Merge mozilla-central to tracemonkey.

accessible/public/nsIAccessibleRelation.idl

@@ -119,7 +119,7 @@ interface nsIAccessibleRelation : nsISupports
 
   /**
    * This object is a transient component related to the target object. When
-   * this object is activated the target object doesn't loose focus.
+   * this object is activated the target object doesn't lose focus.
    */
   const unsigned long RELATION_POPUP_FOR = 0x0c;
 

accessible/src/base/nsRootAccessible.cpp

@@ -157,9 +157,12 @@ NS_IMETHODIMP nsRootAccessible::GetParent(nsIAccessible * *aParent)
   NS_ENSURE_ARG_POINTER(aParent);
   *aParent = nsnull;
 
-  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
-  NS_IF_ADDREF(*aParent = root);
+  if (!mParent) {
+    nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
+    mParent = root;
+  }
 
+  NS_IF_ADDREF(*aParent = mParent);
   return NS_OK;
 }
 
@@ -956,14 +959,12 @@ void nsRootAccessible::FireFocusCallback(nsITimer *aTimer, void *aClosure)
 nsresult
 nsRootAccessible::Init()
 {
-  nsresult rv = nsDocAccessibleWrap::Init();
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
   NS_ENSURE_STATE(root);
 
   root->AddRootAccessible(this);
-  return NS_OK;
+
+  return nsDocAccessibleWrap::Init();
 }
 
 nsresult

accessible/src/html/nsHTMLSelectAccessible.cpp

@@ -1023,19 +1023,20 @@ void nsHTMLComboboxAccessible::CacheChildren()
     if (!mListAccessible) {
       mListAccessible = 
         new nsHTMLComboboxListAccessible(mParent, mDOMNode, mWeakShell);
+      if (!mListAccessible)
+        return;
+
+      mListAccessible->Init();
     }
+
 #ifdef COMBO_BOX_WITH_THREE_CHILDREN
     buttonAccessible->SetNextSibling(mListAccessible);
 #else
     SetFirstChild(mListAccessible);
 #endif
-    if (!mListAccessible) {
-      return;
-    }
 
     mListAccessible->SetParent(this);
     mListAccessible->SetNextSibling(nsnull);
-    mListAccessible->Init();
 
     ++ mAccChildCount;  // List accessible child successfully added
   }

accessible/src/xul/nsXULMenuAccessible.h

@@ -45,7 +45,7 @@
 #include "nsIDOMXULSelectCntrlEl.h"
 
 /*
- * The basic implemetation of nsIAccessibleSelectable.
+ * The basic implementation of nsIAccessibleSelectable.
  */
 class nsXULSelectableAccessible : public nsAccessibleWrap
 {

accessible/tests/mochitest/common.js

@@ -302,9 +302,50 @@ function testAccessibleTree(aAccOrElmOrID, aAccTree)
     is(children.length, aAccTree.children.length,
        "Different amount of expected children of " + prettyName(acc) + ".");
 
-    if (aAccTree.children.length == children.length) { 
+    if (aAccTree.children.length == children.length) {
+      var childCount = children.length;
+
+      // nsIAccessible::firstChild
+      var expectedFirstChild = childCount > 0 ?
+        children.queryElementAt(0, nsIAccessible) : null;
+      var firstChild = null;
+      try { firstChild = acc.firstChild; } catch (e) {}
+      is(firstChild, expectedFirstChild,
+         "Wrong first child of " + prettyName(acc));
+
+      // nsIAccessible::lastChild
+      var expectedLastChild = childCount > 0 ?
+        children.queryElementAt(childCount - 1, nsIAccessible) : null;
+      var lastChild = null;
+      try { lastChild = acc.lastChild; } catch (e) {}
+      is(lastChild, expectedLastChild,
+         "Wrong last child of " + prettyName(acc));
+
       for (var i = 0; i < children.length; i++) {
         var child = children.queryElementAt(i, nsIAccessible);
+
+        // nsIAccessible::parent
+        var parent = null;
+        try { parent = child.parent; } catch (e) {}
+        is(parent, acc, "Wrong parent of " + prettyName(child));
+
+        // nsIAccessible::nextSibling
+        var expectedNextSibling = (i < childCount - 1) ?
+          children.queryElementAt(i + 1, nsIAccessible) : null;
+        var nextSibling = null;
+        try { nextSibling = child.nextSibling; } catch (e) {}
+        is(nextSibling, expectedNextSibling,
+           "Wrong next sibling of " + prettyName(child));
+
+        // nsIAccessible::previousSibling
+        var expectedPrevSibling = (i > 0) ?
+          children.queryElementAt(i - 1, nsIAccessible) : null;
+        var prevSibling = null;
+        try { prevSibling = child.previousSibling; } catch (e) {}
+        is(prevSibling, expectedPrevSibling,
+           "Wrong previous sibling of " + prettyName(child));
+
+        // Go down through subtree
         testAccessibleTree(child, aAccTree.children[i]);
       }
     }

accessible/tests/mochitest/events.js

@@ -1,6 +1,8 @@
 ////////////////////////////////////////////////////////////////////////////////
 // Constants
 
+const EVENT_DOCUMENT_LOAD_COMPLETE =
+  nsIAccessibleEvent.EVENT_DOCUMENT_LOAD_COMPLETE;
 const EVENT_DOM_DESTROY = nsIAccessibleEvent.EVENT_DOM_DESTROY;
 const EVENT_FOCUS = nsIAccessibleEvent.EVENT_FOCUS;
 const EVENT_NAME_CHANGE = nsIAccessibleEvent.EVENT_NAME_CHANGE;
@@ -86,6 +88,15 @@ function unregisterA11yEventListener(aEventType, aEventHandler)
  */
 const INVOKER_ACTION_FAILED = 1;
 
+/**
+ * Common invoker checker (see eventSeq of eventQueue).
+ */
+function invokerChecker(aEventType, aTarget)
+{
+  this.type = aEventType;
+  this.target = aTarget;
+}
+
 /**
  * Creates event queue for the given event type. The queue consists of invoker
  * objects, each of them generates the event of the event type. When queue is
@@ -319,7 +330,9 @@ function eventQueue(aEventType)
   this.setEventHandler = function eventQueue_setEventHandler(aInvoker)
   {
     this.mEventSeq = ("eventSeq" in aInvoker) ?
-      aInvoker.eventSeq : [[this.mDefEventType, aInvoker.DOMNode]];
+      aInvoker.eventSeq :
+      [ new invokerChecker(this.mDefEventType, aInvoker.DOMNode) ];
+
     this.mEventSeqIdx = -1;
 
     if (this.mEventSeq) {
@@ -352,20 +365,12 @@ function eventQueue(aEventType)
 
   this.getEventType = function eventQueue_getEventType(aIdx)
   {
-    var eventItem = this.mEventSeq[aIdx];
-    if ("type" in eventItem)
-      return eventItem.type;
-
-    return eventItem[0];
+    return this.mEventSeq[aIdx].type;
   }
 
   this.getEventTarget = function eventQueue_getEventTarget(aIdx)
   {
-    var eventItem = this.mEventSeq[aIdx];
-    if ("target" in eventItem)
-      return eventItem.target;
-
-    return eventItem[1];
+    return this.mEventSeq[aIdx].target;
   }
 
   this.compareEvents = function eventQueue_compareEvents(aIdx, aEvent)

accessible/tests/mochitest/role.js

@@ -3,6 +3,7 @@
 
 const ROLE_ALERT = nsIAccessibleRole.ROLE_ALERT;
 const ROLE_APPLICATION = nsIAccessibleRole.ROLE_APPLICATION;
+const ROLE_APP_ROOT = nsIAccessibleRole.ROLE_APP_ROOT;
 const ROLE_CELL = nsIAccessibleRole.ROLE_CELL;
 const ROLE_CHROME_WINDOW = nsIAccessibleRole.ROLE_CHROME_WINDOW;
 const ROLE_COMBOBOX = nsIAccessibleRole.ROLE_COMBOBOX;

accessible/tests/mochitest/test_events_doc.html

@@ -13,6 +13,8 @@
 
   <script type="application/javascript"
           src="chrome://mochikit/content/a11y/accessible/common.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/a11y/accessible/role.js"></script>
   <script type="application/javascript"
           src="chrome://mochikit/content/a11y/accessible/events.js"></script>
 
@@ -24,6 +26,10 @@
     {
       this.DOMNode = getNode(aIdentifier);
 
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, getAccessible(this.DOMNode))
+      ];
+
       this.invoke = function changeIframeSrc_invoke()
       {
         this.DOMNode.src = aURL;
@@ -35,6 +41,49 @@
       }
     }
 
+    function openDialogWnd(aURL)
+    {
+      // Get application root accessible.
+      var docAcc = getAccessible(document);
+      while (docAcc) {
+        this.mRootAcc = docAcc;
+        docAcc = docAcc.parent;
+      }
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, this.mRootAcc)
+      ];
+
+      this.invoke = function openDialogWnd_invoke()
+      {
+        this.mDialog = window.openDialog(aURL);
+      }
+
+      this.check = function openDialogWnd_check()
+      {
+        var accTree = {
+          role: ROLE_APP_ROOT,
+          children: [
+            {
+              role: ROLE_CHROME_WINDOW
+            },
+            {
+              role: ROLE_CHROME_WINDOW
+            }
+          ]
+        };
+
+        testAccessibleTree(this.mRootAcc, accTree);
+
+        this.mDialog.close();
+      }
+
+      this.getID = function openDialogWnd_getID()
+      {
+        return "open dialog '" + aURL + "'";
+      }
+    }
+
     ////////////////////////////////////////////////////////////////////////////
     // Do tests
 
@@ -44,10 +93,11 @@
 
     function doTests()
     {
-      gQueue = new eventQueue(EVENT_REORDER);
+      gQueue = new eventQueue();
 
       gQueue.push(new changeIframeSrc("iframe", "about:"));
       gQueue.push(new changeIframeSrc("iframe", "about:buildconfig"));
+      gQueue.push(new openDialogWnd("about:"));
 
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
@@ -64,6 +114,11 @@
      title="Fire event_reorder on any embedded frames/iframes whos document has just loaded">
     Mozilla Bug 420845
   </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=506206"
+     title="Fire event_reorder application root accessible">
+    Mozilla Bug 506206
+  </a>
 
   <p id="display"></p>
   <div id="content" style="display: none"></div>

accessible/tests/mochitest/test_events_mutation.html

@@ -60,8 +60,8 @@
       {
         var type = this.getA11yEventType(aEventType);
         for (var idx = 0; idx < this.eventSeq.length; idx++) {
-          if (this.eventSeq[idx][0] == type) {
-            this.eventSeq[idx][1] = aTarget;
+          if (this.eventSeq[idx].type == type) {
+            this.eventSeq[idx].target = aTarget;
             return idx;
           }
         }
@@ -76,8 +76,10 @@
         var targetIdx = this.setTarget(aEventType, aTargets[0]);
 
         var type = this.getA11yEventType(aEventType);
-        for (var i = 1; i < aTargets.length; i++)
-          this.eventSeq.splice(++targetIdx, 0, [type, aTargets[i]]);
+        for (var i = 1; i < aTargets.length; i++) {
+          var checker = new invokerChecker(type, aTargets[i]);
+          this.eventSeq.splice(++targetIdx, 0, checker);
+        }
       }
 
       // Implementation
@@ -103,15 +105,23 @@
 
       this.mIsDOMChange = aIsDOMChange;
 
-      if (aEventTypes & kHideEvent)
-        this.eventSeq.push([this.getA11yEventType(kHideEvent), this.DOMNode]);
+      if (aEventTypes & kHideEvent) {
+        var checker = new invokerChecker(this.getA11yEventType(kHideEvent),
+                                         this.DOMNode);
+        this.eventSeq.push(checker);
+      }
 
-      if (aEventTypes & kShowEvent)
-        this.eventSeq.push([this.getA11yEventType(kShowEvent), this.DOMNode]);
+      if (aEventTypes & kShowEvent) {
+        var checker = new invokerChecker(this.getA11yEventType(kShowEvent),
+                                         this.DOMNode);
+        this.eventSeq.push(checker);
+      }
 
-      if (aEventTypes & kReorderEvent)
-        this.eventSeq.push([this.getA11yEventType(kReorderEvent),
-                            this.DOMNode.parentNode]);
+      if (aEventTypes & kReorderEvent) {
+        var checker = new invokerChecker(this.getA11yEventType(kReorderEvent),
+                                         this.DOMNode.parentNode);
+        this.eventSeq.push(checker);
+      }
     }
 
     /**

accessible/tests/mochitest/test_events_tree.xul

@@ -122,7 +122,7 @@
 
       this.getID = function setTreeView_getID() { return "TreeViewChanged"; }
 
-      this.eventSeq = [["TreeViewChanged", gTree]];
+      this.eventSeq = [ new invokerChecker("TreeViewChanged", gTree) ];
     };
 
     /**

browser/app/profile/firefox.js

@@ -309,7 +309,6 @@ pref("browser.microsummary.updateGenerators", true);
 // enable search suggestions by default
 pref("browser.search.suggest.enabled", true);
 
-pref("browser.history.grouping", "day");
 pref("browser.history.showSessions", false);
 pref("browser.sessionhistory.max_entries", 50);
 pref("browser.history_expire_days", 180);

browser/base/content/browser-tabPreviews.js

@@ -114,8 +114,9 @@ var tabPreviewPanelHelper = {
     host.panel.hidden = false;
 
     var handler = this._generateHandler(host);
-    host.panel.addEventListener("popuphiding", handler, false);
     host.panel.addEventListener("popupshown", handler, false);
+    host.panel.addEventListener("popuphiding", handler, false);
+    host.panel.addEventListener("popuphidden", handler, false);
 
     host._prevFocus = document.commandDispatcher.focusedElement;
   },
@@ -136,10 +137,6 @@ var tabPreviewPanelHelper = {
     if ("suspendGUI" in host)
       host.suspendGUI();
 
-    // Destroy the widget in order to prevent outdated content
-    // when re-opening the panel.
-    host.panel.hidden = true;
-
     if (host._prevFocus) {
       Cc["@mozilla.org/focus-manager;1"]
         .getService(Ci.nsIFocusManager)
@@ -152,6 +149,11 @@ var tabPreviewPanelHelper = {
       gBrowser.selectedTab = host.tabToSelect;
       host.tabToSelect = null;
     }
+  },
+  _popuphidden: function (host) {
+    // Destroy the widget in order to prevent outdated content
+    // when re-opening the panel.
+    host.panel.hidden = true;
   }
 };
 
@@ -379,7 +381,7 @@ var ctrlTab = {
     this._timer = setTimeout(function (self) {
       self._timer = null;
       self._openPanel();
-    }, 100, this);
+    }, 200, this);
   },
 
   _openPanel: function ctrlTab_openPanel() {

browser/base/content/browser.css

@@ -45,6 +45,10 @@ toolbarpaletteitem[place="palette"] > toolbaritem > hbox[type="places"] {
   display: none;
 }
 
+#feed-menu[chromedir="rtl"] > menuitem {
+  direction: rtl;
+}
+
 #urlbar[pageproxystate="invalid"] > #urlbar-icons > :not(#go-button) ,
 #urlbar[pageproxystate="valid"] > #urlbar-icons > #go-button ,
 #urlbar[isempty="true"] > #urlbar-icons > #go-button {

browser/base/content/browser.xul

@@ -423,6 +423,8 @@
                     tooltiptext="&feedButton.tooltip;"
                     onclick="return FeedHandler.onFeedButtonClick(event);">
               <menupopup position="after_end"
+                         id="feed-menu"
+                         chromedir="&locale.dir;"
                          onpopupshowing="return FeedHandler.buildFeedList(this);"
                          oncommand="return FeedHandler.subscribeToFeed(null, event);"
                          onclick="checkForMiddleClick(this, event);"/>

browser/base/content/test/browser_bug413915.js

@@ -1,9 +1,6 @@
 function test() {
-  var ioserv = Components.classes["@mozilla.org/network/io-service;1"].
-               getService(Components.interfaces.nsIIOService);
-  var exampleUri = ioserv.newURI("http://example.com/", null, null);
-  var secman = Components.classes["@mozilla.org/scriptsecuritymanager;1"].
-               getService(Components.interfaces.nsIScriptSecurityManager);
+  var exampleUri = makeURI("http://example.com/");
+  var secman = Cc["@mozilla.org/scriptsecuritymanager;1"].getService(Ci.nsIScriptSecurityManager);
   var principal = secman.getCodebasePrincipal(exampleUri);
 
   function testIsFeed(aTitle, aHref, aType, aKnown) {

browser/base/content/test/browser_bug432599.js

@@ -30,16 +30,16 @@ function invokeUsingStarButton(phase) {
   }
 }
 
+var testURL = "data:text/plain,Content";
+
 // test bug 432599
 function test() {
   waitForExplicitFinish();
 
-  let testTab = gBrowser.addTab();
-  gBrowser.selectedTab = testTab;
-  let testBrowser = gBrowser.getBrowserForTab(testTab);
-  testBrowser.addEventListener("load", initTest, true);
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", initTest, true);
 
-  testBrowser.contentWindow.location = "data:text/plain,Content";
+  content.location = testURL;
 }
 
 let invokers = [invokeUsingStarButton, invokeUsingCtrlD];
@@ -47,12 +47,7 @@ let currentInvoker = 0;
 
 function initTest() {
   // first, bookmark the page
-  let app = Components.classes["@mozilla.org/fuel/application;1"]
-                      .getService(Components.interfaces.fuelIApplication);
-  let ios = Components.classes["@mozilla.org/network/io-service;1"]
-                      .getService(Ci.nsIIOService);
-  app.bookmarks.toolbar.addBookmark("Bug 432599 Test",
-                                    ios.newURI("data:text/plain,Content", null, null));
+  Application.bookmarks.toolbar.addBookmark("Bug 432599 Test", makeURI(testURL));
 
   checkBookmarksPanel(invokers[currentInvoker], 1);
 }
@@ -77,7 +72,7 @@ function checkBookmarksPanel(invoker, phase)
       if (phase < 4) {
         checkBookmarksPanel(invoker, phase + 1);
       } else {
-        ++ currentInvoker;
+        ++currentInvoker;
         if (currentInvoker < invokers.length) {
           checkBookmarksPanel(invokers[currentInvoker], 1);
         } else {

browser/base/content/test/browser_getshortcutoruri.js

@@ -1,9 +1,3 @@
-function makeURI(aURL, aOriginCharset, aBaseURI) {
-  var ioService = Components.classes["@mozilla.org/network/io-service;1"]
-                            .getService(Components.interfaces.nsIIOService);
-  return ioService.newURI(aURL, aOriginCharset, aBaseURI);
-}
-
 function getPostDataString(aIS) {
   if (!aIS)
     return null;

browser/base/content/test/browser_sanitize-passwordDisabledHosts.js

@@ -1,13 +1,12 @@
 // Bug 474792 - Clear "Never remember passwords for this site" when
 // clearing site-specific settings in Clear Recent History dialog
 
-Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Components.interfaces.mozIJSSubScriptLoader)
+Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Ci.mozIJSSubScriptLoader)
                                            .loadSubScript("chrome://browser/content/sanitize.js");
 
 function test() {
 
-  var pwmgr = Components.classes["@mozilla.org/login-manager;1"]
-             .getService(Components.interfaces.nsILoginManager);
+  var pwmgr = Cc["@mozilla.org/login-manager;1"].getService(Ci.nsILoginManager);
 
   // Add a disabled host
   pwmgr.setLoginSavingEnabled("http://example.com", false);
@@ -20,9 +19,7 @@ function test() {
   let s = new Sanitizer();
   s.ignoreTimespan = false;
   s.prefDomain = "privacy.cpd.";
-  var itemPrefs = Cc["@mozilla.org/preferences-service;1"]
-                  .getService(Components.interfaces.nsIPrefService)
-                  .getBranch(s.prefDomain);
+  var itemPrefs = gPrefService.getBranch(s.prefDomain);
   itemPrefs.setBoolPref("history", false);
   itemPrefs.setBoolPref("downloads", false);
   itemPrefs.setBoolPref("cache", false);

browser/base/content/test/browser_sanitize-sitepermissions.js

@@ -1,14 +1,14 @@
 // Bug 380852 - Delete permission manager entries in Clear Recent History
 
-Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Components.interfaces.mozIJSSubScriptLoader)
+Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Ci.mozIJSSubScriptLoader)
                                            .loadSubScript("chrome://browser/content/sanitize.js");
 
 function test() {
   
   // Add a permission entry
-  var pm = Components.classes["@mozilla.org/permissionmanager;1"]
-                    .getService(Components.interfaces.nsIPermissionManager);
-  pm.add(uri("http://example.com"), "testing", Ci.nsIPermissionManager.ALLOW_ACTION);
+  var pm = Cc["@mozilla.org/permissionmanager;1"]
+             .getService(Ci.nsIPermissionManager);
+  pm.add(makeURI("http://example.com"), "testing", pm.ALLOW_ACTION);
   
   // Sanity check
   ok(pm.enumerator.hasMoreElements(), "Permission manager should have elements, since we just added one");
@@ -17,9 +17,7 @@ function test() {
   let s = new Sanitizer();
   s.ignoreTimespan = false;
   s.prefDomain = "privacy.cpd.";
-  var itemPrefs = Cc["@mozilla.org/preferences-service;1"]
-                  .getService(Components.interfaces.nsIPrefService)
-                  .getBranch(s.prefDomain);
+  var itemPrefs = gPrefService.getBranch(s.prefDomain);
   itemPrefs.setBoolPref("history", false);
   itemPrefs.setBoolPref("downloads", false);
   itemPrefs.setBoolPref("cache", false);
@@ -36,8 +34,3 @@ function test() {
   // Make sure it's gone
   ok(!pm.enumerator.hasMoreElements(), "Permission manager shouldn't have entries after Sanitizing");
 }
-
-function uri(spec) {
-  return Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService)
-                                                .newURI(spec, null, null);
-}

browser/base/content/test/browser_sanitize-timespans.js

@@ -3,10 +3,9 @@ var now_uSec = Date.now() * 1000;
 
 const dm = Cc["@mozilla.org/download-manager;1"].getService(Ci.nsIDownloadManager);
 const bhist = Cc["@mozilla.org/browser/global-history;2"].getService(Ci.nsIBrowserHistory);
-const iosvc = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
 const formhist = Cc["@mozilla.org/satchel/form-history;1"].getService(Ci.nsIFormHistory2);
 
-Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Components.interfaces.mozIJSSubScriptLoader)
+Cc["@mozilla.org/moz/jssubscript-loader;1"].getService(Ci.mozIJSSubScriptLoader)
                                            .loadSubScript("chrome://browser/content/sanitize.js");
 
 function test() {
@@ -24,9 +23,7 @@ function test() {
   let s = new Sanitizer();
   s.ignoreTimespan = false;
   s.prefDomain = "privacy.cpd.";
-  var itemPrefs = Cc["@mozilla.org/preferences-service;1"]
-                  .getService(Components.interfaces.nsIPrefService)
-                  .getBranch(s.prefDomain);
+  var itemPrefs = gPrefService.getBranch(s.prefDomain);
   itemPrefs.setBoolPref("history", true);
   itemPrefs.setBoolPref("downloads", true);
   itemPrefs.setBoolPref("cache", false);
@@ -42,17 +39,17 @@ function test() {
   s.sanitize();
   s.range = null;
   
-  ok(!bhist.isVisited(uri("http://10minutes.com")), "10minutes.com should now be deleted");
-  ok(bhist.isVisited(uri("http://1hour.com")), "Pretend visit to 1hour.com should still exist");
-  ok(bhist.isVisited(uri("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
-  ok(bhist.isVisited(uri("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://10minutes.com")), "10minutes.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://1hour.com")), "Pretend visit to 1hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   
   if(minutesSinceMidnight > 10)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("10minutes"), "10minutes form entry should be deleted");
   ok(formhist.nameExists("1hour"), "1hour form entry should still exist");
@@ -81,16 +78,16 @@ function test() {
   Sanitizer.prefs.setIntPref("timeSpan", 1);
   s.sanitize();
   
