Merge inbound to m-c a=merge CLOSED TREE

accessible/atk/nsMaiInterfaceEditableText.cpp

@@ -9,7 +9,7 @@
 #include "Accessible-inl.h"
 #include "HyperTextAccessible-inl.h"
 #include "nsMai.h"
-
+#include "ProxyAccessible.h"
 #include "nsString.h"
 #include "mozilla/Likely.h"
 
@@ -20,15 +20,18 @@ static void
 setTextContentsCB(AtkEditableText *aText, const gchar *aString)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  NS_ConvertUTF8toUTF16 strContent(aString);
-  text->ReplaceText(strContent);
+    NS_ConvertUTF8toUTF16 strContent(aString);
+    text->ReplaceText(strContent);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    NS_ConvertUTF8toUTF16 strContent(aString);
+    proxy->ReplaceText(strContent);
+  }
 }
 
 static void
@@ -36,71 +39,82 @@ insertTextCB(AtkEditableText *aText,
              const gchar *aString, gint aLength, gint *aPosition)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  NS_ConvertUTF8toUTF16 strContent(aString, aLength);
-  text->InsertText(strContent, *aPosition);
+    NS_ConvertUTF8toUTF16 strContent(aString);
+    text->InsertText(strContent, *aPosition);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    NS_ConvertUTF8toUTF16 strContent(aString);
+    proxy->InsertText(strContent, *aPosition);
+  }
 }
 
 static void
 copyTextCB(AtkEditableText *aText, gint aStartPos, gint aEndPos)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  text->CopyText(aStartPos, aEndPos);
+    text->CopyText(aStartPos, aEndPos);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    proxy->CopyText(aStartPos, aEndPos);
+  }
 }
 
 static void
 cutTextCB(AtkEditableText *aText, gint aStartPos, gint aEndPos)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  text->CutText(aStartPos, aEndPos);
+    text->CutText(aStartPos, aEndPos);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    proxy->CutText(aStartPos, aEndPos);
+  }
 }
 
 static void
 deleteTextCB(AtkEditableText *aText, gint aStartPos, gint aEndPos)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  text->DeleteText(aStartPos, aEndPos);
+    text->DeleteText(aStartPos, aEndPos);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    proxy->DeleteText(aStartPos, aEndPos);
+  }
 }
 
 static void
 pasteTextCB(AtkEditableText *aText, gint aPosition)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return;
-
-  text->PasteText(aPosition);
+    text->PasteText(aPosition);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    proxy->PasteText(aPosition);
+  }
 }
 }
 

accessible/atk/nsMaiInterfaceText.cpp

@@ -478,20 +478,28 @@ getTextSelectionCB(AtkText *aText, gint aSelectionNum,
                    gint *aStartOffset, gint *aEndOffset)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return nullptr;
-
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return nullptr;
-
   int32_t startOffset = 0, endOffset = 0;
-  text->SelectionBoundsAt(aSelectionNum, &startOffset, &endOffset);
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return nullptr;
+    }
 
+    text->SelectionBoundsAt(aSelectionNum, &startOffset, &endOffset);
     *aStartOffset = startOffset;
     *aEndOffset = endOffset;
 
     return getTextCB(aText, *aStartOffset, *aEndOffset);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    nsString data;
+    proxy->SelectionBoundsAt(aSelectionNum, data, &startOffset, &endOffset);
+    *aStartOffset = startOffset;
+    *aEndOffset = endOffset;
+
+    NS_ConvertUTF16toUTF8 dataAsUTF8(data);
+    return (dataAsUTF8.get()) ? g_strdup(dataAsUTF8.get()) : nullptr;
+  }
+  return nullptr;
 }
 
 // set methods
@@ -501,14 +509,18 @@ addTextSelectionCB(AtkText *aText,
                    gint aEndOffset)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return FALSE;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return FALSE;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return FALSE;
+    return text->AddToSelection(aStartOffset, aEndOffset);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    return proxy->AddToSelection(aStartOffset, aEndOffset);
+  }
 
-  return text->AddToSelection(aStartOffset, aEndOffset);
+  return FALSE;
 }
 
 static gboolean
@@ -516,14 +528,18 @@ removeTextSelectionCB(AtkText *aText,
                       gint aSelectionNum)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return FALSE;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return FALSE;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return FALSE;
+    return text->RemoveFromSelection(aSelectionNum);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    return proxy->RemoveFromSelection(aSelectionNum);
+  }
 
-  return text->RemoveFromSelection(aSelectionNum);
+  return FALSE;
 }
 
 static gboolean
@@ -531,14 +547,18 @@ setTextSelectionCB(AtkText *aText, gint aSelectionNum,
                    gint aStartOffset, gint aEndOffset)
 {
   AccessibleWrap* accWrap = GetAccessibleWrap(ATK_OBJECT(aText));
-  if (!accWrap)
-    return FALSE;
+  if (accWrap) {
+    HyperTextAccessible* text = accWrap->AsHyperText();
+    if (!text || !text->IsTextRole()) {
+      return FALSE;
+    }
 
-  HyperTextAccessible* text = accWrap->AsHyperText();
-  if (!text || !text->IsTextRole())
-    return FALSE;
+    return text->SetSelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+  } else if (ProxyAccessible* proxy = GetProxy(ATK_OBJECT(aText))) {
+    return proxy->SetSelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+  }
 
-  return text->SetSelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+  return FALSE;
 }
 
 static gboolean

accessible/ipc/DocAccessibleChild.cpp

@@ -407,5 +407,182 @@ DocAccessibleChild::RecvOffsetAtPoint(const uint64_t& aID,
   return true;
 }
 
+bool
+DocAccessibleChild::RecvSelectionBoundsAt(const uint64_t& aID,
+                                          const int32_t& aSelectionNum,
+                                          bool* aSucceeded,
+                                          nsString* aData,
+                                          int32_t* aStartOffset,
+                                          int32_t* aEndOffset)
+{
+  *aSucceeded = false;
+  *aStartOffset = 0;
+  *aEndOffset = 0;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded =
+      acc->SelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+    if (*aSucceeded) {
+      acc->TextSubstring(*aStartOffset, *aEndOffset, *aData);
+    }
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvSetSelectionBoundsAt(const uint64_t& aID,
+                                             const int32_t& aSelectionNum,
+                                             const int32_t& aStartOffset,
+                                             const int32_t& aEndOffset,
+                                             bool* aSucceeded)
+{
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded =
+      acc->SetSelectionBoundsAt(aSelectionNum, aStartOffset, aEndOffset);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvAddToSelection(const uint64_t& aID,
+                                       const int32_t& aStartOffset,
+                                       const int32_t& aEndOffset,
+                                       bool* aSucceeded)
+{
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded = acc->AddToSelection(aStartOffset, aEndOffset);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvRemoveFromSelection(const uint64_t& aID,
+                                            const int32_t& aSelectionNum,
+                                            bool* aSucceeded)
+{
+  *aSucceeded = false;
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    *aSucceeded = acc->RemoveFromSelection(aSelectionNum);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvScrollSubstringTo(const uint64_t& aID,
+                                          const int32_t& aStartOffset,
+                                          const int32_t& aEndOffset,
+                                          const uint32_t& aScrollType)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->ScrollSubstringTo(aStartOffset, aEndOffset, aScrollType);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvScrollSubstringToPoint(const uint64_t& aID,
+                                               const int32_t& aStartOffset,
+                                               const int32_t& aEndOffset,
+                                               const uint32_t& aCoordinateType,
+                                               const int32_t& aX,
+                                               const int32_t& aY)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc) {
+    acc->ScrollSubstringToPoint(aStartOffset, aEndOffset, aCoordinateType,
+                                aX, aY);
+  }
+
+  return true;
+}
+
+
+bool
+DocAccessibleChild::RecvReplaceText(const uint64_t& aID,
+                                    const nsString& aText)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->ReplaceText(aText);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvInsertText(const uint64_t& aID,
+                                   const nsString& aText,
+                                   const int32_t& aPosition)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->InsertText(aText, aPosition);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvCopyText(const uint64_t& aID,
+                                 const int32_t& aStartPos,
+                                 const int32_t& aEndPos)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->CopyText(aStartPos, aEndPos);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvCutText(const uint64_t& aID,
+                                const int32_t& aStartPos,
+                                const int32_t& aEndPos)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->CutText(aStartPos, aEndPos);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvDeleteText(const uint64_t& aID,
+                                   const int32_t& aStartPos,
+                                   const int32_t& aEndPos)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->DeleteText(aStartPos, aEndPos);
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvPasteText(const uint64_t& aID,
+                                  const int32_t& aPosition)
+{
+  HyperTextAccessible* acc = IdToHyperTextAccessible(aID);
+  if (acc && acc->IsTextRole()) {
+    acc->PasteText(aPosition);
+  }
+
+  return true;
+}
+
 }
 }

accessible/ipc/DocAccessibleChild.h

@@ -127,6 +127,63 @@ public:
                                  const int32_t& aY,
                                  const uint32_t& aCoordType,
                                  int32_t* aRetVal) MOZ_OVERRIDE;
+
+  virtual bool RecvSelectionBoundsAt(const uint64_t& aID,
+                                     const int32_t& aSelectionNum,
+                                     bool* aSucceeded,
+                                     nsString* aData,
+                                     int32_t* aStartOffset,
+                                     int32_t* aEndOffset) MOZ_OVERRIDE;
+
+  virtual bool RecvSetSelectionBoundsAt(const uint64_t& aID,
+                                        const int32_t& aSelectionNum,
+                                        const int32_t& aStartOffset,
+                                        const int32_t& aEndOffset,
+                                        bool* aSucceeded) MOZ_OVERRIDE;
+
+  virtual bool RecvAddToSelection(const uint64_t& aID,
+                                  const int32_t& aStartOffset,
+                                  const int32_t& aEndOffset,
+                                  bool* aSucceeded) MOZ_OVERRIDE;
+
+  virtual bool RecvRemoveFromSelection(const uint64_t& aID,
+                                       const int32_t& aSelectionNum,
+                                       bool* aSucceeded) MOZ_OVERRIDE;
+
+  virtual bool RecvScrollSubstringTo(const uint64_t& aID,
+                                     const int32_t& aStartOffset,
+                                     const int32_t& aEndOffset,
+                                     const uint32_t& aScrollType) MOZ_OVERRIDE;
+
+  virtual bool RecvScrollSubstringToPoint(const uint64_t& aID,
+                                          const int32_t& aStartOffset,
+                                          const int32_t& aEndOffset,
+                                          const uint32_t& aCoordinateType,
+                                          const int32_t& aX,
+                                          const int32_t& aY) MOZ_OVERRIDE;
+
+  virtual bool RecvReplaceText(const uint64_t& aID,
+                               const nsString& aText);
+
+  virtual bool RecvInsertText(const uint64_t& aID,
+                              const nsString& aText,
+                              const int32_t& aPosition);
+
+  virtual bool RecvCopyText(const uint64_t& aID,
+                            const int32_t& aStartPos,
+                            const int32_t& aEndPos);
+
+  virtual bool RecvCutText(const uint64_t& aID,
+                           const int32_t& aStartPos,
+                           const int32_t& aEndPos);
+
+  virtual bool RecvDeleteText(const uint64_t& aID,
+                              const int32_t& aStartPos,
+                              const int32_t& aEndPos);
+
+  virtual bool RecvPasteText(const uint64_t& aID,
+                             const int32_t& aPosition);
+
 private:
   bool PersistentPropertiesToArray(nsIPersistentProperties* aProps,
                                    nsTArray<Attribute>* aAttributes);

accessible/ipc/PDocAccessible.ipdl

@@ -96,6 +96,31 @@ child:
 
   prio(high) sync OffsetAtPoint(uint64_t aID, int32_t aX, int32_t aY, uint32_t aCoordType)
     returns(int32_t aRetVal);
+
+  prio(high) sync SelectionBoundsAt(uint64_t aID, int32_t aSelectionNum)
+    returns(bool aSucceeded, nsString aData, int32_t aStartOffset, int32_t aEndOffset);
+  prio(high) sync SetSelectionBoundsAt(uint64_t aID, int32_t aSelectionNum,
+                                       int32_t aStartOffset, int32_t aEndOffset)
+    returns(bool aSucceeded);
+  prio(high) sync AddToSelection(uint64_t aID, int32_t aStartOffset, int32_t aEndOffset)
+    returns(bool aSucceeded);
+  prio(high) sync RemoveFromSelection(uint64_t aID, int32_t aSelectionNum)
+    returns(bool aSucceeded);
+
+  ScrollSubstringTo(uint64_t aID, int32_t aStartOffset, int32_t aEndOffset,
+                    uint32_t aScrollType);
+  ScrollSubstringToPoint(uint64_t aID,
+                         int32_t aStartOffset,
+                         int32_t aEndOffset,
+                         uint32_t aCoordinateType,
+                         int32_t aX, int32_t aY);
+
+  prio(high) sync ReplaceText(uint64_t aID, nsString aText);
+  prio(high) sync InsertText(uint64_t aID, nsString aText, int32_t aPosition);
+  prio(high) sync CopyText(uint64_t aID, int32_t aStartPos, int32_t aEndPos);
+  prio(high) sync CutText(uint64_t aID, int32_t aStartPos, int32_t aEndPos);
+  prio(high) sync DeleteText(uint64_t aID, int32_t aStartPos, int32_t aEndPos);
+  prio(high) sync PasteText(uint64_t aID, int32_t aPosition);
 };
 
 }

accessible/ipc/ProxyAccessible.cpp

@@ -270,5 +270,98 @@ ProxyAccessible::OffsetAtPoint(int32_t aX, int32_t aY, uint32_t aCoordType)
   return retVal;
 }
 
+bool
+ProxyAccessible::SelectionBoundsAt(int32_t aSelectionNum,
+                                   nsString& aData,
+                                   int32_t* aStartOffset,
+                                   int32_t* aEndOffset)
+{
+  bool retVal = false;
+  unused << mDoc->SendSelectionBoundsAt(mID, aSelectionNum, &retVal, &aData,
+                                        aStartOffset, aEndOffset);
+  return retVal;
+}
+
+bool
+ProxyAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
+                                      int32_t aStartOffset,
+                                      int32_t aEndOffset)
+{
+  bool retVal = false;
+  unused << mDoc->SendSetSelectionBoundsAt(mID, aSelectionNum, aStartOffset,
+                                           aEndOffset, &retVal);
+  return retVal;
+}
+
+bool
+ProxyAccessible::AddToSelection(int32_t aStartOffset,
+                                int32_t aEndOffset)
+{
+  bool retVal = false;
+  unused << mDoc->SendAddToSelection(mID, aStartOffset, aEndOffset, &retVal);
+  return retVal;
+}
+
+bool
+ProxyAccessible::RemoveFromSelection(int32_t aSelectionNum)
+{
+  bool retVal = false;
+  unused << mDoc->SendRemoveFromSelection(mID, aSelectionNum, &retVal);
+  return retVal;
+}
+
+void
+ProxyAccessible::ScrollSubstringTo(int32_t aStartOffset, int32_t aEndOffset,
+                                   uint32_t aScrollType)
+{
+  unused << mDoc->SendScrollSubstringTo(mID, aStartOffset, aEndOffset, aScrollType);
+}
+
+void
+ProxyAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
+                                        int32_t aEndOffset,
+                                        uint32_t aCoordinateType,
+                                        int32_t aX, int32_t aY)
+{
+  unused << mDoc->SendScrollSubstringToPoint(mID, aStartOffset, aEndOffset,
+                                             aCoordinateType, aX, aY);
+}
+
+void
+ProxyAccessible::ReplaceText(const nsString& aText)
+{
+  unused << mDoc->SendReplaceText(mID, aText);
+}
+
+void
+ProxyAccessible::InsertText(const nsString& aText, int32_t aPosition)
+{
+  unused << mDoc->SendInsertText(mID, aText, aPosition);
+}
+
+void
+ProxyAccessible::CopyText(int32_t aStartPos, int32_t aEndPos)
+{
+  unused << mDoc->SendCopyText(mID, aStartPos, aEndPos);
+}
+
+void
+ProxyAccessible::CutText(int32_t aStartPos, int32_t aEndPos)
+{
+  unused << mDoc->SendCutText(mID, aStartPos, aEndPos);
+}
+
+void
+ProxyAccessible::DeleteText(int32_t aStartPos, int32_t aEndPos)
+{
+  unused << mDoc->SendDeleteText(mID, aStartPos, aEndPos);
+}
+
+void
+ProxyAccessible::PasteText(int32_t aPosition)
+{
+  unused << mDoc->SendPasteText(mID, aPosition);
+}
+
 }
 }

accessible/ipc/ProxyAccessible.h

@@ -140,6 +140,40 @@ public:
 
   int32_t OffsetAtPoint(int32_t aX, int32_t aY, uint32_t aCoordType);
 
+  bool SelectionBoundsAt(int32_t aSelectionNum,
+                         nsString& aData,
+                         int32_t* aStartOffset,
+                         int32_t* aEndOffset);
+
+  bool SetSelectionBoundsAt(int32_t aSelectionNum,
+                            int32_t aStartOffset,
+                            int32_t aEndOffset);
+
+  bool AddToSelection(int32_t aStartOffset,
+                      int32_t aEndOffset);
+
+  bool RemoveFromSelection(int32_t aSelectionNum);
+
+  void ScrollSubstringTo(int32_t aStartOffset, int32_t aEndOffset,
+                         uint32_t aScrollType);
+
+  void ScrollSubstringToPoint(int32_t aStartOffset,
+                              int32_t aEndOffset,
+                              uint32_t aCoordinateType,
+                              int32_t aX, int32_t aY);
+
+  void ReplaceText(const nsString& aText);
+
+  void InsertText(const nsString& aText, int32_t aPosition);
+
+  void CopyText(int32_t aStartPos, int32_t aEndPos);
+
+  void CutText(int32_t aStartPos, int32_t aEndPos);
+
+  void DeleteText(int32_t aStartPos, int32_t aEndPos);
+
+  void PasteText(int32_t aPosition);
+
   /**
    * Allow the platform to store a pointers worth of data on us.
    */

browser/app/profile/firefox.js

@@ -1777,6 +1777,14 @@ pref("geo.provider.use_corelocation", true);
 #endif
 #endif
 
