   renderer.Draw(aContext, nsIntSize(window->width, window->height),
                 rendererFlags, screen, visual, nsnull);
 }

dom/plugins/base/nsPluginNativeWindowGtk2.cpp

@@ -16,6 +16,7 @@
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
 
+#include "gtk2compat.h"
 #include "gtk2xtbin.h"
 
 class nsPluginNativeWindowGtk2 : public nsPluginNativeWindow {
@@ -147,8 +148,8 @@ nsresult nsPluginNativeWindowGtk2::CallSetWindow(nsRefPtr<nsNPAPIPluginInstance>
 
 nsresult nsPluginNativeWindowGtk2::CreateXEmbedWindow() {
   NS_ASSERTION(!mSocketWidget,"Already created a socket widget!");
-
-  GdkWindow *parent_win = gdk_window_lookup((XID)window);
+  GdkDisplay *display = gdk_display_get_default();
+  GdkWindow *parent_win = gdk_x11_window_lookup_for_display(display, (XID)window);
   mSocketWidget = gtk_socket_new();
 
   //attach the socket to the container widget
@@ -179,7 +180,10 @@ nsresult nsPluginNativeWindowGtk2::CreateXEmbedWindow() {
   // background and this would happen immediately (before the plug is
   // created).  Setting the background to None prevents the server from
   // painting this window, avoiding flicker.
-  gdk_window_set_back_pixmap(mSocketWidget->window, NULL, FALSE);
+  // TODO GTK3
+#if (MOZ_WIDGET_GTK == 2)
+  gdk_window_set_back_pixmap(gtk_widget_get_window(mSocketWidget), NULL, FALSE);
+#endif
 
   // Resize before we show
   SetAllocation();
@@ -196,10 +200,16 @@ nsresult nsPluginNativeWindowGtk2::CreateXEmbedWindow() {
     return NS_ERROR_FAILURE;
 
   mWsInfo.display = GDK_WINDOW_XDISPLAY(gdkWindow);
+#if (MOZ_WIDGET_GTK == 2)
   mWsInfo.colormap = GDK_COLORMAP_XCOLORMAP(gdk_drawable_get_colormap(gdkWindow));
   GdkVisual* gdkVisual = gdk_drawable_get_visual(gdkWindow);
-  mWsInfo.visual = GDK_VISUAL_XVISUAL(gdkVisual);
   mWsInfo.depth = gdkVisual->depth;
+#else
+  mWsInfo.colormap = None;
+  GdkVisual* gdkVisual = gdk_window_get_visual(gdkWindow);
+  mWsInfo.depth = gdk_visual_get_depth(gdkVisual);
+#endif
+  mWsInfo.visual = GDK_VISUAL_XVISUAL(gdkVisual);
     
   return NS_OK;
 }
@@ -223,7 +233,8 @@ nsresult nsPluginNativeWindowGtk2::CreateXtWindow() {
   printf("About to create new xtbin of %i X %i from %p...\n",
          width, height, (void*)window);
 #endif
-  GdkWindow *gdkWindow = gdk_window_lookup((XID)window);
+  GdkDisplay *display = gdk_display_get_default();
+  GdkWindow *gdkWindow = gdk_x11_window_lookup_for_display(display, (XID)window);
   mSocketWidget = gtk_xtbin_new(gdkWindow, 0);
   // Check to see if creating the xtbin failed for some reason.
   // if it did, we can't go any further.
@@ -270,8 +281,9 @@ socket_unrealize_cb(GtkWidget *widget, gpointer data)
 {
   // Unmap and reparent any child windows that GDK does not yet know about.
   // (See bug 540114 comment 10.)
-  GdkWindow* socket_window = widget->window;
-  Display* display = GDK_DISPLAY();
+  GdkWindow* socket_window =  gtk_widget_get_window(widget);
+  GdkDisplay* gdkDisplay = gdk_display_get_default();
+  Display* display = GDK_DISPLAY_XDISPLAY(gdkDisplay);
 
   // Ignore X errors that may happen if windows get destroyed (possibly
   // requested by the plugin) between XQueryTree and when we operate on them.
@@ -280,13 +292,13 @@ socket_unrealize_cb(GtkWidget *widget, gpointer data)
   Window root, parent;
   Window* children;
   unsigned int nchildren;
-  if (!XQueryTree(display, gdk_x11_drawable_get_xid(socket_window),
+  if (!XQueryTree(display, gdk_x11_window_get_xid(socket_window),
                   &root, &parent, &children, &nchildren))
     return;
 
   for (unsigned int i = 0; i < nchildren; ++i) {
     Window child = children[i];
-    if (!gdk_window_lookup(child)) {
+    if (!gdk_x11_window_lookup_for_display(gdkDisplay, child)) {
       // This window is not known to GDK.
       XUnmapWindow(display, child);
       XReparentWindow(display, child, DefaultRootWindow(display), 0, 0);

dom/plugins/ipc/PluginInstanceChild.cpp

@@ -44,9 +44,12 @@ using mozilla::ipc::ProcessChild;
 using namespace mozilla::plugins;
 using namespace std;
 
