Merge m-c to fx-team, a=merge

accessible/windows/msaa/AccessibleWrap.cpp

@@ -1294,8 +1294,12 @@ AccessibleWrap::GetChildIDFor(Accessible* aAccessible)
   // so that the 3rd party application can call back and get the IAccessible
   // the event occurred on.
 
+  if (!aAccessible) {
+    return 0;
+  }
+
 #ifdef _WIN64
-  if (!aAccessible || (!aAccessible->Document() && !aAccessible->IsProxy()))
+  if (!aAccessible->Document() && !aAccessible->IsProxy())
     return 0;
 
   uint32_t* id = & static_cast<AccessibleWrap*>(aAccessible)->mID;

b2g/config/aries/sources.xml

@@ -15,12 +15,12 @@
   <project name="platform_build" path="build" remote="b2g" revision="8d83715f08b7849f16a0dfc88f78d5c3a89c0a54">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/dolphin/sources.xml

@@ -15,12 +15,12 @@
   <project name="platform_build" path="build" remote="b2g" revision="8d83715f08b7849f16a0dfc88f78d5c3a89c0a54">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/emulator-ics/sources.xml

@@ -19,12 +19,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="27eb2f04e149fc2c9976d881b1b5984bbe7ee089"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="12ff7481566587aa4198cf1287598acb3a999973"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="34ea6163f9f0e0122fb0bb03607eccdca31ced7a"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>

b2g/config/emulator-jb/sources.xml

@@ -17,9 +17,9 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="f004530b30a63c08a16d82536858600446b2abf5"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/emulator-kk/sources.xml

@@ -15,11 +15,11 @@
   <project name="platform_build" path="build" remote="b2g" revision="8d83715f08b7849f16a0dfc88f78d5c3a89c0a54">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/emulator-l/sources.xml

@@ -15,11 +15,11 @@
   <project name="platform_build" path="build" remote="b2g" revision="c9d4fe680662ee44a4bdea42ae00366f5df399cf">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/emulator/sources.xml

@@ -19,12 +19,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="27eb2f04e149fc2c9976d881b1b5984bbe7ee089"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="12ff7481566587aa4198cf1287598acb3a999973"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="34ea6163f9f0e0122fb0bb03607eccdca31ced7a"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>

b2g/config/flame-kk/sources.xml

@@ -15,12 +15,12 @@
   <project name="platform_build" path="build" remote="b2g" revision="8d83715f08b7849f16a0dfc88f78d5c3a89c0a54">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/gaia.json

@@ -1,9 +1,9 @@
 {
     "git": {
-        "git_revision": "f345f6a015709beeb2ca3955cab077fcaa959d3b", 
+        "git_revision": "1bc0b19527777ffee494962b48db4be857b07d64", 
         "remote": "https://git.mozilla.org/releases/gaia.git", 
         "branch": ""
     }, 
-    "revision": "83e7fd1f9ab848025ef06f1283ad95fe5005f26c", 
+    "revision": "d8e220a9a7bc3083b1cd9bc94f5a524e5b114384", 
     "repo_path": "integration/gaia-central"
 }

b2g/config/nexus-4-kk/sources.xml

@@ -15,12 +15,12 @@
   <project name="platform_build" path="build" remote="b2g" revision="8d83715f08b7849f16a0dfc88f78d5c3a89c0a54">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/nexus-4/sources.xml

@@ -18,9 +18,9 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="f004530b30a63c08a16d82536858600446b2abf5"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

b2g/config/nexus-5-l/sources.xml

@@ -15,12 +15,12 @@
   <project name="platform_build" path="build" remote="b2g" revision="c9d4fe680662ee44a4bdea42ae00366f5df399cf">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="f345f6a015709beeb2ca3955cab077fcaa959d3b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="1bc0b19527777ffee494962b48db4be857b07d64"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="fake-qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="939b377d55a2f081d94029a30a75d05e5a20daf3"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="9465d16f95ab87636b2ae07538ee88e5aeff2d7d"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
-  <project name="moztt" path="external/moztt" remote="b2g" revision="828317e64d28138f24d578ab340c2a0ff8552df0"/>
+  <project name="moztt" path="external/moztt" remote="b2g" revision="58909a53f638af022ab09f7a8f6976b0cae8f133"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="5ef30994f4778b4052e58a4383dbe7890048c87e"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="5f931350fbc87c3df9db8b0ceb37734b8b471593"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="48d8c7c950745f1b166b42125e6f0d3293d71636"/>

caps/BasePrincipal.cpp

@@ -395,7 +395,7 @@ BasePrincipal::GetUnknownAppId(bool* aUnknownAppId)
 }
 
 already_AddRefed<BasePrincipal>
-BasePrincipal::CreateCodebasePrincipal(nsIURI* aURI, const OriginAttributes& aAttrs)
+BasePrincipal::CreateCodebasePrincipal(nsIURI* aURI, OriginAttributes& aAttrs)
 {
   // If the URI is supposed to inherit the security context of whoever loads it,
   // we shouldn't make a codebase principal for it.

caps/BasePrincipal.h

@@ -159,7 +159,7 @@ public:
   virtual bool IsCodebasePrincipal() const { return false; };
 
   static BasePrincipal* Cast(nsIPrincipal* aPrin) { return static_cast<BasePrincipal*>(aPrin); }
-  static already_AddRefed<BasePrincipal> CreateCodebasePrincipal(nsIURI* aURI, const OriginAttributes& aAttrs);
+  static already_AddRefed<BasePrincipal> CreateCodebasePrincipal(nsIURI* aURI, OriginAttributes& aAttrs);
 
   const OriginAttributes& OriginAttributesRef() { return mOriginAttributes; }
   uint32_t AppId() const { return mOriginAttributes.mAppId; }

configure.in

@@ -4780,6 +4780,21 @@ then
 fi
 AC_SUBST(MOZ_ENABLE_DBUS)
 
+dnl ========================================================
+dnl = speech-dispatcher support
+dnl ========================================================
+
+if test "$MOZ_ENABLE_GTK" -o "$MOZ_ENABLE_QT"
+then
+    MOZ_SYNTH_SPEECHD=1
+
+    MOZ_ARG_DISABLE_BOOL(synth-speechd,
+    [  --disable-synth-speechd Disable speech-dispatcher support ],
+        MOZ_SYNTH_SPEECHD=,
+        MOZ_SYNTH_SPEECHD=1)
+fi
+AC_SUBST(MOZ_SYNTH_SPEECHD)
+
 dnl ========================================================
 dnl = Enable Android History instead of Places
 dnl ========================================================

dom/base/StructuredCloneHelper.cpp

@@ -425,14 +425,15 @@ StructuredCloneHelper::ReadFullySerializableObjects(JSContext* aCx,
     } else if (aTag == SCTAG_DOM_NULL_PRINCIPAL) {
       info = mozilla::ipc::NullPrincipalInfo();
     } else {
-      uint32_t suffixLength, specLength;
+      uint32_t appId = aIndex;
-      if (!JS_ReadUint32Pair(aReader, &suffixLength, &specLength)) {
+
+      uint32_t isInBrowserElement, specLength;
+      if (!JS_ReadUint32Pair(aReader, &isInBrowserElement, &specLength)) {
         return nullptr;
       }
 
-      nsAutoCString suffix;
+      uint32_t signedPkgLength, dummy;
-      suffix.SetLength(suffixLength);
+      if (!JS_ReadUint32Pair(aReader, &signedPkgLength, &dummy)) {
-      if (!JS_ReadBytes(aReader, suffix.BeginWriting(), suffixLength)) {
         return nullptr;
       }
 
@@ -442,9 +443,14 @@ StructuredCloneHelper::ReadFullySerializableObjects(JSContext* aCx,
         return nullptr;
       }
 
-      OriginAttributes attrs;
+      nsAutoCString signedPkg;
-      attrs.PopulateFromSuffix(suffix);
+      signedPkg.SetLength(signedPkgLength);
-      info = mozilla::ipc::ContentPrincipalInfo(attrs, spec);
+      if (!JS_ReadBytes(aReader, signedPkg.BeginWriting(), signedPkgLength)) {
+        return nullptr;
+      }
+
+      info = mozilla::ipc::ContentPrincipalInfo(appId, isInBrowserElement,
+                                                spec, signedPkg);
     }
 
     nsresult rv;
@@ -571,12 +577,13 @@ StructuredCloneHelper::WriteFullySerializableObjects(JSContext* aCx,
 
       MOZ_ASSERT(info.type() == mozilla::ipc::PrincipalInfo::TContentPrincipalInfo);
       const mozilla::ipc::ContentPrincipalInfo& cInfo = info;
-      nsAutoCString suffix;
+      return JS_WriteUint32Pair(aWriter, SCTAG_DOM_CONTENT_PRINCIPAL,
-      cInfo.attrs().CreateSuffix(suffix);
+                                cInfo.appId()) &&
-      return JS_WriteUint32Pair(aWriter, SCTAG_DOM_CONTENT_PRINCIPAL, 0) &&
+             JS_WriteUint32Pair(aWriter, cInfo.isInBrowserElement(),
-             JS_WriteUint32Pair(aWriter, suffix.Length(), cInfo.spec().Length()) &&
+                                cInfo.spec().Length()) &&
-             JS_WriteBytes(aWriter, suffix.get(), suffix.Length()) &&
+             JS_WriteUint32Pair(aWriter, cInfo.signedPkg().Length(), 0) &&
-             JS_WriteBytes(aWriter, cInfo.spec().get(), cInfo.spec().Length());
+             JS_WriteBytes(aWriter, cInfo.spec().get(), cInfo.spec().Length()) &&
+             JS_WriteBytes(aWriter, cInfo.signedPkg().get(), cInfo.signedPkg().Length());
     }
   }
 

dom/base/nsContentUtils.cpp

@@ -8161,6 +8161,26 @@ nsContentUtils::InternalStorageAllowedForPrincipal(nsIPrincipal* aPrincipal,
   // About URIs are allowed to access storage, even if they don't have chrome
   // privileges. If this is not desired, than the consumer will have to
   // implement their own restriction functionality.
+  //
+  // This is due to backwards-compatibility and the state of storage access before
+  // the introducton of nsContentUtils::InternalStorageAllowedForPrincipal:
+  //
+  // BEFORE:
+  // localStorage, caches: allowed in 3rd-party iframes always
+  // IndexedDB: allowed in 3rd-party iframes only if 3rd party URI is an about:
+  //   URI within a specific whitelist
+  //
+  // AFTER:
+  // localStorage, caches: allowed in 3rd-party iframes by default. Preference
+  //   can be set to disable in 3rd-party, which will not disallow in about: URIs.
+  // IndexedDB: allowed in 3rd-party iframes by default. Preference can be set to
+  //   disable in 3rd-party, which will disallow in about: URIs, unless they are
+  //   within a specific whitelist.
+  //
+  // This means that behavior for storage with internal about: URIs should not be
+  // affected, which is desireable due to the lack of automated testing for about:
+  // URIs with these preferences set, and the importance of the correct functioning
+  // of these URIs even with custom preferences.
   nsCOMPtr<nsIURI> uri;
   nsresult rv = aPrincipal->GetURI(getter_AddRefs(uri));
   if (NS_SUCCEEDED(rv) && uri) {

dom/base/nsFrameMessageManager.cpp

@@ -1806,25 +1806,21 @@ nsMessageManagerScriptExecutor::TryCacheLoadAndCompileScript(
       if (!JS::Compile(cx, options, srcBuf, &script)) {
         return;
       }
-    } else {
     // We're going to run these against some non-global scope.
-      if (!JS::CompileForNonSyntacticScope(cx, options, srcBuf, &script)) {
+    } else if (!JS::CompileForNonSyntacticScope(cx, options, srcBuf, &script)) {
       return;
     }
-    }
 
+    MOZ_ASSERT(script);
     aScriptp.set(script);
 
     nsAutoCString scheme;
     uri->GetScheme(scheme);
     // We don't cache data: scripts!
     if (aShouldCache && !scheme.EqualsLiteral("data")) {
-      nsMessageManagerScriptHolder* holder;
-
       // Root the object also for caching.
-      if (script) {
+      nsMessageManagerScriptHolder* holder =
-        holder = new nsMessageManagerScriptHolder(cx, script, aRunInGlobalScope);
+        new nsMessageManagerScriptHolder(cx, script, aRunInGlobalScope);
-      }
       sCachedScripts->Put(aURL, holder);
     }
   }

dom/base/nsScriptLoader.cpp

@@ -114,6 +114,7 @@ nsScriptLoadRequestList::Contains(nsScriptLoadRequest* aElem)
 nsScriptLoader::nsScriptLoader(nsIDocument *aDocument)
   : mDocument(aDocument),
     mBlockerCount(0),
+    mNumberOfProcessors(0),
     mEnabled(true),
     mDeferEnabled(false),
     mDocumentParsingDone(false),
@@ -1503,6 +1504,18 @@ nsScriptLoader::ContinueParserAsync(nsScriptLoadRequest* aParserBlockingRequest)
   aParserBlockingRequest->mElement->ContinueParserAsync();
 }
 
+uint32_t
+nsScriptLoader::NumberOfProcessors()
+{
+  if (mNumberOfProcessors > 0)
+    return mNumberOfProcessors;
+
+  int32_t numProcs = PR_GetNumberOfProcessors();
+  if (numProcs > 0)
+    mNumberOfProcessors = numProcs;
+  return mNumberOfProcessors;
+}
+
 nsresult
 nsScriptLoader::PrepareLoadedRequest(nsScriptLoadRequest* aRequest,
                                      nsIStreamLoader* aLoader,
@@ -1589,7 +1602,7 @@ nsScriptLoader::PrepareLoadedRequest(nsScriptLoadRequest* aRequest,
   aRequest->mProgress = nsScriptLoadRequest::Progress_DoneLoading;
 
   // If this is currently blocking the parser, attempt to compile it off-main-thread.
-  if (aRequest == mParserBlockingRequest && (PR_GetNumberOfProcessors() > 1)) {
+  if (aRequest == mParserBlockingRequest && (NumberOfProcessors() > 1)) {
     nsresult rv = AttemptAsyncScriptCompile(aRequest);
     if (rv == NS_OK) {
       NS_ASSERTION(aRequest->mProgress == nsScriptLoadRequest::Progress_Compiling,

dom/base/nsScriptLoader.h

@@ -487,6 +487,7 @@ private:
                                     JS::Handle<JSObject *> aScopeChain,
                                     JS::CompileOptions *aOptions);
 
+  uint32_t NumberOfProcessors();
   nsresult PrepareLoadedRequest(nsScriptLoadRequest* aRequest,
                                 nsIStreamLoader* aLoader,
                                 nsresult aStatus,
@@ -530,6 +531,7 @@ private:
   // XXXbz do we want to cycle-collect these or something?  Not sure.
   nsTArray< nsRefPtr<nsScriptLoader> > mPendingChildLoaders;
   uint32_t mBlockerCount;
+  uint32_t mNumberOfProcessors;
   bool mEnabled;
   bool mDeferEnabled;
   bool mDocumentParsingDone;

dom/cache/CacheStorage.cpp

@@ -81,7 +81,7 @@ IsTrusted(const PrincipalInfo& aPrincipalInfo, bool aTestingPrefEnabled)
   // worker.  We require exact knowledge of this information before allowing
   // the caller to touch the disk using the Cache API.
   if (NS_WARN_IF(aPrincipalInfo.type() != PrincipalInfo::TContentPrincipalInfo ||
-                 aPrincipalInfo.get_ContentPrincipalInfo().attrs().mAppId ==
+                 aPrincipalInfo.get_ContentPrincipalInfo().appId() ==
                  nsIScriptSecurityManager::UNKNOWN_APP_ID)) {
     return false;
   }

dom/cache/DBSchema.cpp

@@ -1740,8 +1740,10 @@ InsertEntry(mozIStorageConnection* aConn, CacheId aCacheId,
 
     serializedInfo.Append(cInfo.spec());
 