+#ifdef XP_WIN
+#ifdef RELEASE_BUILD
+pref("geo.provider.ms-windows-location", false);
+#else
+pref("geo.provider.ms-windows-location", true);
+#endif
+#endif
+
 // Necko IPC security checks only needed for app isolation for cookies/cache/etc:
 // currently irrelevant for desktop e10s
 pref("network.disable.ipc.security", true);

browser/installer/package-manifest.in

@@ -537,9 +537,6 @@
 @RESPATH@/components/Webapps.manifest
 @RESPATH@/components/AppsService.js
 @RESPATH@/components/AppsService.manifest
-@RESPATH@/components/nsDOMIdentity.js
-@RESPATH@/components/nsIDService.js
-@RESPATH@/components/Identity.manifest
 @RESPATH@/components/recording-cmdline.js
 @RESPATH@/components/recording-cmdline.manifest
 @RESPATH@/components/htmlMenuBuilder.js

dom/base/nsDOMWindowUtils.cpp

@@ -3187,7 +3187,7 @@ nsDOMWindowUtils::GetPlugins(JSContext* cx, JS::MutableHandle<JS::Value> aPlugin
 }
 
 static void
-MaybeReflowForInflationScreenWidthChange(nsPresContext *aPresContext)
+MaybeReflowForInflationScreenSizeChange(nsPresContext *aPresContext)
 {
   if (aPresContext) {
     nsIPresShell* presShell = aPresContext->GetPresShell();
@@ -3196,7 +3196,7 @@ MaybeReflowForInflationScreenWidthChange(nsPresContext *aPresContext)
     bool changed = false;
     if (presShell && presShell->FontSizeInflationEnabled() &&
         presShell->FontSizeInflationMinTwips() != 0) {
-      aPresContext->ScreenWidthInchesForFontInflation(&changed);
+      aPresContext->ScreenSizeInchesForFontInflation(&changed);
     }
 
     changed = changed ||
@@ -3254,7 +3254,7 @@ nsDOMWindowUtils::SetScrollPositionClampingScrollPortSize(float aWidth, float aH
   // size also changes, we hook in the needed updates here rather
   // than adding a separate notification just for this change.
   nsPresContext* presContext = GetPresContext();
-  MaybeReflowForInflationScreenWidthChange(presContext);
+  MaybeReflowForInflationScreenSizeChange(presContext);
 
   return NS_OK;
 }

dom/base/nsGlobalWindow.cpp

@@ -575,8 +575,6 @@ nsPIDOMWindow::nsPIDOMWindow(nsPIDOMWindow *aOuterWindow)
   mRunningTimeout(nullptr), mMutationBits(0), mIsDocumentLoaded(false),
   mIsHandlingResizeEvent(false), mIsInnerWindow(aOuterWindow != nullptr),
   mMayHavePaintEventListener(false), mMayHaveTouchEventListener(false),
-  mMayHaveTouchCaret(false),
-  mMayHaveScrollWheelEventListener(false),
   mMayHaveMouseEnterLeaveEventListener(false),
   mMayHavePointerEnterLeaveEventListener(false),
   mIsModalContentWindow(false),

dom/base/nsNodeUtils.cpp

@@ -430,9 +430,6 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep,
           if (elm->MayHaveTouchEventListener()) {
             window->SetHasTouchEventListeners();
           }
-          if (elm->MayHaveScrollWheelEventListener()) {
-            window->SetHasScrollWheelEventListeners();
-          }
           if (elm->MayHaveMouseEnterLeaveEventListener()) {
             window->SetHasMouseEnterLeaveEventListeners();
           }

dom/base/nsPIDOMWindow.h

@@ -443,44 +443,6 @@ public:
     return mMayHaveTouchEventListener;
   }
 
-  /**
-   * Call this to indicate that some node (this window, its document,
-   * or content in that document) has a scroll wheel event listener.
-   */
-  void SetHasScrollWheelEventListeners()
-  {
-    mMayHaveScrollWheelEventListener = true;
-  }
-
-  bool HasScrollWheelEventListeners()
-  {
-    return mMayHaveScrollWheelEventListener;
-  }
-
-  /**
-   * Returns whether or not any event listeners are present that APZ must be
-   * aware of.
-   */
-  bool HasApzAwareEventListeners()
-  {
-    return HasTouchEventListeners() || HasScrollWheelEventListeners();
-  }
-
-   /**
-   * Will be called when touch caret visibility has changed. mMayHaveTouchCaret
-   * is set if that some node (this window, its document, or content in that
-   * document) has a visible touch caret.
-   */
-  void SetMayHaveTouchCaret(bool aSetValue)
-  {
-    mMayHaveTouchCaret = aSetValue;
-  }
-
-  bool MayHaveTouchCaret()
-  {
-    return mMayHaveTouchCaret;
-  }
-
   /**
    * Moves the top-level window into fullscreen mode if aIsFullScreen is true,
    * otherwise exits fullscreen. If aRequireTrust is true, this method only
@@ -802,8 +764,6 @@ protected:
   bool                   mIsInnerWindow;
   bool                   mMayHavePaintEventListener;
   bool                   mMayHaveTouchEventListener;
-  bool                   mMayHaveTouchCaret;
-  bool                   mMayHaveScrollWheelEventListener;
   bool                   mMayHaveMouseEnterLeaveEventListener;
   bool                   mMayHavePointerEnterLeaveEventListener;
 

dom/base/test/chrome/cpows_parent.xul

@@ -209,6 +209,16 @@
       // Test to ensure that we don't pass CPOWs to C++-implemented interfaces.
       // See bug 1072980.
       if (test_state == "remote") {
+        // This doesn't work because we intercept toString specially
+        // and don't cache the function pointer.
+        // See bug 1140636.
+        todo_is(savedElement.toString, savedElement.toString, "toString identity works");
+
+        // This does work because we create a CPOW for isEqualNode that stays
+        // alive as long as we have a reference to the first CPOW (so as long
+        // as it's detectable).
+        is(savedElement.isEqualNode, savedElement.isEqualNode, "webidl function identity works");
+
         let walker = Components.classes["@mozilla.org/inspector/deep-tree-walker;1"]
                                .createInstance(Components.interfaces.inIDeepTreeWalker);
         const SHOW_ELEMENT = Components.interfaces.nsIDOMNodeFilter.SHOW_ELEMENT;

dom/bindings/BindingUtils.h

@@ -2865,14 +2865,24 @@ private:
   typename Conditional<IsRefcounted<T>::value, nsRefPtr<T>, OwnedNative>::Type mNative;
 };
 
-template<class T,
-         bool isISupports=IsBaseOf<nsISupports, T>::value>
-class DeferredFinalizer
+template<class T>
+struct DeferredFinalizerImpl
 {
-  typedef typename Conditional<IsRefcounted<T>::value,
-                               nsRefPtr<T>, nsAutoPtr<T>>::Type SmartPtr;
+  typedef typename Conditional<IsSame<T, nsISupports>::value,
+                               nsCOMPtr<T>,
+                               typename Conditional<IsRefcounted<T>::value,
+                                                    nsRefPtr<T>,
+                                                    nsAutoPtr<T>>::Type>::Type SmartPtr;
   typedef nsTArray<SmartPtr> SmartPtrArray;
 
+  static_assert(IsSame<T, nsISupports>::value || !IsBaseOf<nsISupports, T>::value,
+                "nsISupports classes should all use the nsISupports instantiation");
+
+  static inline void
+  AppendAndTake(nsTArray<nsCOMPtr<nsISupports>>& smartPtrArray, nsISupports* ptr)
+  {
+    smartPtrArray.AppendElement(dont_AddRef(ptr));
+  }
   template<class U>
   static inline void
   AppendAndTake(nsTArray<nsRefPtr<U>>& smartPtrArray, U* ptr)
@@ -2913,20 +2923,24 @@ class DeferredFinalizer
     }
     return false;
   }
+};
 
-public:
+template<class T,
+         bool isISupports=IsBaseOf<nsISupports, T>::value>
+struct DeferredFinalizer
+{
   static void
   AddForDeferredFinalization(T* aObject)
   {
-    cyclecollector::DeferredFinalize(AppendDeferredFinalizePointer,
-                                     DeferredFinalize, aObject);
+    typedef DeferredFinalizerImpl<T> Impl;
+    cyclecollector::DeferredFinalize(Impl::AppendDeferredFinalizePointer,
+                                     Impl::DeferredFinalize, aObject);
   }
 };
 
 template<class T>
-class DeferredFinalizer<T, true>
+struct DeferredFinalizer<T, true>
 {
-public:
   static void
   AddForDeferredFinalization(T* aObject)
   {

dom/canvas/DocumentRendererChild.cpp

@@ -80,6 +80,10 @@ DocumentRendererChild::RenderDocument(nsIDOMWindow *window,
                                          IntSize(renderSize.width, renderSize.height),
                                          4 * renderSize.width,
                                          SurfaceFormat::B8G8R8A8);
+    if (!dt) {
+        gfxWarning() << "DocumentRendererChild::RenderDocument failed to Factory::CreateDrawTargetForData";
+        return false;
+    }
     nsRefPtr<gfxContext> ctx = new gfxContext(dt);
     ctx->SetMatrix(mozilla::gfx::ThebesMatrix(transform));
 

dom/events/EventListenerManager.cpp

@@ -98,7 +98,6 @@ EventListenerManager::EventListenerManager(EventTarget* aTarget)
   , mMayHaveCapturingListeners(false)
   , mMayHaveSystemGroupListeners(false)
   , mMayHaveTouchEventListener(false)
-  , mMayHaveScrollWheelEventListener(false)
   , mMayHaveMouseEnterLeaveEventListener(false)
   , mMayHavePointerEnterLeaveEventListener(false)
   , mClearingListeners(false)
@@ -340,16 +339,6 @@ EventListenerManager::AddEventListenerInternal(
     if (window && !aFlags.mInSystemGroup) {
       window->SetHasTouchEventListeners();
     }
-  } else if (aTypeAtom == nsGkAtoms::onwheel ||
-             aTypeAtom == nsGkAtoms::onDOMMouseScroll ||
-             aTypeAtom == nsHtml5Atoms::onmousewheel) {
-    mMayHaveScrollWheelEventListener = true;
-    nsPIDOMWindow* window = GetInnerWindowForTarget();
-    // we don't want touchevent listeners added by scrollbars to flip this flag
-    // so we ignore listeners created with system event flag
-    if (window && !aFlags.mInSystemGroup) {
-      window->SetHasScrollWheelEventListeners();
-    }
   } else if (aType >= NS_POINTER_EVENT_START && aType <= NS_POINTER_LOST_CAPTURE) {
     nsPIDOMWindow* window = GetInnerWindowForTarget();
     if (aTypeAtom == nsGkAtoms::onpointerenter ||

dom/events/EventListenerManager.h

@@ -394,12 +394,6 @@ public:
    */
   bool MayHaveTouchEventListener() { return mMayHaveTouchEventListener; }
 
-  /**
-   * Returns true if there may be a scroll wheel listener registered,
-   * false if there definitely isn't.
-   */
-  bool MayHaveScrollWheelEventListener() { return mMayHaveScrollWheelEventListener; }
-
   bool MayHaveMouseEnterLeaveEventListener() { return mMayHaveMouseEnterLeaveEventListener; }
   bool MayHavePointerEnterLeaveEventListener() { return mMayHavePointerEnterLeaveEventListener; }
 
@@ -550,7 +544,6 @@ protected:
   uint32_t mMayHaveCapturingListeners : 1;
   uint32_t mMayHaveSystemGroupListeners : 1;
   uint32_t mMayHaveTouchEventListener : 1;
-  uint32_t mMayHaveScrollWheelEventListener : 1;
   uint32_t mMayHaveMouseEnterLeaveEventListener : 1;
   uint32_t mMayHavePointerEnterLeaveEventListener : 1;
   uint32_t mClearingListeners : 1;

dom/geolocation/nsGeolocation.cpp

@@ -51,6 +51,7 @@ class nsIPrincipal;
 
 #ifdef XP_WIN
 #include "WindowsLocationProvider.h"
+#include "mozilla/WindowsVersion.h"
 #endif
 
 // Some limit to the number of get or watch geolocation requests
@@ -815,7 +816,8 @@ nsresult nsGeolocationService::Init()
 #endif
 
 #ifdef XP_WIN
-  if (Preferences::GetBool("geo.provider.ms-windows-location", false)) {
+  if (Preferences::GetBool("geo.provider.ms-windows-location", false) &&
+      IsWin8OrLater()) {
     mProvider = new WindowsLocationProvider();
   }
 #endif

dom/html/HTMLPictureElement.cpp

@@ -44,7 +44,7 @@ void
 HTMLPictureElement::RemoveChildAt(uint32_t aIndex, bool aNotify)
 {
   // Find all img siblings after this <source> to notify them of its demise
-  nsCOMPtr<nsINode> child = GetChildAt(aIndex);
+  nsCOMPtr<nsIContent> child = GetChildAt(aIndex);
   nsCOMPtr<nsIContent> nextSibling;
   if (child && child->IsHTMLElement(nsGkAtoms::source)) {
     nextSibling = child->GetNextSibling();

dom/html/HTMLSourceElement.cpp

@@ -80,7 +80,7 @@ HTMLSourceElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
 {
   // If we are associated with a <picture> with a valid <img>, notify it of
   // responsive parameter changes
-  nsINode *parent = nsINode::GetParentNode();
+  Element *parent = nsINode::GetParentElement();
   if (aNameSpaceID == kNameSpaceID_None &&
       (aName == nsGkAtoms::srcset ||
        aName == nsGkAtoms::sizes ||
@@ -89,7 +89,7 @@ HTMLSourceElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
       parent && parent->IsHTMLElement(nsGkAtoms::picture)) {
     nsString strVal = aValue ? aValue->GetStringValue() : EmptyString();
     // Find all img siblings after this <source> and notify them of the change
-    nsCOMPtr<nsINode> sibling = AsContent();
+    nsCOMPtr<nsIContent> sibling = AsContent();
     while ( (sibling = sibling->GetNextSibling()) ) {
       if (sibling->IsHTMLElement(nsGkAtoms::img)) {
         HTMLImageElement *img = static_cast<HTMLImageElement*>(sibling.get());
@@ -149,7 +149,7 @@ HTMLSourceElement::BindToTree(nsIDocument *aDocument,
     media->NotifyAddedSource();
   } else if (aParent && aParent->IsHTMLElement(nsGkAtoms::picture)) {
     // Find any img siblings after this <source> and notify them
-    nsCOMPtr<nsINode> sibling = AsContent();
+    nsCOMPtr<nsIContent> sibling = AsContent();
     while ( (sibling = sibling->GetNextSibling()) ) {
       if (sibling->IsHTMLElement(nsGkAtoms::img)) {
         HTMLImageElement *img = static_cast<HTMLImageElement*>(sibling.get());

dom/ipc/ContentBridgeParent.cpp

@@ -8,6 +8,7 @@
 #include "mozilla/dom/TabParent.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
 #include "nsXULAppAPI.h"
+#include "nsIObserverService.h"
 
 using namespace mozilla::ipc;
 using namespace mozilla::jsipc;
@@ -15,7 +16,9 @@ using namespace mozilla::jsipc;
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_ISUPPORTS(ContentBridgeParent, nsIContentParent)
+NS_IMPL_ISUPPORTS(ContentBridgeParent,
+                  nsIContentParent,
+                  nsIObserver)
 
 ContentBridgeParent::ContentBridgeParent(Transport* aTransport)
   : mTransport(aTransport)
@@ -29,6 +32,10 @@ ContentBridgeParent::~ContentBridgeParent()
 void
 ContentBridgeParent::ActorDestroy(ActorDestroyReason aWhy)
 {
+  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+  if (os) {
+    os->RemoveObserver(this, "content-child-shutdown");
+  }
   MessageLoop::current()->PostTask(
     FROM_HERE,
     NewRunnableMethod(this, &ContentBridgeParent::DeferredDestroy));
@@ -49,6 +56,11 @@ ContentBridgeParent::Create(Transport* aTransport, ProcessId aOtherProcess)
   DebugOnly<bool> ok = bridge->Open(aTransport, handle, XRE_GetIOMessageLoop());
   MOZ_ASSERT(ok);
 
+  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+  if (os) {
+    os->AddObserver(bridge, "content-child-shutdown", false);
+  }
+
   // Initialize the message manager (and load delayed scripts) now that we
   // have established communications with the child.
   bridge->mMessageManager->InitWithCallback(bridge);
@@ -167,5 +179,16 @@ ContentBridgeParent::GetCPOWManager()
   return CPOWManagerFor(SendPJavaScriptConstructor());
 }
 
+NS_IMETHODIMP
+ContentBridgeParent::Observe(nsISupports* aSubject,
+                             const char* aTopic,
+                             const char16_t* aData)
+{
+  if (!strcmp(aTopic, "content-child-shutdown")) {
+    Close();
+  }
+  return NS_OK;
+}
+
 } // namespace dom
 } // namespace mozilla

dom/ipc/ContentBridgeParent.h

@@ -10,17 +10,20 @@
 #include "mozilla/dom/PContentBridgeParent.h"
 #include "mozilla/dom/nsIContentParent.h"
 #include "mozilla/dom/ipc/IdType.h"
+#include "nsIObserver.h"
 
 namespace mozilla {
 namespace dom {
 
 class ContentBridgeParent : public PContentBridgeParent
                           , public nsIContentParent
+                          , public nsIObserver
 {
 public:
   explicit ContentBridgeParent(Transport* aTransport);
 
   NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) MOZ_OVERRIDE;
   void DeferredDestroy();

dom/media/fmp4/AVCCDecoderModule.cpp

@@ -9,6 +9,7 @@
 #include "MediaTaskQueue.h"
 #include "mp4_demuxer/DecoderData.h"
 #include "mp4_demuxer/AnnexB.h"
+#include "mp4_demuxer/H264.h"
 
 namespace mozilla
 {
@@ -205,6 +206,14 @@ AVCCMediaDataDecoder::CreateDecoderAndInit(mp4_demuxer::MP4Sample* aSample)
   if (!mp4_demuxer::AnnexB::HasSPS(extra_data)) {
     return NS_ERROR_NOT_INITIALIZED;
   }
+  mp4_demuxer::SPSData spsdata;
+  if (mp4_demuxer::H264::DecodeSPSFromExtraData(extra_data, spsdata) &&
+      spsdata.pic_width > 0 && spsdata.pic_height > 0) {
+    mCurrentConfig.image_width = spsdata.pic_width;
+    mCurrentConfig.image_height = spsdata.pic_height;
+    mCurrentConfig.display_width = spsdata.display_width;
+    mCurrentConfig.display_height = spsdata.display_height;
+  }
   mCurrentConfig.extra_data = extra_data;
 
   nsresult rv = CreateDecoder();

dom/media/fmp4/PlatformDecoderModule.cpp

@@ -149,9 +149,10 @@ PlatformDecoderModule::CreatePDM()
 #endif
 #ifdef MOZ_FFMPEG
   if (sFFmpegDecoderEnabled) {
-    nsRefPtr<PlatformDecoderModule> m(FFmpegRuntimeLinker::CreateDecoderModule());
+    nsRefPtr<PlatformDecoderModule> m = FFmpegRuntimeLinker::CreateDecoderModule();
     if (m) {
-      return m.forget();
+      nsRefPtr<PlatformDecoderModule> m2(new AVCCDecoderModule(m));
+      return m2.forget();
     }
   }
 #endif

dom/media/fmp4/apple/AppleVDADecoder.cpp

@@ -20,6 +20,7 @@
 #include "nsThreadUtils.h"
 #include "prlog.h"
 #include "VideoUtils.h"
+#include <algorithm>
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* GetAppleMediaLog();
@@ -35,10 +36,13 @@ AppleVDADecoder::AppleVDADecoder(const mp4_demuxer::VideoDecoderConfig& aConfig,
                                FlushableMediaTaskQueue* aVideoTaskQueue,
                                MediaDataDecoderCallback* aCallback,
                                layers::ImageContainer* aImageContainer)
-  : mConfig(aConfig)
-  , mTaskQueue(aVideoTaskQueue)
+  : mTaskQueue(aVideoTaskQueue)
   , mCallback(aCallback)
   , mImageContainer(aImageContainer)
+  , mPictureWidth(aConfig.image_width)
+  , mPictureHeight(aConfig.image_height)
+  , mDisplayWidth(aConfig.display_width)
+  , mDisplayHeight(aConfig.display_height)
   , mDecoder(nullptr)
   , mIs106(!nsCocoaFeatures::OnLionOrLater())
 {
@@ -46,26 +50,24 @@ AppleVDADecoder::AppleVDADecoder(const mp4_demuxer::VideoDecoderConfig& aConfig,
   // TODO: Verify aConfig.mime_type.
 
