From a050ce3db572776db93174bee15d18aefefcf736 Mon Sep 17 00:00:00 2001
From: Blake Kaplan <mrbkap@gmail.com>
Date: Tue, 18 Nov 2014 13:38:39 -0800
Subject: [PATCH 01/84] Bug 1093607 - Enable this test. r=mmc/sworkman

---
 browser/base/content/test/general/browser.ini | 1 -
 1 file changed, 1 deletion(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index d16d43838a60..08760a045a0e 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -442,7 +442,6 @@ skip-if = e10s # Bug ?????? - test needs to be updated for e10s (captures a stac
 skip-if = e10s # Bug 1100664 - test relies on linkedBrowser.docShell
 [browser_tabs_owner.js]
 [browser_trackingUI.js]
-skip-if = e10s # Bug 1093155 - tries to use context menu from browser-chrome and gets in a mess when in e10s mode
 support-files =
   trackingPage.html
   benignPage.html

From bf9df9f607bb5132fc9fc2394154caa98dbe797f Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Tue, 18 Nov 2014 22:13:02 +1300
Subject: [PATCH 02/84] Bug 1095257 - Implement
 Navigator.requestMediaKeySystemAccess(). r=edwin r=bz r=peterv

---
 dom/base/Navigator.cpp                        |  38 +++
 dom/base/Navigator.h                          |  10 +
 dom/media/DecoderTraits.cpp                   |   3 +-
 dom/media/eme/MediaKeySystemAccess.cpp        | 212 +++++++++++++
 dom/media/eme/MediaKeySystemAccess.h          |  58 ++++
 dom/media/eme/MediaKeys.cpp                   | 128 --------
 dom/media/eme/MediaKeys.h                     |  20 +-
 dom/media/eme/moz.build                       |   2 +
 dom/media/fmp4/MP4Decoder.cpp                 |  41 ++-
 dom/media/fmp4/MP4Decoder.h                   |   8 +-
 dom/media/test/eme.js                         |  44 ++-
 dom/media/test/mochitest.ini                  |   2 +
 dom/media/test/test_eme_playback.html         |  18 --
 .../test/test_eme_requestKeySystemAccess.html | 293 ++++++++++++++++++
 .../mochitest/general/test_interfaces.html    |   2 +
 dom/webidl/MediaKeySystemAccess.webidl        |  34 ++
 dom/webidl/MediaKeys.webidl                   |   5 -
 dom/webidl/Navigator.webidl                   |   9 +
 dom/webidl/moz.build                          |   1 +
 19 files changed, 732 insertions(+), 196 deletions(-)
 create mode 100644 dom/media/eme/MediaKeySystemAccess.cpp
 create mode 100644 dom/media/eme/MediaKeySystemAccess.h
 create mode 100644 dom/media/test/test_eme_requestKeySystemAccess.html
 create mode 100644 dom/webidl/MediaKeySystemAccess.webidl

diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 1ea41fb2179b..053c4190c67f 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -2533,5 +2533,43 @@ Navigator::GetUserAgent(nsPIDOMWindow* aWindow, nsIURI* aURI,
   return siteSpecificUA->GetUserAgentForURIAndWindow(aURI, aWindow, aUserAgent);
 }
 
+#ifdef MOZ_EME
+already_AddRefed<Promise>
+Navigator::RequestMediaKeySystemAccess(const nsAString& aKeySystem,
+                                       const Optional<Sequence<MediaKeySystemOptions>>& aOptions,
+                                       ErrorResult& aRv)
+{
+  nsCOMPtr<nsIGlobalObject> go = do_QueryInterface(mWindow);
+  nsRefPtr<Promise> p = Promise::Create(go, aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  if (aKeySystem.IsEmpty() ||
+      (aOptions.WasPassed() && aOptions.Value().IsEmpty())) {
+    p->MaybeReject(NS_ERROR_DOM_INVALID_ACCESS_ERR);
+    return p.forget();
+  }
+
+  if (!MediaKeySystemAccess::IsKeySystemSupported(aKeySystem)) {
+    p->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+    return p.forget();
+  }
+
+  // TODO: Wait (async) until the CDM is downloaded, if it's not already.
+
+  if (!aOptions.WasPassed() ||
+      MediaKeySystemAccess::IsSupported(aKeySystem, aOptions.Value())) {
+    nsRefPtr<MediaKeySystemAccess> access(new MediaKeySystemAccess(mWindow, aKeySystem));
+    p->MaybeResolve(access);
+    return p.forget();
+  }
+
+  p->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+
+  return p.forget();
+}
+#endif
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index 900a65796039..180cbc71aa6b 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -18,6 +18,9 @@
 #include "nsInterfaceHashtable.h"
 #include "nsString.h"
 #include "nsTArray.h"
+#ifdef MOZ_EME
+#include "mozilla/dom/MediaKeySystemAccess.h"
+#endif
 
 class nsPluginArray;
 class nsMimeTypeArray;
@@ -316,6 +319,13 @@ public:
 
   virtual JSObject* WrapObject(JSContext* cx) MOZ_OVERRIDE;
 
+#ifdef MOZ_EME
+  already_AddRefed<Promise>
+  RequestMediaKeySystemAccess(const nsAString& aKeySystem,
+                              const Optional<Sequence<MediaKeySystemOptions>>& aOptions,
+                              ErrorResult& aRv);
+#endif
+
 private:
   virtual ~Navigator();
 
diff --git a/dom/media/DecoderTraits.cpp b/dom/media/DecoderTraits.cpp
index 68efb4599bce..0c49c8b0abe9 100644
--- a/dom/media/DecoderTraits.cpp
+++ b/dom/media/DecoderTraits.cpp
@@ -335,8 +335,9 @@ IsMP4SupportedType(const nsACString& aType,
 #ifdef MOZ_OMX_DECODER
   return false;
 #else
+  bool haveAAC, haveMP3, haveH264;
   return Preferences::GetBool("media.fragmented-mp4.exposed", false) &&
-         MP4Decoder::CanHandleMediaType(aType, aCodecs);
+         MP4Decoder::CanHandleMediaType(aType, aCodecs, haveAAC, haveH264, haveMP3);
 #endif
 }
 #endif
diff --git a/dom/media/eme/MediaKeySystemAccess.cpp b/dom/media/eme/MediaKeySystemAccess.cpp
new file mode 100644
index 000000000000..6d596cfb6941
--- /dev/null
+++ b/dom/media/eme/MediaKeySystemAccess.cpp
@@ -0,0 +1,212 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/MediaKeySystemAccess.h"
+#include "mozilla/dom/MediaKeySystemAccessBinding.h"
+#include "mozilla/Preferences.h"
+#include "nsContentTypeParser.h"
+#ifdef MOZ_FMP4
+#include "MP4Decoder.h"
+#endif
+#ifdef XP_WIN
+#include "mozilla/WindowsVersion.h"
+#endif
+#include "nsContentCID.h"
+#include "nsServiceManagerUtils.h"
+#include "mozIGeckoMediaPluginService.h"
+#include "VideoUtils.h"
+
+namespace mozilla {
+namespace dom {
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(MediaKeySystemAccess,
+                                      mParent)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(MediaKeySystemAccess)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(MediaKeySystemAccess)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(MediaKeySystemAccess)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+MediaKeySystemAccess::MediaKeySystemAccess(nsPIDOMWindow* aParent,
+                                           const nsAString& aKeySystem)
+  : mParent(aParent)
+  , mKeySystem(aKeySystem)
+{
+}
+
+MediaKeySystemAccess::~MediaKeySystemAccess()
+{
+}
+
+JSObject*
+MediaKeySystemAccess::WrapObject(JSContext* aCx)
+{
+  return MediaKeySystemAccessBinding::Wrap(aCx, this);
+}
+
+nsPIDOMWindow*
+MediaKeySystemAccess::GetParentObject() const
+{
+  return mParent;
+}
+
+void
+MediaKeySystemAccess::GetKeySystem(nsString& aRetVal) const
+{
+  aRetVal = mKeySystem;
+}
+
+already_AddRefed<Promise>
+MediaKeySystemAccess::CreateMediaKeys(ErrorResult& aRv)
+{
+  nsRefPtr<MediaKeys> keys(new MediaKeys(mParent, mKeySystem));
+  return keys->Init(aRv);
+}
+
+static bool
+HaveGMPFor(mozIGeckoMediaPluginService* aGMPService,
+           const nsCString& aKeySystem,
+           const nsCString& aAPI,
+           const nsCString& aTag = EmptyCString())
+{
+  nsTArray<nsCString> tags;
+  tags.AppendElement(aKeySystem);
+  if (!aTag.IsEmpty()) {
+    tags.AppendElement(aTag);
+  }
+  // Note: EME plugins need a non-null nodeId here, as they must
+  // not be shared across origins.
+  bool hasPlugin = false;
+  if (NS_FAILED(aGMPService->HasPluginForAPI(aAPI,
+                                             &tags,
+                                             &hasPlugin))) {
+    return false;
+  }
+  return hasPlugin;
+}
+
+/* static */
+bool
+MediaKeySystemAccess::IsKeySystemSupported(const nsAString& aKeySystem)
+{
+  nsCOMPtr<mozIGeckoMediaPluginService> mps =
+    do_GetService("@mozilla.org/gecko-media-plugin-service;1");
+  if (NS_WARN_IF(!mps)) {
+    return false;
+  }
+
+  if (aKeySystem.EqualsLiteral("org.w3.clearkey") &&
+      HaveGMPFor(mps,
+                 NS_LITERAL_CSTRING("org.w3.clearkey"),
+                 NS_LITERAL_CSTRING("eme-decrypt"))) {
+    return true;
+  }
+
+#ifdef XP_WIN
+  if (aKeySystem.EqualsLiteral("com.adobe.access") &&
+      Preferences::GetBool("media.eme.adobe-access.enabled", false) &&
+      IsVistaOrLater() && // Win Vista and later only.
+      HaveGMPFor(mps,
+                 NS_LITERAL_CSTRING("com.adobe.access"),
+                 NS_LITERAL_CSTRING("eme-decrypt"))) {
+      return true;
+  }
+#endif
+
+  return false;
+}
+
+static bool
+IsPlayableWithGMP(mozIGeckoMediaPluginService* aGMPS,
+                  const nsAString& aKeySystem,
+                  const nsAString& aContentType)
+{
+#ifdef MOZ_FMP4
+  nsContentTypeParser parser(aContentType);
+  nsAutoString mimeType;
+  nsresult rv = parser.GetType(mimeType);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  if (!mimeType.EqualsLiteral("audio/mp4") &&
+      !mimeType.EqualsLiteral("audio/x-m4a") &&
+      !mimeType.EqualsLiteral("video/mp4")) {
+    return false;
+  }
+
+  nsAutoString codecs;
+  parser.GetParameter("codecs", codecs);
+
+  NS_ConvertUTF16toUTF8 mimeTypeUTF8(mimeType);
+  bool hasAAC = false;
+  bool hasH264 = false;
+  bool hasMP3 = false;
+  if (!MP4Decoder::CanHandleMediaType(mimeTypeUTF8,
+                                      codecs,
+                                      hasAAC,
+                                      hasH264,
+                                      hasMP3) ||
+      hasMP3) {
+    return false;
+  }
+  return (!hasAAC || !HaveGMPFor(aGMPS,
+                                 NS_ConvertUTF16toUTF8(aKeySystem),
+                                 NS_LITERAL_CSTRING("eme-decrypt"),
+                                 NS_LITERAL_CSTRING("aac"))) &&
+         (!hasH264 || !HaveGMPFor(aGMPS,
+                                  NS_ConvertUTF16toUTF8(aKeySystem),
+                                  NS_LITERAL_CSTRING("eme-decrypt"),
+                                  NS_LITERAL_CSTRING("h264")));
+#else
+  return false;
+#endif
+}
+
+/* static */
+bool
+MediaKeySystemAccess::IsSupported(const nsAString& aKeySystem,
+                                  const Sequence<MediaKeySystemOptions>& aOptions)
+{
+  nsCOMPtr<mozIGeckoMediaPluginService> mps =
+    do_GetService("@mozilla.org/gecko-media-plugin-service;1");
+  if (NS_WARN_IF(!mps)) {
+    return false;
+  }
+
+  for (size_t i = 0; i < aOptions.Length(); i++) {
+    const MediaKeySystemOptions& options = aOptions[i];
+    if (!options.mInitDataType.EqualsLiteral("cenc")) {
+      continue;
+    }
+    if (!options.mAudioCapability.IsEmpty() ||
+        !options.mVideoCapability.IsEmpty()) {
+      // Don't support any capabilites until we know we have a CDM with
+      // capabilities...
+      continue;
+    }
+    if (!options.mAudioType.IsEmpty() &&
+        !IsPlayableWithGMP(mps, aKeySystem, options.mAudioType)) {
+      continue;
+    }
+    if (!options.mVideoType.IsEmpty() &&
+        !IsPlayableWithGMP(mps, aKeySystem, options.mVideoType)) {
+      continue;
+    }
+
+    // Our sandbox provides an origin specific unique identifier, and the
+    // ability to persist data. We don't yet have a way to turn those off
+    // and on for specific GMPs/CDMs, so we don't check the uniqueidentifier
+    // and stateful attributes here.
+
+    return true;
+  }
+  return false;
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/media/eme/MediaKeySystemAccess.h b/dom/media/eme/MediaKeySystemAccess.h
new file mode 100644
index 000000000000..9fbe23573359
--- /dev/null
+++ b/dom/media/eme/MediaKeySystemAccess.h
@@ -0,0 +1,58 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_MediaKeySystemAccess_h
+#define mozilla_dom_MediaKeySystemAccess_h
+
+#include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/MediaKeySystemAccessBinding.h"
+#include "js/TypeDecls.h"
+
+namespace mozilla {
+namespace dom {
+
+class MediaKeySystemAccess MOZ_FINAL : public nsISupports,
+                                       public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MediaKeySystemAccess)
+
+public:
+  explicit MediaKeySystemAccess(nsPIDOMWindow* aParent,
+                                const nsAString& aKeySystem);
+
+protected:
+  ~MediaKeySystemAccess();
+
+public:
+  nsPIDOMWindow* GetParentObject() const;
+
+  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
+  void GetKeySystem(nsString& aRetVal) const;
+
+  already_AddRefed<Promise> CreateMediaKeys(ErrorResult& aRv);
+
+  static bool IsKeySystemSupported(const nsAString& aKeySystem);
+
+  static bool IsSupported(const nsAString& aKeySystem,
+                          const Sequence<MediaKeySystemOptions>& aOptions);
+
+private:
+  nsCOMPtr<nsPIDOMWindow> mParent;
+  const nsString mKeySystem;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_MediaKeySystemAccess_h
diff --git a/dom/media/eme/MediaKeys.cpp b/dom/media/eme/MediaKeys.cpp
index 02453ff4cd18..8c2d1601ce77 100644
--- a/dom/media/eme/MediaKeys.cpp
+++ b/dom/media/eme/MediaKeys.cpp
@@ -114,111 +114,6 @@ MediaKeys::SetServerCertificate(const ArrayBufferViewOrArrayBuffer& aCert, Error
   return promise.forget();
 }
 
-static bool
-HaveGMPFor(const nsCString& aKeySystem,
-           const nsCString& aAPI,
-           const nsCString& aTag = EmptyCString())
-{
-  nsCOMPtr<mozIGeckoMediaPluginService> mps =
-    do_GetService("@mozilla.org/gecko-media-plugin-service;1");
-  if (NS_WARN_IF(!mps)) {
-    return false;
-  }
-
-  nsTArray<nsCString> tags;
-  tags.AppendElement(aKeySystem);
-  if (!aTag.IsEmpty()) {
-    tags.AppendElement(aTag);
-  }
-  // Note: EME plugins need a non-null nodeId here, as they must
-  // not be shared across origins.
-  bool hasPlugin = false;
-  if (NS_FAILED(mps->HasPluginForAPI(aAPI,
-                                     &tags,
-                                     &hasPlugin))) {
-    return false;
-  }
-  return hasPlugin;
-}
-
-static bool
-IsPlayableMP4Type(const nsAString& aContentType)
-{
-#ifdef MOZ_FMP4
-  nsContentTypeParser parser(aContentType);
-  nsAutoString mimeType;
-  nsresult rv = parser.GetType(mimeType);
-  if (NS_FAILED(rv)) {
-    return false;
-  }
-  nsAutoString codecs;
-  parser.GetParameter("codecs", codecs);
-
-  NS_ConvertUTF16toUTF8 mimeTypeUTF8(mimeType);
-  return MP4Decoder::CanHandleMediaType(mimeTypeUTF8, codecs);
-#else
-  return false;
-#endif
-}
-
-bool
-MediaKeys::IsTypeSupported(const nsAString& aKeySystem,
-                           const Optional<nsAString>& aInitDataType,
-                           const Optional<nsAString>& aContentType)
-{
-  if (aKeySystem.EqualsLiteral("org.w3.clearkey") &&
-      (!aInitDataType.WasPassed() || aInitDataType.Value().EqualsLiteral("cenc")) &&
-      (!aContentType.WasPassed() || IsPlayableMP4Type(aContentType.Value())) &&
-      HaveGMPFor(NS_LITERAL_CSTRING("org.w3.clearkey"),
-                 NS_LITERAL_CSTRING("eme-decrypt"))) {
-    return true;
-  }
-
-#ifdef XP_WIN
-  // Note: Adobe Access's GMP uses WMF to decode, so anything our MP4Reader
-  // thinks it can play on Windows, the Access GMP should be able to play.
-  if (aKeySystem.EqualsLiteral("com.adobe.access") &&
-      Preferences::GetBool("media.eme.adobe-access.enabled", false) &&
-      IsVistaOrLater() && // Win Vista and later only.
-      (!aInitDataType.WasPassed() || aInitDataType.Value().EqualsLiteral("cenc")) &&
-      (!aContentType.WasPassed() || IsPlayableMP4Type(aContentType.Value())) &&
-      HaveGMPFor(NS_LITERAL_CSTRING("com.adobe.access"),
-                 NS_LITERAL_CSTRING("eme-decrypt")) &&
-      HaveGMPFor(NS_LITERAL_CSTRING("com.adobe.access"),
-                 NS_LITERAL_CSTRING("decode-video"),
-                 NS_LITERAL_CSTRING("h264")) &&
-      HaveGMPFor(NS_LITERAL_CSTRING("com.adobe.access"),
-                 NS_LITERAL_CSTRING("decode-audio"),
-                 NS_LITERAL_CSTRING("aac"))) {
-      return true;
-  }
-#endif
-
-  return false;
-}
-
-/* static */
-IsTypeSupportedResult
-MediaKeys::IsTypeSupported(const GlobalObject& aGlobal,
-                           const nsAString& aKeySystem,
-                           const Optional<nsAString>& aInitDataType,
-                           const Optional<nsAString>& aContentType,
-                           const Optional<nsAString>& aCapability)
-{
-  // TODO: Should really get spec changed to this is async, so we can wait
-  //       for user to consent to running plugin.
-  bool supported = IsTypeSupported(aKeySystem, aInitDataType, aContentType);
-
-  EME_LOG("MediaKeys::IsTypeSupported keySystem='%s' initDataType='%s' contentType='%s' supported=%d",
-          NS_ConvertUTF16toUTF8(aKeySystem).get(),
-          (aInitDataType.WasPassed() ? NS_ConvertUTF16toUTF8(aInitDataType.Value()).get() : ""),
-          (aContentType.WasPassed() ? NS_ConvertUTF16toUTF8(aContentType.Value()).get() : ""),
-          supported);
-
-  return supported ? IsTypeSupportedResult::Probably
-                   : IsTypeSupportedResult::_empty;
-}
-
 already_AddRefed<Promise>
 MediaKeys::MakePromise(ErrorResult& aRv)
 {
@@ -303,24 +198,6 @@ MediaKeys::ResolvePromise(PromiseId aId)
   }
 }
 
-/* static */
-already_AddRefed<Promise>
-MediaKeys::Create(const GlobalObject& aGlobal,
-                  const nsAString& aKeySystem,
-                  ErrorResult& aRv)
-{
-  // CDMProxy keeps MediaKeys alive until it resolves the promise and thus
-  // returns the MediaKeys object to JS.
-  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal.GetAsSupports());
-  if (!window || !window->GetExtantDoc()) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  nsRefPtr<MediaKeys> keys = new MediaKeys(window, aKeySystem);
-  return keys->Init(aRv);
-}
-
 already_AddRefed<Promise>
 MediaKeys::Init(ErrorResult& aRv)
 {
@@ -329,11 +206,6 @@ MediaKeys::Init(ErrorResult& aRv)
     return nullptr;
   }
 
-  if (!IsTypeSupported(mKeySystem)) {
-    promise->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-    return promise.forget();
-  }
-
   mProxy = new CDMProxy(this, mKeySystem);
 
   // Determine principal (at creation time) of the MediaKeys object.
diff --git a/dom/media/eme/MediaKeys.h b/dom/media/eme/MediaKeys.h
index e0cf26b67b91..5585feda232f 100644
--- a/dom/media/eme/MediaKeys.h
+++ b/dom/media/eme/MediaKeys.h
@@ -53,6 +53,8 @@ public:
 
   MediaKeys(nsPIDOMWindow* aParentWindow, const nsAString& aKeySystem);
 
+  already_AddRefed<Promise> Init(ErrorResult& aRv);
+
   nsPIDOMWindow* GetParentObject() const;
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
@@ -70,19 +72,6 @@ public:
   already_AddRefed<Promise> SetServerCertificate(const ArrayBufferViewOrArrayBuffer& aServerCertificate,
                                                  ErrorResult& aRv);
 
-  // JavaScript: MediaKeys.create()
-  static
-  already_AddRefed<Promise> Create(const GlobalObject& aGlobal,
-                                   const nsAString& aKeySystem,
-                                   ErrorResult& aRv);
-
-  // JavaScript: MediaKeys.IsTypeSupported()
-  static IsTypeSupportedResult IsTypeSupported(const GlobalObject& aGlobal,
-                                               const nsAString& aKeySystem,
-                                               const Optional<nsAString>& aInitDataType,
-                                               const Optional<nsAString>& aContentType,
-                                               const Optional<nsAString>& aCapability);
-
   already_AddRefed<MediaKeySession> GetSession(const nsAString& aSessionId);
 
   // Called once a Create() operation succeeds.
@@ -128,12 +117,7 @@ public:
 
 private:
 
-  static bool IsTypeSupported(const nsAString& aKeySystem,
-                              const Optional<nsAString>& aInitDataType = Optional<nsAString>(),
-                              const Optional<nsAString>& aContentType = Optional<nsAString>());
-
   bool IsInPrivateBrowsing();
-  already_AddRefed<Promise> Init(ErrorResult& aRv);
 
   // Removes promise from mPromises, and returns it.
   already_AddRefed<Promise> RetrievePromise(PromiseId aId);
diff --git a/dom/media/eme/moz.build b/dom/media/eme/moz.build
index 838156d0b99c..6e3d3532be02 100644
--- a/dom/media/eme/moz.build
+++ b/dom/media/eme/moz.build
@@ -10,6 +10,7 @@ EXPORTS.mozilla.dom += [
     'MediaKeyMessageEvent.h',
     'MediaKeys.h',
     'MediaKeySession.h',
+    'MediaKeySystemAccess.h',
 ]
 
 EXPORTS.mozilla += [
@@ -29,6 +30,7 @@ UNIFIED_SOURCES += [
     'MediaKeyMessageEvent.cpp',
     'MediaKeys.cpp',
     'MediaKeySession.cpp',
+    'MediaKeySystemAccess.cpp',
 ]
 
 FINAL_LIBRARY = 'xul'
diff --git a/dom/media/fmp4/MP4Decoder.cpp b/dom/media/fmp4/MP4Decoder.cpp
index 9e8c6887881d..c81f4fc9b5af 100644
--- a/dom/media/fmp4/MP4Decoder.cpp
+++ b/dom/media/fmp4/MP4Decoder.cpp
@@ -54,14 +54,25 @@ MP4Decoder::SetCDMProxy(CDMProxy* aProxy)
 #endif
 
 static bool
-IsSupportedAudioCodec(const nsAString& aCodec)
+IsSupportedAudioCodec(const nsAString& aCodec,
+                      bool& aOutContainsAAC,
+                      bool& aOutContainsMP3)
 {
-  // AAC-LC, HE-AAC or MP3 in M4A.
-  return aCodec.EqualsASCII("mp4a.40.2") ||
+  // AAC-LC or HE-AAC in M4A.
+  aOutContainsAAC = aCodec.EqualsASCII("mp4a.40.2") ||
+                    aCodec.EqualsASCII("mp4a.40.5");
+  if (aOutContainsAAC) {
+    return true;
+  }
 #ifndef MOZ_GONK_MEDIACODEC // B2G doesn't support MP3 in MP4 yet.
-         aCodec.EqualsASCII("mp3") ||
+  aOutContainsMP3 = aCodec.EqualsASCII("mp3");
+  if (aOutContainsMP3) {
+    return true;
+  }
+#else
+  aOutContainsMP3 = false;
 #endif
-         aCodec.EqualsASCII("mp4a.40.5");
+  return false;
 }
 
 static bool
@@ -92,14 +103,20 @@ IsSupportedH264Codec(const nsAString& aCodec)
 /* static */
 bool
 MP4Decoder::CanHandleMediaType(const nsACString& aType,
-                               const nsAString& aCodecs)
+                               const nsAString& aCodecs,
+                               bool& aOutContainsAAC,
+                               bool& aOutContainsH264,
+                               bool& aOutContainsMP3)
 {
   if (!IsEnabled()) {
     return false;
   }
 
   if (aType.EqualsASCII("audio/mp4") || aType.EqualsASCII("audio/x-m4a")) {
-    return aCodecs.IsEmpty() || IsSupportedAudioCodec(aCodecs);
+    return aCodecs.IsEmpty() ||
+           IsSupportedAudioCodec(aCodecs,
+                                 aOutContainsAAC,
+                                 aOutContainsMP3);
   }
 
   if (!aType.EqualsASCII("video/mp4")) {
@@ -113,7 +130,13 @@ MP4Decoder::CanHandleMediaType(const nsACString& aType,
   while (tokenizer.hasMoreTokens()) {
     const nsSubstring& token = tokenizer.nextToken();
     expectMoreTokens = tokenizer.separatorAfterCurrentToken();
-    if (IsSupportedAudioCodec(token) || IsSupportedH264Codec(token)) {
+    if (IsSupportedAudioCodec(token,
+                              aOutContainsAAC,
+                              aOutContainsMP3)) {
+      continue;
+    }
+    if (IsSupportedH264Codec(token)) {
+      aOutContainsH264 = true;
       continue;
     }
     return false;
@@ -122,8 +145,8 @@ MP4Decoder::CanHandleMediaType(const nsACString& aType,
     // Last codec name was empty
     return false;
   }
-  return true;
 
+  return true;
 }
 
 static bool
diff --git a/dom/media/fmp4/MP4Decoder.h b/dom/media/fmp4/MP4Decoder.h
index 95f7131abb0a..0cffec1f60c3 100644
--- a/dom/media/fmp4/MP4Decoder.h
+++ b/dom/media/fmp4/MP4Decoder.h
@@ -30,9 +30,13 @@ public:
 
   // Returns true if aMIMEType is a type that we think we can render with the
   // a MP4 platform decoder backend. If aCodecs is non emtpy, it is filled
-  // with a comma-delimited list of codecs to check support for.
+  // with a comma-delimited list of codecs to check support for. Notes in
+  // out params wether the codecs string contains AAC or H.264.
   static bool CanHandleMediaType(const nsACString& aMIMEType,
-                                 const nsAString& aCodecs = EmptyString());
+                                 const nsAString& aCodecs,
+                                 bool& aOutContainsAAC,
+                                 bool& aOutContainsH264,
+                                 bool& aOutContainsMP3);
 
   // Returns true if the MP4 backend is preffed on, and we're running on a
   // platform that is likely to have decoders for the contained formats.
diff --git a/dom/media/test/eme.js b/dom/media/test/eme.js
index 3d3a2c3af85f..398f4449281b 100644
--- a/dom/media/test/eme.js
+++ b/dom/media/test/eme.js
@@ -192,23 +192,37 @@ function SetupEME(test, token, params)
 
   v.addEventListener("encrypted", function(ev) {
     Log(token, "got encrypted event");
-    MediaKeys.create(KEYSYSTEM_TYPE).then(function(mediaKeys) {
-      Log(token, "created MediaKeys object ok");
-      mediaKeys.sessions = [];
-      return v.setMediaKeys(mediaKeys);
-    }, bail("failed to create MediaKeys object")).then(function() {
-      Log(token, "set MediaKeys on <video> element ok");
-
-      var session = v.mediaKeys.createSession(test.sessionType);
-      if (params && params.onsessioncreated) {
-        params.onsessioncreated(session);
+    var options = [
+      {
+        initDataType: ev.initDataType,
+        videoType: test.type,
       }
-      session.addEventListener("message", UpdateSessionFunc(test, token));
-      session.generateRequest(ev.initDataType, ev.initData).then(function() {
-      }, bail(token + " Failed to initialise MediaKeySession"));
+    ];
+    navigator.requestMediaKeySystemAccess(KEYSYSTEM_TYPE, options)
+      .then(function(keySystemAccess) {
+        return keySystemAccess.createMediaKeys();
+      }, bail(token + " Failed to request key system access."))
+      
+      .then(function(mediaKeys) {
+        Log(token, "created MediaKeys object ok");
+        mediaKeys.sessions = [];
+        return v.setMediaKeys(mediaKeys);
+      }, bail("failed to create MediaKeys object"))
+      
+      .then(function() {
+        Log(token, "set MediaKeys on <video> element ok");
 
-    }, onSetKeysFail);
+        var session = v.mediaKeys.createSession(test.sessionType);
+        if (params && params.onsessioncreated) {
+          params.onsessioncreated(session);
+        }
+        session.addEventListener("message", UpdateSessionFunc(test, token));
+        return session.generateRequest(ev.initDataType, ev.initData);
+      }, onSetKeysFail)
+      
+      .then(function() {
+        Log(token, "generated request");
+      }, bail(token + " Failed to request key system access2."));
   });
-
   return v;
 }
diff --git a/dom/media/test/mochitest.ini b/dom/media/test/mochitest.ini
index 8b5011d91385..f57d563cc24b 100644
--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@@ -364,6 +364,8 @@ skip-if = buildapp == 'b2g' && toolkit != 'gonk' # bug 1082984
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s # bug 1043403, bug 1057908
 [test_eme_playback.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s # bug 1043403, bug 1057908
+[test_eme_requestKeySystemAccess.html]
+skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s # bug 1043403, bug 1057908
 [test_eme_stream_capture_blocked.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s # bug 1043403, bug 1057908
 [test_empty_resource.html]
diff --git a/dom/media/test/test_eme_playback.html b/dom/media/test/test_eme_playback.html
index 790fdddb17d6..39ae811131b6 100644
--- a/dom/media/test/test_eme_playback.html
+++ b/dom/media/test/test_eme_playback.html
@@ -51,8 +51,6 @@ function startTest(test, token)
   var gotPlaying = false;
 
   v.addEventListener("encrypted", function(ev) {
-    ok(MediaKeys.isTypeSupported(KEYSYSTEM_TYPE, ev.initDataType, test.type),
-       TimeStamp(token) + " MediaKeys should support this keysystem");
     gotEncrypted = true;
   });
 
@@ -88,23 +86,7 @@ function startTest(test, token)
   LoadTest(test, v, token).then(function(){v.play();}, bail(token + " failed to load"));
 }
 
-function testIsTypeSupported()
-{
-  var t = MediaKeys.isTypeSupported;
-  const clearkey = "org.w3.clearkey";
-  ok(!t("bogus", "bogon", "video/bogus"), "Invalid type.");
-  ok(t(clearkey), "ClearKey supported.");
-  ok(!t(clearkey, "bogus"), "ClearKey bogus initDataType not supported.");
-  ok(t(clearkey, "cenc"), "ClearKey/cenc should be supported.");
-  ok(!t(clearkey, "cenc", "bogus"), "ClearKey/cenc bogus content type should be supported.");
-  ok(t(clearkey, "cenc", 'video/mp4'), "ClearKey/cenc video/mp4 supported.");
-  ok(t(clearkey, "cenc", 'video/mp4; codecs="avc1.4d4015,mp4a.40.2"'), "ClearKey/cenc H.264/AAC supported.");
-  ok(t(clearkey, "cenc", 'audio/mp4'), "ClearKey/cenc audio/mp4 supported.");
-  ok(t(clearkey, "cenc", 'audio/mp4; codecs="mp4a.40.2"'), "ClearKey/cenc AAC LC supported.");
-}
-
 function beginTest() {
-  testIsTypeSupported();
   manager.runTests(gEMETests, startTest);
 }
 
diff --git a/dom/media/test/test_eme_requestKeySystemAccess.html b/dom/media/test/test_eme_requestKeySystemAccess.html
new file mode 100644
index 000000000000..48b3fabd7db8
--- /dev/null
+++ b/dom/media/test/test_eme_requestKeySystemAccess.html
@@ -0,0 +1,293 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test Encrypted Media Extensions</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script type="text/javascript" src="manifest.js"></script>
+  <script type="text/javascript" src="eme.js"></script>
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+function Test(test) {
+  var name = "'" + test.name + "'";
+  return new Promise(function(resolve, reject) {
+    var p;
+    if (test.options) {
+      p = navigator.requestMediaKeySystemAccess(test.keySystem, test.options);
+    } else {
+      p = navigator.requestMediaKeySystemAccess(test.keySystem);
+    }
+    p.then(
+      function(keySystemAccess) {
+        ok(test.shouldPass, name + " passed and was expected to " + (test.shouldPass ? "pass" : "fail"));
+        resolve();
+      },
+      function(ex) {
+        if (test.shouldPass) {
+          info(name + " failed: " + ex);
+        }
+        ok(!test.shouldPass, name + " failed and was expected to " + (test.shouldPass ? "pass" : "fail"));
+        resolve();
+      });
+  });
+}
+
+const CLEARKEY_ID = 'org.w3.clearkey';
+
+var tests = [
+  {
+    name: 'Empty keySystem string',
+    keySystem: '',
+    options: [ ],
+    shouldPass: false,
+  },
+  {
+    name: 'Empty options specified',
+    keySystem: CLEARKEY_ID,
+    options: [ ],
+    shouldPass: false,
+  },
+  {
+    name: 'Undefined options',
+    keySystem: CLEARKEY_ID,
+    shouldPass: true,
+  },
+  {
+    name: 'Basic MP4 cenc',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'Invalid keysystem failure',
+    keySystem: 'bogusKeySystem',
+    options: [],
+    shouldPass: false,
+  },
+  {
+    name: 'Invalid initDataType',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Invalid videoType',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Invalid statefulness',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+        stateful: 'bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Invalid uniqueidentifier',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+        uniqueidentifier: 'bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Audio capabilities not supported by CLEARKEY_ID',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+        audioCapability: 'bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Video capabilities not supported by CLEARKEY_ID',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+        videoCapability: 'bogus',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'Invalid option followed by valid',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        bogus: 'bogon',
+      },
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'MP4 audio container',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        audioType: 'audio/mp4',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'MP4 audio container with AAC-LC',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        audioType: 'audio/mp4; codecs="mp4a.40.2"',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'MP4 audio container with invalid codecs',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        audioType: 'audio/mp4; codecs="bogus"',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'MP4 audio container with mp3 is unsupported',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        audioType: 'audio/mp4; codecs="mp3"',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'MP4 video container with mp3 and h264 is unsupported',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4; codecs="avc1.42E01E,mp3"',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'MP4 video container with constrained baseline h.264',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        audioType: 'video/mp4; codecs="avc1.42E01E"',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'MP4 video container with invalid codecs',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4; codecs="bogus"',
+      }
+    ],
+    shouldPass: false,
+  },
+  {
+    name: 'MP4 video container with constrained baseline h.264 and AAC-LC',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4; codecs="avc1.42E01E,mp4a.40.2"',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'MP4 audio and video type both specified',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'cenc',
+        videoType: 'video/mp4; codecs="avc1.42E01E"',
+        audioType: 'audio/mp4; codecs="mp4a.40.2"',
+      }
+    ],
+    shouldPass: true,
+  },
+  {
+    name: 'WebM CLEARKEY_ID not supported',
+    keySystem: CLEARKEY_ID,
+    options: [
+      {
+        initDataType: 'webm',
+        videoType: 'video/webm',
+      }
+    ],
+    shouldPass: false,
+  },
+];
+
+function beginTest() {
+  Promise.all(tests.map(Test)).then(function() { SimpleTest.finish(); });
+}
+
+var prefs = [
+  [ "media.mediasource.enabled", true ],
+  [ "media.mediasource.mp4.enabled", true ],
+];
+
+if (/Linux/.test(navigator.userAgent) ||
+    !document.createElement('video').canPlayType("video/mp4")) {
+  // XXX remove once we have mp4 PlatformDecoderModules on all platforms.
+  prefs.push([ "media.fragmented-mp4.exposed", true ]);
+  prefs.push([ "media.fragmented-mp4.use-blank-decoder", true ]);
+}
+
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({ "set" : prefs }, beginTest);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 11dcea87fc87..19cf93c8c282 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -661,6 +661,8 @@ var interfaceNamesInGlobalScope =
     {name: "MediaKeys", pref: "media.eme.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     {name: "MediaKeySession", pref: "media.eme.enabled"},
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    {name: "MediaKeySystemAccess", pref: "media.eme.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     {name: "MediaKeyMessageEvent", pref: "media.eme.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/webidl/MediaKeySystemAccess.webidl b/dom/webidl/MediaKeySystemAccess.webidl
new file mode 100644
index 000000000000..9c62a8443c1e
--- /dev/null
+++ b/dom/webidl/MediaKeySystemAccess.webidl
@@ -0,0 +1,34 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * https://dvcs.w3.org/hg/html-media/raw-file/default/encrypted-media/encrypted-media.html
+ *
+ * Copyright © 2014 W3C® (MIT, ERCIM, Keio, Beihang), All Rights Reserved.
+ * W3C liability, trademark and document use rules apply.
+ */
+
+enum MediaKeysRequirement {
+  "required",
+  "optional",
+  "disallowed"
+};
+
+dictionary MediaKeySystemOptions {
+  DOMString            initDataType = "";
+  DOMString            audioType = "";
+  DOMString            audioCapability = "";
+  DOMString            videoType = "";
+  DOMString            videoCapability = "";
+  MediaKeysRequirement uniqueidentifier = "optional";
+  MediaKeysRequirement stateful = "optional";
+};
+
+[Pref="media.eme.enabled"]
+interface MediaKeySystemAccess {
+  readonly    attribute DOMString keySystem;
+  [NewObject, Throws]
+  Promise<MediaKeys> createMediaKeys();
+};
diff --git a/dom/webidl/MediaKeys.webidl b/dom/webidl/MediaKeys.webidl
index 7467ed68b7f0..c0bf381c5ccd 100644
--- a/dom/webidl/MediaKeys.webidl
+++ b/dom/webidl/MediaKeys.webidl
@@ -22,9 +22,4 @@ interface MediaKeys {
 
   [NewObject, Throws]
   Promise<void> setServerCertificate((ArrayBufferView or ArrayBuffer) serverCertificate);
-
-  [Throws,NewObject]
-  static Promise<MediaKeys> create(DOMString keySystem);
-  static IsTypeSupportedResult isTypeSupported(DOMString keySystem, optional DOMString initDataType, optional DOMString contentType, optional DOMString capability);
-
 };
diff --git a/dom/webidl/Navigator.webidl b/dom/webidl/Navigator.webidl
index 53c7b12d808e..dd2a3e2dcee7 100644
--- a/dom/webidl/Navigator.webidl
+++ b/dom/webidl/Navigator.webidl
@@ -397,3 +397,12 @@ partial interface Navigator {
   [Pref="dom.tv.enabled", CheckPermissions="tv", Func="Navigator::HasTVSupport"]
   readonly attribute TVManager? tv;
 };
+
+#ifdef MOZ_EME
+partial interface Navigator {
+  [Pref="media.eme.enabled", Throws, NewObject]
+  Promise<MediaKeySystemAccess>
+  requestMediaKeySystemAccess(DOMString keySystem,
+                              optional sequence<MediaKeySystemOptions> supportedConfigurations);
+};
+#endif
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index cea1c94d9d20..273ab76cdcf3 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -798,4 +798,5 @@ if CONFIG['MOZ_EME']:
         'MediaKeyMessageEvent.webidl',
         'MediaKeys.webidl',
         'MediaKeySession.webidl',
+        'MediaKeySystemAccess.webidl',
     ]

From 1ee08165ecc2c02fe43c4908b5e0f0cc9f54800a Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Tue, 11 Nov 2014 20:47:00 -0800
Subject: [PATCH 03/84] Bug 1069695 - Use --trace-children=yes in |mach
 valgrind-test|. r=jseward.