+    MOZ_ASSERT(cInfo.appId() != nsIScriptSecurityManager::UNKNOWN_APP_ID);
+    OriginAttributes attrs(cInfo.appId(), cInfo.isInBrowserElement());
     nsAutoCString suffix;
-    cInfo.attrs().CreateSuffix(suffix);
+    attrs.CreateSuffix(suffix);
     serializedInfo.Append(suffix);
   }
 
@@ -1911,8 +1913,9 @@ ReadResponse(mozIStorageConnection* aConn, EntryId aEntryId,
       return NS_ERROR_FAILURE;
     }
 
+    nsCString signedPkg = NS_ConvertUTF16toUTF8(attrs.mSignedPkg);
     aSavedResponseOut->mValue.principalInfo() =
-      mozilla::ipc::ContentPrincipalInfo(attrs, originNoSuffix);
+      mozilla::ipc::ContentPrincipalInfo(attrs.mAppId, attrs.mInBrowser, originNoSuffix, signedPkg);
   }
 
   int32_t redirected;

dom/ipc/PBrowser.ipdl

@@ -330,14 +330,6 @@ parent:
 
     sync IsParentWindowMainWidgetVisible() returns (bool visible);
 
-    /**
-     * Returns the offset of this tab from the top level window
-     * origin in device pixels.
-     *
-     * aPoint offset values in device pixels.
-     */
-    prio(high) sync GetTabOffset() returns (LayoutDeviceIntPoint aPoint);
-
     /**
      * Gets the DPI of the screen corresponding to this browser.
      */

dom/ipc/TabParent.cpp

@@ -2266,13 +2266,6 @@ TabParent::RecvEnableDisableCommands(const nsString& aAction,
   return true;
 }
 
-bool
-TabParent::RecvGetTabOffset(LayoutDeviceIntPoint* aPoint)
-{
-  *aPoint = GetChildProcessOffset();
-  return true;
-}
-
 NS_IMETHODIMP
 TabParent::GetChildProcessOffset(int32_t* aOutCssX, int32_t* aOutCssY)
 {

dom/ipc/TabParent.h

@@ -219,7 +219,6 @@ public:
     virtual bool RecvIsParentWindowMainWidgetVisible(bool* aIsVisible) override;
     virtual bool RecvShowTooltip(const uint32_t& aX, const uint32_t& aY, const nsString& aTooltip) override;
     virtual bool RecvHideTooltip() override;
-    virtual bool RecvGetTabOffset(LayoutDeviceIntPoint* aPoint) override;
     virtual bool RecvGetDPI(float* aValue) override;
     virtual bool RecvGetDefaultScale(double* aValue) override;
     virtual bool RecvGetMaxTouchPoints(uint32_t* aTouchPoints) override;

dom/media/tests/mochitest/ipc/mochitest.ini

@@ -6,4 +6,4 @@ support-files =
 skip-if = e10s
 
 [test_ipc.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || os == 'win' #bug 910661 # b2g(nested ipc not working) b2g-debug(debug-only failure) b2g-desktop(nested ipc not working)(win : Bug 1179826)
+skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' #bug 910661 # b2g(nested ipc not working) b2g-debug(debug-only failure) b2g-desktop(nested ipc not working)

dom/media/webm/WebMDemuxer.cpp

@@ -11,6 +11,7 @@
 #include "WebMDemuxer.h"
 #include "WebMBufferedParser.h"
 #include "gfx2DGlue.h"
+#include "mozilla/Endian.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/SharedThreadPool.h"
 #include "MediaDataDemuxer.h"

dom/media/webspeech/synth/moz.build

@@ -41,10 +41,16 @@ if CONFIG['MOZ_WEBSPEECH']:
             'test/nsFakeSynthServices.cpp'
         ]
 
+    DIRS = []
+
     if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
-        DIRS = ['windows']
+        DIRS += ['windows']
-    elif CONFIG['MOZ_SYNTH_PICO']:
+
-        DIRS = ['pico']
+    if CONFIG['MOZ_SYNTH_SPEECHD']:
+        DIRS += ['speechd']
+
+    if CONFIG['MOZ_SYNTH_PICO']:
+        DIRS += ['pico']
 
 IPDL_SOURCES += [
     'ipc/PSpeechSynthesis.ipdl',

dom/media/webspeech/synth/speechd/SpeechDispatcherModule.cpp

@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ModuleUtils.h"
+#include "nsIClassInfoImpl.h"
+#include "SpeechDispatcherService.h"
+
+using namespace mozilla::dom;
+
+#define SPEECHDISPATCHERSERVICE_CID \
+  {0x8817b1cf, 0x5ada, 0x43bf, {0xbd, 0x73, 0x60, 0x76, 0x57, 0x70, 0x3d, 0x0d}}
+
+#define SPEECHDISPATCHERSERVICE_CONTRACTID "@mozilla.org/synthspeechdispatcher;1"
+
+// Defines SpeechDispatcherServiceConstructor
+NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(SpeechDispatcherService,
+                                         SpeechDispatcherService::GetInstanceForService)
+
+// Defines kSPEECHDISPATCHERSERVICE_CID
+NS_DEFINE_NAMED_CID(SPEECHDISPATCHERSERVICE_CID);
+
+static const mozilla::Module::CIDEntry kCIDs[] = {
+  { &kSPEECHDISPATCHERSERVICE_CID, true, nullptr, SpeechDispatcherServiceConstructor },
+  { nullptr }
+};
+
+static const mozilla::Module::ContractIDEntry kContracts[] = {
+  { SPEECHDISPATCHERSERVICE_CONTRACTID, &kSPEECHDISPATCHERSERVICE_CID },
+  { nullptr }
+};
+
+static const mozilla::Module::CategoryEntry kCategories[] = {
+  { "profile-after-change", "SpeechDispatcher Speech Synth", SPEECHDISPATCHERSERVICE_CONTRACTID },
+  { nullptr }
+};
+
+static void
+UnloadSpeechDispatcherModule()
+{
+  SpeechDispatcherService::Shutdown();
+}
+
+static const mozilla::Module kModule = {
+  mozilla::Module::kVersion,
+  kCIDs,
+  kContracts,
+  kCategories,
+  nullptr,
+  nullptr,
+  UnloadSpeechDispatcherModule
+};
+
+NSMODULE_DEFN(synthspeechdispatcher) = &kModule;