   // Retrieve video dimensions from H264 SPS NAL.
-  mPictureWidth = mConfig.image_width;
-  mPictureHeight = mConfig.image_height;
+  mPictureWidth = aConfig.image_width;
+  mExtraData = aConfig.extra_data;
   mMaxRefFrames = 4;
   mp4_demuxer::SPSData spsdata;
-  if (mp4_demuxer::H264::DecodeSPSFromExtraData(mConfig.extra_data, spsdata) &&
-      spsdata.pic_width && spsdata.pic_height) {
-    mPictureWidth = spsdata.pic_width;
-    mPictureHeight = spsdata.pic_height;
+  if (mp4_demuxer::H264::DecodeSPSFromExtraData(mExtraData, spsdata)) {
     // max_num_ref_frames determines the size of the sliding window
     // we need to queue that many frames in order to guarantee proper
     // pts frames ordering. Use a minimum of 4 to ensure proper playback of
     // non compliant videos.
     mMaxRefFrames =
-      (spsdata.max_num_ref_frames + 1) > mMaxRefFrames ?
-        spsdata.max_num_ref_frames + 1 : mMaxRefFrames;
+      std::min(std::max(mMaxRefFrames, spsdata.max_num_ref_frames + 1), 16u);
   }
 
-  LOG("Creating AppleVDADecoder for %dx%d h.264 video",
+  LOG("Creating AppleVDADecoder for %dx%d (%dx%d) h.264 video",
       mPictureWidth,
-      mPictureHeight
+      mPictureHeight,
+      mDisplayWidth,
+      mDisplayHeight
      );
 }
 
@@ -257,12 +259,12 @@ AppleVDADecoder::OutputFrame(CVPixelBufferRef aImage,
   nsRefPtr<MacIOSurface> macSurface = new MacIOSurface(surface);
   // Bounds.
   VideoInfo info;
-  info.mDisplay = nsIntSize(mConfig.display_width, mConfig.display_height);
+  info.mDisplay = nsIntSize(mDisplayWidth, mDisplayHeight);
   info.mHasVideo = true;
   gfx::IntRect visible = gfx::IntRect(0,
                                       0,
-                                      mConfig.display_width,
-                                      mConfig.display_height);
+                                      mPictureWidth,
+                                      mPictureHeight);
 
   nsRefPtr<layers::Image> image =
     mImageContainer->CreateImage(ImageFormat::MAC_IOSURFACE);
@@ -410,8 +412,8 @@ AppleVDADecoder::InitializeSession()
 CFDictionaryRef
 AppleVDADecoder::CreateDecoderSpecification()
 {
-  const uint8_t* extradata = mConfig.extra_data->Elements();
-  int extrasize = mConfig.extra_data->Length();
+  const uint8_t* extradata = mExtraData->Elements();
+  int extrasize = mExtraData->Length();
 
   OSType format = 'avc1';
   AutoCFRelease<CFNumberRef> avc_width  =

dom/media/fmp4/apple/AppleVDADecoder.h

@@ -89,13 +89,15 @@ public:
   void ClearReorderedFrames();
   CFDictionaryRef CreateOutputConfiguration();
 
-  const mp4_demuxer::VideoDecoderConfig& mConfig;
+  nsRefPtr<mp4_demuxer::ByteBuffer> mExtraData;
   nsRefPtr<FlushableMediaTaskQueue> mTaskQueue;
   MediaDataDecoderCallback* mCallback;
   nsRefPtr<layers::ImageContainer> mImageContainer;
   ReorderQueue mReorderQueue;
   uint32_t mPictureWidth;
   uint32_t mPictureHeight;
+  uint32_t mDisplayWidth;
+  uint32_t mDisplayHeight;
   uint32_t mMaxRefFrames;
 
 private:

dom/media/fmp4/apple/AppleVTDecoder.cpp

@@ -46,8 +46,8 @@ AppleVTDecoder::AppleVTDecoder(const mp4_demuxer::VideoDecoderConfig& aConfig,
   MOZ_COUNT_CTOR(AppleVTDecoder);
   // TODO: Verify aConfig.mime_type.
   LOG("Creating AppleVTDecoder for %dx%d h.264 video",
-      mConfig.image_width,
-      mConfig.image_height
+      mDisplayWidth,
+      mDisplayHeight
      );
 }
 
@@ -262,7 +262,7 @@ AppleVTDecoder::InitializeSession()
 
 #ifdef LOG_MEDIA_SHA1
   SHA1Sum avc_hash;
-  avc_hash.update(mConfig.extra_data->Elements(), mConfig.extra_data->Length());
+  avc_hash.update(mExtraData->Elements(),mExtraData->Length());
   uint8_t digest_buf[SHA1Sum::kHashSize];
   avc_hash.finish(digest_buf);
   nsAutoCString avc_digest;
@@ -270,7 +270,7 @@ AppleVTDecoder::InitializeSession()
     avc_digest.AppendPrintf("%02x", digest_buf[i]);
   }
   LOG("AVCDecoderConfig %ld bytes sha1 %s",
-      mConfig.extra_data->Length(), avc_digest.get());
+      mExtraData->Length(), avc_digest.get());
 #endif // LOG_MEDIA_SHA1
 
   AutoCFRelease<CFDictionaryRef> extensions = CreateDecoderExtensions();
@@ -329,8 +329,8 @@ AppleVTDecoder::CreateDecoderExtensions()
 {
   AutoCFRelease<CFDataRef> avc_data =
     CFDataCreate(kCFAllocatorDefault,
-                 mConfig.extra_data->Elements(),
-                 mConfig.extra_data->Length());
+                 mExtraData->Elements(),
+                 mExtraData->Length());
 
   const void* atomsKey[] = { CFSTR("avcC") };
   const void* atomsValue[] = { avc_data };

dom/media/fmp4/ffmpeg/FFmpegDecoderModule.h

@@ -63,6 +63,11 @@ public:
     return FFmpegH264Decoder<V>::GetCodecId(aMimeType) != AV_CODEC_ID_NONE;
   }
 
+  virtual bool DecoderNeedsAVCC(const mp4_demuxer::VideoDecoderConfig& aConfig) MOZ_OVERRIDE
+  {
+    return true;
+  }
+
 };
 
 } // namespace mozilla

dom/media/fmp4/ffmpeg/FFmpegH264Decoder.cpp

@@ -10,7 +10,6 @@
 #include "ImageContainer.h"
 
 #include "mp4_demuxer/mp4_demuxer.h"
-#include "mp4_demuxer/AnnexB.h"
 
 #include "FFmpegH264Decoder.h"
 
@@ -31,8 +30,11 @@ FFmpegH264Decoder<LIBAV_VER>::FFmpegH264Decoder(
   : FFmpegDataDecoder(aTaskQueue, GetCodecId(aConfig.mime_type))
   , mCallback(aCallback)
   , mImageContainer(aImageContainer)
+  , mDisplayWidth(aConfig.display_width)
+  , mDisplayHeight(aConfig.display_height)
 {
   MOZ_COUNT_CTOR(FFmpegH264Decoder);
+  mExtraData = aConfig.extra_data;
 }
 
 nsresult
@@ -53,12 +55,6 @@ FFmpegH264Decoder<LIBAV_VER>::DoDecodeFrame(mp4_demuxer::MP4Sample* aSample)
   AVPacket packet;
   av_init_packet(&packet);
 
-  if (!mp4_demuxer::AnnexB::ConvertSampleToAnnexB(aSample)) {
-    NS_WARNING("FFmpeg h264 decoder failed to convert sample to Annex B.");
-    mCallback->Error();
-    return DecodeResult::DECODE_ERROR;
-  }
-
   if (!aSample->Pad(FF_INPUT_BUFFER_PADDING_SIZE)) {
     NS_WARNING("FFmpeg h264 decoder failed to allocate sample.");
     mCallback->Error();
@@ -91,7 +87,7 @@ FFmpegH264Decoder<LIBAV_VER>::DoDecodeFrame(mp4_demuxer::MP4Sample* aSample)
   // If we've decoded a frame then we need to output it
   if (decoded) {
     VideoInfo info;
-    info.mDisplay = nsIntSize(mCodecContext->width, mCodecContext->height);
+    info.mDisplay = nsIntSize(mDisplayWidth, mDisplayHeight);
     info.mStereoMode = StereoMode::MONO;
     info.mHasVideo = true;
 

dom/media/fmp4/ffmpeg/FFmpegH264Decoder.h

@@ -62,6 +62,8 @@ private:
 
   MediaDataDecoderCallback* mCallback;
   nsRefPtr<ImageContainer> mImageContainer;
+  uint32_t mDisplayWidth;
+  uint32_t mDisplayHeight;
 };
 
 } // namespace mozilla

dom/moz.build

@@ -90,7 +90,6 @@ DIRS += [
     'indexedDB',
     'system',
     'ipc',
-    'identity',
     'workers',
     'camera',
     'audiochannel',
@@ -142,6 +141,7 @@ if CONFIG['MOZ_SECUREELEMENT']:
 if CONFIG['MOZ_B2G']:
     DIRS += [
         'downloads',
+        'identity',
         'mobileid',
         'engineeringmode'
     ]

dom/plugins/ipc/PluginWidgetParent.cpp

@@ -70,18 +70,7 @@ PluginWidgetParent::~PluginWidgetParent()
   // A destroy call can actually get skipped if a widget is associated
   // with the last out-of-process page, make sure and cleanup any left
   // over widgets if we have them.
-  if (mWidget) {
-#if defined(MOZ_WIDGET_GTK)
-    mWidget->SetNativeData(NS_NATIVE_PLUGIN_OBJECT_PTR, (uintptr_t)0);
-    mWrapper = nullptr;
-#elif defined(XP_WIN)
-    ::RemovePropW((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW),
-                  kPluginWidgetParentProperty);
-#endif
-    mWidget->UnregisterPluginWindowForRemoteUpdates();
-    mWidget->Destroy();
-    mWidget = nullptr;
-  }
+  KillWidget();
 }
 
 mozilla::dom::TabParent*
@@ -135,6 +124,7 @@ PluginWidgetParent::RecvCreate(nsresult* aResult)
   // we can send over to content -> plugin.
   PLUG_NewPluginNativeWindow((nsPluginNativeWindow**)&mWrapper);
   if (!mWrapper) {
+    KillWidget();
     return false;
   }
   // Give a copy of this to the widget, which handles some update
@@ -147,6 +137,7 @@ PluginWidgetParent::RecvCreate(nsresult* aResult)
   // If this fails, bail.
   if (!parentWidget) {
     *aResult = NS_ERROR_NOT_AVAILABLE;
+    KillWidget();
     return true;
   }
 
@@ -158,8 +149,7 @@ PluginWidgetParent::RecvCreate(nsresult* aResult)
   *aResult = mWidget->Create(parentWidget.get(), nullptr, nsIntRect(0,0,0,0),
                              &initData);
   if (NS_FAILED(*aResult)) {
-    mWidget->Destroy();
-    mWidget = nullptr;
+    KillWidget();
     // This should never fail, abort.
     return false;
   }
@@ -192,13 +182,29 @@ PluginWidgetParent::RecvCreate(nsresult* aResult)
 }
 
 void
-PluginWidgetParent::Shutdown(ShutdownType aType)
+PluginWidgetParent::KillWidget()
 {
+  PWLOG("PluginWidgetParent::KillWidget() widget=%p\n", (void*)mWidget.get());
   if (mWidget) {
     mWidget->UnregisterPluginWindowForRemoteUpdates();
     DebugOnly<nsresult> rv = mWidget->Destroy();
     NS_ASSERTION(NS_SUCCEEDED(rv), "widget destroy failure");
+#if defined(MOZ_WIDGET_GTK)
+    mWidget->SetNativeData(NS_NATIVE_PLUGIN_OBJECT_PTR, (uintptr_t)0);
+    mWrapper = nullptr;
+#elif defined(XP_WIN)
+    ::RemovePropW((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW),
+                  kPluginWidgetParentProperty);
+#endif
     mWidget = nullptr;
+  }
+}
+
+void
+PluginWidgetParent::Shutdown(ShutdownType aType)
+{
+  if (mWidget) {
+    KillWidget();
     unused << SendParentShutdown(aType);
   }
 }
@@ -207,6 +213,7 @@ void
 PluginWidgetParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   PWLOG("PluginWidgetParent::ActorDestroy()\n");
+  KillWidget();
 }
 
 // Called by TabParent's Destroy() in response to an early tear down (Early

dom/plugins/ipc/PluginWidgetParent.h

@@ -63,6 +63,7 @@ public:
 
 private:
   void Shutdown(ShutdownType aType);
+  void KillWidget();
 
   // The chrome side native widget.
   nsCOMPtr<nsIWidget> mWidget;

dom/system/windows/WindowsLocationProvider.cpp

@@ -5,16 +5,60 @@
 #include "WindowsLocationProvider.h"
 #include "nsGeoPosition.h"
 #include "nsIDOMGeoPositionError.h"
+#include "nsComponentManagerUtils.h"
 #include "prtime.h"
+#include "MLSFallback.h"
+#include "mozilla/Telemetry.h"
 
 namespace mozilla {
 namespace dom {
 
+NS_IMPL_ISUPPORTS(WindowsLocationProvider::MLSUpdate, nsIGeolocationUpdate);
+
+WindowsLocationProvider::MLSUpdate::MLSUpdate(nsIGeolocationUpdate* aCallback)
+: mCallback(aCallback)
+{
+}
+
+NS_IMETHODIMP
+WindowsLocationProvider::MLSUpdate::Update(nsIDOMGeoPosition *aPosition)
+{
+  if (!mCallback) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsIDOMGeoPositionCoords> coords;
+  aPosition->GetCoords(getter_AddRefs(coords));
+  if (!coords) {
+    return NS_ERROR_FAILURE;
+  }
+
+  Telemetry::Accumulate(Telemetry::GEOLOCATION_WIN8_SOURCE_IS_MLS, true);
+
+  return mCallback->Update(aPosition);
+}
+
+NS_IMETHODIMP
+WindowsLocationProvider::MLSUpdate::LocationUpdatePending()
+{
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+WindowsLocationProvider::MLSUpdate::NotifyError(uint16_t aError)
+{
+  if (!mCallback) {
+    return NS_ERROR_FAILURE;
+  }
+  return mCallback->NotifyError(aError);
+}
+
+
 class LocationEvent MOZ_FINAL : public ILocationEvents
 {
 public:
-  LocationEvent(nsIGeolocationUpdate* aCallback)
-    : mCallback(aCallback), mCount(0) {
+  LocationEvent(nsIGeolocationUpdate* aCallback, WindowsLocationProvider *aProvider)
+    : mCallback(aCallback), mProvider(aProvider), mCount(0) {
   }
 
   // IUnknown interface
@@ -30,6 +74,7 @@ public:
 
 private:
   nsCOMPtr<nsIGeolocationUpdate> mCallback;
+  nsRefPtr<WindowsLocationProvider> mProvider;
   ULONG mCount;
 };
 
@@ -73,18 +118,34 @@ LocationEvent::OnStatusChanged(REFIID aReportType,
     return S_OK;
   }
 
+  // When registering event, REPORT_INITIALIZING is fired at first.
+  // Then, when the location is found, REPORT_RUNNING is fired.
+  if (aStatus == REPORT_RUNNING) {
+    // location is found by Windows Location provider, we use it.
+    mProvider->CancelMLSProvider();
+    return S_OK;
+  }
+
+  // Cannot get current location at this time.  We use MLS instead until
+  // Location API returns RUNNING status.
+  if (NS_SUCCEEDED(mProvider->CreateAndWatchMLSProvider(mCallback))) {
+    return S_OK;
+  }
+
+  // Cannot watch location by MLS provider.  We must return error by
+  // Location API.
   uint16_t err;
   switch (aStatus) {
   case REPORT_ACCESS_DENIED:
     err = nsIDOMGeoPositionError::PERMISSION_DENIED;
     break;
+  case REPORT_NOT_SUPPORTED:
   case REPORT_ERROR:
     err = nsIDOMGeoPositionError::POSITION_UNAVAILABLE;
     break;
   default:
     return S_OK;
   }
-
   mCallback->NotifyError(err);
   return S_OK;
 }
@@ -123,6 +184,8 @@ LocationEvent::OnLocationChanged(REFIID aReportType,
                       PR_Now());
   mCallback->Update(position);
 
+  Telemetry::Accumulate(Telemetry::GEOLOCATION_WIN8_SOURCE_IS_MLS, false);
+
   return S_OK;
 }
 
@@ -132,6 +195,10 @@ WindowsLocationProvider::WindowsLocationProvider()
 {
 }
 
+WindowsLocationProvider::~WindowsLocationProvider()
+{
+}
+
 NS_IMETHODIMP
 WindowsLocationProvider::Startup()
 {
@@ -139,12 +206,14 @@ WindowsLocationProvider::Startup()
   if (FAILED(::CoCreateInstance(CLSID_Location, nullptr, CLSCTX_INPROC_SERVER,
                                 IID_ILocation,
                                 getter_AddRefs(location)))) {
-    return NS_ERROR_FAILURE;
+    // We will use MLS provider
+    return NS_OK;
   }
 
   IID reportTypes[] = { IID_ILatLongReport };
   if (FAILED(location->RequestPermissions(nullptr, reportTypes, 1, FALSE))) {
-    return NS_ERROR_FAILURE;
+    // We will use MLS provider
+    return NS_OK;
   }
 
   mLocation = location;
@@ -154,11 +223,17 @@ WindowsLocationProvider::Startup()
 NS_IMETHODIMP
 WindowsLocationProvider::Watch(nsIGeolocationUpdate* aCallback)
 {
-  nsRefPtr<LocationEvent> event = new LocationEvent(aCallback);
-  if (FAILED(mLocation->RegisterForReport(event, IID_ILatLongReport, 0))) {
-    return NS_ERROR_FAILURE;
+  if (mLocation) {
+    nsRefPtr<LocationEvent> event = new LocationEvent(aCallback, this);
+    if (SUCCEEDED(mLocation->RegisterForReport(event, IID_ILatLongReport, 0))) {
+      return NS_OK;
+    }
   }
-  return NS_OK;
+
+  // Cannot use Location API.  We will use MLS instead.
+  mLocation = nullptr;
+
+  return CreateAndWatchMLSProvider(aCallback);
 }
 