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
 
 #include <gtk/gtk.h>
+#if (MOZ_WIDGET_GTK == 3)
+#include <gtk/gtkx.h>
+#endif
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
 #include "gtk2xtbin.h"

dom/plugins/ipc/PluginInstanceParent.cpp

@@ -36,7 +36,7 @@ extern const PRUnichar* kOOPPPluginFocusEventId;
 UINT gOOPPPluginFocusEvent =
     RegisterWindowMessage(kOOPPPluginFocusEventId);
 extern const PRUnichar* kFlashFullscreenClass;
-#elif defined(MOZ_WIDGET_GTK2)
+#elif defined(MOZ_WIDGET_GTK)
 #include <gdk/gdk.h>
 #elif defined(XP_MACOSX)
 #include <ApplicationServices/ApplicationServices.h>
@@ -1268,7 +1268,7 @@ PluginInstanceParent::NPP_HandleEvent(void* event)
         // Release any active pointer grab so that the plugin X client can
         // grab the pointer if it wishes.
         Display *dpy = DefaultXDisplay();
-#  ifdef MOZ_WIDGET_GTK2
+#  ifdef MOZ_WIDGET_GTK
         // GDK attempts to (asynchronously) track whether there is an active
         // grab so ungrab through GDK.
         gdk_pointer_ungrab(npevent->xbutton.time);

dom/plugins/ipc/PluginModuleChild.cpp

@@ -17,8 +17,12 @@
 
 #include "mozilla/ipc/SyncChannel.h"
 
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
+#if (MOZ_WIDGET_GTK == 3)
+#include <gtk/gtkx.h>
+#endif
+#include "gtk2compat.h"
 #endif
 
 #include "nsIFile.h"
@@ -90,7 +94,7 @@ PluginModuleChild::PluginModuleChild()
   , mInitializeFunc(0)
 #if defined(OS_WIN) || defined(OS_MACOSX)
   , mGetEntryPointsFunc(0)
-#elif defined(MOZ_WIDGET_GTK2)
+#elif defined(MOZ_WIDGET_GTK)
   , mNestedLoopTimerId(0)
 #elif defined(MOZ_WIDGET_QT)
   , mNestedLoopTimerObject(0)
@@ -229,7 +233,7 @@ PluginModuleChild::Init(const std::string& aPluginFilename,
     return true;
 }
 
-#if defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_WIDGET_GTK)
 typedef void (*GObjectDisposeFn)(GObject*);
 typedef gboolean (*GtkWidgetScrollEventFn)(GtkWidget*, GdkEventScroll*);
 typedef void (*GtkPlugEmbeddedFn)(GtkPlug*);
@@ -269,16 +273,16 @@ wrap_gtk_plug_dispose(GObject* object) {
 static gboolean
 gtk_plug_scroll_event(GtkWidget *widget, GdkEventScroll *gdk_event)
 {
-    if (!GTK_WIDGET_TOPLEVEL(widget)) // in same process as its GtkSocket
+    if (!gtk_widget_is_toplevel(widget)) // in same process as its GtkSocket
         return FALSE; // event not handled; propagate to GtkSocket
 
-    GdkWindow* socket_window = GTK_PLUG(widget)->socket_window;
+    GdkWindow* socket_window = gtk_plug_get_socket_window(GTK_PLUG(widget));
     if (!socket_window)
         return FALSE;
 
     // Propagate the event to the embedder.
-    GdkScreen* screen = gdk_drawable_get_screen(socket_window);
-    GdkWindow* plug_window = widget->window;
+    GdkScreen* screen = gdk_window_get_screen(socket_window);
+    GdkWindow* plug_window = gtk_widget_get_window(widget);
     GdkWindow* event_window = gdk_event->window;
     gint x = gdk_event->x;
     gint y = gdk_event->y;
@@ -324,9 +328,9 @@ gtk_plug_scroll_event(GtkWidget *widget, GdkEventScroll *gdk_event)
 
     memset(&xevent, 0, sizeof(xevent));
     xevent.xbutton.type = ButtonPress;
-    xevent.xbutton.window = GDK_WINDOW_XWINDOW(socket_window);
-    xevent.xbutton.root = GDK_WINDOW_XWINDOW(gdk_screen_get_root_window(screen));
-    xevent.xbutton.subwindow = GDK_WINDOW_XWINDOW(plug_window);
+    xevent.xbutton.window = gdk_x11_window_get_xid(socket_window);
+    xevent.xbutton.root = gdk_x11_window_get_xid(gdk_screen_get_root_window(screen));
+    xevent.xbutton.subwindow = gdk_x11_window_get_xid(plug_window);
     xevent.xbutton.time = gdk_event->time;
     xevent.xbutton.x = x;
     xevent.xbutton.y = y;
@@ -354,7 +358,7 @@ gtk_plug_scroll_event(GtkWidget *widget, GdkEventScroll *gdk_event)
 