dom/media/webspeech/synth/speechd/SpeechDispatcherService.cpp

@@ -0,0 +1,557 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "SpeechDispatcherService.h"
+
+#include "mozilla/dom/nsSpeechTask.h"
+#include "mozilla/dom/nsSynthVoiceRegistry.h"
+#include "mozilla/Preferences.h"
+#include "nsEscape.h"
+#include "nsISupports.h"
+#include "nsPrintfCString.h"
+#include "nsReadableUtils.h"
+#include "nsServiceManagerUtils.h"
+#include "nsThreadUtils.h"
+#include "prlink.h"
+
+#define URI_PREFIX "urn:moz-tts:sapi:"
+
+// Some structures for libspeechd
+typedef enum {
+  SPD_EVENT_BEGIN,
+  SPD_EVENT_END,
+  SPD_EVENT_INDEX_MARK,
+  SPD_EVENT_CANCEL,
+  SPD_EVENT_PAUSE,
+  SPD_EVENT_RESUME
+} SPDNotificationType;
+
+typedef enum {
+  SPD_BEGIN = 1,
+  SPD_END = 2,
+  SPD_INDEX_MARKS = 4,
+  SPD_CANCEL = 8,
+  SPD_PAUSE = 16,
+  SPD_RESUME = 32,
+
+  SPD_ALL = 0x3f
+} SPDNotification;
+
+typedef enum {
+  SPD_MODE_SINGLE = 0,
+  SPD_MODE_THREADED = 1
+} SPDConnectionMode;
+
+typedef void (*SPDCallback) (size_t msg_id, size_t client_id,
+                             SPDNotificationType state);
+
+typedef void (*SPDCallbackIM) (size_t msg_id, size_t client_id,
+                               SPDNotificationType state, char* index_mark);
+
+struct SPDConnection
+{
+  SPDCallback callback_begin;
+  SPDCallback callback_end;
+  SPDCallback callback_cancel;
+  SPDCallback callback_pause;
+  SPDCallback callback_resume;
+  SPDCallbackIM callback_im;
+
+  /* partial, more private fields in structure */
+};
+
+struct SPDVoice
+{
+  char* name;
+  char* language;
+  char* variant;
+};
+
+typedef enum {
+  SPD_IMPORTANT = 1,
+  SPD_MESSAGE = 2,
+  SPD_TEXT = 3,
+  SPD_NOTIFICATION = 4,
+  SPD_PROGRESS = 5
+} SPDPriority;
+
+#define SPEECHD_FUNCTIONS \
+  FUNC(spd_open, SPDConnection*, (const char*, const char*, const char*, SPDConnectionMode)) \
+  FUNC(spd_close, void, (SPDConnection*)) \
+  FUNC(spd_list_synthesis_voices, SPDVoice**, (SPDConnection*)) \
+  FUNC(spd_say, int, (SPDConnection*, SPDPriority, const char*)) \
+  FUNC(spd_cancel, int, (SPDConnection*)) \
+  FUNC(spd_set_volume, int, (SPDConnection*, int)) \
+  FUNC(spd_set_voice_rate, int, (SPDConnection*, int)) \
+  FUNC(spd_set_voice_pitch, int, (SPDConnection*, int)) \
+  FUNC(spd_set_synthesis_voice, int, (SPDConnection*, const char*)) \
+  FUNC(spd_set_notification_on, int, (SPDConnection*, SPDNotification))
+
+#define FUNC(name, type, params) \
+  typedef type (*_##name##_fn) params; \
+  static _##name##_fn _##name;
+
+SPEECHD_FUNCTIONS
+
+#undef FUNC
+
+#define spd_open _spd_open
+#define spd_close _spd_close
+#define spd_list_synthesis_voices _spd_list_synthesis_voices
+#define spd_say _spd_say
+#define spd_cancel _spd_cancel
+#define spd_set_volume _spd_set_volume
+#define spd_set_voice_rate _spd_set_voice_rate
+#define spd_set_voice_pitch _spd_set_voice_pitch
+#define spd_set_synthesis_voice _spd_set_synthesis_voice
+#define spd_set_notification_on _spd_set_notification_on
+
+static PRLibrary* speechdLib = nullptr;
+
+typedef void (*nsSpeechDispatcherFunc)();
+struct nsSpeechDispatcherDynamicFunction
+{
+  const char* functionName;
+  nsSpeechDispatcherFunc* function;
+};
+
+namespace mozilla {
+namespace dom {
+
+StaticRefPtr<SpeechDispatcherService> SpeechDispatcherService::sSingleton;
+
+class SpeechDispatcherVoice
+{
+public:
+
+  SpeechDispatcherVoice(const nsAString& aName, const nsAString& aLanguage)
+    : mName(aName), mLanguage(aLanguage) {}
+
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SpeechDispatcherVoice)
+
+  // Voice name
+  nsString mName;
+
+  // Voice language, in BCP-47 syntax
+  nsString mLanguage;
+
+private:
+  ~SpeechDispatcherVoice() {}
+};
+
+
+class SpeechDispatcherCallback final : public nsISpeechTaskCallback
+{
+public:
+  SpeechDispatcherCallback(nsISpeechTask* aTask, SpeechDispatcherService* aService)
+    : mTask(aTask)
+    , mService(aService) {}
+
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(SpeechDispatcherCallback, nsISpeechTaskCallback)
+
+  NS_DECL_NSISPEECHTASKCALLBACK
+
+  bool OnSpeechEvent(SPDNotificationType state);
+
+private:
+  ~SpeechDispatcherCallback() { }
+
+  // This pointer is used to dispatch events
+  nsCOMPtr<nsISpeechTask> mTask;
+
+  // By holding a strong reference to the service we guarantee that it won't be
+  // destroyed before this runnable.
+  nsRefPtr<SpeechDispatcherService> mService;
+
+  TimeStamp mStartTime;
+};
+
+NS_IMPL_CYCLE_COLLECTION(SpeechDispatcherCallback, mTask);
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SpeechDispatcherCallback)
+  NS_INTERFACE_MAP_ENTRY(nsISpeechTaskCallback)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsISpeechTaskCallback)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(SpeechDispatcherCallback)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(SpeechDispatcherCallback)
+
+NS_IMETHODIMP
+SpeechDispatcherCallback::OnPause()
+{
+  // XXX: Speech dispatcher does not pause immediately, but waits for the speech
+  // to reach an index mark so that it could resume from that offset.
+  // There is no support for word or sentence boundaries, so index marks would
+  // only occur in explicit SSML marks, and we don't support that yet.
+  // What in actuality happens, is that if you call spd_pause(), it will speak
+  // the utterance in its entirety, dispatch an end event, and then put speechd
+  // in a 'paused' state. Since it is after the utterance ended, we don't get
+  // that state change, and our speech api is in an unrecoverable state.
+  // So, since it is useless anyway, I am not implementing pause.
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+SpeechDispatcherCallback::OnResume()
+{
+  // XXX: Unsupported, see OnPause().
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+SpeechDispatcherCallback::OnCancel()
+{
+  if (spd_cancel(mService->mSpeechdClient) < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+SpeechDispatcherCallback::OnVolumeChanged(float aVolume)
+{
+  // XXX: This currently does not change the volume mid-utterance, but it
+  // doesn't do anything bad either. So we could put this here with the hopes
+  // that speechd supports this in the future.
+  if (spd_set_volume(mService->mSpeechdClient, static_cast<int>(aVolume * 100)) < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+bool
+SpeechDispatcherCallback::OnSpeechEvent(SPDNotificationType state)
+{
+  bool remove = false;
+
+  switch (state) {
+    case SPD_EVENT_BEGIN:
+      mStartTime = TimeStamp::Now();
+      mTask->DispatchStart();
+      break;
+
+    case SPD_EVENT_PAUSE:
+      mTask->DispatchPause((TimeStamp::Now() - mStartTime).ToSeconds(), 0);
+      break;
+
+    case SPD_EVENT_RESUME:
+      mTask->DispatchResume((TimeStamp::Now() - mStartTime).ToSeconds(), 0);
+      break;
+
+    case SPD_EVENT_CANCEL:
+    case SPD_EVENT_END:
+      mTask->DispatchEnd((TimeStamp::Now() - mStartTime).ToSeconds(), 0);
+      remove = true;
+      break;
+
+    case SPD_EVENT_INDEX_MARK:
+      // Not yet supported
+      break;
+
+    default:
+      break;
+  }
+
+  return remove;
+}
+
+static void
+speechd_cb(size_t msg_id, size_t client_id, SPDNotificationType state)
+{
+  SpeechDispatcherService* service = SpeechDispatcherService::GetInstance(false);
+
+  if (service) {
+    NS_DispatchToMainThread(
+      NS_NewRunnableMethodWithArgs<uint32_t, SPDNotificationType>(
+        service, &SpeechDispatcherService::EventNotify,
+        static_cast<uint32_t>(msg_id), state));
+  }
+}
+
+
+NS_INTERFACE_MAP_BEGIN(SpeechDispatcherService)
+  NS_INTERFACE_MAP_ENTRY(nsISpeechService)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsISpeechService)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_ADDREF(SpeechDispatcherService)
+NS_IMPL_RELEASE(SpeechDispatcherService)
+
+SpeechDispatcherService::SpeechDispatcherService()
+  : mInitialized(false)
+  , mSpeechdClient(nullptr)
+{
+  if (!Preferences::GetBool("media.webspeech.synth.enabled") ||
+      Preferences::GetBool("media.webspeech.synth.test")) {
+    return;
+  }
+
+  // While speech dispatcher has a "threaded" mode, only spd_say() is async.
+  // Since synchronous socket i/o could impact startup time, we do
+  // initialization in a separate thread.
+  DebugOnly<nsresult> rv = NS_NewNamedThread("speechd init",
+                                             getter_AddRefs(mInitThread));
+  MOZ_ASSERT(NS_SUCCEEDED(rv));
+  rv = mInitThread->Dispatch(
+    NS_NewRunnableMethod(this, &SpeechDispatcherService::Init), NS_DISPATCH_NORMAL);
+  MOZ_ASSERT(NS_SUCCEEDED(rv));
+}
+
+SpeechDispatcherService::~SpeechDispatcherService()
+{
+  if (mInitThread) {
+    mInitThread->Shutdown();
+  }
+
+  if (mSpeechdClient) {
+    spd_close(mSpeechdClient);
+  }
+}
+
+void
+SpeechDispatcherService::Init()
+{
+#define FUNC(name, type, params) { #name, (nsSpeechDispatcherFunc *)&_##name },
+  static const nsSpeechDispatcherDynamicFunction kSpeechDispatcherSymbols[] = {
+    SPEECHD_FUNCTIONS
+  };
+#undef FUNC
+
+  MOZ_ASSERT(!mInitialized);
+
+  speechdLib = PR_LoadLibrary("libspeechd.so.2");
+
+  if (!speechdLib) {
+    NS_WARNING("Failed to load speechd library");
+    return;
+  }
+
+  for (uint32_t i = 0; i < ArrayLength(kSpeechDispatcherSymbols); i++) {
+    *kSpeechDispatcherSymbols[i].function =
+      PR_FindFunctionSymbol(speechdLib, kSpeechDispatcherSymbols[i].functionName);
+
+    if (!*kSpeechDispatcherSymbols[i].function) {
+      NS_WARNING(nsPrintfCString("Failed to find speechd symbol for'%s'",
+                                 kSpeechDispatcherSymbols[i].functionName).get());
+      return;
+    }
+  }
+
+  mSpeechdClient = spd_open("firefox", "web speech api", "who", SPD_MODE_THREADED);
+
+  // Get all the voices from sapi and register in the SynthVoiceRegistry
+  SPDVoice** list = spd_list_synthesis_voices(mSpeechdClient);
+
+  mSpeechdClient->callback_begin = speechd_cb;
+  mSpeechdClient->callback_end = speechd_cb;
+  mSpeechdClient->callback_cancel = speechd_cb;
+  mSpeechdClient->callback_pause = speechd_cb;
+  mSpeechdClient->callback_resume = speechd_cb;
+
+  spd_set_notification_on(mSpeechdClient, SPD_BEGIN);
+  spd_set_notification_on(mSpeechdClient, SPD_END);
+  spd_set_notification_on(mSpeechdClient, SPD_CANCEL);
+
+  if (list != NULL) {
+    for (int i = 0; list[i]; i++) {
+      nsAutoString uri;
+
+      uri.AssignLiteral(URI_PREFIX);
+      nsAutoCString name;
+      NS_EscapeURL(list[i]->name, -1, esc_OnlyNonASCII | esc_AlwaysCopy, name);
+      uri.Append(NS_ConvertUTF8toUTF16(name));;
+      uri.AppendLiteral("?");
+
+      nsAutoCString lang(list[i]->language);
+
+      if (strcmp(list[i]->variant, "none") != 0) {
+        // In speech dispatcher, the variant will usually be the locale subtag
+        // with another, non-standard suptag after it. We keep the first one
+        // and convert it to uppercase.
+        const char* v = list[i]->variant;
+        const char* hyphen = strchr(v, '-');
+        nsDependentCSubstring variant(v, hyphen ? hyphen - v : strlen(v));
+        ToUpperCase(variant);
+
+        // eSpeak uses UK which is not a valid region subtag in BCP47.
+        if (variant.Equals("UK")) {
+          variant.AssignLiteral("GB");
+        }
+
+        lang.AppendLiteral("-");
+        lang.Append(variant);
+      }
+
+      uri.Append(NS_ConvertUTF8toUTF16(lang));
+
+      mVoices.Put(uri, new SpeechDispatcherVoice(
+                    NS_ConvertUTF8toUTF16(list[i]->name),
+                    NS_ConvertUTF8toUTF16(lang)));
+    }
+  }
+
+  NS_DispatchToMainThread(NS_NewRunnableMethod(this, &SpeechDispatcherService::RegisterVoices));
+
+  //mInitialized = true;
+}
+
+struct VoiceTraverserData
+{
+  SpeechDispatcherService* mService;
+  nsSynthVoiceRegistry* mRegistry;
+};
+
+// private methods
+
+static PLDHashOperator
+AddVoiceTraverser(const nsAString& aUri,
+                  nsRefPtr<SpeechDispatcherVoice>& aVoice,
+                  void* aUserArg)
+{
+  VoiceTraverserData* data = static_cast<VoiceTraverserData*>(aUserArg);
+
+  // This service can only speak one utterance at a time, se we set
+  // aQueuesUtterances to true in order to track global state and schedule
+  // access to this service.
+  DebugOnly<nsresult> rv = data->mRegistry->AddVoice(data->mService, aUri,
+                                                     aVoice->mName, aVoice->mLanguage,
+                                                     aVoice->mName.EqualsLiteral("default"), true);
+
+  NS_WARN_IF_FALSE(NS_SUCCEEDED(rv), "Failed to add voice");
+
+  return PL_DHASH_NEXT;
+}
+
+void
+SpeechDispatcherService::RegisterVoices()
+{
+  VoiceTraverserData data = { this, nsSynthVoiceRegistry::GetInstance() };
+  mVoices.Enumerate(AddVoiceTraverser, &data);
+
+  mInitThread->Shutdown();
+  mInitThread = nullptr;
+
+  mInitialized = true;
+}
+
+// TODO: Support SSML
+NS_IMETHODIMP
+SpeechDispatcherService::Speak(const nsAString& aText, const nsAString& aUri,
+                               float aVolume, float aRate, float aPitch,
+                               nsISpeechTask* aTask)
+{
+  if (NS_WARN_IF(!mInitialized)) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  nsRefPtr<SpeechDispatcherCallback> callback =
+    new SpeechDispatcherCallback(aTask, this);
+
+  bool found = false;
+  SpeechDispatcherVoice* voice = mVoices.GetWeak(aUri, &found);
+
+  if(NS_WARN_IF(!(found))) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  spd_set_synthesis_voice(mSpeechdClient,
+                          NS_ConvertUTF16toUTF8(voice->mName).get());
+
+  // We provide a volume of 0.0 to 1.0, speech-dispatcher expects 0 - 100.
+  spd_set_volume(mSpeechdClient, static_cast<int>(aVolume * 100));
+
+  // We provide a rate of 0.1 to 10 with 1 being default.
+  // speech-dispatcher expects -100 to 100 with 0 being default.
+  int rate = 0;
+
+  if (aRate > 1) {
+    rate = static_cast<int>((aRate - 1) * 10);
+  } else if (aRate <= 1) {
+    rate = static_cast<int>((aRate - 1) * (100/0.9));
+  }
+
+  spd_set_voice_rate(mSpeechdClient, rate);
+
+  // We provide a pitch of 0 to 2 with 1 being the default.
+  // speech-dispatcher expects -100 to 100 with 0 being default.
+  spd_set_voice_pitch(mSpeechdClient, static_cast<int>((aPitch - 1) * 100));
+
+  // The last three parameters don't matter for an indirect service
+  nsresult rv = aTask->Setup(callback, 0, 0, 0);
+
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  int msg_id = spd_say(mSpeechdClient, SPD_MESSAGE, NS_ConvertUTF16toUTF8(aText).get());
+
+  if (msg_id < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  mCallbacks.Put(msg_id, callback);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+SpeechDispatcherService::GetServiceType(SpeechServiceType* aServiceType)
+{
+  *aServiceType = nsISpeechService::SERVICETYPE_INDIRECT_AUDIO;
+  return NS_OK;
+}
+
+SpeechDispatcherService*
+SpeechDispatcherService::GetInstance(bool create)
+{
+  if (XRE_GetProcessType() != GeckoProcessType_Default) {
+    MOZ_ASSERT(false,
+               "SpeechDispatcherService can only be started on main gecko process");
+    return nullptr;
+  }
+
+  if (!sSingleton && create) {
+    sSingleton = new SpeechDispatcherService();
+  }
+
+  return sSingleton;
+}
+
+already_AddRefed<SpeechDispatcherService>
+SpeechDispatcherService::GetInstanceForService()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsRefPtr<SpeechDispatcherService> sapiService = GetInstance();
+  return sapiService.forget();
+}
+
+void
+SpeechDispatcherService::EventNotify(uint32_t aMsgId, uint32_t aState)
+{
+  SpeechDispatcherCallback* callback = mCallbacks.GetWeak(aMsgId);
+
+  if (callback) {
+    if (callback->OnSpeechEvent((SPDNotificationType)aState)) {
+      mCallbacks.Remove(aMsgId);
+    }
+  }
+}
+
+void
+SpeechDispatcherService::Shutdown()
+{
+  if (!sSingleton) {
+    return;
+  }
+
+  sSingleton = nullptr;
+}
+
+} // namespace dom
+} // namespace mozilla

dom/media/webspeech/synth/speechd/SpeechDispatcherService.h

@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_SpeechDispatcherService_h
+#define mozilla_dom_SpeechDispatcherService_h
+
+#include "mozilla/StaticPtr.h"
+#include "nsAutoPtr.h"
+#include "nsISpeechService.h"
+#include "nsIThread.h"
+#include "nsRefPtrHashtable.h"
+#include "nsTArray.h"
+
+struct SPDConnection;
+
+namespace mozilla {
+namespace dom {
+
+class SpeechDispatcherCallback;
+class SpeechDispatcherVoice;
+
+class SpeechDispatcherService final : public nsISpeechService
+{
+  friend class SpeechDispatcherCallback;
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSISPEECHSERVICE
+
+  SpeechDispatcherService();
+  void Init();
+
+  void EventNotify(uint32_t aMsgId, uint32_t aState);
+
+  static SpeechDispatcherService* GetInstance(bool create = true);
+  static already_AddRefed<SpeechDispatcherService> GetInstanceForService();
+
+  static void Shutdown();
+
+  static StaticRefPtr<SpeechDispatcherService> sSingleton;
+
+private:
+  virtual ~SpeechDispatcherService();
+
+  void RegisterVoices();
+
+  bool mInitialized;
+
+  SPDConnection* mSpeechdClient;
+
+  nsRefPtrHashtable<nsUint32HashKey, SpeechDispatcherCallback> mCallbacks;
+
+  nsCOMPtr<nsIThread> mInitThread;
+
+  nsRefPtrHashtable<nsStringHashKey, SpeechDispatcherVoice> mVoices;
+};
+
+} // namespace dom
+} // namespace mozilla
+#endif

dom/media/webspeech/synth/speechd/moz.build

@@ -0,0 +1,13 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+UNIFIED_SOURCES += [
+  'SpeechDispatcherModule.cpp',
+  'SpeechDispatcherService.cpp'
+]
+include('/ipc/chromium/chromium-config.mozbuild')
+
+FINAL_LIBRARY = 'xul'

dom/network/TCPServerSocket.cpp

@@ -123,7 +123,7 @@ void
 TCPServerSocket::FireEvent(const nsAString& aType, TCPSocket* aSocket)
 {
   AutoJSAPI api;
-  api.Init(GetOwner());
+  api.Init(GetOwnerGlobal());
 
   TCPServerSocketEventInit init;
   init.mBubbles = false;
@@ -144,7 +144,7 @@ TCPServerSocket::FireEvent(const nsAString& aType, TCPSocket* aSocket)
 NS_IMETHODIMP
 TCPServerSocket::OnSocketAccepted(nsIServerSocket* aServer, nsISocketTransport* aTransport)
 {
-  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(GetOwner());
+  nsCOMPtr<nsIGlobalObject> global = GetOwnerGlobal();
   nsRefPtr<TCPSocket> socket = TCPSocket::CreateAcceptedSocket(global, aTransport, mUseArrayBuffers);
   if (mServerBridgeParent) {
     socket->SetAppIdAndBrowser(mServerBridgeParent->GetAppId(),
@@ -175,7 +175,7 @@ TCPServerSocket::OnStopListening(nsIServerSocket* aServer, nsresult aStatus)
 nsresult
 TCPServerSocket::AcceptChildSocket(TCPSocketChild* aSocketChild)
 {
-  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(GetOwner());
+  nsCOMPtr<nsIGlobalObject> global = GetOwnerGlobal();
   NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
   nsRefPtr<TCPSocket> socket = TCPSocket::CreateAcceptedSocket(global, aSocketChild, mUseArrayBuffers);
   NS_ENSURE_TRUE(socket, NS_ERROR_FAILURE);

dom/network/TCPSocket.cpp

@@ -493,7 +493,7 @@ TCPSocket::FireEvent(const nsAString& aType)
   }
 
   AutoJSAPI api;
-  if (NS_WARN_IF(!api.Init(GetOwner()))) {
+  if (NS_WARN_IF(!api.Init(GetOwnerGlobal()))) {
     return NS_ERROR_FAILURE;
   }
   JS::Rooted<JS::Value> val(api.cx());
@@ -505,7 +505,7 @@ TCPSocket::FireDataArrayEvent(const nsAString& aType,
                               const InfallibleTArray<uint8_t>& buffer)
 {
   AutoJSAPI api;
-  if (NS_WARN_IF(!api.Init(GetOwner()))) {
+  if (NS_WARN_IF(!api.Init(GetOwnerGlobal()))) {
     return NS_ERROR_FAILURE;
   }
   JSContext* cx = api.cx();
@@ -523,7 +523,7 @@ TCPSocket::FireDataStringEvent(const nsAString& aType,
                                const nsACString& aString)
 {
   AutoJSAPI api;
-  if (NS_WARN_IF(!api.Init(GetOwner()))) {
+  if (NS_WARN_IF(!api.Init(GetOwnerGlobal()))) {
     return NS_ERROR_FAILURE;
   }
   JSContext* cx = api.cx();
@@ -1034,7 +1034,7 @@ TCPSocket::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext, nsIInput
     }
 
     AutoJSAPI api;
-    if (!api.Init(GetOwner())) {
+    if (!api.Init(GetOwnerGlobal())) {
       return NS_ERROR_FAILURE;
     }
     JSContext* cx = api.cx();
@@ -1057,7 +1057,7 @@ TCPSocket::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext, nsIInput
   }
 
   AutoJSAPI api;
-  if (!api.Init(GetOwner())) {
+  if (!api.Init(GetOwnerGlobal())) {
     return NS_ERROR_FAILURE;
   }
   JSContext* cx = api.cx();
@@ -1189,3 +1189,17 @@ TCPSocket::Observe(nsISupports* aSubject, const char* aTopic, const char16_t* aD
 
   return NS_OK;
 }
+
+/* static */
+bool
+TCPSocket::ShouldTCPSocketExist(JSContext* aCx, JSObject* aGlobal)
+{
+  JS::Rooted<JSObject*> global(aCx, aGlobal);
+  if (nsContentUtils::IsSystemPrincipal(nsContentUtils::ObjectPrincipal(global))) {
+    return true;
+  }
+
+  const char* const perms[] = { "tcp-socket", nullptr };
+  return Preferences::GetBool("dom.mozTCPSocket.enabled") &&
+      CheckAnyPermissions(aCx, global, perms);
+}

dom/network/TCPSocket.h

@@ -88,13 +88,10 @@ public:
   NS_DECL_NSIOBSERVER
   NS_DECL_NSITCPSOCKETCALLBACK
 
-  nsPIDOMWindow* GetParentObject() const
-  {
-    return GetOwner();
-  }
-
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
+  static bool ShouldTCPSocketExist(JSContext* aCx, JSObject* aGlobal);
+
   void GetHost(nsAString& aHost);
   uint32_t Port();
   bool Ssl();

dom/network/moz.build

@@ -9,6 +9,7 @@ DIRS += ['interfaces']
 if CONFIG['MOZ_B2G_RIL']:
     XPCSHELL_TESTS_MANIFESTS += ['tests/unit_stats/xpcshell.ini']
 