--HG--
extra : rebase_source : 3514fc02297fea921c13df7c8c02ab07c54616ab
---
 build/valgrind/mach_commands.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/build/valgrind/mach_commands.py b/build/valgrind/mach_commands.py
index eb9f6755bfb0..a0e0769c95b7 100644
--- a/build/valgrind/mach_commands.py
+++ b/build/valgrind/mach_commands.py
@@ -108,7 +108,8 @@ class MachCommands(MachCommandBase):
                 '--num-callers=36',
                 '--leak-check=full',
                 '--show-possibly-lost=no',
-                '--track-origins=yes'
+                '--track-origins=yes',
+                '--trace-children=yes',
             ]
 
             for s in suppressions:

From 566dc5b315e55beaee72b3e85364cf0205297c63 Mon Sep 17 00:00:00 2001
From: Jim Blandy <jimb@mozilla.com>
Date: Tue, 18 Nov 2014 14:01:38 -0800
Subject: [PATCH 04/84] Bug 1098132: Correctly set the source position of the
 function's parse node when parsing lazy functions. r=luke

---
 js/src/frontend/Parser.cpp                            | 5 +++++
 js/src/jit-test/tests/parser/lazy-parse-bad-offset.js | 5 +++++
 2 files changed, 10 insertions(+)
 create mode 100644 js/src/jit-test/tests/parser/lazy-parse-bad-offset.js

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 233bc7a9a951..32bbc6dba4a3 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -2438,6 +2438,11 @@ Parser<FullParseHandler>::standaloneLazyFunction(HandleFunction fun, unsigned st
     if (!pn)
         return null();
 
+    // Our tokenStream has no current token, so pn's position is garbage.
+    // Substitute the position of the first token in our source.
+    if (!tokenStream.peekTokenPos(&pn->pn_pos))
+        return null();
+
     Directives directives(/* strict = */ strict);
     FunctionBox *funbox = newFunctionBox(pn, fun, /* outerpc = */ nullptr, directives,
                                          generatorKind);
diff --git a/js/src/jit-test/tests/parser/lazy-parse-bad-offset.js b/js/src/jit-test/tests/parser/lazy-parse-bad-offset.js
new file mode 100644
index 000000000000..4b4ef1ba9efb
--- /dev/null
+++ b/js/src/jit-test/tests/parser/lazy-parse-bad-offset.js
@@ -0,0 +1,5 @@
+// Bug 1098132: Shouldn't assert.
+
+options('strict');
+function eval() {};
+eval();

From cacfe982d9ba747972789a5dca59dcc36257ca29 Mon Sep 17 00:00:00 2001
From: Markus Stange <mstange@themasta.com>
Date: Tue, 18 Nov 2014 17:21:19 -0500
Subject: [PATCH 05/84] Bug 1092634 - Let feColorMatrix and feComponentTransfer
 generate output outside their input's bounds. r=Bas

This makes the color matrix and component transfer Moz2D filters generate an infinite output, which is then cropped to the primitive's filter primitive subregion by a subsequent crop filter node. This still gives us different behavior than other browser when the primitive subregion is overridden using the x/y/width/height attributes - other browsers either ignore those completely (IE) or only let them crop the default subregion (which is defined to be the same as the input subregion) and not enlargen it - but I'll fix that in a separate bug.
---
 gfx/2d/FilterNodeSoftware.cpp                 |  8 ++-
 gfx/src/FilterSupport.cpp                     | 57 +++++++++++++++++++
 .../svg/filters/outside-sourcegraphic-1.svg   | 10 ++++
 .../svg/filters/outside-sourcegraphic-2.svg   | 13 +++++
 .../svg/filters/outside-sourcegraphic-3.svg   | 15 +++++
 .../svg/filters/outside-sourcegraphic-ref.svg |  7 +++
 layout/reftests/svg/filters/reftest.list      |  4 ++
 7 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-1.svg
 create mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-2.svg
 create mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-3.svg
 create mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-ref.svg

diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index bb111c511ef5..33585048c329 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -1460,6 +1460,9 @@ FilterNodeColorMatrixSoftware::RequestFromInputsForRect(const IntRect &aRect)
 IntRect
 FilterNodeColorMatrixSoftware::GetOutputRectInRect(const IntRect& aRect)
 {
+  if (mMatrix._54 > 0.0f) {
+    return aRect;
+  }
   return GetInputRectInRect(IN_COLOR_MATRIX_IN, aRect);
 }
 
@@ -1808,7 +1811,10 @@ FilterNodeComponentTransferSoftware::RequestFromInputsForRect(const IntRect &aRe
 IntRect
 FilterNodeComponentTransferSoftware::GetOutputRectInRect(const IntRect& aRect)
 {
-  return GetInputRectInRect(IN_TRANSFER_IN, aRect);
+  if (mDisableA) {
+    return GetInputRectInRect(IN_TRANSFER_IN, aRect);
+  }
+  return aRect;
 }
 
 int32_t
diff --git a/gfx/src/FilterSupport.cpp b/gfx/src/FilterSupport.cpp
index 9a31822cad65..697d9dfe2215 100644
--- a/gfx/src/FilterSupport.cpp
+++ b/gfx/src/FilterSupport.cpp
@@ -1389,6 +1389,42 @@ FilterSupport::ComputeResultChangeRegion(const FilterDescription& aFilter,
   return resultChangeRegions[resultChangeRegions.Length() - 1];
 }
 
+static float
+ResultOfZeroUnderTransferFunction(const AttributeMap& aFunctionAttributes)
+{
+  switch (aFunctionAttributes.GetUint(eComponentTransferFunctionType)) {
+    case SVG_FECOMPONENTTRANSFER_TYPE_TABLE:
+    {
+      const nsTArray<float>& tableValues =
+        aFunctionAttributes.GetFloats(eComponentTransferFunctionTableValues);
+      if (tableValues.Length() < 2) {
+        return 0.0f;
+      }
+      return tableValues[0];
+    }
+
+    case SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE:
+    {
+      const nsTArray<float>& tableValues =
+        aFunctionAttributes.GetFloats(eComponentTransferFunctionTableValues);
+      if (tableValues.Length() < 1) {
+        return 0.0f;
+      }
+      return tableValues[0];
+    }
+
+    case SVG_FECOMPONENTTRANSFER_TYPE_LINEAR:
+      return aFunctionAttributes.GetFloat(eComponentTransferFunctionIntercept);
+
+    case SVG_FECOMPONENTTRANSFER_TYPE_GAMMA:
+      return aFunctionAttributes.GetFloat(eComponentTransferFunctionOffset);
+
+    case SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY:
+    default:
+      return 0.0f;
+  }
+}
+
 nsIntRegion
 FilterSupport::PostFilterExtentsForPrimitive(const FilterPrimitiveDescription& aDescription,
                                              const nsTArray<nsIntRegion>& aInputExtents)
@@ -1439,6 +1475,27 @@ FilterSupport::PostFilterExtentsForPrimitive(const FilterPrimitiveDescription& a
       return ThebesIntRect(aDescription.PrimitiveSubregion());
     }
 
+    case PrimitiveType::ColorMatrix:
+    {
+      if (atts.GetUint(eColorMatrixType) == (uint32_t)SVG_FECOLORMATRIX_TYPE_MATRIX) {
+        const nsTArray<float>& values = atts.GetFloats(eColorMatrixValues);
+        if (values[19] > 0.0f) {
+          return ThebesIntRect(aDescription.PrimitiveSubregion());
+        }
+      }
+      return aInputExtents[0];
+    }
+
+    case PrimitiveType::ComponentTransfer:
+    {
+      AttributeMap functionAttributes =
+        atts.GetAttributeMap(eComponentTransferFunctionA);
+      if (ResultOfZeroUnderTransferFunction(functionAttributes) > 0.0f) {
+        return ThebesIntRect(aDescription.PrimitiveSubregion());
+      }
+      return aInputExtents[0];
+    }
+
     case PrimitiveType::Turbulence:
     case PrimitiveType::Image:
     {
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-1.svg b/layout/reftests/svg/filters/outside-sourcegraphic-1.svg
new file mode 100644
index 000000000000..f360aa12fd0e
--- /dev/null
+++ b/layout/reftests/svg/filters/outside-sourcegraphic-1.svg
@@ -0,0 +1,10 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
+    <feFlood flood-color="lime"/>
+  </filter>
+  <rect width="100" height="100" filter="url(#f)"/>
+</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-2.svg b/layout/reftests/svg/filters/outside-sourcegraphic-2.svg
new file mode 100644
index 000000000000..6699d620b9be
--- /dev/null
+++ b/layout/reftests/svg/filters/outside-sourcegraphic-2.svg
@@ -0,0 +1,13 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
+    <feColorMatrix type="matrix" values="0 0 0 0  0
+                                         0 0 0 0  1
+                                         0 0 0 0  0
+                                         0 0 0 0  1"/>
+  </filter>
+  <rect width="100" height="100" filter="url(#f)"/>
+</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-3.svg b/layout/reftests/svg/filters/outside-sourcegraphic-3.svg
new file mode 100644
index 000000000000..f8f6b363872c
--- /dev/null
+++ b/layout/reftests/svg/filters/outside-sourcegraphic-3.svg
@@ -0,0 +1,15 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
+    <feComponentTransfer>
+      <feFuncR type="table" tableValues="0 0" />
+      <feFuncG type="table" tableValues="1 1" />
+      <feFuncB type="table" tableValues="0 0" />
+      <feFuncA type="table" tableValues="1 1" />
+    </feComponentTransfer>
+  </filter>
+  <rect width="100" height="100" filter="url(#f)"/>
+</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg b/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg
new file mode 100644
index 000000000000..a336d2215849
--- /dev/null
+++ b/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg
@@ -0,0 +1,7 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="200" height="200" fill="lime"/>
+</svg>
diff --git a/layout/reftests/svg/filters/reftest.list b/layout/reftests/svg/filters/reftest.list
index d5cdd1bed2a8..0fde197fdfd0 100644
--- a/layout/reftests/svg/filters/reftest.list
+++ b/layout/reftests/svg/filters/reftest.list
@@ -116,3 +116,7 @@ fuzzy(2,2659) skip-if(d2d) == feSpecularLighting-1.svg feSpecularLighting-1-ref.
 == fePointLight-zoomed-page.svg fePointLight-zoomed-page-ref.svg
 
 == feTurbulence-offset.svg feTurbulence-offset-ref.svg
+
+== outside-sourcegraphic-1.svg outside-sourcegraphic-ref.svg
+== outside-sourcegraphic-2.svg outside-sourcegraphic-ref.svg
+== outside-sourcegraphic-3.svg outside-sourcegraphic-ref.svg

From d758890dc751908567fa06b60164ae63d3d8c984 Mon Sep 17 00:00:00 2001
From: Markus Stange <mstange@themasta.com>
Date: Tue, 18 Nov 2014 17:21:45 -0500
Subject: [PATCH 06/84] Bug 1097776 - Use Skia for unaccelerated rendering of
 3D transforms. r=jrmuizel

---
 gfx/layers/basic/BasicCompositor.cpp      | 113 ++++++++++------------
 gfx/layers/basic/BasicLayerManager.cpp    | 112 ++++++++++-----------
 layout/reftests/bugs/reftest.list         |   2 +-
 layout/reftests/transform-3d/reftest.list |   8 +-
 4 files changed, 104 insertions(+), 131 deletions(-)

diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 9e5d77bb299c..c3b1a2f823fa 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -17,8 +17,8 @@
 #include <algorithm>
 #include "ImageContainer.h"
 #include "gfxPrefs.h"
-#define PIXMAN_DONT_DEFINE_STDINT
-#include "pixman.h"                     // for pixman_f_transform, etc
+#include "skia/SkCanvas.h"              // for SkCanvas
+#include "skia/SkBitmapDevice.h"        // for SkBitmapDevice
 
 namespace mozilla {
 using namespace mozilla::gfx;
@@ -168,75 +168,62 @@ DrawSurfaceWithTextureCoords(DrawTarget *aDest,
                    mode, aMask, aMaskTransform, &matrix);
 }
 
-static pixman_transform
-Matrix3DToPixman(const gfx3DMatrix& aMatrix)
+static SkMatrix
+Matrix3DToSkia(const gfx3DMatrix& aMatrix)
 {
-  pixman_f_transform transform;
+  SkMatrix transform;
+  transform.setAll(aMatrix._11,
+                   aMatrix._21,
+                   aMatrix._41,
+                   aMatrix._12,
+                   aMatrix._22,
+                   aMatrix._42,
+                   aMatrix._14,
+                   aMatrix._24,
+                   aMatrix._44);
 
-  transform.m[0][0] = aMatrix._11;
-  transform.m[0][1] = aMatrix._21;
-  transform.m[0][2] = aMatrix._41;
-  transform.m[1][0] = aMatrix._12;
-  transform.m[1][1] = aMatrix._22;
-  transform.m[1][2] = aMatrix._42;
-  transform.m[2][0] = aMatrix._14;
-  transform.m[2][1] = aMatrix._24;
-  transform.m[2][2] = aMatrix._44;
-
-  pixman_transform result;
-  pixman_transform_from_pixman_f_transform(&result, &transform);
-
-  return result;
+  return transform;
 }
 
 static void
-PixmanTransform(DataSourceSurface* aDest,
-                DataSourceSurface* aSource,
-                const gfx3DMatrix& aTransform,
-                const Point& aDestOffset)
+SkiaTransform(DataSourceSurface* aDest,
+              DataSourceSurface* aSource,
+              const gfx3DMatrix& aTransform,
+              const Point& aDestOffset)
 {
-  IntSize destSize = aDest->GetSize();
-  pixman_image_t* dest = pixman_image_create_bits(PIXMAN_a8r8g8b8,
-                                                  destSize.width,
-                                                  destSize.height,
-                                                  (uint32_t*)aDest->GetData(),
-                                                  aDest->Stride());
-
-  IntSize srcSize = aSource->GetSize();
-  pixman_image_t* src = pixman_image_create_bits(PIXMAN_a8r8g8b8,
-                                                 srcSize.width,
-                                                 srcSize.height,
-                                                 (uint32_t*)aSource->GetData(),
-                                                 aSource->Stride());
-
-  NS_ABORT_IF_FALSE(src && dest, "Failed to create pixman images?");
-
-  pixman_transform pixTransform = Matrix3DToPixman(aTransform);
-  pixman_transform pixTransformInverted;
-
-  // If the transform is singular then nothing would be drawn anyway, return here
-  if (!pixman_transform_invert(&pixTransformInverted, &pixTransform)) {
-    pixman_image_unref(dest);
-    pixman_image_unref(src);
+  if (aTransform.IsSingular()) {
     return;
   }
-  pixman_image_set_transform(src, &pixTransformInverted);
 
-  pixman_image_composite32(PIXMAN_OP_SRC,
-                           src,
-                           nullptr,
-                           dest,
-                           aDestOffset.x,
-                           aDestOffset.y,
-                           0,
-                           0,
-                           0,
-                           0,
-                           destSize.width,
-                           destSize.height);
+  IntSize destSize = aDest->GetSize();
+  SkImageInfo destInfo = SkImageInfo::Make(destSize.width,
+                                           destSize.height,
+                                           kBGRA_8888_SkColorType,
+                                           kPremul_SkAlphaType);
+  SkBitmap destBitmap;
+  destBitmap.setInfo(destInfo, aDest->Stride());
+  destBitmap.setPixels((uint32_t*)aDest->GetData());
+  SkCanvas destCanvas(new SkBitmapDevice(destBitmap));
 
-  pixman_image_unref(dest);
-  pixman_image_unref(src);
+  IntSize srcSize = aSource->GetSize();
+  SkImageInfo srcInfo = SkImageInfo::Make(srcSize.width,
+                                          srcSize.height,
+                                          kBGRA_8888_SkColorType,
+                                          kPremul_SkAlphaType);
+  SkBitmap src;
+  src.setInfo(srcInfo, aSource->Stride());
+  src.setPixels((uint32_t*)aSource->GetData());
+
+  gfx3DMatrix transform = aTransform;
+  transform.TranslatePost(Point3D(-aDestOffset.x, -aDestOffset.y, 0));
+  destCanvas.setMatrix(Matrix3DToSkia(transform));
+
+  SkPaint paint;
+  paint.setXfermodeMode(SkXfermode::kSrc_Mode);
+  paint.setAntiAlias(true);
+  paint.setFilterLevel(SkPaint::kLow_FilterLevel);
+  SkRect destRect = SkRect::MakeXYWH(0, 0, srcSize.width, srcSize.height);
+  destCanvas.drawBitmapRectToRect(src, nullptr, destRect, &paint);
 }
 
 static inline IntRect
@@ -377,12 +364,12 @@ BasicCompositor::DrawQuad(const gfx::Rect& aRect,
     RefPtr<SourceSurface> snapshot = dest->Snapshot();
     RefPtr<DataSourceSurface> source = snapshot->GetDataSurface();
     RefPtr<DataSourceSurface> temp =
-      Factory::CreateDataSourceSurface(RoundOut(transformBounds).Size(), SurfaceFormat::B8G8R8A8);
+      Factory::CreateDataSourceSurface(RoundOut(transformBounds).Size(), SurfaceFormat::B8G8R8A8, true);
     if (NS_WARN_IF(!temp)) {
       return;
     }
 
-    PixmanTransform(temp, source, new3DTransform, transformBounds.TopLeft());
+    SkiaTransform(temp, source, new3DTransform, transformBounds.TopLeft());
 
     transformBounds.MoveTo(0, 0);
     buffer->DrawSurface(temp, transformBounds, transformBounds);
diff --git a/gfx/layers/basic/BasicLayerManager.cpp b/gfx/layers/basic/BasicLayerManager.cpp
index 992184dc8b0b..b45030ede97a 100644
--- a/gfx/layers/basic/BasicLayerManager.cpp
+++ b/gfx/layers/basic/BasicLayerManager.cpp
@@ -46,9 +46,8 @@
 #include "nsRect.h"                     // for nsIntRect
 #include "nsRegion.h"                   // for nsIntRegion, etc
 #include "nsTArray.h"                   // for nsAutoTArray
-#define PIXMAN_DONT_DEFINE_STDINT
-#include "pixman.h"                     // for pixman_f_transform, etc
-
+#include "skia/SkCanvas.h"              // for SkCanvas
+#include "skia/SkBitmapDevice.h"        // for SkBitmapDevice
 class nsIWidget;
 
 namespace mozilla {
@@ -605,75 +604,62 @@ BasicLayerManager::SetRoot(Layer* aLayer)
   mRoot = aLayer;
 }
 
-static pixman_transform
-BasicLayerManager_Matrix3DToPixman(const gfx3DMatrix& aMatrix)
+static SkMatrix
+BasicLayerManager_Matrix3DToSkia(const gfx3DMatrix& aMatrix)
 {
-  pixman_f_transform transform;
+  SkMatrix transform;
+  transform.setAll(aMatrix._11,
+                   aMatrix._21,
+                   aMatrix._41,
+                   aMatrix._12,
+                   aMatrix._22,
+                   aMatrix._42,
+                   aMatrix._14,
+                   aMatrix._24,
+                   aMatrix._44);
 
-  transform.m[0][0] = aMatrix._11;
-  transform.m[0][1] = aMatrix._21;
-  transform.m[0][2] = aMatrix._41;
-  transform.m[1][0] = aMatrix._12;
-  transform.m[1][1] = aMatrix._22;
-  transform.m[1][2] = aMatrix._42;
-  transform.m[2][0] = aMatrix._14;
-  transform.m[2][1] = aMatrix._24;
-  transform.m[2][2] = aMatrix._44;
-
-  pixman_transform result;
-  pixman_transform_from_pixman_f_transform(&result, &transform);
-
-  return result;
+  return transform;
 }
 
 static void
-PixmanTransform(const gfxImageSurface* aDest,
-                RefPtr<DataSourceSurface> aSrc,
-                const gfx3DMatrix& aTransform,
-                gfxPoint aDestOffset)
+SkiaTransform(const gfxImageSurface* aDest,
+              RefPtr<DataSourceSurface> aSrc,
+              const gfx3DMatrix& aTransform,
+              gfxPoint aDestOffset)
 {
-  IntSize destSize = ToIntSize(aDest->GetSize());
-  pixman_image_t* dest = pixman_image_create_bits(aDest->Format() == gfxImageFormat::ARGB32 ? PIXMAN_a8r8g8b8 : PIXMAN_x8r8g8b8,
-                                                  destSize.width,
-                                                  destSize.height,
-                                                  (uint32_t*)aDest->Data(),
-                                                  aDest->Stride());
-
-  IntSize srcSize = aSrc->GetSize();
-  pixman_image_t* src = pixman_image_create_bits(aSrc->GetFormat() == SurfaceFormat::B8G8R8A8 ? PIXMAN_a8r8g8b8 : PIXMAN_x8r8g8b8,
-                                                 srcSize.width,
-                                                 srcSize.height,
-                                                 (uint32_t*)aSrc->GetData(),
-                                                 aSrc->Stride());
-
-  NS_ABORT_IF_FALSE(src && dest, "Failed to create pixman images?");
-
-  pixman_transform pixTransform = BasicLayerManager_Matrix3DToPixman(aTransform);
-  pixman_transform pixTransformInverted;
-
-  // If the transform is singular then nothing would be drawn anyway, return here
-  if (!pixman_transform_invert(&pixTransformInverted, &pixTransform)) {
-    pixman_image_unref(dest);
-    pixman_image_unref(src);
+  if (aTransform.IsSingular()) {
     return;
   }
-  pixman_image_set_transform(src, &pixTransformInverted);
 
-  pixman_image_composite32(PIXMAN_OP_SRC,
-                           src,
-                           nullptr,
-                           dest,
-                           aDestOffset.x,
-                           aDestOffset.y,
-                           0,
-                           0,
-                           0,
-                           0,
-                           destSize.width,
-                           destSize.height);
+  IntSize destSize = ToIntSize(aDest->GetSize());
+  SkImageInfo destInfo = SkImageInfo::Make(destSize.width,
+                                           destSize.height,
+                                           kBGRA_8888_SkColorType,
+                                           kPremul_SkAlphaType);
+  SkBitmap destBitmap;
+  destBitmap.setInfo(destInfo, aDest->Stride());
+  destBitmap.setPixels((uint32_t*)aDest->Data());
+  SkCanvas destCanvas(new SkBitmapDevice(destBitmap));
 
-  pixman_image_unref(dest);
-  pixman_image_unref(src);
+  IntSize srcSize = aSrc->GetSize();
+  SkImageInfo srcInfo = SkImageInfo::Make(srcSize.width,
+                                          srcSize.height,
+                                          kBGRA_8888_SkColorType,
+                                          kPremul_SkAlphaType);
+  SkBitmap src;
+  src.setInfo(srcInfo, aSrc->Stride());
+  src.setPixels((uint32_t*)aSrc->GetData());
+
+  gfx3DMatrix transform = aTransform;
+  transform.TranslatePost(Point3D(-aDestOffset.x, -aDestOffset.y, 0));
+  destCanvas.setMatrix(BasicLayerManager_Matrix3DToSkia(transform));
+
+  SkPaint paint;
+  paint.setXfermodeMode(SkXfermode::kSrc_Mode);
+  paint.setAntiAlias(true);
+  paint.setFilterLevel(SkPaint::kLow_FilterLevel);
+  SkRect destRect = SkRect::MakeXYWH(0, 0, srcSize.width, srcSize.height);
+  destCanvas.drawBitmapRectToRect(src, nullptr, destRect, &paint);
 }
 
 /**
@@ -716,7 +702,7 @@ Transform3D(RefPtr<SourceSurface> aSource,
   gfx3DMatrix translation = gfx3DMatrix::Translation(aBounds.x, aBounds.y, 0);
 
   // Transform the content and offset it such that the content begins at the origin.
-  PixmanTransform(destImage, aSource->GetDataSurface(), translation * aTransform, offset);
+  SkiaTransform(destImage, aSource->GetDataSurface(), translation * aTransform, offset);
 
   // If we haven't actually drawn to aDest then return our temporary image so
   // that the caller can do this.
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index d4d15bb70021..4ab0124f5d93 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1843,5 +1843,5 @@ test-pref(dom.webcomponents.enabled,true) == 1066554-1.html 1066554-1-ref.html
 == 1069716-1.html 1069716-1-ref.html
 == 1078262-1.html about:blank
 test-pref(layout.testing.overlay-scrollbars.always-visible,false) == 1081072-1.html 1081072-1-ref.html
-== 1081185-1.html 1081185-1-ref.html
+fuzzy-if(winWidget&&!layersGPUAccelerated,1,31) == 1081185-1.html 1081185-1-ref.html
 == 1097437-1.html 1097437-1-ref.html
\ No newline at end of file
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 24abf3ce0ee7..721510e4c717 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -35,12 +35,12 @@ fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,224,924) fu
 != backface-visibility-1a.html about:blank
 == backface-visibility-1b.html about:blank
 == backface-visibility-1c.html about:blank
-== backface-visibility-2.html backface-visibility-2-ref.html
+fuzzy-if(winWidget&&!layersGPUAccelerated,1,251) == backface-visibility-2.html backface-visibility-2-ref.html
 == backface-visibility-3.html backface-visibility-3-ref.html
 != perspective-origin-1a.html rotatex-perspective-1a.html
 random-if(Android&&AndroidVersion==17) == perspective-origin-1b.html perspective-origin-1a.html
 random-if(Android&&!browserIsRemote) == perspective-origin-2a.html perspective-origin-2-ref.html # bug 732568
-== perspective-origin-3a.html perspective-origin-3-ref.html
+fuzzy-if(winWidget&&!layersGPUAccelerated,1,61) == perspective-origin-3a.html perspective-origin-3-ref.html
 == perspective-origin-4a.html perspective-origin-4-ref.html
 != sorting-1a.html sorting-1-ref.html
 # Parallel planes, different z depth
@@ -50,8 +50,8 @@ random-if(Android&&!browserIsRemote) == perspective-origin-2a.html perspective-o
 == sorting-3a.html green-rect.html
 # Different, but equivalent (for the given transform) transform origins
 == rotatex-transformorigin-1a.html rotatex-transformorigin-1-ref.html
-== overflow-hidden-1a.html overflow-hidden-1-ref.html
+fuzzy-if((gtk2Widget&&layersOMTC)||(winWidget&&!layersGPUAccelerated),1,86) == overflow-hidden-1a.html overflow-hidden-1-ref.html
 == transform-style-flat-1a.html transform-style-flat-1-ref.html
 pref(layout.css.will-change.enabled,true) == willchange-containing-block.html?willchange willchange-containing-block.html?ref
 pref(layout.css.will-change.enabled,true) != willchange-containing-block.html?willchange willchange-containing-block.html?noblock
-== scroll-perspective-1.html scroll-perspective-1-ref.html
+fuzzy-if(winWidget&&!layersGPUAccelerated,1,606) == scroll-perspective-1.html scroll-perspective-1-ref.html

From a3d313d2081c9942283691cfd73ee5b4af71d9c1 Mon Sep 17 00:00:00 2001
From: Markus Stange <mstange@themasta.com>
Date: Tue, 18 Nov 2014 17:22:01 -0500
Subject: [PATCH 07/84] Bug 1097776 - Don't leak the SkBitmapDevice. r=jrmuizel

---
 gfx/2d/DrawTargetSkia.cpp              | 2 +-
 gfx/layers/basic/BasicCompositor.cpp   | 2 +-
 gfx/layers/basic/BasicLayerManager.cpp | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
index 5bff139f5cbb..837cf99228ca 100644
--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
@@ -843,7 +843,7 @@ DrawTargetSkia::Init(unsigned char* aData, const IntSize &aSize, int32_t aStride
                                        alphaType);
   bitmap.setInfo(info, aStride);
   bitmap.setPixels(aData);
-  mCanvas.adopt(new SkCanvas(new SkBitmapDevice(bitmap)));
+  mCanvas.adopt(new SkCanvas(bitmap));
 
   mSize = aSize;
   mFormat = aFormat;
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index c3b1a2f823fa..0bef0769f471 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -203,7 +203,7 @@ SkiaTransform(DataSourceSurface* aDest,
   SkBitmap destBitmap;
   destBitmap.setInfo(destInfo, aDest->Stride());
   destBitmap.setPixels((uint32_t*)aDest->GetData());
-  SkCanvas destCanvas(new SkBitmapDevice(destBitmap));
+  SkCanvas destCanvas(destBitmap);
 
   IntSize srcSize = aSource->GetSize();
   SkImageInfo srcInfo = SkImageInfo::Make(srcSize.width,
diff --git a/gfx/layers/basic/BasicLayerManager.cpp b/gfx/layers/basic/BasicLayerManager.cpp
index b45030ede97a..6bd70b84ded2 100644
--- a/gfx/layers/basic/BasicLayerManager.cpp
+++ b/gfx/layers/basic/BasicLayerManager.cpp
@@ -639,7 +639,7 @@ SkiaTransform(const gfxImageSurface* aDest,
   SkBitmap destBitmap;
   destBitmap.setInfo(destInfo, aDest->Stride());
   destBitmap.setPixels((uint32_t*)aDest->Data());
-  SkCanvas destCanvas(new SkBitmapDevice(destBitmap));
+  SkCanvas destCanvas(destBitmap);
 
   IntSize srcSize = aSrc->GetSize();
   SkImageInfo srcInfo = SkImageInfo::Make(srcSize.width,

From 059e54468a13abb146bc4ab21c1aab0ee02e92f9 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@mozilla.com>
Date: Tue, 18 Nov 2014 14:25:57 -0800
Subject: [PATCH 08/84] Bug 1100685 - IonMonkey: Don't use tempCopy for
 LClampDToUint8. r=jandem

---
 js/src/jit/LIR-Common.h | 5 ++---
 js/src/jit/Lowering.cpp | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index c80d33931e6b..7cb996b28a5f 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -5094,14 +5094,13 @@ class LClampIToUint8 : public LInstructionHelper<1, 1, 0>
     }
 };
 
-class LClampDToUint8 : public LInstructionHelper<1, 1, 1>
+class LClampDToUint8 : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(ClampDToUint8)
 
-    LClampDToUint8(const LAllocation &in, const LDefinition &temp) {
+    explicit LClampDToUint8(const LAllocation &in) {
         setOperand(0, in);
-        setTemp(0, temp);
     }
 };
 
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index f4871ac20587..a17c5b239c40 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2974,7 +2974,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
         return defineReuseInput(new(alloc()) LClampIToUint8(useRegisterAtStart(in)), ins, 0);
 
       case MIRType_Double:
-        return define(new(alloc()) LClampDToUint8(useRegisterAtStart(in), tempCopy(in, 0)), ins);
+        return define(new(alloc()) LClampDToUint8(useRegisterAtStart(in)), ins);
 
       case MIRType_Value:
       {

From ab7985df990aea708d5a53a8aad763c0c8610feb Mon Sep 17 00:00:00 2001
From: Jeff Muizelaar <jmuizelaar@mozilla.com>
Date: Tue, 18 Nov 2014 15:49:39 -0500
Subject: [PATCH 09/84] Bug 1101160. D3D11: Make switch statement better. r=bas

This is the order one would expect.

--HG--
extra : rebase_source : 299b3814983d42908c2507028bb1c16c64b0f25f
---
 gfx/layers/d3d11/CompositorD3D11.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/gfx/layers/d3d11/CompositorD3D11.cpp b/gfx/layers/d3d11/CompositorD3D11.cpp
index a6b3572c8108..2be4be291ba0 100644
--- a/gfx/layers/d3d11/CompositorD3D11.cpp
+++ b/gfx/layers/d3d11/CompositorD3D11.cpp
@@ -1070,13 +1070,13 @@ CompositorD3D11::SetSamplerForFilter(Filter aFilter)
 {
   ID3D11SamplerState *sampler;
   switch (aFilter) {
-  default:
-  case Filter::LINEAR:
-    sampler = mAttachments->mLinearSamplerState;
-    break;
-  case Filter::POINT:
+    case Filter::POINT:
     sampler = mAttachments->mPointSamplerState;
     break;
+  case Filter::LINEAR:
+  default:
+    sampler = mAttachments->mLinearSamplerState;
+    break;
   }
 
   mContext->PSSetSamplers(0, 1, &sampler);

From 5b9dfb3684a637167ce8c0d193464654324305fa Mon Sep 17 00:00:00 2001
From: Jeff Muizelaar <jmuizelaar@mozilla.com>
Date: Tue, 18 Nov 2014 17:29:57 -0500
Subject: [PATCH 10/84] Bug 1092260. Use
 PREVENT_INTERNAL_THREADING_OPTIMIZATIONS with D3D11. r=bas

Using this seems to avoid the AMD frame delay bug.

--HG--
extra : rebase_source : 1b867ebfef30d1c1a426c7510591770f362d2b28
---
 gfx/thebes/gfxWindowsPlatform.cpp |  5 ++++-
 widget/windows/GfxInfo.cpp        | 15 ---------------
 2 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index 9e29ccbffa3a..47a359f82243 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -1689,7 +1689,10 @@ gfxWindowsPlatform::InitD3D11Devices()
   HRESULT hr;
 
   hr = d3d11CreateDevice(adapter, D3D_DRIVER_TYPE_UNKNOWN, nullptr,
-                         D3D11_CREATE_DEVICE_BGRA_SUPPORT,
+                         // Use
+                         // D3D11_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS
+                         // to prevent bug 1092260. IE 11 also uses this flag.
+                         D3D11_CREATE_DEVICE_BGRA_SUPPORT | D3D11_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
                          featureLevels.Elements(), featureLevels.Length(),
                          D3D11_SDK_VERSION, byRef(mD3D11Device), nullptr, nullptr);
 
diff --git a/widget/windows/GfxInfo.cpp b/widget/windows/GfxInfo.cpp
index cf3aab7158ea..56fc261736d2 100644
--- a/widget/windows/GfxInfo.cpp
+++ b/widget/windows/GfxInfo.cpp
@@ -1013,21 +1013,6 @@ GfxInfo::GetGfxDriverInfo()
       nsIGfxInfo::FEATURE_DIRECT2D, nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION,
       DRIVER_BETWEEN_INCLUSIVE_START, V(14,1,0,0), V(14,2,0,0), "ATI Catalyst 14.6+");
 
-    // Disable acclerated layers on some ATI drivers because they add a frame of delay to D3D11 apps
-    // See bug 1092260
-    APPEND_TO_DRIVER_BLOCKLIST_RANGE( DRIVER_OS_ALL,
-        (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorATI), GfxDriverInfo::allDevices,
-      nsIGfxInfo::FEATURE_DIRECT2D, nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION,
-      DRIVER_BETWEEN_INCLUSIVE_START, V(8,653,0,0), V(8,691,0,0), "ATI Catalyst 14.6+");
-    APPEND_TO_DRIVER_BLOCKLIST_RANGE( DRIVER_OS_ALL,
-        (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorATI), GfxDriverInfo::allDevices,
-      nsIGfxInfo::FEATURE_DIRECT3D_11_LAYERS, nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION,
-      DRIVER_BETWEEN_INCLUSIVE_START, V(8,653,0,0), V(8,691,0,0), "ATI Catalyst 14.6+");
-    APPEND_TO_DRIVER_BLOCKLIST_RANGE( DRIVER_OS_ALL,
-        (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorATI), GfxDriverInfo::allDevices,
-      nsIGfxInfo::FEATURE_DIRECT3D_9_LAYERS, nsIGfxInfo::FEATURE_BLOCKED_DRIVER_VERSION,
-      DRIVER_BETWEEN_INCLUSIVE_START, V(8,653,0,0), V(8,691,0,0), "ATI Catalyst 14.6+");
-
     /* Disable D3D9 layers on NVIDIA 6100/6150/6200 series due to glitches
      * whilst scrolling. See bugs: 612007, 644787 & 645872.
      */

From 189663a6e76e17fc50dbe919e36feb353414124b Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 18 Nov 2014 15:52:28 -0700
Subject: [PATCH 11/84] Bug 1095952 - Don't use SingleObjectPolicy with
 StoreTypedArrayElementStatic or StoreTypedArrayElementHole.