-  ok(!bhist.isVisited(uri("http://1hour.com")), "1hour.com should now be deleted");
-  ok(bhist.isVisited(uri("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
-  ok(bhist.isVisited(uri("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://1hour.com")), "1hour.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   
   if(hoursSinceMidnight > 1)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("1hour"), "1hour form entry should be deleted");
   ok(formhist.nameExists("1hour10minutes"), "1hour10minutes form entry should still exist");
@@ -118,14 +115,14 @@ function test() {
   s.sanitize();
   s.range = null;
   
-  ok(!bhist.isVisited(uri("http://1hour10minutes.com")), "Pretend visit to 1hour10minutes.com should now be deleted");
-  ok(bhist.isVisited(uri("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
-  ok(bhist.isVisited(uri("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://1hour10minutes.com")), "Pretend visit to 1hour10minutes.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://2hour.com")), "Pretend visit to 2hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   if(minutesSinceMidnight > 70)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("1hour10minutes"), "1hour10minutes form entry should be deleted");
   ok(formhist.nameExists("2hour"), "2hour form entry should still exist");
@@ -149,13 +146,13 @@ function test() {
   Sanitizer.prefs.setIntPref("timeSpan", 2);
   s.sanitize();
   
-  ok(!bhist.isVisited(uri("http://2hour.com")), "Pretend visit to 2hour.com should now be deleted");
-  ok(bhist.isVisited(uri("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://2hour.com")), "Pretend visit to 2hour.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   if(hoursSinceMidnight > 2)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("2hour"), "2hour form entry should be deleted");
   ok(formhist.nameExists("2hour10minutes"), "2hour10minutes form entry should still exist");
@@ -179,12 +176,12 @@ function test() {
   s.sanitize();
   s.range = null;
   
-  ok(!bhist.isVisited(uri("http://2hour10minutes.com")), "Pretend visit to 2hour10minutes.com should now be deleted");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://2hour10minutes.com")), "Pretend visit to 2hour10minutes.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should still exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   if(minutesSinceMidnight > 130)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("2hour10minutes"), "2hour10minutes form entry should be deleted");
   ok(formhist.nameExists("4hour"), "4hour form entry should still exist");
@@ -204,11 +201,11 @@ function test() {
   Sanitizer.prefs.setIntPref("timeSpan", 3);
   s.sanitize();
   
-  ok(!bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should now be deleted");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should still exist");
   if(hoursSinceMidnight > 4)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("4hour"), "4hour form entry should be deleted");
   ok(formhist.nameExists("4hour10minutes"), "4hour10minutes form entry should still exist");
@@ -227,10 +224,10 @@ function test() {
   s.sanitize();
   s.range = null;
   
-  ok(!bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should now be deleted");
+  ok(!bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should now be deleted");
   if(minutesSinceMidnight > 250)
-    ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should still exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+    ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should still exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
   
   ok(!formhist.nameExists("4hour10minutes"), "4hour10minutes form entry should be deleted");
   if(minutesSinceMidnight > 250)
@@ -246,8 +243,8 @@ function test() {
   Sanitizer.prefs.setIntPref("timeSpan", 4);
   s.sanitize();
   
-  ok(!bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should now be deleted");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should still exist");
+  ok(!bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should now be deleted");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should still exist");
 
   ok(!formhist.nameExists("today"), "today form entry should be deleted");
   ok(formhist.nameExists("b4today"), "b4today form entry should still exist");
@@ -259,7 +256,7 @@ function test() {
   Sanitizer.prefs.setIntPref("timeSpan", 0);
   s.sanitize();
   
-  ok(!bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should now be deleted");
+  ok(!bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should now be deleted");
 
   ok(!formhist.nameExists("b4today"), "b4today form entry should be deleted");
   
@@ -268,34 +265,34 @@ function test() {
 }
 
 function setupHistory() {
-  bhist.addPageWithDetails(uri("http://10minutes.com/"), "10 minutes ago", now_uSec - 10*60*1000000);
-  bhist.addPageWithDetails(uri("http://1hour.com/"), "Less than 1 hour ago", now_uSec - 45*60*1000000);
-  bhist.addPageWithDetails(uri("http://1hour10minutes.com/"), "1 hour 10 minutes ago", now_uSec - 70*60*1000000);
-  bhist.addPageWithDetails(uri("http://2hour.com/"), "Less than 2 hours ago", now_uSec - 90*60*1000000);
-  bhist.addPageWithDetails(uri("http://2hour10minutes.com/"), "2 hours 10 minutes ago", now_uSec - 130*60*1000000);
-  bhist.addPageWithDetails(uri("http://4hour.com/"), "Less than 4 hours ago", now_uSec - 180*60*1000000);
-  bhist.addPageWithDetails(uri("http://4hour10minutes.com/"), "4 hours 10 minutesago", now_uSec - 250*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://10minutes.com/"), "10 minutes ago", now_uSec - 10*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://1hour.com/"), "Less than 1 hour ago", now_uSec - 45*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://1hour10minutes.com/"), "1 hour 10 minutes ago", now_uSec - 70*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://2hour.com/"), "Less than 2 hours ago", now_uSec - 90*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://2hour10minutes.com/"), "2 hours 10 minutes ago", now_uSec - 130*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://4hour.com/"), "Less than 4 hours ago", now_uSec - 180*60*1000000);
+  bhist.addPageWithDetails(makeURI("http://4hour10minutes.com/"), "4 hours 10 minutesago", now_uSec - 250*60*1000000);
   
   let today = new Date();
   today.setHours(0);
   today.setMinutes(0);
   today.setSeconds(30);
-  bhist.addPageWithDetails(uri("http://today.com/"), "Today", today.valueOf() * 1000);
+  bhist.addPageWithDetails(makeURI("http://today.com/"), "Today", today.valueOf() * 1000);
   
   let lastYear = new Date();
   lastYear.setFullYear(lastYear.getFullYear() - 1);
-  bhist.addPageWithDetails(uri("http://before-today.com/"), "Before Today", lastYear.valueOf() * 1000);
+  bhist.addPageWithDetails(makeURI("http://before-today.com/"), "Before Today", lastYear.valueOf() * 1000);
   
   // Confirm everything worked
-  ok(bhist.isVisited(uri("http://10minutes.com/")), "Pretend visit to 10minutes.com should exist");
-  ok(bhist.isVisited(uri("http://1hour.com")), "Pretend visit to 1hour.com should exist");
-  ok(bhist.isVisited(uri("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should exist");
-  ok(bhist.isVisited(uri("http://2hour.com")), "Pretend visit to 2hour.com should exist");
-  ok(bhist.isVisited(uri("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should exist");
-  ok(bhist.isVisited(uri("http://4hour.com")), "Pretend visit to 4hour.com should exist");
-  ok(bhist.isVisited(uri("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should exist");
-  ok(bhist.isVisited(uri("http://today.com")), "Pretend visit to today.com should exist");
-  ok(bhist.isVisited(uri("http://before-today.com")), "Pretend visit to before-today.com should exist");
+  ok(bhist.isVisited(makeURI("http://10minutes.com/")), "Pretend visit to 10minutes.com should exist");
+  ok(bhist.isVisited(makeURI("http://1hour.com")), "Pretend visit to 1hour.com should exist");
+  ok(bhist.isVisited(makeURI("http://1hour10minutes.com/")), "Pretend visit to 1hour10minutes.com should exist");
+  ok(bhist.isVisited(makeURI("http://2hour.com")), "Pretend visit to 2hour.com should exist");
+  ok(bhist.isVisited(makeURI("http://2hour10minutes.com/")), "Pretend visit to 2hour10minutes.com should exist");
+  ok(bhist.isVisited(makeURI("http://4hour.com")), "Pretend visit to 4hour.com should exist");
+  ok(bhist.isVisited(makeURI("http://4hour10minutes.com/")), "Pretend visit to 4hour10minutes.com should exist");
+  ok(bhist.isVisited(makeURI("http://today.com")), "Pretend visit to today.com should exist");
+  ok(bhist.isVisited(makeURI("http://before-today.com")), "Pretend visit to before-today.com should exist");
 }
 
 function setupFormHistory() {
@@ -598,7 +595,3 @@ function downloadExists(aID)
   stmt.finalize();
   return rows;
 }
-
-function uri(spec) {
-  return iosvc.newURI(spec, null, null);
-}

browser/base/content/test/browser_sanitizeDialog.js

@@ -63,8 +63,6 @@ const dm = Cc["@mozilla.org/download-manager;1"].
            getService(Ci.nsIDownloadManager);
 const bhist = Cc["@mozilla.org/browser/global-history;2"].
               getService(Ci.nsIBrowserHistory);
-const iosvc = Cc["@mozilla.org/network/io-service;1"].
-              getService(Ci.nsIIOService);
 const formhist = Cc["@mozilla.org/satchel/form-history;1"].
                  getService(Ci.nsIFormHistory2);
 
@@ -608,7 +606,7 @@ function addFormEntryWithMinutesAgo(aMinutesAgo) {
  *        The visit will be visited this many minutes ago
  */
 function addHistoryWithMinutesAgo(aMinutesAgo) {
-  let pURI = uri("http://" + aMinutesAgo + "-minutes-ago.com/");
+  let pURI = makeURI("http://" + aMinutesAgo + "-minutes-ago.com/");
   bhist.addPageWithDetails(pURI,
                            aMinutesAgo + " minutes ago",
                            now_uSec - (aMinutesAgo * 60 * 1000 * 1000));
@@ -638,10 +636,7 @@ function blankSlate() {
  *        Passed to is()
  */
 function boolPrefIs(aPrefName, aExpectedVal, aMsg) {
-  let prefs = Cc["@mozilla.org/preferences-service;1"].
-              getService(Ci.nsIPrefService).
-              getBranch("privacy.");
-  is(prefs.getBoolPref(aPrefName), aExpectedVal, aMsg);
+  is(gPrefService.getBoolPref("privacy." + aPrefName), aExpectedVal, aMsg);
 }
 
 /**
@@ -740,17 +735,7 @@ function ensureHistoryClearedState(aURIs, aShouldBeCleared) {
  *        Passed to is()
  */
 function intPrefIs(aPrefName, aExpectedVal, aMsg) {
-  let prefs = Cc["@mozilla.org/preferences-service;1"].
-              getService(Ci.nsIPrefService).
-              getBranch("privacy.");
-  is(prefs.getIntPref(aPrefName), aExpectedVal, aMsg);
-}
-
-/**
- * @return A new nsIURI from aSpec.
- */
-function uri(aSpec) {
-  return iosvc.newURI(aSpec, null, null);
+  is(gPrefService.getIntPref("privacy." + aPrefName), aExpectedVal, aMsg);
 }
 
 ///////////////////////////////////////////////////////////////////////////////

browser/base/content/test/browser_sanitizeDialog_treeView.js

@@ -63,8 +63,6 @@ const dm = Cc["@mozilla.org/download-manager;1"].
            getService(Ci.nsIDownloadManager);
 const bhist = Cc["@mozilla.org/browser/global-history;2"].
               getService(Ci.nsIBrowserHistory);
-const iosvc = Cc["@mozilla.org/network/io-service;1"].
-              getService(Ci.nsIIOService);
 const formhist = Cc["@mozilla.org/satchel/form-history;1"].
                  getService(Ci.nsIFormHistory2);
 
@@ -509,7 +507,7 @@ function addFormEntryWithMinutesAgo(aMinutesAgo) {
  *        The visit will be visited this many minutes ago
  */
 function addHistoryWithMinutesAgo(aMinutesAgo) {
-  let pURI = uri("http://" + aMinutesAgo + "-minutes-ago.com/");
+  let pURI = makeURI("http://" + aMinutesAgo + "-minutes-ago.com/");
   bhist.addPageWithDetails(pURI,
                            aMinutesAgo + " minutes ago",
                            now_uSec - (aMinutesAgo * 60 * 1000 * 1000));
@@ -652,13 +650,6 @@ function openWindow(aOnloadCallback) {
                       null);
 }
 
-/**
- * @return A new nsIURI from aSpec.
- */
-function uri(aSpec) {
-  return iosvc.newURI(aSpec, null, null);
-}
-
 ///////////////////////////////////////////////////////////////////////////////
 
 function test() {

browser/components/privatebrowsing/test/browser/Makefile.in

@@ -60,6 +60,7 @@ _BROWSER_TEST_FILES =  \
 		browser_privatebrowsing_forgetthissite.js \
 		browser_privatebrowsing_pageinfo.js \
 		browser_privatebrowsing_sslsite_transition.js \
+		browser_privatebrowsing_popupmode.js \
 		$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)

browser/components/privatebrowsing/test/browser/browser_privatebrowsing_popupmode.js

@@ -0,0 +1,107 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Private Browsing Tests.
+ *
+ * The Initial Developer of the Original Code is
+ * Ehsan Akhgari.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Ehsan Akhgari <ehsan.akhgari@gmail.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// This test makes sure that the URL bar is enabled after entering the private
+// browsing mode, even if it's disabled before that (see bug 495495).
+
+function test() {
+  // initialization
+  let pb = Cc["@mozilla.org/privatebrowsing;1"].
+           getService(Ci.nsIPrivateBrowsingService);
+  let ss = Cc["@mozilla.org/browser/sessionstore;1"].
+           getService(Ci.nsISessionStore);
+
+  // backup our state
+  let stateBackup = ss.getWindowState(window);
+
+  function pretendToBeAPopup(whatToPretend) {
+    let state = whatToPretend ?
+      '{"windows":[{"tabs":[{"entries":[],"attributes":{}}],"isPopup":true,"hidden":"toolbar"}]}' :
+      '{"windows":[{"tabs":[{"entries":[],"attributes":{}}],"isPopup":false}]}';
+    ss.setWindowState(window, state, true);
+    if (whatToPretend) {
+      ok(gURLBar.readOnly, "pretendToBeAPopup correctly made the URL bar read-only");
+      is(gURLBar.getAttribute("enablehistory"), "false",
+         "pretendToBeAPopup correctly disabled autocomplete on the URL bar");
+    }
+    else {
+      ok(!gURLBar.readOnly, "pretendToBeAPopup correctly made the URL bar read-write");
+      is(gURLBar.getAttribute("enablehistory"), "true",
+         "pretendToBeAPopup correctly enabled autocomplete on the URL bar");
+    }
+  }
+
+  // first, test the case of entering the PB mode when a popup window is active
+
+  // pretend we're a popup window
+  pretendToBeAPopup(true);
+
+  // enter private browsing mode
+  pb.privateBrowsingEnabled = true;
+
+  // make sure that the url bar status is correctly restored
+  ok(!gURLBar.readOnly,
+     "URL bar should not be read-only after entering the private browsing mode");
+  is(gURLBar.getAttribute("enablehistory"), "true",
+     "URL bar autocomplete should be enabled after entering the private browsing mode");
+
+  // leave private browsing mode
+  pb.privateBrowsingEnabled = false;
+
+  // we're no longer a popup window
+  pretendToBeAPopup(false);
+
+  // then, test the case of leaving the PB mode when a popup window is active
+
+  // start from within the private browsing mode
+  pb.privateBrowsingEnabled = true;
+
+  // pretend we're a popup window
+  pretendToBeAPopup(true);
+
+  // leave private browsing mode
+  pb.privateBrowsingEnabled = false;
+
+  // make sure that the url bar status is correctly restored
+  ok(!gURLBar.readOnly,
+     "URL bar should not be read-only after leaving the private browsing mode");
+  is(gURLBar.getAttribute("enablehistory"), "true",
+     "URL bar autocomplete should be enabled after leaving the private browsing mode");
+
+  // cleanup
+  ss.setWindowState(window, stateBackup, true);
+}

browser/components/sessionstore/src/nsSessionStore.js

@@ -2303,11 +2303,21 @@ SessionStoreService.prototype = {
       aWindow[aItem].visible = hidden.indexOf(aItem) == -1;
     });
     
-    if (aWinData.isPopup)
+    if (aWinData.isPopup) {
       this._windows[aWindow.__SSi].isPopup = true;
-    else
+      if (aWindow.gURLBar) {
+        aWindow.gURLBar.readOnly = true;
+        aWindow.gURLBar.setAttribute("enablehistory", "false");
+      }
+    }
+    else {
       delete this._windows[aWindow.__SSi].isPopup;
-    
+      if (aWindow.gURLBar) {
+        aWindow.gURLBar.readOnly = false;
+        aWindow.gURLBar.setAttribute("enablehistory", "true");
+      }
+    }
+
     var _this = this;
     aWindow.setTimeout(function() {
       _this.restoreDimensions.apply(_this, [aWindow, aWinData.width || 0, 

browser/components/sessionstore/test/browser/Makefile.in

@@ -91,6 +91,7 @@ _BROWSER_TEST_FILES = \
 	browser_490040.js \
 	browser_491168.js \
 	browser_493467.js \
+	browser_495495.js \
 	$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)

browser/components/sessionstore/test/browser/browser_495495.js

@@ -0,0 +1,89 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is sessionstore test code.
+ *
+ * The Initial Developer of the Original Code is
+ * Ehsan Akhgari <ehsan.akhgari@gmail.com>.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function test() {
+  /** Test for Bug 495495 **/
+  
+  let ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
+  waitForExplicitFinish();
+
+  let newWin = openDialog(location, "_blank", "chrome,all,dialog=no,toolbar=yes");
+  newWin.addEventListener("load", function() {
+    newWin.removeEventListener("load", arguments.callee, false);
+
+    executeSoon(function() {
+      let state1 = ss.getWindowState(newWin);
+      newWin.close();
+
+      newWin = openDialog(location, "_blank",
+        "chrome,extrachrome,menubar,resizable,scrollbars,status,toolbar=no,location,personal,directories,dialog=no");
+      newWin.addEventListener("load", function() {
+        newWin.removeEventListener("load", arguments.callee, false);
+
+        executeSoon(function() {
+          let state2 = ss.getWindowState(newWin);
+          newWin.close();
+
+          function testState(state, expected, callback) {
+            let win = openDialog(location, "_blank", "chrome,all,dialog=no");
+            win.addEventListener("load", function() {
+              win.removeEventListener("load", arguments.callee, false);
+
+              is(win.gURLBar.readOnly, false,
+                 "URL bar should not be read-only before setting the state");
+              is(win.gURLBar.getAttribute("enablehistory"), "true",
+                 "URL bar autocomplete should be enabled before setting the state");
+              ss.setWindowState(win, state, true);
+              is(win.gURLBar.readOnly, expected.readOnly,
+                 "URL bar read-only state should be restored correctly");
+              is(win.gURLBar.getAttribute("enablehistory"), expected.enablehistory,
+                 "URL bar autocomplete state should be restored correctly");
+
+              win.close();
+              callback();
+            }, false);
+          }
+
+          testState(state1, {readOnly: false, enablehistory: "true"}, function() {
+            testState(state2, {readOnly: true, enablehistory: "false"}, function() {
+              executeSoon(finish);
+            });
+          });
+        });
+      }, false);
+    });
+  }, false);
+}

browser/themes/winstripe/browser/places/organizer.css

@@ -73,6 +73,10 @@
   border: 1px solid transparent;
 }
 
+#placesMenu > menu[_moz-menuactive="true"] {
+  background-color: transparent;
+}
+
 #placesMenu > menu:hover {
   border-color: ThreeDHighlight ThreeDShadow ThreeDShadow ThreeDHighlight;
 }

configure.in

@@ -7955,6 +7955,9 @@ if test "$NECKO_WIFI"; then
     NECKO_WIFI=1
   elif test "$OS_ARCH" = "WINCE"; then
     NECKO_WIFI=1    
+  elif test "$OS_ARCH" = "OS2"; then
+    dnl OS/2 implementation of Necko-WiFi support will be added in bug 506566
+    NECKO_WIFI=
   else
     AC_MSG_ERROR([Necko WiFi scanning not supported on your platform, use --disable-necko-wifi])
   fi

content/base/src/nsDocument.cpp

@@ -6251,7 +6251,7 @@ nsDocument::FlushPendingNotifications(mozFlushType aType)
   }
 
   // If we have a parent we must flush the parent too to ensure that our
-  // container is reflown if its size was changed.  But if it's not safe to
+  // container is reflowed if its size was changed.  But if it's not safe to
   // flush ourselves, then don't flush the parent, since that can cause things
   // like resizes of our frame's widget, which we can't handle while flushing
   // is unsafe.

content/base/src/nsGenericDOMDataNode.h

@@ -43,15 +43,7 @@
 #ifndef nsGenericDOMDataNode_h___
 #define nsGenericDOMDataNode_h___
 
-// This bit is set to indicate that if the text node changes to
-// non-whitespace, we may need to create a frame for it. This bit must
-// not be set on nodes that already have a frame.
-#define NS_CREATE_FRAME_IF_NON_WHITESPACE (1 << NODE_TYPE_SPECIFIC_BITS_OFFSET)
-
-// This bit is set to indicate that if the text node changes to
-// whitespace, we may need to reframe it (or its ancestors).
-#define NS_REFRAME_IF_WHITESPACE (1 << (NODE_TYPE_SPECIFIC_BITS_OFFSET + 1))
-
+#include "nsIContent.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIDOMEventTarget.h"
 #include "nsIDOM3Text.h"
@@ -66,6 +58,18 @@
 #include "nsISMILAttr.h"
 #endif // MOZ_SMIL
 
+// This bit is set to indicate that if the text node changes to
+// non-whitespace, we may need to create a frame for it. This bit must
+// not be set on nodes that already have a frame.
+#define NS_CREATE_FRAME_IF_NON_WHITESPACE (1 << NODE_TYPE_SPECIFIC_BITS_OFFSET)
+
+// This bit is set to indicate that if the text node changes to
+// whitespace, we may need to reframe it (or its ancestors).
+#define NS_REFRAME_IF_WHITESPACE (1 << (NODE_TYPE_SPECIFIC_BITS_OFFSET + 1))
+
+// This bit is set to indicate that the text may be part of a selection.
+#define NS_TEXT_IN_SELECTION (1 << (NODE_TYPE_SPECIFIC_BITS_OFFSET + 2))
+
 class nsIDOMAttr;
 class nsIDOMEventListener;
 class nsIDOMNodeList;

content/base/src/nsObjectLoadingContent.cpp

@@ -760,7 +760,7 @@ nsObjectLoadingContent::EnsureInstantiation(nsIPluginInstance** aInstance)
 
   if (nsiframe->GetStateBits() & NS_FRAME_FIRST_REFLOW) {
     // A frame for this plugin element already exists now, but it has
-    // not been reflown yet. Force a reflow now so that we don't end
+    // not been reflowed yet. Force a reflow now so that we don't end
     // up initializing a plugin before knowing its size. Also re-fetch
     // the frame, as flushing can cause the frame to be deleted.
     frame = GetExistingFrame(eFlushLayout);
@@ -1706,7 +1706,7 @@ nsObjectLoadingContent::TryInstantiate(const nsACString& aMIMEType,
 
   if (!instance) {
     // The frame has no plugin instance yet. If the frame hasn't been
-    // reflown yet, do nothing as once the reflow happens we'll end up
+    // reflowed yet, do nothing as once the reflow happens we'll end up
     // instantiating the plugin with the correct size n' all (which
     // isn't known until we've done the first reflow). But if the
     // frame does have a plugin instance already, be sure to
@@ -1714,7 +1714,7 @@ nsObjectLoadingContent::TryInstantiate(const nsACString& aMIMEType,
     // chanced since it was instantiated.
     nsIFrame* iframe = do_QueryFrame(frame);
     if (iframe->GetStateBits() & NS_FRAME_FIRST_REFLOW) {
-      LOG(("OBJLC [%p]: Frame hasn't been reflown yet\n", this));
+      LOG(("OBJLC [%p]: Frame hasn't been reflowed yet\n", this));
       return NS_OK; // Not a failure to have no frame
     }
   }

content/base/src/nsRange.cpp

@@ -317,8 +317,10 @@ nsRange::ContentRemoved(nsIDocument* aDocument,
   nsINode* container = NODE_FROM(aContainer, aDocument);
 