 NS_IMETHODIMP
@@ -169,6 +244,8 @@ WindowsLocationProvider::Shutdown()
     mLocation = nullptr;
   }
 
+  CancelMLSProvider();
+
   return NS_OK;
 }
 
@@ -176,7 +253,8 @@ NS_IMETHODIMP
 WindowsLocationProvider::SetHighAccuracy(bool enable)
 {
   if (!mLocation) {
-    return NS_ERROR_FAILURE;
+    // MLS provider doesn't support HighAccuracy
+    return NS_OK;
   }
 
   LOCATION_DESIRED_ACCURACY desiredAccuracy;
@@ -192,5 +270,28 @@ WindowsLocationProvider::SetHighAccuracy(bool enable)
   return NS_OK;
 }
 
+nsresult
+WindowsLocationProvider::CreateAndWatchMLSProvider(
+  nsIGeolocationUpdate* aCallback)
+{
+  if (mMLSProvider) {
+    return NS_OK;
+  }
+
+  mMLSProvider = new MLSFallback();
+  return mMLSProvider->Startup(new MLSUpdate(aCallback));
+}
+
+void
+WindowsLocationProvider::CancelMLSProvider()
+{
+  if (!mMLSProvider) {
+    return;
+  }
+
+  mMLSProvider->Shutdown();
+  mMLSProvider = nullptr;
+}
+
 } // namespace dom
 } // namespace mozilla

dom/system/windows/WindowsLocationProvider.h

@@ -10,6 +10,8 @@
 
 #include <locationapi.h>
 
+class MLSFallback;
+
 namespace mozilla {
 namespace dom {
 
@@ -21,10 +23,25 @@ public:
 
   WindowsLocationProvider();
 
+  nsresult CreateAndWatchMLSProvider(nsIGeolocationUpdate* aCallback);
+  void CancelMLSProvider();
+
+  class MLSUpdate : public nsIGeolocationUpdate
+  {
+  public:
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSIGEOLOCATIONUPDATE
+    explicit MLSUpdate(nsIGeolocationUpdate* aCallback);
+
+  private:
+    nsCOMPtr<nsIGeolocationUpdate> mCallback;
+    virtual ~MLSUpdate() {}
+  };
 private:
-  ~WindowsLocationProvider() {}
+  ~WindowsLocationProvider();
 
   nsRefPtr<ILocation> mLocation;
+  nsRefPtr<MLSFallback> mMLSProvider;
 };
 
 } // namespace dom

dom/system/windows/moz.build

@@ -9,6 +9,10 @@ SOURCES += [
     'WindowsLocationProvider.cpp'
 ]
 
+LOCAL_INCLUDES += [
+    '/dom/geolocation'
+]
+
 FAIL_ON_WARNINGS = True
 
 FINAL_LIBRARY = 'xul'

dom/webidl/moz.build

@@ -243,7 +243,6 @@ WEBIDL_FILES = [
     'IDBRequest.webidl',
     'IDBTransaction.webidl',
     'IDBVersionChangeEvent.webidl',
-    'Identity.webidl',
     'ImageCapture.webidl',
     'ImageData.webidl',
     'ImageDocument.webidl',
@@ -827,3 +826,8 @@ if CONFIG['MOZ_PAY']:
     WEBIDL_FILES += [
         'MozPaymentProvider.webidl'
     ]
+
+if CONFIG['MOZ_B2G']:
+    WEBIDL_FILES += [
+        'Identity.webidl'
+    ]

gfx/2d/DrawTargetTiled.h

@@ -8,6 +8,7 @@
 
 #include "2D.h"
 #include "Filters.h"
+#include "Logging.h"
 
 #include <vector>
 
@@ -183,6 +184,11 @@ public:
         Factory::CreateDrawTargetForData(BackendType::CAIRO, mappedSurf.mData,
         GetSize(), mappedSurf.mStride, GetFormat());
 
+      if (!dt) {
+        gfxWarning() << "DrawTargetTiled::GetDataSurface failed in CreateDrawTargetForData";
+        surf->Unmap();
+        return nullptr;
+      }
       for (size_t i = 0; i < mSnapshots.size(); i++) {
         RefPtr<DataSourceSurface> dataSurf = mSnapshots[i]->GetDataSurface();
         dt->CopySurface(dataSurf, IntRect(IntPoint(0, 0), mSnapshots[i]->GetSize()), mOrigins[i]);

gfx/2d/FilterNodeSoftware.cpp

@@ -994,6 +994,11 @@ FilterNodeBlendSoftware::Render(const IntRect& aRect)
 	                                     target->Stride(),
 	                                     target->GetFormat());
 
+  if (!dt) {
+    gfxWarning() << "FilterNodeBlendSoftware::Render failed in CreateDrawTargetForData";
+    return nullptr;
+  }
+
   Rect r(0, 0, size.width, size.height);
   dt->DrawSurface(input2, r, r, DrawSurfaceOptions(), DrawOptions(1.0f, ToBlendOp(mBlendMode)));
   dt->Flush();
@@ -1099,6 +1104,7 @@ FilterNodeTransformSoftware::Render(const IntRect& aRect)
                                      mapping.mStride,
                                      surf->GetFormat());
   if (!dt) {
+    gfxWarning() << "FilterNodeTransformSoftware::Render failed in CreateDrawTargetForData";
     return nullptr;
   }
 

gfx/angle/src/commit.h

@@ -1,3 +1,3 @@
-#define ANGLE_COMMIT_HASH "040a674b6d67"
+#define ANGLE_COMMIT_HASH "736200d4a356"
 #define ANGLE_COMMIT_HASH_SIZE 12
-#define ANGLE_COMMIT_DATE "2015-02-18 11:50:36 -0500"
+#define ANGLE_COMMIT_DATE "2015-03-10 10:54:46 -0400"

gfx/angle/src/compiler/translator/ParseContext.cpp

@@ -2028,9 +2028,11 @@ TIntermTyped* TParseContext::addIndexExpression(TIntermTyped *baseExpression, co
         recover();
     }
 
-    if (indexExpression->getQualifier() == EvqConst)
+    TIntermConstantUnion *indexConstantUnion = indexExpression->getAsConstantUnion();
+
+    if (indexExpression->getQualifier() == EvqConst && indexConstantUnion)
     {
-        int index = indexExpression->getAsConstantUnion()->getIConst(0);
+        int index = indexConstantUnion->getIConst(0);
         if (index < 0)
         {
             std::stringstream infoStream;
@@ -2091,7 +2093,7 @@ TIntermTyped* TParseContext::addIndexExpression(TIntermTyped *baseExpression, co
                 index = baseExpression->getType().getNominalSize() - 1;
             }
 
-            indexExpression->getAsConstantUnion()->getUnionArrayPointer()->setIConst(index);
+            indexConstantUnion->getUnionArrayPointer()->setIConst(index);
             indexedExpression = intermediate.addIndex(EOpIndexDirect, baseExpression, indexExpression, location);
         }
     }

gfx/gl/GLScreenBuffer.cpp

@@ -444,10 +444,6 @@ GLScreenBuffer::Swap(const gfx::IntSize& size)
     mFront = mBack;
     mBack = newBack;
 
-    // Fence before copying.
-    if (mFront) {
-        mFront->Surf()->ProducerRelease();
-    }
     if (mBack) {
         mBack->Surf()->ProducerAcquire();
     }
@@ -470,6 +466,14 @@ GLScreenBuffer::Swap(const gfx::IntSize& size)
         //printf_stderr("After: src: 0x%08x, dest: 0x%08x\n", srcPixel, destPixel);
     }
 
+    // XXX: We would prefer to fence earlier on platforms that don't need
+    // the full ProducerAcquire/ProducerRelease semantics, so that the fence
+    // doesn't include the copy operation. Unfortunately, the current API
+    // doesn't expose a good way to do that.
+    if (mFront) {
+        mFront->Surf()->ProducerRelease();
+    }
+
     return true;
 }
 

gfx/ipc/GfxMessageUtils.h

@@ -724,8 +724,6 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
     WriteParam(aMsg, aParam.mCumulativeResolution);
     WriteParam(aMsg, aParam.mZoom);
     WriteParam(aMsg, aParam.mDevPixelsPerCSSPixel);
-    WriteParam(aMsg, aParam.mMayHaveTouchListeners);
-    WriteParam(aMsg, aParam.mMayHaveTouchCaret);
     WriteParam(aMsg, aParam.mPresShellId);
     WriteParam(aMsg, aParam.mIsRoot);
     WriteParam(aMsg, aParam.mHasScrollgrab);
@@ -767,8 +765,6 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
             ReadParam(aMsg, aIter, &aResult->mCumulativeResolution) &&
             ReadParam(aMsg, aIter, &aResult->mZoom) &&
             ReadParam(aMsg, aIter, &aResult->mDevPixelsPerCSSPixel) &&
-            ReadParam(aMsg, aIter, &aResult->mMayHaveTouchListeners) &&
-            ReadParam(aMsg, aIter, &aResult->mMayHaveTouchCaret) &&
             ReadParam(aMsg, aIter, &aResult->mPresShellId) &&
             ReadParam(aMsg, aIter, &aResult->mIsRoot) &&
             ReadParam(aMsg, aIter, &aResult->mHasScrollgrab) &&

gfx/layers/FrameMetrics.h

@@ -46,8 +46,6 @@ public:
     , mScrollableRect(0, 0, 0, 0)
     , mCumulativeResolution(1)
     , mDevPixelsPerCSSPixel(1)
-    , mMayHaveTouchListeners(false)
-    , mMayHaveTouchCaret(false)
     , mIsRoot(false)
     , mHasScrollgrab(false)
     , mScrollId(NULL_SCROLL_ID)
@@ -85,8 +83,6 @@ public:
            mPresShellResolution == aOther.mPresShellResolution &&
            mCumulativeResolution == aOther.mCumulativeResolution &&
            mDevPixelsPerCSSPixel == aOther.mDevPixelsPerCSSPixel &&
-           mMayHaveTouchListeners == aOther.mMayHaveTouchListeners &&
-           mMayHaveTouchCaret == aOther.mMayHaveTouchCaret &&
            mPresShellId == aOther.mPresShellId &&
            mIsRoot == aOther.mIsRoot &&
            mScrollId == aOther.mScrollId &&
@@ -482,26 +478,6 @@ public:
     mContentDescription = aContentDescription;
   }
 
-  bool GetMayHaveTouchCaret() const
-  {
-    return mMayHaveTouchCaret;
-  }
-
-  void SetMayHaveTouchCaret(bool aMayHaveTouchCaret)
-  {
-    mMayHaveTouchCaret = aMayHaveTouchCaret;
-  }
-
-  bool GetMayHaveTouchListeners() const
-  {
-    return mMayHaveTouchListeners;
-  }
-
-  void SetMayHaveTouchListeners(bool aMayHaveTouchListeners)
-  {
-    mMayHaveTouchListeners = aMayHaveTouchListeners;
-  }
-
   const LayoutDeviceIntSize& GetLineScrollAmount() const
   {
     return mLineScrollAmount;
@@ -592,12 +568,6 @@ private:
   // resolution.
   CSSToLayoutDeviceScale mDevPixelsPerCSSPixel;
 
-  // Whether or not this frame may have touch or scroll wheel listeners.
-  bool mMayHaveTouchListeners;
-
-  // Whether or not this frame may have a touch caret.
-  bool mMayHaveTouchCaret;
-
   // Whether or not this is the root scroll frame for the root content document.
   bool mIsRoot;
 

gfx/layers/apz/src/APZCTreeManager.cpp

@@ -269,14 +269,11 @@ APZCTreeManager::AttachNodeToTree(HitTestingTreeNode* aNode,
 static EventRegions
 GetEventRegions(const LayerMetricsWrapper& aLayer)
 {
-  if (gfxPrefs::LayoutEventRegionsEnabled()) {
-    if (aLayer.IsScrollInfoLayer()) {
-      return EventRegions(nsIntRegion(ParentLayerIntRect::ToUntyped(
-        RoundedToInt(aLayer.Metrics().mCompositionBounds))));
-    }
-    return aLayer.GetEventRegions();
+  if (aLayer.IsScrollInfoLayer()) {
+    return EventRegions(nsIntRegion(ParentLayerIntRect::ToUntyped(
+      RoundedToInt(aLayer.Metrics().mCompositionBounds))));
   }
-  return EventRegions(aLayer.GetVisibleRegion());
+  return aLayer.GetEventRegions();
 }
 
 already_AddRefed<HitTestingTreeNode>
@@ -1361,35 +1358,6 @@ APZCTreeManager::GetAPZCAtPoint(HitTestingTreeNode* aNode,
     }
 
     if (*aOutHitResult != HitNothing) {
-      if (result && !gfxPrefs::LayoutEventRegionsEnabled()) {
-        // When event-regions are disabled, we treat scrollinfo layers as
-        // regular scrollable layers. Unfortunately, their "hit region" (which
-        // we create from the composition bounds) is their full area, and they
-        // sit on top of their non-scrollinfo siblings. This means they will get
-        // a HitTestingTreeNode with a hit region that will aggressively match
-        // any input events that might be directed to sub-APZCs of their non-
-        // scrollinfo siblings. Therefore, we need to keep looping through to
-        // see if there are any other non-scrollinfo siblings that have children
-        // that match this input. If so, they should take priority. With event-
-        // regions enabled we use the actual regions from the layer, which are
-        // empty, and so this is unnecessary.
-        AsyncPanZoomController* prevSiblingApzc = nullptr;
-        for (HitTestingTreeNode* n = node->GetPrevSibling(); n; n = n->GetPrevSibling()) {
-          if (n->GetApzc()) {
-            prevSiblingApzc = n->GetApzc();
-            break;
-          }
-        }
-        if (result == prevSiblingApzc) {
-          APZCTM_LOG("Continuing search past probable scrollinfo info layer\n");
-          // We need to reset aOutHitResult in order to keep searching. This is
-          // ok because we know that we will at least hit prevSiblingApzc
-          // again, which is the same as result.
-          *aOutHitResult = HitNothing;
-          continue;
-        }
-      }
-
       return result;
     }
   }

gfx/layers/apz/src/AsyncPanZoomController.cpp

@@ -2663,8 +2663,6 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
 
   mLastContentPaintMetrics = aLayerMetrics;
 
-  mFrameMetrics.SetMayHaveTouchListeners(aLayerMetrics.GetMayHaveTouchListeners());
-  mFrameMetrics.SetMayHaveTouchCaret(aLayerMetrics.GetMayHaveTouchCaret());
   mFrameMetrics.SetScrollParentId(aLayerMetrics.GetScrollParentId());
   APZC_LOG_FM(aLayerMetrics, "%p got a NotifyLayersUpdated with aIsFirstPaint=%d", this, aIsFirstPaint);
 
@@ -2926,12 +2924,6 @@ void AsyncPanZoomController::ZoomToRect(CSSRect aRect) {
   }
 }
 
-bool
-AsyncPanZoomController::NeedToWaitForContent() const
-{
-  return (mFrameMetrics.GetMayHaveTouchListeners() || mFrameMetrics.GetMayHaveTouchCaret());
-}
-
 TouchBlockState*
 AsyncPanZoomController::CurrentTouchBlock()
 {

gfx/layers/apz/src/AsyncPanZoomController.h

@@ -775,12 +775,6 @@ public:
    */
   bool ArePointerEventsConsumable(TouchBlockState* aBlock, uint32_t aTouchPoints);
 
-  /**
-   * Return true if there are are touch listeners registered on content
-   * scrolled by this APZC.
-   */
-  bool NeedToWaitForContent() const;
-
   /**
    * Clear internal state relating to input handling.
    */

gfx/layers/apz/src/HitTestingTreeNode.cpp

@@ -197,15 +197,6 @@ HitTestingTreeNode::HitTest(const ParentLayerPoint& aPoint) const
     return HitTestResult::HitNothing;
   }
 
-  // When event regions are disabled and we have an APZC on this node, we are
-  // actually storing the touch-sensitive section of the composition bounds in
-  // the clip region, and we don't need to check against the mEventRegions.
-  // If there's no APZC, then we do need to check against the mEventRegions
-  // (which contains the layer's visible region) for obscuration purposes.
-  if (!gfxPrefs::LayoutEventRegionsEnabled() && GetApzc()) {
-    return HitTestResult::HitLayer;
-  }
-
   // convert into Layer coordinate space
   Maybe<LayerPoint> pointInLayerPixels = Untransform(aPoint);
   if (!pointInLayerPixels) {

gfx/layers/apz/src/InputQueue.cpp

@@ -201,9 +201,6 @@ InputQueue::MaybeRequestContentResponse(const nsRefPtr<AsyncPanZoomController>&
                                         CancelableBlockState* aBlock)
 {
   bool waitForMainThread = !aBlock->IsTargetConfirmed();
-  if (!gfxPrefs::LayoutEventRegionsEnabled()) {
-    waitForMainThread |= aTarget->NeedToWaitForContent();
-  }
   if (aBlock->AsTouchBlock() && aBlock->AsTouchBlock()->IsDuringFastMotion()) {
     aBlock->SetConfirmedTargetApzc(aTarget);
     waitForMainThread = false;

gfx/layers/apz/util/ChromeProcessController.cpp

@@ -46,7 +46,9 @@ ChromeProcessController::InitializeRoot()
   // actually scrollable (if it is, APZC will set proper margins when it's
   // scrolled).
   nsIPresShell* presShell = GetPresShell();
-  MOZ_ASSERT(presShell);
+  if (!presShell) {
+    return;
+  }
   MOZ_ASSERT(presShell->GetDocument());
   nsIContent* content = presShell->GetDocument()->GetDocumentElement();
   MOZ_ASSERT(content);
@@ -119,15 +121,25 @@ ChromeProcessController::GetPresShellResolution() const
 nsIPresShell*
 ChromeProcessController::GetPresShell() const
 {
-  nsView* view = nsView::GetViewFor(mWidget);
-  MOZ_ASSERT(view);
-  return view->GetPresShell();
+  if (nsView* view = nsView::GetViewFor(mWidget)) {
+    return view->GetPresShell();
+  }
+  return nullptr;
+}
+
+nsIDocument*
+ChromeProcessController::GetDocument() const
+{
+  if (nsIPresShell* presShell = GetPresShell()) {
+    return presShell->GetDocument();
+  }
+  return nullptr;
 }
 
 already_AddRefed<nsIDOMWindowUtils>
 ChromeProcessController::GetDOMWindowUtils() const
 {
-  if (nsIDocument* doc = GetPresShell()->GetDocument()) {
+  if (nsIDocument* doc = GetDocument()) {
     nsCOMPtr<nsIDOMWindowUtils> result = do_GetInterface(doc->GetWindow());
     return result.forget();
   }
@@ -195,7 +207,7 @@ ChromeProcessController::NotifyAPZStateChange(const ScrollableLayerGuid& aGuid,
     return;
   }
 