+MOCHITEST_CHROME_MANIFESTS += ['tests/chrome.ini']
 MOCHITEST_MANIFESTS += ['tests/mochitest.ini']
 
 EXPORTS.mozilla.dom += [

dom/network/tests/chrome.ini

@@ -0,0 +1,7 @@
+[DEFAULT]
+support-files =
+  tcpsocket_test.jsm
+  test_tcpsocket_client_and_server_basics.js
+  add_task.js
+
+[test_tcpsocket_jsm.html]

dom/network/tests/tcpsocket_test.jsm

@@ -0,0 +1,13 @@
+this.EXPORTED_SYMBOLS = ['createSocket', 'createServer', 'enablePrefsAndPermissions'];
+
+this.createSocket = function(host, port, options) {
+  return new TCPSocket(host, port, options);
+}
+
+this.createServer = function(port, options, backlog) {
+  return new TCPServerSocket(port, options, backlog);
+}
+
+this.enablePrefsAndPermissions = function() {
+  return false;
+}

dom/network/tests/test_tcpsocket_client_and_server_basics.html

@@ -13,6 +13,19 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1084245
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
   <script type="application/javascript" src="add_task.js"></script>
+  <script type="application/javascript">
+    function createServer(port, options, backlog) {
+      return new TCPServerSocket(port, options, backlog);
+    }
+
+    function createSocket(host, port, options) {
+      return new TCPSocket(host, port, options);
+    }
+
+    function enablePrefsAndPermissions() {
+      return true;
+    }
+  </script>
   <script type="application/javascript;version=1.7" src="test_tcpsocket_client_and_server_basics.js"></script>
 </head>
 <body>

dom/network/tests/test_tcpsocket_client_and_server_basics.js

@@ -153,6 +153,7 @@ function defer() {
 
 
 function* test_basics() {
+  if (enablePrefsAndPermissions()) {
     // Enable our use of TCPSocket
     let prefDeferred = defer();
     SpecialPowers.pushPrefEnv(
@@ -165,6 +166,7 @@ function* test_basics() {
       [ { type: 'tcp-socket', allow: true, context: document } ],
       permDeferred.resolve);
     yield permDeferred.promise;
+  }
 
   // See bug 903830; in e10s mode we never get to find out the localPort if we
   // let it pick a free port by choosing 0.  This is the same port the xpcshell
@@ -172,14 +174,14 @@ function* test_basics() {
   let serverPort = 8085;
 
   // - Start up a listening socket.
-  let listeningServer = new TCPServerSocket(serverPort,
+  let listeningServer = createServer(serverPort,
                                      { binaryType: 'arraybuffer' },
                                      SERVER_BACKLOG);
 
   let connectedPromise = waitForConnection(listeningServer);
 
   // -- Open a connection to the server
-  let clientSocket = new TCPSocket('127.0.0.1', serverPort,
+  let clientSocket = createSocket('127.0.0.1', serverPort,
                                   { binaryType: 'arraybuffer' });
   let clientQueue = listenForEventsOnSocket(clientSocket, 'client');
 
@@ -286,7 +288,7 @@ function* test_basics() {
 
   // -- Re-establish connection
   connectedPromise = waitForConnection(listeningServer);
-  clientSocket = new TCPSocket('127.0.0.1', serverPort,
+  clientSocket = createSocket('127.0.0.1', serverPort,
                               { binaryType: 'arraybuffer' });
   clientQueue = listenForEventsOnSocket(clientSocket, 'client');
   is((yield clientQueue.waitForEvent()).type, 'open', 'got open event');
@@ -313,7 +315,7 @@ function* test_basics() {
 
   // -- Re-establish connection
   connectedPromise = waitForConnection(listeningServer);
-  clientSocket = new TCPSocket('127.0.0.1', serverPort,
+  clientSocket = createSocket('127.0.0.1', serverPort,
                               { binaryType: 'arraybuffer' });
   clientQueue = listenForEventsOnSocket(clientSocket, 'client');
   is((yield clientQueue.waitForEvent()).type, 'open', 'got open event');
@@ -347,7 +349,7 @@ function* test_basics() {
 
   // -- Re-establish connection
   connectedPromise = waitForConnection(listeningServer);
-  clientSocket = new TCPSocket('127.0.0.1', serverPort,
+  clientSocket = createSocket('127.0.0.1', serverPort,
                               { binaryType: 'string' });
   clientQueue = listenForEventsOnSocket(clientSocket, 'client');
   is((yield clientQueue.waitForEvent()).type, 'open', 'got open event');
@@ -375,7 +377,7 @@ function* test_basics() {
   listeningServer.close();
 
   // - try and connect, get an error
-  clientSocket = new TCPSocket('127.0.0.1', serverPort,
+  clientSocket = createSocket('127.0.0.1', serverPort,
                               { binaryType: 'arraybuffer' });
   clientQueue = listenForEventsOnSocket(clientSocket, 'client');
   is((yield clientQueue.waitForEvent()).type, 'error', 'fail to connect');

dom/network/tests/test_tcpsocket_jsm.html

@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for 1207090</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+    Components.utils.import("chrome://mochitests/content/chrome/dom/network/tests/tcpsocket_test.jsm");
+  </script>
+  <script type="application/javascript" src="add_task.js"></script>
+  <script type="application/javascript;version=1.7" src="test_tcpsocket_client_and_server_basics.js"></script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1207090">Mozilla Bug 1207090</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+</pre>
+<div id="container"></div>
+</body>
+</html>

dom/plugins/ipc/PluginInstanceParent.cpp

@@ -31,7 +31,6 @@
 #include "gfxXlibSurface.h"
 #endif
 #include "gfxContext.h"
-#include "gfxColor.h"
 #include "gfxUtils.h"
 #include "mozilla/gfx/2D.h"
 #include "Layers.h"

dom/webidl/TCPServerSocket.webidl

@@ -14,9 +14,8 @@ dictionary ServerSocketOptions {
 };
 
 [Constructor(unsigned short port, optional ServerSocketOptions options, optional unsigned short backlog = 0),
- Pref="dom.mozTCPSocket.enabled",
+ Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist",
- CheckAnyPermissions="tcp-socket",
+ Exposed=(Window,System)]
- Exposed=Window]
 interface TCPServerSocket : EventTarget {
   /**
    * The port of this server socket object.

dom/webidl/TCPServerSocketEvent.webidl

@@ -4,9 +4,8 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 [Constructor(DOMString type, optional TCPServerSocketEventInit eventInitDict),
- Pref="dom.mozTCPSocket.enabled",
+ Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist",
- CheckAnyPermissions="tcp-socket",
+ Exposed=(Window,System)]
- Exposed=Window]
 interface TCPServerSocketEvent : Event {
   readonly attribute TCPSocket socket;
 };

dom/webidl/TCPSocket.webidl

@@ -40,9 +40,8 @@ interface LegacyMozTCPSocket {
 };
 
 [Constructor(DOMString host, unsigned short port, optional SocketOptions options),
- Pref="dom.mozTCPSocket.enabled",
+ Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist",
- CheckAnyPermissions="tcp-socket",
+ Exposed=(Window,System)]
- Exposed=Window]
 interface TCPSocket : EventTarget {
   /**
    * Upgrade an insecure connection to use TLS. Throws if the ready state is not OPEN.

dom/webidl/TCPSocketErrorEvent.webidl

@@ -9,9 +9,9 @@
 * - if there's an error connecting to the host
 */
 
-[Pref="dom.mozTCPSocket.enabled",
+[Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist",
- CheckAnyPermissions="tcp-socket",
+ Constructor(DOMString type, optional TCPSocketErrorEventInit eventInitDict),
- Constructor(DOMString type, optional TCPSocketErrorEventInit eventInitDict)]
+ Exposed=(Window,System)]
 interface TCPSocketErrorEvent : Event {
   readonly attribute DOMString name;
   readonly attribute DOMString message;

dom/webidl/TCPSocketEvent.webidl

@@ -10,9 +10,8 @@
  */
 
 [Constructor(DOMString type, optional TCPSocketEventInit eventInitDict),
- Pref="dom.mozTCPSocket.enabled",
+ Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist",
- CheckAnyPermissions="tcp-socket",
+ Exposed=(Window,System)]
- Exposed=Window]
 interface TCPSocketEvent : Event {
   /**
    * If the event is a "data" event, data will be the bytes read from the network;

dom/workers/RuntimeService.cpp

@@ -355,6 +355,8 @@ LoadRuntimeOptions(const char* aPrefName, void* /* aClosure */)
   // Runtime options.
   JS::RuntimeOptions runtimeOptions;
   runtimeOptions.setAsmJS(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asmjs")))
+                .setThrowOnAsmJSValidationFailure(GetWorkerPref<bool>(
+                      NS_LITERAL_CSTRING("throw_on_asmjs_validation_failure")))
                 .setBaseline(GetWorkerPref<bool>(NS_LITERAL_CSTRING("baselinejit")))
                 .setIon(GetWorkerPref<bool>(NS_LITERAL_CSTRING("ion")))
                 .setNativeRegExp(GetWorkerPref<bool>(NS_LITERAL_CSTRING("native_regexp")))

dom/workers/ServiceWorkerRegistrar.cpp

@@ -332,8 +332,9 @@ ServiceWorkerRegistrar::ReadData()
     }
 
     GET_LINE(line);
+    nsCString signedPkg = NS_ConvertUTF16toUTF8(attrs.mSignedPkg);
     entry->principal() =
-      mozilla::ipc::ContentPrincipalInfo(attrs, line);
+      mozilla::ipc::ContentPrincipalInfo(attrs.mAppId, attrs.mInBrowser, line, signedPkg);
 
     GET_LINE(entry->scope());
     GET_LINE(entry->scriptSpec());
@@ -548,8 +549,9 @@ ServiceWorkerRegistrar::WriteData()
     const mozilla::ipc::ContentPrincipalInfo& cInfo =
       info.get_ContentPrincipalInfo();
 
+    OriginAttributes attrs(cInfo.appId(), cInfo.isInBrowserElement());
     nsAutoCString suffix;
-    cInfo.attrs().CreateSuffix(suffix);
+    attrs.CreateSuffix(suffix);
 
     buffer.Truncate();
     buffer.Append(suffix.get());

dom/workers/test/gtest/TestReadWrite.cpp

@@ -163,8 +163,9 @@ TEST(ServiceWorkerRegistrar, TestReadData)
   ASSERT_EQ(info0.type(), mozilla::ipc::PrincipalInfo::TContentPrincipalInfo) << "First principal must be content";
   const mozilla::ipc::ContentPrincipalInfo& cInfo0 = data[0].principal();
 
+  mozilla::OriginAttributes attrs0(cInfo0.appId(), cInfo0.isInBrowserElement());
   nsAutoCString suffix0;
-  cInfo0.attrs().CreateSuffix(suffix0);
+  attrs0.CreateSuffix(suffix0);
 
   ASSERT_STREQ("^appId=123&inBrowser=1", suffix0.get());
   ASSERT_STREQ("spec 0", cInfo0.spec().get());
@@ -178,8 +179,9 @@ TEST(ServiceWorkerRegistrar, TestReadData)
   ASSERT_EQ(info1.type(), mozilla::ipc::PrincipalInfo::TContentPrincipalInfo) << "First principal must be content";
   const mozilla::ipc::ContentPrincipalInfo& cInfo1 = data[1].principal();
 
+  mozilla::OriginAttributes attrs1(cInfo1.appId(), cInfo1.isInBrowserElement());
   nsAutoCString suffix1;
-  cInfo1.attrs().CreateSuffix(suffix1);
+  attrs1.CreateSuffix(suffix1);
 
   ASSERT_STREQ("", suffix1.get());
   ASSERT_STREQ("spec 1", cInfo1.spec().get());
@@ -219,7 +221,7 @@ TEST(ServiceWorkerRegistrar, TestWriteData)
 
       nsAutoCString spec;
       spec.AppendPrintf("spec write %d", i);
-      d->principal() = mozilla::ipc::ContentPrincipalInfo(mozilla::OriginAttributes(i, i % 2), spec);
+      d->principal() = mozilla::ipc::ContentPrincipalInfo(i, i % 2, spec, EmptyCString());
       d->scope().AppendPrintf("scope write %d", i);
       d->scriptSpec().AppendPrintf("scriptSpec write %d", i);
       d->currentWorkerURL().AppendPrintf("currentWorkerURL write %d", i);
@@ -245,12 +247,8 @@ TEST(ServiceWorkerRegistrar, TestWriteData)
     ASSERT_EQ(data[i].principal().type(), mozilla::ipc::PrincipalInfo::TContentPrincipalInfo);
     const mozilla::ipc::ContentPrincipalInfo& cInfo = data[i].principal();
 
-    mozilla::OriginAttributes attrs(i, i % 2);
+    ASSERT_EQ((uint32_t)i, cInfo.appId());
-    nsAutoCString suffix, expectSuffix;
+    ASSERT_EQ((uint32_t)(i % 2), (uint32_t)cInfo.isInBrowserElement());
-    attrs.CreateSuffix(expectSuffix);
-    cInfo.attrs().CreateSuffix(suffix);
-
-    ASSERT_STREQ(expectSuffix.get(), suffix.get());
 
     test.AppendPrintf("spec write %d", i);
     ASSERT_STREQ(test.get(), cInfo.spec().get());

gfx/gl/GLContext.cpp

@@ -39,7 +39,6 @@
 
 #ifdef XP_MACOSX
 #include <CoreServices/CoreServices.h>
-#include "gfxColor.h"
 #endif
 
 #if defined(MOZ_WIDGET_COCOA)

gfx/gl/GLReadTexImageHelper.cpp

@@ -7,6 +7,7 @@
 #include "GLReadTexImageHelper.h"
 
 #include "gfx2DGlue.h"
+#include "gfxColor.h"
 #include "gfxTypes.h"
 #include "GLContext.h"
 #include "OGLShaderProgram.h"

gfx/ipc/GfxMessageUtils.h

@@ -13,7 +13,6 @@
 
 #include <stdint.h>
 
-#include "gfxColor.h"
 #include "mozilla/gfx/Matrix.h"
 #include "GraphicsFilter.h"
 #include "gfxPoint.h"
@@ -293,28 +292,6 @@ struct ParamTraits<mozilla::PixelFormat>
 {};
 */
 
-template<>
-struct ParamTraits<gfxRGBA>
-{
-  typedef gfxRGBA paramType;
-
-  static void Write(Message* msg, const paramType& param)
-  {
-    WriteParam(msg, param.r);
-    WriteParam(msg, param.g);
-    WriteParam(msg, param.b);
-    WriteParam(msg, param.a);
-  }
-
-  static bool Read(const Message* msg, void** iter, paramType* result)
-  {
-    return (ReadParam(msg, iter, &result->r) &&
-            ReadParam(msg, iter, &result->g) &&
-            ReadParam(msg, iter, &result->b) &&
-            ReadParam(msg, iter, &result->a));
-  }
-};
-
 template<>
 struct ParamTraits<mozilla::gfx::Color>
 {
@@ -915,51 +892,6 @@ struct ParamTraits<mozilla::layers::EventRegions>
   }
 };
 