---
 js/src/jit/TypePolicy.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index aa907583ea90..4ff4cdc0f073 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -736,8 +736,6 @@ bool
 StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins, int arrayType,
                                         MDefinition *value, int valueOperand)
 {
-    SingleObjectPolicy::staticAdjustInputs(alloc, ins);
-
     MDefinition *curValue = value;
     // First, ensure the value is int32, boolean, double or Value.
     // The conversion is based on TypedArrayObjectTemplate::setElementTail.
@@ -819,6 +817,8 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
 bool
 StoreTypedArrayPolicy::adjustInputs(TempAllocator &alloc, MInstruction *ins)
 {
+    SingleObjectPolicy::staticAdjustInputs(alloc, ins);
+
     MStoreTypedArrayElement *store = ins->toStoreTypedArrayElement();
     MOZ_ASSERT(IsValidElementsType(store->elements(), store->offsetAdjustment()));
     MOZ_ASSERT(store->index()->type() == MIRType_Int32);

From 25031cb91e62690dbf828ec24503fe6febc1a44b Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 18 Nov 2014 15:02:24 -0800
Subject: [PATCH 12/84] Bug 1100923 - Make onPromiseSettled() declaration
 JS_PUBLIC_API. r=fitzgen

---
 js/public/Debug.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/public/Debug.h b/js/public/Debug.h
index 440100774bdc..537b760f2613 100644
--- a/js/public/Debug.h
+++ b/js/public/Debug.h
@@ -289,7 +289,8 @@ onNewPromise(JSContext *cx, HandleObject promise);
 // It is Gecko's responsibility to ensure that this is never called on the same
 // promise more than once (because a promise can only make the transition from
 // unsettled to settled once).
-void onPromiseSettled(JSContext *cx, HandleObject promise);
+JS_PUBLIC_API(void)
+onPromiseSettled(JSContext *cx, HandleObject promise);
 
 } // namespace dbg
 } // namespace JS

From 8b68f6741c732ebde80036ca644cc9c8aec3a540 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Tue, 18 Nov 2014 13:56:46 -0800
Subject: [PATCH 13/84] Bug 1100652 - Simplify the store buffer implementation;
 r=sfink

--HG--
extra : rebase_source : 5df8784df384cc32e64b65903c501b84e255e073
---
 js/src/gc/StoreBuffer.cpp | 139 +++-----------------------------------
 js/src/gc/StoreBuffer.h   | 136 +++++++++++++++++--------------------
 2 files changed, 69 insertions(+), 206 deletions(-)

diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 0587e434f032..d262d43d1b56 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -22,7 +22,7 @@ using mozilla::ReentrancyGuard;
 /*** Edges ***/
 
 void
-StoreBuffer::SlotsEdge::mark(JSTracer *trc)
+StoreBuffer::SlotsEdge::mark(JSTracer *trc) const
 {
     NativeObject *obj = object();
 
@@ -48,7 +48,7 @@ StoreBuffer::SlotsEdge::mark(JSTracer *trc)
 }
 
 void
-StoreBuffer::WholeCellEdges::mark(JSTracer *trc)
+StoreBuffer::WholeCellEdges::mark(JSTracer *trc) const
 {
     MOZ_ASSERT(edge->isTenured());
     JSGCTraceKind kind = GetGCThingTraceKind(edge);
@@ -64,7 +64,7 @@ StoreBuffer::WholeCellEdges::mark(JSTracer *trc)
 }
 
 void
-StoreBuffer::CellPtrEdge::mark(JSTracer *trc)
+StoreBuffer::CellPtrEdge::mark(JSTracer *trc) const
 {
     if (!*edge)
         return;
@@ -74,7 +74,7 @@ StoreBuffer::CellPtrEdge::mark(JSTracer *trc)
 }
 
 void
-StoreBuffer::ValueEdge::mark(JSTracer *trc)
+StoreBuffer::ValueEdge::mark(JSTracer *trc) const
 {
     if (!deref())
         return;
@@ -84,135 +84,14 @@ StoreBuffer::ValueEdge::mark(JSTracer *trc)
 
 /*** MonoTypeBuffer ***/
 
-template <typename T>
-void
-StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
-{
-    if (!owner->isAboutToOverflow()) {
-        /*
-         * Compact the buffer now, and if that fails to free enough space then
-         * trigger a minor collection.
-         */
-        compact(owner);
-        if (isLowOnSpace())
-            owner->setAboutToOverflow();
-    } else {
-         /*
-          * A minor GC has already been triggered, so there's no point
-          * compacting unless the buffer is totally full.
-          */
-        if (storage_->availableInCurrentChunk() < sizeof(T))
-            maybeCompact(owner);
-    }
-}
-
-template <typename T>
-void
-StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
-{
-    typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> DedupSet;
-
-    DedupSet duplicates;
-    if (!duplicates.init())
-        return; /* Failure to de-dup is acceptable. */
-
-    LifoAlloc::Enum insert(*storage_);
-    for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
-        T *edge = e.get<T>();
-        if (!duplicates.has(*edge)) {
-            insert.updateFront<T>(*edge);
-            insert.popFront<T>();
-
-            /* Failure to insert will leave the set with duplicates. Oh well. */
-            duplicates.put(*edge);
-        }
-    }
-    storage_->release(insert.mark());
-
-    duplicates.clear();
-}
-
-template <typename T>
-void
-StoreBuffer::MonoTypeBuffer<T>::compact(StoreBuffer *owner)
-{
-    MOZ_ASSERT(storage_);
-    compactRemoveDuplicates(owner);
-    usedAtLastCompact_ = storage_->used();
-}
-
-template <typename T>
-void
-StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner)
-{
-    MOZ_ASSERT(storage_);
-    if (storage_->used() != usedAtLastCompact_)
-        compact(owner);
-}
-
 template <typename T>
 void
 StoreBuffer::MonoTypeBuffer<T>::mark(StoreBuffer *owner, JSTracer *trc)
 {
-    MOZ_ASSERT(owner->isEnabled());
-    ReentrancyGuard g(*owner);
-    if (!storage_)
-        return;
-
-    maybeCompact(owner);
-    for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
-        T *edge = e.get<T>();
-        edge->mark(trc);
-    }
-}
-
-/*** RelocatableMonoTypeBuffer ***/
-
-template <typename T>
-void
-StoreBuffer::RelocatableMonoTypeBuffer<T>::compactMoved(StoreBuffer *owner)
-{
-    LifoAlloc &storage = *this->storage_;
-    EdgeSet invalidated;
-    if (!invalidated.init())
-        CrashAtUnhandlableOOM("RelocatableMonoTypeBuffer::compactMoved: Failed to init table.");
-
-    /* Collect the set of entries which are currently invalid. */
-    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>()) {
-        T *edge = e.get<T>();
-        if (edge->isTagged()) {
-            if (!invalidated.put(edge->untagged().edge))
-                CrashAtUnhandlableOOM("RelocatableMonoTypeBuffer::compactMoved: Failed to put removal.");
-        } else {
-            invalidated.remove(edge->untagged().edge);
-        }
-    }
-
-    /* Remove all entries which are in the invalidated set. */
-    LifoAlloc::Enum insert(storage);
-    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>()) {
-        T *edge = e.get<T>();
-        if (!edge->isTagged() && !invalidated.has(edge->untagged().edge)) {
-            insert.updateFront<T>(*edge);
-            insert.popFront<T>();
-        }
-    }
-    storage.release(insert.mark());
-
-    invalidated.clear();
-
-#ifdef DEBUG
-    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>())
-        MOZ_ASSERT(!e.get<T>()->isTagged());
-#endif
-}
-
-template <typename T>
-void
-StoreBuffer::RelocatableMonoTypeBuffer<T>::compact(StoreBuffer *owner)
-{
-    compactMoved(owner);
-    StoreBuffer::MonoTypeBuffer<T>::compact(owner);
+    MOZ_ASSERT(stores_.initialized());
+    sinkStores(owner);
+    for (typename StoreSet::Range r = stores_.all(); !r.empty(); r.popFront())
+        r.front().mark(trc);
 }
 
 /*** GenericBuffer ***/
@@ -373,7 +252,5 @@ template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::ValueEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::CellPtrEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::SlotsEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::WholeCellEdges>;
-template struct StoreBuffer::RelocatableMonoTypeBuffer<StoreBuffer::ValueEdge>;
-template struct StoreBuffer::RelocatableMonoTypeBuffer<StoreBuffer::CellPtrEdge>;
 
 #endif /* JSGC_GENERATIONAL */
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index b5b19fb63457..98fb31fe246c 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -80,17 +80,6 @@ class StoreBuffer
     /* The size at which a block is about to overflow. */
     static const size_t LowAvailableThreshold = (size_t)(LifoAllocBlockSize * 1.0 / 16.0);
 
-    /*
-     * If the space available in the store buffer hits the
-     * LowAvailableThreshold and gets compacted, but still doesn't have at
-     * least HighAvailableThreshold space available, then we will trigger a
-     * minor GC. HighAvailableThreshold should be set to provide enough space
-     * for the mutator to run for a while in between compactions. (If
-     * HighAvailableThreshold is too low, we will thrash and spend most of the
-     * time compacting. If it is too high, we will tenure things too early.)
-     */
-    static const size_t HighAvailableThreshold = (size_t)(LifoAllocBlockSize * 1.0 / 4.0);
-
     /*
      * This buffer holds only a single type of edge. Using this buffer is more
      * efficient than the generic buffer when many writes will be to the same
@@ -99,89 +88,75 @@ class StoreBuffer
     template<typename T>
     struct MonoTypeBuffer
     {
-        LifoAlloc *storage_;
-        size_t usedAtLastCompact_;
+        /* The canonical set of stores. */
+        typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> StoreSet;
+        StoreSet stores_;
 
-        explicit MonoTypeBuffer() : storage_(nullptr), usedAtLastCompact_(0) {}
-        ~MonoTypeBuffer() { js_delete(storage_); }
+        /*
+         * A small, fixed-size buffer in front of the canonical set to simplify
+         * insertion via jit code.
+         */
+        const static size_t NumBufferEntries = 4096 / sizeof(T);
+        T buffer_[NumBufferEntries];
+        T *insert_;
+
+        /* Maximum number of entries before we request a minor GC. */
+        const static size_t MaxEntries = 48 * 1024 / sizeof(T);
+
+        explicit MonoTypeBuffer() : insert_(buffer_) {}
+        ~MonoTypeBuffer() { stores_.finish(); }
 
         bool init() {
-            if (!storage_)
-                storage_ = js_new<LifoAlloc>(LifoAllocBlockSize);
+            if (!stores_.initialized() && !stores_.init())
+                return false;
             clear();
-            return bool(storage_);
+            return true;
         }
 
         void clear() {
-            if (!storage_)
-                return;
-
-            storage_->used() ? storage_->releaseAll() : storage_->freeAll();
-            usedAtLastCompact_ = 0;
+            if (stores_.initialized())
+                stores_.clear();
         }
 
-        bool isAboutToOverflow() const {
-            return !storage_->isEmpty() && storage_->availableInCurrentChunk() < LowAvailableThreshold;
-        }
-
-        bool isLowOnSpace() const {
-            return !storage_->isEmpty() && storage_->availableInCurrentChunk() < HighAvailableThreshold;
-        }
-
-        void handleOverflow(StoreBuffer *owner);
-
-        /* Compaction algorithms. */
-        void compactRemoveDuplicates(StoreBuffer *owner);
-
-        /*
-         * Attempts to reduce the usage of the buffer by removing unnecessary
-         * entries.
-         */
-        virtual void compact(StoreBuffer *owner);
-
-        /* Compacts if any entries have been added since the last compaction. */
-        void maybeCompact(StoreBuffer *owner);
-
         /* Add one item to the buffer. */
         void put(StoreBuffer *owner, const T &t) {
-            MOZ_ASSERT(storage_);
+            MOZ_ASSERT(stores_.initialized());
+            *insert_++ = t;
+            if (MOZ_UNLIKELY(insert_ == buffer_ + NumBufferEntries))
+                sinkStores(owner);
+        }
 
-            T *tp = storage_->new_<T>(t);
-            if (!tp)
-                CrashAtUnhandlableOOM("Failed to allocate for MonoTypeBuffer::put.");
+        /* Move any buffered stores to the canonical store set. */
+        void sinkStores(StoreBuffer *owner) {
+            MOZ_ASSERT(stores_.initialized());
 
-            if (isAboutToOverflow())
-                handleOverflow(owner);
+            for (T *p = buffer_; p < insert_; ++p) {
+                if (!stores_.put(*p))
+                    CrashAtUnhandlableOOM("Failed to allocate for MonoTypeBuffer::sinkStores.");
+            }
+            insert_ = buffer_;
+
+            if (MOZ_UNLIKELY(stores_.count() > MaxEntries))
+                owner->setAboutToOverflow();
+        }
+
+        /* Remove an item from the store buffer. */
+        void unput(StoreBuffer *owner, const T &v) {
+            sinkStores(owner);
+            stores_.remove(v);
         }
 
         /* Mark the source of all edges in the store buffer. */
         void mark(StoreBuffer *owner, JSTracer *trc);
 
         size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) {
-            return storage_ ? storage_->sizeOfIncludingThis(mallocSizeOf) : 0;
+            return stores_.sizeOfExcludingThis(mallocSizeOf);
         }
 
       private:
         MonoTypeBuffer &operator=(const MonoTypeBuffer& other) MOZ_DELETE;
     };
 
-    /*
-     * Overrides the MonoTypeBuffer to support pointers that may be moved in
-     * memory outside of the GC's control.
-     */
-    template <typename T>
-    struct RelocatableMonoTypeBuffer : public MonoTypeBuffer<T>
-    {
-        /* Override compaction to filter out removed items. */
-        void compactMoved(StoreBuffer *owner);
-        virtual void compact(StoreBuffer *owner) MOZ_OVERRIDE;
-
-        /* Record a removal from the buffer. */
-        void unput(StoreBuffer *owner, const T &v) {
-            MonoTypeBuffer<T>::put(owner, v.tagged());
-        }
-    };
-
     struct GenericBuffer
     {
         LifoAlloc *storage_;
@@ -251,6 +226,7 @@ class StoreBuffer
     {
         Cell **edge;
 
+        CellPtrEdge() : edge(nullptr) {}
         explicit CellPtrEdge(Cell **v) : edge(v) {}
         bool operator==(const CellPtrEdge &other) const { return edge == other.edge; }
         bool operator!=(const CellPtrEdge &other) const { return edge != other.edge; }
@@ -260,7 +236,7 @@ class StoreBuffer
             return !nursery.isInside(edge);
         }
 
-        void mark(JSTracer *trc);
+        void mark(JSTracer *trc) const;
 
         CellPtrEdge tagged() const { return CellPtrEdge((Cell **)(uintptr_t(edge) | 1)); }
         CellPtrEdge untagged() const { return CellPtrEdge((Cell **)(uintptr_t(edge) & ~1)); }
@@ -273,6 +249,7 @@ class StoreBuffer
     {
         JS::Value *edge;
 
+        ValueEdge() : edge(nullptr) {}
         explicit ValueEdge(JS::Value *v) : edge(v) {}
         bool operator==(const ValueEdge &other) const { return edge == other.edge; }
         bool operator!=(const ValueEdge &other) const { return edge != other.edge; }
@@ -284,7 +261,7 @@ class StoreBuffer
             return !nursery.isInside(edge);
         }
 
-        void mark(JSTracer *trc);
+        void mark(JSTracer *trc) const;
 
         ValueEdge tagged() const { return ValueEdge((JS::Value *)(uintptr_t(edge) | 1)); }
         ValueEdge untagged() const { return ValueEdge((JS::Value *)(uintptr_t(edge) & ~1)); }
@@ -303,6 +280,7 @@ class StoreBuffer
         int32_t start_;
         int32_t count_;
 
+        SlotsEdge() : objectAndKind_(0), start_(0), count_(0) {}
         SlotsEdge(NativeObject *object, int kind, int32_t start, int32_t count)
           : objectAndKind_(uintptr_t(object) | kind), start_(start), count_(count)
         {
@@ -329,7 +307,7 @@ class StoreBuffer
             return !IsInsideNursery(JS::AsCell(reinterpret_cast<JSObject *>(object())));
         }
 
-        void mark(JSTracer *trc);
+        void mark(JSTracer *trc) const;
 
         typedef struct {
             typedef SlotsEdge Lookup;
@@ -342,6 +320,7 @@ class StoreBuffer
     {
         Cell *edge;
 
+        WholeCellEdges() : edge(nullptr) {}
         explicit WholeCellEdges(Cell *cell) : edge(cell) {
             MOZ_ASSERT(edge->isTenured());
         }
@@ -354,7 +333,7 @@ class StoreBuffer
         static bool supportsDeduplication() { return true; }
         void *deduplicationKey() const { return (void *)edge; }
 
-        void mark(JSTracer *trc);
+        void mark(JSTracer *trc) const;
 
         typedef PointerEdgeHasher<WholeCellEdges> Hasher;
     };
@@ -425,8 +404,8 @@ class StoreBuffer
     MonoTypeBuffer<CellPtrEdge> bufferCell;
     MonoTypeBuffer<SlotsEdge> bufferSlot;
     MonoTypeBuffer<WholeCellEdges> bufferWholeCell;
-    RelocatableMonoTypeBuffer<ValueEdge> bufferRelocVal;
-    RelocatableMonoTypeBuffer<CellPtrEdge> bufferRelocCell;
+    MonoTypeBuffer<ValueEdge> bufferRelocVal;
+    MonoTypeBuffer<CellPtrEdge> bufferRelocCell;
     GenericBuffer bufferGeneric;
 
     JSRuntime *runtime_;
@@ -505,6 +484,13 @@ class StoreBuffer
     /* For use by our owned buffers and for testing. */
     void setAboutToOverflow();
 
+    /* For jit access to the raw buffer. */
+    void oolSinkStoresForWholeCellBuffer() { bufferWholeCell.sinkStores(this); }
+    void *addressOfWholeCellBufferPointer() const { return (void *)&bufferWholeCell.insert_; }
+    void *addressOfWholeCellBufferEnd() const {
+        return (void *)(bufferWholeCell.buffer_ + bufferWholeCell.NumBufferEntries);
+    }
+
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::GCSizes *sizes);
 };
 

From 5b41e9bc9e36d456264a4046534a18d745326b22 Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Thu, 13 Nov 2014 18:20:38 -0800
Subject: [PATCH 14/84] Bug 1083285 - Fix noisy IndexedDB error, replace with
 better warning. r=khuey.

---
 dom/indexedDB/ActorsChild.cpp               |  13 ++-
 dom/indexedDB/IDBDatabase.cpp               | 100 ++++++++++++++++++--
 dom/indexedDB/IDBDatabase.h                 |   7 +-
 dom/indexedDB/IDBFactory.cpp                |  20 +++-
 dom/indexedDB/IDBFactory.h                  |  13 +++
 dom/indexedDB/IDBRequest.cpp                |  50 +++++-----
 dom/indexedDB/IDBRequest.h                  |   5 +-
 dom/indexedDB/IDBTransaction.cpp            |  16 ++++
 dom/indexedDB/IDBTransaction.h              |   8 ++
 dom/indexedDB/IndexedDatabaseManager.cpp    |   2 +-
 dom/locales/en-US/chrome/dom/dom.properties |   2 +
 11 files changed, 191 insertions(+), 45 deletions(-)

diff --git a/dom/indexedDB/ActorsChild.cpp b/dom/indexedDB/ActorsChild.cpp
index 221026679035..5fd0c120e9e3 100644
--- a/dom/indexedDB/ActorsChild.cpp
+++ b/dom/indexedDB/ActorsChild.cpp
@@ -1240,8 +1240,14 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   auto actor = static_cast<BackgroundVersionChangeTransactionChild*>(aActor);
 
+  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
+  MOZ_ASSERT(request);
+
   nsRefPtr<IDBTransaction> transaction =
-    IDBTransaction::CreateVersionChange(mDatabase, actor, aNextObjectStoreId,
+    IDBTransaction::CreateVersionChange(mDatabase,
+                                        actor,
+                                        request,
+                                        aNextObjectStoreId,
                                         aNextIndexId);
   if (NS_WARN_IF(!transaction)) {
     return false;
@@ -1253,9 +1259,6 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   mDatabase->EnterSetVersionTransaction(aRequestedVersion);
 
-  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
-  MOZ_ASSERT(request);
-
   request->SetTransaction(transaction);
 
   nsCOMPtr<nsIDOMEvent> upgradeNeededEvent =
@@ -1316,7 +1319,7 @@ BackgroundDatabaseChild::RecvVersionChange(const uint64_t& aOldVersion,
     if (shouldAbortAndClose) {
       // Invalidate() doesn't close the database in the parent, so we have
       // to call Close() and AbortTransactions() manually.
-      mDatabase->AbortTransactions();
+      mDatabase->AbortTransactions(/* aShouldWarn */ false);
       mDatabase->Close();
       return true;
     }
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 3826265d93ff..8dae654bfa01 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -39,9 +39,12 @@
 #include "mozilla/ipc/InputStreamParams.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "nsCOMPtr.h"
+#include "nsContentUtils.h"
+#include "nsIConsoleService.h"
 #include "nsIDocument.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
+#include "nsIScriptError.h"
 #include "nsISupportsPrimitives.h"
 #include "nsThreadUtils.h"
 #include "ProfilerHelpers.h"
@@ -314,7 +317,7 @@ IDBDatabase::InvalidateInternal()
   AssertIsOnOwningThread();
 
   InvalidateMutableFiles();
-  AbortTransactions();
+  AbortTransactions(/* aShouldWarn */ true);
 
   CloseInternal();
 }
@@ -751,7 +754,7 @@ IDBDatabase::UnregisterTransaction(IDBTransaction* aTransaction)
 }
 
 void
-IDBDatabase::AbortTransactions()
+IDBDatabase::AbortTransactions(bool aShouldWarn)
 {
   AssertIsOnOwningThread();
 
@@ -759,27 +762,31 @@ IDBDatabase::AbortTransactions()
   {
   public:
     static void
-    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable)
+    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable,
+                      nsTArray<nsRefPtr<IDBTransaction>>& aAbortedTransactions)
     {
       const uint32_t count = aTable.Count();
       if (!count) {
         return;
       }
 
-      nsTArray<nsRefPtr<IDBTransaction>> transactions;
+      nsAutoTArray<nsRefPtr<IDBTransaction>, 20> transactions;
       transactions.SetCapacity(count);
 
       aTable.EnumerateEntries(Collect, &transactions);
 
       MOZ_ASSERT(transactions.Length() == count);
 
-      IDB_REPORT_INTERNAL_ERR();
-
       for (uint32_t index = 0; index < count; index++) {
-        nsRefPtr<IDBTransaction> transaction = transactions[index].forget();
+        nsRefPtr<IDBTransaction> transaction = Move(transactions[index]);
         MOZ_ASSERT(transaction);
 
         transaction->Abort(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
+
+        // We only care about warning for write transactions.
+        if (transaction->GetMode() != IDBTransaction::READ_ONLY) {
+          aAbortedTransactions.AppendElement(Move(transaction));
+        }
       }
     }
 
@@ -798,7 +805,25 @@ IDBDatabase::AbortTransactions()
     }
   };
 
-  Helper::AbortTransactions(mTransactions);
+  nsAutoTArray<nsRefPtr<IDBTransaction>, 5> abortedTransactions;
+  Helper::AbortTransactions(mTransactions, abortedTransactions);
+
+  if (aShouldWarn && !abortedTransactions.IsEmpty()) {
+    static const char kWarningMessage[] = "IndexedDBTransactionAbortNavigation";
+
+    for (uint32_t count = abortedTransactions.Length(), index = 0;
+         index < count;
+         index++) {
+      nsRefPtr<IDBTransaction>& transaction = abortedTransactions[index];
+      MOZ_ASSERT(transaction);
+
+      nsString filename;
+      uint32_t lineNo;
+      transaction->GetCallerLocation(filename, &lineNo);
+
+      LogWarning(kWarningMessage, filename, lineNo);
+    }
+  }
 }
 
 PBackgroundIDBDatabaseFileChild*
@@ -1155,6 +1180,65 @@ IDBDatabase::Invalidate()
   }
 }
 
+void
+IDBDatabase::LogWarning(const char* aMessageName,
+                        const nsAString& aFilename,
+                        uint32_t aLineNumber)
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aMessageName);
+
+  // For now this is main-thread only.
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsXPIDLString localizedMessage;
+  if (NS_WARN_IF(NS_FAILED(
+    nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
+                                       aMessageName,
+                                       localizedMessage)))) {
+    return;
+  }
+
+  nsAutoCString category;
+  if (mFactory->IsChrome()) {
+    category.AssignLiteral("chrome ");
+  } else {
+    category.AssignLiteral("content ");
+  }
+  category.AppendLiteral("javascript");
+
+  nsCOMPtr<nsIConsoleService> consoleService =
+    do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+  MOZ_ASSERT(consoleService);
+
+  nsCOMPtr<nsIScriptError> scriptError =
+    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
+  MOZ_ASSERT(consoleService);
+
+  if (mFactory->GetParentObject()) {
+    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
+      scriptError->InitWithWindowID(localizedMessage,
+                                    aFilename,
+                                    /* aSourceLine */ EmptyString(),
+                                    aLineNumber,
+                                    /* aColumnNumber */ 0,
+                                    nsIScriptError::warningFlag,
+                                    category,
+                                    mFactory->InnerWindowID())));
+  } else {
+    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
+      scriptError->Init(localizedMessage,
+                        aFilename,
+                        /* aSourceLine */ EmptyString(),
+                        aLineNumber,
+                        /* aColumnNumber */ 0,
+                        nsIScriptError::warningFlag,
+                        category.get())));
+  }
+
+  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(consoleService->LogMessage(scriptError)));
+}
+
 NS_IMPL_ADDREF_INHERITED(IDBDatabase, IDBWrapperCache)
 NS_IMPL_RELEASE_INHERITED(IDBDatabase, IDBWrapperCache)
 
diff --git a/dom/indexedDB/IDBDatabase.h b/dom/indexedDB/IDBDatabase.h
index 811b7f2b8729..63f3ea727dcf 100644
--- a/dom/indexedDB/IDBDatabase.h
+++ b/dom/indexedDB/IDBDatabase.h
@@ -171,7 +171,7 @@ public:
   UnregisterTransaction(IDBTransaction* aTransaction);
 
   void
-  AbortTransactions();
+  AbortTransactions(bool aShouldWarn);
 
   PBackgroundIDBDatabaseFileChild*
   GetOrCreateFileActorForBlob(File* aBlob);
@@ -299,6 +299,11 @@ private:
 
   void
   InvalidateMutableFiles();
+
+  void
+  LogWarning(const char* aMessageName,
+             const nsAString& aFilename,
+             uint32_t aLineNumber);
 };
 
 } // namespace indexedDB
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index bf22ab5f3b70..bdab53dbed8d 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -29,7 +29,7 @@
 #include "ActorsChild.h"
 
 #ifdef DEBUG
-#include "nsContentUtils.h" // For IsCallerChrome assertions.
+#include "nsContentUtils.h" // For assertions.
 #endif
 
 namespace mozilla {
@@ -110,6 +110,7 @@ struct IDBFactory::PendingRequestInfo
 IDBFactory::IDBFactory()
   : mOwningObject(nullptr)
   , mBackgroundActor(nullptr)
+  , mInnerWindowID(0)
   , mBackgroundActorFailed(false)
   , mPrivateBrowsingMode(false)
 {
@@ -183,6 +184,7 @@ IDBFactory::CreateForWindow(nsPIDOMWindow* aWindow,
   factory->mPrincipalInfo = Move(principalInfo);
   factory->mWindow = aWindow;
   factory->mTabChild = TabChild::GetFrom(aWindow);
+  factory->mInnerWindowID = aWindow->WindowID();
   factory->mPrivateBrowsingMode = privateBrowsingMode;
 
   factory.forget(aFactory);
@@ -285,6 +287,15 @@ IDBFactory::AssertIsOnOwningThread() const
 
 #endif // DEBUG
 
+bool
+IDBFactory::IsChrome() const
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(mPrincipalInfo);
+
+  return mPrincipalInfo->type() == PrincipalInfo::TSystemPrincipalInfo;
+}
+
 void
 IDBFactory::SetBackgroundActor(BackgroundFactoryChild* aBackgroundActor)
 {
@@ -524,19 +535,20 @@ IDBFactory::OpenInternal(nsIPrincipal* aPrincipal,
   nsRefPtr<IDBOpenDBRequest> request;
 
   if (mWindow) {
-    if (NS_WARN_IF(!autoJS.Init(mWindow))) {
+    AutoJSContext cx;
+    if (NS_WARN_IF(!autoJS.Init(mWindow, cx))) {
       IDB_REPORT_INTERNAL_ERR();
       aRv.Throw(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
       return nullptr;
     }
 
-    JS::Rooted<JSObject*> scriptOwner(autoJS.cx(),
+    JS::Rooted<JSObject*> scriptOwner(cx,
       static_cast<nsGlobalWindow*>(mWindow.get())->FastGetGlobalJSObject());
     MOZ_ASSERT(scriptOwner);
 
     request = IDBOpenDBRequest::CreateForWindow(this, mWindow, scriptOwner);
   } else {
-    autoJS.Init();
+    autoJS.Init(mOwningObject.get());
     JS::Rooted<JSObject*> scriptOwner(autoJS.cx(), mOwningObject);
 
     request = IDBOpenDBRequest::CreateForJS(this, scriptOwner);
diff --git a/dom/indexedDB/IDBFactory.h b/dom/indexedDB/IDBFactory.h
index 69952a4158da..b88d055195bd 100644
--- a/dom/indexedDB/IDBFactory.h
+++ b/dom/indexedDB/IDBFactory.h
@@ -73,6 +73,8 @@ class IDBFactory MOZ_FINAL
   PRThread* mOwningThread;
 #endif
 
+  uint64_t mInnerWindowID;
+
   bool mBackgroundActorFailed;
   bool mPrivateBrowsingMode;
 
@@ -130,6 +132,17 @@ public:
     return mPrincipalInfo;
   }
 
+  uint64_t
+  InnerWindowID() const
+  {
+    AssertIsOnOwningThread();
+
+    return mInnerWindowID;
+  }
+
+  bool
+  IsChrome() const;
+
   already_AddRefed<IDBOpenDBRequest>
   Open(const nsAString& aName,
        uint64_t aVersion,
diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
index 2f360ab995cd..388e8046131a 100644
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@@ -99,12 +99,11 @@ IDBRequest::Create(IDBDatabase* aDatabase,
   aDatabase->AssertIsOnOwningThread();
 
   nsRefPtr<IDBRequest> request = new IDBRequest(aDatabase);
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->mTransaction = aTransaction;
   request->SetScriptOwner(aDatabase->GetScriptOwner());
 
-  request->CaptureCaller();
-
   return request.forget();
 }
 
@@ -140,6 +139,26 @@ IDBRequest::Create(IDBIndex* aSourceAsIndex,
   return request.forget();
 }
 
+// static
+void
+IDBRequest::CaptureCaller(nsAString& aFilename, uint32_t* aLineNo)
+{
+  MOZ_ASSERT(aFilename.IsEmpty());
+  MOZ_ASSERT(aLineNo);
+
+  ThreadsafeAutoJSContext cx;
+
+  const char* filename = nullptr;
+  uint32_t lineNo = 0;
+  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
+    *aLineNo = 0;
+    return;
+  }
+
+  aFilename.Assign(NS_ConvertUTF8toUTF16(filename));
+  *aLineNo = lineNo;
+}
+
 void
 IDBRequest::GetSource(
              Nullable<OwningIDBObjectStoreOrIDBIndexOrIDBCursor>& aSource) const
@@ -227,25 +246,13 @@ IDBRequest::GetErrorCode() const
 #endif // DEBUG
 
 void
-IDBRequest::CaptureCaller()
+IDBRequest::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
 {
-  AutoJSContext cx;
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aLineNo);
 
-  const char* filename = nullptr;
-  uint32_t lineNo = 0;
-  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
-    return;
-  }
-
-  mFilename.Assign(NS_ConvertUTF8toUTF16(filename));
-  mLineNo = lineNo;
-}
-
-void
-IDBRequest::FillScriptErrorEvent(ErrorEventInit& aEventInit) const
-{
-  aEventInit.mLineno = mLineNo;
-  aEventInit.mFilename = mFilename;
+  aFilename = mFilename;
+  *aLineNo = mLineNo;
 }
 
 IDBRequestReadyState
@@ -301,7 +308,6 @@ IDBRequest::SetResultCallback(ResultCallback* aCallback)
 
   // See if our window is still valid.
   if (NS_WARN_IF(NS_FAILED(CheckInnerWindowCorrectness()))) {
-    IDB_REPORT_INTERNAL_ERR();
     SetError(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
     return;
   }
@@ -424,7 +430,7 @@ IDBOpenDBRequest::CreateForWindow(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, aOwner);
-  request->CaptureCaller();
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->SetScriptOwner(aScriptOwner);
 
@@ -441,7 +447,7 @@ IDBOpenDBRequest::CreateForJS(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, nullptr);
-  request->CaptureCaller();
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->SetScriptOwner(aScriptOwner);
 
diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
index eda2d4e41cf9..3eba21c30a96 100644
--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@@ -114,7 +114,7 @@ public:
   GetError(ErrorResult& aRv);
 
   void
-  FillScriptErrorEvent(ErrorEventInit& aEventInit) const;
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
 
   bool
   IsPending() const
@@ -189,9 +189,6 @@ protected:
 
   void
   ConstructResult();
-
-  void
-  CaptureCaller();
 };
 
 class NS_NO_VTABLE IDBRequest::ResultCallback
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index b210e7bda2f6..a914dc1b2f86 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -48,6 +48,7 @@ IDBTransaction::IDBTransaction(IDBDatabase* aDatabase,
   , mNextIndexId(0)
   , mAbortCode(NS_OK)
   , mPendingRequestCount(0)
+  , mLineNo(0)
   , mReadyState(IDBTransaction::INITIAL)
   , mMode(aMode)
   , mCreating(false)
@@ -127,12 +128,14 @@ already_AddRefed<IDBTransaction>
 IDBTransaction::CreateVersionChange(
                                 IDBDatabase* aDatabase,
                                 BackgroundVersionChangeTransactionChild* aActor,
+                                IDBOpenDBRequest* aOpenRequest,
                                 int64_t aNextObjectStoreId,
                                 int64_t aNextIndexId)
 {
   MOZ_ASSERT(aDatabase);
   aDatabase->AssertIsOnOwningThread();
   MOZ_ASSERT(aActor);
+  MOZ_ASSERT(aOpenRequest);
   MOZ_ASSERT(aNextObjectStoreId > 0);
   MOZ_ASSERT(aNextIndexId > 0);
 
@@ -140,6 +143,8 @@ IDBTransaction::CreateVersionChange(
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, emptyObjectStoreNames, VERSION_CHANGE);
+  aOpenRequest->GetCallerLocation(transaction->mFilename,
+                                  &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
   transaction->mBackgroundActor.mVersionChangeBackgroundActor = aActor;
@@ -175,6 +180,7 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, aObjectStoreNames, aMode);
+  IDBRequest::CaptureCaller(transaction->mFilename, &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
 
@@ -391,6 +397,16 @@ IDBTransaction::IsOpen() const
   return false;
 }
 
+void
+IDBTransaction::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aLineNo);
+
+  aFilename = mFilename;
+  *aLineNo = mLineNo;
+}
+
 already_AddRefed<IDBObjectStore>
 IDBTransaction::CreateObjectStore(const ObjectStoreSpec& aSpec)
 {
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index 2624afaff78a..476489b12ec0 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -37,6 +37,7 @@ class BackgroundTransactionChild;
 class BackgroundVersionChangeTransactionChild;
 class IDBDatabase;
 class IDBObjectStore;
+class IDBOpenDBRequest;
 class IDBRequest;
 class IndexMetadata;
 class ObjectStoreSpec;
@@ -94,6 +95,9 @@ private:
   nsresult mAbortCode;
   uint32_t mPendingRequestCount;
 
+  nsString mFilename;
+  uint32_t mLineNo;
+
   ReadyState mReadyState;
   Mode mMode;
 
@@ -109,6 +113,7 @@ public:
   static already_AddRefed<IDBTransaction>
   CreateVersionChange(IDBDatabase* aDatabase,
                       BackgroundVersionChangeTransactionChild* aActor,
+                      IDBOpenDBRequest* aOpenRequest,
                       int64_t aNextObjectStoreId,
                       int64_t aNextIndexId);
 
@@ -184,6 +189,9 @@ public:
     return NS_FAILED(mAbortCode);
   }
 
+  void
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
+
   // 'Get' prefix is to avoid name collisions with the enum
   Mode
   GetMode() const
diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
index 13f969b5e64c..0e72c817df50 100644
--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@@ -366,7 +366,7 @@ IndexedDatabaseManager::FireWindowOnError(nsPIDOMWindow* aOwner,
 