-  mAPZEventState->ProcessAPZStateChange(GetPresShell()->GetDocument(), aGuid.mScrollId, aChange, aArg);
+  mAPZEventState->ProcessAPZStateChange(GetDocument(), aGuid.mScrollId, aChange, aArg);
 }
 
 

gfx/layers/apz/util/ChromeProcessController.h

@@ -11,6 +11,7 @@
 #include "nsRefPtr.h"
 
 class nsIDOMWindowUtils;
+class nsIDocument;
 class nsIPresShell;
 class nsIWidget;
 
@@ -64,6 +65,7 @@ private:
   void InitializeRoot();
   float GetPresShellResolution() const;
   nsIPresShell* GetPresShell() const;
+  nsIDocument* GetDocument() const;
   already_AddRefed<nsIDOMWindowUtils> GetDOMWindowUtils() const;
 };
 

gfx/layers/client/ImageClient.cpp

@@ -225,6 +225,10 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer, uint32_t aContentFlag
       {
         // We must not keep a reference to the DrawTarget after it has been unlocked.
         DrawTarget* dt = texture->BorrowDrawTarget();
+        if (!dt) {
+          gfxWarning() << "ImageClientSingle::UpdateImage failed in BorrowDrawTarget";
+          return false;
+        }
         MOZ_ASSERT(surface.get());
         dt->CopySurface(surface, IntRect(IntPoint(), surface->GetSize()), IntPoint());
       }

gfx/layers/client/TextureClient.cpp

@@ -532,7 +532,17 @@ bool TextureClient::CopyToTextureClient(TextureClient* aTarget,
   }
 
   RefPtr<DrawTarget> destinationTarget = aTarget->BorrowDrawTarget();
+  if (!destinationTarget) {
+      gfxWarning() << "TextureClient::CopyToTextureClient (dest) failed in BorrowDrawTarget";
+    return false;
+  }
+
   RefPtr<DrawTarget> sourceTarget = BorrowDrawTarget();
+  if (!sourceTarget) {
+    gfxWarning() << "TextureClient::CopyToTextureClient (src) failed in BorrowDrawTarget";
+    return false;
+  }
+
   RefPtr<gfx::SourceSurface> source = sourceTarget->Snapshot();
   destinationTarget->CopySurface(source,
                                  aRect ? *aRect : gfx::IntRect(gfx::IntPoint(0, 0), GetSize()),

gfx/layers/d3d11/TextureD3D11.cpp

@@ -270,11 +270,19 @@ TextureClientD3D11::Lock(OpenMode aMode)
 
   if (mNeedsClear) {
     mDrawTarget = BorrowDrawTarget();
+    if (!mDrawTarget) {
+        Unlock();
+        return false;
+    }
     mDrawTarget->ClearRect(Rect(0, 0, GetSize().width, GetSize().height));
     mNeedsClear = false;
   }
   if (mNeedsClearWhite) {
     mDrawTarget = BorrowDrawTarget();
+    if (!mDrawTarget) {
+        Unlock();
+        return false;
+    }
     mDrawTarget->FillRect(Rect(0, 0, GetSize().width, GetSize().height), ColorPattern(Color(1.0, 1.0, 1.0, 1.0)));
     mNeedsClearWhite = false;
   }

gfx/layers/d3d9/TextureD3D9.cpp

@@ -290,17 +290,19 @@ TextureSourceD3D9::SurfaceToTexture(DeviceManagerD3D9* aDeviceManager,
                                        reinterpret_cast<unsigned char*>(lockedRect.pBits),
                                        aSize, lockedRect.Pitch,
                                        gfxPlatform::GetPlatform()->Optimal2DFormatForContent(aSurface->GetContentType()));
-    NativeSurface nativeSurf;
-    nativeSurf.mSize = aSize;
-    nativeSurf.mType = NativeSurfaceType::CAIRO_SURFACE;
-    // We don't know that this is actually the right format, but it's the best
-    // we can get for the content type. In practice this probably always works.
-    nativeSurf.mFormat = dt->GetFormat();
-    nativeSurf.mSurface = aSurface->CairoSurface();
 
-    RefPtr<SourceSurface> surf = dt->CreateSourceSurfaceFromNativeSurface(nativeSurf);
+    if (dt) {
+        NativeSurface nativeSurf;
+        nativeSurf.mSize = aSize;
+        nativeSurf.mType = NativeSurfaceType::CAIRO_SURFACE;
+        // We don't know that this is actually the right format, but it's the best
+        // we can get for the content type. In practice this probably always works.
+        nativeSurf.mFormat = dt->GetFormat();
+        nativeSurf.mSurface = aSurface->CairoSurface();
 
-    dt->CopySurface(surf, IntRect(IntPoint(), aSize), IntPoint());
+        RefPtr<SourceSurface> surf = dt->CreateSourceSurfaceFromNativeSurface(nativeSurf);
+        dt->CopySurface(surf, IntRect(IntPoint(), aSize), IntPoint());
+    }
   }
 
   FinishTextures(aDeviceManager, texture, surface);
@@ -618,11 +620,19 @@ CairoTextureClientD3D9::Lock(OpenMode aMode)
 
   if (mNeedsClear) {
     mDrawTarget = BorrowDrawTarget();
+    if (!mDrawTarget) {
+      Unlock();
+      return false;
+    }
     mDrawTarget->ClearRect(Rect(0, 0, GetSize().width, GetSize().height));
     mNeedsClear = false;
   }
   if (mNeedsClearWhite) {
     mDrawTarget = BorrowDrawTarget();
+    if (!mDrawTarget) {
+      Unlock();
+      return false;
+    }
     mDrawTarget->FillRect(Rect(0, 0, GetSize().width, GetSize().height), ColorPattern(Color(1.0, 1.0, 1.0, 1.0)));
     mNeedsClearWhite = false;
   }

gfx/layers/opengl/CompositorOGL.cpp

@@ -1229,9 +1229,10 @@ CompositorOGL::EndFrame()
       mWidget->GetBounds(rect);
     }
     RefPtr<DrawTarget> target = gfxPlatform::GetPlatform()->CreateOffscreenContentDrawTarget(IntSize(rect.width, rect.height), SurfaceFormat::B8G8R8A8);
-    CopyToTarget(target, nsIntPoint(), Matrix());
-
-    WriteSnapshotToDumpFile(this, target);
+    if (target) {
+      CopyToTarget(target, nsIntPoint(), Matrix());
+      WriteSnapshotToDumpFile(this, target);
+    }
   }
 #endif
 
@@ -1343,6 +1344,7 @@ CompositorOGL::SetDestinationSurfaceSize(const gfx::IntSize& aSize)
 void
 CompositorOGL::CopyToTarget(DrawTarget* aTarget, const nsIntPoint& aTopLeft, const gfx::Matrix& aTransform)
 {
+  MOZ_ASSERT(aTarget);
   IntRect rect;
   if (mUseExternalSurfaceSize) {
     rect = IntRect(0, 0, mSurfaceSize.width, mSurfaceSize.height);

gfx/tests/gtest/TestAsyncPanZoomController.cpp

@@ -261,7 +261,7 @@ protected:
     apzc->Destroy();
   }
 
-  void SetMayHaveTouchListeners()
+  void MakeApzcWaitForMainThread()
   {
     apzc->SetWaitForMainThread();
   }
@@ -765,7 +765,7 @@ TEST_F(APZCPinchGestureDetectorTester, Pinch_PreventDefault) {
   FrameMetrics originalMetrics = GetPinchableFrameMetrics();
   apzc->SetFrameMetrics(originalMetrics);
 
-  SetMayHaveTouchListeners();
+  MakeApzcWaitForMainThread();
   MakeApzcZoomable();
 
   int touchInputId = 0;
@@ -969,7 +969,7 @@ protected:
 
   void DoPanWithPreventDefaultTest()
   {
-    SetMayHaveTouchListeners();
+    MakeApzcWaitForMainThread();
 
     int time = 0;
     int touchStart = 50;
@@ -1248,7 +1248,7 @@ protected:
   }
 
   void DoFlingStopWithSlowListener(bool aPreventDefault) {
-    SetMayHaveTouchListeners();
+    MakeApzcWaitForMainThread();
 
     int time = 0;
     int touchStart = 50;
@@ -1573,7 +1573,7 @@ DoubleTapAndCheckStatus(const nsRefPtr<InputReceiver>& aTarget, int aX, int aY,
 }
 
 TEST_F(APZCGestureDetectorTester, DoubleTap) {
-  SetMayHaveTouchListeners();
+  MakeApzcWaitForMainThread();
   MakeApzcZoomable();
 
   EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
@@ -1593,7 +1593,7 @@ TEST_F(APZCGestureDetectorTester, DoubleTap) {
 }
 
 TEST_F(APZCGestureDetectorTester, DoubleTapNotZoomable) {
-  SetMayHaveTouchListeners();
+  MakeApzcWaitForMainThread();
   MakeApzcUnzoomable();
 
   EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(2);
@@ -1613,7 +1613,7 @@ TEST_F(APZCGestureDetectorTester, DoubleTapNotZoomable) {
 }
 
 TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultFirstOnly) {
-  SetMayHaveTouchListeners();
+  MakeApzcWaitForMainThread();
   MakeApzcZoomable();
 
   EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(1);
@@ -1633,7 +1633,7 @@ TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultFirstOnly) {
 }
 
 TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultBoth) {
-  SetMayHaveTouchListeners();
+  MakeApzcWaitForMainThread();
   MakeApzcZoomable();
 
   EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
@@ -2668,8 +2668,6 @@ protected:
 };
 
 TEST_F(APZEventRegionsTester, HitRegionImmediateResponse) {
-  SCOPED_GFX_PREF(LayoutEventRegionsEnabled, bool, true);
-
   CreateEventRegionsLayerTree1();
 
   TestAsyncPanZoomController* root = ApzcOf(layers[0]);
@@ -2723,8 +2721,6 @@ TEST_F(APZEventRegionsTester, HitRegionImmediateResponse) {
 }
 
 TEST_F(APZEventRegionsTester, HitRegionAccumulatesChildren) {
-  SCOPED_GFX_PREF(LayoutEventRegionsEnabled, bool, true);
-
   CreateEventRegionsLayerTree2();
 
   int time = 0;
@@ -2738,8 +2734,6 @@ TEST_F(APZEventRegionsTester, HitRegionAccumulatesChildren) {
 }
 
 TEST_F(APZEventRegionsTester, Obscuration) {
-  SCOPED_GFX_PREF(LayoutEventRegionsEnabled, bool, true);
-
   CreateObscuringLayerTree();
   ScopedLayerTreeRegistration registration(0, root, mcc);
 
@@ -2758,8 +2752,6 @@ TEST_F(APZEventRegionsTester, Obscuration) {
 }
 
 TEST_F(APZEventRegionsTester, Bug1119497) {
-  SCOPED_GFX_PREF(LayoutEventRegionsEnabled, bool, true);
-
   CreateBug1119497LayerTree();
 
   HitTestResult result;
@@ -2771,8 +2763,6 @@ TEST_F(APZEventRegionsTester, Bug1119497) {
 }
 
 TEST_F(APZEventRegionsTester, Bug1117712) {
-  SCOPED_GFX_PREF(LayoutEventRegionsEnabled, bool, true);
-
   CreateBug1117712LayerTree();
 
   TestAsyncPanZoomController* apzc2 = ApzcOf(layers[2]);

gfx/thebes/gfxPlatform.cpp

@@ -727,6 +727,10 @@ gfxPlatform::CreateDrawTargetForSurface(gfxASurface *aSurface, const IntSize& aS
 {
   SurfaceFormat format = Optimal2DFormatForContent(aSurface->GetContentType());
   RefPtr<DrawTarget> drawTarget = Factory::CreateDrawTargetForCairoSurface(aSurface->CairoSurface(), aSize, &format);
+  if (!drawTarget) {
+    gfxWarning() << "gfxPlatform::CreateDrawTargetForSurface failed in CreateDrawTargetForCairoSurface";
+    return nullptr;
+  }
   aSurface->SetData(&kDrawTarget, drawTarget, nullptr);
   return drawTarget.forget();
 }
@@ -909,6 +913,10 @@ gfxPlatform::GetSourceSurfaceForSurface(DrawTarget *aTarget, gfxASurface *aSurfa
     surf.mSize = ToIntSize(aSurface->GetSize());
     RefPtr<DrawTarget> drawTarget =
       Factory::CreateDrawTarget(BackendType::CAIRO, IntSize(1, 1), format);
+    if (!drawTarget) {
+      gfxWarning() << "gfxPlatform::GetSourceSurfaceForSurface failed in CreateDrawTarget";
+      return nullptr;
+    }
     srcBuffer = drawTarget->CreateSourceSurfaceFromNativeSurface(surf);
     if (srcBuffer) {
       srcBuffer = aTarget->OptimizeSourceSurface(srcBuffer);

gfx/thebes/gfxUtils.cpp

@@ -14,6 +14,7 @@
 #include "mozilla/Base64.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/DataSurfaceHelpers.h"
+#include "mozilla/gfx/Logging.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/RefPtr.h"
 #include "mozilla/Vector.h"
@@ -1037,6 +1038,11 @@ gfxUtils::CopySurfaceToDataSourceSurfaceWithFormat(SourceSurface* aSurface,
     // GPU.
     RefPtr<DrawTarget> dt = gfxPlatform::GetPlatform()->
       CreateOffscreenContentDrawTarget(aSurface->GetSize(), aFormat);
+    if (!dt) {
+      gfxWarning() << "gfxUtils::CopySurfaceToDataSourceSurfaceWithFormat failed in CreateOffscreenContentDrawTarget";
+      return nullptr;
+    }
+
     // Using DrawSurface() here rather than CopySurface() because CopySurface
     // is optimized for memcpy and therefore isn't good for format conversion.
     // Using OP_OVER since in our case it's equivalent to OP_SOURCE and

image/src/DynamicImage.cpp

@@ -184,6 +184,10 @@ DynamicImage::GetFrame(uint32_t aWhichFrame,
   RefPtr<DrawTarget> dt = gfxPlatform::GetPlatform()->
     CreateOffscreenContentDrawTarget(IntSize(size.width, size.height),
                                      SurfaceFormat::B8G8R8A8);
+  if (!dt) {
+    gfxWarning() << "DynamicImage::GetFrame failed in CreateOffscreenContentDrawTarget";
+    return nullptr;
+  }
   nsRefPtr<gfxContext> context = new gfxContext(dt);
 
   auto result = Draw(context, size, ImageRegion::Create(size),

image/src/RasterImage.cpp

@@ -692,6 +692,10 @@ RasterImage::CopyFrame(uint32_t aWhichFrame, uint32_t aFlags)
                                      size,
                                      mapping.mStride,
                                      SurfaceFormat::B8G8R8A8);
+  if (!target) {
+    gfxWarning() << "RasterImage::CopyFrame failed in CreateDrawTargetForData";
+    return nullptr;
+  }
 
   nsIntRect intFrameRect = frameRef->GetRect();
   Rect rect(intFrameRect.x, intFrameRect.y,

image/src/imgFrame.cpp

@@ -483,6 +483,10 @@ nsresult imgFrame::Optimize()
                                        mapping.mStride,
                                        optFormat);
 
+    if (!target) {
+      gfxWarning() << "imgFrame::Optimize failed in CreateDrawTargetForData";
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
     Rect rect(0, 0, mSize.width, mSize.height);
     target->DrawSurface(mImageSurface, rect, rect);
     target->Flush();
@@ -882,6 +886,10 @@ imgFrame::Deoptimize()
                                          mSize,
                                          mapping.mStride,
                                          format);
+      if (!target) {
+        gfxWarning() << "imgFrame::Deoptimize failed in CreateDrawTargetForData";
+        return NS_ERROR_OUT_OF_MEMORY;
+      }
 
       Rect rect(0, 0, mSize.width, mSize.height);
       if (mSinglePixel)

image/src/imgTools.cpp

@@ -221,6 +221,11 @@ NS_IMETHODIMP imgTools::EncodeScaledImage(imgIContainer *aContainer,
                                      dataSurface->GetSize(),
                                      map.mStride,
                                      SurfaceFormat::B8G8R8A8);
+  if (!dt) {
+    gfxWarning() << "imgTools::EncodeImage failed in CreateDrawTargetForData";
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
   dt->DrawSurface(frame,
                   Rect(0, 0, aScaledWidth, aScaledHeight),
                   Rect(0, 0, frameWidth, frameHeight),
@@ -293,6 +298,10 @@ NS_IMETHODIMP imgTools::EncodeCroppedImage(imgIContainer *aContainer,
                                      dataSurface->GetSize(),
                                      map.mStride,
                                      SurfaceFormat::B8G8R8A8);
+  if (!dt) {
+    gfxWarning() << "imgTools::EncodeCroppedImage failed in CreateDrawTargetForData";
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
   dt->CopySurface(frame,
                   IntRect(aOffsetX, aOffsetY, aWidth, aHeight),
                   IntPoint(0, 0));

ipc/keystore/KeyStore.cpp

@@ -137,15 +137,15 @@ status_t BnKeystoreService::onTransact(uint32_t code, const Parcel& data, Parcel
     case SIGN: {
       CHECK_INTERFACE(IKeystoreService, data, reply);
       String16 name = data.readString16();
-      size_t signDataSize = data.readInt32();
+      ssize_t signDataSize = data.readInt32();
       const uint8_t *signData = nullptr;
-      if (signDataSize >= 0 && signDataSize <= data.dataAvail()) {
+      if (signDataSize >= 0 && (size_t)signDataSize <= data.dataAvail()) {
         signData = (const uint8_t *)data.readInplace(signDataSize);
       }
 
       uint8_t *signResult = nullptr;
       size_t signResultSize;
-      int32_t ret = sign(name, signData, signDataSize, &signResult,
+      int32_t ret = sign(name, signData, (size_t)signDataSize, &signResult,
                          &signResultSize);
 
       reply->writeNoException();

js/src/asmjs/AsmJSValidate.cpp

@@ -8203,6 +8203,8 @@ static const FloatRegisterSet NonVolatileSimdRegs = SupportsSimd ? NonVolatileRe
 static const unsigned FramePushedAfterSave = NonVolatileRegs.gprs().size() * sizeof(intptr_t) +
                                              NonVolatileRegs.fpus().getPushSizeInBytes() +
                                              sizeof(double);
+#elif defined(JS_CODEGEN_NONE)
+static const unsigned FramePushedAfterSave = 0;
 #else
 static const unsigned FramePushedAfterSave =
    SupportsSimd ? NonVolatileRegs.gprs().size() * sizeof(intptr_t) +

js/src/jit-test/tests/ion/bug1139368.js

@@ -0,0 +1,10 @@
+// |jit-test| error: TypeError
+function f() {
+    for (var i=2; i<2; i++) {
+	var a = /a/;
+    }
+    for (var i=0; i<2; i++) {
+	a.exec("aaa");
+    }
+}
+f();

js/src/jit/IonAnalysis.cpp

@@ -373,6 +373,9 @@ MaybeFoldAndOrBlock(MIRGraph &graph, MBasicBlock *initialBlock)
     MDefinition *branchResult = phi->getOperand(phiBlock->indexForPredecessor(branchBlock));
     MDefinition *initialResult = phi->getOperand(phiBlock->indexForPredecessor(initialBlock));
 
+    if (initialResult != initialTest->input())
+        return;
+
     // OK, we found the desired pattern, now transform the graph.
 