-struct MessageAndAttributeMap
-{
-  Message* msg;
-  const mozilla::gfx::AttributeMap& map;
-};
-
-static bool
-WriteAttribute(mozilla::gfx::AttributeName aName,
-               mozilla::gfx::AttributeType aType,
-               void* aUserData)
-{
-  MessageAndAttributeMap* msgAndMap =
-    static_cast<MessageAndAttributeMap*>(aUserData);
-
-  WriteParam(msgAndMap->msg, aType);
-  WriteParam(msgAndMap->msg, aName);
-
-  switch (aType) {
-
-#define HANDLE_TYPE(typeName)                                          \
-    case mozilla::gfx::AttributeType::e##typeName:                     \
-      WriteParam(msgAndMap->msg, msgAndMap->map.Get##typeName(aName)); \
-      break;
-
-    HANDLE_TYPE(Bool)
-    HANDLE_TYPE(Uint)
-    HANDLE_TYPE(Float)
-    HANDLE_TYPE(Size)
-    HANDLE_TYPE(IntSize)
-    HANDLE_TYPE(IntPoint)
-    HANDLE_TYPE(Matrix)
-    HANDLE_TYPE(Matrix5x4)
-    HANDLE_TYPE(Point3D)
-    HANDLE_TYPE(Color)
-    HANDLE_TYPE(AttributeMap)
-    HANDLE_TYPE(Floats)
-
-#undef HANDLE_TYPE
-
-    default:
-      MOZ_CRASH("unhandled attribute type");
-  }
-  return true;
-}
-
 template <>
 struct ParamTraits<mozilla::gfx::AttributeMap>
 {
@@ -968,8 +900,41 @@ struct ParamTraits<mozilla::gfx::AttributeMap>
   static void Write(Message* aMsg, const paramType& aParam)
   {
     WriteParam(aMsg, aParam.Count());
-    MessageAndAttributeMap msgAndMap = { aMsg, aParam };
+    for (auto iter = aParam.ConstIter(); !iter.Done(); iter.Next()) {
-    aParam.EnumerateRead(WriteAttribute, &msgAndMap);
+      mozilla::gfx::AttributeName name =
+        mozilla::gfx::AttributeName(iter.Key());
+      mozilla::gfx::AttributeType type =
+        mozilla::gfx::AttributeMap::GetType(iter.UserData());
+
+      WriteParam(aMsg, type);
+      WriteParam(aMsg, name);
+
+      switch (type) {
+
+#define CASE_TYPE(typeName)                                          \
+    case mozilla::gfx::AttributeType::e##typeName:                     \
+      WriteParam(aMsg, aParam.Get##typeName(name)); \
+      break;
+
+    CASE_TYPE(Bool)
+    CASE_TYPE(Uint)
+    CASE_TYPE(Float)
+    CASE_TYPE(Size)
+    CASE_TYPE(IntSize)
+    CASE_TYPE(IntPoint)
+    CASE_TYPE(Matrix)
+    CASE_TYPE(Matrix5x4)
+    CASE_TYPE(Point3D)
+    CASE_TYPE(Color)
+    CASE_TYPE(AttributeMap)
+    CASE_TYPE(Floats)
+
+#undef CASE_TYPE
+
+        default:
+          MOZ_CRASH("unhandled attribute type");
+      }
+    }
   }
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)

gfx/layers/FrameMetrics.h

@@ -13,7 +13,6 @@
 #include "mozilla/gfx/Rect.h"           // for RoundedIn
 #include "mozilla/gfx/ScaleFactor.h"    // for ScaleFactor
 #include "mozilla/gfx/Logging.h"        // for Log
-#include "gfxColor.h"
 #include "nsString.h"
 
 namespace IPC {

gfx/layers/LayerScope.cpp

@@ -21,7 +21,6 @@
 #include "mozilla/layers/LayerManagerComposite.h"
 #include "mozilla/layers/TextureHostOGL.h"
 
-#include "gfxColor.h"
 #include "gfxContext.h"
 #include "gfxUtils.h"
 #include "gfxPrefs.h"
@@ -599,12 +598,12 @@ protected:
 class DebugGLColorData final: public DebugGLData {
 public:
     DebugGLColorData(void* layerRef,
-                     const gfxRGBA& color,
+                     const Color& color,
                      int width,
                      int height)
         : DebugGLData(Packet::COLOR),
           mLayerRef(reinterpret_cast<uint64_t>(layerRef)),
-          mColor(color.Packed()),
+          mColor(color.ToABGR()),
           mSize(width, height)
     { }
 
@@ -902,7 +901,7 @@ public:
 // Sender private functions
 private:
     static void SendColor(void* aLayerRef,
-                          const gfxRGBA& aColor,
+                          const Color& aColor,
                           int aWidth,
                           int aHeight);
     static void SendTextureSource(GLContext* aGLContext,
@@ -1004,7 +1003,7 @@ SenderHelper::SendLayer(LayerComposite* aLayer,
 
 void
 SenderHelper::SendColor(void* aLayerRef,
-                        const gfxRGBA& aColor,
+                        const Color& aColor,
                         int aWidth,
                         int aHeight)
 {
@@ -1179,11 +1178,8 @@ SenderHelper::SendEffectChain(GLContext* aGLContext,
         case EffectTypes::SOLID_COLOR: {
             const EffectSolidColor* solidColorEffect =
                 static_cast<const EffectSolidColor*>(primaryEffect);
-            gfxRGBA color(solidColorEffect->mColor.r,
+            SendColor(aEffectChain.mLayerRef, solidColorEffect->mColor,
-                          solidColorEffect->mColor.g,
+                      aWidth, aHeight);
-                          solidColorEffect->mColor.b,
-                          solidColorEffect->mColor.a);
-            SendColor(aEffectChain.mLayerRef, color, aWidth, aHeight);
             break;
         }
         case EffectTypes::COMPONENT_ALPHA:

gfx/layers/LayerTreeInvalidation.cpp

@@ -10,7 +10,6 @@
 #include "ImageLayers.h"                // for ImageLayer, etc
 #include "Layers.h"                     // for Layer, ContainerLayer, etc
 #include "Units.h"                      // for ParentLayerIntRect
-#include "gfxColor.h"                   // for gfxRGBA
 #include "GraphicsFilter.h"             // for GraphicsFilter
 #include "gfxRect.h"                    // for gfxRect
 #include "gfxUtils.h"                   // for gfxUtils

gfx/layers/Layers.h

@@ -13,7 +13,6 @@
 #include "Units.h"                      // for LayerMargin, LayerPoint, ParentLayerIntRect
 #include "gfxContext.h"
 #include "gfxTypes.h"
-#include "gfxColor.h"                   // for gfxRGBA
 #include "GraphicsFilter.h"             // for GraphicsFilter
 #include "gfxPoint.h"                   // for gfxPoint
 #include "gfxRect.h"                    // for gfxRect

gfx/layers/LayersLogging.cpp

@@ -7,7 +7,6 @@
 
 #include "LayersLogging.h"
 #include <stdint.h>                     // for uint8_t
-#include "gfxColor.h"                   // for gfxRGBA
 #include "ImageTypes.h"                 // for ImageFormat
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4, Matrix
 #include "mozilla/gfx/Point.h"          // for IntSize
@@ -57,17 +56,6 @@ AppendToString(std::stringstream& aStream, FrameMetrics::ViewID n,
   aStream << sfx;
 }
 
-void
-AppendToString(std::stringstream& aStream, const gfxRGBA& c,
-               const char* pfx, const char* sfx)
-{
-  aStream << pfx;
-  aStream << nsPrintfCString(
-    "rgba(%d, %d, %d, %g)",
-    uint8_t(c.r*255.0), uint8_t(c.g*255.0), uint8_t(c.b*255.0), c.a).get();
-  aStream << sfx;
-}
-
 void
 AppendToString(std::stringstream& aStream, const Color& c,
                const char* pfx, const char* sfx)

gfx/layers/LayersLogging.h

@@ -16,8 +16,6 @@
 #include "nsRegion.h"                   // for nsRegion, nsIntRegion
 #include "nscore.h"                     // for nsACString, etc
 
-struct gfxRGBA;
-
 namespace mozilla {
 namespace gfx {
 class Matrix4x4;
@@ -40,10 +38,6 @@ void
 AppendToString(std::stringstream& aStream, FrameMetrics::ViewID n,
                const char* pfx="", const char* sfx="");
 
-void
-AppendToString(std::stringstream& aStream, const gfxRGBA& c,
-               const char* pfx="", const char* sfx="");
-
 void
 AppendToString(std::stringstream& aStream, const gfx::Color& c,
                const char* pfx="", const char* sfx="");

gfx/layers/ReadbackLayer.h

@@ -8,9 +8,8 @@
 
 #include <stdint.h>                     // for uint64_t
 #include "Layers.h"                     // for Layer, etc
-#include "gfxColor.h"                   // for gfxRGBA
 #include "mozilla/gfx/Rect.h"           // for gfxRect
-#include "mozilla/gfx/Point.h"                    // for gfxRect
+#include "mozilla/gfx/Point.h"          // for IntPoint
 #include "mozilla/mozalloc.h"           // for operator delete
 #include "nsAutoPtr.h"                  // for nsAutoPtr
 #include "nsCOMPtr.h"                   // for already_AddRefed

gfx/layers/ReadbackProcessor.cpp

@@ -9,7 +9,6 @@
 #include "ReadbackLayer.h"              // for ReadbackLayer, ReadbackSink
 #include "UnitTransforms.h"             // for ViewAs
 #include "Units.h"                      // for ParentLayerIntRect
-#include "gfxColor.h"                   // for gfxRGBA
 #include "gfxContext.h"                 // for gfxContext
 #include "gfxUtils.h"
 #include "gfxRect.h"                    // for gfxRect

gfx/layers/basic/BasicLayerManager.cpp

@@ -17,7 +17,6 @@
 #include "basic/BasicImplData.h"        // for BasicImplData
 #include "basic/BasicLayers.h"          // for BasicLayerManager, etc
 #include "gfxASurface.h"                // for gfxASurface, etc
-#include "gfxColor.h"                   // for gfxRGBA
 #include "gfxContext.h"                 // for gfxContext, etc
 #include "gfxImageSurface.h"            // for gfxImageSurface
 #include "gfxMatrix.h"                  // for gfxMatrix

gfx/layers/client/ContentClient.cpp

@@ -5,7 +5,6 @@
 
 #include "mozilla/layers/ContentClient.h"
 #include "BasicLayers.h"                // for BasicLayerManager
-#include "gfxColor.h"                   // for gfxRGBA
 #include "gfxContext.h"                 // for gfxContext, etc
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxPrefs.h"                   // for gfxPrefs

gfx/layers/composite/ColorLayerComposite.cpp

@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ColorLayerComposite.h"
-#include "gfxColor.h"                   // for gfxRGBA
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4
 #include "mozilla/gfx/Point.h"          // for Point

gfx/layers/ipc/CompositorBench.cpp

@@ -10,7 +10,6 @@
 #include "mozilla/layers/Compositor.h"
 #include "mozilla/layers/Effects.h"
 #include "mozilla/TimeStamp.h"
-#include "gfxColor.h"
 #include "gfxPrefs.h"
 #include <math.h>
 #include "GeckoProfiler.h"
@@ -96,15 +95,11 @@ public:
   {}
 
   void DrawFrame(Compositor* aCompositor, const gfx::Rect& aScreenRect, size_t aStep) {
-    float red;
     float tmp;
-    red = modf(aStep * 0.03f, &tmp);
+    float red = modff(aStep * 0.03f, &tmp);
     EffectChain effects;
-    gfxRGBA color(red, 0.4f, 0.4f, 1.0f);
+    effects.mPrimaryEffect =
-    effects.mPrimaryEffect = new EffectSolidColor(gfx::Color(color.r,
+        new EffectSolidColor(gfx::Color(red, 0.4f, 0.4f, 1.0f));
-                                                             color.g,
-                                                             color.b,
-                                                             color.a));
 
     const gfx::Rect& rect = aScreenRect;
     const gfx::Rect& clipRect = aScreenRect;
@@ -130,15 +125,10 @@ public:
   }
 
   already_AddRefed<Effect> CreateEffect(size_t i) {
-      float red;
       float tmp;
-      red = modf(i * 0.03f, &tmp);
+      float red = modff(i * 0.03f, &tmp);
       EffectChain effects;
-      gfxRGBA color(red, 0.4f, 0.4f, 1.0f);
+      return MakeAndAddRef<EffectSolidColor>(gfx::Color(red, 0.4f, 0.4f, 1.0f));
-      return MakeAndAddRef<EffectSolidColor>(gfx::Color(color.r,
-                                                        color.g,
-                                                        color.b,
-                                                        color.a));
   }
 };
 
@@ -156,15 +146,10 @@ public:
   }
 
   already_AddRefed<Effect> CreateEffect(size_t i) {
-      float red;
       float tmp;
-      red = modf(i * 0.03f, &tmp);
+      float red = modff(i * 0.03f, &tmp);
       EffectChain effects;
-      gfxRGBA color(red, 0.4f, 0.4f, 1.0f);
+      return MakeAndAddRef<EffectSolidColor>(gfx::Color(red, 0.4f, 0.4f, 1.0f));
-      return MakeAndAddRef<EffectSolidColor>(gfx::Color(color.r,
-                                                        color.g,
-                                                        color.b,
-                                                        color.a));
   }
 };
 

gfx/layers/opengl/OGLShaderProgram.cpp

@@ -14,8 +14,6 @@
 #include "Layers.h"
 #include "GLContext.h"
 
-struct gfxRGBA;
-
 namespace mozilla {
 namespace layers {
 

gfx/layers/opengl/OGLShaderProgram.h

@@ -20,8 +20,6 @@
 
 #include <string>
 
-struct gfxRGBA;
-
 namespace mozilla {
 namespace layers {
 
@@ -435,10 +433,6 @@ public:
     SetUniform(KnownUniform::MaskTexture, aUnit);
   }
 
-  void SetRenderColor(const gfxRGBA& aColor) {
-    SetUniform(KnownUniform::RenderColor, aColor);
-  }
-
   void SetRenderColor(const gfx::Color& aColor) {
     SetUniform(KnownUniform::RenderColor, aColor);
   }
@@ -507,17 +501,6 @@ protected:
     }
   }
 
-  void SetUniform(KnownUniform::KnownUniformName aKnownUniform, const gfxRGBA& aColor)
-  {
-    ASSERT_THIS_PROGRAM;
-    NS_ASSERTION(aKnownUniform >= 0 && aKnownUniform < KnownUniform::KnownUniformCount, "Invalid known uniform");
-
-    KnownUniform& ku(mProfile.mUniforms[aKnownUniform]);
-    if (ku.UpdateUniform(aColor.r, aColor.g, aColor.b, aColor.a)) {
-      mGL->fUniform4fv(ku.mLocation, 1, ku.mValue.f16v);
-    }
-  }
-
   void SetUniform(KnownUniform::KnownUniformName aKnownUniform, const gfx::Color& aColor) {
     ASSERT_THIS_PROGRAM;
     NS_ASSERTION(aKnownUniform >= 0 && aKnownUniform < KnownUniform::KnownUniformCount, "Invalid known uniform");

gfx/src/FilterSupport.cpp

@@ -2045,20 +2045,13 @@ AttributeMap::~AttributeMap()
 {
 }
 
-static PLDHashOperator
-CopyAttribute(const uint32_t& aAttributeName,
-              Attribute* aAttribute,
-              void* aAttributes)
-{
-  typedef nsClassHashtable<nsUint32HashKey, Attribute> Map;
-  Map* map = static_cast<Map*>(aAttributes);
-  map->Put(aAttributeName, new Attribute(*aAttribute));
-  return PL_DHASH_NEXT;
-}
-
 AttributeMap::AttributeMap(const AttributeMap& aOther)
 {
-  aOther.mMap.EnumerateRead(CopyAttribute, &mMap);
+  for (auto iter = aOther.mMap.Iter(); !iter.Done(); iter.Next()) {
+    const uint32_t& attributeName = iter.Key();
+    Attribute* attribute = iter.UserData();
+    mMap.Put(attributeName, new Attribute(*attribute));
+  }
 }
 