   ThreadsafeAutoJSContext cx;
   RootedDictionary<ErrorEventInit> init(cx);
-  request->FillScriptErrorEvent(init);
+  request->GetCallerLocation(init.mFilename, &init.mLineno);
 
   init.mMessage = errorName;
   init.mCancelable = true;
diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties
index 357a52e06c9c..9c68b3392b80 100644
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -209,3 +209,5 @@ KeyNameZoomWarning=KeyboardEvent.key value "Zoom" is obsolete and will be rename
 KeyNameDeadKeysWarning=KeyboardEvent.key values starting with "Dead" are obsolete and will be merged into just "Dead". For more help https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.key
 ImportXULIntoContentWarning=Importing XUL nodes into a content document is deprecated. This functionality may be removed soon.
 XMLDocumentLoadPrincipalMismatch=Use of document.load forbidden on Documents that come from other Windows. Only the Window in which a Document was created is allowed to call .load on that Document. Preferably, use XMLHttpRequest instead.
+# LOCALIZATION NOTE: Do not translate "IndexedDB".
+IndexedDBTransactionAbortNavigation=An IndexedDB transaction that was not yet complete has been aborted due to page navigation.
\ No newline at end of file

From a7a427d424f23200b7aae0cb6ccf95b40dc1827a Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 18 Nov 2014 15:47:57 -0800
Subject: [PATCH 15/84] Backed out changeset f5ed560d297f (bug 1083285) for
 build bustage

---
 dom/indexedDB/ActorsChild.cpp               |  13 +--
 dom/indexedDB/IDBDatabase.cpp               | 100 ++------------------
 dom/indexedDB/IDBDatabase.h                 |   7 +-
 dom/indexedDB/IDBFactory.cpp                |  20 +---
 dom/indexedDB/IDBFactory.h                  |  13 ---
 dom/indexedDB/IDBRequest.cpp                |  50 +++++-----
 dom/indexedDB/IDBRequest.h                  |   5 +-
 dom/indexedDB/IDBTransaction.cpp            |  16 ----
 dom/indexedDB/IDBTransaction.h              |   8 --
 dom/indexedDB/IndexedDatabaseManager.cpp    |   2 +-
 dom/locales/en-US/chrome/dom/dom.properties |   2 -
 11 files changed, 45 insertions(+), 191 deletions(-)

diff --git a/dom/indexedDB/ActorsChild.cpp b/dom/indexedDB/ActorsChild.cpp
index 5fd0c120e9e3..221026679035 100644
--- a/dom/indexedDB/ActorsChild.cpp
+++ b/dom/indexedDB/ActorsChild.cpp
@@ -1240,14 +1240,8 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   auto actor = static_cast<BackgroundVersionChangeTransactionChild*>(aActor);
 
-  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
-  MOZ_ASSERT(request);
-
   nsRefPtr<IDBTransaction> transaction =
-    IDBTransaction::CreateVersionChange(mDatabase,
-                                        actor,
-                                        request,
-                                        aNextObjectStoreId,
+    IDBTransaction::CreateVersionChange(mDatabase, actor, aNextObjectStoreId,
                                         aNextIndexId);
   if (NS_WARN_IF(!transaction)) {
     return false;
@@ -1259,6 +1253,9 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   mDatabase->EnterSetVersionTransaction(aRequestedVersion);
 
+  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
+  MOZ_ASSERT(request);
+
   request->SetTransaction(transaction);
 
   nsCOMPtr<nsIDOMEvent> upgradeNeededEvent =
@@ -1319,7 +1316,7 @@ BackgroundDatabaseChild::RecvVersionChange(const uint64_t& aOldVersion,
     if (shouldAbortAndClose) {
       // Invalidate() doesn't close the database in the parent, so we have
       // to call Close() and AbortTransactions() manually.
-      mDatabase->AbortTransactions(/* aShouldWarn */ false);
+      mDatabase->AbortTransactions();
       mDatabase->Close();
       return true;
     }
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 8dae654bfa01..3826265d93ff 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -39,12 +39,9 @@
 #include "mozilla/ipc/InputStreamParams.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "nsCOMPtr.h"
-#include "nsContentUtils.h"
-#include "nsIConsoleService.h"
 #include "nsIDocument.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
-#include "nsIScriptError.h"
 #include "nsISupportsPrimitives.h"
 #include "nsThreadUtils.h"
 #include "ProfilerHelpers.h"
@@ -317,7 +314,7 @@ IDBDatabase::InvalidateInternal()
   AssertIsOnOwningThread();
 
   InvalidateMutableFiles();
-  AbortTransactions(/* aShouldWarn */ true);
+  AbortTransactions();
 
   CloseInternal();
 }
@@ -754,7 +751,7 @@ IDBDatabase::UnregisterTransaction(IDBTransaction* aTransaction)
 }
 
 void
-IDBDatabase::AbortTransactions(bool aShouldWarn)
+IDBDatabase::AbortTransactions()
 {
   AssertIsOnOwningThread();
 
@@ -762,31 +759,27 @@ IDBDatabase::AbortTransactions(bool aShouldWarn)
   {
   public:
     static void
-    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable,
-                      nsTArray<nsRefPtr<IDBTransaction>>& aAbortedTransactions)
+    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable)
     {
       const uint32_t count = aTable.Count();
       if (!count) {
         return;
       }
 
-      nsAutoTArray<nsRefPtr<IDBTransaction>, 20> transactions;
+      nsTArray<nsRefPtr<IDBTransaction>> transactions;
       transactions.SetCapacity(count);
 
       aTable.EnumerateEntries(Collect, &transactions);
 
       MOZ_ASSERT(transactions.Length() == count);
 
+      IDB_REPORT_INTERNAL_ERR();
+
       for (uint32_t index = 0; index < count; index++) {
-        nsRefPtr<IDBTransaction> transaction = Move(transactions[index]);
+        nsRefPtr<IDBTransaction> transaction = transactions[index].forget();
         MOZ_ASSERT(transaction);
 
         transaction->Abort(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
-
-        // We only care about warning for write transactions.
-        if (transaction->GetMode() != IDBTransaction::READ_ONLY) {
-          aAbortedTransactions.AppendElement(Move(transaction));
-        }
       }
     }
 
@@ -805,25 +798,7 @@ IDBDatabase::AbortTransactions(bool aShouldWarn)
     }
   };
 
-  nsAutoTArray<nsRefPtr<IDBTransaction>, 5> abortedTransactions;
-  Helper::AbortTransactions(mTransactions, abortedTransactions);
-
-  if (aShouldWarn && !abortedTransactions.IsEmpty()) {
-    static const char kWarningMessage[] = "IndexedDBTransactionAbortNavigation";
-
-    for (uint32_t count = abortedTransactions.Length(), index = 0;
-         index < count;
-         index++) {
-      nsRefPtr<IDBTransaction>& transaction = abortedTransactions[index];
-      MOZ_ASSERT(transaction);
-
-      nsString filename;
-      uint32_t lineNo;
-      transaction->GetCallerLocation(filename, &lineNo);
-
-      LogWarning(kWarningMessage, filename, lineNo);
-    }
-  }
+  Helper::AbortTransactions(mTransactions);
 }
 
 PBackgroundIDBDatabaseFileChild*
@@ -1180,65 +1155,6 @@ IDBDatabase::Invalidate()
   }
 }
 
-void
-IDBDatabase::LogWarning(const char* aMessageName,
-                        const nsAString& aFilename,
-                        uint32_t aLineNumber)
-{
-  AssertIsOnOwningThread();
-  MOZ_ASSERT(aMessageName);
-
-  // For now this is main-thread only.
-  MOZ_ASSERT(NS_IsMainThread());
-
-  nsXPIDLString localizedMessage;
-  if (NS_WARN_IF(NS_FAILED(
-    nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-                                       aMessageName,
-                                       localizedMessage)))) {
-    return;
-  }
-
-  nsAutoCString category;
-  if (mFactory->IsChrome()) {
-    category.AssignLiteral("chrome ");
-  } else {
-    category.AssignLiteral("content ");
-  }
-  category.AppendLiteral("javascript");
-
-  nsCOMPtr<nsIConsoleService> consoleService =
-    do_GetService(NS_CONSOLESERVICE_CONTRACTID);
-  MOZ_ASSERT(consoleService);
-
-  nsCOMPtr<nsIScriptError> scriptError =
-    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
-  MOZ_ASSERT(consoleService);
-
-  if (mFactory->GetParentObject()) {
-    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
-      scriptError->InitWithWindowID(localizedMessage,
-                                    aFilename,
-                                    /* aSourceLine */ EmptyString(),
-                                    aLineNumber,
-                                    /* aColumnNumber */ 0,
-                                    nsIScriptError::warningFlag,
-                                    category,
-                                    mFactory->InnerWindowID())));
-  } else {
-    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
-      scriptError->Init(localizedMessage,
-                        aFilename,
-                        /* aSourceLine */ EmptyString(),
-                        aLineNumber,
-                        /* aColumnNumber */ 0,
-                        nsIScriptError::warningFlag,
-                        category.get())));
-  }
-
-  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(consoleService->LogMessage(scriptError)));
-}
-
 NS_IMPL_ADDREF_INHERITED(IDBDatabase, IDBWrapperCache)
 NS_IMPL_RELEASE_INHERITED(IDBDatabase, IDBWrapperCache)
 
diff --git a/dom/indexedDB/IDBDatabase.h b/dom/indexedDB/IDBDatabase.h
index 63f3ea727dcf..811b7f2b8729 100644
--- a/dom/indexedDB/IDBDatabase.h
+++ b/dom/indexedDB/IDBDatabase.h
@@ -171,7 +171,7 @@ public:
   UnregisterTransaction(IDBTransaction* aTransaction);
 
   void
-  AbortTransactions(bool aShouldWarn);
+  AbortTransactions();
 
   PBackgroundIDBDatabaseFileChild*
   GetOrCreateFileActorForBlob(File* aBlob);
@@ -299,11 +299,6 @@ private:
 
   void
   InvalidateMutableFiles();
-
-  void
-  LogWarning(const char* aMessageName,
-             const nsAString& aFilename,
-             uint32_t aLineNumber);
 };
 
 } // namespace indexedDB
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index bdab53dbed8d..bf22ab5f3b70 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -29,7 +29,7 @@
 #include "ActorsChild.h"
 
 #ifdef DEBUG
-#include "nsContentUtils.h" // For assertions.
+#include "nsContentUtils.h" // For IsCallerChrome assertions.
 #endif
 
 namespace mozilla {
@@ -110,7 +110,6 @@ struct IDBFactory::PendingRequestInfo
 IDBFactory::IDBFactory()
   : mOwningObject(nullptr)
   , mBackgroundActor(nullptr)
-  , mInnerWindowID(0)
   , mBackgroundActorFailed(false)
   , mPrivateBrowsingMode(false)
 {
@@ -184,7 +183,6 @@ IDBFactory::CreateForWindow(nsPIDOMWindow* aWindow,
   factory->mPrincipalInfo = Move(principalInfo);
   factory->mWindow = aWindow;
   factory->mTabChild = TabChild::GetFrom(aWindow);
-  factory->mInnerWindowID = aWindow->WindowID();
   factory->mPrivateBrowsingMode = privateBrowsingMode;
 
   factory.forget(aFactory);
@@ -287,15 +285,6 @@ IDBFactory::AssertIsOnOwningThread() const
 
 #endif // DEBUG
 
-bool
-IDBFactory::IsChrome() const
-{
-  AssertIsOnOwningThread();
-  MOZ_ASSERT(mPrincipalInfo);
-
-  return mPrincipalInfo->type() == PrincipalInfo::TSystemPrincipalInfo;
-}
-
 void
 IDBFactory::SetBackgroundActor(BackgroundFactoryChild* aBackgroundActor)
 {
@@ -535,20 +524,19 @@ IDBFactory::OpenInternal(nsIPrincipal* aPrincipal,
   nsRefPtr<IDBOpenDBRequest> request;
 
   if (mWindow) {
-    AutoJSContext cx;
-    if (NS_WARN_IF(!autoJS.Init(mWindow, cx))) {
+    if (NS_WARN_IF(!autoJS.Init(mWindow))) {
       IDB_REPORT_INTERNAL_ERR();
       aRv.Throw(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
       return nullptr;
     }
 
-    JS::Rooted<JSObject*> scriptOwner(cx,
+    JS::Rooted<JSObject*> scriptOwner(autoJS.cx(),
       static_cast<nsGlobalWindow*>(mWindow.get())->FastGetGlobalJSObject());
     MOZ_ASSERT(scriptOwner);
 
     request = IDBOpenDBRequest::CreateForWindow(this, mWindow, scriptOwner);
   } else {
-    autoJS.Init(mOwningObject.get());
+    autoJS.Init();
     JS::Rooted<JSObject*> scriptOwner(autoJS.cx(), mOwningObject);
 
     request = IDBOpenDBRequest::CreateForJS(this, scriptOwner);
diff --git a/dom/indexedDB/IDBFactory.h b/dom/indexedDB/IDBFactory.h
index b88d055195bd..69952a4158da 100644
--- a/dom/indexedDB/IDBFactory.h
+++ b/dom/indexedDB/IDBFactory.h
@@ -73,8 +73,6 @@ class IDBFactory MOZ_FINAL
   PRThread* mOwningThread;
 #endif
 
-  uint64_t mInnerWindowID;
-
   bool mBackgroundActorFailed;
   bool mPrivateBrowsingMode;
 
@@ -132,17 +130,6 @@ public:
     return mPrincipalInfo;
   }
 
-  uint64_t
-  InnerWindowID() const
-  {
-    AssertIsOnOwningThread();
-
-    return mInnerWindowID;
-  }
-
-  bool
-  IsChrome() const;
-
   already_AddRefed<IDBOpenDBRequest>
   Open(const nsAString& aName,
        uint64_t aVersion,
diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
index 388e8046131a..2f360ab995cd 100644
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@@ -99,11 +99,12 @@ IDBRequest::Create(IDBDatabase* aDatabase,
   aDatabase->AssertIsOnOwningThread();
 
   nsRefPtr<IDBRequest> request = new IDBRequest(aDatabase);
-  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->mTransaction = aTransaction;
   request->SetScriptOwner(aDatabase->GetScriptOwner());
 
+  request->CaptureCaller();
+
   return request.forget();
 }
 
@@ -139,26 +140,6 @@ IDBRequest::Create(IDBIndex* aSourceAsIndex,
   return request.forget();
 }
 
-// static
-void
-IDBRequest::CaptureCaller(nsAString& aFilename, uint32_t* aLineNo)
-{
-  MOZ_ASSERT(aFilename.IsEmpty());
-  MOZ_ASSERT(aLineNo);
-
-  ThreadsafeAutoJSContext cx;
-
-  const char* filename = nullptr;
-  uint32_t lineNo = 0;
-  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
-    *aLineNo = 0;
-    return;
-  }
-
-  aFilename.Assign(NS_ConvertUTF8toUTF16(filename));
-  *aLineNo = lineNo;
-}
-
 void
 IDBRequest::GetSource(
              Nullable<OwningIDBObjectStoreOrIDBIndexOrIDBCursor>& aSource) const
@@ -246,13 +227,25 @@ IDBRequest::GetErrorCode() const
 #endif // DEBUG
 
 void
-IDBRequest::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
+IDBRequest::CaptureCaller()
 {
-  AssertIsOnOwningThread();
-  MOZ_ASSERT(aLineNo);
+  AutoJSContext cx;
 
-  aFilename = mFilename;
-  *aLineNo = mLineNo;
+  const char* filename = nullptr;
+  uint32_t lineNo = 0;
+  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
+    return;
+  }
+
+  mFilename.Assign(NS_ConvertUTF8toUTF16(filename));
+  mLineNo = lineNo;
+}
+
+void
+IDBRequest::FillScriptErrorEvent(ErrorEventInit& aEventInit) const
+{
+  aEventInit.mLineno = mLineNo;
+  aEventInit.mFilename = mFilename;
 }
 
 IDBRequestReadyState
@@ -308,6 +301,7 @@ IDBRequest::SetResultCallback(ResultCallback* aCallback)
 
   // See if our window is still valid.
   if (NS_WARN_IF(NS_FAILED(CheckInnerWindowCorrectness()))) {
+    IDB_REPORT_INTERNAL_ERR();
     SetError(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
     return;
   }
@@ -430,7 +424,7 @@ IDBOpenDBRequest::CreateForWindow(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, aOwner);
-  CaptureCaller(request->mFilename, &request->mLineNo);
+  request->CaptureCaller();
 
   request->SetScriptOwner(aScriptOwner);
 
@@ -447,7 +441,7 @@ IDBOpenDBRequest::CreateForJS(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, nullptr);
-  CaptureCaller(request->mFilename, &request->mLineNo);
+  request->CaptureCaller();
 
   request->SetScriptOwner(aScriptOwner);
 
diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
index 3eba21c30a96..eda2d4e41cf9 100644
--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@@ -114,7 +114,7 @@ public:
   GetError(ErrorResult& aRv);
 
   void
-  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
+  FillScriptErrorEvent(ErrorEventInit& aEventInit) const;
 
   bool
   IsPending() const
@@ -189,6 +189,9 @@ protected:
 
   void
   ConstructResult();
+
+  void
+  CaptureCaller();
 };
 
 class NS_NO_VTABLE IDBRequest::ResultCallback
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index a914dc1b2f86..b210e7bda2f6 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -48,7 +48,6 @@ IDBTransaction::IDBTransaction(IDBDatabase* aDatabase,
   , mNextIndexId(0)
   , mAbortCode(NS_OK)
   , mPendingRequestCount(0)
-  , mLineNo(0)
   , mReadyState(IDBTransaction::INITIAL)
   , mMode(aMode)
   , mCreating(false)
@@ -128,14 +127,12 @@ already_AddRefed<IDBTransaction>
 IDBTransaction::CreateVersionChange(
                                 IDBDatabase* aDatabase,
                                 BackgroundVersionChangeTransactionChild* aActor,
-                                IDBOpenDBRequest* aOpenRequest,
                                 int64_t aNextObjectStoreId,
                                 int64_t aNextIndexId)
 {
   MOZ_ASSERT(aDatabase);
   aDatabase->AssertIsOnOwningThread();
   MOZ_ASSERT(aActor);
-  MOZ_ASSERT(aOpenRequest);
   MOZ_ASSERT(aNextObjectStoreId > 0);
   MOZ_ASSERT(aNextIndexId > 0);
 
@@ -143,8 +140,6 @@ IDBTransaction::CreateVersionChange(
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, emptyObjectStoreNames, VERSION_CHANGE);
-  aOpenRequest->GetCallerLocation(transaction->mFilename,
-                                  &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
   transaction->mBackgroundActor.mVersionChangeBackgroundActor = aActor;
@@ -180,7 +175,6 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, aObjectStoreNames, aMode);
-  IDBRequest::CaptureCaller(transaction->mFilename, &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
 
@@ -397,16 +391,6 @@ IDBTransaction::IsOpen() const
   return false;
 }
 
-void
-IDBTransaction::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
-{
-  AssertIsOnOwningThread();
-  MOZ_ASSERT(aLineNo);
-
-  aFilename = mFilename;
-  *aLineNo = mLineNo;
-}
-
 already_AddRefed<IDBObjectStore>
 IDBTransaction::CreateObjectStore(const ObjectStoreSpec& aSpec)
 {
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index 476489b12ec0..2624afaff78a 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -37,7 +37,6 @@ class BackgroundTransactionChild;
 class BackgroundVersionChangeTransactionChild;
 class IDBDatabase;
 class IDBObjectStore;
-class IDBOpenDBRequest;
 class IDBRequest;
 class IndexMetadata;
 class ObjectStoreSpec;
@@ -95,9 +94,6 @@ private:
   nsresult mAbortCode;
   uint32_t mPendingRequestCount;
 
-  nsString mFilename;
-  uint32_t mLineNo;
-
   ReadyState mReadyState;
   Mode mMode;
 
@@ -113,7 +109,6 @@ public:
   static already_AddRefed<IDBTransaction>
   CreateVersionChange(IDBDatabase* aDatabase,
                       BackgroundVersionChangeTransactionChild* aActor,
-                      IDBOpenDBRequest* aOpenRequest,
                       int64_t aNextObjectStoreId,
                       int64_t aNextIndexId);
 
@@ -189,9 +184,6 @@ public:
     return NS_FAILED(mAbortCode);
   }
 
-  void
-  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
-
   // 'Get' prefix is to avoid name collisions with the enum
   Mode
   GetMode() const
diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
index 0e72c817df50..13f969b5e64c 100644
--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@@ -366,7 +366,7 @@ IndexedDatabaseManager::FireWindowOnError(nsPIDOMWindow* aOwner,
 
   ThreadsafeAutoJSContext cx;
   RootedDictionary<ErrorEventInit> init(cx);
-  request->GetCallerLocation(init.mFilename, &init.mLineno);
+  request->FillScriptErrorEvent(init);
 
   init.mMessage = errorName;
   init.mCancelable = true;
diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties
index 9c68b3392b80..357a52e06c9c 100644
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -209,5 +209,3 @@ KeyNameZoomWarning=KeyboardEvent.key value "Zoom" is obsolete and will be rename
 KeyNameDeadKeysWarning=KeyboardEvent.key values starting with "Dead" are obsolete and will be merged into just "Dead". For more help https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.key
 ImportXULIntoContentWarning=Importing XUL nodes into a content document is deprecated. This functionality may be removed soon.
 XMLDocumentLoadPrincipalMismatch=Use of document.load forbidden on Documents that come from other Windows. Only the Window in which a Document was created is allowed to call .load on that Document. Preferably, use XMLHttpRequest instead.
-# LOCALIZATION NOTE: Do not translate "IndexedDB".
-IndexedDBTransactionAbortNavigation=An IndexedDB transaction that was not yet complete has been aborted due to page navigation.
\ No newline at end of file

From 528b775249a840da93d9fa888af1c42d3d490f43 Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Tue, 18 Nov 2014 13:04:33 -0500
Subject: [PATCH 16/84] bug 1088148 - disable ipc accessibility messages for
 now to make crashes go away r=davidb

---
 accessible/base/nsAccessibilityService.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/accessible/base/nsAccessibilityService.h b/accessible/base/nsAccessibilityService.h
index 1ab0ee6f8559..ab791d8fb63b 100644
--- a/accessible/base/nsAccessibilityService.h
+++ b/accessible/base/nsAccessibilityService.h
@@ -251,6 +251,8 @@ GetAccService()
 inline bool
 IPCAccessibilityActive()
 {
+  // XXX temporarily disable ipc accessibility because of crashes.
+return false;
 #ifdef MOZ_B2G
   return false;
 #else

From f7ea8389878111b3da9d2e5b36a19fbafaf82df6 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 16:20:59 -0800
Subject: [PATCH 17/84] Bug 1099416 - [e10s] Make sure add-on shims are always
 enabled (r=ally)

---
 toolkit/content/browser-child.js | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index ea41d00bf957..6656fea733f6 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -416,16 +416,10 @@ addMessageListener("Browser:Thumbnail:Request", function (aMessage) {
 
 // The AddonsChild needs to be rooted so that it stays alive as long as
 // the tab.
-let AddonsChild;
-if (Services.appinfo.browserTabsRemoteAutostart) {
-  // Currently, the addon shims are only supported when autostarting
-  // with remote tabs.
-  AddonsChild = RemoteAddonsChild.init(this);
-
-  addEventListener("unload", () => {
-    RemoteAddonsChild.uninit(AddonsChild);
-  });
-}
+let AddonsChild = RemoteAddonsChild.init(this);
+addEventListener("unload", () => {
+  RemoteAddonsChild.uninit(AddonsChild);
+});
 
 addMessageListener("NetworkPrioritizer:AdjustPriority", (msg) => {
   let webNav = docShell.QueryInterface(Ci.nsIWebNavigation);

From 62af1a5643a459a44062a32774173a804eb5f623 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 16:20:59 -0800
Subject: [PATCH 18/84] Bug 1092156 - [e10s] Don't use compartment-per-addon if
 window already associated with add-on (r=bholley)

---
 dom/base/nsGlobalWindow.cpp                   |  9 ++++++
 js/xpconnect/src/XPCWrappedNativeScope.cpp    | 10 +++++++
 .../addoncompat/tests/addon/bootstrap.js      | 29 ++++++++++++++++++-
 .../addoncompat/tests/addon/chrome.manifest   |  2 +-
 .../addoncompat/tests/addon/content/page.html |  2 ++
 5 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 toolkit/components/addoncompat/tests/addon/content/page.html

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 99bfac307d5c..8922327344cb 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -194,6 +194,7 @@
 
 #include "mozilla/dom/SelectionChangeEvent.h"
 
+#include "mozilla/AddonPathService.h"
 #include "mozilla/Services.h"
 #include "mozilla/Telemetry.h"
 #include "nsLocation.h"
@@ -2270,6 +2271,14 @@ CreateNativeGlobalForInner(JSContext* aCx,
     top = aNewInner->GetTop();
   }
   JS::CompartmentOptions options;
+
+  // Sometimes add-ons load their own XUL windows, either as separate top-level
+  // windows or inside a browser element. In such cases we want to tag the
+  // window's compartment with the add-on ID. See bug 1092156.
+  if (nsContentUtils::IsSystemPrincipal(aPrincipal)) {
+    options.setAddonId(MapURIToAddonID(aURI));
+  }
+
   if (top) {
     if (top->GetGlobalJSObject()) {
       options.setSameZoneAs(top->GetGlobalJSObject());
diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp
index 35eedabb6415..c6831981c8b8 100644
--- a/js/xpconnect/src/XPCWrappedNativeScope.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp
@@ -346,6 +346,16 @@ XPCWrappedNativeScope::EnsureAddonScope(JSContext *cx, JSAddonId *addonId)
     MOZ_ASSERT(addonId);
     MOZ_ASSERT(nsContentUtils::IsSystemPrincipal(GetPrincipal()));
 
+    // In bug 1092156, we found that add-on scopes don't work correctly when the
+    // window navigates. The add-on global's prototype is an outer window, so,
+    // after the navigation, looking up window properties in the add-on scope
+    // will fail. However, in most cases where the window can be navigated, the
+    // entire window is part of the add-on. To solve the problem, we avoid
+    // returning an add-on scope for a window that is already tagged with the
+    // add-on ID.
+    if (AddonIdOfObject(global) == addonId)
+        return global;
+
     // If we already have an addon scope object, we know what to use.
     for (size_t i = 0; i < mAddonScopes.Length(); i++) {
         if (JS::AddonIdOfObject(js::UncheckedUnwrap(mAddonScopes[i])) == addonId)
diff --git a/toolkit/components/addoncompat/tests/addon/bootstrap.js b/toolkit/components/addoncompat/tests/addon/bootstrap.js
index 043f23045562..e54569f924ab 100644
--- a/toolkit/components/addoncompat/tests/addon/bootstrap.js
+++ b/toolkit/components/addoncompat/tests/addon/bootstrap.js
@@ -3,6 +3,7 @@ var Ci = Components.interfaces;
 var Cu = Components.utils;
 
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/BrowserUtils.jsm");
 
 const baseURL = "http://mochi.test:8888/browser/" +
   "toolkit/components/addoncompat/tests/browser/";
@@ -232,6 +233,31 @@ function testSandbox()
   });
 }
 
+// Test for bug 1095305. We just want to make sure that loading some
+// unprivileged content from an add-on package doesn't crash.
+function testAddonContent()
+{
+  let chromeRegistry = Components.classes["@mozilla.org/chrome/chrome-registry;1"]
+    .getService(Components.interfaces.nsIChromeRegistry);
+  let base = chromeRegistry.convertChromeURL(BrowserUtils.makeURI("chrome://addonshim1/content/"));
+
+  let res = Services.io.getProtocolHandler("resource")
+    .QueryInterface(Ci.nsIResProtocolHandler);
+  res.setSubstitution("addonshim1", base);
+
+  return new Promise(function(resolve, reject) {
+    const url = "resource://addonshim1/page.html";
+    let tab = gBrowser.addTab(url);
+    let browser = tab.linkedBrowser;
+    addLoadListener(browser, function handler() {
+      gBrowser.removeTab(tab);
+      res.setSubstitution("addonshim1", null);
+
+      resolve();
+    });
+  });
+}
+
 function runTests(win, funcs)
 {
   ok = funcs.ok;
@@ -245,7 +271,8 @@ function runTests(win, funcs)
     then(testListeners).
     then(testCapturing).
     then(testObserver).
-    then(testSandbox);
+    then(testSandbox).
+    then(testAddonContent);
 }
 
 /*
diff --git a/toolkit/components/addoncompat/tests/addon/chrome.manifest b/toolkit/components/addoncompat/tests/addon/chrome.manifest
index 443666893e47..602ba3a5dc28 100644
--- a/toolkit/components/addoncompat/tests/addon/chrome.manifest
+++ b/toolkit/components/addoncompat/tests/addon/chrome.manifest
@@ -1 +1 @@
-content addonshim1 content/
\ No newline at end of file
+content addonshim1 content/
diff --git a/toolkit/components/addoncompat/tests/addon/content/page.html b/toolkit/components/addoncompat/tests/addon/content/page.html
new file mode 100644
index 000000000000..90531a4b3ed1
--- /dev/null
+++ b/toolkit/components/addoncompat/tests/addon/content/page.html
@@ -0,0 +1,2 @@
+<html>
+</html>

From d672a1ceaef41c69ebd542c6fd7cdd2d169dc01c Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 16:20:59 -0800
Subject: [PATCH 19/84] Bug 1075122 - [e10s] Handle nsIWebProgress::DOMWindow
 not being available (r=ttaubert)

---
 toolkit/content/browser-child.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index 6656fea733f6..27171f5dded2 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -71,10 +71,20 @@ let WebProgressListener = {
   },
 
   _setupObjects: function setupObjects(aWebProgress) {
+    let domWindow;
+    try {
+      domWindow = aWebProgress && aWebProgress.DOMWindow;
+    } catch (e) {
+      // If nsDocShell::Destroy has already been called, then we'll
+      // get NS_NOINTERFACE when trying to get the DOM window. Ignore
+      // that here.
+      domWindow = null;
+    }
+
     return {
       contentWindow: content,
       // DOMWindow is not necessarily the content-window with subframes.
-      DOMWindow: aWebProgress && aWebProgress.DOMWindow
+      DOMWindow: domWindow
     };
   },
 

From f573792cd6ff85873fc1185f35c79aee7717c429 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 16:21:00 -0800
Subject: [PATCH 20/84] Bug 1098969 - [e10s] Content policy shim should use
 category value, not name (r=mconley)

---
 .../addoncompat/RemoteAddonsParent.jsm        | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/toolkit/components/addoncompat/RemoteAddonsParent.jsm b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
index 303c04fc4676..efe0ebfc730a 100644
--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -109,20 +109,16 @@ let ContentPolicyParent = {
                .getService(Ci.nsIMessageBroadcaster);
     ppmm.addMessageListener("Addons:ContentPolicy:Run", this);
 
-    this._policies = [];
+    this._policies = new Map();
   },
 
-  addContentPolicy: function(cid) {
-    this._policies.push(cid);
+  addContentPolicy: function(name, cid) {
+    this._policies.set(name, cid);
     NotificationTracker.add(["content-policy"]);
   },
 
-  removeContentPolicy: function(cid) {
-    let index = this._policies.lastIndexOf(cid);
-    if (index > -1) {
-      this._policies.splice(index, 1);
-    }
-
+  removeContentPolicy: function(name) {
+    this._policies.delete(name);
     NotificationTracker.remove(["content-policy"]);
   },
 
@@ -135,8 +131,14 @@ let ContentPolicyParent = {
   },
 
   shouldLoad: function(aData, aObjects) {
-    for (let policyCID of this._policies) {
-      let policy = Cc[policyCID].getService(Ci.nsIContentPolicy);
+    for (let policyCID of this._policies.values()) {
+      let policy;
+      try {
+        policy = Cc[policyCID].getService(Ci.nsIContentPolicy);
+      } catch (e) {
+        // Current Gecko behavior is to ignore entries that don't QI.
+        continue;
+      }
       try {
         let contentLocation = BrowserUtils.makeURI(aData.contentLocation);
         let requestOrigin = aData.requestOrigin ? BrowserUtils.makeURI(aData.requestOrigin) : null;
@@ -167,7 +169,7 @@ let CategoryManagerInterposition = new Interposition("CategoryManagerInterpositi
 CategoryManagerInterposition.methods.addCategoryEntry =
   function(addon, target, category, entry, value, persist, replace) {
     if (category == "content-policy") {
-      ContentPolicyParent.addContentPolicy(entry);
+      ContentPolicyParent.addContentPolicy(entry, value);
     }
 
     target.addCategoryEntry(category, entry, value, persist, replace);

From c0911d9bae1a8c54675a70353d6f17dc78b4f108 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 18 Nov 2014 16:42:01 -0800
Subject: [PATCH 21/84] Bug 1099444 - Fix getting pc offsets from
 BaselineFrames mid-debug mode OSR. (r=jandem)

---
 js/src/jit/IonFrames.cpp      | 19 ++++++++-----------
 js/src/jit/JitFrameIterator.h |  4 ----
 2 files changed, 8 insertions(+), 15 deletions(-)

diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index b8199ee597d9..8d37f3d4b355 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -216,16 +216,6 @@ JitFrameIterator::script() const
     return script;
 }
 
-uint8_t *
-JitFrameIterator::resumeAddressToFp() const
-{
-    // If we are settled on a patched BaselineFrame due to debug mode OSR, get
-    // the real return address via the stashed DebugModeOSRInfo.
-    if (isBaselineJS() && baselineFrame()->getDebugModeOSRInfo())
-        return baselineFrame()->debugModeOSRInfo()->resumeAddr;
-    return returnAddressToFp();
-}
-
 void
 JitFrameIterator::baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes) const
 {
@@ -233,7 +223,6 @@ JitFrameIterator::baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes)
     JSScript *script = this->script();
     if (scriptRes)
         *scriptRes = script;
-    uint8_t *retAddr = resumeAddressToFp();
 
     // If we have unwound the scope due to exception handling to a different
     // pc, the frame should behave as if it were settled on that pc.
@@ -242,6 +231,14 @@ JitFrameIterator::baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes)
         return;
     }
 
+    // If we are settled on a patched BaselineFrame due to debug mode OSR, get
+    // the stashed pc.
+    if (baselineFrame()->getDebugModeOSRInfo()) {
+        *pcRes = baselineFrame()->debugModeOSRInfo()->pc;
+        return;
+    }
+
+    uint8_t *retAddr = returnAddressToFp();
     if (pcRes) {
         // If the return address is into the prologue entry address or just
         // after the debug prologue, then assume start of script.
diff --git a/js/src/jit/JitFrameIterator.h b/js/src/jit/JitFrameIterator.h
index 447c560fa7e5..35950df2584e 100644
--- a/js/src/jit/JitFrameIterator.h
+++ b/js/src/jit/JitFrameIterator.h
@@ -179,10 +179,6 @@ class JitFrameIterator
         return returnAddressToFp_;
     }
 
-    // Returns the resume address. As above, except taking
-    // BaselineDebugModeOSRInfo into account, if present.
-    uint8_t *resumeAddressToFp() const;
-
     // Previous frame information extracted from the current frame.
     inline size_t prevFrameLocalSize() const;
     inline FrameType prevType() const;

From f03f3e58942c7a7d5b4ed2b3ae2c29d5e1956c75 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 18 Nov 2014 16:42:01 -0800
Subject: [PATCH 22/84] Bug 1099446 - Rekey DebugScopes::missingScopes on debug
 mode OSR. (r=luke)

---
 js/src/vm/Debugger.cpp    |  4 ++++
 js/src/vm/ScopeObject.cpp | 16 ++++++++++++++++
 js/src/vm/ScopeObject.h   |  3 +++
 3 files changed, 23 insertions(+)

diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index b7847ab5e9d5..8e429be38e03 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -4475,6 +4475,7 @@ Debugger::observesScript(JSScript *script) const
 Debugger::replaceFrameGuts(JSContext *cx, AbstractFramePtr from, AbstractFramePtr to,
                            ScriptFrameIter &iter)
 {
+    // Forward live Debugger.Frame objects.
     for (Debugger::FrameRange r(from); !r.empty(); r.popFront()) {
         RootedNativeObject frameobj(cx, r.frontFrame());
         Debugger *dbg = r.frontDebugger();
@@ -4497,6 +4498,9 @@ Debugger::replaceFrameGuts(JSContext *cx, AbstractFramePtr from, AbstractFramePt
         }
     }
 
+    // Rekey missingScopes to maintain Debugger.Environment identity.
+    DebugScopes::rekeyMissingScopes(cx, from, to);
+
     return true;
 }
 
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 421deccf3345..7505cf798908 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -2380,6 +2380,22 @@ DebugScopes::hasLiveScope(ScopeObject &scope)
     return nullptr;
 }
 
+/* static */ void
+DebugScopes::rekeyMissingScopes(JSContext *cx, AbstractFramePtr from, AbstractFramePtr to)
+{
+    DebugScopes *scopes = cx->compartment()->debugScopes;
+    if (!scopes)
+        return;
+
+    for (MissingScopeMap::Enum e(scopes->missingScopes); !e.empty(); e.popFront()) {
+        ScopeIterKey key = e.front().key();
+        if (key.frame() == from) {
+            key.updateFrame(to);
+            e.rekeyFront(key);
+        }
+    }
+}
+
 /*****************************************************************************/
 
 static JSObject *
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 8ba71c75e4f7..c73efb7a7af6 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -774,6 +774,7 @@ class ScopeIterKey
 
     void updateCur(JSObject *obj) { cur_ = obj; }
     void updateStaticScope(NestedScopeObject *obj) { staticScope_ = obj; }
+    void updateFrame(AbstractFramePtr frame) { frame_ = frame; }
 