   // Adjust position if a sibling was removed...
-  if (container == mStartParent && aIndexInContainer < mStartOffset) {
-    --mStartOffset;
+  if (container == mStartParent) {
+    if (aIndexInContainer < mStartOffset) {
+      --mStartOffset;
+    }
   }
   // ...or gravitate if an ancestor was removed.
   else if (nsContentUtils::ContentIsDescendantOf(mStartParent, aChild)) {
@@ -327,8 +329,10 @@ nsRange::ContentRemoved(nsIDocument* aDocument,
   }
 
   // Do same thing for end boundry.
-  if (container == mEndParent && aIndexInContainer < mEndOffset) {
-    --mEndOffset;
+  if (container == mEndParent) {
+    if (aIndexInContainer < mEndOffset) {
+      --mEndOffset;
+    }
   }
   else if (nsContentUtils::ContentIsDescendantOf(mEndParent, aChild)) {
     mEndParent = container;

content/base/src/nsStyleLinkElement.cpp

@@ -250,9 +250,9 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
     return NS_OK;
   }
 
-  nsCOMPtr<nsIURI> uri;
   PRBool isInline;
-  GetStyleSheetURL(&isInline, getter_AddRefs(uri));
+  
+  nsCOMPtr<nsIURI> uri = GetStyleSheetURL(&isInline);
 
   if (!aForceUpdate && mStyleSheet && !isInline && uri) {
     nsCOMPtr<nsIURI> oldURI;

content/base/src/nsStyleLinkElement.h

@@ -95,8 +95,7 @@ protected:
   nsresult UpdateStyleSheetInternal(nsIDocument *aOldDocument,
                                     PRBool aForceUpdate = PR_FALSE);
 
-  virtual void GetStyleSheetURL(PRBool* aIsInline,
-                                nsIURI** aURI) = 0;
+  virtual already_AddRefed<nsIURI> GetStyleSheetURL(PRBool* aIsInline) = 0;
   virtual void GetStyleSheetInfo(nsAString& aTitle,
                                  nsAString& aType,
                                  nsAString& aMedia,

content/html/content/public/nsHTMLMediaElement.h

@@ -207,12 +207,10 @@ public:
 
   // Returns true if we can handle this MIME type.
   // If it returns true, then it also returns a null-terminated list
-  // of supported codecs in *aSupportedCodecs, and a null-terminated list
-  // of codecs that *may* be supported in *aMaybeSupportedCodecs. These
-  // lists should not be freed, they area static data.
+  // of supported codecs in *aSupportedCodecs. This
+  // list should not be freed, it is static data.
   static PRBool CanHandleMediaType(const char* aMIMEType,
-                                   const char*** aSupportedCodecs,
-                                   const char*** aMaybeSupportedCodecs);
+                                   const char*** aSupportedCodecs);
 
   // Returns true if we should handle this MIME type when it appears
   // as an <object> or as a toplevel page. If, in practice, our support

content/html/content/reftests/484200-1-ref.html

@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Test for Bug 484200</title>
+<style>
+p { background:lime }
+</style>
+</head>
+<body>
+<p>xxxxx</p>
+</body>
+</html>

content/html/content/reftests/484200-1.html

@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Test for Bug 484200</title>
+<style src=style>
+p { background:lime }
+</style>
+</head>
+<body>
+<p>xxxxx</p>
+</body>
+</html>

content/html/content/reftests/reftest.list

@@ -4,3 +4,4 @@
 != 468263-1d.html about:blank
 == 468263-2.html 468263-2-ref.html
 == 468263-2.html 468263-2-alternate-ref.html
+== 484200-1.html 484200-1-ref.html

content/html/content/src/nsHTMLAudioElement.cpp

@@ -117,8 +117,15 @@ NS_IMETHODIMP
 nsHTMLAudioElement::Initialize(nsISupports* aOwner, JSContext* aContext,
                                JSObject *aObj, PRUint32 argc, jsval *argv)
 {
+  // Audio elements created using "new Audio(...)" should have
+  // 'autobuffer' set (since the script must intend to play the audio)
+  nsresult rv = SetAttr(kNameSpaceID_None, nsGkAtoms::autobuffer,
+                        NS_LITERAL_STRING("autobuffer"), PR_TRUE);
+  if (NS_FAILED(rv))
+    return rv;
+
   if (argc <= 0) {
-    // Nothing to do here if we don't get any arguments.
+    // Nothing more to do here if we don't get any arguments.
     return NS_OK;
   }
 

content/html/content/src/nsHTMLLinkElement.cpp

@@ -116,8 +116,7 @@ public:
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
-  virtual void GetStyleSheetURL(PRBool* aIsInline,
-                                nsIURI** aURI);
+  virtual already_AddRefed<nsIURI> GetStyleSheetURL(PRBool* aIsInline);
   virtual void GetStyleSheetInfo(nsAString& aTitle,
                                  nsAString& aType,
                                  nsAString& aMedia,
@@ -395,13 +394,11 @@ nsHTMLLinkElement::GetHrefURI() const
   return GetHrefURIForAnchors();
 }
 
-void
-nsHTMLLinkElement::GetStyleSheetURL(PRBool* aIsInline,
-                                    nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsHTMLLinkElement::GetStyleSheetURL(PRBool* aIsInline)
 {
   *aIsInline = PR_FALSE;
-  *aURI = GetHrefURIForAnchors().get();
-  return;
+  return GetHrefURIForAnchors();
 }
 
 void

content/html/content/src/nsHTMLMediaElement.cpp

@@ -985,10 +985,6 @@ static const char* gOggCodecs[] = {
   nsnull
 };
 
-static const char* gOggMaybeCodecs[] = {
-  nsnull
-};
-
 static PRBool IsOggEnabled()
 {
   return nsContentUtils::GetBoolPref("media.ogg.enabled");
@@ -1022,11 +1018,6 @@ static const char* gWaveCodecs[] = {
   nsnull
 };
 
-static const char* gWaveMaybeCodecs[] = {
-  "0", // Microsoft Unknown Wave Format
-  nsnull
-};
-
 static PRBool IsWaveEnabled()
 {
   return nsContentUtils::GetBoolPref("media.wave.enabled");
@@ -1046,20 +1037,17 @@ static PRBool IsWaveType(const nsACString& aType)
 
 /* static */
 PRBool nsHTMLMediaElement::CanHandleMediaType(const char* aMIMEType,
-                                              const char*** aCodecList,
-                                              const char*** aMaybeCodecList)
+                                              const char*** aCodecList)
 {
 #ifdef MOZ_OGG
   if (IsOggType(nsDependentCString(aMIMEType))) {
     *aCodecList = gOggCodecs;
-    *aMaybeCodecList = gOggMaybeCodecs;
     return PR_TRUE;
   }
 #endif
 #ifdef MOZ_WAVE
   if (IsWaveType(nsDependentCString(aMIMEType))) {
     *aCodecList = gWaveCodecs;
-    *aMaybeCodecList = gWaveMaybeCodecs;
     return PR_TRUE;
   }
 #endif
@@ -1107,9 +1095,8 @@ static CanPlayStatus GetCanPlay(const nsAString& aType)
 
   NS_ConvertUTF16toUTF8 mimeTypeUTF8(mimeType);
   const char** supportedCodecs;
-  const char** maybeSupportedCodecs;
   if (!nsHTMLMediaElement::CanHandleMediaType(mimeTypeUTF8.get(),
-          &supportedCodecs, &maybeSupportedCodecs))
+                                              &supportedCodecs))
     return CANPLAY_NO;
 
   nsAutoString codecs;
@@ -1126,9 +1113,7 @@ static CanPlayStatus GetCanPlay(const nsAString& aType)
   while (tokenizer.hasMoreTokens()) {
     const nsSubstring& token = tokenizer.nextToken();
 
-    if (CodecListContains(maybeSupportedCodecs, token)) {
-      result = CANPLAY_MAYBE;
-    } else if (!CodecListContains(supportedCodecs, token)) {
+    if (!CodecListContains(supportedCodecs, token)) {
       // Totally unsupported codec
       return CANPLAY_NO;
     }

content/html/content/src/nsHTMLStyleElement.cpp

@@ -103,8 +103,7 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
 protected:
-  void GetStyleSheetURL(PRBool* aIsInline,
-                        nsIURI** aURI);
+  already_AddRefed<nsIURI> GetStyleSheetURL(PRBool* aIsInline);
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
@@ -312,24 +311,11 @@ nsHTMLStyleElement::SetInnerHTML(const nsAString& aInnerHTML)
   return rv;
 }
 
-void
-nsHTMLStyleElement::GetStyleSheetURL(PRBool* aIsInline,
-                                     nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsHTMLStyleElement::GetStyleSheetURL(PRBool* aIsInline)
 {
-  *aURI = nsnull;
-  *aIsInline = !HasAttr(kNameSpaceID_None, nsGkAtoms::src);
-  if (*aIsInline) {
-    return;
-  }
-  if (!IsInHTMLDocument()) {
-    // We stopped supporting <style src="..."> for XHTML as it is
-    // non-standard.
-    *aIsInline = PR_TRUE;
-    return;
-  }
-
-  *aURI = GetHrefURIForAnchors().get();
-  return;
+  *aIsInline = PR_TRUE;
+  return nsnull;
 }
 
 void

content/media/test/can_play_type_wave.js

@@ -15,14 +15,11 @@ function check_wave(v, enabled) {
   check("audio/wave; codecs=", "probably");
   check("audio/wave; codecs=\"\"", "probably");
 
-  // Maybe-supported Wave codecs
-  check("audio/wave; codecs=0", "maybe");
-  check("audio/wave; codecs=\"0, 1\"", "maybe");
-
   // Unsupported Wave codecs
+  check("audio/wave; codecs=0", "");
   check("audio/wave; codecs=2", "");
-  check("audio/wave; codecs=xyz,0", "");
-  check("audio/wave; codecs=0,xyz", "");
+  check("audio/wave; codecs=xyz,1", "");
+  check("audio/wave; codecs=1,xyz", "");
   check("audio/wave; codecs=\"xyz, 1\"", "");
   // empty codec names
   check("audio/wave; codecs=,", "");

content/media/test/test_audio1.html

@@ -19,7 +19,7 @@ for (var i = 0; i < gAudioTests.length; ++i) {
   if (!a1.canPlayType(test.type))
     continue;
 
-  a1.setAttribute("autobuffer", "");
+  is(a1.getAttribute("autobuffer"), "autobuffer", "Autobuffer automatically set");
   a1.addEventListener('load', function(event) {
     is(event.target.networkState, HTMLMediaElement.NETWORK_LOADED,
        "Audio " + event.target.currentSrc + " loaded");

content/media/test/test_audio2.html

@@ -20,7 +20,7 @@ for (var i = 0; i < gAudioTests.length; ++i) {
     continue;
 
   var a1 = new Audio(test.name);
-  a1.setAttribute("autobuffer", "");
+  is(a1.getAttribute("autobuffer"), "autobuffer", "Autobuffer automatically set");
   a1.addEventListener('load', function(event) {
     is(event.target.networkState, HTMLMediaElement.NETWORK_LOADED,
        "Audio " + event.target.currentSrc + " loaded");

content/smil/nsSMILAnimationFunction.cpp

@@ -407,9 +407,13 @@ nsSMILAnimationFunction::InterpolateResult(const nsSMILValueArray& aValues,
 
   // Handle CALC_DISCRETE separately, because it's simple.
   if (GetCalcMode() == CALC_DISCRETE) {
-    PRUint32 index = IsToAnimation() ? 0 :
-      (PRUint32) floor(simpleProgress * (aValues.Length()));
-    aResult = aValues[index];
+    if (IsToAnimation()) {
+      // Two discrete values: our base value, and the val in our array
+      aResult = (simpleProgress < 0.5f) ? aBaseValue : aValues[0];
+    } else {
+      PRUint32 index = (PRUint32) floor(simpleProgress * (aValues.Length()));
+      aResult = aValues[index];
+    }
     return NS_OK;
   }
 

content/svg/content/src/nsSVGFilters.cpp

@@ -549,6 +549,19 @@ BoxBlur(const PRUint8 *aInput, PRUint8 *aOutput,
   }
 }
 
+static PRUint32
+GetBlurBoxSize(double aStdDev)
+{
+  NS_ASSERTION(aStdDev >= 0, "Negative standard deviations not allowed");
+
+  double size = aStdDev*3*sqrt(2*M_PI)/4;
+  // Doing super-large blurs accurately isn't very important.
+  PRUint32 max = 1024;
+  if (size > max)
+    return max;
+  return PRUint32(floor(size + 0.5));
+}
+
 nsresult
 nsSVGFEGaussianBlurElement::GetDXY(PRUint32 *aDX, PRUint32 *aDY,
                                    const nsSVGFilterInstance& aInstance)
@@ -569,8 +582,11 @@ nsSVGFEGaussianBlurElement::GetDXY(PRUint32 *aDX, PRUint32 *aDY,
   if (stdX == 0 || stdY == 0)
     return NS_ERROR_UNEXPECTED;
 
-  *aDX = PRUint32(floor(stdX * 3*sqrt(2*M_PI)/4 + 0.5));
-  *aDY = PRUint32(floor(stdY * 3*sqrt(2*M_PI)/4 + 0.5));
+  // If the box size is greater than twice the temporary surface size
+  // in an axis, then each pixel will be set to the average of all the
+  // other pixel values.
+  *aDX = GetBlurBoxSize(stdX);
+  *aDY = GetBlurBoxSize(stdY);
   return NS_OK;
 }
 

content/svg/content/src/nsSVGStyleElement.cpp

@@ -99,8 +99,8 @@ protected:
   }
 
   // nsStyleLinkElement overrides
-  void GetStyleSheetURL(PRBool* aIsInline,
-                        nsIURI** aURI);
+  already_AddRefed<nsIURI> GetStyleSheetURL(PRBool* aIsInline);
+
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
@@ -311,14 +311,11 @@ NS_IMETHODIMP nsSVGStyleElement::SetTitle(const nsAString & aTitle)
 //----------------------------------------------------------------------
 // nsStyleLinkElement methods
 
-void
-nsSVGStyleElement::GetStyleSheetURL(PRBool* aIsInline,
-                                    nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsSVGStyleElement::GetStyleSheetURL(PRBool* aIsInline)
 {
-  *aURI = nsnull;
   *aIsInline = PR_TRUE;
-
-  return;
+  return nsnull;
 }
 
 void

content/xbl/test/test_bug378518.xul

@@ -21,7 +21,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=378518
 
   </bindings>
 
-  <!-- test resuls are displayed in the html:body -->
+  <!-- test results are displayed in the html:body -->
   <body xmlns="http://www.w3.org/1999/xhtml">
       <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=378518"
          target="_blank">Mozilla Bug 378518</a>

content/xml/content/src/nsXMLStylesheetPI.cpp

@@ -78,8 +78,7 @@ public:
 protected:
   nsCOMPtr<nsIURI> mOverriddenBaseURI;
 
-  void GetStyleSheetURL(PRBool* aIsInline,
-                        nsIURI** aURI);
+  already_AddRefed<nsIURI> GetStyleSheetURL(PRBool* aIsInline);
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
@@ -166,16 +165,14 @@ nsXMLStylesheetPI::OverrideBaseURI(nsIURI* aNewBaseURI)
   mOverriddenBaseURI = aNewBaseURI;
 }
 
-void
-nsXMLStylesheetPI::GetStyleSheetURL(PRBool* aIsInline,
-                                    nsIURI** aURI)
+already_AddRefed<nsIURI>
+nsXMLStylesheetPI::GetStyleSheetURL(PRBool* aIsInline)
 {
   *aIsInline = PR_FALSE;
-  *aURI = nsnull;
 
   nsAutoString href;
   if (!GetAttrValue(nsGkAtoms::href, href)) {
-    return;
+    return nsnull;
   }
 
   nsIURI *baseURL;
@@ -188,7 +185,9 @@ nsXMLStylesheetPI::GetStyleSheetURL(PRBool* aIsInline,
     baseURL = mOverriddenBaseURI;
   }
 
-  NS_NewURI(aURI, href, charset.get(), baseURL);
+  nsCOMPtr<nsIURI> aURI;
+  NS_NewURI(getter_AddRefs(aURI), href, charset.get(), baseURL);
+  return aURI.forget();
 }
 
 void

content/xslt/src/xslt/txMozillaXMLOutput.cpp

@@ -480,7 +480,7 @@ txMozillaXMLOutput::startElement(nsIAtom* aPrefix,
         lname = do_GetAtom(aLocalName);
     }
 
-    // No biggie if we loose the prefix due to OOM
+    // No biggie if we lose the prefix due to OOM
     NS_ENSURE_TRUE(lname, NS_ERROR_OUT_OF_MEMORY);
 
     // Check that it's a valid name

db/mdb/public/mdb.h

@@ -1457,7 +1457,7 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIMdbStore, NS_IMDBSTORE_IID)
 **| current seed value (which implies the iteration is less than total) in
 **| between to cursor calls that actually access collection content.  By
 **| default, a cursor should assume this attribute is false until specified,
-**| so that iterations quietly try to re-sync when they loose coherence.
+**| so that iterations quietly try to re-sync when they lose coherence.
 |*/
 
 #define NS_IMDBCURSOR_IID_STR "a0c37337-6ebc-474c-90db-e65ea0b850aa"

dom/base/nsGlobalWindow.cpp

@@ -4883,7 +4883,7 @@ nsGlobalWindow::CheckForAbusePoint()
   
   nsCOMPtr<nsIDocShellTreeItem> item(do_QueryInterface(mDocShell));
 
-  NS_ASSERTION(item, "Docshell doesn't implenent nsIDocShellTreeItem?");
+  NS_ASSERTION(item, "Docshell doesn't implement nsIDocShellTreeItem?");
 
   PRInt32 type = nsIDocShellTreeItem::typeChrome;
   item->GetItemType(&type);

dom/tests/mochitest/general/test_offsets.xul

@@ -56,7 +56,7 @@
   </menupopup>
 </button>
 
-  <!-- test resuls are displayed in the html:body -->
+  <!-- test results are displayed in the html:body -->
   <body xmlns="http://www.w3.org/1999/xhtml" style="height: 300px; overflow: auto;"/>
 
   <!-- test code goes here -->

editor/txtsvc/public/nsIInlineSpellChecker.idl

@@ -43,7 +43,7 @@ interface nsISelection;
 interface nsIEditor;
 interface nsIEditorSpellCheck;
 
-[scriptable, uuid(074cd6ff-9118-4164-8da7-3c2d4b3ed38b)]
+[scriptable, uuid(07be036a-2355-4a92-b150-5c9b7e9fdf2f)]
 
 interface nsIInlineSpellChecker : nsISupports
 {
@@ -65,7 +65,7 @@ interface nsIInlineSpellChecker : nsISupports
 
   void spellCheckRange(in nsIDOMRange aSelection);
 
-  nsIDOMRange getMispelledWord(in nsIDOMNode aNode, in long aOffset);
+  nsIDOMRange getMisspelledWord(in nsIDOMNode aNode, in long aOffset);
   void replaceWord(in nsIDOMNode aNode, in long aOffset, in AString aNewword);
   void addWordToDictionary(in AString aWord);
   

embedding/base/nsIWindowProvider.idl

@@ -83,7 +83,7 @@ interface nsIWindowProvider : nsISupports
    * @param aURI The URI to be loaded in the new window.  The nsIWindowProvider
    *             implementation MUST NOT load this URI in the window it
    *             returns.  This URI is provided solely to help the
-   *             nsIWindowProvider implenentation make decisions; the caller
+   *             nsIWindowProvider implementation make decisions; the caller
    *             will handle loading the URI in the window returned if
    *             provideWindow returns a window.  Note that the URI may be null
    *             if the load cannot be represented by a single URI (e.g. if

embedding/browser/photon/src/EmbedPrivate.h

@@ -131,7 +131,7 @@ class EmbedPrivate {
 */
 
   // these let the widget code know when the toplevel window gets and
-  // looses focus.
+  // loses focus.
   void        TopLevelFocusIn (void);
   void        TopLevelFocusOut(void);
 

extensions/spellcheck/hunspell/src/suggestmgr.cpp

@@ -173,7 +173,7 @@ int SuggestMgr::testsug(char** wlst, const char * candidate, int wl, int ns, int
       return ns;
 }
 
-// generate suggestions for a mispelled word
+// generate suggestions for a misspelled word
 //    pass in address of array of char * pointers
 // onlycompoundsug: probably bad suggestions (need for ngram sugs, too)
 

extensions/spellcheck/src/mozInlineSpellChecker.cpp

@@ -813,11 +813,11 @@ mozInlineSpellChecker::SpellCheckRange(nsIDOMRange* aRange)
   return ScheduleSpellCheck(status);
 }
 
-// mozInlineSpellChecker::GetMispelledWord
+// mozInlineSpellChecker::GetMisspelledWord
 
 NS_IMETHODIMP
-mozInlineSpellChecker::GetMispelledWord(nsIDOMNode *aNode, PRInt32 aOffset,
-                                        nsIDOMRange **newword)
+mozInlineSpellChecker::GetMisspelledWord(nsIDOMNode *aNode, PRInt32 aOffset,
+                                         nsIDOMRange **newword)
 {
   NS_ENSURE_ARG_POINTER(aNode);
   nsCOMPtr<nsISelection> spellCheckSelection;
@@ -838,7 +838,7 @@ mozInlineSpellChecker::ReplaceWord(nsIDOMNode *aNode, PRInt32 aOffset,
   NS_ENSURE_TRUE(newword.Length() != 0, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDOMRange> range;
-  nsresult res = GetMispelledWord(aNode, aOffset, getter_AddRefs(range));
+  nsresult res = GetMisspelledWord(aNode, aOffset, getter_AddRefs(range));
   NS_ENSURE_SUCCESS(res, res); 
 
   if (range)

gfx/thebes/src/gfxFontUtils.cpp

@@ -38,7 +38,6 @@
 
 #include "gfxFontUtils.h"
 
-#include "nsIPref.h"  // for pref handling code
 #include "nsServiceManagerUtils.h"
 
 #include "nsIPrefBranch.h"

gfx/thebes/src/gfxPangoFonts.cpp

@@ -100,7 +100,7 @@ static cairo_scaled_font_t *CreateScaledFont(FcPattern *aPattern);
 
 static PangoFontMap *gPangoFontMap;
 static PangoFontMap *GetPangoFontMap();
-static PRBool gPangoFontHasFontMapProperty;
+static PRBool gUseFontMapProperty;
 
 static FT_Library gFTLibrary;
 static nsILanguageAtomService* gLangService;
@@ -141,6 +141,18 @@ ScaleRoundDesignUnits(FT_Short aDesignMetric, FT_Fixed aScale)
     return ROUND_26_6_TO_INT(fixed26dot6);
 }
 
+static PRFuncPtr
+FindFunctionSymbol(const char *name)
+{
+    PRLibrary *lib = nsnull;
+    PRFuncPtr result = PR_FindFunctionSymbolAndLibrary(name, &lib);
+    if (lib) {
+        PR_UnloadLibrary(lib);
+    }
+
+    return result;
+}
+
 // A namespace for @font-face family names in FcPatterns so that fontconfig
 // aliases do not pick up families from @font-face rules and so that
 // fontconfig rules can distinguish between web fonts and platform fonts.
@@ -365,23 +377,12 @@ typedef FcPattern* (*QueryFaceFunction)(const FT_Face face,
                                         const FcChar8 *file, int id,
                                         FcBlanks *blanks);
 
-static QueryFaceFunction
-GetFcFreeTypeQueryFace()
-{
-    PRLibrary *lib = nsnull;
-    PRFuncPtr result =
-        PR_FindFunctionSymbolAndLibrary("FcFreeTypeQueryFace", &lib);
-    if (lib) {
-        PR_UnloadLibrary(lib);
-    }
-
-    return reinterpret_cast<QueryFaceFunction>(result);
-}
-
 void
 gfxDownloadedFcFontEntry::InitPattern()
 {
-    static QueryFaceFunction sQueryFacePtr = GetFcFreeTypeQueryFace();
+    static QueryFaceFunction sQueryFacePtr =
+        reinterpret_cast<QueryFaceFunction>
+        (FindFunctionSymbol("FcFreeTypeQueryFace"));
     FcPattern *pattern;
 