     // Remove the phi from phiBlock.

js/src/jit/IonBuilder.cpp

@@ -10019,6 +10019,11 @@ IonBuilder::improveThisTypesForCall()
     MFilterTypeSet *filter = MFilterTypeSet::New(alloc(), thisDef, types);
     current->add(filter);
     current->rewriteAtDepth(-2, filter);
+
+    // FilterTypeSetPolicy::adjustInputs will insert an infallible Unbox(Object)
+    // for the input. Don't hoist this unbox above the getprop or getelem
+    // operation.
+    filter->setDependency(current->peek(-1)->toInstruction());
     return true;
 }
 

js/src/jit/IonTypes.h

@@ -487,6 +487,8 @@ StringFromMIRType(MIRType type)
       return "MagicUninitializedLexical";
     case MIRType_Value:
       return "Value";
+    case MIRType_ObjectOrNull:
+      return "ObjectOrNull";
     case MIRType_None:
       return "None";
     case MIRType_Slots:
@@ -495,10 +497,16 @@ StringFromMIRType(MIRType type)
       return "Elements";
     case MIRType_Pointer:
       return "Pointer";
-    case MIRType_Int32x4:
-      return "Int32x4";
+    case MIRType_Shape:
+      return "Shape";
+    case MIRType_ObjectGroup:
+      return "ObjectGroup";
     case MIRType_Float32x4:
       return "Float32x4";
+    case MIRType_Int32x4:
+      return "Int32x4";
+    case MIRType_Doublex2:
+      return "Doublex2";
     default:
       MOZ_CRASH("Unknown MIRType.");
   }

js/src/jit/MIR.h

@@ -8199,6 +8199,12 @@ class MLoadElementHole
     {
         setResultType(MIRType_Value);
         setMovable();
+
+        // Set the guard flag to make sure we bail when we see a negative
+        // index. We can clear this flag (and needsNegativeIntCheck_) in
+        // collectRangeInfoPreTrunc.
+        setGuard();
+
         MOZ_ASSERT(elements->type() == MIRType_Elements);
         MOZ_ASSERT(index->type() == MIRType_Int32);
         MOZ_ASSERT(initLength->type() == MIRType_Int32);

js/src/jit/RangeAnalysis.cpp

@@ -3061,8 +3061,10 @@ void
 MLoadElementHole::collectRangeInfoPreTrunc()
 {
     Range indexRange(index());
-    if (indexRange.isFiniteNonNegative())
+    if (indexRange.isFiniteNonNegative()) {
         needsNegativeIntCheck_ = false;
+        setNotGuard();
+    }
 }
 
 void

js/src/tests/shell/futex.js

@@ -5,8 +5,10 @@
  * http://creativecommons.org/licenses/publicdomain/
  */
 
-if (!(this.SharedArrayBuffer && this.getSharedArrayBuffer && this.setSharedArrayBuffer))
+if (!(this.SharedArrayBuffer && this.getSharedArrayBuffer && this.setSharedArrayBuffer)) {
+    reportCompare(true,true);
     quit(0);
+}
 
 var DEBUG = false;
 

layout/base/FrameLayerBuilder.cpp

@@ -2716,9 +2716,11 @@ PaintInactiveLayer(nsDisplayListBuilder* aBuilder,
     tempDT = gfxPlatform::GetPlatform()->CreateOffscreenContentDrawTarget(
                                       itemVisibleRect.Size().ToIntSize(),
                                       SurfaceFormat::B8G8R8A8);
-    context = new gfxContext(tempDT);
-    context->SetMatrix(gfxMatrix::Translation(-itemVisibleRect.x,
-                                              -itemVisibleRect.y));
+    if (tempDT) {
+      context = new gfxContext(tempDT);
+      context->SetMatrix(gfxMatrix::Translation(-itemVisibleRect.x,
+                                                -itemVisibleRect.y));
+    }
   }
 #endif
   basic->BeginTransaction();
@@ -2740,7 +2742,7 @@ PaintInactiveLayer(nsDisplayListBuilder* aBuilder,
   basic->SetTarget(nullptr);
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting) {
+  if (gfxUtils::sDumpPainting && tempDT) {
     RefPtr<SourceSurface> surface = tempDT->Snapshot();
     DumpPaintedImage(aItem, surface);
 

layout/base/SelectionCarets.cpp

@@ -319,12 +319,6 @@ SelectionCarets::SetVisibility(bool aVisible)
 
   dom::Element* endElement = mPresShell->GetSelectionCaretsEndElement();
   SetElementVisibility(endElement, mVisible && mEndCaretVisible);
-
-  // We must call SetHasTouchCaret() in order to get APZC to wait until the
-  // event has been round-tripped and check whether it has been handled,
-  // otherwise B2G will end up panning the document when the user tries to drag
-  // selection caret.
-  mPresShell->SetMayHaveTouchCaret(mVisible);
 }
 
 void

layout/base/TouchCaret.cpp

@@ -181,12 +181,6 @@ TouchCaret::SetVisibility(bool aVisible)
 
   // Set touch caret expiration time.
   mVisible ? LaunchExpirationTimer() : CancelExpirationTimer();
-
-  // We must call SetMayHaveTouchCaret() in order to get APZC to wait until the
-  // event has been round-tripped and check whether it has been handled,
-  // otherwise B2G will end up panning the document when the user tries to drag
-  // touch caret.
-  presShell->SetMayHaveTouchCaret(mVisible);
 }
 
 nsRect

layout/base/nsDisplayList.cpp

@@ -828,18 +828,6 @@ nsDisplayScrollLayer::ComputeFrameMetrics(nsIFrame* aForFrame,
   metrics.SetZoom(metrics.GetCumulativeResolution() * metrics.GetDevPixelsPerCSSPixel()
                   * layerToParentLayerScale);
 
-  if (presShell) {
-    nsIDocument* document = nullptr;
-    document = presShell->GetDocument();
-    if (document) {
-      nsCOMPtr<nsPIDOMWindow> innerWin(document->GetInnerWindow());
-      if (innerWin) {
-        metrics.SetMayHaveTouchListeners(innerWin->HasApzAwareEventListeners());
-      }
-    }
-    metrics.SetMayHaveTouchCaret(presShell->MayHaveTouchCaret());
-  }
-
   // Calculate the composition bounds as the size of the scroll frame and
   // its origin relative to the reference frame.
   // If aScrollFrame is null, we are in a document without a root scroll frame,
@@ -4803,17 +4791,14 @@ nsDisplayScrollInfoLayer::BuildLayer(nsDisplayListBuilder* aBuilder,
                                      LayerManager* aManager,
                                      const ContainerLayerParameters& aContainerParameters)
 {
-  // Only build scrollinfo layers if event-regions are disabled, so that the
-  // compositor knows where the inactive scrollframes are. When event-regions
-  // are enabled, the dispatch-to-content regions generally provide this
-  // information to the APZ code. However, in some cases, there might be
-  // content that cannot be layerized, and so needs to scroll synchronously.
-  // To handle those cases (which are indicated by setting mHoisted to true), we
-  // still want to generate scrollinfo layers.
-  if (gfxPrefs::LayoutEventRegionsEnabled() && !mHoisted) {
-    return nullptr;
-  }
-  return nsDisplayScrollLayer::BuildLayer(aBuilder, aManager, aContainerParameters);
+  // In general for APZ with event-regions we no longer have a need for
+  // scrollinfo layers. However, in some cases, there might be content that
+  // cannot be layerized, and so needs to scroll synchronously. To handle those
+  // cases (which are indicated by setting mHoisted to true), we still want to
+  // generate scrollinfo layers.
+  return mHoisted
+    ? nsDisplayScrollLayer::BuildLayer(aBuilder, aManager, aContainerParameters)
+    : nullptr;
 }
 
 LayerState
@@ -4822,10 +4807,9 @@ nsDisplayScrollInfoLayer::GetLayerState(nsDisplayListBuilder* aBuilder,
                                         const ContainerLayerParameters& aParameters)
 {
   // See comment in BuildLayer
-  if (gfxPrefs::LayoutEventRegionsEnabled() && !mHoisted) {
-    return LAYER_NONE;
-  }
-  return LAYER_ACTIVE_EMPTY;
+  return mHoisted
+    ? LAYER_ACTIVE_EMPTY
+    : LAYER_NONE;
 }
 
 bool

layout/base/nsDisplayList.h

@@ -345,7 +345,11 @@ public:
   }
   bool IsBuildingLayerEventRegions()
   {
-    return (gfxPrefs::LayoutEventRegionsEnabled() && mMode == PAINTING);
+    if (mMode == PAINTING) {
+      return (gfxPrefs::LayoutEventRegionsEnabled() ||
+              gfxPrefs::AsyncPanZoomEnabled());
+    }
+    return false;
   }
   bool IsInsidePointerEventsNoneDoc()
   {

layout/base/nsIPresShell.h

@@ -794,17 +794,6 @@ public:
    */
   virtual mozilla::dom::Element* GetTouchCaretElement() const = 0;
 
-  /**
-   * Will be called when touch caret visibility has changed.
-   * Set the mMayHaveTouchCaret flag to aSet.
-   */
-  virtual void SetMayHaveTouchCaret(bool aSet) = 0;
-
-  /**
-   * Get the mMayHaveTouchCaret flag.
-   */
-  virtual bool MayHaveTouchCaret() = 0;
-
   /**
    * Get the selection caret, if it exists. AddRefs it.
    */

layout/base/nsLayoutUtils.cpp

@@ -7171,7 +7171,8 @@ nsUnsetAttrRunnable::Run()
  * width of the device**, the fonts satisfy our minima.
  */
 static nscoord
-MinimumFontSizeFor(nsPresContext* aPresContext, nscoord aContainerWidth)
+MinimumFontSizeFor(nsPresContext* aPresContext, WritingMode aWritingMode,
+                   nscoord aContainerISize)
 {
   nsIPresShell* presShell = aPresContext->PresShell();
 
@@ -7182,20 +7183,23 @@ MinimumFontSizeFor(nsPresContext* aPresContext, nscoord aContainerWidth)
   }
 
   // Clamp the container width to the device dimensions
-  nscoord iFrameWidth = aPresContext->GetVisibleArea().width;
-  nscoord effectiveContainerWidth = std::min(iFrameWidth, aContainerWidth);
+  nscoord iFrameISize = aWritingMode.IsVertical()
+    ? aPresContext->GetVisibleArea().height
+    : aPresContext->GetVisibleArea().width;
+  nscoord effectiveContainerISize = std::min(iFrameISize, aContainerISize);
 
   nscoord byLine = 0, byInch = 0;
   if (emPerLine != 0) {
-    byLine = effectiveContainerWidth / emPerLine;
+    byLine = effectiveContainerISize / emPerLine;
   }
   if (minTwips != 0) {
     // REVIEW: Is this giving us app units and sizes *not* counting
     // viewport scaling?
-    float deviceWidthInches =
-      aPresContext->ScreenWidthInchesForFontInflation();
-    byInch = NSToCoordRound(effectiveContainerWidth /
-                            (deviceWidthInches * 1440 /
+    gfxSize screenSize = aPresContext->ScreenSizeInchesForFontInflation();
+    float deviceISizeInches = aWritingMode.IsVertical()
+      ? screenSize.height : screenSize.width;
+    byInch = NSToCoordRound(effectiveContainerISize /
+                            (deviceISizeInches * 1440 /
                              minTwips ));
   }
   return std::max(byLine, byInch);
@@ -7304,14 +7308,14 @@ ShouldInflateFontsForContainer(const nsIFrame *aFrame)
   // We only want to inflate fonts for text that is in a place
   // with room to expand.  The question is what the best heuristic for
   // that is...
-  // For now, we're going to use NS_FRAME_IN_CONSTRAINED_HEIGHT, which
+  // For now, we're going to use NS_FRAME_IN_CONSTRAINED_BSIZE, which
   // indicates whether the frame is inside something with a constrained
-  // height (propagating down the tree), but the propagation stops when
-  // we hit overflow-y: scroll or auto.
+  // block-size (propagating down the tree), but the propagation stops when
+  // we hit overflow-y [or -x, for vertical mode]: scroll or auto.
   const nsStyleText* styleText = aFrame->StyleText();
 
   return styleText->mTextSizeAdjust != NS_STYLE_TEXT_SIZE_ADJUST_NONE &&
-         !(aFrame->GetStateBits() & NS_FRAME_IN_CONSTRAINED_HEIGHT) &&
+         !(aFrame->GetStateBits() & NS_FRAME_IN_CONSTRAINED_BSIZE) &&
          // We also want to disable font inflation for containers that have
          // preformatted text.
          // MathML cells need special treatment. See bug 1002526 comment 56.
@@ -7343,7 +7347,8 @@ nsLayoutUtils::InflationMinFontSizeFor(const nsIFrame *aFrame)
       }
 
       return MinimumFontSizeFor(aFrame->PresContext(),
-                                data->EffectiveWidth());
+                                aFrame->GetWritingMode(),
+                                data->EffectiveISize());
     }
   }
 

layout/base/nsPresContext.cpp

@@ -191,7 +191,8 @@ IsVisualCharset(const nsCString& aCharset)
 
 nsPresContext::nsPresContext(nsIDocument* aDocument, nsPresContextType aType)
   : mType(aType), mDocument(aDocument), mBaseMinFontSize(0),
-    mTextZoom(1.0), mFullZoom(1.0), mLastFontInflationScreenWidth(-1.0),
+    mTextZoom(1.0), mFullZoom(1.0),
+    mLastFontInflationScreenSize(gfxSize(-1.0, -1.0)),
     mPageSize(-1, -1), mPPScale(1.0f),
     mViewportStyleScrollbar(NS_STYLE_OVERFLOW_AUTO, NS_STYLE_OVERFLOW_AUTO),
     mImageAnimationModePref(imgIContainer::kNormalAnimMode),
@@ -1505,8 +1506,8 @@ nsPresContext::SetFullZoom(float aZoom)
   mSupressResizeReflow = false;
 }
 
-float
-nsPresContext::ScreenWidthInchesForFontInflation(bool* aChanged)
+gfxSize
+nsPresContext::ScreenSizeInchesForFontInflation(bool* aChanged)
 {
   if (aChanged) {
     *aChanged = false;
@@ -1515,19 +1516,20 @@ nsPresContext::ScreenWidthInchesForFontInflation(bool* aChanged)
   nsDeviceContext *dx = DeviceContext();
   nsRect clientRect;
   dx->GetClientRect(clientRect); // FIXME: GetClientRect looks expensive
-  float deviceWidthInches =
-    float(clientRect.width) / float(dx->AppUnitsPerPhysicalInch());
+  float unitsPerInch = dx->AppUnitsPerPhysicalInch();
+  gfxSize deviceSizeInches(float(clientRect.width) / unitsPerInch,
+                           float(clientRect.height) / unitsPerInch);
 
-  if (mLastFontInflationScreenWidth == -1.0) {
-    mLastFontInflationScreenWidth = deviceWidthInches;
+  if (mLastFontInflationScreenSize == gfxSize(-1.0, -1.0)) {
+    mLastFontInflationScreenSize = deviceSizeInches;
   }
 
-  if (deviceWidthInches != mLastFontInflationScreenWidth && aChanged) {
+  if (deviceSizeInches != mLastFontInflationScreenSize && aChanged) {
     *aChanged = true;
-    mLastFontInflationScreenWidth = deviceWidthInches;
+    mLastFontInflationScreenSize = deviceSizeInches;
   }
 
-  return deviceWidthInches;
+  return deviceSizeInches;
 }
 
 void

layout/base/nsPresContext.h

@@ -592,15 +592,15 @@ public:
   }
 
   /**
-   * Return the device's screen width in inches, for font size
+   * Return the device's screen size in inches, for font size
    * inflation.
    *
    * If |aChanged| is non-null, then aChanged is filled in with whether
-   * the return value has changed since either:
+   * the screen size value has changed since either:
    *  a. the last time the function was called with non-null aChanged, or
    *  b. the first time the function was called.
    */
-  float ScreenWidthInchesForFontInflation(bool* aChanged = nullptr);
+  gfxSize ScreenSizeInchesForFontInflation(bool* aChanged = nullptr);
 
   static int32_t AppUnitsPerCSSPixel() { return mozilla::AppUnitsPerCSSPixel(); }
   int32_t AppUnitsPerDevPixel() const;
@@ -1259,7 +1259,7 @@ protected:
   float                 mTextZoom;      // Text zoom, defaults to 1.0
   float                 mFullZoom;      // Page zoom, defaults to 1.0
 
-  float                 mLastFontInflationScreenWidth;
+  gfxSize               mLastFontInflationScreenSize;
 
   int32_t               mCurAppUnitsPerDevPixel;
   int32_t               mAutoQualityMinFontSizePixelsPref;

layout/base/nsPresShell.cpp

@@ -2591,52 +2591,6 @@ PresShell::GetTouchCaretElement() const
   return GetCanvasFrame() ? GetCanvasFrame()->GetTouchCaretElement() : nullptr;
 }
 
-void
-PresShell::SetMayHaveTouchCaret(bool aSet)
-{
-  if (!mPresContext) {
-    return;
-  }
-
-  if (!mPresContext->IsRoot()) {
-    nsIPresShell* rootPresShell = GetRootPresShell();
-    if (rootPresShell) {
-      rootPresShell->SetMayHaveTouchCaret(aSet);
-    }
-    return;
-  }
-
-  nsIDocument* document = GetDocument();
-  if (document) {
-    nsPIDOMWindow* innerWin = document->GetInnerWindow();
-    if (innerWin) {
-      innerWin->SetMayHaveTouchCaret(aSet);
-    }
-  }
-}
-
-bool
-PresShell::MayHaveTouchCaret()
-{
-  if (!mPresContext) {
-    return false;
-  }
-
-  if (!mPresContext->IsRoot()) {
-    nsIPresShell* rootPresShell = GetRootPresShell();
-    return rootPresShell ? rootPresShell->MayHaveTouchCaret() : false;
-  }
-
-  nsIDocument* document = GetDocument();
-  if (document) {
-    nsPIDOMWindow* innerWin = document->GetInnerWindow();
-    if (innerWin) {
-      return innerWin->MayHaveTouchCaret();
-    }
-  }
-  return false;
-}
-
 Element*
 PresShell::GetSelectionCaretsStartElement() const
 {

layout/base/nsPresShell.h

@@ -235,8 +235,6 @@ public:
   // touch caret
   virtual already_AddRefed<mozilla::TouchCaret> GetTouchCaret() const MOZ_OVERRIDE;
   virtual mozilla::dom::Element* GetTouchCaretElement() const MOZ_OVERRIDE;
-  virtual void SetMayHaveTouchCaret(bool aSet) MOZ_OVERRIDE;
-  virtual bool MayHaveTouchCaret() MOZ_OVERRIDE;
   // selection caret
   virtual already_AddRefed<mozilla::SelectionCarets> GetSelectionCarets() const MOZ_OVERRIDE;
   virtual mozilla::dom::Element* GetSelectionCaretsStartElement() const MOZ_OVERRIDE;

layout/base/tests/test_reftests_with_caret.html

@@ -17,6 +17,7 @@
 
 SimpleTest.waitForExplicitFinish();
 SimpleTest.requestFlakyTimeout("untriaged");
+SimpleTest.requestLongerTimeout(2);
 
 var iframes = [];
 function callbackTestIframe(iframe)

layout/generic/nsFontInflationData.cpp

@@ -32,7 +32,7 @@ nsFontInflationData::FindFontInflationDataFor(const nsIFrame *aFrame)
 }
 