 AttributeMap&
@@ -2066,34 +2059,15 @@ AttributeMap::operator=(const AttributeMap& aOther)
 {
   if (this != &aOther) {
     mMap.Clear();
-    aOther.mMap.EnumerateRead(CopyAttribute, &mMap);
+    for (auto iter = aOther.mMap.Iter(); !iter.Done(); iter.Next()) {
+      const uint32_t& attributeName = iter.Key();
+      Attribute* attribute = iter.UserData();
+      mMap.Put(attributeName, new Attribute(*attribute));
+    }
   }
   return *this;
 }
 
-namespace {
-  struct MatchingMap {
-    typedef nsClassHashtable<nsUint32HashKey, Attribute> Map;
-    const Map& map;
-    bool matches;
-  };
-} // namespace
-
-static PLDHashOperator
-CheckAttributeEquality(const uint32_t& aAttributeName,
-                       Attribute* aAttribute,
-                       void* aMatchingMap)
-{
-  MatchingMap& matchingMap = *static_cast<MatchingMap*>(aMatchingMap);
-  Attribute* matchingAttribute = matchingMap.map.Get(aAttributeName);
-  if (!matchingAttribute ||
-      *matchingAttribute != *aAttribute) {
-    matchingMap.matches = false;
-    return PL_DHASH_STOP;
-  }
-  return PL_DHASH_NEXT;
-}
-
 bool
 AttributeMap::operator==(const AttributeMap& aOther) const
 {
@@ -2101,37 +2075,16 @@ AttributeMap::operator==(const AttributeMap& aOther) const
     return false;
   }
 
-  MatchingMap matchingMap = { mMap, true };
+  for (auto iter = aOther.mMap.Iter(); !iter.Done(); iter.Next()) {
-  aOther.mMap.EnumerateRead(CheckAttributeEquality, &matchingMap);
+    const uint32_t& attributeName = iter.Key();
-  return matchingMap.matches;
+    Attribute* attribute = iter.UserData();
+    Attribute* matchingAttribute = mMap.Get(attributeName);
+    if (!matchingAttribute || *matchingAttribute != *attribute) {
+      return false;
+    }
   }
 
-namespace {
+  return true;
-  struct HandlerWithUserData
-  {
-    AttributeMap::AttributeHandleCallback handler;
-    void* userData;
-  };
-} // namespace
-
-static PLDHashOperator
-PassAttributeToHandleCallback(const uint32_t& aAttributeName,
-                              Attribute* aAttribute,
-                              void* aHandlerWithUserData)
-{
-  HandlerWithUserData* handlerWithUserData =
-    static_cast<HandlerWithUserData*>(aHandlerWithUserData);
-  return handlerWithUserData->handler(AttributeName(aAttributeName),
-                                      aAttribute->Type(),
-                                      handlerWithUserData->userData) ?
-    PL_DHASH_NEXT : PL_DHASH_STOP;
-}
-
-void
-AttributeMap::EnumerateRead(AttributeMap::AttributeHandleCallback aCallback, void* aUserData) const
-{
-  HandlerWithUserData handlerWithUserData = { aCallback, aUserData };
-  mMap.EnumerateRead(PassAttributeToHandleCallback, &handlerWithUserData);
 }
 
 uint32_t
@@ -2140,6 +2093,18 @@ AttributeMap::Count() const
   return mMap.Count();
 }
 
+nsClassHashtable<nsUint32HashKey, FilterAttribute>::Iterator
+AttributeMap::ConstIter() const
+{
+  return mMap.ConstIter();
+}
+
+/* static */ AttributeType
+AttributeMap::GetType(FilterAttribute* aAttribute)
+{
+  return aAttribute->Type();
+}
+
 #define MAKE_ATTRIBUTE_HANDLERS_BASIC(type, typeLabel, defaultValue) \
   type                                                               \
   AttributeMap::Get##typeLabel(AttributeName aName) const {          \

gfx/src/FilterSupport.h

@@ -221,10 +221,12 @@ public:
   AttributeMap GetAttributeMap(AttributeName aName) const;
   const nsTArray<float>& GetFloats(AttributeName aName) const;
 
-  typedef bool (*AttributeHandleCallback)(AttributeName aName, AttributeType aType, void* aUserData);
-  void EnumerateRead(AttributeHandleCallback aCallback, void* aUserData) const;
   uint32_t Count() const;
 
+  nsClassHashtable<nsUint32HashKey, FilterAttribute>::Iterator ConstIter() const;
+
+  static AttributeType GetType(FilterAttribute* aAttribute);
+
 private:
   mutable nsClassHashtable<nsUint32HashKey, FilterAttribute>  mMap;
 };

gfx/src/nsColor.h

@@ -27,10 +27,6 @@ typedef uint32_t nscolor;
 #define NS_RGBA(_r,_g,_b,_a) \
   ((nscolor) (((_a) << 24) | ((_b)<<16) | ((_g)<<8) | (_r)))
 
-// Make a color out of a gfxRGBA.
-#define NS_RGBA_FROM_GFXRGBA(gfxColor) \
-  ((nscolor) (gfxColor.Packed()))
-
 // Extract color components from nscolor
 #define NS_GET_R(_rgba) ((uint8_t) ((_rgba) & 0xff))
 #define NS_GET_G(_rgba) ((uint8_t) (((_rgba) >> 8) & 0xff))

gfx/thebes/gfx2DGlue.h

@@ -13,7 +13,6 @@
 #include "mozilla/gfx/Matrix.h"
 #include "mozilla/gfx/Rect.h"
 #include "mozilla/gfx/2D.h"
-#include "gfxColor.h"
 
 namespace mozilla {
 namespace gfx {
@@ -34,17 +33,6 @@ inline Rect ToRect(const IntRect &aRect)
   return Rect(aRect.x, aRect.y, aRect.width, aRect.height);
 }
 
-inline Color ToColor(const gfxRGBA &aRGBA)
-{
-  return Color(Float(aRGBA.r), Float(aRGBA.g),
-               Float(aRGBA.b), Float(aRGBA.a));
-}
-
-inline gfxRGBA ThebesColor(const Color &aColor)
-{
-  return gfxRGBA(aColor.r, aColor.g, aColor.b, aColor.a);
-}
-
 inline Matrix ToMatrix(const gfxMatrix &aMatrix)
 {
   return Matrix(Float(aMatrix._11), Float(aMatrix._12), Float(aMatrix._21),
@@ -138,11 +126,6 @@ inline gfxRect ThebesRect(const RectDouble &aRect)
   return gfxRect(aRect.x, aRect.y, aRect.width, aRect.height);
 }
 
-inline gfxRGBA ThebesRGBA(const Color &aColor)
-{
-  return gfxRGBA(aColor.r, aColor.g, aColor.b, aColor.a);
-}
-
 inline gfxImageFormat SurfaceFormatToImageFormat(SurfaceFormat aFormat)
 {
   switch (aFormat) {

gfx/thebes/gfxBlur.h

@@ -15,7 +15,6 @@
 
 class gfxContext;
 struct gfxRect;
-struct gfxRGBA;
 
 namespace mozilla {
   namespace gfx {

gfx/thebes/gfxColor.h

@@ -6,29 +6,9 @@
 #ifndef GFX_COLOR_H
 #define GFX_COLOR_H
 
-#include "gfxTypes.h"
-
 #include "mozilla/Attributes.h" // for MOZ_ALWAYS_INLINE
 #include "mozilla/Endian.h" // for mozilla::NativeEndian::swapToBigEndian
 
-#define GFX_UINT32_FROM_BPTR(pbptr,i) (((uint32_t*)(pbptr))[i])
-
-/**
- * GFX_0XFF_PPIXEL_FROM_BPTR(x)
- *
- * Avoid tortured construction of 32-bit ARGB pixel from 3 individual bytes
- *   of memory plus constant 0xFF.  RGB bytes are already contiguous!
- * Equivalent to: GFX_PACKED_PIXEL(0xff,r,g,b)
- *
- * Attempt to use fast byte-swapping instruction(s), e.g. bswap on x86, in
- *   preference to a sequence of shift/or operations.
- */
-#define GFX_0XFF_PPIXEL_FROM_UINT32(x) \
-  ( (mozilla::NativeEndian::swapToBigEndian(uint32_t(x)) >> 8) | (0xFFU << 24) )
-
-#define GFX_0XFF_PPIXEL_FROM_BPTR(x) \
-     ( GFX_0XFF_PPIXEL_FROM_UINT32(GFX_UINT32_FROM_BPTR((x),0)) )
-
 /**
  * GFX_BLOCK_RGB_TO_FRGB(from,to)
  *   sizeof(*from) == sizeof(char)
@@ -39,9 +19,9 @@
  */
 #define GFX_BLOCK_RGB_TO_FRGB(from,to) \
   PR_BEGIN_MACRO \
-    uint32_t m0 = GFX_UINT32_FROM_BPTR(from,0), \
+    uint32_t m0 = ((uint32_t*)from)[0], \
-             m1 = GFX_UINT32_FROM_BPTR(from,1), \
+             m1 = ((uint32_t*)from)[1], \
-             m2 = GFX_UINT32_FROM_BPTR(from,2), \
+             m2 = ((uint32_t*)from)[2], \
              rgbr = mozilla::NativeEndian::swapToBigEndian(m0), \
              gbrg = mozilla::NativeEndian::swapToBigEndian(m1), \
              brgb = mozilla::NativeEndian::swapToBigEndian(m2), \
@@ -100,128 +80,4 @@ gfxPackedPixel(uint8_t a, uint8_t r, uint8_t g, uint8_t b) {
     }
 }
 
-/**
- * A color value, storing red, green, blue and alpha components.
- * This class does not use premultiplied alpha.
- *
- * XXX should this use doubles (instead of gfxFloat), for consistency with
- * cairo?
- */
-struct gfxRGBA {
-    gfxFloat r, g, b, a;
-
-    enum PackedColorType {
-        PACKED_ABGR,
-        PACKED_ABGR_PREMULTIPLIED,
-
-        PACKED_ARGB,
-        PACKED_ARGB_PREMULTIPLIED,
-
-        PACKED_XRGB
-    };
-
-    gfxRGBA() { }
-    /**
-     * Intialize this color using explicit red, green, blue and alpha
-     * values.
-     */
-    MOZ_CONSTEXPR gfxRGBA(gfxFloat _r, gfxFloat _g, gfxFloat _b, gfxFloat _a=1.0) : r(_r), g(_g), b(_b), a(_a) {}
-
-    /**
-     * Initialize this color from a packed 32-bit color.
-     * The color value is interpreted based on colorType;
-     * all values use the native platform endianness.
-     *
-     * Resulting gfxRGBA stores non-premultiplied data.
-     *
-     * @see gfxRGBA::Packed
-     */
-    MOZ_IMPLICIT gfxRGBA(uint32_t c, PackedColorType colorType = PACKED_ABGR) {
-        if (colorType == PACKED_ABGR ||
-            colorType == PACKED_ABGR_PREMULTIPLIED)
-        {
-            r = ((c >> 0) & 0xff) * (1.0 / 255.0);
-            g = ((c >> 8) & 0xff) * (1.0 / 255.0);
-            b = ((c >> 16) & 0xff) * (1.0 / 255.0);
-            a = ((c >> 24) & 0xff) * (1.0 / 255.0);
-        } else if (colorType == PACKED_ARGB ||
-                   colorType == PACKED_XRGB ||
-                   colorType == PACKED_ARGB_PREMULTIPLIED)
-        {
-            b = ((c >> 0) & 0xff) * (1.0 / 255.0);
-            g = ((c >> 8) & 0xff) * (1.0 / 255.0);
-            r = ((c >> 16) & 0xff) * (1.0 / 255.0);
-            a = ((c >> 24) & 0xff) * (1.0 / 255.0);
-        }
-
-        if (colorType == PACKED_ABGR_PREMULTIPLIED ||
-            colorType == PACKED_ARGB_PREMULTIPLIED)
-        {
-            if (a > 0.0) {
-                r /= a;
-                g /= a;
-                b /= a;
-            }
-        } else if (colorType == PACKED_XRGB) {
-            a = 1.0;
-        }
-    }
-
-    bool operator==(const gfxRGBA& other) const
-    {
-        return r == other.r && g == other.g && b == other.b && a == other.a;
-    }
-    bool operator!=(const gfxRGBA& other) const
-    {
-        return !(*this == other);
-    }
-
-    /**
-     * Returns this color value as a packed 32-bit integer. This reconstructs
-     * the int32_t based on the given colorType, always in the native byte order.
-     *
-     * Note: gcc 4.2.3 on at least Ubuntu (x86) does something strange with
-     * (uint8_t)(c * 255.0) << x, where the result is different than
-     * double d = c * 255.0; v = ((uint8_t) d) << x. 
-     */
-    uint32_t Packed(PackedColorType colorType = PACKED_ABGR) const {
-        gfxFloat rb = (r * 255.0);
-        gfxFloat gb = (g * 255.0);
-        gfxFloat bb = (b * 255.0);
-        gfxFloat ab = (a * 255.0);
-
-        if (colorType == PACKED_ABGR) {
-            return (uint8_t(ab) << 24) |
-                   (uint8_t(bb) << 16) |
-                   (uint8_t(gb) << 8) |
-                   (uint8_t(rb) << 0);
-        }
-        if (colorType == PACKED_ARGB || colorType == PACKED_XRGB) {
-            return (uint8_t(ab) << 24) |
-                   (uint8_t(rb) << 16) |
-                   (uint8_t(gb) << 8) |
-                   (uint8_t(bb) << 0);
-        }
-
-        rb *= a;
-        gb *= a;
-        bb *= a;
-
-        if (colorType == PACKED_ABGR_PREMULTIPLIED) {
-            return (((uint8_t)(ab) << 24) |
-                    ((uint8_t)(bb) << 16) |
-                    ((uint8_t)(gb) << 8) |
-                    ((uint8_t)(rb) << 0));
-        }
-        if (colorType == PACKED_ARGB_PREMULTIPLIED) {
-            return (((uint8_t)(ab) << 24) |
-                    ((uint8_t)(rb) << 16) |
-                    ((uint8_t)(gb) << 8) |
-                    ((uint8_t)(bb) << 0));
-        }
-
-        return 0;
-    }
-};
-
 #endif /* _GFX_COLOR_H */

gfx/thebes/gfxContext.cpp

@@ -14,7 +14,6 @@
 
 #include "gfxContext.h"
 
-#include "gfxColor.h"
 #include "gfxMatrix.h"
 #include "gfxUtils.h"
 #include "gfxASurface.h"

gfx/thebes/gfxDrawable.cpp

@@ -7,7 +7,6 @@
 #include "gfxASurface.h"
 #include "gfxContext.h"
 #include "gfxPlatform.h"
-#include "gfxColor.h"
 #include "gfx2DGlue.h"
 #ifdef MOZ_X11
 #include "cairo.h"

gfx/thebes/gfxFontUtils.cpp

@@ -7,7 +7,6 @@
 #include "mozilla/BinarySearch.h"
 
 #include "gfxFontUtils.h"
-#include "gfxColor.h"
 