     // FcFreeTypeQueryFace is the same function used to construct patterns for
@@ -649,15 +650,16 @@ struct gfxPangoFcFont {
         // would usually set this after calling PangoFcFontMap::create_font()
         // or new_font().)
         PangoFontMap *fontmap = GetPangoFontMap();
-        // In Pango-1.24, this is a property; by setting the property, the
-        // PangoFcFont base class manages the pointer (as a weak reference).
+        // In Pango-1.24.4, we can use the "fontmap" property; by setting the
+        // property, the PangoFcFont base class manages the pointer (as a weak
+        // reference).
         PangoFcFont *fc_font = &font->parent_instance;
-        if (gPangoFontHasFontMapProperty) {
+        if (gUseFontMapProperty) {
             g_object_set(font, "fontmap", fontmap, NULL);
         } else {
             // In Pango versions up to 1.20.5, the parent class will decrement
             // the reference count of the fontmap during shutdown() or
-            // finalize() of the font.  In Pango 1.22.x versions this no
+            // finalize() of the font.  In Pango versions from 1.22.0 this no
             // longer happens, so we'll end up leaking the (singleton)
             // fontmap.
             fc_font->fontmap = fontmap;
@@ -910,6 +912,8 @@ gfx_pango_fc_font_get_glyph(PangoFcFont *font, gunichar wc)
     return gfxFont->GetGlyph(wc);
 }
 
+typedef int (*PangoVersionFunction)();
+
 static void
 gfx_pango_fc_font_class_init (gfxPangoFcFontClass *klass)
 {
@@ -934,9 +938,17 @@ gfx_pango_fc_font_class_init (gfxPangoFcFontClass *klass)
     fc_font_class->unlock_face = gfx_pango_fc_font_unlock_face;
     fc_font_class->get_glyph = gfx_pango_fc_font_get_glyph;
 
-    gPangoFontHasFontMapProperty =
-        g_object_class_find_property(G_OBJECT_CLASS(gfx_pango_fc_font_parent_class),
-                                     "fontmap") != NULL;
+    // The "fontmap" property on PangoFcFont was introduced for Pango-1.24.0
+    // but versions prior to Pango-1.24.4 leaked weak pointers for every font,
+    // which would causes crashes when shutting down the FontMap.  For the
+    // early Pango-1.24.x versions we're better off setting the fontmap member
+    // ourselves, which will not create weak pointers to leak, and instead
+    // we'll leak the FontMap on shutdown.  pango_version() and
+    // PANGO_VERSION_ENCODE require Pango-1.16.
+    PangoVersionFunction pango_version =
+        reinterpret_cast<PangoVersionFunction>
+        (FindFunctionSymbol("pango_version"));
+    gUseFontMapProperty = pango_version && (*pango_version)() >= 12404;
 }
 
 /**
@@ -1098,24 +1110,13 @@ FindFontPatterns(gfxUserFontSet *mUserFontSet,
 typedef FcBool (*FcPatternRemoveFunction)(FcPattern *p, const char *object,
                                           int id);
 
-static FcPatternRemoveFunction
-GetFcPatternRemove()
-{
-    PRLibrary *lib = nsnull;
-    PRFuncPtr result =
-        PR_FindFunctionSymbolAndLibrary("FcPatternRemove", &lib);
-    if (lib) {
-        PR_UnloadLibrary(lib);
-    }
-
-    return reinterpret_cast<FcPatternRemoveFunction>(result);
-}
-
 // FcPatternRemove is available in fontconfig-2.3.0 (2005)
 static FcBool
 moz_FcPatternRemove(FcPattern *p, const char *object, int id)
 {
-    static FcPatternRemoveFunction sFcPatternRemovePtr = GetFcPatternRemove();
+    static FcPatternRemoveFunction sFcPatternRemovePtr =
+        reinterpret_cast<FcPatternRemoveFunction>
+        (FindFunctionSymbol("FcPatternRemove"));
 
     if (!sFcPatternRemovePtr)
         return FcFalse;

js/src/jsOS240.def

@@ -1,654 +0,0 @@
-; ***** BEGIN LICENSE BLOCK *****
-; Version: MPL 1.1/GPL 2.0/LGPL 2.1
-;
-; The contents of this file are subject to the Mozilla Public License Version
-; 1.1 (the "License"); you may not use this file except in compliance with
-; the License. You may obtain a copy of the License at
-; http://www.mozilla.org/MPL/
-;
-; Software distributed under the License is distributed on an "AS IS" basis,
-; WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-; for the specific language governing rights and limitations under the
-; License.
-;
-; The Original Code is Mozilla Communicator client code, released
-; March 31, 1998.
-;
-; The Initial Developer of the Original Code is
-; Netscape Communications Corporation.
-; Portions created by the Initial Developer are Copyright (C) 1998
-; the Initial Developer. All Rights Reserved.
-;
-; Contributor(s):
-;
-; Alternatively, the contents of this file may be used under the terms of
-; either of the GNU General Public License Version 2 or later (the "GPL"),
-; or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-; in which case the provisions of the GPL or the LGPL are applicable instead
-; of those above. If you wish to allow use of your version of this file only
-; under the terms of either the GPL or the LGPL, and not to allow others to
-; use your version of this file under the terms of the MPL, indicate your
-; decision by deleting the provisions above and replace them with the notice
-; and other provisions required by the GPL or the LGPL. If you do not delete
-; the provisions above, a recipient may use your version of this file under
-; the terms of any one of the MPL, the GPL or the LGPL.
-;
-; ***** END LICENSE BLOCK *****
-
-LIBRARY JS3240 INITINSTANCE TERMINSTANCE
-PROTMODE
-
-DESCRIPTION 'Netscape OS/2 JavaScript Library'
-
-
-CODE    LOADONCALL MOVEABLE DISCARDABLE
-DATA    PRELOAD MOVEABLE MULTIPLE NONSHARED
-
-
-EXPORTS
-;====================== win16 exports these at least... ===========
-;	JS_Init				= JS_Init		@2
-;	JS_Finish			= JS_Finish		@3
-;	JS_GetNaNValue
-;	JS_GetNegativeInfinityValue
-;	JS_GetPositiveInfinityValue
-;	JS_GetEmptyStringValue
-;	JS_ConvertValue
-;	JS_ValueToObject
-;	JS_ValueToFunction
-;	JS_ValueToString
-;	JS_ValueToNumber
-;	JS_ValueToBoolean
-;	JS_TypeOfValue
-;	JS_GetTypeName
-;	JS_Lock
-;	JS_Unlock
-;	JS_NewContext
-;	JS_DestroyContext
-;	JS_ContextIterator
-;	JS_GetGlobalObject
-;	JS_SetGlobalObject
-;	JS_InitStandardClasses
-;;	JS_GetStaticLink
-;	JS_malloc
-;	JS_realloc
-;	JS_free
-;	JS_strdup
-;	JS_NewDouble
-;	JS_NewDoubleValue
-;	JS_AddRoot
-;	JS_RemoveRoot
-;	JS_LockGCThing
-;	JS_UnlockGCThing
-;	JS_GC
-;	JS_PropertyStub
-;	JS_EnumerateStub
-;	JS_ResolveStub
-;	JS_ConvertStub
-;	JS_FinalizeStub
-;	JS_InitClass
-;	JS_GetClass
-;	JS_InstanceOf
-;	JS_GetPrivate
-;	JS_SetPrivate
-;	JS_GetInstancePrivate
-;	JS_GetPrototype
-;	JS_GetParent
-;	JS_SetParent
-;	JS_GetConstructor
-;	JS_NewObject
-;	JS_DefineObject
-;	JS_DefineConstDoubles
-;	JS_DefineProperties
-;	JS_DefineProperty
-;	JS_DefinePropertyWithTinyId
-;	JS_AliasProperty
-;	JS_LookupProperty
-;	JS_GetProperty
-;	JS_SetProperty
-;	JS_DeleteProperty
-;	JS_NewArrayObject
-;	JS_DefineElement
-;	JS_AliasElement
-;	JS_LookupElement
-;	JS_GetElement
-;	JS_SetElement
-;	JS_DeleteElement
-;	JS_ClearScope
-;	JS_NewFunction
-;	JS_GetFunctionObject
-;	JS_GetFunctionName
-;	JS_DefineFunctions
-;	JS_DefineFunction
-;	JS_CompileScript
-;	JS_DestroyScript
-;	JS_CompileFunction
-;	JS_DecompileScript
-;	JS_DecompileFunction
-;	JS_DecompileFunctionBody
-;	JS_ExecuteScript
-;	JS_EvaluateScript
-;	JS_CallFunction
-;	JS_CallFunctionName
-;	JS_CallFunctionValue
-;	JS_SetBranchCallback
-;	JS_IsRunning
-;	JS_IsConstructing
-;	JS_SetCallReturnValue2
-;	JS_NewString
-;	JS_NewStringCopyN
-;	JS_NewStringCopyZ
-;	JS_InternString
-;	JS_GetStringBytes
-;	JS_GetStringLength
-;	JS_CompareStrings
-;	JS_ReportError
-;	JS_ReportOutOfMemory
-;	JS_SetErrorReporter
-;	JS_NewRegExpObject
-;	JS_SetRegExpInput
-;	JS_ClearRegExpStatics
-;=================================================
-
-
-;00001:jsstr (OFFSET:0x00002e17, SIZE:0x0000ae17):
-; - Public Definitions:
-;     js_EmptySubString
-;     js_CompareStrings
-;     js_HashString
-;     js_ValueToString
-;     js_StringToObject
-;     js_FinalizeString
-;     js_NewStringCopyZ
-;     js_NewString
-;     js_InitStringClass
-;     js_NewStringCopyN
-;     js_BoyerMooreHorspool
-;
-;
-;00002:jsscript (OFFSET:0x0000dc2e, SIZE:0x00003abb):
-; - Public Definitions:
-;     js_LineNumberToPC
-;     js_PCToLineNumber
-;     js_GetSrcNote
-;     js_DestroyScript
-;     js_NewScript
-;
-;
-;00003:jsscope (OFFSET:0x000116e9, SIZE:0x00004f82):
-; - Public Definitions:
-;     js_hash_scope_ops
-;     js_list_scope_ops
-;     js_DestroyProperty
-;     js_NewProperty
-;     js_IdToValue
-;     js_HashValue
-;     js_DestroyScope
-;     js_MutateScope
-;     js_DropScope
-;     js_HoldScope
-;     js_NewScope
-;     js_GetMutableScope
-;     js_HoldProperty
-;     js_DropProperty
-;
-;
-;00004:jsscan (OFFSET:0x0001666b, SIZE:0x00008890):
-; - Public Definitions:
-;     js_MatchToken
-;     js_FlushNewlines
-;     js_PeekTokenSameLine
-;     js_UngetToken
-;     js_GetToken
-;     js_PeekToken
-;     js_ReportCompileError
-      js_CloseTokenStream
-      js_NewBufferTokenStream
-;     js_NewTokenStream
-;     js_InitScanner
-;
-;
-;00005:jsregexp (OFFSET:0x0001eefb, SIZE:0x0000eee4):
-; - Public Definitions:
-;     js_RegExpClass
-;     reopsize
-;     js_NewRegExpObject
-;     js_InitRegExpClass
-;     js_FreeRegExpStatics
-;     js_InitRegExpStatics
-;     js_ExecuteRegExp
-;     js_NewRegExpOpt
-;     js_DestroyRegExp
-;     js_NewRegExp
-;
-;
-;00006:jsparse (OFFSET:0x0002dddf, SIZE:0x00010b71):
-; - Public Definitions:
-;     js_ParseFunctionBody
-      js_Parse
-;
-;
-;00007:jsopcode (OFFSET:0x0003e950, SIZE:0x0000d362):
-; - Public Definitions:
-;     js_EscapeMap
-;     js_NumCodeSpecs
-;     js_CodeSpec
-;     js_incop_str
-;     js_true_str
-;     js_false_str
-;     js_this_str
-;     js_null_str
-;     js_void_str
-;     js_typeof_str
-;     js_delete_str
-;     js_new_str
-;     js_ValueToSource
-;     js_DecompileScript
-;     js_DecompileCode
-;     js_DecompileFunction
-;     js_puts
-;     js_printf
-;     js_GetPrinterOutput
-;     js_DestroyPrinter
-;     js_NewPrinter
-;     js_EscapeString
-;     js_Disassemble1
-;     js_Disassemble
-;
-;00008:jsobj (OFFSET:0x0004bcb2, SIZE:0x000090a4):
-; - Public Definitions:
-;     js_WithClass
-;     js_ObjectClass
-;     js_TryValueOf
-;     js_ValueToNonNullObject
-;     js_TryMethod
-;     js_ObjectToString
-;     js_SetClassPrototype
-;     js_DeleteProperty2
-;     js_DeleteProperty
-;     js_SetProperty
-;     js_GetProperty
-;     js_FindVariableScope
-;     js_FindVariable
-;     js_FindProperty
-;     js_LookupProperty
-;     js_DefineProperty
-;     js_FreeSlot
-;     js_AllocSlot
-;     js_FinalizeObject
-;     js_GetClassPrototype
-;     js_NewObject
-;     js_InitObjectClass
-;     js_ValueToObject
-;     js_obj_toString
-;     js_SetSlot
-;     js_GetSlot
-;
-;
-;00009:jsnum (OFFSET:0x00054d56, SIZE:0x00004f29):
-; - Public Definitions:
-;     js_ValueToInt32
-;     js_NumberToObject
-;     js_FinalizeDouble
-;     js_InitNumberClass
-;     js_NumberToString
-;     js_NewDoubleValue
-;     js_NewDouble
-;     js_ValueToNumber
-;
-;
-;00010:jsmath (OFFSET:0x00059c7f, SIZE:0x000054b6):
-; - Public Definitions:
-;     js_InitMathClass
-;
-;
-;00011:jsjava (OFFSET:0x0005f135, SIZE:0x00022aad):
-; - Public Definitions:
-;     js_Hooks
-;     MojaSrcLog
-;     finalizeTask
-      JSJ_FindCurrentJSContext
-;     JSJ_GetPrincipals
-      JSJ_IsSafeMethod
-      JSJ_InitContext
-      JSJ_Init
-      js_JSErrorToJException
-      js_JavaErrorReporter
-      js_RemoveReflection
-      js_ReflectJObjectToJSObject
-      js_convertJObjectToJSValue
-      js_convertJSValueToJObject
-      js_ReflectJSObjectToJObject
-;     js_ReflectJClassToJSObject
-      JSJ_ExitJS
-      JSJ_EnterJS
-      JSJ_CurrentContext
-      JSJ_IsEnabled
-;added in GA code - DSR70297
-      JSJ_Finish
-      JSJ_IsCalledFromJava
-      js_GetJSPrincipalsFromJavaCaller
-
-;
-;
-;00012:jsinterp (OFFSET:0x00081be2, SIZE:0x00012274):
-; - Public Definitions:
-;     js_Call
-;     js_Interpret
-;     js_SetLocalVariable
-;     js_GetLocalVariable
-;     js_SetArgument
-;     js_GetArgument
-;     js_FlushPropertyCacheByProp
-;     js_FlushPropertyCache
-;
-;
-;00013:jsgc (OFFSET:0x00093e56, SIZE:0x00004f8d):
-; - Public Definitions:
-;     js_ForceGC
-;     js_UnlockGCThing
-;     js_LockGCThing
-;     js_GC
-;     js_AllocGCThing
-;     js_RemoveRoot
-;     js_AddRoot
-;     js_FinishGC
-;     js_InitGC
-;
-;
-;00014:jsfun (OFFSET:0x00098de3, SIZE:0x0000977c):
-; - Public Definitions:
-;     js_FunctionClass
-;     js_ClosureClass
-;     js_CallClass
-;     js_DefineFunction
-;     js_NewFunction
-;     js_InitCallAndClosureClasses
-;     js_InitFunctionClass
-;     js_ValueToFunction
-;     js_SetCallVariable
-;     js_GetCallVariable
-;     js_PutCallObject
-;     js_GetCallObject
-;
-;
-;00015:jsemit (OFFSET:0x000a255f, SIZE:0x000077be):
-; - Public Definitions:
-;     js_SrcNoteName
-;     js_SrcNoteArity
-      js_FinishTakingSrcNotes
-;     js_MoveSrcNotes
-;     js_GetSrcNoteOffset
-;     js_BumpSrcNoteDelta
-;     js_NewSrcNote3
-;     js_NewSrcNote2
-;     js_PopStatement
-;     js_EmitContinue
-;     js_EmitBreak
-;     js_SetSrcNoteOffset
-;     js_NewSrcNote
-;     js_PushStatement
-;     js_MoveCode
-;     js_SetJumpOffset
-;     js_Emit3
-;     js_Emit2
-;     js_Emit1
-;     js_UpdateDepth
-;     js_SrcNoteLength
-;     js_CancelLastOpcode
-      js_InitCodeGenerator
-;
-;
-;00016:jsdbgapi (OFFSET:0x000a9d1d, SIZE:0x000057db):
-; - Public Definitions:
-;     js_watchpoint_list
-;     js_trap_list
-;     JS_SetAnnotationInFrame
-;     JS_GetAnnotationFromFrame
-;     JS_GetJSPrincipalArrayFromFrame
-;     JS_NextJSFrame
-;     JS_InitJSFrameIterator
-      JS_LineNumberToPC
-      JS_PCToLineNumber
-      JS_ClearAllWatchPoints
-      JS_ClearWatchPoint
-      JS_SetWatchPoint
-      JS_HandleTrap
-      JS_ClearAllTraps
-      JS_ClearScriptTraps
-      JS_ClearTrap
-      JS_GetTrapOpcode
-      JS_SetTrap
-;DSR070297 - added in GA code
-      JS_FrameIterator
-      JS_GetFrameAnnotation
-      JS_GetFramePrincipalArray
-      JS_GetFrameScript
-      JS_GetScriptFilename
-      JS_SetFrameAnnotation
-      JS_GetFramePC
-      JS_GetFunctionScript
-
-;
-;
-;00017:jsdate (OFFSET:0x000af4f8, SIZE:0x00009a8e):
-; - Public Definitions:
-      js_DateGetSeconds
-      js_DateGetMinutes
-      js_DateGetHours
-      js_DateGetDate
-      js_DateGetMonth
-      js_DateGetYear
-      js_NewDateObject
-;     js_InitDateClass
-;
-;
-;00018:jscntxt (OFFSET:0x000b8f86, SIZE:0x00003732):
-; - Public Definitions:
-;     js_InterpreterHooks
-;     js_ReportIsNotDefined
-;     js_ReportErrorAgain
-;     js_ReportErrorVA
-;     js_ContextIterator
-;     js_DestroyContext
-;     js_NewContext
-;     js_SetInterpreterHooks
-;
-;
-;00019:jsbool (OFFSET:0x000bc6b8, SIZE:0x00003375):
-; - Public Definitions:
-;     js_BooleanToString
-;     js_BooleanToObject
-;     js_InitBooleanClass
-;     js_ValueToBoolean
-;
-;
-;00020:jsatom (OFFSET:0x000bfa2d, SIZE:0x000058d0):
-; - Public Definitions:
-;     js_valueOf_str
-;     js_toString_str
-;     js_length_str
-;     js_eval_str
-;     js_constructor_str
-;     js_class_prototype_str
-;     js_assign_str
-;     js_anonymous_str
-;     js_Object_str
-;     js_Array_str
-;     js_type_str
-;     js_DropUnmappedAtoms
-      js_FreeAtomMap
-      js_InitAtomMap
-;     js_GetAtom
-;     js_DropAtom
-;     js_IndexAtom
-;     js_ValueToStringAtom
-;     js_AtomizeString
-;     js_AtomizeDouble
-;     js_AtomizeInt
-;     js_AtomizeBoolean
-;     js_AtomizeObject
-;     js_HoldAtom
-;     js_MarkAtomState
-;     js_FreeAtomState
-;     js_Atomize
-;     js_InitAtomState
-;
-;
-;00021:jsarray (OFFSET:0x000c52fd, SIZE:0x00007c86):
-; - Public Definitions:
-;     js_ArrayClass
-;     js_SetArrayLength
-;     js_GetArrayLength
-;     js_InitArrayClass
-;     js_NewArrayObject
-;     PR_qsort
-;
-;
-;00022:jsapi (OFFSET:0x000ccf83, SIZE:0x0000de8c):
-; - Public Definitions:
-      JS_ClearRegExpStatics
-      JS_SetRegExpInput
-      JS_NewRegExpObject
-      JS_SetErrorReporter
-      JS_CompareStrings
-      JS_GetStringLength
-      JS_GetStringBytes
-      JS_InternString
-      JS_NewStringCopyZ
-      JS_NewStringCopyN
-      JS_NewString
-      JS_IsRunning
-      JS_SetBranchCallback
-      JS_CallFunctionValue
-      JS_CallFunctionName
-      JS_CallFunction
-      JS_EvaluateScriptForPrincipals
-      JS_EvaluateScript
-      JS_ExecuteScript
-      JS_DecompileFunctionBody
-      JS_DecompileFunction
-      JS_DecompileScript
-      JS_CompileFunctionForPrincipals
-      JS_CompileFunction
-      JS_DestroyScript
-      JS_CompileScriptForPrincipals
-      JS_CompileScript
-      JS_DefineFunction
-      JS_GetFunctionName
-      JS_GetFunctionObject
-      JS_NewFunction
-      JS_ClearScope
-      JS_DeleteElement
-      JS_SetElement
-      JS_GetElement
-      JS_LookupElement
-      JS_AliasElement
-      JS_DefineElement
-      JS_SetArrayLength
-      JS_GetArrayLength
-      JS_NewArrayObject
-      JS_DeleteProperty
-      JS_SetProperty
-      JS_GetProperty
-      JS_LookupProperty
-      JS_AliasProperty
-      JS_DefinePropertyWithTinyId
-      JS_DefineProperty
-      JS_DefineConstDoubles
-      JS_DefineObject
-      JS_NewObject
-      JS_GetConstructor
-      JS_SetParent
-      JS_GetParent
-      JS_SetPrototype
-      JS_GetPrototype
-      JS_GetInstancePrivate
-      JS_SetPrivate
-      JS_GetPrivate
-      JS_InstanceOf
-      JS_GetClass
-      JS_DefineFunctions
-      JS_DefineProperties
-      JS_InitClass
-      JS_FinalizeStub
-      JS_ConvertStub
-      JS_ResolveStub
-      JS_EnumerateStub
-      JS_PropertyStub
-      JS_GC
-      JS_UnlockGCThing
-      JS_LockGCThing
-      JS_RemoveRoot
-      JS_AddRoot
-      JS_NewDoubleValue
-      JS_NewDouble
-      JS_strdup
-      JS_free
-      JS_realloc
-      JS_ReportOutOfMemory
-      JS_malloc
-      JS_GetScopeChain
-      JS_InitStandardClasses
-      JS_SetGlobalObject
-      JS_GetGlobalObject
-      JS_SetVersion
-      JS_GetVersion
-      JS_ContextIterator
-      JS_GetTaskState
-      JS_DestroyContext
-      JS_NewContext
-      JS_Unlock
-      JS_Lock
-      JS_Finish
-      JS_Init
-      JS_GetTypeName
-      JS_TypeOfValue
-      JS_ValueToBoolean
-      JS_ValueToInt32
-      JS_ValueToNumber
-      JS_ValueToString
-      JS_ValueToFunction
-      JS_ValueToObject
-      JS_ReportError
-      JS_ConvertValue
-      JS_GetEmptyStringValue
-      JS_GetPositiveInfinityValue
-      JS_GetNegativeInfinityValue
-      JS_GetNaNValue
-;DSR062897 - added for GA code
-      JS_MaybeGC
-      JS_GetScriptPrincipals
-      JS_IsAssigning
-      JS_SetCharSetInfo
-;brendan@mozilla.org, 2-Sept-2000
-      JS_SetCallReturnValue2
-      JS_SetGCCallback
-      JS_SetGCCallbackRT
-      JS_AddExternalStringFinalizer
-      JS_RemoveExternalStringFinalizer
-      JS_NewExternalString
-;
-;
-;00023:prmjtime (OFFSET:0x000dae0f, SIZE:0x00008986):
-; - Public Definitions:
-      PRMJ_FormatTimeUSEnglish
-      PRMJ_gmtime
-      PRMJ_FormatTime
-      PRMJ_mktime
-      PRMJ_ComputeTime
-      PRMJ_localtime
-      PRMJ_ExplodeTime
-      PRMJ_ToLocal
-      PRMJ_ToGMT
-      PRMJ_NowLocal
-      PRMJ_DSTOffset
-      PRMJ_NowS
-      PRMJ_NowMS
-      PRMJ_Now
-      PRMJ_ToExtendedTime
-      PRMJ_ToBaseTime
-      PRMJ_setDST
-      PRMJ_LocalGMTDifference
-
-

js/src/jsbit.h

@@ -78,7 +78,7 @@ extern JS_PUBLIC_API(JSIntn) JS_FloorLog2(JSUint32 i);
  *
  * SWS: Added MSVC intrinsic bitscan support.  See bugs 349364 and 356856.
  */
-#if defined(_WIN32) && (_MSC_VER >= 1300) && defined(_M_IX86)
+#if defined(_WIN32) && (_MSC_VER >= 1300) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
 
 unsigned char _BitScanForward(unsigned long * Index, unsigned long Mask);
 unsigned char _BitScanReverse(unsigned long * Index, unsigned long Mask);
@@ -104,6 +104,31 @@ __BitScanReverse32(unsigned int val)
 # define js_bitscan_clz32(val)  __BitScanReverse32(val)
 # define JS_HAS_BUILTIN_BITSCAN32
 