 /* static */ bool
-nsFontInflationData::UpdateFontInflationDataWidthFor(const nsHTMLReflowState& aReflowState)
+nsFontInflationData::UpdateFontInflationDataISizeFor(const nsHTMLReflowState& aReflowState)
 {
   nsIFrame *bfc = aReflowState.frame;
   NS_ASSERTION(bfc->GetStateBits() & NS_FRAME_FONT_INFLATION_FLOW_ROOT,
@@ -41,24 +41,24 @@ nsFontInflationData::UpdateFontInflationDataWidthFor(const nsHTMLReflowState& aR
   nsFontInflationData *data = static_cast<nsFontInflationData*>(
                                 bfcProps.Get(FontInflationDataProperty()));
   bool oldInflationEnabled;
-  nscoord oldNCAWidth;
+  nscoord oldNCAISize;
   if (data) {
-    oldNCAWidth = data->mNCAWidth;
+    oldNCAISize = data->mNCAISize;
     oldInflationEnabled = data->mInflationEnabled;
   } else {
     data = new nsFontInflationData(bfc);
     bfcProps.Set(FontInflationDataProperty(), data);
-    oldNCAWidth = -1;
+    oldNCAISize = -1;
     oldInflationEnabled = true; /* not relevant */
   }
 
-  data->UpdateWidth(aReflowState);
+  data->UpdateISize(aReflowState);
 
   if (oldInflationEnabled != data->mInflationEnabled)
     return true;
 
   return oldInflationEnabled &&
-         oldNCAWidth != data->mNCAWidth;
+         oldNCAISize != data->mNCAISize;
 }
 
 /* static */ void
@@ -77,7 +77,7 @@ nsFontInflationData::MarkFontInflationDataTextDirty(nsIFrame *aBFCFrame)
 
 nsFontInflationData::nsFontInflationData(nsIFrame *aBFCFrame)
   : mBFCFrame(aBFCFrame)
-  , mNCAWidth(0)
+  , mNCAISize(0)
   , mTextAmount(0)
   , mTextThreshold(0)
   , mInflationEnabled(false)
@@ -124,12 +124,12 @@ NearestCommonAncestorFirstInFlow(nsIFrame *aFrame1, nsIFrame *aFrame2,
 }
 
 static nscoord
-ComputeDescendantWidth(const nsHTMLReflowState& aAncestorReflowState,
+ComputeDescendantISize(const nsHTMLReflowState& aAncestorReflowState,
                        nsIFrame *aDescendantFrame)
 {
   nsIFrame *ancestorFrame = aAncestorReflowState.frame->FirstInFlow();
   if (aDescendantFrame == ancestorFrame) {
-    return aAncestorReflowState.ComputedWidth();
+    return aAncestorReflowState.ComputedISize();
   }
 
   AutoInfallibleTArray<nsIFrame*, 16> frames;
@@ -138,7 +138,7 @@ ComputeDescendantWidth(const nsHTMLReflowState& aAncestorReflowState,
     frames.AppendElement(f);
   }
 
-  // This ignores the width contributions made by scrollbars, though in
+  // This ignores the inline-size contributions made by scrollbars, though in
   // reality we don't have any scrollbars on the sorts of devices on
   // which we use font inflation, so it's not a problem.  But it may
   // occasionally cause problems when writing tests on desktop.
@@ -163,7 +163,7 @@ ComputeDescendantWidth(const nsHTMLReflowState& aAncestorReflowState,
 
   MOZ_ASSERT(reflowStates[len - 1].frame == aDescendantFrame,
              "bad logic in this function");
-  nscoord result = reflowStates[len - 1].ComputedWidth();
+  nscoord result = reflowStates[len - 1].ComputedISize();
 
   for (uint32_t i = len; i-- != 0; ) {
     reflowStates[i].~nsHTMLReflowState();
@@ -174,7 +174,7 @@ ComputeDescendantWidth(const nsHTMLReflowState& aAncestorReflowState,
 }
 
 void
-nsFontInflationData::UpdateWidth(const nsHTMLReflowState &aReflowState)
+nsFontInflationData::UpdateISize(const nsHTMLReflowState &aReflowState)
 {
   nsIFrame *bfc = aReflowState.frame;
   NS_ASSERTION(bfc->GetStateBits() & NS_FRAME_FONT_INFLATION_FLOW_ROOT,
@@ -195,8 +195,8 @@ nsFontInflationData::UpdateWidth(const nsHTMLReflowState &aReflowState)
              "null-ness should match; NearestCommonAncestorFirstInFlow"
              " will crash when passed null");
 
-  // Particularly when we're computing for the root BFC, the width of
-  // nca might differ significantly for the width of bfc.
+  // Particularly when we're computing for the root BFC, the inline-size of
+  // nca might differ significantly for the inline-size of bfc.
   nsIFrame *nca = NearestCommonAncestorFirstInFlow(firstInflatableDescendant,
                                                    lastInflatableDescendant,
                                                    bfc);
@@ -204,13 +204,13 @@ nsFontInflationData::UpdateWidth(const nsHTMLReflowState &aReflowState)
     nca = nca->GetParent()->FirstInFlow();
   }
 
-  nscoord newNCAWidth = ComputeDescendantWidth(aReflowState, nca);
+  nscoord newNCAISize = ComputeDescendantISize(aReflowState, nca);
 
   // See comment above "font.size.inflation.lineThreshold" in
   // modules/libpref/src/init/all.js .
   nsIPresShell* presShell = bfc->PresContext()->PresShell();
   uint32_t lineThreshold = presShell->FontSizeInflationLineThreshold();
-  nscoord newTextThreshold = (newNCAWidth * lineThreshold) / 100;
+  nscoord newTextThreshold = (newNCAISize * lineThreshold) / 100;
 
   if (mTextThreshold <= mTextAmount && mTextAmount < newTextThreshold) {
     // Because we truncate our scan when we hit sufficient text, we now
@@ -218,7 +218,7 @@ nsFontInflationData::UpdateWidth(const nsHTMLReflowState &aReflowState)
     mTextDirty = true;
   }
 
-  mNCAWidth = newNCAWidth;
+  mNCAISize = newNCAISize;
   mTextThreshold = newTextThreshold;
   mInflationEnabled = mTextAmount >= mTextThreshold;
 }

layout/generic/nsFontInflationData.h

@@ -21,7 +21,7 @@ public:
   // Returns whether the effective width changed (which requires the
   // caller to mark its descendants dirty
   static bool
-    UpdateFontInflationDataWidthFor(const nsHTMLReflowState& aReflowState);
+    UpdateFontInflationDataISizeFor(const nsHTMLReflowState& aReflowState);
 
   static void MarkFontInflationDataTextDirty(nsIFrame *aFrame);
 
@@ -32,8 +32,8 @@ public:
     return mInflationEnabled;
   }
 
-  nscoord EffectiveWidth() const {
-    return mNCAWidth;
+  nscoord EffectiveISize() const {
+    return mNCAISize;
   }
 
 private:
@@ -43,7 +43,7 @@ private:
   nsFontInflationData(const nsFontInflationData&) = delete;
   void operator=(const nsFontInflationData&) = delete;
 
-  void UpdateWidth(const nsHTMLReflowState &aReflowState);
+  void UpdateISize(const nsHTMLReflowState &aReflowState);
   enum SearchDirection { eFromStart, eFromEnd };
   static nsIFrame* FindEdgeInflatableFrameIn(nsIFrame *aFrame,
                                              SearchDirection aDirection);
@@ -52,7 +52,7 @@ private:
   void ScanText();
   // Scan text in the subtree rooted at aFrame.  Increment mTextAmount
   // by multiplying the number of characters found by the font size
-  // (yielding the width that would be occupied by the characters if
+  // (yielding the inline-size that would be occupied by the characters if
   // they were all em squares).  But stop scanning if mTextAmount
   // crosses mTextThreshold.
   void ScanTextIn(nsIFrame *aFrame);
@@ -66,7 +66,7 @@ private:
   }
 
   nsIFrame *mBFCFrame;
-  nscoord mNCAWidth;
+  nscoord mNCAISize;
   nscoord mTextAmount, mTextThreshold;
   bool mInflationEnabled; // for this BFC
   bool mTextDirty;

layout/generic/nsFrameStateBits.h

@@ -187,10 +187,10 @@ FRAME_STATE_BIT(Generic, 37, NS_FRAME_HAS_ABSPOS_CHILDREN)
 // A display item for this frame has been painted as part of a PaintedLayer.
 FRAME_STATE_BIT(Generic, 38, NS_FRAME_PAINTED_THEBES)
 
-// Frame is or is a descendant of something with a fixed height, unless that
-// ancestor is a body or html element, and has no closer ancestor that is
+// Frame is or is a descendant of something with a fixed block-size, unless
+// that ancestor is a body or html element, and has no closer ancestor that is
 // overflow:auto or overflow:scroll.
-FRAME_STATE_BIT(Generic, 39, NS_FRAME_IN_CONSTRAINED_HEIGHT)
+FRAME_STATE_BIT(Generic, 39, NS_FRAME_IN_CONSTRAINED_BSIZE)
 
 // This is only set during painting
 FRAME_STATE_BIT(Generic, 40, NS_FRAME_FORCE_DISPLAY_LIST_DESCEND_INTO)

layout/generic/nsHTMLReflowState.cpp

@@ -379,52 +379,62 @@ nsHTMLReflowState::Init(nsPresContext* aPresContext,
 
   nsIFrame *parent = frame->GetParent();
   if (parent &&
-      (parent->GetStateBits() & NS_FRAME_IN_CONSTRAINED_HEIGHT) &&
+      (parent->GetStateBits() & NS_FRAME_IN_CONSTRAINED_BSIZE) &&
       !(parent->GetType() == nsGkAtoms::scrollFrame &&
         parent->StyleDisplay()->mOverflowY != NS_STYLE_OVERFLOW_HIDDEN)) {
-    frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
+    frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
   } else if (type == nsGkAtoms::svgForeignObjectFrame) {
-    // An SVG foreignObject frame is inherently constrained height.
-    frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
-  } else if ((mStylePosition->mHeight.GetUnit() != eStyleUnit_Auto ||
-              mStylePosition->mMaxHeight.GetUnit() != eStyleUnit_None) &&
-              // Don't set NS_FRAME_IN_CONSTRAINED_HEIGHT on body or html
-              // elements.
-             (frame->GetContent() &&
-            !(frame->GetContent()->IsAnyOfHTMLElements(nsGkAtoms::body,
-                                                       nsGkAtoms::html)))) {
+    // An SVG foreignObject frame is inherently constrained block-size.
+    frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
+  } else {
+    const bool vertical = mWritingMode.IsVertical();
+    const nsStyleCoord& bSizeCoord =
+      vertical ? mStylePosition->mWidth : mStylePosition->mHeight;
+    const nsStyleCoord& maxBSizeCoord =
+      vertical ? mStylePosition->mMaxWidth : mStylePosition->mMaxHeight;
+    if ((bSizeCoord.GetUnit() != eStyleUnit_Auto ||
+         maxBSizeCoord.GetUnit() != eStyleUnit_None) &&
+         // Don't set NS_FRAME_IN_CONSTRAINED_BSIZE on body or html elements.
+         (frame->GetContent() &&
+        !(frame->GetContent()->IsAnyOfHTMLElements(nsGkAtoms::body,
+                                                   nsGkAtoms::html)))) {
 
-    // If our height was specified as a percentage, then this could
-    // actually resolve to 'auto', based on:
-    // http://www.w3.org/TR/CSS21/visudet.html#the-height-property
-    nsIFrame* containingBlk = frame;
-    while (containingBlk) {
-      const nsStylePosition* stylePos = containingBlk->StylePosition();
-      if ((stylePos->mHeight.IsCoordPercentCalcUnit() &&
-           !stylePos->mHeight.HasPercent()) ||
-          (stylePos->mMaxHeight.IsCoordPercentCalcUnit() &&
-           !stylePos->mMaxHeight.HasPercent())) {
-        frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
-        break;
-      } else if ((stylePos->mHeight.IsCoordPercentCalcUnit() &&
-                  stylePos->mHeight.HasPercent()) ||
-                 (stylePos->mMaxHeight.IsCoordPercentCalcUnit() &&
-                  stylePos->mMaxHeight.HasPercent())) {
-        if (!(containingBlk = containingBlk->GetContainingBlock())) {
-          // If we've reached the top of the tree, then we don't have
-          // a constrained height.
-          frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
+      // If our block-size was specified as a percentage, then this could
+      // actually resolve to 'auto', based on:
+      // http://www.w3.org/TR/CSS21/visudet.html#the-height-property
+      nsIFrame* containingBlk = frame;
+      while (containingBlk) {
+        const nsStylePosition* stylePos = containingBlk->StylePosition();
+        const nsStyleCoord& bSizeCoord =
+          vertical ? stylePos->mWidth : stylePos->mHeight;
+        const nsStyleCoord& maxBSizeCoord =
+          vertical ? stylePos->mMaxWidth : stylePos->mMaxHeight;
+        if ((bSizeCoord.IsCoordPercentCalcUnit() &&
+             !bSizeCoord.HasPercent()) ||
+            (maxBSizeCoord.IsCoordPercentCalcUnit() &&
+             !maxBSizeCoord.HasPercent())) {
+          frame->AddStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
+          break;
+        } else if ((bSizeCoord.IsCoordPercentCalcUnit() &&
+                    bSizeCoord.HasPercent()) ||
+                   (maxBSizeCoord.IsCoordPercentCalcUnit() &&
+                    maxBSizeCoord.HasPercent())) {
+          if (!(containingBlk = containingBlk->GetContainingBlock())) {
+            // If we've reached the top of the tree, then we don't have
+            // a constrained block-size.
+            frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
+            break;
+          }
+
+          continue;
+        } else {
+          frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
           break;
         }
-
-        continue;
-      } else {
-        frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
-        break;
       }
+    } else {
+      frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_BSIZE);
     }
-  } else {
-    frame->RemoveStateBits(NS_FRAME_IN_CONSTRAINED_HEIGHT);
   }
 
   NS_WARN_IF_FALSE((mFrameType == NS_CSS_FRAME_TYPE_INLINE &&
@@ -495,7 +505,7 @@ nsHTMLReflowState::InitResizeFlags(nsPresContext* aPresContext, nsIAtom* aFrameT
       nsLayoutUtils::FontSizeInflationEnabled(aPresContext)) {
     // Create our font inflation data if we don't have it already, and
     // give it our current width information.
-    bool dirty = nsFontInflationData::UpdateFontInflationDataWidthFor(*this) &&
+    bool dirty = nsFontInflationData::UpdateFontInflationDataISizeFor(*this) &&
                  // Avoid running this at the box-to-block interface
                  // (where we shouldn't be inflating anyway, and where
                  // reflow state construction is probably to construct a

layout/generic/nsLineLayout.cpp

@@ -207,10 +207,10 @@ nsLineLayout::BeginLineReflow(nscoord aICoord, nscoord aBCoord,
   psd->mIEnd = aICoord + aISize;
   mContainerSize = aContainerSize;
 
-  // If we're in a constrained height frame, then we don't allow a
+  // If we're in a constrained block-size frame, then we don't allow a
   // max line box width to take effect.
   if (!(LineContainerFrame()->GetStateBits() &
-        NS_FRAME_IN_CONSTRAINED_HEIGHT)) {
+        NS_FRAME_IN_CONSTRAINED_BSIZE)) {
 
     // If the available size is greater than the maximum line box width (if
     // specified), then we need to adjust the line box width to be at the max

layout/reftests/writing-mode/font-inflation-1-ref.html

@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { width: 0; height: 0; }
+#inner { font-size: 12px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1a.html

@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { width: 450px; }
+#inner { font-size: 12px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1b.html

@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { width: 600px; }
+#inner { font-size: 12px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1c-ref.html

@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { width: 0; height: 0; }
+/*
+In a 450px container, the minimum font size at 15em per line is 30px.
+This means we map 0px-45px into 30px-45px, so 12px gets mapped to 34px.
+*/
+#inner { font-size: 34px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1c.html

@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { height: 450px; }
+#inner { font-size: 12px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1d-ref.html

@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { width: 0; height: 0; }
+/*
+In a 600px container, the minimum font size at 15em per line is 40px.
+This means we map 0px-60px into 40px-60px, so 12px gets mapped to 44px.
+*/
+#inner { font-size: 44px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/font-inflation-1d.html

@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<style>
+body { writing-mode: vertical-lr; text-orientation: sideways-right; }
+#outer { height: 600px; }
+#inner { font-size: 12px; width: 100%; height: 100%; }
+</style>
+<div id="outer">
+<div id="inner">Inflated?

layout/reftests/writing-mode/reftest.list

@@ -105,3 +105,12 @@ HTTP(..) == 1127488-align-right-vertical-lr-ltr.html 1127488-align-bottom-left-r
 == 1131013-vertical-bidi.html 1131013-vertical-bidi-ref.html
 == 1134744-radio-checkbox-baseline-1.html 1134744-radio-checkbox-baseline-1-ref.html
 fails-if(B2G) == 1135361-ruby-justify-1.html 1135361-ruby-justify-1-ref.html # bug 1136067
+
+# Font inflation behaves wrong in vertical writing mode: bug 1138495
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) == font-inflation-1a.html font-inflation-1-ref.html
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) == font-inflation-1b.html font-inflation-1-ref.html
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) != font-inflation-1c.html font-inflation-1-ref.html
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) != font-inflation-1d.html font-inflation-1-ref.html
+pref(dom.meta-viewport.enabled,true) pref(font.size.inflation.emPerLine,15) pref(font.size.inflation.forceEnabled,true) pref(font.size.inflation.lineThreshold,0) != font-inflation-1c.html font-inflation-1d.html
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) == font-inflation-1c.html font-inflation-1c-ref.html
+test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.forceEnabled,true) test-pref(font.size.inflation.lineThreshold,0) == font-inflation-1d.html font-inflation-1d-ref.html

media/libstagefright/binding/H264.cpp

@@ -9,6 +9,7 @@
 #include "mp4_demuxer/ByteWriter.h"
 #include "mp4_demuxer/H264.h"
 #include <media/stagefright/foundation/ABitReader.h>
+#include <cmath>
 
 using namespace mozilla;
 
@@ -73,7 +74,11 @@ private:
 SPSData::SPSData()
 {
   PodZero(this);
-  chroma_format_idc = 1;
+  // Default values when they aren't defined as per ITU-T H.264 (2014/02).
+  video_format = 5;
+  colour_primaries = 2;
+  transfer_characteristics = 2;
+  sample_ratio = 1.0;
 }
 
 /* static */ already_AddRefed<ByteBuffer>
@@ -123,6 +128,15 @@ H264::DecodeNALUnit(const ByteBuffer* aNAL)
   return rbsp.forget();
 }
 
+static int32_t
+ConditionDimension(float aValue)
+{
+  // This will exclude NaNs and too-big values.
+  if (aValue > 1.0 && aValue <= INT32_MAX)
+    return int32_t(round(aValue));
+  return 0;
+}
+
 /* static */ bool
 H264::DecodeSPS(const ByteBuffer* aSPS, SPSData& aDest)
 {
@@ -202,6 +216,12 @@ H264::DecodeSPS(const ByteBuffer* aSPS, SPSData& aDest)
     aDest.frame_crop_bottom_offset = br.ReadUE();
   }
 
+  aDest.sample_ratio = 1.0f;
+  aDest.vui_parameters_present_flag = br.ReadBit();
+  if (aDest.vui_parameters_present_flag) {
+    vui_parameters(br, aDest);
+  }
+
   // Calculate common values.
 