 static void
 wrap_gtk_plug_embedded(GtkPlug* plug) {
-    GdkWindow* socket_window = plug->socket_window;
+    GdkWindow* socket_window = gtk_plug_get_socket_window(plug);
     if (socket_window) {
         if (gtk_check_version(2,18,7) != NULL // older
             && g_object_get_data(G_OBJECT(socket_window),
@@ -497,7 +501,7 @@ PluginModuleChild::ShouldContinueFromReplyTimeout()
 bool
 PluginModuleChild::InitGraphics()
 {
-#if defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_WIDGET_GTK)
     // Work around plugins that don't interact well with GDK
     // client-side windows.
     PR_SetEnv("GDK_NATIVE_WINDOWS=1");
@@ -1072,7 +1076,7 @@ _getvalue(NPP aNPP,
     switch (aVariable) {
         // Copied from nsNPAPIPlugin.cpp
         case NPNVToolkit:
-#if defined(MOZ_WIDGET_GTK2) || defined(MOZ_WIDGET_QT)
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)
             *static_cast<NPNToolkitType*>(aValue) = NPNVGtk2;
             return NPERR_NO_ERROR;
 #endif

dom/plugins/ipc/PluginModuleChild.h

@@ -306,7 +306,7 @@ private:
     void InitQuirksModes(const nsCString& aMimeType);
     bool InitGraphics();
     void DeinitGraphics();
-#if defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_WIDGET_GTK)
     static gboolean DetectNestedEventLoop(gpointer data);
     static gboolean ProcessBrowserEvents(gpointer data);
 
@@ -340,7 +340,7 @@ private:
     NPPluginFuncs mFunctions;
     NPSavedData mSavedData;
 
-#if defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_WIDGET_GTK)
     // If a plugin spins a nested glib event loop in response to a
     // synchronous IPC message from the browser, the loop might break
     // only after the browser responds to a request sent by the

dom/plugins/ipc/PluginModuleParent.cpp

@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifdef MOZ_WIDGET_GTK2
+#ifdef MOZ_WIDGET_GTK
 #include <glib.h>
 #elif XP_MACOSX
 #include "PluginInterposeOSX.h"
@@ -964,7 +964,7 @@ PluginModuleParent::AnswerProcessSomeEvents()
     return true;
 }
 
-#elif !defined(MOZ_WIDGET_GTK2)
+#elif !defined(MOZ_WIDGET_GTK)
 bool
 PluginModuleParent::AnswerProcessSomeEvents()
 {

dom/plugins/test/testplugin/nptest.cpp

@@ -3221,7 +3221,7 @@ hangPlugin(NPObject* npobj, const NPVariant* args, uint32_t argCount,
   return true;
 }
 
-#if defined(MOZ_WIDGET_GTK2)
+#if defined(MOZ_WIDGET_GTK)
 bool
 getClipboardText(NPObject* npobj, const NPVariant* args, uint32_t argCount,
                  NPVariant* result)

dom/system/OSFileConstants.cpp

@@ -202,6 +202,19 @@ static dom::ConstantSpec gLibcProperties[] =
 #endif // defined(EWOULDBLOCK)
   INT_CONSTANT(EXDEV),
 
+  // Constants used to define data structures
+  //
+  // Many data structures have different fields/sizes/etc. on
+  // various OSes / versions of the same OS / platforms. For these
+  // data structures, we need to compute and export from C the size
+  // and, if necessary, the offset of fields, so as to be able to
+  // define the structure in JS.
+
+#if defined(XP_UNIX)
+  // The size of |mode_t|.
+  {"OSFILE_SIZEOF_MODE_T", INT_TO_JSVAL(sizeof (mode_t)) },
+#endif // defined(XP_UNIX)
+
   PROP_END
 };
 
@@ -349,7 +362,7 @@ bool DefineOSFileConstants(JSContext *cx, JSObject *global)
     }
 
     jsval valVersion = STRING_TO_JSVAL(strVersion);
-    if (!JS_SetProperty(cx, objSys, "Version", &valVersion)) {
+    if (!JS_SetProperty(cx, objSys, "Name", &valVersion)) {
       return false;
     }
   }

dom/tests/mochitest/Makefile.in

@@ -18,7 +18,6 @@ DIRS	+= \
 	ajax \
 	bugs \
 	chrome \
-	devicestorage \
 	general \
 	whatwg \
 	geolocation \

dom/tests/mochitest/general/test_clipboard_events.html

@@ -74,10 +74,17 @@ window.onfocus = function()
 SimpleTest.waitForExplicitFinish();
 window.focus();
 
+function getLoadContext() {
+  return window.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+               .getInterface(Components.interfaces.nsIWebNavigation)
+               .QueryInterface(Components.interfaces.nsILoadContext);
+}
+
 function getClipboardText() {
   var trans = Components.classes["@mozilla.org/widget/transferable;1"]
     .createInstance();
   trans = trans.QueryInterface(Components.interfaces.nsITransferable);
+  trans.init(getLoadContext());
   trans.addDataFlavor("text/unicode");
   
   var clipboard = Components.classes["@mozilla.org/widget/clipboard;1"]

editor/libeditor/base/DeleteRangeTxn.cpp

@@ -4,33 +4,21 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "DeleteRangeTxn.h"
-#include "nsIDOMRange.h"
-#include "nsIDOMNodeList.h"
 #include "DeleteTextTxn.h"
 #include "DeleteElementTxn.h"
 #include "nsIContentIterator.h"
-#include "nsIContent.h"
 #include "nsComponentManagerUtils.h"
 
 #include "mozilla/Util.h"
 
 using namespace mozilla;
 