+#if defined(_M_AMD64) || defined(_M_X64)
+unsigned char _BitScanForward64(unsigned long * Index, unsigned __int64 Mask);
+unsigned char _BitScanReverse64(unsigned long * Index, unsigned __int64 Mask);
+# pragma intrinsic(_BitScanForward64,_BitScanReverse64)
+
+__forceinline static int
+__BitScanForward64(unsigned __int64 val)
+{
+    unsigned long idx;
+
+    _BitScanForward64(&idx, val);
+    return (int)idx;
+}
+__forceinline static int
+__BitScanReverse64(unsigned __int64 val)
+{
+    unsigned long idx;
+
+    _BitScanReverse64(&idx, val);
+    return (int)(63-idx);
+}
+# define js_bitscan_ctz64(val)  __BitScanForward64(val)
+# define js_bitscan_clz64(val)  __BitScanReverse64(val)
+# define JS_HAS_BUILTIN_BITSCAN64
+#endif
 #elif (__GNUC__ >= 4) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)
 
 # define js_bitscan_ctz32(val)  __builtin_ctz(val)

js/src/jslock.cpp

@@ -91,6 +91,19 @@ NativeCompareAndSwap(jsword *w, jsword ov, jsword nv)
     return (NativeCompareAndSwapHelper(w, ov, nv) & 1);
 }
 
+#elif defined(_MSC_VER) && (defined(_M_AMD64) || defined(_M_X64))
+JS_BEGIN_EXTERN_C
+extern long long __cdecl
+_InterlockedCompareExchange64(long long *volatile dest, long long exchange, long long comp);
+JS_END_EXTERN_C
+#pragma intrinsic(_InterlockedCompareExchange64)
+
+static JS_ALWAYS_INLINE int
+NativeCompareAndSwap(jsword *w, jsword ov, jsword nv)
+{
+    return _InterlockedCompareExchange64(w, nv, ov) == ov;
+}
+
 #elif defined(XP_MACOSX) || defined(DARWIN)
 
 #include <libkern/OSAtomic.h>

js/src/jslock.h

@@ -55,6 +55,7 @@ JS_BEGIN_EXTERN_C
 #ifdef JS_THREADSAFE
 
 #if (defined(_WIN32) && defined(_M_IX86)) ||                                  \
+    (defined(_WIN64) && (defined(_M_AMD64) || defined(_M_X64))) ||            \
     (defined(__i386) && (defined(__GNUC__) || defined(__SUNPRO_CC))) ||       \
     (defined(__x86_64) && (defined(__GNUC__) || defined(__SUNPRO_CC))) ||     \
     (defined(__sparc) && (defined(__GNUC__) || defined(__SUNPRO_CC))) ||      \

js/src/xpconnect/idl/nsIXPConnect.idl

@@ -252,7 +252,7 @@ interface nsIXPConnectWrappedJS : nsIXPConnectJSObjectHolder
  *
  * That activity is...
  *
- * When JavaScript code uses a component that is itself implemeted in
+ * When JavaScript code uses a component that is itself implemented in
  * JavaScript then XPConnect will build a wrapper rather than directly
  * expose the JSObject of the component. This allows components implemented
  * in JavaScript to 'look' just like any other xpcom component (from the

js/src/xpconnect/tools/src/xpctools_private.h

@@ -223,7 +223,7 @@ private:
     JSBool VerifyRuntime();
 
     /* Taking the unusual step of making all data public to simplify
-    *  the implemetation of the "C" static debugger hooks.  
+    *  the implementation of the "C" static debugger hooks.  
     */
 
 public:

layout/base/nsCSSFrameConstructor.h

@@ -81,6 +81,98 @@ typedef void (nsLazyFrameConstructionCallback)
 class nsFrameConstructorState;
 class nsFrameConstructorSaveState;
   
+// Structure used when constructing formatting object trees.
+struct nsFrameItems : public nsFrameList {
+  nsIFrame* lastChild;
+  
+  nsFrameItems(nsIFrame* aFrame = nsnull);
+
+  nsFrameItems(const nsFrameList& aList, nsIFrame* aLastChild) :
+    nsFrameList(aList),
+    lastChild(aLastChild)
+  {
+    NS_ASSERTION(LastChild() == lastChild, "Bogus aLastChild");
+  }
+
+  // Appends the frame to the end of the list
+  void AddChild(nsIFrame* aChild);
+
+  void InsertFrame(nsIFrame* aParent, nsIFrame* aPrevSibling,
+                   nsIFrame* aNewFrame) {
+    nsFrameList::InsertFrame(aParent, aPrevSibling, aNewFrame);
+    if (aPrevSibling == lastChild) {
+      lastChild = aNewFrame;
+    }
+  }
+
+  void InsertFrames(nsIFrame* aParent, nsIFrame* aPrevSibling,
+                    nsFrameItems& aFrames) {
+    nsFrameList::InsertFrames(aParent, aPrevSibling, aFrames);
+    if (aPrevSibling == lastChild) {
+      lastChild = aFrames.lastChild;
+    }
+  }
+
+  void DestroyFrame(nsIFrame* aFrameToDestroy, nsIFrame* aPrevSibling) {
+    NS_PRECONDITION((!aPrevSibling && aFrameToDestroy == FirstChild()) ||
+                    aPrevSibling->GetNextSibling() == aFrameToDestroy,
+                    "Unexpected prevsibling");
+    nsFrameList::DestroyFrame(aFrameToDestroy, aPrevSibling);
+    if (aFrameToDestroy == lastChild) {
+      lastChild = aPrevSibling;
+    }
+  }
+
+  PRBool RemoveFrame(nsIFrame* aFrameToRemove, nsIFrame* aPrevSibling) {
+    NS_PRECONDITION(!aPrevSibling ||
+                    aPrevSibling->GetNextSibling() == aFrameToRemove,
+                    "Unexpected aPrevSibling");
+    if (!aPrevSibling) {
+      aPrevSibling = GetPrevSiblingFor(aFrameToRemove);
+    }
+
+    PRBool removed = nsFrameList::RemoveFrame(aFrameToRemove, aPrevSibling);
+
+    if (aFrameToRemove == lastChild) {
+      lastChild = aPrevSibling;
+    }
+
+    return removed;
+  }
+
+  nsFrameItems ExtractHead(FrameLinkEnumerator& aLink) {
+    nsIFrame* newLastChild = aLink.PrevFrame();
+    if (lastChild && aLink.NextFrame() == lastChild) {
+      lastChild = nsnull;
+    }
+    return nsFrameItems(nsFrameList::ExtractHead(aLink),
+                        newLastChild);
+  }
+
+  nsFrameItems ExtractTail(FrameLinkEnumerator& aLink) {
+    nsIFrame* newLastChild = lastChild;
+    lastChild = aLink.PrevFrame();
+    return nsFrameItems(nsFrameList::ExtractTail(aLink),
+                        newLastChild);
+  }
+
+  void Clear() {
+    nsFrameList::Clear();
+    lastChild = nsnull;
+  }
+
+private:
+  // Not implemented; shouldn't be called
+  void SetFrames(nsIFrame* aFrameList);
+  void AppendFrames(nsIFrame* aParent, nsIFrame* aFrameList);
+  Slice AppendFrames(nsIFrame* aParent, nsFrameList& aFrameList);
+  void AppendFrame(nsIFrame* aParent, nsIFrame* aFrame);
+  PRBool RemoveFirstChild();
+  void InsertFrames(nsIFrame* aParent, nsIFrame* aPrevSibling,
+                    nsIFrame* aFrameList);
+  void SortByContentOrder();
+};
+
 class nsCSSFrameConstructor
 {
 public:
@@ -1409,7 +1501,7 @@ private:
    *
    * @param aState the frame construction state we're using right now.
    * @param aExistingEndFrame the already-existing end frame.
-   * @param aFramesToMove The frame list to move over
+   * @param aFramesToMove The frame list to move over.  Must be nonempty.
    * @param aBlockPart the block part of the {ib} split.
    * @param aTargetState if non-null, the target state to pass to
    *        MoveChildrenTo for float reparenting.
@@ -1417,7 +1509,7 @@ private:
    */
   void MoveFramesToEndOfIBSplit(nsFrameConstructorState& aState,
                                 nsIFrame* aExistingEndFrame,
-                                nsIFrame* aFramesToMove,
+                                nsFrameItems& aFramesToMove,
                                 nsIFrame* aBlockPart,
                                 nsFrameConstructorState* aTargetState);
 
@@ -1530,11 +1622,21 @@ private:
 
   // Methods support :first-line style
 
+  // This method chops the initial inline-outside frames out of aFrameItems.
+  // If aLineFrame is non-null, it appends them to that frame.  Otherwise, it
+  // creates a new line frame, sets the inline frames as its initial child
+  // list, and inserts that line frame at the front of what's left of
+  // aFrameItems.  In both cases, the kids are reparented to the line frame.
+  // After this call, aFrameItems holds the frames that need to become kids of
+  // the block (possibly including line frames).
   nsresult WrapFramesInFirstLineFrame(nsFrameConstructorState& aState,
                                       nsIContent*              aBlockContent,
                                       nsIFrame*                aBlockFrame,
+                                      nsIFrame*                aLineFrame,
                                       nsFrameItems&            aFrameItems);
 
+  // Handle the case when a block with first-line style is appended to (by
+  // possibly calling WrapFramesInFirstLineFrame as needed).
   nsresult AppendFirstLineFrames(nsFrameConstructorState& aState,
                                  nsIContent*              aContent,
                                  nsIFrame*                aBlockFrame,

layout/base/nsDisplayList.cpp

@@ -220,12 +220,12 @@ nsDisplayListBuilder::LeavePresShell(nsIFrame* aReferenceFrame,
 }
 
 void
-nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame* aDirtyFrame, nsIFrame* aFrames,
+nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame* aDirtyFrame,
+                                               const nsFrameList& aFrames,
                                                const nsRect& aDirtyRect) {
-  while (aFrames) {
-    mFramesMarkedForDisplay.AppendElement(aFrames);
-    MarkOutOfFlowFrameForDisplay(aDirtyFrame, aFrames, aDirtyRect);
-    aFrames = aFrames->GetNextSibling();
+  for (nsFrameList::Enumerator e(aFrames); !e.AtEnd(); e.Next()) {
+    mFramesMarkedForDisplay.AppendElement(e.get());
+    MarkOutOfFlowFrameForDisplay(aDirtyFrame, e.get(), aDirtyRect);
   }
 }
 
@@ -1062,7 +1062,7 @@ nsDisplayWrapList* nsDisplayClip::WrapWithClone(nsDisplayListBuilder* aBuilder,
 // Write #define UNIFIED_CONTINUATIONS here to have the transform property try
 // to transform content with continuations as one unified block instead of
 // several smaller ones.  This is currently disabled because it doesn't work
-// correctly, since when the frames are initially being reflown, their
+// correctly, since when the frames are initially being reflowed, their
 // continuations all compute their bounding rects independently of each other
 // and consequently get the wrong value.  Write #define DEBUG_HIT here to have
 // the nsDisplayTransform class dump out a bunch of information about hit

layout/base/nsDisplayList.h

@@ -277,14 +277,15 @@ public:
   void SetInTransform(PRBool aInTransform) { mInTransform = aInTransform; }
 
   /**
-   * Mark aFrames and its (next) siblings to be displayed if they
-   * intersect aDirtyRect (which is relative to aDirtyFrame). If the
-   * frame(s) have placeholders that might not be displayed, we mark the
-   * placeholders and their ancestors to ensure that display list construction
-   * descends into them anyway. nsDisplayListBuilder will take care of
-   * unmarking them when it is destroyed.
+   * Mark the frames in aFrames to be displayed if they intersect aDirtyRect
+   * (which is relative to aDirtyFrame). If the frames have placeholders
+   * that might not be displayed, we mark the placeholders and their ancestors
+   * to ensure that display list construction descends into them
+   * anyway. nsDisplayListBuilder will take care of unmarking them when it is
+   * destroyed.
    */
-  void MarkFramesForDisplayList(nsIFrame* aDirtyFrame, nsIFrame* aFrames,
+  void MarkFramesForDisplayList(nsIFrame* aDirtyFrame,
+                                const nsFrameList& aFrames,
                                 const nsRect& aDirtyRect);
   
   /**

layout/base/nsFrameManager.cpp

@@ -1398,7 +1398,7 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
               // the frame where we started the reresolve.  Therefore, even if
               // aMinChange already includes nsChangeHint_ReflowFrame we don't
               // want to pass that on to the out-of-flow reresolve, since that
-              // can lead to the out-of-flow not getting reflown when it should
+              // can lead to the out-of-flow not getting reflowed when it should
               // be (eg a reresolve starting at <body> that involves reflowing
               // the <body> would miss reflowing fixed-pos nodes that also need
               // reflow).  In the cases when the out-of-flow _is_ a geometric

layout/base/nsLayoutUtils.cpp

@@ -2753,8 +2753,6 @@ DrawImageInternal(nsIRenderingContext* aRenderingContext,
 {
   if (aDest.IsEmpty() || aFill.IsEmpty())
     return NS_OK;
-  if (aImageSize.width == 0 || aImageSize.height == 0)
-    return NS_OK;
 
   nsCOMPtr<nsIDeviceContext> dc;
   aRenderingContext->GetDeviceContext(*getter_AddRefs(dc));
@@ -2853,21 +2851,21 @@ DrawImageInternal(nsIRenderingContext* aRenderingContext,
   return NS_OK;
 }
 
-/* Workhorse for DrawSingleUnscaledImage.  */
-static nsresult
-DrawSingleUnscaledImageInternal(nsIRenderingContext* aRenderingContext,
-                                imgIContainer*       aImage,
-                                const nsPoint&       aDest,
-                                const nsRect&        aDirty,
-                                const nsRect*        aSourceArea,
-                                const nsIntSize&     aImageSize)
+/* static */ nsresult
+nsLayoutUtils::DrawSingleUnscaledImage(nsIRenderingContext* aRenderingContext,
+                                       imgIContainer*       aImage,
+                                       const nsPoint&       aDest,
+                                       const nsRect&        aDirty,
+                                       const nsRect*        aSourceArea)
 {
-  if (aImageSize.width == 0 || aImageSize.height == 0)
-    return NS_OK;
+  nsIntSize imageSize;
+  aImage->GetWidth(&imageSize.width);
+  aImage->GetHeight(&imageSize.height);
+  NS_ENSURE_TRUE(imageSize.width > 0 && imageSize.height > 0, NS_ERROR_FAILURE);
 
   nscoord appUnitsPerCSSPixel = nsIDeviceContext::AppUnitsPerCSSPixel();
-  nsSize size(aImageSize.width*appUnitsPerCSSPixel,
-              aImageSize.height*appUnitsPerCSSPixel);
+  nsSize size(imageSize.width*appUnitsPerCSSPixel,
+              imageSize.height*appUnitsPerCSSPixel);
 
   nsRect source;
   if (aSourceArea) {
@@ -2883,77 +2881,7 @@ DrawSingleUnscaledImageInternal(nsIRenderingContext* aRenderingContext,
   // translation but we don't want to actually tile the image.
   fill.IntersectRect(fill, dest);
   return DrawImageInternal(aRenderingContext, aImage, gfxPattern::FILTER_NEAREST,
-                           dest, fill, aDest, aDirty, aImageSize);
-}
-
-/* Workhorse for DrawSingleImage.  */
-static nsresult
-DrawSingleImageInternal(nsIRenderingContext* aRenderingContext,
-                        imgIContainer*       aImage,
-                        gfxPattern::GraphicsFilter aGraphicsFilter,
-                        const nsRect&        aDest,
-                        const nsRect&        aDirty,
-                        const nsRect*        aSourceArea,
-                        const nsIntSize&     aImageSize)
-{
-  if (aImageSize.width == 0 || aImageSize.height == 0)
-    return NS_OK;
-
-  nsRect source;
-  if (aSourceArea) {
-    source = *aSourceArea;
-  } else {
-    nscoord appUnitsPerCSSPixel = nsIDeviceContext::AppUnitsPerCSSPixel();
-    source.SizeTo(aImageSize.width*appUnitsPerCSSPixel,
-                  aImageSize.height*appUnitsPerCSSPixel);
-  }
-
-  nsRect dest = nsLayoutUtils::GetWholeImageDestination(aImageSize, source,
-                                                        aDest);
-  // Ensure that only a single image tile is drawn. If aSourceArea extends
-  // outside the image bounds, we want to honor the aSourceArea-to-aDest
-  // transform but we don't want to actually tile the image.
-  nsRect fill;
-  fill.IntersectRect(aDest, dest);
-  return DrawImageInternal(aRenderingContext, aImage, aGraphicsFilter, dest, fill,
-                           fill.TopLeft(), aDirty, aImageSize);
-}
-
-/* The exposed Draw*Image functions just do interface conversion and call the
-   appropriate Draw*ImageInternal workhorse.  */
-
-/* static */ nsresult
-nsLayoutUtils::DrawImage(nsIRenderingContext* aRenderingContext,
-                         imgIContainer*       aImage,
-                         gfxPattern::GraphicsFilter aGraphicsFilter,
-                         const nsRect&        aDest,
-                         const nsRect&        aFill,
-                         const nsPoint&       aAnchor,
-                         const nsRect&        aDirty)
-{
-  nsIntSize imageSize;
-  aImage->GetWidth(&imageSize.width);
-  aImage->GetHeight(&imageSize.height);
-
-  return DrawImageInternal(aRenderingContext, aImage, aGraphicsFilter,
-                           aDest, aFill, aAnchor, aDirty,
-                           imageSize);
-}
-
-/* static */ nsresult
-nsLayoutUtils::DrawSingleUnscaledImage(nsIRenderingContext* aRenderingContext,
-                                       imgIContainer*       aImage,
-                                       const nsPoint&       aDest,
-                                       const nsRect&        aDirty,
-                                       const nsRect*        aSourceArea)
-{
-  nsIntSize imageSize;
-  aImage->GetWidth(&imageSize.width);
-  aImage->GetHeight(&imageSize.height);
-
-  return DrawSingleUnscaledImageInternal(aRenderingContext, aImage,
-                                         aDest, aDirty, aSourceArea,
-                                         imageSize);
+                           dest, fill, aDest, aDirty, imageSize);
 }
  
 /* static */ nsresult
@@ -2967,10 +2895,45 @@ nsLayoutUtils::DrawSingleImage(nsIRenderingContext* aRenderingContext,
   nsIntSize imageSize;
   aImage->GetWidth(&imageSize.width);
   aImage->GetHeight(&imageSize.height);
+  NS_ENSURE_TRUE(imageSize.width > 0 && imageSize.height > 0, NS_ERROR_FAILURE);
 
-  return DrawSingleImageInternal(aRenderingContext, aImage, aGraphicsFilter,
-                                 aDest, aDirty, aSourceArea,
-                                 imageSize);
+  nsRect source;
+  if (aSourceArea) {
+    source = *aSourceArea;
+  } else {
+    nscoord appUnitsPerCSSPixel = nsIDeviceContext::AppUnitsPerCSSPixel();
+    source.SizeTo(imageSize.width*appUnitsPerCSSPixel,
+                  imageSize.height*appUnitsPerCSSPixel);
+  }
+
+  nsRect dest = nsLayoutUtils::GetWholeImageDestination(imageSize, source,
+                                                        aDest);
+  // Ensure that only a single image tile is drawn. If aSourceArea extends
+  // outside the image bounds, we want to honor the aSourceArea-to-aDest
+  // transform but we don't want to actually tile the image.
+  nsRect fill;
+  fill.IntersectRect(aDest, dest);
+  return DrawImageInternal(aRenderingContext, aImage, aGraphicsFilter, dest, fill,
+                           fill.TopLeft(), aDirty, imageSize);
+}
+
+/* static */ nsresult
+nsLayoutUtils::DrawImage(nsIRenderingContext* aRenderingContext,
+                         imgIContainer*       aImage,
+                         gfxPattern::GraphicsFilter aGraphicsFilter,
+                         const nsRect&        aDest,
+                         const nsRect&        aFill,
+                         const nsPoint&       aAnchor,
+                         const nsRect&        aDirty)
+{
+  nsIntSize imageSize;
+  aImage->GetWidth(&imageSize.width);
+  aImage->GetHeight(&imageSize.height);
+  NS_ENSURE_TRUE(imageSize.width > 0 && imageSize.height > 0, NS_ERROR_FAILURE);
+
+  return DrawImageInternal(aRenderingContext, aImage, aGraphicsFilter,
+                           aDest, aFill, aAnchor, aDirty,
+                           imageSize);
 }
 
 /* static */ nsRect

layout/base/nsPresShell.cpp

@@ -4597,7 +4597,7 @@ PresShell::CaptureHistoryState(nsILayoutHistoryState** aState, PRBool aLeavingPa
   if (!rootFrame) return NS_OK;
   // Capture frame state for the root scroll frame
   // Don't capture state when first creating doc element hierarchy
-  // As the scroll position is 0 and this will cause us to loose
+  // As the scroll position is 0 and this will cause us to lose
   // our previously saved place!
   if (aLeavingPage) {
     nsIFrame* scrollFrame = GetRootScrollFrame();
@@ -7659,13 +7659,14 @@ CompareTrees(nsPresContext* aFirstPresContext, nsIFrame* aFirstFrame,
   nsIAtom* listName = nsnull;
   PRInt32 listIndex = 0;
   do {
-    nsIFrame* k1 = aFirstFrame->GetFirstChild(listName);
-    nsIFrame* k2 = aSecondFrame->GetFirstChild(listName);
-    PRInt32 l1 = nsContainerFrame::LengthOf(k1);
-    PRInt32 l2 = nsContainerFrame::LengthOf(k2);
+    const nsFrameList& kids1 = aFirstFrame->GetChildList(listName);
+    const nsFrameList& kids2 = aSecondFrame->GetChildList(listName);
+    PRInt32 l1 = kids1.GetLength();
+    PRInt32 l2 = kids2.GetLength();;
     if (l1 != l2) {
       ok = PR_FALSE;
-      LogVerifyMessage(k1, k2, "child counts don't match: ");
+      LogVerifyMessage(kids1.FirstChild(), kids2.FirstChild(),
+                       "child counts don't match: ");
       printf("%d != %d\n", l1, l2);
       if (0 == (VERIFY_REFLOW_ALL & gVerifyReflowFlags)) {
         break;
@@ -7674,7 +7675,11 @@ CompareTrees(nsPresContext* aFirstPresContext, nsIFrame* aFirstFrame,
 
     nsIntRect r1, r2;
     nsIView* v1, *v2;
-    for (;;) {
+    for (nsFrameList::Enumerator e1(kids1), e2(kids2);
+         ;
+         e1.Next(), e2.Next()) {
+      nsIFrame* k1 = e1.get();
+      nsIFrame* k2 = e2.get();
       if (((nsnull == k1) && (nsnull != k2)) ||
           ((nsnull != k1) && (nsnull == k2))) {
         ok = PR_FALSE;
@@ -7732,10 +7737,6 @@ CompareTrees(nsPresContext* aFirstPresContext, nsIFrame* aFirstFrame,
             break;
           }
         }
-
-        // Advance to next sibling
-        k1 = k1->GetNextSibling();
-        k2 = k2->GetNextSibling();
       }
       else {
         break;
@@ -7752,7 +7753,8 @@ CompareTrees(nsPresContext* aFirstPresContext, nsIFrame* aFirstFrame,
       if (0 == (VERIFY_REFLOW_ALL & gVerifyReflowFlags)) {
         ok = PR_FALSE;
       }
-      LogVerifyMessage(k1, k2, "child list names are not matched: ");
+      LogVerifyMessage(kids1.FirstChild(), kids2.FirstChild(),
+                       "child list names are not matched: ");
       nsAutoString tmp;
       if (nsnull != listName1) {
         listName1->ToString(tmp);

layout/base/nsStyleSheetService.h

@@ -80,7 +80,7 @@ class nsStyleSheetService : public nsIStyleSheetService
   NS_HIDDEN_(PRInt32) FindSheetByURI(const nsCOMArray<nsIStyleSheet> &sheets,
                                      nsIURI *sheetURI);
 