     /* For use as hash policy */
     typedef ScopeIterKey Lookup;
@@ -941,6 +942,8 @@ class DebugScopes
     static bool updateLiveScopes(JSContext *cx);
     static ScopeIterVal *hasLiveScope(ScopeObject &scope);
 
+    static void rekeyMissingScopes(JSContext *cx, AbstractFramePtr from, AbstractFramePtr to);
+
     // In debug-mode, these must be called whenever exiting a scope that might
     // have stack-allocated locals.
     static void onPopCall(AbstractFramePtr frame, JSContext *cx);

From be06e38a89af0dd2a9495eb1bbe4ba3e4db5ff05 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 18 Nov 2014 16:42:01 -0800
Subject: [PATCH 23/84] Bug 1098696 - Make onDebuggerStatement able to trigger
 on non-debuggee frames. (r=jandem,jimb)

---
 .../tests/debug/onDebuggerStatement-05.js     | 22 +++++++
 js/src/jit/BaselineBailouts.cpp               |  1 +
 js/src/jit/BaselineCompiler.cpp               |  4 +-
 js/src/jit/CodeGenerator.cpp                  | 18 ++++++
 js/src/jit/CodeGenerator.h                    |  1 +
 js/src/jit/IonBuilder.cpp                     | 15 +++++
 js/src/jit/IonBuilder.h                       |  1 +
 js/src/jit/IonTypes.h                         |  5 ++
 js/src/jit/LIR-Common.h                       | 11 ++++
 js/src/jit/LOpcodes.h                         |  3 +-
 js/src/jit/Lowering.cpp                       |  7 +++
 js/src/jit/Lowering.h                         |  1 +
 js/src/jit/MIR.h                              | 10 +++
 js/src/jit/MOpcodes.h                         |  3 +-
 js/src/jit/ParallelSafetyAnalysis.cpp         |  1 +
 js/src/jit/VMFunctions.cpp                    | 13 ++--
 js/src/jit/VMFunctions.h                      |  1 +
 js/src/vm/Debugger-inl.h                      |  9 ++-
 js/src/vm/Debugger.cpp                        | 53 ++++++++++------
 js/src/vm/Debugger.h                          | 61 +++++++++++--------
 js/src/vm/Interpreter.cpp                     |  4 +-
 21 files changed, 180 insertions(+), 64 deletions(-)
 create mode 100644 js/src/jit-test/tests/debug/onDebuggerStatement-05.js

diff --git a/js/src/jit-test/tests/debug/onDebuggerStatement-05.js b/js/src/jit-test/tests/debug/onDebuggerStatement-05.js
new file mode 100644
index 000000000000..0a05d19c7ca4
--- /dev/null
+++ b/js/src/jit-test/tests/debug/onDebuggerStatement-05.js
@@ -0,0 +1,22 @@
+// For perf reasons we don't recompile all a debuggee global's scripts when
+// Debugger no longer needs to observe all execution for that global. Test that
+// things don't crash if we try to run a script with a BaselineScript that was
+// compiled with debug instrumentation when the global is no longer a debuggee.
+
+var g = newGlobal();
+var dbg = new Debugger(g);
+var counter = 0;
+dbg.onDebuggerStatement = function (frame) {
+  counter++;
+  if (counter == 15)
+    dbg.onDebuggerStatement = undefined;
+};
+
+g.eval("" + function f() {
+  {
+    let inner = 42;
+    debugger;
+    inner++;
+  }
+});
+g.eval("for (var i = 0; i < 20; i++) f()");
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index ddf9e36b3d0d..cff6ee2a4195 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1777,6 +1777,7 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
       case Bailout_NonSymbolInput:
       case Bailout_GuardThreadExclusive:
       case Bailout_InitialState:
+      case Bailout_Debugger:
         // Do nothing.
         break;
 
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index e1d56a33a6a5..0bd132269826 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -2980,12 +2980,10 @@ static const VMFunction OnDebuggerStatementInfo =
 bool
 BaselineCompiler::emit_JSOP_DEBUGGER()
 {
-    if (!compileDebugInstrumentation_)
-        return true;
-
     prepareVMCall();
     pushArg(ImmPtr(pc));
 
+    frame.assertSyncedStack();
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
     pushArg(R0.scratchReg());
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 48c5b023a947..6f3cd1e3b4e3 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -10175,5 +10175,23 @@ CodeGenerator::visitThrowUninitializedLexical(LThrowUninitializedLexical *ins)
     return callVM(ThrowUninitializedLexicalInfo, ins);
 }
 
+bool
+CodeGenerator::visitDebugger(LDebugger *ins)
+{
+    Register cx = ToRegister(ins->getTemp(0));
+    Register temp = ToRegister(ins->getTemp(1));
+
+    // The check for cx->compartment()->isDebuggee() could be inlined, but the
+    // performance of |debugger;| does not matter.
+    masm.loadJSContext(cx);
+    masm.setupUnalignedABICall(1, temp);
+    masm.passABIArg(cx);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, IsCompartmentDebuggee));
+
+    Label bail;
+    masm.branchIfTrueBool(ReturnReg, &bail);
+    return bailoutFrom(&bail, ins->snapshot());
+}
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 5ebd97265ae1..2ee071b7af77 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -318,6 +318,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitAsmJSVoidReturn(LAsmJSVoidReturn *ret);
     bool visitLexicalCheck(LLexicalCheck *ins);
     bool visitThrowUninitializedLexical(LThrowUninitializedLexical *ins);
+    bool visitDebugger(LDebugger *ins);
 
     bool visitCheckOverRecursed(LCheckOverRecursed *lir);
     bool visitCheckOverRecursedFailure(CheckOverRecursedFailure *ool);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 650c33a9a157..9883ff779df8 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1825,6 +1825,9 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_DEBUGLEAVEBLOCK:
         return true;
 
+      case JSOP_DEBUGGER:
+        return jsop_debugger();
+
       default:
 #ifdef DEBUG
         return abort("Unsupported opcode: %s (line %d)", js_CodeName[op], info().lineno(pc));
@@ -11070,6 +11073,18 @@ IonBuilder::jsop_instanceof()
     return resumeAfter(ins);
 }
 
+bool
+IonBuilder::jsop_debugger()
+{
+    MDebugger *debugger = MDebugger::New(alloc());
+    current->add(debugger);
+
+    // The |debugger;| statement will always bail out to baseline if
+    // cx->compartment()->isDebuggee(). Resume in-place and have baseline
+    // handle the details.
+    return resumeAt(debugger, pc);
+}
+
 MInstruction *
 IonBuilder::addConvertElementsToDoubles(MDefinition *elements)
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 4de3ac95cc90..415f5be49138 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -680,6 +680,7 @@ class IonBuilder
     bool jsop_instanceof();
     bool jsop_getaliasedvar(ScopeCoordinate sc);
     bool jsop_setaliasedvar(ScopeCoordinate sc);
+    bool jsop_debugger();
 
     /* Inlining. */
 
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index eb58be78d173..aa4a22ea55f0 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -110,6 +110,9 @@ enum BailoutKind
     // For the initial snapshot when entering a function.
     Bailout_InitialState,
 
+    // We hit a |debugger;| statement.
+    Bailout_Debugger,
+
     // END Normal bailouts
 
 
@@ -201,6 +204,8 @@ BailoutKindString(BailoutKind kind)
         return "Bailout_GuardThreadExclusive";
       case Bailout_InitialState:
         return "Bailout_InitialState";
+      case Bailout_Debugger:
+        return "Bailout_Debugger";
 
       // Bailouts caused by invalid assumptions.
       case Bailout_OverflowInvalidate:
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 7cb996b28a5f..9818e844aae6 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -6864,6 +6864,17 @@ class LMemoryBarrier : public LInstructionHelper<0, 0, 0>
     }
 };
 
+class LDebugger : public LCallInstructionHelper<0, 0, 2>
+{
+  public:
+    LIR_HEADER(Debugger)
+
+    LDebugger(const LDefinition &temp1, const LDefinition &temp2) {
+        setTemp(0, temp1);
+        setTemp(1, temp2);
+    }
+};
+
 } // namespace jit
 } // namespace js
 
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 43ed28659169..63f86499bdbd 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -340,7 +340,8 @@
     _(AssertRangeF)                 \
     _(AssertRangeV)                 \
     _(LexicalCheck)                 \
-    _(ThrowUninitializedLexical)
+    _(ThrowUninitializedLexical)    \
+    _(Debugger)
 
 #if defined(JS_CODEGEN_X86)
 # include "jit/x86/LOpcodes-x86.h"
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index a17c5b239c40..e833267e496d 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -4109,6 +4109,13 @@ LIRGenerator::visitThrowUninitializedLexical(MThrowUninitializedLexical *ins)
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitDebugger(MDebugger *ins)
+{
+    LDebugger *lir = new(alloc()) LDebugger(tempFixed(CallTempReg0), tempFixed(CallTempReg1));
+    return assignSnapshot(lir, Bailout_Debugger) && add(lir, ins);
+}
+
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 256d52ac1a5f..dd91b22abccb 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -296,6 +296,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitUnknownValue(MUnknownValue *ins);
     bool visitLexicalCheck(MLexicalCheck *ins);
     bool visitThrowUninitializedLexical(MThrowUninitializedLexical *ins);
+    bool visitDebugger(MDebugger *ins);
 };
 
 } // namespace jit
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 21c7c98fe0bd..482a42d705e8 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -12004,6 +12004,16 @@ class MAtomicTypedArrayElementBinop
     }
 };
 
+class MDebugger : public MNullaryInstruction
+{
+  public:
+    INSTRUCTION_HEADER(Debugger);
+
+    static MDebugger *New(TempAllocator &alloc) {
+        return new(alloc) MDebugger();
+    }
+};
+
 class MAsmJSNeg : public MUnaryInstruction
 {
     MAsmJSNeg(MDefinition *op, MIRType type)
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index ce404fa56a98..70f410b33df8 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -262,7 +262,8 @@ namespace jit {
     _(MemoryBarrier)                                                        \
     _(UnknownValue)                                                         \
     _(LexicalCheck)                                                         \
-    _(ThrowUninitializedLexical)
+    _(ThrowUninitializedLexical)                                            \
+    _(Debugger)
 
 // Forward declarations of MIR types.
 #define FORWARD_DECLARE(op) class M##op;
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index d1a740e7f86f..ca008f333f2b 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -360,6 +360,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     UNSAFE_OP(UnknownValue)
     UNSAFE_OP(LexicalCheck)
     UNSAFE_OP(ThrowUninitializedLexical)
+    UNSAFE_OP(Debugger)
 
     // It looks like these could easily be made safe:
     UNSAFE_OP(ConvertElementsToDoubles)
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 1d8764fd55e5..69ebde9deb43 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -1018,10 +1018,7 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
 {
     *mustReturn = false;
 
-    RootedScript script(cx, frame->script());
-    RootedValue rval(cx);
-
-    switch (Debugger::onDebuggerStatement(cx, frame, &rval)) {
+    switch (Debugger::onDebuggerStatement(cx, frame)) {
       case JSTRAP_ERROR:
         return false;
 
@@ -1029,12 +1026,10 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
         return true;
 
       case JSTRAP_RETURN:
-        frame->setReturnValue(rval);
         *mustReturn = true;
         return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
-        cx->setPendingException(rval);
         return false;
 
       default:
@@ -1042,6 +1037,12 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
     }
 }
 
+bool
+IsCompartmentDebuggee(JSContext *cx)
+{
+    return cx->compartment()->isDebuggee();
+}
+
 bool
 PushBlockScope(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block)
 {
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 84854bb699aa..e1b376d3fbd6 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -724,6 +724,7 @@ JSObject *InitRestParameter(JSContext *cx, uint32_t length, Value *rest, HandleO
 
 bool HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mustReturn);
 bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn);
+bool IsCompartmentDebuggee(JSContext *cx);
 
 bool EnterWith(JSContext *cx, BaselineFrame *frame, HandleValue val,
                Handle<StaticWithObject *> templ);
diff --git a/js/src/vm/Debugger-inl.h b/js/src/vm/Debugger-inl.h
index dfaf01e13049..10be2e9ef052 100644
--- a/js/src/vm/Debugger-inl.h
+++ b/js/src/vm/Debugger-inl.h
@@ -42,12 +42,11 @@ js::Debugger::onEnterFrame(JSContext *cx, AbstractFramePtr frame)
 }
 
 /* static */ JSTrapStatus
-js::Debugger::onDebuggerStatement(JSContext *cx, AbstractFramePtr frame, MutableHandleValue vp)
+js::Debugger::onDebuggerStatement(JSContext *cx, AbstractFramePtr frame)
 {
-    MOZ_ASSERT_IF(frame.script()->isDebuggee(), frame.isDebuggee());
-    return frame.isDebuggee()
-           ? dispatchHook(cx, vp, OnDebuggerStatement, NullPtr())
-           : JSTRAP_CONTINUE;
+    if (!cx->compartment()->isDebuggee())
+        return JSTRAP_CONTINUE;
+    return slowPathOnDebuggerStatement(cx, frame);
 }
 
 /* static */ JSTrapStatus
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 8e429be38e03..e263cac48b0c 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -686,7 +686,33 @@ Debugger::slowPathOnLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool frame
     }
 }
 
-JSTrapStatus
+/* static */ JSTrapStatus
+Debugger::slowPathOnDebuggerStatement(JSContext *cx, AbstractFramePtr frame)
+{
+    RootedValue rval(cx);
+    JSTrapStatus status = dispatchHook(cx, &rval, OnDebuggerStatement, NullPtr());
+
+    switch (status) {
+      case JSTRAP_CONTINUE:
+      case JSTRAP_ERROR:
+        break;
+
+      case JSTRAP_RETURN:
+        frame.setReturnValue(rval);
+        break;
+
+      case JSTRAP_THROW:
+        cx->setPendingException(rval);
+        break;
+
+      default:
+        MOZ_CRASH("Invalid onDebuggerStatement trap status");
+    }
+
+    return status;
+}
+
+/* static */ JSTrapStatus
 Debugger::slowPathOnExceptionUnwind(JSContext *cx, AbstractFramePtr frame)
 {
     RootedValue rval(cx);
@@ -710,7 +736,7 @@ Debugger::slowPathOnExceptionUnwind(JSContext *cx, AbstractFramePtr frame)
         break;
 
       default:
-        MOZ_CRASH("Invalid trap status");
+        MOZ_CRASH("Invalid onExceptionUnwind trap status");
     }
 
     return status;
@@ -1113,7 +1139,6 @@ Debugger::fireDebuggerStatement(JSContext *cx, MutableHandleValue vp)
     ac.emplace(cx, object);
 
     ScriptFrameIter iter(cx);
-
     RootedValue scriptFrame(cx);
     if (!getScriptFrame(cx, iter, &scriptFrame))
         return handleUncaughtException(ac, false);
@@ -1788,7 +1813,11 @@ Debugger::updateExecutionObservabilityOfFrames(JSContext *cx, const ExecutionObs
         }
     }
 
-    for (ScriptFrameIter iter(cx); !iter.done(); ++iter) {
+    for (ScriptFrameIter iter(cx, ScriptFrameIter::ALL_CONTEXTS,
+                              ScriptFrameIter::GO_THROUGH_SAVED);
+         !iter.done();
+         ++iter)
+    {
         if (obs.shouldMarkAsDebuggee(iter)) {
             if (observing) {
                 iter.abstractFramePtr().setIsDebuggee();
@@ -1958,18 +1987,10 @@ Debugger::ensureExecutionObservabilityOfCompartment(JSContext *cx, JSCompartment
     return updateExecutionObservability(cx, obs, Observing);
 }
 
-static const Debugger::Hook ObserveAllExecutionHooks[] = { Debugger::OnDebuggerStatement,
-                                                           Debugger::OnEnterFrame,
-                                                           Debugger::HookCount };
-
 /* static */ bool
 Debugger::hookObservesAllExecution(Hook which)
 {
-    for (const Hook *hook = ObserveAllExecutionHooks; *hook != HookCount; hook++) {
-        if (*hook == which)
-            return true;
-    }
-    return false;
+    return which == OnEnterFrame;
 }
 
 bool
@@ -1983,11 +2004,7 @@ Debugger::hasAnyLiveHooksThatObserveAllExecution() const
 bool
 Debugger::hasAnyHooksThatObserveAllExecution() const
 {
-    for (const Hook *hook = ObserveAllExecutionHooks; *hook != HookCount; hook++) {
-        if (getHook(*hook))
-            return true;
-    }
-    return false;
+    return !!getHook(OnEnterFrame);
 }
 
 /* static */ bool
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 352c80d8f6c7..7b4f0c3c0ba4 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -397,6 +397,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
 
+    static bool getNewestAbstractFramePtr(JSContext *cx);
     static bool updateExecutionObservabilityOfFrames(JSContext *cx, const ExecutionObservableSet &obs,
                                                      IsObserving observing);
     static bool updateExecutionObservabilityOfScripts(JSContext *cx, const ExecutionObservableSet &obs,
@@ -423,6 +424,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
 
     static JSTrapStatus slowPathOnEnterFrame(JSContext *cx, AbstractFramePtr frame);
     static bool slowPathOnLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool ok);
+    static JSTrapStatus slowPathOnDebuggerStatement(JSContext *cx, AbstractFramePtr frame);
     static JSTrapStatus slowPathOnExceptionUnwind(JSContext *cx, AbstractFramePtr frame);
     static void slowPathOnNewScript(JSContext *cx, HandleScript script,
                                     GlobalObject *compileAndGoGlobal);
@@ -509,24 +511,49 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     static void findCompartmentEdges(JS::Zone *v, gc::ComponentFinder<JS::Zone> &finder);
 
     /*
-     * Announce to the debugger that the thread has entered a new JavaScript frame,
-     * |frame|. Call whatever hooks have been registered to observe new frames, and
-     * return a JSTrapStatus code indication how execution should proceed:
+     * JSTrapStatus Overview
+     * ---------------------
+     *
+     * The |onEnterFrame|, |onDebuggerStatement|, and |onExceptionUnwind|
+     * methods below return a JSTrapStatus code that indicates how execution
+     * should proceed:
      *
      * - JSTRAP_CONTINUE: Continue execution normally.
      *
-     * - JSTRAP_THROW: Throw an exception. onEnterFrame has set |cx|'s
+     * - JSTRAP_THROW: Throw an exception. The method has set |cx|'s
      *   pending exception to the value to be thrown.
      *
      * - JSTRAP_ERROR: Terminate execution (as is done when a script is terminated
-     *   for running too long). onEnterFrame has cleared |cx|'s pending
+     *   for running too long). The method has cleared |cx|'s pending
      *   exception.
      *
-     * - JSTRAP_RETURN: Return from the new frame immediately. onEnterFrame
-     *   has set |frame|'s return value appropriately.
+     * - JSTRAP_RETURN: Return from the new frame immediately. The method has
+     *   set the youngest JS frame's return value appropriately.
+     */
+
+    /*
+     * Announce to the debugger that the context has entered a new JavaScript
+     * frame, |frame|. Call whatever hooks have been registered to observe new
+     * frames.
      */
     static inline JSTrapStatus onEnterFrame(JSContext *cx, AbstractFramePtr frame);
 
+    /*
+     * Announce to the debugger a |debugger;| statement on has been
+     * encountered on the youngest JS frame on |cx|. Call whatever hooks have
+     * been registered to observe this.
+     *
+     * Note that this method is called for all |debugger;| statements,
+     * regardless of the frame's debuggee-ness.
+     */
+    static inline JSTrapStatus onDebuggerStatement(JSContext *cx, AbstractFramePtr frame);
+
+    /*
+     * Announce to the debugger that an exception has been thrown and propagated
+     * to |frame|. Call whatever hooks have been registered to observe this.
+     */
+    static inline JSTrapStatus onExceptionUnwind(JSContext *cx, AbstractFramePtr frame);
+
     /*
      * Announce to the debugger that the thread has exited a JavaScript frame, |frame|.
      * If |ok| is true, the frame is returning normally; if |ok| is false, the frame
@@ -543,26 +570,6 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
      */
     static inline bool onLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool ok);
 
-    static inline JSTrapStatus onDebuggerStatement(JSContext *cx, AbstractFramePtr frame,
-                                                   MutableHandleValue vp);
-
-    /*
-     * Announce to the debugger that an exception has been thrown and propagated
-     * to |frame|. Call whatever hooks have been registered to observe this and
-     * return a JSTrapStatus code indication how execution should proceed:
-     *
-     * - JSTRAP_CONTINUE: Continue throwing the current exception.
-     *
-     * - JSTRAP_THROW: Throw another value. onExceptionUnwind has set |cx|'s
-     *   pending exception to the new value.
-     *
-     * - JSTRAP_ERROR: Terminate execution. onExceptionUnwind has cleared |cx|'s
-     *   pending exception.
-     *
-     * - JSTRAP_RETURN: Return from |frame|. onExceptionUnwind has cleared
-     *   |cx|'s pending exception and set |frame|'s return value.
-     */
-    static inline JSTrapStatus onExceptionUnwind(JSContext *cx, AbstractFramePtr frame);
     static inline void onNewScript(JSContext *cx, HandleScript script, GlobalObject *compileAndGoGlobal);
     static inline void onNewGlobalObject(JSContext *cx, Handle<GlobalObject *> global);
     static inline bool onLogAllocationSite(JSContext *cx, HandleSavedFrame frame, int64_t when);
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 1d6e2e93ded0..1665a8d4d292 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3295,17 +3295,15 @@ END_CASE(JSOP_INSTANCEOF)
 CASE(JSOP_DEBUGGER)
 {
     RootedValue rval(cx);
-    switch (Debugger::onDebuggerStatement(cx, REGS.fp(), &rval)) {
+    switch (Debugger::onDebuggerStatement(cx, REGS.fp())) {
       case JSTRAP_ERROR:
         goto error;
       case JSTRAP_CONTINUE:
         break;
       case JSTRAP_RETURN:
-        REGS.fp()->setReturnValue(rval);
         ForcedReturn(cx, REGS);
         goto successful_return_continuation;
       case JSTRAP_THROW:
-        cx->setPendingException(rval);
         goto error;
       default:;
     }

From 6dda4a331e6d8fe2aec1dd14ec390fc4b2c554f4 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 18 Nov 2014 16:42:02 -0800
Subject: [PATCH 24/84] Bug 1100316 - Mark resumed BaselineFrames as debuggee
 when resuming from generator throw/close. (r=jandem)

---
 .../tests/debug/execution-observability-02.js     | 15 +++++++++++++++
 js/src/jit/BaselineCompiler.cpp                   |  6 ++++--
 js/src/jit/VMFunctions.cpp                        |  8 ++++++++
 js/src/jit/VMFunctions.h                          |  2 ++
 4 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 js/src/jit-test/tests/debug/execution-observability-02.js

diff --git a/js/src/jit-test/tests/debug/execution-observability-02.js b/js/src/jit-test/tests/debug/execution-observability-02.js
new file mode 100644
index 000000000000..2f6d65d061b3
--- /dev/null
+++ b/js/src/jit-test/tests/debug/execution-observability-02.js
@@ -0,0 +1,15 @@
+// Test that baseline frames are marked as debuggee when resuming from
+// throwing.
+
+var g = newGlobal();
+var dbg = new Debugger(g);
+
+var hits = 0;
+dbg.onEnterFrame = function (f) { hits++; };
+
+try {
+  g.eval("for (c in (function() { yield })()) h");
+} catch (e) {
+}
+
+assertEq(hits, 2);
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 0bd132269826..862954b80921 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -3449,8 +3449,8 @@ typedef bool (*InterpretResumeFn)(JSContext *, HandleObject, HandleValue, Handle
                                   MutableHandleValue);
 static const VMFunction InterpretResumeInfo = FunctionInfo<InterpretResumeFn>(jit::InterpretResume);
 
-typedef bool (*GeneratorThrowFn)(JSContext *, HandleObject, HandleValue, uint32_t);
-static const VMFunction GeneratorThrowInfo = FunctionInfo<GeneratorThrowFn>(js::GeneratorThrowOrClose);
+typedef bool (*GeneratorThrowFn)(JSContext *, BaselineFrame *, HandleObject, HandleValue, uint32_t);
+static const VMFunction GeneratorThrowInfo = FunctionInfo<GeneratorThrowFn>(jit::GeneratorThrowOrClose);
 
 bool
 BaselineCompiler::emit_JSOP_RESUME()
@@ -3601,11 +3601,13 @@ BaselineCompiler::emit_JSOP_RESUME()
         masm.movePtr(scratch2, scratch3);
         masm.subPtr(BaselineStackReg, scratch2);
         masm.store32(scratch2, Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfFrameSize()));
+        masm.loadBaselineFramePtr(BaselineFrameReg, scratch2);
 
         prepareVMCall();
         pushArg(Imm32(resumeKind));
         pushArg(retVal);
         pushArg(genObj);
+        pushArg(scratch2);
 
         JitCode *code = cx->runtime()->jitRuntime()->getVMWrapper(GeneratorThrowInfo);
         if (!code)
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 69ebde9deb43..341e36bc0c52 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -917,6 +917,14 @@ DebugAfterYield(JSContext *cx, BaselineFrame *frame)
     return true;
 }
 
+bool
+GeneratorThrowOrClose(JSContext *cx, BaselineFrame *frame, HandleObject obj, HandleValue arg,
+                      uint32_t resumeKind)
+{
+    MOZ_ALWAYS_TRUE(DebugAfterYield(cx, frame));
+    return js::GeneratorThrowOrClose(cx, obj, arg, resumeKind);
+}
+
 bool
 StrictEvalPrologue(JSContext *cx, BaselineFrame *frame)
 {
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index e1b376d3fbd6..3a36cad491a7 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -713,6 +713,8 @@ bool FinalSuspend(JSContext *cx, HandleObject obj, BaselineFrame *frame, jsbytec
 bool InterpretResume(JSContext *cx, HandleObject obj, HandleValue val, HandlePropertyName kind,
                      MutableHandleValue rval);
 bool DebugAfterYield(JSContext *cx, BaselineFrame *frame);
+bool GeneratorThrowOrClose(JSContext *cx, BaselineFrame *frame, HandleObject obj, HandleValue arg,
+                           uint32_t resumeKind);
 
 bool StrictEvalPrologue(JSContext *cx, BaselineFrame *frame);
 bool HeavyweightFunPrologue(JSContext *cx, BaselineFrame *frame);

From 8d090830201b0380e2a5d3497b917fb9b6a34a61 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 18 Nov 2014 16:42:02 -0800
Subject: [PATCH 25/84] Bug 1100320 - Don't call onExceptionUnwind and onPop
 debugger hooks on over-recursion. (r=jimb)

---
 .../tests/debug/onExceptionUnwind-12.js       | 14 +++
 js/src/jsapi.cpp                              |  5 +
 js/src/jsapi.h                                |  2 +
 js/src/jscntxt.cpp                            |  7 +-
 js/src/jscntxt.h                              |  7 ++
 js/src/jscntxtinlines.h                       |  2 +
 js/src/vm/Debugger.cpp                        | 93 +++++++++++--------
 7 files changed, 88 insertions(+), 42 deletions(-)
 create mode 100644 js/src/jit-test/tests/debug/onExceptionUnwind-12.js

diff --git a/js/src/jit-test/tests/debug/onExceptionUnwind-12.js b/js/src/jit-test/tests/debug/onExceptionUnwind-12.js
new file mode 100644
index 000000000000..78874ddea676
--- /dev/null
+++ b/js/src/jit-test/tests/debug/onExceptionUnwind-12.js
@@ -0,0 +1,14 @@
+var g = newGlobal();
+g.parent = this;
+g.hits = 0;
+g.eval("new Debugger(parent).onExceptionUnwind = function () { hits++; };");
+function f() {
+    var x = f();
+}
+try {
+  f();
+} catch (e) {
+  assertEq(e instanceof InternalError, true);
+} finally {
+  assertEq(g.hits, 0);
+}
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index dfda99022e21..f5ab88f7ec6c 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -6099,6 +6099,7 @@ JS_ReportPendingException(JSContext *cx)
 JS::AutoSaveExceptionState::AutoSaveExceptionState(JSContext *cx)
   : context(cx),
     wasPropagatingForcedReturn(cx->propagatingForcedReturn_),
+    wasOverRecursed(cx->overRecursed_),
     wasThrowing(cx->throwing),
     exceptionValue(cx)
 {
@@ -6106,6 +6107,8 @@ JS::AutoSaveExceptionState::AutoSaveExceptionState(JSContext *cx)
     CHECK_REQUEST(cx);
     if (wasPropagatingForcedReturn)
         cx->clearPropagatingForcedReturn();
+    if (wasOverRecursed)
+        cx->overRecursed_ = false;
     if (wasThrowing) {
         exceptionValue = cx->unwrappedException_;
         cx->clearPendingException();
@@ -6116,6 +6119,7 @@ void
 JS::AutoSaveExceptionState::restore()
 {
     context->propagatingForcedReturn_ = wasPropagatingForcedReturn;
+    context->overRecursed_ = wasOverRecursed;
     context->throwing = wasThrowing;
     context->unwrappedException_ = exceptionValue;
     drop();
@@ -6127,6 +6131,7 @@ JS::AutoSaveExceptionState::~AutoSaveExceptionState()
         if (wasPropagatingForcedReturn)
             context->setPropagatingForcedReturn();
         if (wasThrowing) {
+            context->overRecursed_ = wasOverRecursed;
             context->throwing = true;
             context->unwrappedException_ = exceptionValue;
         }
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 23bcf1456673..f6a1a164ec00 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -4989,6 +4989,7 @@ class JS_PUBLIC_API(AutoSaveExceptionState)
   private:
     JSContext *context;
     bool wasPropagatingForcedReturn;
+    bool wasOverRecursed;
     bool wasThrowing;
     RootedValue exceptionValue;
 
@@ -5011,6 +5012,7 @@ class JS_PUBLIC_API(AutoSaveExceptionState)
      */
     void drop() {
         wasPropagatingForcedReturn = false;
+        wasOverRecursed = false;
         wasThrowing = false;
         exceptionValue.setUndefined();
     }
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 17fc393628f4..210585257f5e 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -416,8 +416,10 @@ js_ReportOverRecursed(JSContext *maybecx)
      */
     fprintf(stderr, "js_ReportOverRecursed called\n");
 #endif
-    if (maybecx)
+    if (maybecx) {
         JS_ReportErrorNumber(maybecx, js_GetErrorMessage, nullptr, JSMSG_OVER_RECURSED);
+        maybecx->overRecursed_ = true;
+    }
 }
 
 void
@@ -1010,6 +1012,7 @@ JSContext::JSContext(JSRuntime *rt)
     throwing(false),
     unwrappedException_(UndefinedValue()),
     options_(),
+    overRecursed_(false),
     propagatingForcedReturn_(false),
     liveVolatileJitFrameIterators_(nullptr),
     reportGranularity(JS_DEFAULT_JITREPORT_GRANULARITY),
@@ -1042,11 +1045,13 @@ JSContext::getPendingException(MutableHandleValue rval)
     rval.set(unwrappedException_);
     if (IsAtomsCompartment(compartment()))
         return true;
+    bool wasOverRecursed = overRecursed_;
     clearPendingException();
     if (!compartment()->wrap(this, rval))
         return false;
     assertSameCompartment(this, rval);
     setPendingException(rval);
+    overRecursed_ = wasOverRecursed;
     return true;
 }
 
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 704767f16dce..fea21ae007fa 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -423,6 +423,7 @@ struct JSContext : public js::ExclusiveContext,
     friend class js::ExclusiveContext;
     friend class JS::AutoSaveExceptionState;
     friend class js::jit::DebugModeOSRVolatileJitFrameIterator;
+    friend void js_ReportOverRecursed(JSContext *);
 
   private:
     /* Exception state -- the exception member is a GC root by definition. */
@@ -432,6 +433,10 @@ struct JSContext : public js::ExclusiveContext,
     /* Per-context options. */
     JS::ContextOptions  options_;
 
+    // True if the exception currently being thrown is by result of
+    // js_ReportOverRecursed. See Debugger::slowPathOnExceptionUnwind.
+    bool                overRecursed_;
+
     // True if propagating a forced return from an interrupt handler during
     // debug mode.
     bool                propagatingForcedReturn_;
@@ -571,9 +576,11 @@ struct JSContext : public js::ExclusiveContext,
 
     void clearPendingException() {
         throwing = false;
+        overRecursed_ = false;
         unwrappedException_.setUndefined();
     }
 
+    bool isThrowingOverRecursed() const { return throwing && overRecursed_; }
     bool isPropagatingForcedReturn() const { return propagatingForcedReturn_; }
     void setPropagatingForcedReturn() { propagatingForcedReturn_ = true; }
     void clearPropagatingForcedReturn() { propagatingForcedReturn_ = false; }
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index 781dff7f333a..f7d9c39bbd04 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -367,6 +367,8 @@ inline void
 JSContext::setPendingException(js::Value v)
 {
     MOZ_ASSERT(!IsPoisonedValue(v));
+    // overRecursed_ is set after the fact by js_ReportOverRecursed.
+    this->overRecursed_ = false;
     this->throwing = true;
     this->unwrappedException_ = v;
     // We don't use assertSameCompartment here to allow
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index e263cac48b0c..a9e071b20b2a 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -592,51 +592,57 @@ Debugger::slowPathOnLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool frame
     RootedValue value(cx);
     Debugger::resultToCompletion(cx, frameOk, frame.returnValue(), &status, &value);
 
-    /* Build a list of the recipients. */
-    AutoObjectVector frames(cx);
-    for (FrameRange r(frame, global); !r.empty(); r.popFront()) {
-        if (!frames.append(r.frontFrame())) {
-            cx->clearPendingException();
-            return false;
-        }
-    }
-
-    /* For each Debugger.Frame, fire its onPop handler, if any. */
-    for (JSObject **p = frames.begin(); p != frames.end(); p++) {
-        RootedNativeObject frameobj(cx, &(*p)->as<NativeObject>());
-        Debugger *dbg = Debugger::fromChildJSObject(frameobj);
-
-        if (dbg->enabled &&
-            !frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER).isUndefined()) {
-            RootedValue handler(cx, frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER));
-
-            Maybe<AutoCompartment> ac;
-            ac.emplace(cx, dbg->object);
-
-            RootedValue completion(cx);
-            if (!dbg->newCompletionValue(cx, status, value, &completion)) {
-                status = dbg->handleUncaughtException(ac, false);
-                break;
+    // This path can be hit via unwinding the stack due to
+    // over-recursion. Only fire the frames' onPop handlers if we haven't
+    // over-recursed, because invoking more JS will only result in more
+    // over-recursion errors. See slowPathOnExceptionUnwind.
+    if (!cx->isThrowingOverRecursed()) {
+        /* Build a list of the recipients. */
+        AutoObjectVector frames(cx);
+        for (FrameRange r(frame, global); !r.empty(); r.popFront()) {
+            if (!frames.append(r.frontFrame())) {
+                cx->clearPendingException();
+                return false;
             }
+        }
 
-            /* Call the onPop handler. */
-            RootedValue rval(cx);
-            bool hookOk = Invoke(cx, ObjectValue(*frameobj), handler, 1, completion.address(),
-                                 &rval);
-            RootedValue nextValue(cx);
-            JSTrapStatus nextStatus = dbg->parseResumptionValue(ac, hookOk, rval, &nextValue);
+        /* For each Debugger.Frame, fire its onPop handler, if any. */
+        for (JSObject **p = frames.begin(); p != frames.end(); p++) {
+            RootedNativeObject frameobj(cx, &(*p)->as<NativeObject>());
+            Debugger *dbg = Debugger::fromChildJSObject(frameobj);
 
-            /*
-             * At this point, we are back in the debuggee compartment, and any error has
-             * been wrapped up as a completion value.
-             */
-            MOZ_ASSERT(cx->compartment() == global->compartment());
-            MOZ_ASSERT(!cx->isExceptionPending());
+            if (dbg->enabled &&
+                !frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER).isUndefined()) {
+                RootedValue handler(cx, frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER));
 
-            /* JSTRAP_CONTINUE means "make no change". */
-            if (nextStatus != JSTRAP_CONTINUE) {
-                status = nextStatus;
-                value = nextValue;
+                Maybe<AutoCompartment> ac;
+                ac.emplace(cx, dbg->object);
+
+                RootedValue completion(cx);
+                if (!dbg->newCompletionValue(cx, status, value, &completion)) {
+                    status = dbg->handleUncaughtException(ac, false);
+                    break;
+                }
+
+                /* Call the onPop handler. */
+                RootedValue rval(cx);
+                bool hookOk = Invoke(cx, ObjectValue(*frameobj), handler, 1, completion.address(),
+                                     &rval);
+                RootedValue nextValue(cx);
+                JSTrapStatus nextStatus = dbg->parseResumptionValue(ac, hookOk, rval, &nextValue);
+
+                /*
+                 * At this point, we are back in the debuggee compartment, and any error has
+                 * been wrapped up as a completion value.
+                 */
+                MOZ_ASSERT(cx->compartment() == global->compartment());
+                MOZ_ASSERT(!cx->isExceptionPending());
+
+                /* JSTRAP_CONTINUE means "make no change". */
+                if (nextStatus != JSTRAP_CONTINUE) {
+                    status = nextStatus;
+                    value = nextValue;
+                }
             }
         }
     }
@@ -715,6 +721,11 @@ Debugger::slowPathOnDebuggerStatement(JSContext *cx, AbstractFramePtr frame)
 /* static */ JSTrapStatus
 Debugger::slowPathOnExceptionUnwind(JSContext *cx, AbstractFramePtr frame)
 {
+    // Invoking more JS on an over-recursed stack is only going to result in
+    // more over-recursion errors.
+    if (cx->isThrowingOverRecursed())
+        return JSTRAP_CONTINUE;
+
     RootedValue rval(cx);
     JSTrapStatus status = dispatchHook(cx, &rval, OnExceptionUnwind, NullPtr());
 