-#ifdef DEBUG
-static bool gNoisy = false;
-#endif
-
 // note that aEditor is not refcounted
 DeleteRangeTxn::DeleteRangeTxn()
-: EditAggregateTxn()
-,mRange()
-,mStartParent()
-,mStartOffset(0)
-,mEndParent()
-,mCommonParent()
-,mEndOffset(0)
-,mEditor(nsnull)
-,mRangeUpdater(nsnull)
+  : EditAggregateTxn(),
+    mRange(),
+    mEditor(nsnull),
+    mRangeUpdater(nsnull)
 {
 }
 
@@ -39,264 +27,203 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(DeleteRangeTxn)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(DeleteRangeTxn,
                                                 EditAggregateTxn)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mRange)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mStartParent)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEndParent)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mCommonParent)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(DeleteRangeTxn,
                                                   EditAggregateTxn)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mRange)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mStartParent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mEndParent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mCommonParent)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mRange, nsIDOMRange)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DeleteRangeTxn)
 NS_INTERFACE_MAP_END_INHERITING(EditAggregateTxn)
 
-NS_IMETHODIMP DeleteRangeTxn::Init(nsEditor *aEditor,
-                                   nsIDOMRange *aRange,
-                                   nsRangeUpdater *aRangeUpdater)
+nsresult
+DeleteRangeTxn::Init(nsEditor* aEditor,
+                     nsRange* aRange,
+                     nsRangeUpdater* aRangeUpdater)
 {
-  NS_ASSERTION(aEditor && aRange, "bad state");
-  if (!aEditor || !aRange) { return NS_ERROR_NOT_INITIALIZED; }
+  MOZ_ASSERT(aEditor && aRange);
 
   mEditor = aEditor;
-  mRange  = do_QueryInterface(aRange);
+  mRange = aRange->CloneRange();
   mRangeUpdater = aRangeUpdater;
 
-  DebugOnly<nsresult> result = aRange->GetStartContainer(getter_AddRefs(mStartParent));
-  NS_ASSERTION((NS_SUCCEEDED(result)), "GetStartParent failed.");
-  result = aRange->GetEndContainer(getter_AddRefs(mEndParent));
-  NS_ASSERTION((NS_SUCCEEDED(result)), "GetEndParent failed.");
-  result = aRange->GetStartOffset(&mStartOffset);
-  NS_ASSERTION((NS_SUCCEEDED(result)), "GetStartOffset failed.");
-  result = aRange->GetEndOffset(&mEndOffset);
-  NS_ASSERTION((NS_SUCCEEDED(result)), "GetEndOffset failed.");
-  result = aRange->GetCommonAncestorContainer(getter_AddRefs(mCommonParent));
-  NS_ASSERTION((NS_SUCCEEDED(result)), "GetCommonParent failed.");
-
-  if (!mEditor->IsModifiableNode(mStartParent)) {
-    return NS_ERROR_FAILURE;
-  }
-
-  if (mStartParent!=mEndParent &&
-      (!mEditor->IsModifiableNode(mEndParent) ||
-       !mEditor->IsModifiableNode(mCommonParent)))
-  {
-      return NS_ERROR_FAILURE;
-  }
-
-#ifdef DEBUG
-  {
-    nsCOMPtr<nsINode> start = do_QueryInterface(mStartParent);
-    MOZ_ASSERT(start);
-    NS_ASSERTION(mStartOffset <= PRInt32(start->Length()), "bad start offset");
-
-    nsCOMPtr<nsINode> end = do_QueryInterface(mEndParent);
-    MOZ_ASSERT(end);
-    NS_ASSERTION(mEndOffset <= PRInt32(end->Length()), "bad end offset");
-
-    if (gNoisy) {
-      printf ("DeleteRange: %d of %p to %d of %p\n", 
-               mStartOffset, (void *)mStartParent, mEndOffset, (void *)mEndParent);
-    }         
-  }
-#endif // DEBUG
+  NS_ENSURE_TRUE(mEditor->IsModifiableNode(mRange->GetStartParent()),
+                 NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mEditor->IsModifiableNode(mRange->GetEndParent()),
+                 NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mEditor->IsModifiableNode(mRange->GetCommonAncestor()),
+                 NS_ERROR_FAILURE);
 
   return NS_OK;
 }
 
-NS_IMETHODIMP DeleteRangeTxn::DoTransaction(void)
+NS_IMETHODIMP
+DeleteRangeTxn::DoTransaction()
 {
-#ifdef DEBUG
-  if (gNoisy) { printf("Do Delete Range\n"); }
-#endif
+  MOZ_ASSERT(mRange && mEditor);
+  nsresult res;
 
-  NS_ENSURE_TRUE(mStartParent && mEndParent && mCommonParent && mEditor, NS_ERROR_NOT_INITIALIZED);
-
-  nsresult result; 
   // build the child transactions
+  nsCOMPtr<nsINode> startParent = mRange->GetStartParent();
+  PRInt32 startOffset = mRange->StartOffset();
+  nsCOMPtr<nsINode> endParent = mRange->GetEndParent();
+  PRInt32 endOffset = mRange->EndOffset();
+  MOZ_ASSERT(startParent && endParent);
 