 #include "nsServiceManagerUtils.h"
 

gfx/thebes/gfxQtNativeRenderer.h

@@ -6,7 +6,6 @@
 #ifndef GFXQTNATIVERENDER_H_
 #define GFXQTNATIVERENDER_H_
 
-#include "gfxColor.h"
 #include "gfxContext.h"
 #include "gfxXlibSurface.h"
 #include "mozilla/gfx/Rect.h"

gfx/thebes/gfxSVGGlyphs.cpp

@@ -28,7 +28,6 @@
 #include "gfxFont.h"
 #include "nsSMILAnimationController.h"
 #include "gfxContext.h"
-#include "gfxColor.h"
 #include "harfbuzz/hb.h"
 
 #define SVG_CONTENT_TYPE NS_LITERAL_CSTRING("image/svg+xml")

gfx/thebes/gfxUtils.cpp

@@ -1101,9 +1101,7 @@ gfxUtils::ConvertYCbCrToRGB(const PlanarYCbCrData& aData,
   }
 }
 
-/* static */ void gfxUtils::ClearThebesSurface(gfxASurface* aSurface,
+/* static */ void gfxUtils::ClearThebesSurface(gfxASurface* aSurface)
-                                               IntRect* aRect,
-                                               const gfxRGBA& aColor)
 {
   if (aSurface->CairoStatus()) {
     return;
@@ -1113,14 +1111,9 @@ gfxUtils::ConvertYCbCrToRGB(const PlanarYCbCrData& aData,
     return;
   }
   cairo_t* ctx = cairo_create(surf);
-  cairo_set_source_rgba(ctx, aColor.r, aColor.g, aColor.b, aColor.a);
+  cairo_set_source_rgba(ctx, 0.0, 0.0, 0.0, 0.0);
   cairo_set_operator(ctx, CAIRO_OPERATOR_SOURCE);
-  IntRect bounds;
+  IntRect bounds(nsIntPoint(0, 0), aSurface->GetSize());
-  if (aRect) {
-    bounds = *aRect;
-  } else {
-    bounds = IntRect(nsIntPoint(0, 0), aSurface->GetSize());
-  }
   cairo_rectangle(ctx, bounds.x, bounds.y, bounds.width, bounds.height);
   cairo_fill(ctx);
   cairo_destroy(ctx);

gfx/thebes/gfxUtils.h

@@ -6,7 +6,6 @@
 #ifndef GFX_UTILS_H
 #define GFX_UTILS_H
 
-#include "gfxColor.h"
 #include "gfxTypes.h"
 #include "GraphicsFilter.h"
 #include "imgIContainer.h"
@@ -161,9 +160,7 @@ public:
     /**
      * Clears surface to aColor (which defaults to transparent black).
      */
-    static void ClearThebesSurface(gfxASurface* aSurface,
+    static void ClearThebesSurface(gfxASurface* aSurface);
-                                   mozilla::gfx::IntRect* aRect = nullptr,
-                                   const gfxRGBA& aColor = gfxRGBA(0.0, 0.0, 0.0, 0.0));
 
     /**
      * Creates a copy of aSurface, but having the SurfaceFormat aFormat.

gfx/thebes/gfxWindowsPlatform.cpp

@@ -2444,6 +2444,7 @@ gfxWindowsPlatform::InitializeD2D()
   // Initialize D2D 1.0.
   VerifyD2DDevice(gfxPrefs::Direct2DForceEnabled());
   if (!mD3D10Device) {
+    mDWriteFactory = nullptr;
     mD2DStatus = FeatureStatus::Failed;
     return;
   }

ipc/glue/BackgroundUtils.cpp

@@ -25,6 +25,7 @@ class OptionalLoadInfoArgs;
 }
 
 using mozilla::BasePrincipal;
+using mozilla::OriginAttributes;
 using namespace mozilla::net;
 
 namespace ipc {
@@ -76,10 +77,13 @@ PrincipalInfoToPrincipal(const PrincipalInfo& aPrincipalInfo,
         return nullptr;
       }
 
-      if (info.attrs().mAppId == nsIScriptSecurityManager::UNKNOWN_APP_ID) {
+      if (info.appId() == nsIScriptSecurityManager::UNKNOWN_APP_ID) {
         rv = secMan->GetSimpleCodebasePrincipal(uri, getter_AddRefs(principal));
       } else {
-        principal = BasePrincipal::CreateCodebasePrincipal(uri, info.attrs());
+        // TODO: Bug 1167100 - User nsIPrincipal.originAttribute in ContentPrincipalInfo
+        OriginAttributes attrs(info.appId(), info.isInBrowserElement());
+        attrs.mSignedPkg = NS_ConvertUTF8toUTF16(info.signedPkg());
+        principal = BasePrincipal::CreateCodebasePrincipal(uri, attrs);
         rv = principal ? NS_OK : NS_ERROR_FAILURE;
       }
       if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -199,14 +203,33 @@ PrincipalToPrincipalInfo(nsIPrincipal* aPrincipal,
     return rv;
   }
 
+  const mozilla::OriginAttributes& attr =
+	mozilla::BasePrincipal::Cast(aPrincipal)->OriginAttributesRef();
+  nsCString signedPkg = NS_ConvertUTF16toUTF8(attr.mSignedPkg);
+
   bool isUnknownAppId;
   rv = aPrincipal->GetUnknownAppId(&isUnknownAppId);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
-  *aPrincipalInfo = ContentPrincipalInfo(BasePrincipal::Cast(aPrincipal)->OriginAttributesRef(),
+  uint32_t appId;
-                                         spec);
+  if (isUnknownAppId) {
+    appId = nsIScriptSecurityManager::UNKNOWN_APP_ID;
+  } else {
+    rv = aPrincipal->GetAppId(&appId);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+
+  bool isInBrowserElement;
+  rv = aPrincipal->GetIsInBrowserElement(&isInBrowserElement);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  *aPrincipalInfo = ContentPrincipalInfo(appId, isInBrowserElement, spec, signedPkg);
   return NS_OK;
 }
 

ipc/glue/PBackgroundSharedTypes.ipdlh

@@ -2,7 +2,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-using mozilla::OriginAttributes from "mozilla/ipc/BackgroundUtils.h";
 using struct mozilla::void_t from "ipc/IPCMessageUtils.h";
 
 namespace mozilla {
@@ -10,8 +9,10 @@ namespace ipc {
 
 struct ContentPrincipalInfo
 {
-  OriginAttributes attrs;
+  uint32_t appId;
+  bool isInBrowserElement;
   nsCString spec;
+  nsCString signedPkg;
 };
 
 struct SystemPrincipalInfo

js/public/HashTable.h

@@ -653,8 +653,6 @@ class HashMapEntry
     template <class> friend class detail::HashTableEntry;
     template <class, class, class, class> friend class HashMap;
 
-    Key & mutableKey() { return key_; }
-
   public:
     template<typename KeyInput, typename ValueInput>
     HashMapEntry(KeyInput&& k, ValueInput&& v)
@@ -671,6 +669,7 @@ class HashMapEntry
     typedef Value ValueType;
 
     const Key& key() const { return key_; }
+    Key& mutableKey() { return key_; }
     const Value& value() const { return value_; }
     Value& value() { return value_; }
 
@@ -741,6 +740,7 @@ class HashTableEntry
     }
 
     T& get() { MOZ_ASSERT(isLive()); return *mem.addr(); }
+    NonConstT& getMutable() { MOZ_ASSERT(isLive()); return *mem.addr(); }
 
     bool isFree() const    { return keyHash == sFreeKey; }
     void clearLive()       { MOZ_ASSERT(isLive()); keyHash = sFreeKey; mem.addr()->~T(); }
@@ -980,6 +980,16 @@ class HashTable : private AllocPolicy
 #endif
         }
 
+        NonConstT& mutableFront() {
+            MOZ_ASSERT(!this->empty());
+#ifdef JS_DEBUG
+            MOZ_ASSERT(this->validEntry);
+            MOZ_ASSERT(this->generation == this->Range::table_->generation());
+            MOZ_ASSERT(this->mutationCount == this->Range::table_->mutationCount);
+#endif
+            return this->cur->getMutable();
+        }
+
         // Removes the |front()| element and re-inserts it into the table with
         // a new key at the new Lookup position.  |front()| is invalid after
         // this operation until the next call to |popFront()|.

js/public/HeapAPI.h

@@ -54,7 +54,8 @@ const size_t ChunkMarkBitmapOffset = 1032352;
 const size_t ChunkMarkBitmapBits = 129024;
 #endif
 const size_t ChunkRuntimeOffset = ChunkSize - sizeof(void*);
-const size_t ChunkLocationOffset = ChunkSize - 2 * sizeof(void*) - sizeof(uint64_t);
+const size_t ChunkTrailerSize = 2 * sizeof(uintptr_t) + sizeof(uint64_t);
+const size_t ChunkLocationOffset = ChunkSize - ChunkTrailerSize;
 const size_t ArenaZoneOffset = 0;
 
 /*

js/public/MemoryMetrics.h

@@ -584,7 +584,8 @@ struct ZoneStats
     macro(Other,   GCHeapUsed,  objectGroupsGCHeap) \
     macro(Other,   MallocHeap,  objectGroupsMallocHeap) \
     macro(Other,   MallocHeap,  typePool) \
-    macro(Other,   MallocHeap,  baselineStubsOptimized)
+    macro(Other,   MallocHeap,  baselineStubsOptimized) \
+    macro(Other,   MallocHeap,  uniqueIdMap)
 
     ZoneStats()
       : FOR_EACH_SIZE(ZERO_SIZE)

js/src/asmjs/AsmJSValidate.cpp

@@ -8182,7 +8182,11 @@ CheckModule(ExclusiveContext* cx, AsmJSParser& parser, ParseNode* stmtList,
 static bool
 Warn(AsmJSParser& parser, int errorNumber, const char* str)
 {
-    parser.reportNoOffset(ParseWarning, /* strict = */ false, errorNumber, str ? str : "");
+    ParseReportKind reportKind = parser.options().throwOnAsmJSValidationFailureOption &&
+                                 errorNumber == JSMSG_USE_ASM_TYPE_FAIL
+                                 ? ParseError
+                                 : ParseWarning;
+    parser.reportNoOffset(reportKind, /* strict = */ false, errorNumber, str ? str : "");
     return false;
 }
 

js/src/doc/Debugger/Debugger-API.md

@@ -37,6 +37,10 @@ it ought not to introduce security holes, so in principle it could be made
 available to content as well; but it is hard to justify the security risks
 of the additional attack surface.
 
+The `Debugger` API cannot currently observe self-hosted JavaScript. This is not
+inherent in the API's design, but simply that the self-hosting infrastructure
+isn't prepared for the kind of invasions the `Debugger` API can perform.
+
 
 ## Debugger Instances and Shadow Objects
 

js/src/frontend/TokenStream.cpp

@@ -772,7 +772,10 @@ TokenStream::reportAsmJSError(uint32_t offset, unsigned errorNumber, ...)
 {
     va_list args;
     va_start(args, errorNumber);
-    reportCompileErrorNumberVA(offset, JSREPORT_WARNING, errorNumber, args);
+    unsigned flags = options().throwOnAsmJSValidationFailureOption
+                     ? JSREPORT_ERROR
+                     : JSREPORT_WARNING;
+    reportCompileErrorNumberVA(offset, flags, errorNumber, args);
     va_end(args);
 }
 

js/src/gc/Barrier.cpp

@@ -10,7 +10,9 @@
 #include "jsobj.h"
 
 #include "gc/Zone.h"
+#include "js/HashTable.h"
 #include "js/Value.h"
+#include "vm/ScopeObject.h"
 #include "vm/Symbol.h"
 
 #ifdef DEBUG
@@ -102,3 +104,56 @@ JS::HeapValuePostBarrier(JS::Value* valuep, const Value& prev, const Value& next
     MOZ_ASSERT(valuep);
     js::InternalGCMethods<JS::Value>::postBarrier(valuep, prev, next);
 }
+
+template <typename T>
+/* static */ js::HashNumber
+js::MovableCellHasher<T>::hash(const Lookup& l)
+{
+    if (!l)
+        return 0;
+
+    // We have to access the zone from-any-thread here: a worker thread may be
+    // cloning a self-hosted object from the main-thread-runtime-owned self-
+    // hosting zone into the off-main-thread runtime. The zone's uid lock will
+    // protect against multiple workers doing this simultaneously.
+    MOZ_ASSERT(CurrentThreadCanAccessZone(l->zoneFromAnyThread()) ||
+               l->zoneFromAnyThread()->isSelfHostingZone());
+
+    js::HashNumber hn;
+    if (!l->zoneFromAnyThread()->getHashCode(l, &hn))
+        js::CrashAtUnhandlableOOM("failed to get a stable hash code");
+    return hn;
+}
+
+template <typename T>
+/* static */ bool
+js::MovableCellHasher<T>::match(const Key& k, const Lookup& l)
+{
+    // Return true if both are null or false if only one is null.
+    if (!k)
+        return !l;
+    if (!l)
+        return false;
+
+    MOZ_ASSERT(k);
+    MOZ_ASSERT(l);
+    MOZ_ASSERT(CurrentThreadCanAccessZone(l->zoneFromAnyThread()) ||
+               l->zoneFromAnyThread()->isSelfHostingZone());
+
+    Zone* zone = k->zoneFromAnyThread();
+    if (zone != l->zoneFromAnyThread())
+        return false;
+    MOZ_ASSERT(zone->hasUniqueId(k));
+    MOZ_ASSERT(zone->hasUniqueId(l));
+
+    // Since both already have a uid (from hash), the get is infallible.
+    uint64_t uidK, uidL;
+    MOZ_ALWAYS_TRUE(zone->getUniqueId(k, &uidK));
+    MOZ_ALWAYS_TRUE(zone->getUniqueId(l, &uidL));
+    return uidK == uidL;
+}
+
+template struct js::MovableCellHasher<JSObject*>;
+template struct js::MovableCellHasher<js::GlobalObject*>;
+template struct js::MovableCellHasher<js::SavedFrame*>;
+template struct js::MovableCellHasher<js::ScopeObject*>;

js/src/gc/Barrier.h

@@ -693,6 +693,31 @@ class ImmutableTenuredPtr
     const T* address() { return &value; }
 };
 
+// Provide hash codes for Cell kinds that may be relocated and, thus, not have
+// a stable address to use as the base for a hash code. Instead of the address,
+// this hasher uses Cell::getUniqueId to provide exact matches and as a base
+// for generating hash codes.
+//
+// Note: this hasher, like PointerHasher can "hash" a nullptr. While a nullptr
+// would not likely be a useful key, there are some cases where being able to
+// hash a nullptr is useful, either on purpose or because of bugs:
+// (1) existence checks where the key may happen to be null and (2) some
+// aggregate Lookup kinds embed a JSObject* that is frequently null and do not
+// null test before dispatching to the hasher.
+template <typename T>
+struct MovableCellHasher
+{
+    static_assert(mozilla::IsBaseOf<JSObject, typename mozilla::RemovePointer<T>::Type>::value,
+                  "MovableCellHasher's T must be a Cell type that may move");
+
+    using Key = T;
+    using Lookup = T;
+
+    static HashNumber hash(const Lookup& l);
+    static bool match(const Key& k, const Lookup& l);
+    static void rekey(Key& k, const Key& newKey) { k = newKey; }
+};
+
 /* Useful for hashtables with a HeapPtr as key. */
 template <class T>
 struct HeapPtrHasher

js/src/gc/GCRuntime.h

@@ -655,6 +655,11 @@ class GCRuntime
 
     size_t maxMallocBytesAllocated() { return maxMallocBytes; }
 
+    uint64_t nextCellUniqueId() {
+        MOZ_ASSERT(nextCellUniqueId_ > 0);
+        return nextCellUniqueId_++;
+    }
+
   public:
     // Internal public interface
     js::gc::State state() const { return incrementalState; }
@@ -1013,6 +1018,9 @@ class GCRuntime
 
     size_t maxMallocBytes;
 