-  // Like LoadAndRegisterSheet, but doesn't notify.  If succesful, the
+  // Like LoadAndRegisterSheet, but doesn't notify.  If successful, the
   // new sheet will be the last sheet in mSheets[aSheetType].
   NS_HIDDEN_(nsresult) LoadAndRegisterSheetInternal(nsIURI *aSheetURI,
                                                     PRUint32 aSheetType);

layout/build/nsLayoutStatics.cpp

@@ -85,6 +85,7 @@
 #include "nsHtml5Module.h"
 #include "nsCrossSiteListenerProxy.h"
 #include "nsFocusManager.h"
+#include "nsFrameList.h"
 
 #ifdef MOZ_XUL
 #include "nsXULPopupManager.h"
@@ -279,6 +280,12 @@ nsLayoutStatics::Initialize()
   
   nsCrossSiteListenerProxy::Startup();
 
+  rv = nsFrameList::Init();
+  if (NS_FAILED(rv)) {
+    NS_ERROR("Could not initialize nsFrameList");
+    return rv;
+  }
+
   return NS_OK;
 }
 
@@ -368,6 +375,8 @@ nsLayoutStatics::Shutdown()
   nsHtml5Module::ReleaseStatics();
 
   NS_ShutdownChainItemPool();
+
+  nsFrameList::Shutdown();
 }
 
 void

layout/forms/nsComboboxControlFrame.cpp

@@ -1196,7 +1196,8 @@ nsComboboxControlFrame::CreateFrameFor(nsIContent*      aContent)
     return nsnull;
   }
 
-  mDisplayFrame->SetInitialChildList(nsnull, mTextFrame);
+  nsFrameList textList(mTextFrame);
+  mDisplayFrame->SetInitialChildList(nsnull, textList);
   return mDisplayFrame;
 }
 
@@ -1230,34 +1231,33 @@ nsComboboxControlFrame::Destroy()
 }
 
 
-nsIFrame*
-nsComboboxControlFrame::GetFirstChild(nsIAtom* aListName) const
+nsFrameList
+nsComboboxControlFrame::GetChildList(nsIAtom* aListName) const
 {
   if (nsGkAtoms::selectPopupList == aListName) {
-    return mPopupFrames.FirstChild();
+    return mPopupFrames;
   }
-  return nsBlockFrame::GetFirstChild(aListName);
+  return nsBlockFrame::GetChildList(aListName);
 }
 
 NS_IMETHODIMP
 nsComboboxControlFrame::SetInitialChildList(nsIAtom*        aListName,
-                                            nsIFrame*       aChildList)
+                                            nsFrameList&    aChildList)
 {
   nsresult rv = NS_OK;
   if (nsGkAtoms::selectPopupList == aListName) {
     mPopupFrames.SetFrames(aChildList);
   } else {
-    rv = nsBlockFrame::SetInitialChildList(aListName, aChildList);
-
-    for (nsIFrame * child = aChildList; child;
-         child = child->GetNextSibling()) {
-      nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(child->GetContent());
+    for (nsFrameList::Enumerator e(aChildList); !e.AtEnd(); e.Next()) {
+      nsCOMPtr<nsIFormControl> formControl =
+        do_QueryInterface(e.get()->GetContent());
       if (formControl && formControl->GetType() == NS_FORM_INPUT_BUTTON) {
-        mButtonFrame = child;
+        mButtonFrame = e.get();
         break;
       }
     }
     NS_ASSERTION(mButtonFrame, "missing button frame in initial child list");
+    rv = nsBlockFrame::SetInitialChildList(aListName, aChildList);
   }
   return rv;
 }

layout/forms/nsComboboxControlFrame.h

@@ -141,9 +141,9 @@ public:
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
   virtual void Destroy();
-  virtual nsIFrame* GetFirstChild(nsIAtom* aListName) const;
+  virtual nsFrameList GetChildList(nsIAtom* aListName) const;
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
   virtual nsIAtom* GetAdditionalChildListName(PRInt32 aIndex) const;
 
   virtual nsIFrame* GetContentInsertionFrame();

layout/forms/nsFieldSetFrame.cpp

@@ -70,7 +70,7 @@ public:
   nsFieldSetFrame(nsStyleContext* aContext);
 
   NS_IMETHOD SetInitialChildList(nsIAtom*       aListName,
-                                 nsIFrame*      aChildList);
+                                 nsFrameList&   aChildList);
 
   NS_HIDDEN_(nscoord)
     GetIntrinsicWidth(nsIRenderingContext* aRenderingContext,
@@ -154,14 +154,15 @@ nsFieldSetFrame::IsContainingBlock() const
 
 NS_IMETHODIMP
 nsFieldSetFrame::SetInitialChildList(nsIAtom*       aListName,
-                                     nsIFrame*      aChildList)
+                                     nsFrameList&   aChildList)
 {
   // Get the content and legend frames.
-  if (aChildList->GetNextSibling()) {
-    mContentFrame = aChildList->GetNextSibling();
-    mLegendFrame  = aChildList;
+  if (!aChildList.OnlyChild()) {
+    NS_ASSERTION(aChildList.GetLength() == 2, "Unexpected child list");
+    mContentFrame = aChildList.LastChild();
+    mLegendFrame  = aChildList.FirstChild();
   } else {
-    mContentFrame = aChildList;
+    mContentFrame = aChildList.FirstChild();
     mLegendFrame  = nsnull;
   }
 

layout/forms/nsGfxButtonControlFrame.cpp

@@ -149,7 +149,6 @@ nsGfxButtonControlFrame::CreateFrameFor(nsIContent*      aContent)
       if (newFrame) {
         // initialize the text frame
         newFrame->Init(mTextContent, parentFrame, nsnull);
-        newFrame->SetInitialChildList(nsnull, nsnull);
       }
     }
   }

layout/forms/nsListControlFrame.cpp

@@ -1094,7 +1094,7 @@ nsListControlFrame::HandleEvent(nsPresContext* aPresContext,
 //---------------------------------------------------------
 NS_IMETHODIMP
 nsListControlFrame::SetInitialChildList(nsIAtom*       aListName,
-                                        nsIFrame*      aChildList)
+                                        nsFrameList&   aChildList)
 {
   // First check to see if all the content has been added
   mIsAllContentHere = mContent->IsDoneAddingChildren();

layout/forms/nsListControlFrame.h

@@ -85,7 +85,7 @@ public:
                          nsEventStatus* aEventStatus);
   
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
 
   virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);

layout/forms/nsTextControlFrame.cpp

@@ -2742,7 +2742,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
 
 NS_IMETHODIMP
 nsTextControlFrame::SetInitialChildList(nsIAtom*        aListName,
-                                        nsIFrame*       aChildList)
+                                        nsFrameList&    aChildList)
 {
   nsresult rv = nsBoxFrame::SetInitialChildList(aListName, aChildList);
 

layout/forms/nsTextControlFrame.h

@@ -127,7 +127,7 @@ public:
   // In that case the method returns an error value.
   nsresult SetValue(const nsAString& aValue);
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
 
 //==== BEGIN NSIFORMCONTROLFRAME
   virtual void SetFocus(PRBool aOn , PRBool aRepaint); 

layout/generic/crashtests/505912-1.html

@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="document.getElementById('x').style.visibility = 'hidden';">
+<embed id="x" type="application/x-test" wmode="window"></embed>
+</body>
+</html>

layout/generic/crashtests/crashtests.list

@@ -235,3 +235,4 @@ load 479938-1.html
 load 480345-1.html
 load 494332-1.html
 load 501535-1.html
+load 505912-1.html

layout/generic/nsAbsoluteContainingBlock.cpp

@@ -55,7 +55,7 @@
 nsresult
 nsAbsoluteContainingBlock::SetInitialChildList(nsIFrame*       aDelegatingFrame,
                                                nsIAtom*        aListName,
-                                               nsIFrame*       aChildList)
+                                               nsFrameList&    aChildList)
 {
   NS_PRECONDITION(GetChildListName() == aListName, "unexpected child list name");
 #ifdef NS_DEBUG

layout/generic/nsAbsoluteContainingBlock.h

@@ -84,11 +84,11 @@ public:
   nsIAtom* GetChildListName() const { return mChildListName; }
 #endif
 
-  nsIFrame* GetFirstChild() const { return mAbsoluteFrames.FirstChild(); }
+  const nsFrameList& GetChildList() const { return mAbsoluteFrames; }
 
   nsresult SetInitialChildList(nsIFrame*       aDelegatingFrame,
                                nsIAtom*        aListName,
-                               nsIFrame*       aChildList);
+                               nsFrameList&    aChildList);
   nsresult AppendFrames(nsIFrame*      aDelegatingFrame,
                         nsIAtom*       aListName,
                         nsIFrame*      aFrameList);

layout/generic/nsBlockFrame.cpp

@@ -513,13 +513,16 @@ nsBlockFrame::GetBaseline() const
 /////////////////////////////////////////////////////////////////////////////
 // Child frame enumeration
 
-nsIFrame*
-nsBlockFrame::GetFirstChild(nsIAtom* aListName) const
+nsFrameList
+nsBlockFrame::GetChildList(nsIAtom* aListName) const
 {
   if (nsGkAtoms::absoluteList == aListName) {
-    return mAbsoluteContainer.GetFirstChild();
+    return mAbsoluteContainer.GetChildList();
   }
   else if (nsnull == aListName) {
+    // XXXbz once we start using mFrames, or some other sane storage for our
+    // in-flow kids, we could switch GetChildList to returning a |const
+    // nsFrameList&|.
     return (mLines.empty()) ? nsnull : mLines.front()->mFirstChild;
   }
   else if (aListName == nsGkAtoms::overflowList) {
@@ -527,15 +530,15 @@ nsBlockFrame::GetFirstChild(nsIAtom* aListName) const
     return overflowLines ? overflowLines->front()->mFirstChild : nsnull;
   }
   else if (aListName == nsGkAtoms::overflowOutOfFlowList) {
-    return GetOverflowOutOfFlows().FirstChild();
+    return GetOverflowOutOfFlows();
   }
   else if (aListName == nsGkAtoms::floatList) {
-    return mFloats.FirstChild();
+    return mFloats;
   }
   else if (aListName == nsGkAtoms::bulletList) {
     return (HaveOutsideBullet()) ? mBullet : nsnull;
   }
-  return nsContainerFrame::GetFirstChild(aListName);;
+  return nsContainerFrame::GetChildList(aListName);
 }
 
 #define NS_BLOCK_FRAME_OVERFLOW_OOF_LIST_INDEX  (NS_CONTAINER_LIST_COUNT_INCL_OC + 0)
@@ -1018,7 +1021,7 @@ nsBlockFrame::Reflow(nsPresContext*           aPresContext,
         nsLineList::iterator nextToLastLine = ----end_lines();
         PushLines(state, nextToLastLine);
       }
-      state.mOverflowPlaceholders.SetFrames(nsnull);
+      state.mOverflowPlaceholders.Clear();
     }
     state.mReflowStatus |= NS_FRAME_REFLOW_NEXTINFLOW;
     if (NS_FRAME_IS_COMPLETE(state.mReflowStatus))
@@ -4478,7 +4481,7 @@ nsBlockFrame::DrainOverflowLines(nsBlockReflowState& aState)
           ReparentFrame(f, prevBlock, this);
         }
         mFloats.InsertFrames(nsnull, nsnull, oofs.mList.FirstChild());
-        oofs.mList.SetFrames(nsnull);
+        oofs.mList.Clear();
       }
     }
     
@@ -4494,7 +4497,7 @@ nsBlockFrame::DrainOverflowLines(nsBlockReflowState& aState)
     if (oofs.mList.NotEmpty()) {
       // The overflow floats go after our regular floats
       mFloats.AppendFrames(nsnull, oofs.mList.FirstChild());
-      oofs.mList.SetFrames(nsnull);
+      oofs.mList.Clear();
     }
   }
 
@@ -4876,20 +4879,20 @@ ShouldPutNextSiblingOnNewLine(nsIFrame* aLastFrame)
 }
 
 nsresult
-nsBlockFrame::AddFrames(nsIFrame* aFrameList,
+nsBlockFrame::AddFrames(const nsFrameList& aFrameList,
                         nsIFrame* aPrevSibling)
 {
   // Clear our line cursor, since our lines may change.
   ClearLineCursor();
 
-  if (nsnull == aFrameList) {
+  if (aFrameList.IsEmpty()) {
     return NS_OK;
   }
 
   // If we're inserting at the beginning of our list and we have an
   // inside bullet, insert after that bullet.
   if (!aPrevSibling && mBullet && !HaveOutsideBullet()) {
-    NS_ASSERTION(!nsFrameList(aFrameList).ContainsFrame(mBullet),
+    NS_ASSERTION(!aFrameList.ContainsFrame(mBullet),
                  "Trying to make mBullet prev sibling to itself");
     aPrevSibling = mBullet;
   }
@@ -4944,7 +4947,7 @@ nsBlockFrame::AddFrames(nsIFrame* aFrameList,
     }
 
     // Now (partially) join the sibling lists together
-    aPrevSibling->SetNextSibling(aFrameList);
+    aPrevSibling->SetNextSibling(aFrameList.FirstChild());
   }
   else if (! mLines.empty()) {
     prevSiblingNextFrame = mLines.front()->mFirstChild;
@@ -4954,7 +4957,7 @@ nsBlockFrame::AddFrames(nsIFrame* aFrameList,
 
   // Walk through the new frames being added and update the line data
   // structures to fit.
-  nsIFrame* newFrame = aFrameList;
+  nsIFrame* newFrame = aFrameList.FirstChild();
   while (newFrame) {
     NS_ASSERTION(newFrame->GetType() != nsGkAtoms::placeholderFrame ||
                  (!newFrame->GetStyleDisplay()->IsAbsolutelyPositioned() &&
@@ -6150,8 +6153,9 @@ nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     DisplayOverflowContainers(aBuilder, aDirtyRect, aLists);
   }
 
-  aBuilder->MarkFramesForDisplayList(this, mFloats.FirstChild(), aDirtyRect);
-  aBuilder->MarkFramesForDisplayList(this, mAbsoluteContainer.GetFirstChild(), aDirtyRect);
+  aBuilder->MarkFramesForDisplayList(this, mFloats, aDirtyRect);
+  aBuilder->MarkFramesForDisplayList(this, mAbsoluteContainer.GetChildList(),
+                                     aDirtyRect);
 
   // Don't use the line cursor if we might have a descendant placeholder ...
   // it might skip lines that contain placeholders but don't themselves
@@ -6401,7 +6405,7 @@ nsBlockFrame::Init(nsIContent*      aContent,
 
 NS_IMETHODIMP
 nsBlockFrame::SetInitialChildList(nsIAtom*        aListName,
-                                  nsIFrame*       aChildList)
+                                  nsFrameList&    aChildList)
 {
   nsresult rv = NS_OK;
 
@@ -6441,6 +6445,7 @@ nsBlockFrame::SetInitialChildList(nsIAtom*        aListName,
     if (NS_FAILED(rv)) {
       return rv;
     }
+    aChildList.Clear();
 
     // Create list bullet if this is a list-item. Note that this is done
     // here so that RenumberLists will work (it needs the bullets to

layout/generic/nsBlockFrame.h

@@ -168,7 +168,7 @@ public:
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
   NS_IMETHOD  AppendFrames(nsIAtom*        aListName,
                            nsIFrame*       aFrameList);
   NS_IMETHOD  InsertFrames(nsIAtom*        aListName,
@@ -176,7 +176,7 @@ public:
                            nsIFrame*       aFrameList);
   NS_IMETHOD  RemoveFrame(nsIAtom*        aListName,
                           nsIFrame*       aOldFrame);
-  virtual nsIFrame* GetFirstChild(nsIAtom* aListName) const;
+  virtual nsFrameList GetChildList(nsIAtom* aListName) const;
   virtual nscoord GetBaseline() const;
   virtual nsIAtom* GetAdditionalChildListName(PRInt32 aIndex) const;
   virtual void Destroy();
@@ -395,7 +395,7 @@ protected:
     * contains aPrevSibling and add aFrameList after aPrevSibling on that line.
     * new lines are created as necessary to handle block data in aFrameList.
     */
-  virtual nsresult AddFrames(nsIFrame* aFrameList,
+  virtual nsresult AddFrames(const nsFrameList& aFrameList,
                              nsIFrame* aPrevSibling);
 
 #ifdef IBMBIDI

layout/generic/nsColumnSetFrame.cpp

@@ -57,7 +57,7 @@ public:
   nsColumnSetFrame(nsStyleContext* aContext);
 
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
 
   NS_IMETHOD Reflow(nsPresContext* aPresContext,
                     nsHTMLReflowMetrics& aDesiredSize,
@@ -287,10 +287,10 @@ nsColumnSetFrame::PaintColumnRule(nsIRenderingContext* aCtx,
 
 NS_IMETHODIMP
 nsColumnSetFrame::SetInitialChildList(nsIAtom*        aListName,
-                                      nsIFrame*       aChildList)
+                                      nsFrameList&    aChildList)
 {
   NS_ASSERTION(!aListName, "Only default child list supported");
-  NS_ASSERTION(aChildList && !aChildList->GetNextSibling(),
+  NS_ASSERTION(aChildList.OnlyChild(),
                "initial child list must have exactly one child");
   // Queue up the frames for the content frame
   return nsHTMLContainerFrame::SetInitialChildList(nsnull, aChildList);
@@ -865,33 +865,22 @@ nsColumnSetFrame::DrainOverflowColumns()
   // frame.
   nsColumnSetFrame* prev = static_cast<nsColumnSetFrame*>(GetPrevInFlow());
   if (prev) {
-    nsIFrame* overflows = prev->GetOverflowFrames(PresContext(), PR_TRUE);
+    nsAutoPtr<nsFrameList> overflows(prev->StealOverflowFrames());
     if (overflows) {
-      // Make all the frames on the overflow list mine
-      nsIFrame* lastFrame = nsnull;
-      for (nsIFrame* f = overflows; f; f = f->GetNextSibling()) {
-        f->SetParent(this);
+      nsHTMLContainerFrame::ReparentFrameViewList(PresContext(), *overflows,
+                                                  prev, this);
 
-        // When pushing and pulling frames we need to check for whether any
-        // views need to be reparented
-        nsHTMLContainerFrame::ReparentFrameView(PresContext(), f, prev, this);
-
-        // Get the next frame
-        lastFrame = f;
-      }
-
-      NS_ASSERTION(lastFrame, "overflow list was created with no frames");
-      lastFrame->SetNextSibling(mFrames.FirstChild());
-      
-      mFrames.SetFrames(overflows);
+      mFrames.InsertFrames(this, nsnull, *overflows);
     }
   }
   
   // Now pull back our own overflows and append them to our children.
   // We don't need to reparent them since we're already their parent.
-  nsIFrame* overflows = GetOverflowFrames(PresContext(), PR_TRUE);
+  nsAutoPtr<nsFrameList> overflows(StealOverflowFrames());
   if (overflows) {
-    mFrames.AppendFrames(this, overflows);
+    // We're already the parent for these frames, so no need to set
+    // their parent again.
+    mFrames.AppendFrames(nsnull, *overflows);
   }
 }
 

layout/generic/nsContainerFrame.cpp

@@ -101,8 +101,8 @@ nsContainerFrame::Init(nsIContent* aContent,
 }
 
 NS_IMETHODIMP
-nsContainerFrame::SetInitialChildList(nsIAtom*  aListName,
-                                      nsIFrame* aChildList)
+nsContainerFrame::SetInitialChildList(nsIAtom*     aListName,
+                                      nsFrameList& aChildList)
 {
   nsresult  result;
   if (!mFrames.IsEmpty()) {
@@ -268,8 +268,7 @@ nsContainerFrame::Destroy()
   // Destroy auxiliary frame lists
   nsPresContext* prescontext = PresContext();
 
-  nsFrameList overflowFrames(GetOverflowFrames(prescontext, PR_TRUE));
-  overflowFrames.DestroyFrames();
+  DestroyOverflowList(prescontext);
 
   if (IsFrameOfType(nsIFrame::eCanContainOverflowContainers)) {
     nsFrameList* frameList = RemovePropTableFrames(prescontext,
@@ -312,27 +311,34 @@ nsContainerFrame::Destroy()
 /////////////////////////////////////////////////////////////////////////////
 // Child frame enumeration
 
-nsIFrame*
-nsContainerFrame::GetFirstChild(nsIAtom* aListName) const
+nsFrameList
+nsContainerFrame::GetChildList(nsIAtom* aListName) const
 {
   // We only know about the unnamed principal child list and the overflow
-  // list
+  // lists
   if (nsnull == aListName) {
-    return mFrames.FirstChild();
-  } else if (nsGkAtoms::overflowList == aListName) {
-    return GetOverflowFrames(PresContext(), PR_FALSE);
-  } else if (nsGkAtoms::overflowContainersList == aListName) {
+    return mFrames;
+  }
+
+  if (nsGkAtoms::overflowList == aListName) {
+    nsFrameList* frameList = GetOverflowFrames();
+    return frameList ? *frameList : nsFrameList::EmptyList();
+  }
+
+  if (nsGkAtoms::overflowContainersList == aListName) {
     nsFrameList* list = GetPropTableFrames(PresContext(),
                           nsGkAtoms::overflowContainersProperty);
-    return (list) ? list->FirstChild() : nsnull;
-  } else if (nsGkAtoms::excessOverflowContainersList == aListName) {
+    return list ? *list : nsFrameList::EmptyList();
+  }
+
+  if (nsGkAtoms::excessOverflowContainersList == aListName) {
     nsFrameList* list = GetPropTableFrames(PresContext(),
                           nsGkAtoms::excessOverflowContainersProperty);
-    return (list) ? list->FirstChild() : nsnull;
+    return list ? *list : nsFrameList::EmptyList();
 
-  } else {
-    return nsnull;
   }
+
+  return nsFrameList::EmptyList();
 }
 
 #define NS_CONTAINER_FRAME_OVERFLOW_LIST_INDEX                   0
@@ -1098,14 +1104,6 @@ nsContainerFrame::DisplayOverflowContainers(nsDisplayListBuilder*   aBuilder,
   }
 }
 