-  if (mStartParent==mEndParent)
-  { // the selection begins and ends in the same node
-    result = CreateTxnsToDeleteBetween(mStartParent, mStartOffset, mEndOffset);
-  }
-  else
-  { // the selection ends in a different node from where it started
-    // delete the relevant content in the start node
-    result = CreateTxnsToDeleteContent(mStartParent, mStartOffset, nsIEditor::eNext);
-    if (NS_SUCCEEDED(result))
-    {
-      // delete the intervening nodes
-      result = CreateTxnsToDeleteNodesBetween();
-      if (NS_SUCCEEDED(result))
-      {
-        // delete the relevant content in the end node
-        result = CreateTxnsToDeleteContent(mEndParent, mEndOffset, nsIEditor::ePrevious);
-      }
-    }
+  if (startParent == endParent) {
+    // the selection begins and ends in the same node
+    res = CreateTxnsToDeleteBetween(startParent, startOffset, endOffset);
+    NS_ENSURE_SUCCESS(res, res);
+  } else {
+    // the selection ends in a different node from where it started.  delete
+    // the relevant content in the start node
+    res = CreateTxnsToDeleteContent(startParent, startOffset, nsIEditor::eNext);
+    NS_ENSURE_SUCCESS(res, res);
+    // delete the intervening nodes
+    res = CreateTxnsToDeleteNodesBetween();
+    NS_ENSURE_SUCCESS(res, res);
+    // delete the relevant content in the end node
+    res = CreateTxnsToDeleteContent(endParent, endOffset, nsIEditor::ePrevious);
+    NS_ENSURE_SUCCESS(res, res);
   }
 
   // if we've successfully built this aggregate transaction, then do it.
-  if (NS_SUCCEEDED(result)) {
-    result = EditAggregateTxn::DoTransaction();
-  }
-
-  NS_ENSURE_SUCCESS(result, result);
+  res = EditAggregateTxn::DoTransaction();
+  NS_ENSURE_SUCCESS(res, res);
 
   // only set selection to deletion point if editor gives permission
   bool bAdjustSelection;
   mEditor->ShouldTxnSetSelection(&bAdjustSelection);
-  if (bAdjustSelection)
-  {
-    nsCOMPtr<nsISelection> selection;
-    result = mEditor->GetSelection(getter_AddRefs(selection));
-    // At this point, it is possible that the frame for our root element
-    // might have been destroyed, in which case, the above call returns
-    // an error.  We eat that error here intentionally.  See bug 574558
-    // for a sample case where this happens.
-    NS_ENSURE_SUCCESS(result, NS_OK);
+  if (bAdjustSelection) {
+    nsRefPtr<Selection> selection = mEditor->GetSelection();
     NS_ENSURE_TRUE(selection, NS_ERROR_NULL_POINTER);
-    result = selection->Collapse(mStartParent, mStartOffset);
-  }
-  else
-  {
-    // do nothing - dom range gravity will adjust selection
+    res = selection->Collapse(startParent, startOffset);
+    NS_ENSURE_SUCCESS(res, res);
   }
+  // else do nothing - dom range gravity will adjust selection
 
-  return result;
+  return NS_OK;
 }
 
-NS_IMETHODIMP DeleteRangeTxn::UndoTransaction(void)
+NS_IMETHODIMP
+DeleteRangeTxn::UndoTransaction()
 {
-#ifdef DEBUG
-  if (gNoisy) { printf("Undo Delete Range\n"); }
-#endif
-
-  NS_ENSURE_TRUE(mStartParent && mEndParent && mCommonParent && mEditor, NS_ERROR_NOT_INITIALIZED);
+  MOZ_ASSERT(mRange && mEditor);
 
   return EditAggregateTxn::UndoTransaction();
 }
 
-NS_IMETHODIMP DeleteRangeTxn::RedoTransaction(void)
+NS_IMETHODIMP
+DeleteRangeTxn::RedoTransaction()
 {
-#ifdef DEBUG
-  if (gNoisy) { printf("Redo Delete Range\n"); }
-#endif
-
-  NS_ENSURE_TRUE(mStartParent && mEndParent && mCommonParent && mEditor, NS_ERROR_NOT_INITIALIZED);
+  MOZ_ASSERT(mRange && mEditor);
 
   return EditAggregateTxn::RedoTransaction();
 }
 
-NS_IMETHODIMP DeleteRangeTxn::GetTxnDescription(nsAString& aString)
+NS_IMETHODIMP
+DeleteRangeTxn::GetTxnDescription(nsAString& aString)
 {
   aString.AssignLiteral("DeleteRangeTxn");
   return NS_OK;
 }
 
-NS_IMETHODIMP 
-DeleteRangeTxn::CreateTxnsToDeleteBetween(nsIDOMNode *aStartParent, 
-                                          PRUint32    aStartOffset, 
-                                          PRUint32    aEndOffset)
+nsresult
+DeleteRangeTxn::CreateTxnsToDeleteBetween(nsINode* aNode,
+                                          PRInt32 aStartOffset,
+                                          PRInt32 aEndOffset)
 {
   // see what kind of node we have
-  nsCOMPtr<nsIDOMCharacterData> textNode = do_QueryInterface(aStartParent);
-  if (textNode) {
-    // if the node is a text node, then delete text content
+  if (aNode->IsNodeOfType(nsINode::eDATA_NODE)) {
+    // if the node is a chardata node, then delete chardata content
     nsRefPtr<DeleteTextTxn> txn = new DeleteTextTxn();
 