From 73f70ec38ed88ba68e642fbd625b2476e006a749 Mon Sep 17 00:00:00 2001
From: David Burns <dburns@mozilla.com>
Date: Tue, 18 Nov 2014 22:57:23 +0000
Subject: [PATCH 26/84] Bug 1094441: Allow CSS Selector as a search strategy
 for Marionette in Chrome context; r=ahal

--HG--
extra : rebase_source : bfbd853e362e62d55ffb0fefff36667aa60ca04f
---
 testing/marionette/client/marionette/marionette.py          | 4 ++--
 .../client/marionette/tests/unit/test_findelement_chrome.py | 6 ++++++
 testing/marionette/marionette-server.js                     | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/testing/marionette/client/marionette/marionette.py b/testing/marionette/client/marionette/marionette.py
index a033f65e9970..010d83e9c148 100644
--- a/testing/marionette/client/marionette/marionette.py
+++ b/testing/marionette/client/marionette/marionette.py
@@ -1298,7 +1298,7 @@ class Marionette(object):
         :param method: The method to use to locate the element; one of: "id",
                        "name", "class name", "tag name", "css selector", "link text",
                        "partial link text", "xpath", "anon" and "anon attribute".
-                       Note that the "name", "css selector", "link text" and
+                       Note that the "name", "link text" and
                        "partial link test" methods are not supported in the chrome dom.
         :param target: The target of the search.  For example, if method =
                        "tag", target might equal "div".  If method = "id", target would be
@@ -1325,7 +1325,7 @@ class Marionette(object):
         :param method: The method to use to locate the elements; one of:
                        "id", "name", "class name", "tag name", "css selector", "link text",
                        "partial link text", "xpath", "anon" and "anon attribute".
-                       Note that the "name", "css selector", "link text" and
+                       Note that the "name", "link text" and
                        "partial link test" methods are not supported in the chrome dom.
         :param target: The target of the search.  For example, if method =
                        "tag", target might equal "div".  If method = "id", target would be
diff --git a/testing/marionette/client/marionette/tests/unit/test_findelement_chrome.py b/testing/marionette/client/marionette/tests/unit/test_findelement_chrome.py
index cb0d98eb4dcd..4d13b1f6b295 100644
--- a/testing/marionette/client/marionette/tests/unit/test_findelement_chrome.py
+++ b/testing/marionette/client/marionette/tests/unit/test_findelement_chrome.py
@@ -29,6 +29,12 @@ class TestElementsChrome(MarionetteTestCase):
         self.assertEqual(HTMLElement, type(found_el))
         self.assertEqual(el, found_el)
 
+    def test_that_we_can_find_elements_from_css_selectors(self):
+        el = self.marionette.execute_script("return window.document.getElementById('textInput');")
+        found_el = self.marionette.find_element(By.CSS_SELECTOR, "#textInput")
+        self.assertEqual(HTMLElement, type(found_el))
+        self.assertEqual(el, found_el)
+
     def test_child_element(self):
         el = self.marionette.find_element(By.ID, "textInput")
         parent = self.marionette.find_element(By.ID, "things")
diff --git a/testing/marionette/marionette-server.js b/testing/marionette/marionette-server.js
index 1ee99f192e23..e8e54480874e 100644
--- a/testing/marionette/marionette-server.js
+++ b/testing/marionette/marionette-server.js
@@ -2899,7 +2899,7 @@ function BrowserObj(win, server) {
   this.startPage = "about:blank";
   this.mainContentId = null; // used in B2G to identify the homescreen content page
   this.newSession = true; //used to set curFrameId upon new session
-  this.elementManager = new ElementManager([SELECTOR, NAME, LINK_TEXT, PARTIAL_LINK_TEXT]);
+  this.elementManager = new ElementManager([NAME, LINK_TEXT, PARTIAL_LINK_TEXT]);
   this.setBrowser(win);
   this.frameManager = new FrameManager(server); //We should have one FM per BO so that we can handle modals in each Browser
 

From ce77256bf9ee3db3ecc1f8f18f0cd97a8b82cfbc Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Wed, 19 Nov 2014 01:44:02 +0100
Subject: [PATCH 27/84] Bug 1095439 - Make assignments to a const variable a
 syntax error. r=efaust

---
 js/src/frontend/BytecodeEmitter.cpp           | 35 +++----------
 js/src/jit-test/tests/asm.js/testGlobals.js   |  7 ---
 js/src/jit-test/tests/basic/bug673731.js      |  2 +-
 js/src/jit-test/tests/basic/bug821470.js      |  4 +-
 .../jit-test/tests/basic/constAssignError.js  | 23 +++++++++
 .../tests/basic/constGlobalAssignError.js     |  3 ++
 .../jit-test/tests/basic/testDynamicUsage.js  | 14 ------
 .../tests/saved-stacks/gc-frame-cache.js      |  2 +-
 js/src/js.msg                                 |  1 +
 js/src/tests/js1_5/Regress/regress-383674.js  | 14 +++---
 .../tests/js1_5/extensions/regress-452565.js  |  2 +-
 .../tests/js1_6/extensions/regress-465443.js  |  4 +-
 .../tests/js1_7/extensions/regress-470176.js  | 38 --------------
 .../js1_8_1/extensions/regress-437288-01.js   |  2 +-
 .../js1_8_1/regress/regress-452498-039.js     | 35 -------------
 .../js1_8_1/regress/regress-452498-074.js     |  2 +-
 .../js1_8_1/regress/regress-452498-077.js     | 34 -------------
 .../js1_8_1/regress/regress-452498-110.js     | 49 -------------------
 .../js1_8_1/regress/regress-452498-184.js     | 31 ------------
 .../js1_8_1/regress/regress-452498-187.js     |  2 +-
 .../extensions/compound-assign-const.js       | 23 ---------
 .../tests/js1_8_5/regress/regress-383902.js   |  4 +-
 22 files changed, 52 insertions(+), 279 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/constAssignError.js
 create mode 100644 js/src/jit-test/tests/basic/constGlobalAssignError.js
 delete mode 100644 js/src/tests/js1_7/extensions/regress-470176.js
 delete mode 100644 js/src/tests/js1_8_1/regress/regress-452498-039.js
 delete mode 100644 js/src/tests/js1_8_1/regress/regress-452498-077.js
 delete mode 100644 js/src/tests/js1_8_1/regress/regress-452498-110.js
 delete mode 100644 js/src/tests/js1_8_1/regress/regress-452498-184.js
 delete mode 100644 js/src/tests/js1_8_5/extensions/compound-assign-const.js

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 7a770044ac72..bbdf7554ed10 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1679,30 +1679,18 @@ BindNameToSlotHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         return true;
     }
 
-    /*
-     * Turn attempts to mutate const-declared bindings into get ops (for
-     * pre-increment and pre-decrement ops, our caller will have to emit
-     * JSOP_POS, JSOP_ONE, and JSOP_ADD as well).
-     *
-     * Turn JSOP_DELNAME into JSOP_FALSE if dn is known, as all declared
-     * bindings visible to the compiler are permanent in JS unless the
-     * declaration originates at top level in eval code.
-     */
+    // Throw an error on attempts to mutate const-declared bindings.
     switch (op) {
       case JSOP_NAME:
       case JSOP_SETCONST:
         break;
       default:
         if (pn->isConst()) {
-            if (bce->sc->needStrictChecks()) {
-                JSAutoByteString name;
-                if (!AtomToPrintableString(cx, pn->pn_atom, &name) ||
-                    !bce->reportStrictModeError(pn, JSMSG_READ_ONLY, name.ptr()))
-                {
-                    return false;
-                }
-            }
-            pn->setOp(op = JSOP_NAME);
+            JSAutoByteString name;
+            if (!AtomToPrintableString(cx, pn->pn_atom, &name))
+                return false;
+            bce->reportError(pn, JSMSG_BAD_CONST_ASSIGN, name.ptr());
+            return false;
         }
     }
 
@@ -3317,10 +3305,6 @@ EmitDestructuringLHS(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn,
             if (!BindNameToSlot(cx, bce, pn))
                 return false;
 
-            // Allow 'const [x,y] = o', make 'const x,y; [x,y] = o' a nop.
-            if (pn->isConst() && !pn->isDefn())
-                return Emit1(cx, bce, JSOP_POP) >= 0;
-
             switch (pn->getOp()) {
               case JSOP_SETNAME:
               case JSOP_SETGNAME:
@@ -4086,13 +4070,6 @@ EmitAssignment(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp
     /* Finally, emit the specialized assignment bytecode. */
     switch (lhs->getKind()) {
       case PNK_NAME:
-        if (lhs->isConst()) {
-            if (!rhs) {
-                bce->reportError(lhs, JSMSG_BAD_FOR_LEFTSIDE);
-                return false;
-            }
-            break;
-        }
         if (lhs->isOp(JSOP_SETARG) || lhs->isOp(JSOP_SETLOCAL) || lhs->isOp(JSOP_SETALIASEDVAR)) {
             if (!EmitVarOp(cx, lhs, lhs->getOp(), bce))
                 return false;
diff --git a/js/src/jit-test/tests/asm.js/testGlobals.js b/js/src/jit-test/tests/asm.js/testGlobals.js
index 3ceea9612058..9fe831ab79c3 100644
--- a/js/src/jit-test/tests/asm.js/testGlobals.js
+++ b/js/src/jit-test/tests/asm.js/testGlobals.js
@@ -13,15 +13,9 @@ assertAsmTypeFail(USE_ASM + "const i=42; function f(){ return +(i+.1) } return f
 assertAsmTypeFail(USE_ASM + "var i=1.2; function f(){ return i|0 } return f");
 assertAsmTypeFail(USE_ASM + "const i=1.2; function f(){ return i|0 } return f");
 assertAsmTypeFail(USE_ASM + "var i=0; function f(e){ e=+e; i=e } return f");
-assertAsmTypeFail(USE_ASM + "const i=0; function f(e){ e=+e; i=e } return f");
 assertAsmTypeFail(USE_ASM + "var d=0.1; function f(i){ i=i|0; d=i } return f");
-assertAsmTypeFail(USE_ASM + "const d=0.1; function f(i){ i=i|0; d=i } return f");
 assertEq(asmLink(asmCompile(USE_ASM + "var i=13; function f(j) { j=j|0; i=j; return i|0 } return f"))(42), 42);
-assertAsmTypeFail(USE_ASM + "const i=13; function f(j) { j=j|0; i=j; return i|0 } return f");
-assertAsmTypeFail(USE_ASM + "const c=0,i=13; function f(j) { j=j|0; i=j; return i|0 } return f");
 assertEq(asmLink(asmCompile(USE_ASM + "var d=.1; function f(e) { e=+e; d=e; return +e } return f"))(42.1), 42.1);
-assertAsmTypeFail(USE_ASM + "const d=.1; function f(e) { e=+e; d=e; return +e } return f");
-assertAsmTypeFail(USE_ASM + "const c=0, d=.1; function f(e) { e=+e; d=e; return +e } return f");
 assertEq(asmLink(asmCompile(USE_ASM + "var i=13; function f(i, j) { i=i|0; j=j|0; i=j; return i|0 } return f"))(42,43), 43);
 assertEq(asmLink(asmCompile(USE_ASM + "var i=13; function f(j) { j=j|0; var i=0; i=j; return i|0 } return f"))(42), 42);
 
@@ -61,7 +55,6 @@ assertAsmTypeFail('global', USE_ASM + "var i=global.i|0; function f() { return i
 assertAsmTypeFail('global', USE_ASM + "const i=global.i|0; function f() { return i|0 } return f");
 assertAsmTypeFail('global', USE_ASM + "var i=global.i|0; function f() { return i|0 } return f");
 assertAsmTypeFail('global', USE_ASM + 'var i=global.Infinity; function f() { i = 0.0 } return f');
-assertAsmTypeFail('global', USE_ASM + 'const i=global.Infinity; function f() { i = 0.0 } return f');
 assertAsmLinkAlwaysFail(asmCompile('global', USE_ASM + 'var i=global.Infinity; function f() { return +i } return f'), undefined);
 assertAsmLinkAlwaysFail(asmCompile('global', USE_ASM + 'const i=global.Infinity; function f() { return +i } return f'), undefined);
 assertAsmLinkAlwaysFail(asmCompile('global', USE_ASM + 'var i=global.Infinity; function f() { return +i } return f'), null);
diff --git a/js/src/jit-test/tests/basic/bug673731.js b/js/src/jit-test/tests/basic/bug673731.js
index 4a27681d72d4..ca249828e6df 100644
--- a/js/src/jit-test/tests/basic/bug673731.js
+++ b/js/src/jit-test/tests/basic/bug673731.js
@@ -1,3 +1,3 @@
 // |jit-test| error: ReferenceError
 
-const IS_TOKEN_ARRAY = [ printBugNumber && IS_TOKEN_ARRAY++ && this() ? this() : this() ];
+const IS_TOKEN_ARRAY = [ printBugNumber && this() ? this() : this() ];
diff --git a/js/src/jit-test/tests/basic/bug821470.js b/js/src/jit-test/tests/basic/bug821470.js
index f03163ff0b95..a1ebc06012ef 100644
--- a/js/src/jit-test/tests/basic/bug821470.js
+++ b/js/src/jit-test/tests/basic/bug821470.js
@@ -2,7 +2,7 @@ load(libdir + "asserts.js");
 
 assertThrowsInstanceOf(function () {
     eval("function x() { 'use strict'; const x = 4; x = 3; }");
-}, TypeError);
+}, SyntaxError);
 assertThrowsInstanceOf(function () {
     Function("'use strict'; const x = x = 5;");
-}, TypeError)
+}, SyntaxError)
diff --git a/js/src/jit-test/tests/basic/constAssignError.js b/js/src/jit-test/tests/basic/constAssignError.js
new file mode 100644
index 000000000000..43fc02b348f8
--- /dev/null
+++ b/js/src/jit-test/tests/basic/constAssignError.js
@@ -0,0 +1,23 @@
+// Can't assign to const
+
+load(libdir + 'asserts.js');
+
+function assertSyntaxError(str) {
+  assertThrowsInstanceOf(function () { eval(str); }, SyntaxError);
+}
+
+assertSyntaxError("(function() { const x = 3; (function() x++)(); return x })");
+assertSyntaxError("(function() { const x = 3; (function() x++)(); return x++ })");
+assertSyntaxError("(function() { const x = 2; (function() x++)(); return ++x })");
+assertSyntaxError("(function() { const x = 2; (function() x++)(); return x += 1 })");
+
+assertSyntaxError("(function() { const x = 3; x = 1; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; x = 1; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; x++; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; ++x; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; x--; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; --x; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; x += 1; return (function() { return x})() })");
+assertSyntaxError("(function() { const x = 3; x -= 1; return (function() { return x})() })");
+
+assertSyntaxError("(function() { const x = 3; [x] = [1]; })");
diff --git a/js/src/jit-test/tests/basic/constGlobalAssignError.js b/js/src/jit-test/tests/basic/constGlobalAssignError.js
new file mode 100644
index 000000000000..f8b27c45bbfd
--- /dev/null
+++ b/js/src/jit-test/tests/basic/constGlobalAssignError.js
@@ -0,0 +1,3 @@
+// |jit-test| error: SyntaxError
+
+const x = 1; x = 2;
diff --git a/js/src/jit-test/tests/basic/testDynamicUsage.js b/js/src/jit-test/tests/basic/testDynamicUsage.js
index 2dad579b9993..02fd984e12da 100644
--- a/js/src/jit-test/tests/basic/testDynamicUsage.js
+++ b/js/src/jit-test/tests/basic/testDynamicUsage.js
@@ -8,20 +8,6 @@ assertEq((function() { function f() { return 3 }; assertEq(f(), 3); return (func
 assertEq((function() { function f() { return 3 }; assertEq(f(), 3); return eval('f()') })(), 3);
 assertEq((function() { function f() { return 3 }; (function() f())(); return f() })(), 3);
 
-assertEq((function() { const x = 3; (function() x++)(); return x })(), 3);
-assertEq((function() { const x = 3; (function() x++)(); return x++ })(), 3);
-assertEq((function() { const x = 2; (function() x++)(); return ++x })(), 3);
-assertEq((function() { const x = 2; (function() x++)(); return x += 1 })(), 3);
-
-assertEq((function() { const x = 3; x = 1; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; x = 1; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; x++; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; ++x; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; x--; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; --x; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; x += 1; return (function() { return x})() })(), 3);
-assertEq((function() { const x = 3; x -= 1; return (function() { return x})() })(), 3);
-
 assertEq((function() { var x = 3; return eval("x") })(), 3);
 assertEq((function() { var x; x = 3; return eval("x") })(), 3);
 assertEq((function() { x = 3; var x; return eval("x") })(), 3);
diff --git a/js/src/jit-test/tests/saved-stacks/gc-frame-cache.js b/js/src/jit-test/tests/saved-stacks/gc-frame-cache.js
index 35f56fbcb083..4a2838015bea 100644
--- a/js/src/jit-test/tests/saved-stacks/gc-frame-cache.js
+++ b/js/src/jit-test/tests/saved-stacks/gc-frame-cache.js
@@ -9,7 +9,7 @@ function assertAboutEq(actual, expected) {
                     ". FUZZ_FACTOR = " + FUZZ_FACTOR);
 }
 
-const stacks = [];
+var stacks = [];
 
 stacks.push(saveStack());
 stacks.push(saveStack());
diff --git a/js/src/js.msg b/js/src/js.msg
index f4649860ec37..2a1788e1f348 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -181,6 +181,7 @@ MSG_DEF(JSMSG_BAD_ANON_GENERATOR_RETURN, 0, JSEXN_TYPEERR, "anonymous generator
 MSG_DEF(JSMSG_BAD_ARROW_ARGS,          0, JSEXN_SYNTAXERR, "invalid arrow-function arguments (parentheses around the arrow-function may help)")
 MSG_DEF(JSMSG_BAD_BINDING,             1, JSEXN_SYNTAXERR, "redefining {0} is deprecated")
 MSG_DEF(JSMSG_BAD_CONST_DECL,          0, JSEXN_SYNTAXERR, "missing = in const declaration")
+MSG_DEF(JSMSG_BAD_CONST_ASSIGN,        1, JSEXN_SYNTAXERR, "invalid assignment to const {0}")
 MSG_DEF(JSMSG_BAD_CONTINUE,            0, JSEXN_SYNTAXERR, "continue must be inside loop")
 MSG_DEF(JSMSG_BAD_DESTRUCT_ASS,        0, JSEXN_REFERENCEERR, "invalid destructuring assignment operator")
 MSG_DEF(JSMSG_BAD_DESTRUCT_TARGET,     0, JSEXN_SYNTAXERR, "invalid destructuring target")
diff --git a/js/src/tests/js1_5/Regress/regress-383674.js b/js/src/tests/js1_5/Regress/regress-383674.js
index c0b01cb73bb1..688e00629bd3 100644
--- a/js/src/tests/js1_5/Regress/regress-383674.js
+++ b/js/src/tests/js1_5/Regress/regress-383674.js
@@ -19,7 +19,7 @@ function test()
   enterFunc ('test');
   printBugNumber(BUGNUMBER);
   printStatus (summary);
-    
+
   options("strict");
   options("werror");
 
@@ -27,11 +27,11 @@ function test()
   actual = 'toString not called';
   try
   {
-    var x = {toString: function() { 
-        actual = 'toString called'; 
-        print(actual); 
-      } 
-    }; 
+    var x = {toString: function() {
+        actual = 'toString called';
+        print(actual);
+      }
+    };
     var f = function() { var j = x; j + ""; }
     f();
     reportCompare(expect, actual, summary + ': 1');
@@ -44,7 +44,7 @@ function test()
   actual = 'toString not called';
   try
   {
-    (function() { const a = 
+    (function() { var a =
          ({toString: function(){
              actual = 'toString called'; print(actual)} }); a += ""; })();
     reportCompare(expect, actual, summary + ': 2');
diff --git a/js/src/tests/js1_5/extensions/regress-452565.js b/js/src/tests/js1_5/extensions/regress-452565.js
index 9a68f2ae417b..e4fe1cff5c3d 100644
--- a/js/src/tests/js1_5/extensions/regress-452565.js
+++ b/js/src/tests/js1_5/extensions/regress-452565.js
@@ -14,7 +14,7 @@ printStatus (summary);
 
 jit(true);
 
-const c = undefined; (function() { for (var j=0;j<5;++j) { c = 1; } })();
+var c = undefined; (function() { for (var j=0;j<5;++j) { c = 1; } })();
 
 jit(false);
 
diff --git a/js/src/tests/js1_6/extensions/regress-465443.js b/js/src/tests/js1_6/extensions/regress-465443.js
index a15d33445d9d..1b30d73a4b34 100644
--- a/js/src/tests/js1_6/extensions/regress-465443.js
+++ b/js/src/tests/js1_6/extensions/regress-465443.js
@@ -19,8 +19,8 @@ function test()
   enterFunc ('test');
   printBugNumber(BUGNUMBER);
   printStatus (summary);
- 
-  expect = 'SyntaxError: invalid for/in left-hand side';
+
+  expect = 'SyntaxError: invalid assignment to const b';
 
   jit(true);
 
diff --git a/js/src/tests/js1_7/extensions/regress-470176.js b/js/src/tests/js1_7/extensions/regress-470176.js
deleted file mode 100644
index e5ee69fb4c9e..000000000000
--- a/js/src/tests/js1_7/extensions/regress-470176.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 470176;
-var summary = 'let-fun should not be able to modify constants';
-var actual = '';
-var expect = '';
-
-
-//-----------------------------------------------------------------------------
-test();
-//-----------------------------------------------------------------------------
-
-function test()
-{
-  enterFunc ('test');
-  printBugNumber(BUGNUMBER);
-  printStatus (summary);
- 
-  const e = 8; 
-
-  expect = e;
-
-  jit (true);
-
-  let (f = function() { for (var h=0;h<6;++h) ++e; }) { f(); }
-
-  actual = e;
-
-  jit(false);
-
-  reportCompare(expect, actual, summary);
-
-  exitFunc ('test');
-}
diff --git a/js/src/tests/js1_8_1/extensions/regress-437288-01.js b/js/src/tests/js1_8_1/extensions/regress-437288-01.js
index 48af35a46a77..9ec3ff615961 100644
--- a/js/src/tests/js1_8_1/extensions/regress-437288-01.js
+++ b/js/src/tests/js1_8_1/extensions/regress-437288-01.js
@@ -20,7 +20,7 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = 'SyntaxError: invalid for/in left-hand side';
+  expect = 'SyntaxError: invalid assignment to const x';
   try
   {
     eval('(function() { const x = 1; for (x in null); })();');
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-039.js b/js/src/tests/js1_8_1/regress/regress-452498-039.js
deleted file mode 100644
index 909d1870988c..000000000000
--- a/js/src/tests/js1_8_1/regress/regress-452498-039.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 452498;
-var summary = 'TM: upvar2 regression tests';
-var actual = '';
-var expect = '';
-
-
-//-----------------------------------------------------------------------------
-test();
-//-----------------------------------------------------------------------------
-
-function test()
-{
-  enterFunc ('test');
-  printBugNumber(BUGNUMBER);
-  printStatus (summary);
-
-  expect = '10';
-
-// ------- Comment #39 From Jesse Ruderman
-
-  const e = 0;
-  print(actual = ++e);
-
-  actual = String(actual) + e;
-
-  reportCompare(expect, actual, summary);
-
-  exitFunc ('test');
-}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-074.js b/js/src/tests/js1_8_1/regress/regress-452498-074.js
index 322246d6c063..d7f920d4a64d 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-074.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-074.js
@@ -24,7 +24,7 @@ function test()
 
 // ------- Comment #74 From Jesse Ruderman
 
-  const [d] = [1]; [d] = [2]; print(actual = d);
+  const [d] = [1]; print(actual = d);
 
   actual = String(actual);
 
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-077.js b/js/src/tests/js1_8_1/regress/regress-452498-077.js
deleted file mode 100644
index 9231ecfbfbf1..000000000000
--- a/js/src/tests/js1_8_1/regress/regress-452498-077.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 452498;
-var summary = 'TM: upvar2 regression tests';
-var actual = '';
-var expect = '';
-
-
-//-----------------------------------------------------------------------------
-test();
-//-----------------------------------------------------------------------------
-
-function test()
-{
-  enterFunc ('test');
-  printBugNumber(BUGNUMBER);
-  printStatus (summary);
-
-  expect = '1';
-
-// ------- Comment #77 From Brendan Eich
-
-  (function () { const [d] = [1]; [d] = [2]; print(actual = d);})();
-
-  actual = String(actual);
-
-  reportCompare(expect, actual, summary);
-
-  exitFunc ('test');
-}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-110.js b/js/src/tests/js1_8_1/regress/regress-452498-110.js
deleted file mode 100644
index 34f576b21eaa..000000000000
--- a/js/src/tests/js1_8_1/regress/regress-452498-110.js
+++ /dev/null
@@ -1,49 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 452498;
-var summary = 'TM: upvar2 regression tests';
-var actual = '';
-var expect = '';
-
-
-//-----------------------------------------------------------------------------
-test();
-//-----------------------------------------------------------------------------
-
-function test()
-{
-  enterFunc ('test');
-  printBugNumber(BUGNUMBER);
-  printStatus (summary);
-
-// ------- Comment #110 From Brendan Eich
-
-// (In reply to comment #107)
-
-  function f(a) { const b = a; print(++b); return b; }
-
-  expect = 'function f(a) { const b = a; print(++b); return b; }';
-  actual = f + '';
-  compareSource(expect, actual, 'function f(a) { const b = a; print(++b); return b; }');
-
-  expect = '01';
-  actual = 0;
-
-  function g(a) { const b = a; print(actual = ++b); return b; }
-  actual = String(actual) + g(1);
-  reportCompare(expect, actual, 'function g(a) { const b = a; print(actual = ++b); return b; }');
-
-  expect = '21';
-  actual = 0;
-
-  const x = 1; print(actual = ++x);
-  actual = String(actual) + x;
-
-  reportCompare(expect, actual, 'const x = 1; print(actual = ++x); ');
-
-  exitFunc ('test');
-}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-184.js b/js/src/tests/js1_8_1/regress/regress-452498-184.js
deleted file mode 100644
index bdf1a779148a..000000000000
--- a/js/src/tests/js1_8_1/regress/regress-452498-184.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 452498;
-var summary = 'TM: upvar2 regression tests';
-var actual = '';
-var expect = '';
-
-//-------  Comment #184  From  Jesse Ruderman
-
-//-----------------------------------------------------------------------------
-test();
-//-----------------------------------------------------------------------------
-
-function test()
-{
-  enterFunc ('test');
-  printBugNumber(BUGNUMBER);
-  printStatus (summary);
-
-  expect = '11';
-
-  const e = 8; print(actual = '' + ((e += 3)));
-
-  reportCompare(expect, actual, summary);
-
-  exitFunc ('test');
-}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-187.js b/js/src/tests/js1_8_1/regress/regress-452498-187.js
index d1d0ffdf2762..9e598826fc88 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-187.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-187.js
@@ -21,7 +21,7 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = 'SyntaxError: invalid for/in left-hand side';
+  expect = 'SyntaxError: invalid assignment to const x';
   try
   {
     eval('const x = undefined; for (x in []);');
diff --git a/js/src/tests/js1_8_5/extensions/compound-assign-const.js b/js/src/tests/js1_8_5/extensions/compound-assign-const.js
deleted file mode 100644
index 01a8b290fbb2..000000000000
--- a/js/src/tests/js1_8_5/extensions/compound-assign-const.js
+++ /dev/null
@@ -1,23 +0,0 @@
-// Any copyright is dedicated to the Public Domain.
-// http://creativecommons.org/licenses/publicdomain/
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 730810;
-var summary = "Don't assert on compound assignment to a const";
-
-print(BUGNUMBER + ": " + summary);
-
-/**************
- * BEGIN TEST *
- **************/
-
-const x = 3;
-x += 2;
-assertEq(x, 3);
-
-/******************************************************************************/
-
-if (typeof reportCompare === "function")
-  reportCompare(true, true);
-
-print("Tests complete!");
diff --git a/js/src/tests/js1_8_5/regress/regress-383902.js b/js/src/tests/js1_8_5/regress/regress-383902.js
index ed0562378a04..6d9d18e9e2f2 100644
--- a/js/src/tests/js1_8_5/regress/regress-383902.js
+++ b/js/src/tests/js1_8_5/regress/regress-383902.js
@@ -26,7 +26,7 @@ try {
   eval('"use strict"; function g(x) { const y = x; y = 1 + x; } c = 3');
   assertEq(0, 1);
 } catch (e) {
-  assertEq(e.name, 'TypeError');
+  assertEq(e.name, 'SyntaxError');
   assertEq(2, c);
 }
 
@@ -35,7 +35,7 @@ try {
   eval('"use strict"; const z = w; z = 1 + w; c = 5');
   assertEq(0, 1);
 } catch (e) {
-  assertEq(e.name, 'TypeError');
+  assertEq(e.name, 'SyntaxError');
   assertEq(4, c);
   assertEq('z' in this, false);
 }

From 4bb81d61de71730f48eafc308ef0bd8166d4e4ba Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Wed, 19 Nov 2014 01:44:02 +0100
Subject: [PATCH 28/84] Bug 1091900 - Introduce a function to create an empty
 iterator, which simplifies a bunch of stuff. r=efaust

---
 js/src/jsiter.cpp      | 221 +++++++++++++++++++++--------------------
 js/src/jsiter.h        |   3 +
 js/src/proxy/Proxy.cpp |   3 +-
 3 files changed, 120 insertions(+), 107 deletions(-)

diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index ba1caf79e3ee..87ece703338d 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -566,11 +566,9 @@ VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVecto
 {
     MOZ_ASSERT(!(flags & JSITER_FOREACH));
 
-    if (obj) {
-        if (obj->hasSingletonType() && !obj->setIteratedSingleton(cx))
-            return false;
-        types::MarkTypeObjectFlags(cx, obj, types::OBJECT_FLAG_ITERATED);
-    }
+    if (obj->hasSingletonType() && !obj->setIteratedSingleton(cx))
+        return false;
+    types::MarkTypeObjectFlags(cx, obj, types::OBJECT_FLAG_ITERATED);
 
     Rooted<PropertyIteratorObject *> iterobj(cx, NewPropertyIteratorObject(cx, flags));
     if (!iterobj)
@@ -618,11 +616,9 @@ js::VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoI
 {
     MOZ_ASSERT(flags & JSITER_FOREACH);
 
-    if (obj) {
-        if (obj->hasSingletonType() && !obj->setIteratedSingleton(cx))
-            return false;
-        types::MarkTypeObjectFlags(cx, obj, types::OBJECT_FLAG_ITERATED);
-    }
+    if (obj->hasSingletonType() && !obj->setIteratedSingleton(cx))
+        return false;
+    types::MarkTypeObjectFlags(cx, obj, types::OBJECT_FLAG_ITERATED);
 
     Rooted<PropertyIteratorObject*> iterobj(cx, NewPropertyIteratorObject(cx, flags));
     if (!iterobj)
@@ -650,6 +646,27 @@ js::EnumeratedIdVectorToIterator(JSContext *cx, HandleObject obj, unsigned flags
     return VectorToValueIterator(cx, obj, flags, props, vp);
 }
 
+// Mainly used for .. in over null/undefined
+bool
+js::NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleValue vp)
+{
+    Rooted<PropertyIteratorObject*> iterobj(cx, NewPropertyIteratorObject(cx, flags));
+    if (!iterobj)
+        return false;
+
+    AutoIdVector keys(cx); // Empty
+    NativeIterator *ni = NativeIterator::allocateIterator(cx, 0, keys);
+    if (!ni)
+        return false;
+    ni->init(nullptr, iterobj, flags, 0, 0);
+
+    iterobj->setNativeIterator(ni);
+    vp.setObject(*iterobj);
+
+    RegisterEnumerator(cx, iterobj, ni);
+    return true;
+}
+
 static inline void
 UpdateNativeIterator(NativeIterator *ni, JSObject *obj)
 {
@@ -661,113 +678,107 @@ UpdateNativeIterator(NativeIterator *ni, JSObject *obj)
 bool
 js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue vp)
 {
+    if (obj->is<PropertyIteratorObject>() || obj->is<LegacyGeneratorObject>()) {
+        vp.setObject(*obj);
+        return true;
+    }
+
     Vector<Shape *, 8> shapes(cx);
     uint32_t key = 0;
-
-    bool keysOnly = (flags == JSITER_ENUMERATE);
-
-    if (obj) {
-        if (obj->is<PropertyIteratorObject>() || obj->is<LegacyGeneratorObject>()) {
-            vp.setObject(*obj);
-            return true;
-        }
-
-        if (keysOnly) {
-            /*
-             * Check to see if this is the same as the most recent object which
-             * was iterated over.  We don't explicitly check for shapeless
-             * objects here, as they are not inserted into the cache and
-             * will result in a miss.
-             */
-            PropertyIteratorObject *last = cx->runtime()->nativeIterCache.last;
-            if (last) {
-                NativeIterator *lastni = last->getNativeIterator();
-                if (!(lastni->flags & (JSITER_ACTIVE|JSITER_UNREUSABLE)) &&
-                    obj->isNative() &&
-                    obj->as<NativeObject>().hasEmptyElements() &&
-                    obj->lastProperty() == lastni->shapes_array[0])
-                {
-                    JSObject *proto = obj->getProto();
-                    if (proto->isNative() &&
-                        proto->as<NativeObject>().hasEmptyElements() &&
-                        proto->lastProperty() == lastni->shapes_array[1] &&
-                        !proto->getProto())
-                    {
-                        vp.setObject(*last);
-                        UpdateNativeIterator(lastni, obj);
-                        RegisterEnumerator(cx, last, lastni);
-                        return true;
-                    }
-                }
-            }
-
-            /*
-             * The iterator object for JSITER_ENUMERATE never escapes, so we
-             * don't care for the proper parent/proto to be set. This also
-             * allows us to re-use a previous iterator object that is not
-             * currently active.
-             */
+    if (flags == JSITER_ENUMERATE) {
+        /*
+         * Check to see if this is the same as the most recent object which
+         * was iterated over.  We don't explicitly check for shapeless
+         * objects here, as they are not inserted into the cache and
+         * will result in a miss.
+         */
+        PropertyIteratorObject *last = cx->runtime()->nativeIterCache.last;
+        if (last) {
+            NativeIterator *lastni = last->getNativeIterator();
+            if (!(lastni->flags & (JSITER_ACTIVE|JSITER_UNREUSABLE)) &&
+                obj->isNative() &&
+                obj->as<NativeObject>().hasEmptyElements() &&
+                obj->lastProperty() == lastni->shapes_array[0])
             {
-                JSObject *pobj = obj;
-                do {
-                    if (!pobj->isNative() ||
-                        !pobj->as<NativeObject>().hasEmptyElements() ||
-                        IsAnyTypedArray(pobj) ||
-                        pobj->hasUncacheableProto() ||
-                        pobj->getOps()->enumerate ||
-                        pobj->getClass()->enumerate != JS_EnumerateStub ||
-                        pobj->as<NativeObject>().containsPure(cx->names().iteratorIntrinsic))
-                    {
-                        shapes.clear();
-                        goto miss;
-                    }
-                    Shape *shape = pobj->lastProperty();
-                    key = (key + (key << 16)) ^ (uintptr_t(shape) >> 3);
-                    if (!shapes.append(shape))
-                        return false;
-                    pobj = pobj->getProto();
-                } while (pobj);
-            }
-
-            PropertyIteratorObject *iterobj = cx->runtime()->nativeIterCache.get(key);
-            if (iterobj) {
-                NativeIterator *ni = iterobj->getNativeIterator();
-                if (!(ni->flags & (JSITER_ACTIVE|JSITER_UNREUSABLE)) &&
-                    ni->shapes_key == key &&
-                    ni->shapes_length == shapes.length() &&
-                    Compare(ni->shapes_array, shapes.begin(), ni->shapes_length)) {
-                    vp.setObject(*iterobj);
-
-                    UpdateNativeIterator(ni, obj);
-                    RegisterEnumerator(cx, iterobj, ni);
-                    if (shapes.length() == 2)
-                        cx->runtime()->nativeIterCache.last = iterobj;
+                JSObject *proto = obj->getProto();
+                if (proto->isNative() &&
+                    proto->as<NativeObject>().hasEmptyElements() &&
+                    proto->lastProperty() == lastni->shapes_array[1] &&
+                    !proto->getProto())
+                {
+                    vp.setObject(*last);
+                    UpdateNativeIterator(lastni, obj);
+                    RegisterEnumerator(cx, last, lastni);
                     return true;
                 }
             }
         }
 
-      miss:
-        if (obj->is<ProxyObject>())
-            return Proxy::iterate(cx, obj, flags, vp);
+        /*
+         * The iterator object for JSITER_ENUMERATE never escapes, so we
+         * don't care for the proper parent/proto to be set. This also
+         * allows us to re-use a previous iterator object that is not
+         * currently active.
+         */
+        {
+            JSObject *pobj = obj;
+            do {
+                if (!pobj->isNative() ||
+                    !pobj->as<NativeObject>().hasEmptyElements() ||
+                    IsAnyTypedArray(pobj) ||
+                    pobj->hasUncacheableProto() ||
+                    pobj->getOps()->enumerate ||
+                    pobj->getClass()->enumerate != JS_EnumerateStub ||
+                    pobj->as<NativeObject>().containsPure(cx->names().iteratorIntrinsic))
+                {
+                    shapes.clear();
+                    goto miss;
+                }
+                Shape *shape = pobj->lastProperty();
+                key = (key + (key << 16)) ^ (uintptr_t(shape) >> 3);
+                if (!shapes.append(shape))
+                    return false;
+                pobj = pobj->getProto();
+            } while (pobj);
+        }
 