+    // An incrementing id used to assign unique ids to cells that require one.
+    uint64_t nextCellUniqueId_;
+
     /*
      * Number of the committed arenas in all GC chunks including empty chunks.
      */

js/src/gc/Heap.h

@@ -294,6 +294,9 @@ class TenuredCell : public Cell
 #endif
 };
 
+/* Cells are aligned to CellShift, so the largest tagged null pointer is: */
+const uintptr_t LargestTaggedNullCellPointer = (1 << CellShift) - 1;
+
 /*
  * The mark bitmap has one bit per each GC cell. For multi-cell GC things this
  * wastes space but allows to avoid expensive devisions by thing's size when
@@ -806,6 +809,17 @@ ArenaHeader::getThingSize() const
  */
 struct ChunkTrailer
 {
+    /* Construct a Nursery ChunkTrailer. */
+    ChunkTrailer(JSRuntime* rt, StoreBuffer* sb)
+      : location(gc::ChunkLocationBitNursery), storeBuffer(sb), runtime(rt)
+    {}
+
+    /* Construct a Tenured heap ChunkTrailer. */
+    explicit ChunkTrailer(JSRuntime* rt)
+      : location(gc::ChunkLocationBitTenuredHeap), storeBuffer(nullptr), runtime(rt)
+    {}
+
+  public:
     /* The index the chunk in the nursery, or LocationTenuredHeap. */
     uint32_t        location;
     uint32_t        padding;
@@ -813,11 +827,12 @@ struct ChunkTrailer
     /* The store buffer for writes to things in this chunk or nullptr. */
     StoreBuffer*    storeBuffer;
 
+    /* This provides quick access to the runtime from absolutely anywhere. */
     JSRuntime*      runtime;
 };
 
-static_assert(sizeof(ChunkTrailer) == 2 * sizeof(uintptr_t) + sizeof(uint64_t),
+static_assert(sizeof(ChunkTrailer) == ChunkTrailerSize,
-              "ChunkTrailer size is incorrect.");
+              "ChunkTrailer size must match the API defined size.");
 
 /* The chunk header (located at the end of the chunk to preserve arena alignment). */
 struct ChunkInfo
@@ -1006,13 +1021,16 @@ struct Chunk
         return reinterpret_cast<Chunk*>(addr);
     }
 
-    static bool withinArenasRange(uintptr_t addr) {
+    static bool withinValidRange(uintptr_t addr) {
         uintptr_t offset = addr & ChunkMask;
-        return offset < ArenasPerChunk * ArenaSize;
+        return Chunk::fromAddress(addr)->isNurseryChunk()
+               ? offset < ChunkSize - sizeof(ChunkTrailer)
+               : offset < ArenasPerChunk * ArenaSize;
     }
 
     static size_t arenaIndex(uintptr_t addr) {
-        MOZ_ASSERT(withinArenasRange(addr));
+        MOZ_ASSERT(!Chunk::fromAddress(addr)->isNurseryChunk());
+        MOZ_ASSERT(withinValidRange(addr));
         return (addr & ChunkMask) >> ArenaShift;
     }
 
@@ -1030,6 +1048,10 @@ struct Chunk
         return info.numArenasFree != 0;
     }
 
+    bool isNurseryChunk() const {
+        return info.trailer.storeBuffer;
+    }
+
     ArenaHeader* allocateArena(JSRuntime* rt, JS::Zone* zone, AllocKind kind,
                                const AutoLockGC& lock);
 
@@ -1129,7 +1151,7 @@ ArenaHeader::address() const
     uintptr_t addr = reinterpret_cast<uintptr_t>(this);
     MOZ_ASSERT(addr);
     MOZ_ASSERT(!(addr & ArenaMask));
-    MOZ_ASSERT(Chunk::withinArenasRange(addr));
+    MOZ_ASSERT(Chunk::withinValidRange(addr));
     return addr;
 }
 
@@ -1298,7 +1320,7 @@ Cell::address() const
 {
     uintptr_t addr = uintptr_t(this);
     MOZ_ASSERT(addr % CellSize == 0);
-    MOZ_ASSERT(Chunk::withinArenasRange(addr));
+    MOZ_ASSERT(Chunk::withinValidRange(addr));
     return addr;
 }
 

js/src/gc/Marking.cpp

@@ -2117,7 +2117,13 @@ js::TenuringTracer::moveObjectToTenured(JSObject* dst, JSObject* src, AllocKind
     if (src->is<ArrayObject>())
         tenuredSize = srcSize = sizeof(NativeObject);
 
+    // Copy the Cell contents.
     js_memcpy(dst, src, srcSize);
+
+    // Move any hash code attached to the object.
+    src->zone()->transferUniqueId(dst, src);
+
+    // Move the slots and elements, if we need to.
     if (src->isNative()) {
         NativeObject* ndst = &dst->as<NativeObject>();
         NativeObject* nsrc = &src->as<NativeObject>();

js/src/gc/Marking.h

@@ -425,7 +425,7 @@ ToMarkable(Cell* cell)
 MOZ_ALWAYS_INLINE bool
 IsNullTaggedPointer(void* p)
 {
-    return uintptr_t(p) < 32;
+    return uintptr_t(p) <= LargestTaggedNullCellPointer;
 }
 
 // HashKeyRef represents a reference to a HashMap key. This should normally

js/src/gc/Nursery.cpp

@@ -67,6 +67,9 @@ js::Nursery::init(uint32_t maxNurseryBytes)
     if (!mallocedBuffers.init())
         return false;
 
+    if (!cellsWithUid_.init())
+        return false;
+
     void* heap = MapAlignedPages(nurserySize(), Alignment);
     if (!heap)
         return false;
@@ -653,6 +656,16 @@ js::Nursery::waitBackgroundFreeEnd()
 void
 js::Nursery::sweep()
 {
+    /* Sweep unique id's in all in-use chunks. */
+    for (CellsWithUniqueIdSet::Enum e(cellsWithUid_); !e.empty(); e.popFront()) {
+        JSObject* obj = static_cast<JSObject*>(e.front());
+        if (!IsForwarded(obj))
+            obj->zone()->removeUniqueId(obj);
+        else
+            MOZ_ASSERT(Forwarded(obj)->zone()->hasUniqueId(Forwarded(obj)));
+    }
+    cellsWithUid_.clear();
+
 #ifdef JS_GC_ZEAL
     /* Poison the nursery contents so touching a freed object will crash. */
     JS_POISON((void*)start(), JS_SWEPT_NURSERY_PATTERN, nurserySize());
@@ -670,10 +683,8 @@ js::Nursery::sweep()
     {
 #ifdef JS_CRASH_DIAGNOSTICS
         JS_POISON((void*)start(), JS_SWEPT_NURSERY_PATTERN, allocationEnd() - start());
-        for (int i = 0; i < numActiveChunks_; ++i) {
+        for (int i = 0; i < numActiveChunks_; ++i)
-            chunk(i).trailer.location = gc::ChunkLocationBitNursery;
+            initChunk(i);
-            chunk(i).trailer.runtime = runtime();
-        }
 #endif
         setCurrentChunk(0);
     }

js/src/gc/Nursery.h

@@ -183,6 +183,14 @@ class Nursery
 
     void waitBackgroundFreeEnd();
 
+    bool addedUniqueIdToCell(gc::Cell* cell) {
+        if (!IsInsideNursery(cell) || !isEnabled())
+            return true;
+        MOZ_ASSERT(cellsWithUid_.initialized());
+        MOZ_ASSERT(!cellsWithUid_.has(cell));
+        return cellsWithUid_.put(cell);
+    }
+
     size_t sizeOfHeapCommitted() const {
         return numActiveChunks_ * gc::ChunkSize;
     }
@@ -266,6 +274,21 @@ class Nursery
     typedef HashMap<void*, void*, PointerHasher<void*, 1>, SystemAllocPolicy> ForwardedBufferMap;
     ForwardedBufferMap forwardedBuffers;
 
+    /*
+     * When we assign a unique id to cell in the nursery, that almost always
+     * means that the cell will be in a hash table, and thus, held live,
+     * automatically moving the uid from the nursery to its new home in
+     * tenured. It is possible, if rare, for an object that acquired a uid to
+     * be dead before the next collection, in which case we need to know to
+     * remove it when we sweep.
+     *
+     * Note: we store the pointers as Cell* here, resulting in an ugly cast in
+     *       sweep. This is because this structure is used to help implement
+     *       stable object hashing and we have to break the cycle somehow.
+     */
+    using CellsWithUniqueIdSet = HashSet<gc::Cell*, PointerHasher<gc::Cell*, 3>, SystemAllocPolicy>;
+    CellsWithUniqueIdSet cellsWithUid_;
+
     /* The maximum number of bytes allowed to reside in nursery buffers. */
     static const size_t MaxNurseryBufferSize = 1024;
 
@@ -287,10 +310,8 @@ class Nursery
     }
 
     MOZ_ALWAYS_INLINE void initChunk(int chunkno) {
-        NurseryChunkLayout& c = chunk(chunkno);
+        gc::StoreBuffer* sb = JS::shadow::Runtime::asShadowRuntime(runtime())->gcStoreBufferPtr();
-        c.trailer.storeBuffer = JS::shadow::Runtime::asShadowRuntime(runtime())->gcStoreBufferPtr();
+        new (&chunk(chunkno).trailer) gc::ChunkTrailer(runtime(), sb);
-        c.trailer.location = gc::ChunkLocationBitNursery;
-        c.trailer.runtime = runtime();
     }
 
     MOZ_ALWAYS_INLINE void setCurrentChunk(int chunkno) {

js/src/gc/Zone.cpp

@@ -66,7 +66,7 @@ Zone::~Zone()
 bool Zone::init(bool isSystemArg)
 {
     isSystem = isSystemArg;
-    return gcZoneGroupEdges.init();
+    return uniqueIds_.init() && gcZoneGroupEdges.init();
 }
 
 void
@@ -156,7 +156,6 @@ Zone::logPromotionsToTenured()
     awaitingTenureLogging.clear();
 }
 
-
 void
 Zone::sweepBreakpoints(FreeOp* fop)
 {
@@ -257,6 +256,15 @@ Zone::discardJitCode(FreeOp* fop)
     }
 }
 
+#ifdef JSGC_HASH_TABLE_CHECKS
+void
+JS::Zone::checkUniqueIdTableAfterMovingGC()
+{
+    for (UniqueIdMap::Enum e(uniqueIds_); !e.empty(); e.popFront())
+        js::gc::CheckGCThingAfterMovingGC(e.front().key());
+}
+#endif
+
 uint64_t
 Zone::gcNumber()
 {

js/src/gc/Zone.h

@@ -13,9 +13,11 @@
 
 #include "jscntxt.h"
 
+#include "ds/SplayTree.h"
 #include "gc/FindSCCs.h"
 #include "gc/GCRuntime.h"
 #include "js/TracingAPI.h"
+#include "vm/MallocProvider.h"
 #include "vm/TypeInference.h"
 
 namespace js {
@@ -58,6 +60,11 @@ class ZoneHeapThreshold
                                           const GCSchedulingTunables& tunables);
 };
 
+// Maps a Cell* to a unique, 64bit id.
+using UniqueIdMap = HashMap<Cell*, uint64_t, PointerHasher<Cell*, 3>, SystemAllocPolicy>;
+
+extern uint64_t NextCellUniqueId(JSRuntime* rt);
+
 } // namespace gc
 } // namespace js
 
@@ -118,7 +125,8 @@ struct Zone : public JS::shadow::Zone,
 
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                 size_t* typePool,
-                                size_t* baselineStubsOptimized);
+                                size_t* baselineStubsOptimized,
+                                size_t* uniqueIdMap);
 
     void resetGCMallocBytes();
     void setGCMaxMallocBytes(size_t value);
@@ -242,6 +250,7 @@ struct Zone : public JS::shadow::Zone,
     LogTenurePromotionQueue awaitingTenureLogging;
 
     void sweepBreakpoints(js::FreeOp* fop);
+    void sweepUniqueIds(js::FreeOp* fop);
     void sweepWeakMaps();
     void sweepCompartments(js::FreeOp* fop, bool keepAtleastOne, bool lastGC);
 
@@ -251,6 +260,9 @@ struct Zone : public JS::shadow::Zone,
         return isOnList();
     }
 
+    // Side map for storing a unique ids for cells, independent of address.
+    js::gc::UniqueIdMap uniqueIds_;
+
   public:
     bool hasDebuggers() const { return debuggers && debuggers->length(); }
     DebuggerVector* getDebuggers() const { return debuggers; }
@@ -323,6 +335,73 @@ struct Zone : public JS::shadow::Zone,
 
     mozilla::DebugOnly<unsigned> gcLastZoneGroupIndex;
 
+    // Creates a HashNumber based on getUniqueId. Returns false on OOM.
+    bool getHashCode(js::gc::Cell* cell, js::HashNumber* hashp) {
+        uint64_t uid;
+        if (!getUniqueId(cell, &uid))
+            return false;
+        *hashp = js::HashNumber(uid >> 32) ^ js::HashNumber(uid & 0xFFFFFFFF);
+        return true;
+    }
+
+    // Puts an existing UID in |uidp|, or creates a new UID for this Cell and
+    // puts that into |uidp|. Returns false on OOM.
+    bool getUniqueId(js::gc::Cell* cell, uint64_t* uidp) {
+        MOZ_ASSERT(uidp);
+        MOZ_ASSERT(js::CurrentThreadCanAccessZone(this));
+
+        // Get an existing uid, if one has been set.
+        auto p = uniqueIds_.lookupForAdd(cell);
+        if (p) {
+            *uidp = p->value();
+            return true;
+        }
+
+        // Set a new uid on the cell.
+        *uidp = js::gc::NextCellUniqueId(runtimeFromAnyThread());
+        if (!uniqueIds_.add(p, cell, *uidp))
+            return false;
+
+        // If the cell was in the nursery, hopefully unlikely, then we need to
+        // tell the nursery about it so that it can sweep the uid if the thing
+        // does not get tenured.
+        if (!runtimeFromAnyThread()->gc.nursery.addedUniqueIdToCell(cell))
+            js::CrashAtUnhandlableOOM("failed to allocate tracking data for a nursery uid");
+        return true;
+    }
+
+    // Return true if this cell has a UID associated with it.
+    bool hasUniqueId(js::gc::Cell* cell) {
+        MOZ_ASSERT(js::CurrentThreadCanAccessZone(this));
+        return uniqueIds_.has(cell);
+    }
+
+    // Transfer an id from another cell. This must only be called on behalf of a
+    // moving GC. This method is infallible.
+    void transferUniqueId(js::gc::Cell* tgt, js::gc::Cell* src) {
+        MOZ_ASSERT(src != tgt);
+        MOZ_ASSERT(!IsInsideNursery(tgt));
+        MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtimeFromMainThread()));
+        MOZ_ASSERT(js::CurrentThreadCanAccessZone(this));
+        uniqueIds_.rekeyIfMoved(src, tgt);
+    }
+
+    // Remove any unique id associated with this Cell.
+    void removeUniqueId(js::gc::Cell* cell) {
+        MOZ_ASSERT(js::CurrentThreadCanAccessZone(this));
+        uniqueIds_.remove(cell);
+    }
+
+    // Off-thread parsing should not result in any UIDs being created.
+    void assertNoUniqueIdsInZone() const {
+        MOZ_ASSERT(uniqueIds_.count() == 0);
+    }
+
+#ifdef JSGC_HASH_TABLE_CHECKS
+    // Assert that the UniqueId table has been redirected successfully.
+    void checkUniqueIdTableAfterMovingGC();
+#endif
+
   private:
     js::jit::JitZone* jitZone_;