     PRInt32 numToDel;
-    if (aStartOffset==aEndOffset)
+    if (aStartOffset == aEndOffset) {
       numToDel = 1;
-    else
-      numToDel = aEndOffset-aStartOffset;
+    } else {
+      numToDel = aEndOffset - aStartOffset;
+    }
 
-    nsresult rv = txn->Init(mEditor, textNode, aStartOffset, numToDel, mRangeUpdater);
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDOMCharacterData> charDataNode = do_QueryInterface(aNode);
+    nsresult res = txn->Init(mEditor, charDataNode, aStartOffset, numToDel,
+                             mRangeUpdater);
+    NS_ENSURE_SUCCESS(res, res);
 
     AppendChild(txn);
     return NS_OK;
   }
 
-  nsCOMPtr<nsINode> startParent = do_QueryInterface(aStartParent);
-  NS_ENSURE_STATE(startParent);
-  NS_ASSERTION(aEndOffset <= startParent->GetChildCount(), "bad aEndOffset");
-
-  nsCOMPtr<nsIContent> child = startParent->GetChildAt(aStartOffset);
+  nsCOMPtr<nsIContent> child = aNode->GetChildAt(aStartOffset);
   NS_ENSURE_STATE(child);
 
-  nsresult result = NS_OK;
-  for (PRUint32 i = aStartOffset; i < aEndOffset; ++i) {
+  nsresult res = NS_OK;
+  for (PRInt32 i = aStartOffset; i < aEndOffset; ++i) {
     nsRefPtr<DeleteElementTxn> txn = new DeleteElementTxn();
-    result = txn->Init(mEditor, child->AsDOMNode(), mRangeUpdater);
-    if (NS_SUCCEEDED(result))
+    res = txn->Init(mEditor, child->AsDOMNode(), mRangeUpdater);
+    if (NS_SUCCEEDED(res)) {
       AppendChild(txn);
+    }
 
     child = child->GetNextSibling();
   }
-  return result;
+
+  NS_ENSURE_SUCCESS(res, res);
+  return NS_OK;
 }
 
-NS_IMETHODIMP DeleteRangeTxn::CreateTxnsToDeleteContent(nsIDOMNode *aParent, 
-                                                        PRUint32    aOffset, 
-                                                        nsIEditor::EDirection aAction)
+nsresult
+DeleteRangeTxn::CreateTxnsToDeleteContent(nsINode* aNode,
+                                          PRInt32 aOffset,
+                                          nsIEditor::EDirection aAction)
 {
-  nsresult result = NS_OK;
   // see what kind of node we have
-  nsCOMPtr<nsIDOMCharacterData> textNode = do_QueryInterface(aParent);
-  if (textNode)
-  { // if the node is a text node, then delete text content
+  if (aNode->IsNodeOfType(nsINode::eDATA_NODE)) {
+    // if the node is a chardata node, then delete chardata content
     PRUint32 start, numToDelete;
-    if (nsIEditor::eNext == aAction)
-    {
-      start=aOffset;
-      textNode->GetLength(&numToDelete);
-      numToDelete -= aOffset;
-    }
-    else
-    {
-      start=0;
-      numToDelete=aOffset;
+    if (nsIEditor::eNext == aAction) {
+      start = aOffset;
+      numToDelete = aNode->Length() - aOffset;
+    } else {
+      start = 0;
+      numToDelete = aOffset;
     }
 
-    if (numToDelete)
-    {
+    if (numToDelete) {
       nsRefPtr<DeleteTextTxn> txn = new DeleteTextTxn();
-      NS_ENSURE_TRUE(txn, NS_ERROR_OUT_OF_MEMORY);
 
-      result = txn->Init(mEditor, textNode, start, numToDelete, mRangeUpdater);
-      if (NS_SUCCEEDED(result))
-        AppendChild(txn);
+      nsCOMPtr<nsIDOMCharacterData> charDataNode = do_QueryInterface(aNode);
+      nsresult res = txn->Init(mEditor, charDataNode, start, numToDelete,
+                               mRangeUpdater);
+      NS_ENSURE_SUCCESS(res, res);
+
+      AppendChild(txn);
     }
   }
 
-  return result;
+  return NS_OK;
 }
 
-NS_IMETHODIMP DeleteRangeTxn::CreateTxnsToDeleteNodesBetween()
+nsresult
+DeleteRangeTxn::CreateTxnsToDeleteNodesBetween()
 {
-  nsCOMPtr<nsIContentIterator> iter = do_CreateInstance("@mozilla.org/content/subtree-content-iterator;1");
-  NS_ENSURE_TRUE(iter, NS_ERROR_NULL_POINTER);
+  nsCOMPtr<nsIContentIterator> iter = NS_NewContentSubtreeIterator();
 
-  nsresult result = iter->Init(mRange);
-  NS_ENSURE_SUCCESS(result, result);
+  nsresult res = iter->Init(mRange);
+  NS_ENSURE_SUCCESS(res, res);
 