-nsresult
-nsContainerFrame::AddFrames(nsIFrame* aFrameList,
-                            nsIFrame* aPrevSibling)
-{
-  mFrames.InsertFrames(nsnull, aPrevSibling, aFrameList);
-  return NS_OK;
-}
-
 nsresult
 nsContainerFrame::StealFrame(nsPresContext* aPresContext,
                              nsIFrame*      aChild,
@@ -1126,17 +1124,27 @@ nsContainerFrame::StealFrame(nsPresContext* aPresContext,
     if (!mFrames.RemoveFrame(aChild)) {
       // We didn't find the child in the parent's principal child list.
       // Maybe it's on the overflow list?
-      nsFrameList frameList(GetOverflowFrames(aPresContext, PR_TRUE));
-      removed = frameList.RemoveFrame(aChild);
-      if (frameList.NotEmpty()) {
-        nsresult rv = SetOverflowFrames(aPresContext, frameList.FirstChild());
-        NS_ENSURE_SUCCESS(rv, rv);
+      nsFrameList* frameList = GetOverflowFrames();
+      if (frameList) {
+        removed = frameList->RemoveFrame(aChild);
+        if (frameList->IsEmpty()) {
+          DestroyOverflowList(aPresContext);
+        }
       }
     }
   }
   return (removed) ? NS_OK : NS_ERROR_UNEXPECTED;
 }
 
+void
+nsContainerFrame::DestroyOverflowList(nsPresContext* aPresContext)
+{
+  nsFrameList* list =
+    RemovePropTableFrames(aPresContext, nsGkAtoms::overflowList);
+  if (list)
+    list->Destroy();
+}
+
 /**
  * Remove and delete aNextInFlow and its next-in-flows. Updates the sibling and flow
  * pointers
@@ -1184,56 +1192,6 @@ nsContainerFrame::DeleteNextInFlowChild(nsPresContext* aPresContext,
   NS_POSTCONDITION(!prevInFlow->GetNextInFlow(), "non null next-in-flow");
 }
 
-/**
- * Get the frames on the overflow list
- */
-nsIFrame*
-nsContainerFrame::GetOverflowFrames(nsPresContext*  aPresContext,
-                                    PRBool          aRemoveProperty) const
-{
-  nsPropertyTable *propTable = aPresContext->PropertyTable();
-  if (aRemoveProperty) {
-    return (nsIFrame*) propTable->UnsetProperty(this,
-                                                nsGkAtoms::overflowProperty);
-  }
-  return (nsIFrame*) propTable->GetProperty(this,
-                                            nsGkAtoms::overflowProperty);
-}
-
-// Destructor function for the overflow frame property
-static void
-DestroyOverflowFrames(void*           aFrame,
-                      nsIAtom*        aPropertyName,
-                      void*           aPropertyValue,
-                      void*           aDtorData)
-{
-  if (aPropertyValue) {
-    nsFrameList frames((nsIFrame*)aPropertyValue);
-
-    frames.DestroyFrames();
-  }
-}
-
-/**
- * Set the frames on the overflow list
- */
-nsresult
-nsContainerFrame::SetOverflowFrames(nsPresContext* aPresContext,
-                                    nsIFrame*       aOverflowFrames)
-{
-  nsresult rv =
-    aPresContext->PropertyTable()->SetProperty(this,
-                                               nsGkAtoms::overflowProperty,
-                                               aOverflowFrames,
-                                               DestroyOverflowFrames,
-                                               nsnull);
-
-  // Verify that we didn't overwrite an existing overflow list
-  NS_ASSERTION(rv != NS_PROPTABLE_PROP_OVERWRITTEN, "existing overflow list");
-
-  return rv;
-}
-
 // Destructor function for the proptable-stored framelists
 static void
 DestroyFrameList(void*           aFrame,
@@ -1245,6 +1203,38 @@ DestroyFrameList(void*           aFrame,
     static_cast<nsFrameList*>(aPropertyValue)->Destroy();
 }
 
+/**
+ * Set the frames on the overflow list
+ */
+nsresult
+nsContainerFrame::SetOverflowFrames(nsPresContext* aPresContext,
+                                    const nsFrameList& aOverflowFrames)
+{
+  NS_PRECONDITION(aOverflowFrames.NotEmpty(), "Shouldn't be called");
+  nsFrameList* newList = new nsFrameList(aOverflowFrames);
+  if (!newList) {
+    // XXXbz should really destroy the frames here, but callers are holding
+    // pointers to them.... We should switch all callers to framelists, then
+    // audit and do that.
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  nsresult rv =
+    aPresContext->PropertyTable()->SetProperty(this,
+                                               nsGkAtoms::overflowProperty,
+                                               newList,
+                                               DestroyFrameList,
+                                               nsnull);
+  if (NS_FAILED(rv)) {
+    newList->Destroy();
+  }
+
+  // Verify that we didn't overwrite an existing overflow list
+  NS_ASSERTION(rv != NS_PROPTABLE_PROP_OVERWRITTEN, "existing overflow list");
+
+  return rv;
+}
+
 nsFrameList*
 nsContainerFrame::GetPropTableFrames(nsPresContext*  aPresContext,
                                      nsIAtom*        aPropID) const
@@ -1360,25 +1350,27 @@ nsContainerFrame::MoveOverflowToChildList(nsPresContext* aPresContext)
   // Check for an overflow list with our prev-in-flow
   nsContainerFrame* prevInFlow = (nsContainerFrame*)GetPrevInFlow();
   if (nsnull != prevInFlow) {
-    nsIFrame* prevOverflowFrames = prevInFlow->GetOverflowFrames(aPresContext,
-                                                                 PR_TRUE);
+    nsAutoPtr<nsFrameList> prevOverflowFrames(prevInFlow->StealOverflowFrames());
     if (prevOverflowFrames) {
-      NS_ASSERTION(mFrames.IsEmpty(), "bad overflow list");
+      // Tables are special; they can have repeated header/footer
+      // frames on mFrames at this point.
+      NS_ASSERTION(mFrames.IsEmpty() || GetType() == nsGkAtoms::tableFrame,
+                   "bad overflow list");
       // When pushing and pulling frames we need to check for whether any
       // views need to be reparented.
-      for (nsIFrame* f = prevOverflowFrames; f; f = f->GetNextSibling()) {
-        nsHTMLContainerFrame::ReparentFrameView(aPresContext, f, prevInFlow, this);
-      }
-      mFrames.InsertFrames(this, nsnull, prevOverflowFrames);
+      nsHTMLContainerFrame::ReparentFrameViewList(aPresContext,
+                                                  *prevOverflowFrames,
+                                                  prevInFlow, this);
+      mFrames.AppendFrames(this, *prevOverflowFrames);
       result = PR_TRUE;
     }
   }
 
   // It's also possible that we have an overflow list for ourselves
-  nsIFrame* overflowFrames = GetOverflowFrames(aPresContext, PR_TRUE);
+  nsAutoPtr<nsFrameList> overflowFrames(StealOverflowFrames());
   if (overflowFrames) {
     NS_ASSERTION(mFrames.NotEmpty(), "overflow list w/o frames");
-    mFrames.AppendFrames(nsnull, overflowFrames);
+    mFrames.AppendFrames(nsnull, *overflowFrames);
     result = PR_TRUE;
   }
   return result;

layout/generic/nsContainerFrame.h

@@ -44,6 +44,7 @@
 #include "nsSplittableFrame.h"
 #include "nsFrameList.h"
 #include "nsLayoutUtils.h"
+#include "nsAutoPtr.h"
 
 /**
  * Child list name indices
@@ -76,8 +77,8 @@ public:
   NS_IMETHOD Init(nsIContent* aContent,
                   nsIFrame*   aParent,
                   nsIFrame*   aPrevInFlow);
-  NS_IMETHOD SetInitialChildList(nsIAtom*  aListName,
-                                 nsIFrame* aChildList);
+  NS_IMETHOD SetInitialChildList(nsIAtom*     aListName,
+                                 nsFrameList& aChildList);
   NS_IMETHOD AppendFrames(nsIAtom*  aListName,
                           nsIFrame* aFrameList);
   NS_IMETHOD InsertFrames(nsIAtom*  aListName,
@@ -86,7 +87,7 @@ public:
   NS_IMETHOD RemoveFrame(nsIAtom*  aListName,
                          nsIFrame* aOldFrame);
 
-  virtual nsIFrame* GetFirstChild(nsIAtom* aListName) const;
+  virtual nsFrameList GetChildList(nsIAtom* aListName) const;
   virtual nsIAtom* GetAdditionalChildListName(PRInt32 aIndex) const;
   virtual void Destroy();
   virtual void ChildIsDirty(nsIFrame* aChild);
@@ -111,11 +112,6 @@ public:
                                      nsIFrame*      aNextInFlow,
                                      PRBool         aDeletingEmptyFrames);
 
-  static PRInt32 LengthOf(nsIFrame* aFrameList) {
-    nsFrameList tmp(aFrameList);
-    return tmp.GetLength();
-  }
-
   // Positions the frame's view based on the frame's origin
   static void PositionFrameView(nsIFrame* aKidFrame);
 
@@ -280,13 +276,6 @@ public:
                                            PRUint32                 aFlags,
                                            nsReflowStatus&          aStatus);
 
-  /**
-   * Inserts aFrameList's frames into our main child list--without reparenting
-   * or requesting reflow.
-   */
-  virtual nsresult AddFrames(nsIFrame* aFrameList,
-                             nsIFrame* aPrevSibling);
-
   /**
    * Removes aChild without destroying it and without requesting reflow.
    * Continuations are not affected. Checks the primary and overflow
@@ -349,15 +338,33 @@ protected:
    */
 
   /**
-   * Get the frames on the overflow list
+   * Get the frames on the overflow list.  Can return null if there are no
+   * overflow frames.  The caller does NOT take ownership of the list; it's
+   * still owned by this frame.  A non-null return value indicates that the
+   * list is nonempty.
    */
-  nsIFrame* GetOverflowFrames(nsPresContext*  aPresContext,
-                              PRBool          aRemoveProperty) const;
+  inline nsFrameList* GetOverflowFrames() const;
+
   /**
-   * Set the overflow list
+   * As GetOverflowFrames, but removes the overflow frames property.  The
+   * caller is responsible for deleting nsFrameList and either passing
+   * ownership of the frames to someone else or destroying the frames.  A
+   * non-null return value indicates that the list is nonempty.  The
+   * recommended way to use this function it to assign its return value
+   * into an nsAutoPtr.
+   */
+  inline nsFrameList* StealOverflowFrames();
+  
+  /**
+   * Set the overflow list.  aOverflowFrames must not be an empty list.
    */
   nsresult SetOverflowFrames(nsPresContext*  aPresContext,
-                             nsIFrame*       aOverflowFrames);
+                             const nsFrameList& aOverflowFrames);
+
+  /**
+   * Destroy the overflow list and any frames that are on  it.
+   */
+  void DestroyOverflowList(nsPresContext* aPresContext);
 
   /**
    * Moves any frames on both the prev-in-flow's overflow list and the
@@ -569,4 +576,24 @@ private:
   PRBool mWalkOOFFrames;
 };
 
+inline
+nsFrameList*
+nsContainerFrame::GetOverflowFrames() const
+{
+  nsFrameList* list =
+    static_cast<nsFrameList*>(GetProperty(nsGkAtoms::overflowProperty));
+  NS_ASSERTION(!list || !list->IsEmpty(), "Unexpected empty overflow list");
+  return list;
+}
+
+inline
+nsFrameList*
+nsContainerFrame::StealOverflowFrames()
+{
+  nsFrameList* list =
+    static_cast<nsFrameList*>(UnsetProperty(nsGkAtoms::overflowProperty));
+  NS_ASSERTION(!list || !list->IsEmpty(), "Unexpected empty overflow list");
+  return list;
+}
+
 #endif /* nsContainerFrame_h___ */

layout/generic/nsFirstLetterFrame.cpp

@@ -97,31 +97,17 @@ nsFirstLetterFrame::Init(nsIContent*      aContent,
 }
 
 NS_IMETHODIMP
-nsFirstLetterFrame::SetInitialChildList(nsIAtom*  aListName,
-                                        nsIFrame* aChildList)
+nsFirstLetterFrame::SetInitialChildList(nsIAtom*     aListName,
+                                        nsFrameList& aChildList)
 {
-  mFrames.SetFrames(aChildList);
   nsFrameManager *frameManager = PresContext()->FrameManager();
 
-  for (nsIFrame* frame = aChildList; frame; frame = frame->GetNextSibling()) {
-    NS_ASSERTION(frame->GetParent() == this, "Unexpected parent");
-    frameManager->ReParentStyleContext(frame);
+  for (nsFrameList::Enumerator e(aChildList); !e.AtEnd(); e.Next()) {
+    NS_ASSERTION(e.get()->GetParent() == this, "Unexpected parent");
+    frameManager->ReParentStyleContext(e.get());
   }
-  return NS_OK;
-}
 
-NS_IMETHODIMP
-nsFirstLetterFrame::SetSelected(nsPresContext* aPresContext, nsIDOMRange *aRange,PRBool aSelected, nsSpread aSpread, SelectionType aType)
-{
-  if (aSelected && ParentDisablesSelection())
-    return NS_OK;
-  nsIFrame *child = GetFirstChild(nsnull);
-  while (child)
-  {
-    child->SetSelected(aPresContext, aRange, aSelected, aSpread, aType);
-    // don't worry about result. there are more frames to come
-    child = child->GetNextSibling();
-  }
+  mFrames.SetFrames(aChildList);
   return NS_OK;
 }
 
@@ -315,31 +301,28 @@ nsFirstLetterFrame::CanContinueTextRun() const
 void
 nsFirstLetterFrame::DrainOverflowFrames(nsPresContext* aPresContext)
 {
-  nsIFrame* overflowFrames;
+  nsAutoPtr<nsFrameList> overflowFrames;
 
   // Check for an overflow list with our prev-in-flow
   nsFirstLetterFrame* prevInFlow = (nsFirstLetterFrame*)GetPrevInFlow();
   if (nsnull != prevInFlow) {
-    overflowFrames = prevInFlow->GetOverflowFrames(aPresContext, PR_TRUE);
+    overflowFrames = prevInFlow->StealOverflowFrames();
     if (overflowFrames) {
       NS_ASSERTION(mFrames.IsEmpty(), "bad overflow list");
 
       // When pushing and pulling frames we need to check for whether any
       // views need to be reparented.
-      nsIFrame* f = overflowFrames;
-      while (f) {
-        nsHTMLContainerFrame::ReparentFrameView(aPresContext, f, prevInFlow, this);
-        f = f->GetNextSibling();
-      }
-      mFrames.InsertFrames(this, nsnull, overflowFrames);
+      nsHTMLContainerFrame::ReparentFrameViewList(aPresContext, *overflowFrames,
+                                                  prevInFlow, this);
+      mFrames.InsertFrames(this, nsnull, *overflowFrames);
     }
   }
 
   // It's also possible that we have an overflow list for ourselves
-  overflowFrames = GetOverflowFrames(aPresContext, PR_TRUE);
+  overflowFrames = StealOverflowFrames();
   if (overflowFrames) {
     NS_ASSERTION(mFrames.NotEmpty(), "overflow list w/o frames");
-    mFrames.AppendFrames(nsnull, overflowFrames);
+    mFrames.AppendFrames(nsnull, *overflowFrames);
   }
 
   // Now repair our first frames style context (since we only reflow

layout/generic/nsFirstLetterFrame.h

@@ -52,7 +52,7 @@ public:
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
-                                 nsIFrame*       aChildList);
+                                 nsFrameList&    aChildList);
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
@@ -83,8 +83,6 @@ public:
 
   virtual PRBool CanContinueTextRun() const;
 
-  NS_IMETHOD SetSelected(nsPresContext* aPresContext, nsIDOMRange *aRange,PRBool aSelected, nsSpread aSpread, SelectionType aType);
-
 //override of nsFrame method
   NS_IMETHOD GetChildFrameContainingOffset(PRInt32 inContentOffset,
                                            PRBool inHint,

layout/generic/nsFrame.cpp

@@ -400,7 +400,7 @@ nsFrame::Init(nsIContent*      aContent,
 }
 
 NS_IMETHODIMP nsFrame::SetInitialChildList(nsIAtom*        aListName,
-                                           nsIFrame*       aChildList)
+                                           nsFrameList&    aChildList)
 {
   // XXX This shouldn't be getting called at all, but currently is for backwards
   // compatility reasons...
@@ -408,7 +408,7 @@ NS_IMETHODIMP nsFrame::SetInitialChildList(nsIAtom*        aListName,
   NS_ERROR("not a container");
   return NS_ERROR_UNEXPECTED;
 #else
-  NS_ASSERTION(nsnull == aChildList, "not a container");
+  NS_ASSERTION(aChildList.IsEmpty(), "not a container");
   return NS_OK;
 #endif
 }
@@ -759,10 +759,10 @@ nsFrame::GetAdditionalChildListName(PRInt32 aIndex) const
   return nsnull;
 }
 
-nsIFrame*
-nsFrame::GetFirstChild(nsIAtom* aListName) const
+nsFrameList
+nsFrame::GetChildList(nsIAtom* aListName) const
 {
-  return nsnull;
+  return nsFrameList::EmptyList();
 }
 
 static nsIFrame*
@@ -4260,35 +4260,6 @@ nsFrame::XMLQuote(nsString& aString)
 }
 #endif
 
-PRBool
-nsFrame::ParentDisablesSelection() const
-{
-/*
-  // should never be called now
-  nsIFrame* parent = GetParent();
-  if (parent) {
-	  PRBool selectable;
-	  parent->IsSelectable(selectable);
-    return (selectable ? PR_FALSE : PR_TRUE);
-  }
-  return PR_FALSE;
-*/
-/*
-  PRBool selected;
-  if (NS_FAILED(GetSelected(&selected)))
-    return PR_FALSE;
-  if (selected)
-    return PR_FALSE; //if this frame is selected and no one has overridden the selection from "higher up"
-                     //then no one below us will be disabled by this frame.
-  nsIFrame* target = GetParent();
-  if (target)
-    return ((nsFrame *)target)->ParentDisablesSelection();
-  return PR_FALSE; //default this does not happen
-  */
-  
-  return PR_FALSE;
-}
-
 PRBool
 nsIFrame::IsVisibleForPainting(nsDisplayListBuilder* aBuilder) {
   if (!GetStyleVisibility()->IsVisible())
@@ -4487,55 +4458,30 @@ nsFrame::DumpBaseRegressionData(nsPresContext* aPresContext, FILE* out, PRInt32
 }
 #endif
 
-/*this method may.. invalidate if the state was changed or if aForceRedraw is PR_TRUE
-  it will not update immediately.*/
-NS_IMETHODIMP
-nsFrame::SetSelected(nsPresContext* aPresContext, nsIDOMRange *aRange, PRBool aSelected, nsSpread aSpread, SelectionType aType)
+void
+nsIFrame::SetSelected(PRBool aSelected, SelectionType aType)
 {
-/*
-  if (aSelected && ParentDisablesSelection())
-    return NS_OK;
-*/
+  NS_ASSERTION(!GetPrevContinuation(),
+               "Should only be called on first in flow");
+  if (aType != nsISelectionController::SELECTION_NORMAL)
+    return;
 
-  if (aType == nsISelectionController::SELECTION_NORMAL) {
-    // check whether style allows selection
-    PRBool  selectable;
-    IsSelectable(&selectable, nsnull);
-    if (!selectable)
-      return NS_OK;
-  }
+  // check whether style allows selection
+  PRBool selectable;
+  IsSelectable(&selectable, nsnull);
+  if (!selectable)
+    return;
 
-/*
-  if (eSpreadDown == aSpread){
-    nsIFrame* kid = GetFirstChild(nsnull);
-    while (nsnull != kid) {
-      kid->SetSelected(nsnull,aSelected,aSpread);
-      kid = kid->GetNextSibling();
+  for (nsIFrame* f = this; f; f = f->GetNextContinuation()) {
+    if (aSelected) {
+      AddStateBits(NS_FRAME_SELECTED_CONTENT);
+    } else {
+      RemoveStateBits(NS_FRAME_SELECTED_CONTENT);
     }
-  }
-*/
-  if ( aSelected ){
-    AddStateBits(NS_FRAME_SELECTED_CONTENT);
-  }
-  else
-    RemoveStateBits(NS_FRAME_SELECTED_CONTENT);
 
-  // Repaint this frame subtree's entire area
-  InvalidateOverflowRect();
-
-#ifdef IBMBIDI
-  PRInt32 start, end;
-  nsIFrame* frame = GetNextSibling();
-  if (frame) {
-    GetFirstLeaf(aPresContext, &frame);
-    GetOffsets(start, end);
-    if (start && end) {
-      frame->SetSelected(aPresContext, aRange, aSelected, aSpread, aType);
-    }
+    // Repaint this frame subtree's entire area
+    InvalidateOverflowRect();
   }
-#endif // IBMBIDI
-
-  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -6920,10 +6866,11 @@ nsFrame::TraceMsg(const char* aFormatString, ...)
 }
 
 void
-nsFrame::VerifyDirtyBitSet(nsIFrame* aFrameList)
+nsFrame::VerifyDirtyBitSet(const nsFrameList& aFrameList)
 {
-  for (nsIFrame*f = aFrameList; f; f = f->GetNextSibling()) {
-    NS_ASSERTION(f->GetStateBits() & NS_FRAME_IS_DIRTY, "dirty bit not set");
+  for (nsFrameList::Enumerator e(aFrameList); !e.AtEnd(); e.Next()) {
+    NS_ASSERTION(e.get()->GetStateBits() & NS_FRAME_IS_DIRTY,
+                 "dirty bit not set");
   }
 }
 

layout/generic/nsFrame.h

@@ -163,8 +163,8 @@ public:
   NS_IMETHOD  Init(nsIContent*      aContent,
                    nsIFrame*        aParent,
                    nsIFrame*        asPrevInFlow);
-  NS_IMETHOD  SetInitialChildList(nsIAtom*        aListName,
-                                  nsIFrame*       aChildList);
+  NS_IMETHOD  SetInitialChildList(nsIAtom*           aListName,
+                                  nsFrameList&       aChildList);
   NS_IMETHOD  AppendFrames(nsIAtom*        aListName,
                            nsIFrame*       aFrameList);
   NS_IMETHOD  InsertFrames(nsIAtom*        aListName,
@@ -179,7 +179,7 @@ public:
   NS_IMETHOD  SetParent(const nsIFrame* aParent);
   virtual nscoord GetBaseline() const;
   virtual nsIAtom* GetAdditionalChildListName(PRInt32 aIndex) const;
-  virtual nsIFrame* GetFirstChild(nsIAtom* aListName) const;
+  virtual nsFrameList GetChildList(nsIAtom* aListName) const;
   NS_IMETHOD  HandleEvent(nsPresContext* aPresContext, 
                           nsGUIEvent*     aEvent,
                           nsEventStatus*  aEventStatus);
@@ -237,7 +237,6 @@ public:
   NS_IMETHOD  DumpRegressionData(nsPresContext* aPresContext, FILE* out, PRInt32 aIndent);
 #endif
 
-  NS_IMETHOD  SetSelected(nsPresContext* aPresContext, nsIDOMRange *aRange,PRBool aSelected, nsSpread aSpread, SelectionType aType);
   NS_IMETHOD  GetSelected(PRBool *aSelected) const;
   NS_IMETHOD  IsSelectable(PRBool* aIsSelectable, PRUint8* aSelectStyle) const;
 
@@ -429,7 +428,7 @@ public:
 
   // Helper function that verifies that each frame in the list has the
   // NS_FRAME_IS_DIRTY bit set
-  static void VerifyDirtyBitSet(nsIFrame* aFrameList);
+  static void VerifyDirtyBitSet(const nsFrameList& aFrameList);
 
   // Helper function to return the index in parent of the frame's content
   // object. Returns -1 on error or if the frame doesn't have a content object
@@ -597,8 +596,6 @@ protected:
                                       nsIContent **aParentContent, PRInt32 *aContentOffset, 
                                       PRInt32 *aTarget);
 
-  virtual PRBool ParentDisablesSelection() const;
-
   // Fills aCursor with the appropriate information from ui
   static void FillCursorInformationFromStyle(const nsStyleUserInterface* ui,
                                              nsIFrame::Cursor& aCursor);

layout/generic/nsFrameList.cpp

@@ -39,7 +39,8 @@
 /* class for maintaining a linked list of child frames */
 
 #include "nsFrameList.h"
-#ifdef NS_DEBUG
+#include "nsIFrame.h"
+#ifdef DEBUG
 #include "nsIFrameDebug.h"
 #endif
 #include "nsLayoutUtils.h"
@@ -51,6 +52,20 @@
 #include "nsBidiPresUtils.h"
 #endif // IBMBIDI
 