-        if (!GetCustomIterator(cx, obj, flags, vp))
-            return false;
-        if (!vp.isUndefined())
-            return true;
+        PropertyIteratorObject *iterobj = cx->runtime()->nativeIterCache.get(key);
+        if (iterobj) {
+            NativeIterator *ni = iterobj->getNativeIterator();
+            if (!(ni->flags & (JSITER_ACTIVE|JSITER_UNREUSABLE)) &&
+                ni->shapes_key == key &&
+                ni->shapes_length == shapes.length() &&
+                Compare(ni->shapes_array, shapes.begin(), ni->shapes_length)) {
+                vp.setObject(*iterobj);
+
+                UpdateNativeIterator(ni, obj);
+                RegisterEnumerator(cx, iterobj, ni);
+                if (shapes.length() == 2)
+                    cx->runtime()->nativeIterCache.last = iterobj;
+                return true;
+            }
+        }
     }
 
-    /* NB: for (var p in null) succeeds by iterating over no properties. */
+  miss:
+    if (obj->is<ProxyObject>())
+        return Proxy::iterate(cx, obj, flags, vp);
+
+    if (!GetCustomIterator(cx, obj, flags, vp))
+        return false;
+    if (!vp.isUndefined())
+        return true;
 
     AutoIdVector keys(cx);
     if (flags & JSITER_FOREACH) {
-        if (MOZ_LIKELY(obj != nullptr) && !Snapshot(cx, obj, flags, &keys))
-            return false;
         MOZ_ASSERT(shapes.empty());
+
+        if (!Snapshot(cx, obj, flags, &keys))
+            return false;
         if (!VectorToValueIterator(cx, obj, flags, keys, vp))
             return false;
     } else {
-        if (MOZ_LIKELY(obj != nullptr) && !Snapshot(cx, obj, flags, &keys))
+        if (!Snapshot(cx, obj, flags, &keys))
             return false;
         if (!VectorToKeyIterator(cx, obj, flags, keys, shapes.length(), key, vp))
             return false;
@@ -1005,17 +1016,17 @@ js::ValueToIterator(JSContext *cx, unsigned flags, MutableHandleValue vp)
     if (vp.isObject()) {
         /* Common case. */
         obj = &vp.toObject();
-    } else {
+    } else if ((flags & JSITER_ENUMERATE) && vp.isNullOrUndefined()) {
         /*
          * Enumerating over null and undefined gives an empty enumerator, so
          * that |for (var p in <null or undefined>) <loop>;| never executes
          * <loop>, per ES5 12.6.4.
          */
-        if (!(flags & JSITER_ENUMERATE) || !vp.isNullOrUndefined()) {
-            obj = ToObject(cx, vp);
-            if (!obj)
-                return false;
-        }
+         return NewEmptyPropertyIterator(cx, flags, vp);
+    } else {
+        obj = ToObject(cx, vp);
+        if (!obj)
+            return false;
     }
 
     return GetIterator(cx, obj, flags, vp);
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index e9babee2ee80..600f641e60e6 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -170,6 +170,9 @@ bool
 EnumeratedIdVectorToIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &props,
                              MutableHandleValue vp);
 
+bool
+NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleValue vp);
+
 /*
  * Convert the value stored in *vp to its iteration object. The flags should
  * contain JSITER_ENUMERATE if js::ValueToIterator is called when enumerating
diff --git a/js/src/proxy/Proxy.cpp b/js/src/proxy/Proxy.cpp
index 5e0781792d96..b607d9165038 100644
--- a/js/src/proxy/Proxy.cpp
+++ b/js/src/proxy/Proxy.cpp
@@ -396,9 +396,8 @@ Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleV
         // If the policy denies access but wants us to return true, we need
         // to hand a valid (empty) iterator object to the caller.
         if (!policy.allowed()) {
-            AutoIdVector props(cx);
             return policy.returnValue() &&
-                   EnumeratedIdVectorToIterator(cx, proxy, flags, props, vp);
+                   NewEmptyPropertyIterator(cx, flags, vp);
         }
         return handler->iterate(cx, proxy, flags, vp);
     }

From fc0765b66331d1d4c04ba17db2a974de5c22e50f Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Wed, 19 Nov 2014 01:44:02 +0100
Subject: [PATCH 29/84] Bug 1091900 - Make some functions local. r=efaust

---
 js/src/jsiter.cpp                        | 15 ++++-----------
 js/src/jsiter.h                          |  8 --------
 js/src/proxy/CrossCompartmentWrapper.cpp | 10 +---------
 3 files changed, 5 insertions(+), 28 deletions(-)

diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index 87ece703338d..9ad97819a82e 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -603,16 +603,9 @@ VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVecto
     return true;
 }
 
-bool
-js::VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &props,
-                        MutableHandleValue vp)
-{
-    return VectorToKeyIterator(cx, obj, flags, props, 0, 0, vp);
-}
-
-bool
-js::VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &keys,
-                          MutableHandleValue vp)
+static bool
+VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &keys,
+                      MutableHandleValue vp)
 {
     MOZ_ASSERT(flags & JSITER_FOREACH);
 
@@ -641,7 +634,7 @@ js::EnumeratedIdVectorToIterator(JSContext *cx, HandleObject obj, unsigned flags
                                  AutoIdVector &props, MutableHandleValue vp)
 {
     if (!(flags & JSITER_FOREACH))
-        return VectorToKeyIterator(cx, obj, flags, props, vp);
+        return VectorToKeyIterator(cx, obj, flags, props, 0, 0, vp);
 
     return VectorToValueIterator(cx, obj, flags, props, vp);
 }
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index 600f641e60e6..1c18577d4e6f 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -154,14 +154,6 @@ GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue
 JSObject *
 GetIteratorObject(JSContext *cx, HandleObject obj, unsigned flags);
 
-bool
-VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &props,
-                    MutableHandleValue vp);
-
-bool
-VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &props,
-                      MutableHandleValue vp);
-
 /*
  * Creates either a key or value iterator, depending on flags. For a value
  * iterator, performs value-lookup to convert the given list of jsids.
diff --git a/js/src/proxy/CrossCompartmentWrapper.cpp b/js/src/proxy/CrossCompartmentWrapper.cpp
index 8254abecf518..c9d39bc7915a 100644
--- a/js/src/proxy/CrossCompartmentWrapper.cpp
+++ b/js/src/proxy/CrossCompartmentWrapper.cpp
@@ -243,7 +243,6 @@ Reify(JSContext *cx, JSCompartment *origin, MutableHandleValue vp)
      * implicit cx->enumerators state.
      */
     size_t length = ni->numKeys();
-    bool isKeyIter = ni->isKeyIter();
     AutoIdVector keys(cx);
     if (length > 0) {
         if (!keys.reserve(length))
@@ -261,14 +260,7 @@ Reify(JSContext *cx, JSCompartment *origin, MutableHandleValue vp)
     if (!CloseIterator(cx, iterObj))
         return false;
 
-    if (isKeyIter) {
-        if (!VectorToKeyIterator(cx, obj, ni->flags, keys, vp))
-            return false;
-    } else {
-        if (!VectorToValueIterator(cx, obj, ni->flags, keys, vp))
-            return false;
-    }
-    return true;
+    return EnumeratedIdVectorToIterator(cx, obj, ni->flags, keys, vp);
 }
 
 bool

From 127a42b89f4cb24a2184fd903a3c52f6c4971fb9 Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Wed, 19 Nov 2014 01:44:03 +0100
Subject: [PATCH 30/84] Bug 1091900 - Make GetIterator and others take an
 object as outparam. r=efaust

---
 dom/base/nsGlobalWindow.cpp                   |  7 +-
 js/src/jsiter.cpp                             | 70 +++++++++++--------
 js/src/jsiter.h                               |  6 +-
 js/src/jsproxy.h                              |  4 +-
 js/src/jswrapper.h                            |  2 +-
 js/src/proxy/BaseProxyHandler.cpp             |  4 +-
 js/src/proxy/CrossCompartmentWrapper.cpp      | 22 +++---
 js/src/proxy/DirectProxyHandler.cpp           |  4 +-
 js/src/proxy/Proxy.cpp                        | 10 +--
 js/src/proxy/Proxy.h                          |  2 +-
 js/src/proxy/ScriptedDirectProxyHandler.cpp   |  4 +-
 js/src/proxy/ScriptedDirectProxyHandler.h     |  2 +-
 js/src/proxy/ScriptedIndirectProxyHandler.cpp | 14 ++--
 js/src/proxy/ScriptedIndirectProxyHandler.h   |  2 +-
 js/xpconnect/src/Sandbox.cpp                  |  4 +-
 js/xpconnect/wrappers/FilteringWrapper.cpp    |  4 +-
 js/xpconnect/wrappers/FilteringWrapper.h      |  2 +-
 js/xpconnect/wrappers/WaiveXrayWrapper.cpp    |  6 +-
 js/xpconnect/wrappers/WaiveXrayWrapper.h      |  2 +-
 js/xpconnect/wrappers/XrayWrapper.cpp         |  4 +-
 js/xpconnect/wrappers/XrayWrapper.h           |  4 +-
 21 files changed, 96 insertions(+), 83 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 8922327344cb..c3d586dedaa1 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -652,7 +652,7 @@ public:
                                          JS::AutoIdVector &props) const MOZ_OVERRIDE;
   virtual bool iterate(JSContext *cx, JS::Handle<JSObject*> proxy,
                        unsigned flags,
-                       JS::MutableHandle<JS::Value> vp) const MOZ_OVERRIDE;
+                       JS::MutableHandle<JSObject*> objp) const MOZ_OVERRIDE;
   virtual const char *className(JSContext *cx,
                                 JS::Handle<JSObject*> wrapper) const MOZ_OVERRIDE;
 
@@ -943,14 +943,13 @@ nsOuterWindowProxy::getEnumerablePropertyKeys(JSContext *cx, JS::Handle<JSObject
   return js::AppendUnique(cx, props, innerProps);
 }
 
-
 bool
 nsOuterWindowProxy::iterate(JSContext *cx, JS::Handle<JSObject*> proxy,
-                            unsigned flags, JS::MutableHandle<JS::Value> vp) const
+                            unsigned flags, JS::MutableHandle<JSObject*> objp) const
 {
   // BaseProxyHandler::iterate seems to do what we want here: fall
   // back on the property names returned from keys() and enumerate().
-  return js::BaseProxyHandler::iterate(cx, proxy, flags, vp);
+  return js::BaseProxyHandler::iterate(cx, proxy, flags, objp);
 }
 
 bool
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index 9ad97819a82e..8cc1d30af1f2 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -407,18 +407,19 @@ js::GetPropertyKeys(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVecto
 size_t sCustomIteratorCount = 0;
 
 static inline bool
-GetCustomIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue vp)
+GetCustomIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleObject objp)
 {
     JS_CHECK_RECURSION(cx, return false);
 
+    RootedValue rval(cx);
     /* Check whether we have a valid __iterator__ method. */
     HandlePropertyName name = cx->names().iteratorIntrinsic;
-    if (!JSObject::getProperty(cx, obj, obj, name, vp))
+    if (!JSObject::getProperty(cx, obj, obj, name, &rval))
         return false;
 
     /* If there is no custom __iterator__ method, we are done here. */
-    if (!vp.isObject()) {
-        vp.setUndefined();
+    if (!rval.isObject()) {
+        objp.set(nullptr);
         return true;
     }
 
@@ -427,9 +428,9 @@ GetCustomIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandle
 
     /* Otherwise call it and return that object. */
     Value arg = BooleanValue((flags & JSITER_FOREACH) == 0);
-    if (!Invoke(cx, ObjectValue(*obj), vp, 1, &arg, vp))
+    if (!Invoke(cx, ObjectValue(*obj), rval, 1, &arg, &rval))
         return false;
-    if (vp.isPrimitive()) {
+    if (rval.isPrimitive()) {
         /*
          * We are always coming from js::ValueToIterator, and we are no longer on
          * trace, so the object we are iterating over is on top of the stack (-1).
@@ -442,6 +443,7 @@ GetCustomIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandle
                              -1, val, js::NullPtr(), bytes.ptr());
         return false;
     }
+    objp.set(&rval.toObject());
     return true;
 }
 
@@ -562,7 +564,7 @@ RegisterEnumerator(JSContext *cx, PropertyIteratorObject *iterobj, NativeIterato
 
 static inline bool
 VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &keys,
-                    uint32_t slength, uint32_t key, MutableHandleValue vp)
+                    uint32_t slength, uint32_t key, MutableHandleObject objp)
 {
     MOZ_ASSERT(!(flags & JSITER_FOREACH));
 
@@ -597,7 +599,7 @@ VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVecto
     }
 
     iterobj->setNativeIterator(ni);
-    vp.setObject(*iterobj);
+    objp.set(iterobj);
 
     RegisterEnumerator(cx, iterobj, ni);
     return true;
@@ -605,7 +607,7 @@ VectorToKeyIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVecto
 
 static bool
 VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &keys,
-                      MutableHandleValue vp)
+                      MutableHandleObject objp)
 {
     MOZ_ASSERT(flags & JSITER_FOREACH);
 
@@ -623,7 +625,7 @@ VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVec
     ni->init(obj, iterobj, flags, 0, 0);
 
     iterobj->setNativeIterator(ni);
-    vp.setObject(*iterobj);
+    objp.set(iterobj);
 
     RegisterEnumerator(cx, iterobj, ni);
     return true;
@@ -631,17 +633,17 @@ VectorToValueIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVec
 
 bool
 js::EnumeratedIdVectorToIterator(JSContext *cx, HandleObject obj, unsigned flags,
-                                 AutoIdVector &props, MutableHandleValue vp)
+                                 AutoIdVector &props, MutableHandleObject objp)
 {
     if (!(flags & JSITER_FOREACH))
-        return VectorToKeyIterator(cx, obj, flags, props, 0, 0, vp);
+        return VectorToKeyIterator(cx, obj, flags, props, 0, 0, objp);
 
-    return VectorToValueIterator(cx, obj, flags, props, vp);
+    return VectorToValueIterator(cx, obj, flags, props, objp);
 }
 
 // Mainly used for .. in over null/undefined
 bool
-js::NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleValue vp)
+js::NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleObject objp)
 {
     Rooted<PropertyIteratorObject*> iterobj(cx, NewPropertyIteratorObject(cx, flags));
     if (!iterobj)
@@ -654,7 +656,7 @@ js::NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleValue v
     ni->init(nullptr, iterobj, flags, 0, 0);
 
     iterobj->setNativeIterator(ni);
-    vp.setObject(*iterobj);
+    objp.set(iterobj);
 
     RegisterEnumerator(cx, iterobj, ni);
     return true;
@@ -669,10 +671,10 @@ UpdateNativeIterator(NativeIterator *ni, JSObject *obj)
 }
 
 bool
-js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue vp)
+js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleObject objp)
 {
     if (obj->is<PropertyIteratorObject>() || obj->is<LegacyGeneratorObject>()) {
-        vp.setObject(*obj);
+        objp.set(obj);
         return true;
     }
 
@@ -699,7 +701,7 @@ js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleVa
                     proto->lastProperty() == lastni->shapes_array[1] &&
                     !proto->getProto())
                 {
-                    vp.setObject(*last);
+                    objp.set(last);
                     UpdateNativeIterator(lastni, obj);
                     RegisterEnumerator(cx, last, lastni);
                     return true;
@@ -742,7 +744,7 @@ js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleVa
                 ni->shapes_key == key &&
                 ni->shapes_length == shapes.length() &&
                 Compare(ni->shapes_array, shapes.begin(), ni->shapes_length)) {
-                vp.setObject(*iterobj);
+                objp.set(iterobj);
 
                 UpdateNativeIterator(ni, obj);
                 RegisterEnumerator(cx, iterobj, ni);
@@ -755,11 +757,11 @@ js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleVa
 
   miss:
     if (obj->is<ProxyObject>())
-        return Proxy::iterate(cx, obj, flags, vp);
+        return Proxy::iterate(cx, obj, flags, objp);
 
-    if (!GetCustomIterator(cx, obj, flags, vp))
+    if (!GetCustomIterator(cx, obj, flags, objp))
         return false;
-    if (!vp.isUndefined())
+    if (objp)
         return true;
 
     AutoIdVector keys(cx);
@@ -768,16 +770,16 @@ js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleVa
 
         if (!Snapshot(cx, obj, flags, &keys))
             return false;
-        if (!VectorToValueIterator(cx, obj, flags, keys, vp))
+        if (!VectorToValueIterator(cx, obj, flags, keys, objp))
             return false;
     } else {
         if (!Snapshot(cx, obj, flags, &keys))
             return false;
-        if (!VectorToKeyIterator(cx, obj, flags, keys, shapes.length(), key, vp))
+        if (!VectorToKeyIterator(cx, obj, flags, keys, shapes.length(), key, objp))
             return false;
     }
 
-    PropertyIteratorObject *iterobj = &vp.toObject().as<PropertyIteratorObject>();
+    PropertyIteratorObject *iterobj = &objp->as<PropertyIteratorObject>();
 
     /* Cache the iterator object if possible. */
     if (shapes.length())
@@ -791,10 +793,10 @@ js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleVa
 JSObject *
 js::GetIteratorObject(JSContext *cx, HandleObject obj, uint32_t flags)
 {
-    RootedValue value(cx);
-    if (!GetIterator(cx, obj, flags, &value))
+    RootedObject iterator(cx);
+    if (!GetIterator(cx, obj, flags, &iterator))
         return nullptr;
-    return &value.toObject();
+    return iterator;
 }
 
 JSObject *
@@ -1015,14 +1017,22 @@ js::ValueToIterator(JSContext *cx, unsigned flags, MutableHandleValue vp)
          * that |for (var p in <null or undefined>) <loop>;| never executes
          * <loop>, per ES5 12.6.4.
          */
-         return NewEmptyPropertyIterator(cx, flags, vp);
+        RootedObject iter(cx);
+        if (!NewEmptyPropertyIterator(cx, flags, &iter))
+            return false;
+        vp.setObject(*iter);
+        return true;
     } else {
         obj = ToObject(cx, vp);
         if (!obj)
             return false;
     }
 
-    return GetIterator(cx, obj, flags, vp);
+    RootedObject iter(cx);
+    if (!GetIterator(cx, obj, flags, &iter))
+        return false;
+    vp.setObject(*iter);
+    return true;
 }
 
 bool
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index 1c18577d4e6f..e2c1a1c9f531 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -149,7 +149,7 @@ bool
 VectorToIdArray(JSContext *cx, AutoIdVector &props, JSIdArray **idap);
 
 bool
-GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue vp);
+GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleObject objp);
 
 JSObject *
 GetIteratorObject(JSContext *cx, HandleObject obj, unsigned flags);
@@ -160,10 +160,10 @@ GetIteratorObject(JSContext *cx, HandleObject obj, unsigned flags);
  */
 bool
 EnumeratedIdVectorToIterator(JSContext *cx, HandleObject obj, unsigned flags, AutoIdVector &props,
-                             MutableHandleValue vp);
+                             MutableHandleObject objp);
 
 bool
-NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleValue vp);
+NewEmptyPropertyIterator(JSContext *cx, unsigned flags, MutableHandleObject objp);
 
 /*
  * Convert the value stored in *vp to its iteration object. The flags should
diff --git a/js/src/jsproxy.h b/js/src/jsproxy.h
index 7ac34cff5c35..a0526e17b03f 100644
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -308,7 +308,7 @@ class JS_FRIEND_API(BaseProxyHandler)
     virtual bool getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
                                            AutoIdVector &props) const = 0;
     virtual bool iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                         MutableHandleValue vp) const;
+                         MutableHandleObject objp) const;
     virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl, CallArgs args) const;
     virtual bool hasInstance(JSContext *cx, HandleObject proxy, MutableHandleValue v, bool *bp) const;
     virtual bool objectClassIs(HandleObject obj, ESClassValue classValue, JSContext *cx) const;
@@ -395,7 +395,7 @@ class JS_PUBLIC_API(DirectProxyHandler) : public BaseProxyHandler
     virtual bool getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
                                            AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                         MutableHandleValue vp) const MOZ_OVERRIDE;
+                         MutableHandleObject objp) const MOZ_OVERRIDE;
     virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                             CallArgs args) const MOZ_OVERRIDE;
     virtual bool hasInstance(JSContext *cx, HandleObject proxy, MutableHandleValue v,
diff --git a/js/src/jswrapper.h b/js/src/jswrapper.h
index 47c41d45884e..217e3f0db591 100644
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -146,7 +146,7 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
     virtual bool getEnumerablePropertyKeys(JSContext *cx, HandleObject wrapper,
                                            AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, HandleObject wrapper, unsigned flags,
-                         MutableHandleValue vp) const MOZ_OVERRIDE;
+                         MutableHandleObject objp) const MOZ_OVERRIDE;
     virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                             CallArgs args) const MOZ_OVERRIDE;
     virtual bool hasInstance(JSContext *cx, HandleObject wrapper, MutableHandleValue v,
diff --git a/js/src/proxy/BaseProxyHandler.cpp b/js/src/proxy/BaseProxyHandler.cpp
index d218e90cc571..a84eb8e5d1b0 100644
--- a/js/src/proxy/BaseProxyHandler.cpp
+++ b/js/src/proxy/BaseProxyHandler.cpp
@@ -198,7 +198,7 @@ BaseProxyHandler::getOwnEnumerablePropertyKeys(JSContext *cx, HandleObject proxy
 
 bool
 BaseProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                          MutableHandleValue vp) const
+                          MutableHandleObject objp) const
 {
     assertEnteredPolicy(cx, proxy, JSID_VOID, ENUMERATE);
 
@@ -209,7 +209,7 @@ BaseProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
         return false;
     }
 
-    return EnumeratedIdVectorToIterator(cx, proxy, flags, props, vp);
+    return EnumeratedIdVectorToIterator(cx, proxy, flags, props, objp);
 }
 
 bool
diff --git a/js/src/proxy/CrossCompartmentWrapper.cpp b/js/src/proxy/CrossCompartmentWrapper.cpp
index c9d39bc7915a..5f4a93c5442d 100644
--- a/js/src/proxy/CrossCompartmentWrapper.cpp
+++ b/js/src/proxy/CrossCompartmentWrapper.cpp
@@ -203,11 +203,9 @@ CrossCompartmentWrapper::getEnumerablePropertyKeys(JSContext *cx, HandleObject w
  * allows fast iteration over objects across a compartment boundary.
  */
 static bool
-CanReify(HandleValue vp)
+CanReify(HandleObject obj)
 {
-    JSObject *obj;
-    return vp.isObject() &&
-           (obj = &vp.toObject())->is<PropertyIteratorObject>() &&
+    return obj->is<PropertyIteratorObject>() &&
            (obj->as<PropertyIteratorObject>().getNativeIterator()->flags & JSITER_ENUMERATE);
 }
 
@@ -225,9 +223,9 @@ struct AutoCloseIterator
 };
 
 static bool
-Reify(JSContext *cx, JSCompartment *origin, MutableHandleValue vp)
+Reify(JSContext *cx, JSCompartment *origin, MutableHandleObject objp)
 {
-    Rooted<PropertyIteratorObject*> iterObj(cx, &vp.toObject().as<PropertyIteratorObject>());
+    Rooted<PropertyIteratorObject*> iterObj(cx, &objp->as<PropertyIteratorObject>());
     NativeIterator *ni = iterObj->getNativeIterator();
 
     AutoCloseIterator close(cx, iterObj);
@@ -260,22 +258,22 @@ Reify(JSContext *cx, JSCompartment *origin, MutableHandleValue vp)
     if (!CloseIterator(cx, iterObj))
         return false;
 
-    return EnumeratedIdVectorToIterator(cx, obj, ni->flags, keys, vp);
+    return EnumeratedIdVectorToIterator(cx, obj, ni->flags, keys, objp);
 }
 
 bool
 CrossCompartmentWrapper::iterate(JSContext *cx, HandleObject wrapper, unsigned flags,
-                                 MutableHandleValue vp) const
+                                 MutableHandleObject objp) const
 {
     {
         AutoCompartment call(cx, wrappedObject(wrapper));
-        if (!Wrapper::iterate(cx, wrapper, flags, vp))
+        if (!Wrapper::iterate(cx, wrapper, flags, objp))
             return false;
     }
 
-    if (CanReify(vp))
-        return Reify(cx, cx->compartment(), vp);
-    return cx->compartment()->wrap(cx, vp);
+    if (CanReify(objp))
+        return Reify(cx, cx->compartment(), objp);
+    return cx->compartment()->wrap(cx, objp);
 }
 
 bool
diff --git a/js/src/proxy/DirectProxyHandler.cpp b/js/src/proxy/DirectProxyHandler.cpp
index 30106bb0294c..aa55fc64de1f 100644
--- a/js/src/proxy/DirectProxyHandler.cpp
+++ b/js/src/proxy/DirectProxyHandler.cpp
@@ -254,12 +254,12 @@ DirectProxyHandler::getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
 
 bool
 DirectProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                            MutableHandleValue vp) const
+                            MutableHandleObject objp) const
 {
     assertEnteredPolicy(cx, proxy, JSID_VOID, ENUMERATE);
     MOZ_ASSERT(!hasPrototype()); // Should never be called if there's a prototype.
     RootedObject target(cx, proxy->as<ProxyObject>().target());
-    return GetIterator(cx, target, flags, vp);
+    return GetIterator(cx, target, flags, objp);
 }
 
 bool
diff --git a/js/src/proxy/Proxy.cpp b/js/src/proxy/Proxy.cpp
index b607d9165038..c9f884e92fd1 100644
--- a/js/src/proxy/Proxy.cpp
+++ b/js/src/proxy/Proxy.cpp
@@ -385,11 +385,11 @@ Proxy::getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy, AutoIdVector
 }
 
 bool
-Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleValue vp)
+Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleObject objp)
 {
     JS_CHECK_RECURSION(cx, return false);
     const BaseProxyHandler *handler = proxy->as<ProxyObject>().handler();
-    vp.setUndefined(); // default result if we refuse to perform this action
+    objp.set(nullptr); // default result if we refuse to perform this action
     if (!handler->hasPrototype()) {
         AutoEnterPolicy policy(cx, handler, proxy, JSID_VOIDHANDLE,
                                BaseProxyHandler::ENUMERATE, true);
@@ -397,9 +397,9 @@ Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleV
         // to hand a valid (empty) iterator object to the caller.
         if (!policy.allowed()) {
             return policy.returnValue() &&
-                   NewEmptyPropertyIterator(cx, flags, vp);
+                   NewEmptyPropertyIterator(cx, flags, objp);
         }
-        return handler->iterate(cx, proxy, flags, vp);
+        return handler->iterate(cx, proxy, flags, objp);
     }
     AutoIdVector props(cx);
     // The other Proxy::foo methods do the prototype-aware work for us here.
@@ -408,7 +408,7 @@ Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleV
         : !Proxy::getEnumerablePropertyKeys(cx, proxy, props)) {
         return false;
     }
-    return EnumeratedIdVectorToIterator(cx, proxy, flags, props, vp);
+    return EnumeratedIdVectorToIterator(cx, proxy, flags, props, objp);
 }
 
 bool
diff --git a/js/src/proxy/Proxy.h b/js/src/proxy/Proxy.h
index a48e62ebba3f..889303e2d69f 100644
--- a/js/src/proxy/Proxy.h
+++ b/js/src/proxy/Proxy.h
@@ -56,7 +56,7 @@ class Proxy
     static bool getOwnEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
                                              AutoIdVector &props);
     static bool getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy, AutoIdVector &props);
-    static bool iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleValue vp);
+    static bool iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleObject objp);
     static bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl, CallArgs args);
     static bool hasInstance(JSContext *cx, HandleObject proxy, MutableHandleValue v, bool *bp);
     static bool objectClassIs(HandleObject obj, ESClassValue classValue, JSContext *cx);
diff --git a/js/src/proxy/ScriptedDirectProxyHandler.cpp b/js/src/proxy/ScriptedDirectProxyHandler.cpp
index ab0fe134e3f0..9c468f28a199 100644
--- a/js/src/proxy/ScriptedDirectProxyHandler.cpp
+++ b/js/src/proxy/ScriptedDirectProxyHandler.cpp
@@ -1020,10 +1020,10 @@ ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleObject
 
 bool
 ScriptedDirectProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                                    MutableHandleValue vp) const
+                                    MutableHandleObject objp) const
 {
     // FIXME: Provide a proper implementation for this trap, see bug 787004
-    return DirectProxyHandler::iterate(cx, proxy, flags, vp);
+    return DirectProxyHandler::iterate(cx, proxy, flags, objp);
 }
 
 // ES6 (22 May, 2014) 9.5.13 Proxy.[[Call]]
diff --git a/js/src/proxy/ScriptedDirectProxyHandler.h b/js/src/proxy/ScriptedDirectProxyHandler.h
index 8ce2194a55a9..d6121740aa44 100644
--- a/js/src/proxy/ScriptedDirectProxyHandler.h
+++ b/js/src/proxy/ScriptedDirectProxyHandler.h
@@ -65,7 +65,7 @@ class ScriptedDirectProxyHandler : public DirectProxyHandler {
     virtual bool getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
                                            AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                         MutableHandleValue vp) const MOZ_OVERRIDE;
+                         MutableHandleObject objp) const MOZ_OVERRIDE;
 
     virtual bool isCallable(JSObject *obj) const MOZ_OVERRIDE;
     virtual bool isConstructor(JSObject *obj) const MOZ_OVERRIDE {
diff --git a/js/src/proxy/ScriptedIndirectProxyHandler.cpp b/js/src/proxy/ScriptedIndirectProxyHandler.cpp
index 43d9d1293b39..414c51efca2d 100644
--- a/js/src/proxy/ScriptedIndirectProxyHandler.cpp
+++ b/js/src/proxy/ScriptedIndirectProxyHandler.cpp
@@ -318,16 +318,22 @@ ScriptedIndirectProxyHandler::getEnumerablePropertyKeys(JSContext *cx, HandleObj
 
 bool
 ScriptedIndirectProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                                      MutableHandleValue vp) const
+                                      MutableHandleObject objp) const
 {
     RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue value(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().iterate, &value))
         return false;
     if (!IsCallable(value))
-        return BaseProxyHandler::iterate(cx, proxy, flags, vp);
-    return Trap(cx, handler, value, 0, nullptr, vp) &&
-           ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().iterate, vp);
+        return BaseProxyHandler::iterate(cx, proxy, flags, objp);
+
+    RootedValue rval(cx);
+    if (!Trap(cx, handler, value, 0, nullptr, &rval))
+        return false;
+    if (!ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().iterate, rval))
+        return false;
+    objp.set(&rval.toObject());
+    return true;
 }
 
 bool
diff --git a/js/src/proxy/ScriptedIndirectProxyHandler.h b/js/src/proxy/ScriptedIndirectProxyHandler.h
index 3208fe726667..8157c769ed5f 100644
--- a/js/src/proxy/ScriptedIndirectProxyHandler.h
+++ b/js/src/proxy/ScriptedIndirectProxyHandler.h
@@ -44,7 +44,7 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler
     virtual bool getEnumerablePropertyKeys(JSContext *cx, HandleObject proxy,
                                            AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                         MutableHandleValue vp) const MOZ_OVERRIDE;
+                         MutableHandleObject objp) const MOZ_OVERRIDE;
     virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                             CallArgs args) const MOZ_OVERRIDE;
     virtual JSString *fun_toString(JSContext *cx, HandleObject proxy, unsigned indent) const MOZ_OVERRIDE;
diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index 1ada76af004c..0bda685d8524 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -738,9 +738,9 @@ xpc::SandboxProxyHandler::getOwnEnumerablePropertyKeys(JSContext *cx,
 
 bool
 xpc::SandboxProxyHandler::iterate(JSContext *cx, JS::Handle<JSObject*> proxy,
-                                  unsigned flags, JS::MutableHandle<Value> vp) const
+                                  unsigned flags, JS::MutableHandle<JSObject*> objp) const
 {
-    return BaseProxyHandler::iterate(cx, proxy, flags, vp);
+    return BaseProxyHandler::iterate(cx, proxy, flags, objp);
 }
 
 bool
diff --git a/js/xpconnect/wrappers/FilteringWrapper.cpp b/js/xpconnect/wrappers/FilteringWrapper.cpp
index 3518d19637bf..2245ed73566f 100644
--- a/js/xpconnect/wrappers/FilteringWrapper.cpp
+++ b/js/xpconnect/wrappers/FilteringWrapper.cpp
@@ -125,14 +125,14 @@ FilteringWrapper<Base, Policy>::getEnumerablePropertyKeys(JSContext *cx,
 template <typename Base, typename Policy>
 bool
 FilteringWrapper<Base, Policy>::iterate(JSContext *cx, HandleObject wrapper,
-                                        unsigned flags, MutableHandleValue vp) const
+                                        unsigned flags, MutableHandleObject objp) const
 {
     assertEnteredPolicy(cx, wrapper, JSID_VOID, BaseProxyHandler::ENUMERATE);
     // We refuse to trigger the iterator hook across chrome wrappers because
     // we don't know how to censor custom iterator objects. Instead we trigger
     // the default proxy iterate trap, which will ask enumerate() for the list
     // of (censored) ids.
-    return js::BaseProxyHandler::iterate(cx, wrapper, flags, vp);
+    return js::BaseProxyHandler::iterate(cx, wrapper, flags, objp);
 }
 
 template <typename Base, typename Policy>
diff --git a/js/xpconnect/wrappers/FilteringWrapper.h b/js/xpconnect/wrappers/FilteringWrapper.h
index c09421e12dc9..97f3dce7095c 100644
--- a/js/xpconnect/wrappers/FilteringWrapper.h
+++ b/js/xpconnect/wrappers/FilteringWrapper.h
@@ -42,7 +42,7 @@ class FilteringWrapper : public Base {
     virtual bool getEnumerablePropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper,
                                            JS::AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, JS::Handle<JSObject*> wrapper, unsigned flags,
-                         JS::MutableHandle<JS::Value> vp) const MOZ_OVERRIDE;
+                         JS::MutableHandle<JSObject*> objp) const MOZ_OVERRIDE;
 
     virtual bool call(JSContext *cx, JS::Handle<JSObject*> wrapper,
                       const JS::CallArgs &args) const MOZ_OVERRIDE;
diff --git a/js/xpconnect/wrappers/WaiveXrayWrapper.cpp b/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
index 963e3570421b..a4375f70442c 100644
--- a/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
+++ b/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
@@ -60,10 +60,10 @@ WaiveXrayWrapper::get(JSContext *cx, HandleObject wrapper,
 
 bool
 WaiveXrayWrapper::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
-                         MutableHandleValue vp) const
+                          MutableHandleObject objp) const
 {
-    return CrossCompartmentWrapper::iterate(cx, proxy, flags, vp) &&
-           WrapperFactory::WaiveXrayAndWrap(cx, vp);
+    return CrossCompartmentWrapper::iterate(cx, proxy, flags, objp) &&
+           (!objp || WrapperFactory::WaiveXrayAndWrap(cx, objp));
 }
 
 bool
diff --git a/js/xpconnect/wrappers/WaiveXrayWrapper.h b/js/xpconnect/wrappers/WaiveXrayWrapper.h
index 816a53a05d80..bea036f2ce1a 100644
--- a/js/xpconnect/wrappers/WaiveXrayWrapper.h
+++ b/js/xpconnect/wrappers/WaiveXrayWrapper.h
@@ -30,7 +30,7 @@ class WaiveXrayWrapper : public js::CrossCompartmentWrapper {
                            const JS::CallArgs &args) const MOZ_OVERRIDE;
 
     virtual bool iterate(JSContext *cx, JS::Handle<JSObject*> proxy, unsigned flags,
-                         JS::MutableHandle<JS::Value> vp) const MOZ_OVERRIDE;
+                         JS::MutableHandle<JSObject*> objp) const MOZ_OVERRIDE;
     virtual bool nativeCall(JSContext *cx, JS::IsAcceptableThis test,
                             JS::NativeImpl impl, JS::CallArgs args) const MOZ_OVERRIDE;
     virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper,
diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 9ad1a15b47ca..b93b2f72a836 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2127,10 +2127,10 @@ XrayWrapper<Base, Traits>::getEnumerablePropertyKeys(JSContext *cx, HandleObject
 template <typename Base, typename Traits>
 bool
 XrayWrapper<Base, Traits>::iterate(JSContext *cx, HandleObject wrapper,
-                                   unsigned flags, MutableHandleValue vp) const
+                                   unsigned flags, MutableHandleObject objp) const
 {
     // Skip our Base if it isn't already ProxyHandler.
-    return js::BaseProxyHandler::iterate(cx, wrapper, flags, vp);
+    return js::BaseProxyHandler::iterate(cx, wrapper, flags, objp);
 }
 
 template <typename Base, typename Traits>
diff --git a/js/xpconnect/wrappers/XrayWrapper.h b/js/xpconnect/wrappers/XrayWrapper.h
index de51cac582b0..65d781f5845b 100644
--- a/js/xpconnect/wrappers/XrayWrapper.h
+++ b/js/xpconnect/wrappers/XrayWrapper.h
@@ -442,7 +442,7 @@ class XrayWrapper : public Base {
     virtual bool getEnumerablePropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper,
                                            JS::AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, JS::Handle<JSObject*> wrapper, unsigned flags,
-                         JS::MutableHandle<JS::Value> vp) const MOZ_OVERRIDE;
+                         JS::MutableHandle<JSObject*> objp) const MOZ_OVERRIDE;
 
     virtual const char *className(JSContext *cx, JS::HandleObject proxy) const MOZ_OVERRIDE;
     virtual bool defaultValue(JSContext *cx, JS::HandleObject wrapper,
@@ -513,7 +513,7 @@ public:
     virtual bool getOwnEnumerablePropertyKeys(JSContext *cx, JS::Handle<JSObject*> proxy,
                                               JS::AutoIdVector &props) const MOZ_OVERRIDE;
     virtual bool iterate(JSContext *cx, JS::Handle<JSObject*> proxy, unsigned flags,
-                         JS::MutableHandle<JS::Value> vp) const MOZ_OVERRIDE;
+                         JS::MutableHandle<JSObject*> objp) const MOZ_OVERRIDE;
 };
 
 extern const SandboxProxyHandler sandboxProxyHandler;