-  while (!iter->IsDone() && NS_SUCCEEDED(result))
-  {
-    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(iter->GetCurrentNode());
+  while (!iter->IsDone()) {
+    nsCOMPtr<nsINode> node = iter->GetCurrentNode();
     NS_ENSURE_TRUE(node, NS_ERROR_NULL_POINTER);
 
     nsRefPtr<DeleteElementTxn> txn = new DeleteElementTxn();
-    NS_ENSURE_TRUE(txn, NS_ERROR_OUT_OF_MEMORY);
 
-    result = txn->Init(mEditor, node, mRangeUpdater);
-    if (NS_SUCCEEDED(result))
-      AppendChild(txn);
+    res = txn->Init(mEditor, node->AsDOMNode(), mRangeUpdater);
+    NS_ENSURE_SUCCESS(res, res);
+    AppendChild(txn);
+
     iter->Next();
   }
-  return result;
+  return NS_OK;
 }
-

editor/libeditor/base/DeleteRangeTxn.h

@@ -7,12 +7,10 @@
 #define DeleteRangeTxn_h__
 
 #include "EditAggregateTxn.h"
-#include "nsIDOMNode.h"
-#include "nsIDOMRange.h"
+#include "nsRange.h"
 #include "nsEditor.h"
 #include "nsCOMPtr.h"
 
-class nsIDOMRange;
 class nsRangeUpdater;
 
 /**
@@ -25,9 +23,9 @@ public:
     * @param aEditor the object providing basic editing operations
     * @param aRange  the range to delete
     */
-  NS_IMETHOD Init(nsEditor *aEditor,
-                  nsIDOMRange *aRange,
-                  nsRangeUpdater *aRangeUpdater);
+  nsresult Init(nsEditor* aEditor,
+                nsRange* aRange,
+                nsRangeUpdater* aRangeUpdater);
 
   DeleteRangeTxn();
 
@@ -40,41 +38,26 @@ public:
 
 protected:
 
-  NS_IMETHOD CreateTxnsToDeleteBetween(nsIDOMNode *aStartParent, 
-                                             PRUint32    aStartOffset, 
-                                             PRUint32    aEndOffset);
+  nsresult CreateTxnsToDeleteBetween(nsINode* aNode,
+                                     PRInt32 aStartOffset,
+                                     PRInt32 aEndOffset);
 
-  NS_IMETHOD CreateTxnsToDeleteNodesBetween();
+  nsresult CreateTxnsToDeleteNodesBetween();
 
-  NS_IMETHOD CreateTxnsToDeleteContent(nsIDOMNode *aParent, 
-                                             PRUint32 aOffset, 
-                                             nsIEditor::EDirection aAction);
+  nsresult CreateTxnsToDeleteContent(nsINode* aParent,
+                                     PRInt32 aOffset,
+                                     nsIEditor::EDirection aAction);
 
 protected:
 
   /** p1 in the range */
-  nsCOMPtr<nsIDOMRange> mRange;			// is this really an owning ptr?
-
-  /** p1 in the range */
-  nsCOMPtr<nsIDOMNode> mStartParent;
-
-  /** p1 offset */
-  PRInt32 mStartOffset;
-
-  /** p2 in the range */
-  nsCOMPtr<nsIDOMNode> mEndParent;
-
-  /** the closest common parent of p1 and p2 */
-  nsCOMPtr<nsIDOMNode> mCommonParent;
-
-  /** p2 offset */
-  PRInt32 mEndOffset;
+  nsRefPtr<nsRange> mRange;
 
   /** the editor for this transaction */
   nsEditor* mEditor;
 
   /** range updater object */
-  nsRangeUpdater *mRangeUpdater;
+  nsRangeUpdater* mRangeUpdater;
 };
 
 #endif

editor/libeditor/base/crashtests/766845.xhtml

@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  window.getSelection().removeAllRanges();
+  var r1 = document.createRange();
+  r1.setStart(document.body, 0);
+  r1.setEnd  (document.body, 1);
+  window.getSelection().addRange(r1);
+  var r2 = document.createRange();
+  r2.setStart(document.body, 1);
+  r2.setEnd  (document.body, 2);
+  window.getSelection().addRange(r2);
+  if (document.queryCommandEnabled("inserthtml"))
+    document.execCommand("inserthtml", false, "1");
+}
+
+]]>
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"><div></div><div></div></body>
+
+</html>

editor/libeditor/base/crashtests/crashtests.list

@@ -13,3 +13,4 @@ load 713427-2.xhtml
 load 762183.html
 load 766360.html
 load 766413.html
+load 766845.xhtml

editor/libeditor/html/nsHTMLDataTransfer.cpp

@@ -93,6 +93,7 @@
 #include "nsContentUtils.h"
 #include "mozilla/Preferences.h"
 #include "nsIParserUtils.h"
+#include "nsILoadContext.h"
 
 using namespace mozilla;
 