   // FFmpeg and VLC ignore the left and top cropping. Do the same here.
@@ -226,6 +246,20 @@ H264::DecodeSPS(const ByteBuffer* aSPS, SPSData& aDest)
   aDest.pic_height = aDest.pic_height_in_map_units * 16 - cropY;
 
   aDest.interlaced = !aDest.frame_mbs_only_flag;
+
+  // Determine display size.
+  if (aDest.sample_ratio > 1.0) {
+    // Increase the intrinsic width
+    aDest.display_width =
+      ConditionDimension(aDest.pic_width * aDest.sample_ratio);
+    aDest.display_height = aDest.pic_height;
+  } else {
+    // Increase the intrinsic height
+    aDest.display_width = aDest.pic_width;
+    aDest.display_height =
+      ConditionDimension(aDest.pic_height / aDest.sample_ratio);
+  }
+
   return true;
 }
 
@@ -233,23 +267,155 @@ H264::DecodeSPS(const ByteBuffer* aSPS, SPSData& aDest)
 H264::vui_parameters(BitReader& aBr, SPSData& aDest)
 {
   aDest.aspect_ratio_info_present_flag = aBr.ReadBit();
-  if (aDest.aspect_ratio_info_present_flag)
-  {
+  if (aDest.aspect_ratio_info_present_flag) {
     aDest.aspect_ratio_idc = aBr.ReadBits(8);
-
-    if (aDest.aspect_ratio_idc == 255 /* EXTENDED_SAR */) {
-      aDest.sar_width  = aBr.ReadBits(16);
-      aDest.sar_height = aBr.ReadBits(16);
-    }
-  }
-  else {
     aDest.sar_width = aDest.sar_height = 0;
+
+    // From E.2.1 VUI parameters semantics (ITU-T H.264 02/2014)
+    switch (aDest.aspect_ratio_idc)  {
+      case 0:
+        // Unspecified
+        break;
+      case 1:
+        /*
+          1:1
+         7680x4320 16:9 frame without horizontal overscan
+         3840x2160 16:9 frame without horizontal overscan
+         1280x720 16:9 frame without horizontal overscan
+         1920x1080 16:9 frame without horizontal overscan (cropped from 1920x1088)
+         640x480 4:3 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 1.0f;
+        break;
+      case 2:
+        /*
+          12:11
+         720x576 4:3 frame with horizontal overscan
+         352x288 4:3 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 12.0 / 11.0;
+        break;
+      case 3:
+        /*
+          10:11
+         720x480 4:3 frame with horizontal overscan
+         352x240 4:3 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 10.0 / 11.0;
+        break;
+      case 4:
+        /*
+          16:11
+         720x576 16:9 frame with horizontal overscan
+         528x576 4:3 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 16.0 / 11.0;
+        break;
+      case 5:
+        /*
+          40:33
+         720x480 16:9 frame with horizontal overscan
+         528x480 4:3 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 40.0 / 33.0;
+        break;
+      case 6:
+        /*
+          24:11
+         352x576 4:3 frame without horizontal overscan
+         480x576 16:9 frame with horizontal overscan
+         */
+        aDest.sample_ratio = 24.0 / 11.0;
+        break;
+      case 7:
+        /*
+          20:11
+         352x480 4:3 frame without horizontal overscan
+         480x480 16:9 frame with horizontal overscan
+         */
+        aDest.sample_ratio = 20.0 / 11.0;
+        break;
+      case 8:
+        /*
+          32:11
+         352x576 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 32.0 / 11.0;
+        break;
+      case 9:
+        /*
+          80:33
+         352x480 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 80.0 / 33.0;
+        break;
+      case 10:
+        /*
+          18:11
+         480x576 4:3 frame with horizontal overscan
+         */
+        aDest.sample_ratio = 18.0 / 11.0;
+        break;
+      case 11:
+        /*
+          15:11
+         480x480 4:3 frame with horizontal overscan
+         */
+        aDest.sample_ratio = 15.0 / 11.0;
+        break;
+      case 12:
+        /*
+          64:33
+         528x576 16:9 frame with horizontal overscan
+         */
+        aDest.sample_ratio = 64.0 / 33.0;
+        break;
+      case 13:
+        /*
+          160:99
+         528x480 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 160.0 / 99.0;
+        break;
+      case 14:
+        /*
+          4:3
+         1440x1080 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 4.0 / 3.0;
+        break;
+      case 15:
+        /*
+          3:2
+         1280x1080 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 3.2 / 2.0;
+        break;
+      case 16:
+        /*
+          2:1
+         960x1080 16:9 frame without horizontal overscan
+         */
+        aDest.sample_ratio = 2.0 / 1.0;
+        break;
+      case 255:
+        /* Extended_SAR */
+        aDest.sar_width  = aBr.ReadBits(16);
+        aDest.sar_height = aBr.ReadBits(16);
+        if (aDest.sar_width && aDest.sar_height) {
+          aDest.sample_ratio = float(aDest.sar_width) / float(aDest.sar_height);
+        }
+        break;
+      default:
+        break;
+    }
   }
 
   if (aBr.ReadBit()) { //overscan_info_present_flag
     aDest.overscan_appropriate_flag = aBr.ReadBit();
   }
-  if (aBr.ReadBit()) { //video_signal_type_present_flag
+
+  if (aBr.ReadBit()) { // video_signal_type_present_flag
     aDest.video_format = aBr.ReadBits(3);
     aDest.video_full_range_flag = aBr.ReadBit();
     aDest.colour_description_present_flag = aBr.ReadBit();
@@ -259,59 +425,19 @@ H264::vui_parameters(BitReader& aBr, SPSData& aDest)
       aDest.matrix_coefficients = aBr.ReadBits(8);
     }
   }
-  aDest.chroma_loc_info_present_flag = aBr.ReadBit();
 
+  aDest.chroma_loc_info_present_flag = aBr.ReadBit();
   if (aDest.chroma_loc_info_present_flag) {
     aDest.chroma_sample_loc_type_top_field = aBr.ReadUE();
     aDest.chroma_sample_loc_type_bottom_field = aBr.ReadUE();
   }
 
-  if (aBr.ReadBit()) { //timing_info_present_flag
+  aDest.timing_info_present_flag = aBr.ReadBit();
+  if (aDest.timing_info_present_flag ) {
     aDest.num_units_in_tick = aBr.ReadBits(32);
     aDest.time_scale = aBr.ReadBits(32);
     aDest.fixed_frame_rate_flag = aBr.ReadBit();
   }
-
-  bool hrd_present = false;
-  if (aBr.ReadBit()) { // nal_hrd_parameters_present_flag
-    hrd_parameters(aBr);
-    hrd_present = true;
-  }
-  if (aBr.ReadBit()) { // vcl_hrd_parameters_present_flag
-    hrd_parameters(aBr);
-    hrd_present = true;
-  }
-  if (hrd_present) {
-    aBr.ReadBit(); // low_delay_hrd_flag
-  }
-  aDest.pic_struct_present_flag = aBr.ReadBit();
-  aDest.bitstream_restriction_flag = aBr.ReadBit();
-  if (aDest.bitstream_restriction_flag) {
-    aDest.motion_vectors_over_pic_boundaries_flag = aBr.ReadBit();
-    aDest.max_bytes_per_pic_denom = aBr.ReadUE();
-    aDest.max_bits_per_mb_denom = aBr.ReadUE();
-    aDest.log2_max_mv_length_horizontal = aBr.ReadUE();
-    aDest.log2_max_mv_length_vertical = aBr.ReadUE();
-    aDest.max_num_reorder_frames = aBr.ReadUE();
-    aDest.max_dec_frame_buffering = aBr.ReadUE();
-  }
-}
-
-/* static */ void
-H264::hrd_parameters(BitReader& aBr)
-{
-  uint32_t cpb_cnt_minus1 = aBr.ReadUE();
-  aBr.ReadBits(4); // bit_rate_scale
-  aBr.ReadBits(4); // cpb_size_scale
-  for (uint32_t SchedSelIdx = 0; SchedSelIdx <= cpb_cnt_minus1; SchedSelIdx++) {
-    aBr.ReadUE(); // bit_rate_value_minus1[ SchedSelIdx ]
-    aBr.ReadUE(); // cpb_size_value_minus1[ SchedSelIdx ]
-    aBr.ReadBit(); // cbr_flag[ SchedSelIdx ]
-  }
-  aBr.ReadBits(5); // initial_cpb_removal_delay_length_minus1
-  aBr.ReadBits(5); // cpb_removal_delay_length_minus1
-  aBr.ReadBits(5); // dpb_output_delay_length_minus1
-  aBr.ReadBits(5); // time_offset_length
 }
 
 /* static */ bool

media/libstagefright/binding/include/mp4_demuxer/H264.h

@@ -30,6 +30,16 @@ struct SPSData
 
   bool interlaced;
 
+  /*
+   Displayed size.
+   display_width and display_height are adjusted according to the display
+   sample aspect ratio.
+   */
+  uint32_t display_width;
+  uint32_t display_height;
+
+  float sample_ratio;
+
   /*
     H264 decoding parameters according to ITU-T H.264 (T-REC-H.264-201402-I/en)
    http://www.itu.int/rec/T-REC-H.264-201402-I/en
@@ -222,121 +232,87 @@ struct SPSData
   uint32_t sar_width;
   uint32_t sar_height;
 
+  /*
+    video_signal_type_present_flag equal to 1 specifies that video_format,
+    video_full_range_flag and colour_description_present_flag are present.
+    video_signal_type_present_flag equal to 0, specify that video_format,
+    video_full_range_flag and colour_description_present_flag are not present.
+   */
+  bool video_signal_type_present_flag;
+
+  /*
+    overscan_info_present_flag equal to1 specifies that the
+    overscan_appropriate_flag is present. When overscan_info_present_flag is
+    equal to 0 or is not present, the preferred display method for the video
+    signal is unspecified (Unspecified).
+   */
   bool overscan_info_present_flag;
+  /*
+    overscan_appropriate_flag equal to 1 indicates that the cropped decoded
+    pictures output are suitable for display using overscan.
+    overscan_appropriate_flag equal to 0 indicates that the cropped decoded
+    pictures output contain visually important information in the entire region
+    out to the edges of the cropping rectangle of the picture
+   */
   bool overscan_appropriate_flag;
 
+  /*
+    video_format indicates the representation of the pictures as specified in
+    Table E-2, before being coded in accordance with this
+    Recommendation | International Standard. When the video_format syntax element
+    is not present, video_format value shall be inferred to be equal to 5.
+    (Unspecified video format)
+   */
   uint8_t video_format;
+
+  /*
+    video_full_range_flag indicates the black level and range of the luma and
+    chroma signals as derived from E′Y, E′PB, and E′PR or E′R, E′G, and E′B
+    real-valued component signals.
+    When the video_full_range_flag syntax element is not present, the value of
+    video_full_range_flag shall be inferred to be equal to 0.
+   */
   bool video_full_range_flag;
+
+  /*
+    colour_description_present_flag equal to1 specifies that colour_primaries,
+    transfer_characteristics and matrix_coefficients are present.
+    colour_description_present_flag equal to 0 specifies that colour_primaries,
+    transfer_characteristics and matrix_coefficients are not present.
+   */
   bool colour_description_present_flag;
+
+  /*
+    colour_primaries indicates the chromaticity coordinates of the source
+    primaries as specified in Table E-3 in terms of the CIE 1931 definition of
+    x and y as specified by ISO 11664-1.
+    When the colour_primaries syntax element is not present, the value of
+    colour_primaries shall be inferred to be equal to 2 (the chromaticity is
+    unspecified or is determined by the application).
+   */
   uint8_t colour_primaries;
+
+  /*
+    transfer_characteristics indicates the opto-electronic transfer
+    characteristic of the source picture as specified in Table E-4 as a function
+    of a linear optical intensity input Lc with a nominal real-valued range of 0
+    to 1.
+    When the transfer_characteristics syntax element is not present, the value
+    of transfer_characteristics shall be inferred to be equal to 2
+    (the transfer characteristics are unspecified or are determined by the
+    application).
+   */
   uint8_t transfer_characteristics;
+
   uint8_t matrix_coefficients;
   bool chroma_loc_info_present_flag;
   uint32_t chroma_sample_loc_type_top_field;
   uint32_t chroma_sample_loc_type_bottom_field;
+  bool timing_info_present_flag;
   uint32_t num_units_in_tick;
   uint32_t time_scale;
   bool fixed_frame_rate_flag;
 
-  // Bitstream restriction parameters
-
-  /*
-    pic_struct_present_flag equal to 1 specifies that picture timing SEI
-    messages (clause D.2.2) are present that include the pic_struct syntax
-    element. pic_struct_present_flag equal to 0 specifies that the pic_struct
-    syntax element is not present in picture timing SEI messages.
-    When pic_struct_present_flag is not present, its value shall be inferred to
-    be equal to 0.
-   */
-  bool pic_struct_present_flag;
-
-  /*
-    bitstream_restriction_flag equal to 1, specifies that the following coded
-    video sequence bitstream restriction parameters are present.
-    bitstream_restriction_flag equal to 0, specifies that the following coded
-    video sequence bitstream restriction parameters are not present.
-   */
-  bool bitstream_restriction_flag;
-
-  /*
-    motion_vectors_over_pic_boundaries_flag equal to 0 indicates that no
-    sample outside the picture boundaries and no sample at a fractional
-    sample position for which the sample value is derived using one or more
-    samples outside the picture boundaries is used for inter prediction of any
-    sample. motion_vectors_over_pic_boundaries_flag equal to 1 indicates that
-    one or more samples outside picture boundaries may be used in inter
-    prediction. When the motion_vectors_over_pic_boundaries_flag syntax element
-    is not present, motion_vectors_over_pic_boundaries_flag value shall be
-    inferred to be equal to 1.
-   */
-  bool motion_vectors_over_pic_boundaries_flag;
-
-  /*
-    max_bytes_per_pic_denom indicates a number of bytes not exceeded by the
-    sum of the sizes of the VCL NAL units associated with any coded picture in
-    the coded video sequence.
-   */
-  uint32_t max_bytes_per_pic_denom;
-
-  /*
-    max_bits_per_mb_denom indicates an upper bound for the number of coded bits
-    of macroblock_layer( ) data for any macroblock in any picture of the coded
-    video sequence. The value of max_bits_per_mb_denom shall be in the range
-    of 0 to 16, inclusive.
-   */
-  uint32_t max_bits_per_mb_denom;
-
-  /*
-    log2_max_mv_length_horizontal and log2_max_mv_length_vertical indicate the
-    maximum absolute value of a decoded horizontal and vertical motion vector
-    component, respectively, in 1⁄4 luma sample units, for all pictures in the
-    coded video sequence. A value of n asserts that no value of a motion vector
-    component shall exceed the range from −2n to 2n − 1, inclusive, in units
-    of 1⁄4 luma sample displacement. The value of log2_max_mv_length_horizontal
-    shall be in the range of 0 to 16, inclusive. The value of
-    log2_max_mv_length_vertical shall be in the range of 0 to 16, inclusive.
-    When log2_max_mv_length_horizontal is not present, the values of
-    log2_max_mv_length_horizontal and log2_max_mv_length_vertical shall be
-    inferred to be equal to 16.
-   */
-   uint32_t log2_max_mv_length_horizontal;
-   uint32_t log2_max_mv_length_vertical;
-
-  /*
-    max_num_reorder_frames indicates an upper bound for the number of frames
-    buffers, in the decoded picture buffer (DPB), that are required for storing
-    frames, complementary field pairs, and non-paired fields before output.
-    It is a requirement of bitstream conformance that the maximum number of
-    frames, complementary field pairs, or non-paired fields that precede any
-    frame, complementary field pair, or non-paired field in the coded video
-    sequence in decoding order and follow it in output order shall be less than
-    or equal to max_num_reorder_frames. The value of max_num_reorder_frames
-    shall be in the range of 0 to max_dec_frame_buffering, inclusive.
-    When the max_num_reorder_frames syntax element is not present, the value
-    of max_num_reorder_frames value shall be inferred as follows:
-     – If profile_idc is equal to 44, 86, 100, 110, 122, or 244 and
-       constraint_set3_flag is equal to 1, the value of max_num_reorder_frames
-       shall be inferred to be equal to 0.
-     – Otherwise (profile_idc is not equal to 44, 86, 100, 110, 122, or 244 or
-       constraint_set3_flag is equal to 0), the value of max_num_reorder_frames
-       shall be inferred to be equal to MaxDpbFrames.
-   */
-   uint32_t max_num_reorder_frames;
-
-  /*
-    max_dec_frame_buffering specifies the required size of the HRD decoded
-    picture buffer (DPB) in units of frame buffers. It is a requirement of
-    bitstream conformance that the coded video sequence shall not require a
-    decoded picture buffer with size of more than
-    Max( 1, max_dec_frame_buffering ) frame buffers to enable the output of
-    decoded pictures at the output times specified by dpb_output_delay of the
-    picture timing SEI messages. The value of max_dec_frame_buffering shall be
-    greater than or equal to max_num_ref_frames. An upper bound for the value
-    of max_dec_frame_buffering is specified by the level limits in
-    clauses A.3.1, A.3.2, G.10.2.1, and H.10.2.
-   */
-   uint32_t max_dec_frame_buffering;
-
   SPSData();
 };