+const nsFrameList* nsFrameList::sEmptyList;
+
+/* static */
+nsresult
+nsFrameList::Init()
+{
+  NS_PRECONDITION(!sEmptyList, "Shouldn't be allocated");
+  sEmptyList = new nsFrameList();
+  if (!sEmptyList)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  return NS_OK;
+}
+
 void
 nsFrameList::Destroy()
 {
@@ -69,52 +84,6 @@ nsFrameList::DestroyFrames()
   }
 }
 
-void
-nsFrameList::AppendFrames(nsIFrame* aParent, nsIFrame* aFrameList)
-{
-  NS_PRECONDITION(nsnull != aFrameList, "null ptr");
-  if (nsnull != aFrameList) {
-    nsIFrame* lastChild = LastChild();
-    if (nsnull == lastChild) {
-      mFirstChild = aFrameList;
-    }
-    else {
-      lastChild->SetNextSibling(aFrameList);
-    }
-    if (aParent) {
-      for (nsIFrame* frame = aFrameList; frame;
-           frame = frame->GetNextSibling()) {
-        frame->SetParent(aParent);
-      }
-    }
-  }
-#ifdef DEBUG
-  CheckForLoops();
-#endif
-}
-
-void
-nsFrameList::AppendFrame(nsIFrame* aParent, nsIFrame* aFrame)
-{
-  NS_PRECONDITION(nsnull != aFrame, "null ptr");
-  if (nsnull != aFrame) {
-    NS_PRECONDITION(!aFrame->GetNextSibling(), "Can only append one frame here");
-    nsIFrame* lastChild = LastChild();
-    if (nsnull == lastChild) {
-      mFirstChild = aFrame;
-    }
-    else {
-      lastChild->SetNextSibling(aFrame);
-    }
-    if (nsnull != aParent) {
-      aFrame->SetParent(aParent);
-    }
-  }
-#ifdef DEBUG
-  CheckForLoops();
-#endif
-}
-
 PRBool
 nsFrameList::RemoveFrame(nsIFrame* aFrame, nsIFrame* aPrevSiblingHint)
 {
@@ -146,62 +115,30 @@ PRBool
 nsFrameList::RemoveFirstChild()
 {
   if (mFirstChild) {
-    nsIFrame* nextFrame = mFirstChild->GetNextSibling();
-    mFirstChild->SetNextSibling(nsnull);
-    mFirstChild = nextFrame;
+    RemoveFrame(mFirstChild);
     return PR_TRUE;
   }
   return PR_FALSE;
 }
 
 PRBool
-nsFrameList::DestroyFrame(nsIFrame* aFrame)
+nsFrameList::DestroyFrame(nsIFrame* aFrame, nsIFrame* aPrevSiblingHint)
 {
   NS_PRECONDITION(nsnull != aFrame, "null ptr");
-  if (RemoveFrame(aFrame)) {
+  if (RemoveFrame(aFrame, aPrevSiblingHint)) {
     aFrame->Destroy();
     return PR_TRUE;
   }
   return PR_FALSE;
 }
 
-void
-nsFrameList::InsertFrame(nsIFrame* aParent,
-                         nsIFrame* aPrevSibling,
-                         nsIFrame* aNewFrame)
-{
-  NS_PRECONDITION(nsnull != aNewFrame, "null ptr");
-  if (nsnull != aNewFrame) {
-    NS_ASSERTION(!aNewFrame->GetNextSibling(), 
-      "the pointer to this sibling will be overwritten");
-    if (aParent) {
-      aNewFrame->SetParent(aParent);
-    }
-    if (nsnull == aPrevSibling) {
-      aNewFrame->SetNextSibling(mFirstChild);
-      mFirstChild = aNewFrame;
-    }
-    else {
-      NS_ASSERTION(aNewFrame->GetParent() == aPrevSibling->GetParent(),
-                   "prev sibling has different parent");
-      nsIFrame* nextFrame = aPrevSibling->GetNextSibling();
-      NS_ASSERTION(!nextFrame ||
-                   aNewFrame->GetParent() == nextFrame->GetParent(),
-                   "next sibling has different parent");
-      aPrevSibling->SetNextSibling(aNewFrame);
-      aNewFrame->SetNextSibling(nextFrame);
-    }
-  }
-#ifdef DEBUG
-  CheckForLoops();
-#endif
-}
-
 void
 nsFrameList::InsertFrames(nsIFrame* aParent,
                           nsIFrame* aPrevSibling,
                           nsIFrame* aFrameList)
 {
+  // XXXbz once we have fast access to last frames (and have an nsFrameList
+  // here, not an nsIFrame*), we should clean up this method significantly.
   NS_PRECONDITION(nsnull != aFrameList, "null ptr");
   if (nsnull != aFrameList) {
     nsIFrame* lastNewFrame = nsnull;
@@ -214,14 +151,20 @@ nsFrameList::InsertFrames(nsIFrame* aParent,
     }
 
     // Get the last new frame if necessary
-    if (!lastNewFrame) {
+    if (!lastNewFrame &&
+        ((aPrevSibling && aPrevSibling->GetNextSibling()) ||
+         mFirstChild)) {
       nsFrameList tmp(aFrameList);
       lastNewFrame = tmp.LastChild();
     }
 
     // Link the new frames into the child list
-    if (nsnull == aPrevSibling) {
-      lastNewFrame->SetNextSibling(mFirstChild);
+    if (!aPrevSibling) {
+      NS_ASSERTION(lastNewFrame || !mFirstChild,
+                   "Should have lastNewFrame here");
+      if (lastNewFrame) {
+        lastNewFrame->SetNextSibling(mFirstChild);
+      }
       mFirstChild = aFrameList;
     }
     else {
@@ -232,7 +175,10 @@ nsFrameList::InsertFrames(nsIFrame* aParent,
                    aFrameList->GetParent() == nextFrame->GetParent(),
                    "next sibling has different parent");
       aPrevSibling->SetNextSibling(aFrameList);
-      lastNewFrame->SetNextSibling(nextFrame);
+      NS_ASSERTION(lastNewFrame || !nextFrame, "Should have lastNewFrame here");
+      if (lastNewFrame) {
+        lastNewFrame->SetNextSibling(nextFrame);
+      }
     }
   }
 #ifdef DEBUG
@@ -240,20 +186,74 @@ nsFrameList::InsertFrames(nsIFrame* aParent,
 #endif
 }
 
-PRBool
-nsFrameList::Split(nsIFrame* aAfterFrame, nsIFrame** aNextFrameResult)
+nsFrameList
+nsFrameList::ExtractHead(FrameLinkEnumerator& aLink)
 {
-  NS_PRECONDITION(nsnull != aAfterFrame, "null ptr");
-  NS_PRECONDITION(nsnull != aNextFrameResult, "null ptr");
-  NS_ASSERTION(ContainsFrame(aAfterFrame), "split after unknown frame");
+  NS_PRECONDITION(&aLink.List() == this, "Unexpected list");
+  NS_PRECONDITION(!aLink.PrevFrame() ||
+                  aLink.PrevFrame()->GetNextSibling() ==
+                    aLink.NextFrame(),
+                  "Unexpected PrevFrame()");
+  NS_PRECONDITION(aLink.PrevFrame() ||
+                  aLink.NextFrame() == FirstChild(),
+                  "Unexpected NextFrame()");
+  NS_PRECONDITION(!aLink.PrevFrame() ||
+                  aLink.NextFrame() != FirstChild(),
+                  "Unexpected NextFrame()");
+  NS_PRECONDITION(aLink.mEnd == nsnull,
+                  "Unexpected mEnd for frame link enumerator");
 
-  if (aNextFrameResult && aAfterFrame) {
-    nsIFrame* nextFrame = aAfterFrame->GetNextSibling();
-    aAfterFrame->SetNextSibling(nsnull);
-    *aNextFrameResult = nextFrame;
-    return PR_TRUE;
+  nsIFrame* prev = aLink.PrevFrame();
+  nsIFrame* newFirstFrame = nsnull;
+  if (prev) {
+    // Truncate the list after |prev| and hand the first part to our new list.
+    prev->SetNextSibling(nsnull);
+    newFirstFrame = mFirstChild;
+    mFirstChild = aLink.NextFrame();
+
+    // Now make sure aLink doesn't point to a frame we no longer have.
+    aLink.mPrev = nsnull;
   }
-  return PR_FALSE;
+  // else aLink is pointing to before our first frame.  Nothing to do.
+
+  return nsFrameList(newFirstFrame);
+}
+
+nsFrameList
+nsFrameList::ExtractTail(FrameLinkEnumerator& aLink)
+{
+  NS_PRECONDITION(&aLink.List() == this, "Unexpected list");
+  NS_PRECONDITION(!aLink.PrevFrame() ||
+                  aLink.PrevFrame()->GetNextSibling() ==
+                    aLink.NextFrame(),
+                  "Unexpected PrevFrame()");
+  NS_PRECONDITION(aLink.PrevFrame() ||
+                  aLink.NextFrame() == FirstChild(),
+                  "Unexpected NextFrame()");
+  NS_PRECONDITION(!aLink.PrevFrame() ||
+                  aLink.NextFrame() != FirstChild(),
+                  "Unexpected NextFrame()");
+  NS_PRECONDITION(aLink.mEnd == nsnull,
+                  "Unexpected mEnd for frame link enumerator");
+
+  nsIFrame* prev = aLink.PrevFrame();
+  nsIFrame* newFirstFrame;
+  if (prev) {
+    // Truncate the list after |prev| and hand the second part to our new list
+    prev->SetNextSibling(nsnull);
+    newFirstFrame = aLink.NextFrame();
+  } else {
+    // Hand the whole list over to our new list
+    newFirstFrame = mFirstChild;
+    mFirstChild = nsnull;
+  }
+
+  // Now make sure aLink doesn't point to a frame we no longer have.
+  aLink.mFrame = nsnull;
+
+  NS_POSTCONDITION(aLink.AtEnd(), "What's going on here?");
+
+  return nsFrameList(newFirstFrame);
 }
 
 nsIFrame*
@@ -417,18 +417,7 @@ nsFrameList::GetPrevSiblingFor(nsIFrame* aFrame) const
   return frame;
 }
 
-void
-nsFrameList::VerifyParent(nsIFrame* aParent) const
-{
-#ifdef NS_DEBUG
-  for (nsIFrame* frame = mFirstChild; frame;
-       frame = frame->GetNextSibling()) {
-    NS_ASSERTION(frame->GetParent() == aParent, "bad parent");
-  }
-#endif
-}
-
-#ifdef NS_DEBUG
+#ifdef DEBUG
 void
 nsFrameList::List(FILE* out) const
 {

layout/generic/nsFrameList.h

@@ -40,27 +40,43 @@
 #ifndef nsFrameList_h___
 #define nsFrameList_h___
 
-#include "nsIFrame.h"
+#include "nscore.h"
+#include "nsTraceRefcnt.h"
+#include <stdio.h> /* for FILE* */
+#include "nsDebug.h"
+
+class nsIFrame;
 
 /**
- * A class for managing a singly linked list of frames. Frames are
- * linked together through their next-sibling pointer.
+ * A class for managing a list of frames.
  */
-
 class nsFrameList {
 public:
-  nsFrameList() {
-    mFirstChild = nsnull;
+  nsFrameList() :
+    mFirstChild(nsnull)
+  {
+    MOZ_COUNT_CTOR(nsFrameList);
   }
 
-  nsFrameList(nsIFrame* aHead) {
-    mFirstChild = aHead;
+  // XXX We should make this explicit when we can!
+  nsFrameList(nsIFrame* aHead) :
+    mFirstChild(aHead)
+  {
+    MOZ_COUNT_CTOR(nsFrameList);
 #ifdef DEBUG
     CheckForLoops();
 #endif
   }
 
+  nsFrameList(const nsFrameList& aOther) :
+    mFirstChild(aOther.mFirstChild)
+  {
+    MOZ_COUNT_CTOR(nsFrameList);
+  }
+
   ~nsFrameList() {
+    MOZ_COUNT_DTOR(nsFrameList);
+    // Don't destroy our frames here, so that we can have temporary nsFrameLists
   }
 
   void DestroyFrames();
@@ -75,58 +91,112 @@ public:
 #endif
   }
 
-  // Appends frames from aFrameList to this list. If aParent
-  // is not null, reparents the newly-added frames.
-  void AppendFrames(nsIFrame* aParent, nsIFrame* aFrameList);
+  void Clear() { SetFrames(nsnull); }
 
-  void AppendFrames(nsIFrame* aParent, nsFrameList& aFrameList) {
-    AppendFrames(aParent, aFrameList.mFirstChild);
-    aFrameList.mFirstChild = nsnull;
+  void SetFrames(nsFrameList& aFrameList) {
+    NS_PRECONDITION(!mFirstChild, "Losing frames");
+    mFirstChild = aFrameList.FirstChild();
+    aFrameList.Clear();
   }
 
-  void AppendFrame(nsIFrame* aParent, nsIFrame* aFrame);
+  class Slice;
 
-  // Take aFrame out of the frame list. This also disconnects aFrame
-  // from the sibling list. This will return PR_FALSE if aFrame is
-  // nsnull or if aFrame is not in the list. The second frame is
-  // a hint for the prev-sibling of aFrame; if the hint is correct,
-  // then this is O(1) time. If successfully removed, the child's
-  // NextSibling pointer is cleared.
+  /**
+   * Appends frames from aFrameList to this list. If aParent
+   * is not null, reparents the newly-added frames.
+   */
+  void AppendFrames(nsIFrame* aParent, nsIFrame* aFrameList) {
+    InsertFrames(aParent, LastChild(), aFrameList);
+  }
+
+  /**
+   * Appends aFrameList to this list.  If aParent is not null,
+   * reparents the newly added frames.  Clears out aFrameList and
+   * returns a list slice represening the newly-appended frames.
+   */
+  Slice AppendFrames(nsIFrame* aParent, nsFrameList& aFrameList) {
+    NS_PRECONDITION(!aFrameList.IsEmpty(), "Unexpected empty list");
+    nsIFrame* firstNewFrame = aFrameList.FirstChild();
+    AppendFrames(aParent, firstNewFrame);
+    aFrameList.Clear();
+    return Slice(*this, firstNewFrame, nsnull);
+  }
+
+  /* This is implemented in nsIFrame.h because it needs to know about
+     nsIFrame. */
+  inline void AppendFrame(nsIFrame* aParent, nsIFrame* aFrame);
+
+  /**
+   * Take aFrame out of the frame list. This also disconnects aFrame
+   * from the sibling list. This will return PR_FALSE if aFrame is
+   * nsnull or if aFrame is not in the list. The second frame is
+   * a hint for the prev-sibling of aFrame; if the hint is correct,
+   * then this is O(1) time. If successfully removed, the child's
+   * NextSibling pointer is cleared.
+   */
   PRBool RemoveFrame(nsIFrame* aFrame, nsIFrame* aPrevSiblingHint = nsnull);
 
-  // Remove the first child from the list. The caller is assumed to be
-  // holding a reference to the first child. This call is equivalent
-  // in behavior to calling RemoveFrame(FirstChild()). If successfully
-  // removed the first child's NextSibling pointer is cleared.
+  /**
+   * Remove the first child from the list. The caller is assumed to be
+   * holding a reference to the first child. This call is equivalent
+   * in behavior to calling RemoveFrame(FirstChild()). If successfully
+   * removed the first child's NextSibling pointer is cleared.
+   */
   PRBool RemoveFirstChild();
 
-  // Take aFrame out of the frame list and then destroy it. This also
-  // disconnects aFrame from the sibling list. This will return
-  // PR_FALSE if aFrame is nsnull or if aFrame is not in the list.
-  PRBool DestroyFrame(nsIFrame* aFrame);
+  /**
+   * Take aFrame out of the frame list and then destroy it. This also
+   * disconnects aFrame from the sibling list. This will return
+   * PR_FALSE if aFrame is nsnull or if aFrame is not in the list. The
+   * second frame is a hint for the prev-sibling of aFrame; if the
+   * hint is correct, then the time this method takes doesn't depend
+   * on the number of previous siblings of aFrame.
+   */
+  PRBool DestroyFrame(nsIFrame* aFrame, nsIFrame* aPrevSiblingHint = nsnull);
 
-  // Inserts aNewFrame right after aPrevSibling, or prepends to
-  // list if aPrevSibling is null. If aParent is not null, also
-  // reparents newly-added frame. Note that this method always
-  // sets the frame's nextSibling pointer.
-  void InsertFrame(nsIFrame* aParent,
-                   nsIFrame* aPrevSibling,
-                   nsIFrame* aNewFrame);
+  /**
+   * Inserts aNewFrame right after aPrevSibling, or prepends to
+   * list if aPrevSibling is null. If aParent is not null, also
+   * reparents newly-added frame. Note that this method always
+   * sets the frame's nextSibling pointer.
+   * This is implemented in nsIFrame.h because it needs to know about nsIFrame.
+   */
+  inline void InsertFrame(nsIFrame* aParent, nsIFrame* aPrevSibling,
+                          nsIFrame* aNewFrame);
 
-  // Inserts aFrameList right after aPrevSibling, or prepends to
-  // list if aPrevSibling is null. If aParent is not null, also
-  // reparents newly-added frame.
+  /**
+   * Inserts aFrameList right after aPrevSibling, or prepends to
+   * list if aPrevSibling is null. If aParent is not null, also
+   * reparents newly-added frame.
+   */
   void InsertFrames(nsIFrame* aParent,
                     nsIFrame* aPrevSibling,
                     nsIFrame* aFrameList);
 
-  void InsertFrames(nsIFrame* aParent, nsIFrame* aPrevSibling,
-                    nsFrameList& aFrameList) {
-    InsertFrames(aParent, aPrevSibling, aFrameList.FirstChild());
-    aFrameList.mFirstChild = nsnull;
-  }
+  /**
+   * Inserts aFrameList into this list after aPrevSibling (at the beginning if
+   * aPrevSibling is null).  If aParent is not null, reparents the newly added
+   * frames.  Clears out aFrameList and returns a list slice representing the
+   * newly-inserted frames.
+   *
+   * This is implemented in nsIFrame.h because it needs to know about nsIFrame.
+   */
+  inline Slice InsertFrames(nsIFrame* aParent, nsIFrame* aPrevSibling,
+                            nsFrameList& aFrameList);
 
-  PRBool Split(nsIFrame* aAfterFrame, nsIFrame** aNextFrameResult);
+  class FrameLinkEnumerator;
+
+  /* Split this frame list such that all the frames before the link pointed to
+   * by aLink end up in the returned list, while the remaining frames stay in
+   * this list.  After this call, aLink points to the beginning of this list.
+   */
+  nsFrameList ExtractHead(FrameLinkEnumerator& aLink);
+
+  /* Split this frame list such that all the frames coming after the link
+   * pointed to by aLink end up in the returned list, while the frames before
+   * that link stay in this list.  After this call, aLink is at end.
+   */
+  nsFrameList ExtractTail(FrameLinkEnumerator& aLink);
 
   /**
    * Sort the frames according to content order so that the first
@@ -160,6 +230,17 @@ public:
 
   nsIFrame* GetPrevSiblingFor(nsIFrame* aFrame) const;
 
+  /**
+   * If this frame list has only one frame, return that frame.
+   * Otherwise, return null.
+   */
+  nsIFrame* OnlyChild() const {
+    if (FirstChild() == LastChild()) {
+      return FirstChild();
+    }
+    return nsnull;
+  }
+
 #ifdef IBMBIDI
   /**
    * Return the frame before this frame in visual order (after Bidi reordering).
@@ -174,17 +255,150 @@ public:
   nsIFrame* GetNextVisualFor(nsIFrame* aFrame) const;
 #endif // IBMBIDI
 
-  void VerifyParent(nsIFrame* aParent) const;
-
-#ifdef NS_DEBUG
+#ifdef DEBUG
   void List(FILE* out) const;
 #endif
 
+  static nsresult Init();
+  static void Shutdown() { delete sEmptyList; }
+  static const nsFrameList& EmptyList() { return *sEmptyList; }
+
+  class Enumerator;
+
+  /**
+   * A class representing a slice of a frame list.
+   */
+  class Slice {
+    friend class Enumerator;
+
+  public:
+    // Implicit on purpose, so that we can easily create enumerators from
+    // nsFrameList via this impicit constructor.
+    Slice(const nsFrameList& aList) :
+#ifdef DEBUG
+      mList(aList),
+#endif
+      mStart(aList.FirstChild()),
+      mEnd(nsnull)
+    {}
+
+    Slice(const nsFrameList& aList, nsIFrame* aStart, nsIFrame* aEnd) :
+#ifdef DEBUG
+      mList(aList),
+#endif
+      mStart(aStart),
+      mEnd(aEnd)
+    {}
+
+    Slice(const Slice& aOther) :
+#ifdef DEBUG
+      mList(aOther.mList),
+#endif
+      mStart(aOther.mStart),
+      mEnd(aOther.mEnd)
+    {}
+
+  private:
+#ifdef DEBUG
+    const nsFrameList& mList;
+#endif
+    nsIFrame* const mStart; // our starting frame
+    const nsIFrame* const mEnd; // The first frame that is NOT in the slice.
+                                // May be null.
+  };
+
+  class Enumerator {
+  public:
+    Enumerator(const Slice& aSlice) :
+#ifdef DEBUG
+      mSlice(aSlice),
+#endif
+      mFrame(aSlice.mStart),
+      mEnd(aSlice.mEnd)
+    {}
+
+    Enumerator(const Enumerator& aOther) :
+#ifdef DEBUG
+      mSlice(aOther.mSlice),
+#endif
+      mFrame(aOther.mFrame),
+      mEnd(aOther.mEnd)
+    {}
+
+    PRBool AtEnd() const { return mFrame == mEnd; }
+
+    /* Next() needs to know about nsIFrame, and nsIFrame will need to
+       know about nsFrameList methods, so in order to inline this put
+       the implementation in nsIFrame.h */
+    inline void Next();
+
+    nsIFrame* get() const { return mFrame; }
+
+#ifdef DEBUG
+    const nsFrameList& List() const { return mSlice.mList; }
+#endif
+
+  protected:
+#ifdef DEBUG
+    /* Has to be an object, not a reference, since the slice could
+       well be a temporary constructed from an nsFrameList */
+    const Slice mSlice;
+#endif
+    nsIFrame* mFrame; // our current frame.
+    const nsIFrame* const mEnd; // The first frame we should NOT enumerate.
+                                // May be null.
+  };
+
+  /**
+   * A class that can be used to enumerate links between frames.  When created
+   * from an nsFrameList, it points to the "link" immediately before the first
+   * frame.  It can then be advanced until it points to the "link" immediately
+   * after the last frame.  At any position, PrevFrame() and NextFrame() are
+   * the frames before and after the given link.  This means PrevFrame() is
+   * null when the enumerator is at the beginning of the list and NextFrame()
+   * is null when it's AtEnd().
+   */
+  class FrameLinkEnumerator : private Enumerator {
+  public:
+    friend class nsFrameList;
+
+    FrameLinkEnumerator(const nsFrameList& aList) :
+      Enumerator(aList),
+      mPrev(nsnull)
+    {}
+
+    FrameLinkEnumerator(const FrameLinkEnumerator& aOther) :
+      Enumerator(aOther),
+      mPrev(aOther.mPrev)
+    {}
+
+    void operator=(const FrameLinkEnumerator& aOther) {
+      NS_PRECONDITION(&List() == &aOther.List(), "Different lists?");
+      mFrame = aOther.mFrame;
+      mPrev = aOther.mPrev;
+    }
+
+    void Next() {
+      mPrev = mFrame;
+      Enumerator::Next();
+    }
+
+    PRBool AtEnd() const { return Enumerator::AtEnd(); }
+
+    nsIFrame* PrevFrame() const { return mPrev; }
+    nsIFrame* NextFrame() const { return mFrame; }
+
+  protected:
+    nsIFrame* mPrev;
+  };
+
 private:
 #ifdef DEBUG
   void CheckForLoops();
 #endif
-  
+
+  static const nsFrameList* sEmptyList;
+
 protected:
   nsIFrame* mFirstChild;
 };