@@ -985,6 +986,10 @@ NS_IMETHODIMP nsHTMLEditor::PrepareHTMLTransferable(nsITransferable **aTransfera
   // Get the nsITransferable interface for getting the data from the clipboard
   if (aTransferable)
   {
+    nsCOMPtr<nsIDocument> destdoc = GetDocument();
+    nsILoadContext* loadContext = destdoc ? destdoc->GetLoadContext() : nsnull;
+    (*aTransferable)->Init(loadContext);
+
     // Create the desired DataFlavor for the type of data
     // we want to get out of the transferable
     // This should only happen in html editors, not plaintext
@@ -1535,6 +1540,7 @@ NS_IMETHODIMP nsHTMLEditor::Paste(PRInt32 aSelectionType)
     nsCOMPtr<nsITransferable> contextTrans =
                   do_CreateInstance("@mozilla.org/widget/transferable;1");
     NS_ENSURE_TRUE(contextTrans, NS_ERROR_NULL_POINTER);
+    contextTrans->Init(nsnull);
     contextTrans->AddDataFlavor(kHTMLContext);
     clipboard->GetData(contextTrans, aSelectionType);
     contextTrans->GetTransferData(kHTMLContext, getter_AddRefs(contextDataObj), &contextLen);
@@ -1542,6 +1548,7 @@ NS_IMETHODIMP nsHTMLEditor::Paste(PRInt32 aSelectionType)
     nsCOMPtr<nsITransferable> infoTrans =
                   do_CreateInstance("@mozilla.org/widget/transferable;1");
     NS_ENSURE_TRUE(infoTrans, NS_ERROR_NULL_POINTER);
+    infoTrans->Init(nsnull);
     infoTrans->AddDataFlavor(kHTMLInfo);
     clipboard->GetData(infoTrans, aSelectionType);
     infoTrans->GetTransferData(kHTMLInfo, getter_AddRefs(infoDataObj), &infoLen);
@@ -1775,6 +1782,10 @@ NS_IMETHODIMP nsHTMLEditor::PasteAsPlaintextQuotation(PRInt32 aSelectionType)
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(trans, NS_ERROR_FAILURE);
 
+  nsCOMPtr<nsIDocument> destdoc = GetDocument();
+  nsILoadContext* loadContext = destdoc ? destdoc->GetLoadContext() : nsnull;
+  trans->Init(loadContext);
+
   // We only handle plaintext pastes here
   trans->AddDataFlavor(kUnicodeMime);
 

editor/libeditor/html/tests/test_CF_HTML_clipboard.html

@@ -27,6 +27,12 @@ function copyCF_HTML(cfhtml, success, failure) {
   const Ci = Components.interfaces;
   const CF_HTML = "application/x-moz-nativehtml";
 
+  function getLoadContext() {
+    return window.QueryInterface(Ci.nsIInterfaceRequestor)
+                 .getInterface(Ci.nsIWebNavigation)
+                 .QueryInterface(Ci.nsILoadContext);
+  }
+
   var cb = Cc["@mozilla.org/widget/clipboard;1"].
            getService(Ci.nsIClipboard);
 
@@ -47,6 +53,7 @@ function copyCF_HTML(cfhtml, success, failure) {
 
     var trans = Cc["@mozilla.org/widget/transferable;1"].
                 createInstance(Ci.nsITransferable);
+    trans.init(getLoadContext());
     trans.addDataFlavor(CF_HTML);
     cb.getData(trans, cb.kGlobalClipboard);
     var data = {};
@@ -62,6 +69,7 @@ function copyCF_HTML(cfhtml, success, failure) {
 
   var trans = Cc["@mozilla.org/widget/transferable;1"].
               createInstance(Ci.nsITransferable);
+  trans.init(getLoadContext());
   trans.addDataFlavor(CF_HTML);
   var data = Cc["@mozilla.org/supports-cstring;1"].
              createInstance(Ci.nsISupportsCString);

editor/libeditor/html/tests/test_bug489202.xul

@@ -33,11 +33,18 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=489202
   var Cc = Components.classes;
   var Ci = Components.interfaces;
 
+function getLoadContext() {
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIWebNavigation)
+               .QueryInterface(Ci.nsILoadContext);
+}
+
 function runTest() {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
   var trans = Cc["@mozilla.org/widget/transferable;1"]
       .createInstance(Ci.nsITransferable);
+  trans.init(getLoadContext());
   trans.addDataFlavor("text/html");
   var test_data = '<meta/><a href="http://mozilla.org/">mozilla.org</a>';
   var cstr = Cc["@mozilla.org/supports-string;1"]

editor/libeditor/html/tests/test_bug520189.html

@@ -548,6 +548,13 @@ function doNextTest() {
   doNextTest();
 }
 
+function getLoadContext() {
+  const Ci = Components.interfaces;
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIWebNavigation)
+               .QueryInterface(Ci.nsILoadContext);
+}
+
 function runTest(test) {
   var elem = document.getElementById(test.id);
   if ("isIFrame" in test) {
@@ -560,6 +567,7 @@ function runTest(test) {
 
   var trans = Components.classes["@mozilla.org/widget/transferable;1"]
                         .createInstance(Components.interfaces.nsITransferable);
+  trans.init(getLoadContext());
   var data = Components.classes["@mozilla.org/supports-string;1"]
                        .createInstance(Components.interfaces.nsISupportsString);
   data.data = test.payload;