From d286e091a0d4824f5ef0684b6b7dbba74595ad64 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Wed, 19 Nov 2014 09:46:47 +0900
Subject: [PATCH 31/84] Bug 1101070 - Add missing OSX build flag for the new
 replace-malloc symbol. r=njn,r=khuey

Bug 818922 added a new replace-malloc symbol that the OSX linker tricks need
to know about.
---
 mozglue/build/replace_malloc.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mozglue/build/replace_malloc.mk b/mozglue/build/replace_malloc.mk
index cb0200dc0e17..467f2a5c80a6 100644
--- a/mozglue/build/replace_malloc.mk
+++ b/mozglue/build/replace_malloc.mk
@@ -5,6 +5,7 @@
 ifeq (Darwin_1,$(OS_TARGET)_$(MOZ_REPLACE_MALLOC))
 OS_LDFLAGS += \
   -Wl,-U,_replace_init \
+  -Wl,-U,_replace_get_bridge \
   -Wl,-U,_replace_malloc \
   -Wl,-U,_replace_posix_memalign \
   -Wl,-U,_replace_aligned_alloc \

From e68882a91d40033a6c97e062255bf5548db75a9d Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Wed, 19 Nov 2014 09:46:49 +0900
Subject: [PATCH 32/84] Bug 1098967 - Use native Win32 APIs to append to the
 LogAlloc output. r=nfroyd

Because it turns out that the POSIX API the CRT exposes doesn't do O_APPEND
in a sane manner.
---
 memory/replace/logalloc/FdPrintf.cpp      | 13 +++++--
 memory/replace/logalloc/FdPrintf.h        |  6 ++-
 memory/replace/logalloc/LogAlloc.cpp      | 47 +++++++++++++++--------
 memory/replace/logalloc/replay/Replay.cpp | 19 ++++++---
 4 files changed, 61 insertions(+), 24 deletions(-)

diff --git a/memory/replace/logalloc/FdPrintf.cpp b/memory/replace/logalloc/FdPrintf.cpp
index 798036913640..2f3cdcaa558d 100644
--- a/memory/replace/logalloc/FdPrintf.cpp
+++ b/memory/replace/logalloc/FdPrintf.cpp
@@ -7,12 +7,13 @@
 #include <cstdarg>
 
 #ifdef _WIN32
-#include <io.h>
+#include <windows.h>
 #else
 #include <unistd.h>
 #endif
 #include <cstring>
 #include "mozilla/Assertions.h"
+#include "mozilla/NullPtr.h"
 
 /* Template class allowing a limited number of increments on a value */
 template <typename T>
@@ -46,9 +47,9 @@ private:
 };
 
 void
-FdPrintf(int aFd, const char* aFormat, ...)
+FdPrintf(intptr_t aFd, const char* aFormat, ...)
 {
-  if (aFd == -1) {
+  if (aFd == 0) {
     return;
   }
   char buf[256];
@@ -120,6 +121,12 @@ FdPrintf(int aFd, const char* aFormat, ...)
     f++;
   }
 out:
+#ifdef _WIN32
+  // See comment in FdPrintf.h as to why WriteFile is used.
+  DWORD written;
+  WriteFile(reinterpret_cast<HANDLE>(aFd), buf, b - buf, &written, nullptr);
+#else
   write(aFd, buf, b - buf);
+#endif
   va_end(ap);
 }
diff --git a/memory/replace/logalloc/FdPrintf.h b/memory/replace/logalloc/FdPrintf.h
index 7f0b2925f9bb..9ad3e54a677e 100644
--- a/memory/replace/logalloc/FdPrintf.h
+++ b/memory/replace/logalloc/FdPrintf.h
@@ -12,8 +12,12 @@
  * Only %p and %z are supported.
  * /!\ This function used a fixed-size internal buffer. The caller is
  * expected to not use a format string that may overflow.
+ * The aFd argument is a file descriptor on UNIX and a native win32 file
+ * handle on Windows (from CreateFile). We can't use the windows POSIX
+ * APIs is that they don't support O_APPEND in a multi-process-safe way,
+ * while CreateFile does.
  */
-extern void FdPrintf(int aFd, const char* aFormat, ...)
+extern void FdPrintf(intptr_t aFd, const char* aFormat, ...)
 #ifdef __GNUC__
 __attribute__((format(printf, 2, 3)))
 #endif
diff --git a/memory/replace/logalloc/LogAlloc.cpp b/memory/replace/logalloc/LogAlloc.cpp
index 8ee350892a63..e12f25244233 100644
--- a/memory/replace/logalloc/LogAlloc.cpp
+++ b/memory/replace/logalloc/LogAlloc.cpp
@@ -24,7 +24,8 @@
 #include "base/lock.h"
 
 static const malloc_table_t* sFuncs = nullptr;
-static int sFd = -1;
+static intptr_t sFd = 0;
+static bool sStdoutOrStderr = false;
 
 static Lock sLock;
 
@@ -51,13 +52,8 @@ int pthread_atfork(void (*)(void), void (*)(void), void (*)(void));
 class LogAllocBridge : public ReplaceMallocBridge
 {
   virtual void InitDebugFd(mozilla::DebugFdRegistry& aRegistry) MOZ_OVERRIDE {
-    if (sFd > 2) {
-#ifdef _WIN32
-      intptr_t handle = _get_osfhandle(sFd);
-#else
-      intptr_t handle = sFd;
-#endif
-      aRegistry.RegisterHandle(handle);
+    if (!sStdoutOrStderr) {
+      aRegistry.RegisterHandle(sFd);
     }
   }
 };
@@ -84,25 +80,46 @@ replace_init(const malloc_table_t* aTable)
    * descriptor number. Other values are considered as a file name. */
   char* log = getenv("MALLOC_LOG");
   if (log && *log) {
-    sFd = 0;
+    int fd = 0;
     const char *fd_num = log;
     while (*fd_num) {
       /* Reject non digits. */
       if (*fd_num < '0' || *fd_num > '9') {
-        sFd = -1;
+        fd = -1;
         break;
       }
-      sFd = sFd * 10 + (*fd_num - '0');
+      fd = fd * 10 + (*fd_num - '0');
       /* Reject values >= 10000. */
-      if (sFd >= 10000) {
-        sFd = -1;
+      if (fd >= 10000) {
+        fd = -1;
         break;
       }
       fd_num++;
     }
-    if (sFd == -1) {
-      sFd = open(log, O_WRONLY | O_CREAT | O_APPEND, 0644);
+    if (fd == 1 || fd == 2) {
+      sStdoutOrStderr = true;
     }
+#ifdef _WIN32
+    // See comment in FdPrintf.h as to why CreateFile is used.
+    HANDLE handle;
+    if (fd > 0) {
+      handle = reinterpret_cast<HANDLE>(_get_osfhandle(fd));
+    } else {
+      handle = CreateFileA(log, FILE_APPEND_DATA, FILE_SHARE_READ |
+                           FILE_SHARE_WRITE, nullptr, OPEN_ALWAYS,
+                           FILE_ATTRIBUTE_NORMAL, nullptr);
+    }
+    if (handle != INVALID_HANDLE_VALUE) {
+      sFd = reinterpret_cast<intptr_t>(handle);
+    }
+#else
+    if (fd == -1) {
+      fd = open(log, O_WRONLY | O_CREAT | O_APPEND, 0644);
+    }
+    if (fd > 0) {
+      sFd = fd;
+    }
+#endif
   }
 }
 
diff --git a/memory/replace/logalloc/replay/Replay.cpp b/memory/replace/logalloc/replay/Replay.cpp
index 73fc762d66f3..de75f5af8096 100644
--- a/memory/replace/logalloc/replay/Replay.cpp
+++ b/memory/replace/logalloc/replay/Replay.cpp
@@ -346,7 +346,14 @@ size_t parseNumber(Buffer aBuf)
 class Replay
 {
 public:
-  Replay(): mOps(0) {}
+  Replay(): mOps(0) {
+#ifdef _WIN32
+    // See comment in FdPrintf.h as to why native win32 handles are used.
+    mStdErr = reinterpret_cast<intptr_t>(GetStdHandle(STD_ERROR_HANDLE));
+#else
+    mStdErr = fileno(stderr);
+#endif
+  }
 
   MemSlot& operator[] (size_t index) const
   {
@@ -456,10 +463,11 @@ public:
     }
     jemalloc_stats_t stats;
     ::jemalloc_stats_impl(&stats);
-    FdPrintf(2, "#%zu mapped: %zu; allocated: %zu; waste: %zu; dirty: %zu; "
-                "bookkeep: %zu; binunused: %zu\n", mOps, stats.mapped,
-                stats.allocated, stats.waste, stats.page_cache,
-                stats.bookkeeping, stats.bin_unused);
+    FdPrintf(mStdErr,
+             "#%zu mapped: %zu; allocated: %zu; waste: %zu; dirty: %zu; "
+             "bookkeep: %zu; binunused: %zu\n", mOps, stats.mapped,
+             stats.allocated, stats.waste, stats.page_cache,
+             stats.bookkeeping, stats.bin_unused);
     /* TODO: Add more data, like actual RSS as measured by OS, but compensated
      * for the replay internal data. */
   }
@@ -470,6 +478,7 @@ private:
     memset(aSlot.mPtr, 0x5a, aSlot.mSize);
   }
 
+  intptr_t mStdErr;
   size_t mOps;
   MemSlotList mSlots;
 };

From 46ab4e3fb03ba1be5627389b63dee4a022fcf2eb Mon Sep 17 00:00:00 2001
From: Anthony Jones <ajones@mozilla.com>
Date: Wed, 5 Nov 2014 02:14:00 +1300
Subject: [PATCH 33/84] Bug 1036849 - Create SharedDecoderManager and
 SharedDecoderProxy; r=blakewu

---
 dom/media/MediaDecoderReader.h              |   2 +
 dom/media/fmp4/MP4Reader.cpp                |  45 +++--
 dom/media/fmp4/MP4Reader.h                  |   5 +-
 dom/media/fmp4/PlatformDecoderModule.h      |   4 +-
 dom/media/fmp4/SharedDecoderManager.cpp     | 207 ++++++++++++++++++++
 dom/media/fmp4/SharedDecoderManager.h       |  77 ++++++++
 dom/media/fmp4/moz.build                    |   2 +
 dom/media/mediasource/MediaSourceReader.cpp |   3 +
 dom/media/mediasource/MediaSourceReader.h   |   1 +
 9 files changed, 331 insertions(+), 15 deletions(-)
 create mode 100644 dom/media/fmp4/SharedDecoderManager.cpp
 create mode 100644 dom/media/fmp4/SharedDecoderManager.h

diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index f295f408e19b..45a5a087b997 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -20,6 +20,7 @@ class TimeRanges;
 
 class RequestSampleCallback;
 class MediaDecoderReader;
+class SharedDecoderManager;
 
 // Encapsulates the decoding and reading of media data. Reading can either
 // synchronous and done on the calling "decode" thread, or asynchronous and
@@ -47,6 +48,7 @@ public:
   // Release media resources they should be released in dormant state
   // The reader can be made usable again by calling ReadMetadata().
   virtual void ReleaseMediaResources() {};
+  virtual void SetSharedDecoderManager(SharedDecoderManager* aManager) {}
   // Breaks reference-counted cycles. Called during shutdown.
   // WARNING: If you override this, you must call the base implementation
   // in your override.
diff --git a/dom/media/fmp4/MP4Reader.cpp b/dom/media/fmp4/MP4Reader.cpp
index bed4c5f73704..4c83a847d66f 100644
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@@ -14,6 +14,7 @@
 #include "SharedThreadPool.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/TimeRanges.h"
+#include "SharedDecoderManager.h"
 
 #ifdef MOZ_EME
 #include "mozilla/CDMProxy.h"
@@ -414,12 +415,21 @@ MP4Reader::ReadMetadata(MediaInfo* aInfo,
     const VideoDecoderConfig& video = mDemuxer->VideoConfig();
     mInfo.mVideo.mDisplay =
       nsIntSize(video.display_width, video.display_height);
-    mVideo.mCallback = new  DecoderCallback(this, kVideo);
-    mVideo.mDecoder = mPlatform->CreateH264Decoder(video,
-                                                   mLayersBackendType,
-                                                   mDecoder->GetImageContainer(),
-                                                   mVideo.mTaskQueue,
-                                                   mVideo.mCallback);
+    mVideo.mCallback = new DecoderCallback(this, kVideo);
+    if (mSharedDecoderManager) {
+      mVideo.mDecoder =
+        mSharedDecoderManager->CreateH264Decoder(video,
+                                                 mLayersBackendType,
+                                                 mDecoder->GetImageContainer(),
+                                                 mVideo.mTaskQueue,
+                                                 mVideo.mCallback);
+    } else {
+      mVideo.mDecoder = mPlatform->CreateH264Decoder(video,
+                                                     mLayersBackendType,
+                                                     mDecoder->GetImageContainer(),
+                                                     mVideo.mTaskQueue,
+                                                     mVideo.mCallback);
+    }
     NS_ENSURE_TRUE(mVideo.mDecoder != nullptr, NS_ERROR_FAILURE);
     nsresult rv = mVideo.mDecoder->Init();
     NS_ENSURE_SUCCESS(rv, rv);
@@ -473,12 +483,6 @@ MP4Reader::GetDecoderData(TrackType aTrack)
   return (aTrack == kAudio) ? mAudio : mVideo;
 }
 
-MediaDataDecoder*
-MP4Reader::Decoder(TrackType aTrack)
-{
-  return GetDecoderData(aTrack).mDecoder;
-}
-
 MP4Sample*
 MP4Reader::PopSample(TrackType aTrack)
 {
@@ -884,4 +888,21 @@ void MP4Reader::NotifyResourcesStatusChanged()
 #endif
 }
 
+void
+MP4Reader::SetIdle()
+{
+  if (mSharedDecoderManager && mVideo.mDecoder) {
+    mSharedDecoderManager->SetIdle(mVideo.mDecoder);
+    NotifyResourcesStatusChanged();
+  }
+}
+
+void
+MP4Reader::SetSharedDecoderManager(SharedDecoderManager* aManager)
+{
+#ifdef MOZ_GONK_MEDIACODEC
+  mSharedDecoderManager = aManager;
+#endif
+}
+
 } // namespace mozilla
diff --git a/dom/media/fmp4/MP4Reader.h b/dom/media/fmp4/MP4Reader.h
index b19dbb57e59e..e410cbf3b363 100644
--- a/dom/media/fmp4/MP4Reader.h
+++ b/dom/media/fmp4/MP4Reader.h
@@ -62,9 +62,12 @@ public:
   virtual nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
 
   // For Media Resource Management
+  virtual void SetIdle() MOZ_OVERRIDE;
   virtual bool IsWaitingMediaResources() MOZ_OVERRIDE;
   virtual bool IsDormantNeeded() MOZ_OVERRIDE;
   virtual void ReleaseMediaResources() MOZ_OVERRIDE;
+  virtual void SetSharedDecoderManager(SharedDecoderManager* aManager)
+    MOZ_OVERRIDE;
 
   virtual nsresult ResetDecode() MOZ_OVERRIDE;
 
@@ -179,7 +182,6 @@ private:
   uint64_t mLastReportedNumDecodedFrames;
 
   DecoderData& GetDecoderData(mp4_demuxer::TrackType aTrack);
-  MediaDataDecoder* Decoder(mp4_demuxer::TrackType aTrack);
 
   layers::LayersBackend mLayersBackendType;
 
@@ -193,6 +195,7 @@ private:
 
   bool mIndexReady;
   Monitor mIndexMonitor;
+  nsRefPtr<SharedDecoderManager> mSharedDecoderManager;
 };
 
 } // namespace mozilla
diff --git a/dom/media/fmp4/PlatformDecoderModule.h b/dom/media/fmp4/PlatformDecoderModule.h
index 29ad1b7e3e41..237108457679 100644
--- a/dom/media/fmp4/PlatformDecoderModule.h
+++ b/dom/media/fmp4/PlatformDecoderModule.h
@@ -230,8 +230,8 @@ public:
   virtual bool IsDormantNeeded() {
     return false;
   };
-  virtual void ReleaseMediaResources() {};
-  virtual void ReleaseDecoder() {};
+  virtual void ReleaseMediaResources() {}
+  virtual void ReleaseDecoder() {}
 };
 
 } // namespace mozilla
diff --git a/dom/media/fmp4/SharedDecoderManager.cpp b/dom/media/fmp4/SharedDecoderManager.cpp
new file mode 100644
index 000000000000..b8a98ba7da54
--- /dev/null
+++ b/dom/media/fmp4/SharedDecoderManager.cpp
@@ -0,0 +1,207 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "SharedDecoderManager.h"
+#include "mp4_demuxer/DecoderData.h"
+
+namespace mozilla {
+
+class SharedDecoderCallback : public MediaDataDecoderCallback
+{
+public:
+  SharedDecoderCallback(SharedDecoderManager* aManager) : mManager(aManager) {}
+
+  virtual void Output(MediaData* aData) MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->mActiveCallback->Output(aData);
+    }
+  }
+  virtual void Error() MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->mActiveCallback->Error();
+    }
+  }
+  virtual void InputExhausted() MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->mActiveCallback->InputExhausted();
+    }
+  }
+  virtual void DrainComplete() MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->DrainComplete();
+    }
+  }
+  virtual void NotifyResourcesStatusChanged() MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->mActiveCallback->NotifyResourcesStatusChanged();
+    }
+  }
+  virtual void ReleaseMediaResources() MOZ_OVERRIDE
+  {
+    if (mManager->mActiveCallback) {
+      mManager->mActiveCallback->ReleaseMediaResources();
+    }
+  }
+
+  SharedDecoderManager* mManager;
+};
+
+SharedDecoderManager::SharedDecoderManager()
+  : mActiveProxy(nullptr)
+  , mActiveCallback(nullptr)
+  , mWaitForInternalDrain(false)
+  , mMonitor("SharedDecoderProxy")
+{
+  mCallback = new SharedDecoderCallback(this);
+}
+
+SharedDecoderManager::~SharedDecoderManager() {}
+
+already_AddRefed<MediaDataDecoder>
+SharedDecoderManager::CreateH264Decoder(
+  const mp4_demuxer::VideoDecoderConfig& aConfig,
+  layers::LayersBackend aLayersBackend, layers::ImageContainer* aImageContainer,
+  MediaTaskQueue* aVideoTaskQueue, MediaDataDecoderCallback* aCallback)
+{
+  if (!mDecoder) {
+    nsAutoPtr<PlatformDecoderModule> platform(PlatformDecoderModule::Create());
+    mDecoder = platform->CreateH264Decoder(
+      aConfig, aLayersBackend, aImageContainer, aVideoTaskQueue, mCallback);
+    if (!mDecoder) {
+      return nullptr;
+    }
+    nsresult rv = mDecoder->Init();
+    NS_ENSURE_SUCCESS(rv, nullptr);
+  }
+
+  nsRefPtr<SharedDecoderProxy> proxy(new SharedDecoderProxy(this, aCallback));
+  return proxy.forget();
+}
+
+void
+SharedDecoderManager::Select(SharedDecoderProxy* aProxy)
+{
+  if (mActiveProxy == aProxy) {
+    return;
+  }
+  SetIdle(mActiveProxy);
+
+  mActiveProxy = aProxy;
+  mActiveCallback = aProxy->mCallback;
+}
+
+void
+SharedDecoderManager::SetIdle(MediaDataDecoder* aProxy)
+{
+  if (aProxy && mActiveProxy == aProxy) {
+    mWaitForInternalDrain = true;
+    mActiveProxy->Drain();
+    MonitorAutoLock mon(mMonitor);
+    while (mWaitForInternalDrain) {
+      mon.Wait();
+    }
+    mActiveProxy->Flush();
+    mActiveProxy = nullptr;
+  }
+}
+
+void
+SharedDecoderManager::DrainComplete()
+{
+  if (mWaitForInternalDrain) {
+    MonitorAutoLock mon(mMonitor);
+    mWaitForInternalDrain = false;
+    mon.NotifyAll();
+  } else {
+    mActiveCallback->DrainComplete();
+  }
+}
+
+SharedDecoderProxy::SharedDecoderProxy(
+  SharedDecoderManager* aManager, MediaDataDecoderCallback* aCallback)
+  : mManager(aManager), mCallback(aCallback)
+{
+}
+
+SharedDecoderProxy::~SharedDecoderProxy() { Shutdown(); }
+
+nsresult
+SharedDecoderProxy::Init()
+{
+  return NS_OK;
+}
+
+nsresult
+SharedDecoderProxy::Input(mp4_demuxer::MP4Sample* aSample)
+{
+  if (mManager->mActiveProxy != this) {
+    mManager->Select(this);
+  }
+  return mManager->mDecoder->Input(aSample);
+  return NS_OK;
+}
+
+nsresult
+SharedDecoderProxy::Flush()
+{
+  if (mManager->mActiveProxy == this) {
+    return mManager->mDecoder->Flush();
+  }
+  return NS_OK;
+}
+
+nsresult
+SharedDecoderProxy::Drain()
+{
+  if (mManager->mActiveProxy == this) {
+    return mManager->mDecoder->Drain();
+  }
+  return NS_OK;
+}
+
+nsresult
+SharedDecoderProxy::Shutdown()
+{
+  mManager->SetIdle(this);
+  return NS_OK;
+}
+
+bool
+SharedDecoderProxy::IsWaitingMediaResources()
+{
+  if (mManager->mActiveProxy == this) {
+    return mManager->mDecoder->IsWaitingMediaResources();
+  }
+  return mManager->mActiveProxy != nullptr;
+}
+
+bool
+SharedDecoderProxy::IsDormantNeeded()
+{
+  return mManager->mDecoder->IsDormantNeeded();
+}
+
+void
+SharedDecoderProxy::ReleaseMediaResources()
+{
+  if (mManager->mActiveProxy == this) {
+    mManager->mDecoder->ReleaseMediaResources();
+  }
+}
+
+void
+SharedDecoderProxy::ReleaseDecoder()
+{
+  if (mManager->mActiveProxy == this) {
+    mManager->mDecoder->ReleaseMediaResources();
+  }
+}
+}
diff --git a/dom/media/fmp4/SharedDecoderManager.h b/dom/media/fmp4/SharedDecoderManager.h
new file mode 100644
index 000000000000..13e8ba230a72
--- /dev/null
+++ b/dom/media/fmp4/SharedDecoderManager.h
@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef SHARED_DECODER_MANAGER_H_
+#define SHARED_DECODER_MANAGER_H_
+
+#include "PlatformDecoderModule.h"
+#include "mozilla/Monitor.h"
+
+namespace mozilla
+{
+
+class MediaDataDecoder;
+class SharedDecoderProxy;
+class SharedDecoderCallback;
+
+class SharedDecoderManager
+{
+public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SharedDecoderManager)
+
+  SharedDecoderManager();
+
+  already_AddRefed<MediaDataDecoder> CreateH264Decoder(
+    const mp4_demuxer::VideoDecoderConfig& aConfig,
+    layers::LayersBackend aLayersBackend,
+    layers::ImageContainer* aImageContainer, MediaTaskQueue* aVideoTaskQueue,
+    MediaDataDecoderCallback* aCallback);
+
+  void SetReader(MediaDecoderReader* aReader);
+  void Select(SharedDecoderProxy* aProxy);
+  void SetIdle(MediaDataDecoder* aProxy);
+
+  friend class SharedDecoderProxy;
+  friend class SharedDecoderCallback;
+
+private:
+  virtual ~SharedDecoderManager();
+  void DrainComplete();
+
+  nsRefPtr<MediaDataDecoder> mDecoder;
+  SharedDecoderProxy* mActiveProxy;
+  MediaDataDecoderCallback* mActiveCallback;
+  nsAutoPtr<MediaDataDecoderCallback> mCallback;
+  bool mWaitForInternalDrain;
+  Monitor mMonitor;
+};
+
+class SharedDecoderProxy : public MediaDataDecoder
+{
+public:
+  SharedDecoderProxy(SharedDecoderManager* aManager,
+                     MediaDataDecoderCallback* aCallback);
+  virtual ~SharedDecoderProxy();
+
+  virtual nsresult Init() MOZ_OVERRIDE;
+  virtual nsresult Input(mp4_demuxer::MP4Sample* aSample) MOZ_OVERRIDE;
+  virtual nsresult Flush() MOZ_OVERRIDE;
+  virtual nsresult Drain() MOZ_OVERRIDE;
+  virtual nsresult Shutdown() MOZ_OVERRIDE;
+  virtual bool IsWaitingMediaResources() MOZ_OVERRIDE;
+  virtual bool IsDormantNeeded() MOZ_OVERRIDE;
+  virtual void ReleaseMediaResources() MOZ_OVERRIDE;
+  virtual void ReleaseDecoder() MOZ_OVERRIDE;
+
+  friend class SharedDecoderManager;
+
+private:
+  nsRefPtr<SharedDecoderManager> mManager;
+  MediaDataDecoderCallback* mCallback;
+};
+}
+
+#endif
diff --git a/dom/media/fmp4/moz.build b/dom/media/fmp4/moz.build
index 14267f54a34e..bec530604ef5 100644
--- a/dom/media/fmp4/moz.build
+++ b/dom/media/fmp4/moz.build
@@ -8,12 +8,14 @@ EXPORTS += [
     'MP4Decoder.h',
     'MP4Reader.h',
     'PlatformDecoderModule.h',
+    'SharedDecoderManager.h',
 ]
 
 UNIFIED_SOURCES += [
     'BlankDecoderModule.cpp',
     'MP4Decoder.cpp',
     'PlatformDecoderModule.cpp',
+    'SharedDecoderManager.cpp',
 ]
 
 SOURCES += [
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index d998777e024e..3dd796a955d7 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -14,6 +14,7 @@
 #include "MediaSourceUtils.h"
 #include "SourceBufferDecoder.h"
 #include "TrackBuffer.h"
+#include "SharedDecoderManager.h"
 
 #ifdef MOZ_FMP4
 #include "MP4Decoder.h"
@@ -62,6 +63,7 @@ MediaSourceReader::MediaSourceReader(MediaSourceDecoder* aDecoder)
   , mAudioIsSeeking(false)
   , mVideoIsSeeking(false)
   , mHasEssentialTrackBuffers(false)
+  , mSharedDecoderManager(new SharedDecoderManager())
 {
 }
 
@@ -371,6 +373,7 @@ MediaSourceReader::CreateSubDecoder(const nsACString& aType)
     new MediaDataDecodedListener<MediaSourceReader>(this, GetTaskQueue());
   reader->SetCallback(callback);
   reader->SetTaskQueue(GetTaskQueue());
+  reader->SetSharedDecoderManager(mSharedDecoderManager);
   reader->Init(nullptr);
 
   MSE_DEBUG("MediaSourceReader(%p)::CreateSubDecoder subdecoder %p subreader %p",
diff --git a/dom/media/mediasource/MediaSourceReader.h b/dom/media/mediasource/MediaSourceReader.h
index 9238e0f6bdd0..fba1d9f965e4 100644
--- a/dom/media/mediasource/MediaSourceReader.h
+++ b/dom/media/mediasource/MediaSourceReader.h
@@ -175,6 +175,7 @@ private:
   bool mVideoIsSeeking;
 
   bool mHasEssentialTrackBuffers;
+  nsRefPtr<SharedDecoderManager> mSharedDecoderManager;
 };
 
 } // namespace mozilla

From 92049c1863aa70236eb83b1d46815d40acda48b4 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 18 Nov 2014 17:21:08 -0800
Subject: [PATCH 34/84] Backed out changeset 41ecbb9a5fac (bug 1092634) for
 reftest bustage

---
 gfx/2d/FilterNodeSoftware.cpp                 |  8 +--
 gfx/src/FilterSupport.cpp                     | 57 -------------------
 .../svg/filters/outside-sourcegraphic-1.svg   | 10 ----
 .../svg/filters/outside-sourcegraphic-2.svg   | 13 -----
 .../svg/filters/outside-sourcegraphic-3.svg   | 15 -----
 .../svg/filters/outside-sourcegraphic-ref.svg |  7 ---
 layout/reftests/svg/filters/reftest.list      |  4 --
 7 files changed, 1 insertion(+), 113 deletions(-)
 delete mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-1.svg
 delete mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-2.svg
 delete mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-3.svg
 delete mode 100644 layout/reftests/svg/filters/outside-sourcegraphic-ref.svg

diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index 33585048c329..bb111c511ef5 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -1460,9 +1460,6 @@ FilterNodeColorMatrixSoftware::RequestFromInputsForRect(const IntRect &aRect)
 IntRect
 FilterNodeColorMatrixSoftware::GetOutputRectInRect(const IntRect& aRect)
 {
-  if (mMatrix._54 > 0.0f) {
-    return aRect;
-  }
   return GetInputRectInRect(IN_COLOR_MATRIX_IN, aRect);
 }
 
@@ -1811,10 +1808,7 @@ FilterNodeComponentTransferSoftware::RequestFromInputsForRect(const IntRect &aRe
 IntRect
 FilterNodeComponentTransferSoftware::GetOutputRectInRect(const IntRect& aRect)
 {
-  if (mDisableA) {
-    return GetInputRectInRect(IN_TRANSFER_IN, aRect);
-  }
-  return aRect;
+  return GetInputRectInRect(IN_TRANSFER_IN, aRect);
 }
 
 int32_t
diff --git a/gfx/src/FilterSupport.cpp b/gfx/src/FilterSupport.cpp
index 697d9dfe2215..9a31822cad65 100644
--- a/gfx/src/FilterSupport.cpp
+++ b/gfx/src/FilterSupport.cpp
@@ -1389,42 +1389,6 @@ FilterSupport::ComputeResultChangeRegion(const FilterDescription& aFilter,
   return resultChangeRegions[resultChangeRegions.Length() - 1];
 }
 
-static float
-ResultOfZeroUnderTransferFunction(const AttributeMap& aFunctionAttributes)
-{
-  switch (aFunctionAttributes.GetUint(eComponentTransferFunctionType)) {
-    case SVG_FECOMPONENTTRANSFER_TYPE_TABLE:
-    {
-      const nsTArray<float>& tableValues =
-        aFunctionAttributes.GetFloats(eComponentTransferFunctionTableValues);
-      if (tableValues.Length() < 2) {
-        return 0.0f;
-      }
-      return tableValues[0];
-    }
-
-    case SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE:
-    {
-      const nsTArray<float>& tableValues =
-        aFunctionAttributes.GetFloats(eComponentTransferFunctionTableValues);
-      if (tableValues.Length() < 1) {
-        return 0.0f;
-      }
-      return tableValues[0];
-    }
-
-    case SVG_FECOMPONENTTRANSFER_TYPE_LINEAR:
-      return aFunctionAttributes.GetFloat(eComponentTransferFunctionIntercept);
-
-    case SVG_FECOMPONENTTRANSFER_TYPE_GAMMA:
-      return aFunctionAttributes.GetFloat(eComponentTransferFunctionOffset);
-
-    case SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY:
-    default:
-      return 0.0f;
-  }
-}
-
 nsIntRegion
 FilterSupport::PostFilterExtentsForPrimitive(const FilterPrimitiveDescription& aDescription,
                                              const nsTArray<nsIntRegion>& aInputExtents)
@@ -1475,27 +1439,6 @@ FilterSupport::PostFilterExtentsForPrimitive(const FilterPrimitiveDescription& a
       return ThebesIntRect(aDescription.PrimitiveSubregion());
     }
 
-    case PrimitiveType::ColorMatrix:
-    {
-      if (atts.GetUint(eColorMatrixType) == (uint32_t)SVG_FECOLORMATRIX_TYPE_MATRIX) {
-        const nsTArray<float>& values = atts.GetFloats(eColorMatrixValues);
-        if (values[19] > 0.0f) {
-          return ThebesIntRect(aDescription.PrimitiveSubregion());
-        }
-      }
-      return aInputExtents[0];
-    }
-
-    case PrimitiveType::ComponentTransfer:
-    {
-      AttributeMap functionAttributes =
-        atts.GetAttributeMap(eComponentTransferFunctionA);
-      if (ResultOfZeroUnderTransferFunction(functionAttributes) > 0.0f) {
-        return ThebesIntRect(aDescription.PrimitiveSubregion());
-      }
-      return aInputExtents[0];
-    }
-
     case PrimitiveType::Turbulence:
     case PrimitiveType::Image:
     {
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-1.svg b/layout/reftests/svg/filters/outside-sourcegraphic-1.svg
deleted file mode 100644
index f360aa12fd0e..000000000000
--- a/layout/reftests/svg/filters/outside-sourcegraphic-1.svg
+++ /dev/null
@@ -1,10 +0,0 @@
-<!--
-     Any copyright is dedicated to the Public Domain.
-     http://creativecommons.org/publicdomain/zero/1.0/
--->
-<svg xmlns="http://www.w3.org/2000/svg">
-  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
-    <feFlood flood-color="lime"/>
-  </filter>
-  <rect width="100" height="100" filter="url(#f)"/>
-</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-2.svg b/layout/reftests/svg/filters/outside-sourcegraphic-2.svg
deleted file mode 100644
index 6699d620b9be..000000000000
--- a/layout/reftests/svg/filters/outside-sourcegraphic-2.svg
+++ /dev/null
@@ -1,13 +0,0 @@
-<!--
-     Any copyright is dedicated to the Public Domain.
-     http://creativecommons.org/publicdomain/zero/1.0/
--->
-<svg xmlns="http://www.w3.org/2000/svg">
-  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
-    <feColorMatrix type="matrix" values="0 0 0 0  0
-                                         0 0 0 0  1
-                                         0 0 0 0  0
-                                         0 0 0 0  1"/>
-  </filter>
-  <rect width="100" height="100" filter="url(#f)"/>
-</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-3.svg b/layout/reftests/svg/filters/outside-sourcegraphic-3.svg
deleted file mode 100644
index f8f6b363872c..000000000000
--- a/layout/reftests/svg/filters/outside-sourcegraphic-3.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<!--
-     Any copyright is dedicated to the Public Domain.
-     http://creativecommons.org/publicdomain/zero/1.0/
--->
-<svg xmlns="http://www.w3.org/2000/svg">
-  <filter id="f" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="200">
-    <feComponentTransfer>
-      <feFuncR type="table" tableValues="0 0" />
-      <feFuncG type="table" tableValues="1 1" />
-      <feFuncB type="table" tableValues="0 0" />
-      <feFuncA type="table" tableValues="1 1" />
-    </feComponentTransfer>
-  </filter>
-  <rect width="100" height="100" filter="url(#f)"/>
-</svg>
diff --git a/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg b/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg
deleted file mode 100644
index a336d2215849..000000000000
--- a/layout/reftests/svg/filters/outside-sourcegraphic-ref.svg
+++ /dev/null
@@ -1,7 +0,0 @@
-<!--
-     Any copyright is dedicated to the Public Domain.
-     http://creativecommons.org/publicdomain/zero/1.0/
--->
-<svg xmlns="http://www.w3.org/2000/svg">
-  <rect width="200" height="200" fill="lime"/>
-</svg>
diff --git a/layout/reftests/svg/filters/reftest.list b/layout/reftests/svg/filters/reftest.list
index 0fde197fdfd0..d5cdd1bed2a8 100644
--- a/layout/reftests/svg/filters/reftest.list
+++ b/layout/reftests/svg/filters/reftest.list
@@ -116,7 +116,3 @@ fuzzy(2,2659) skip-if(d2d) == feSpecularLighting-1.svg feSpecularLighting-1-ref.
 == fePointLight-zoomed-page.svg fePointLight-zoomed-page-ref.svg
 
 == feTurbulence-offset.svg feTurbulence-offset-ref.svg
-
-== outside-sourcegraphic-1.svg outside-sourcegraphic-ref.svg
-== outside-sourcegraphic-2.svg outside-sourcegraphic-ref.svg
-== outside-sourcegraphic-3.svg outside-sourcegraphic-ref.svg

From 6ea347d6f08a14fd10077f052a3c13db759d5d89 Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 10:58:51 +1300
Subject: [PATCH 35/84] Bug 1065215 - MSE endOfStream() called within an
 'updateend' event can fail with 'object no longer usable' - r=karl Reopens
 the MediaSource when SourceBuffer::Remove is called on an Ended MediaSource.
 Only run the Range Removal algorithm when MediaSource duration is changed
 instead of calling Remove on SourceBuffers. Updates tests for the fact that
 update{start,end} can now be called more than once due to DurationChange.

--HG--
extra : rebase_source : e718144ba2c36b4fa0194719e7f06fe6e931e292
---
 dom/media/mediasource/MediaSource.cpp         |  8 +--
 dom/media/mediasource/SourceBuffer.cpp        | 11 +++-
 dom/media/mediasource/SourceBuffer.h          |  3 ++
 dom/media/mediasource/SourceBufferList.cpp    |  9 ++--
 dom/media/mediasource/SourceBufferList.h      |  5 +-
 dom/media/mediasource/test/mochitest.ini      |  2 +
 .../mediasource/test/test_BufferedSeek.html   | 10 +++-
 .../mediasource/test/test_EndOfStream.html    | 50 +++++++++++++++++++
 .../mediasource/test/test_FrameSelection.html | 10 ++--
 .../mediasource/test/test_MediaSource.html    | 14 ++++--
 .../test/test_SeekableAfterEndOfStream.html   | 10 +++-
 .../test_SeekableAfterEndOfStreamSplit.html   |  2 +-
 .../mediasource/test/test_SplitAppend.html    | 10 ++--
 .../test/test_SplitAppendDelay.html           | 10 ++--
 14 files changed, 119 insertions(+), 35 deletions(-)
 create mode 100644 dom/media/mediasource/test/test_EndOfStream.html

diff --git a/dom/media/mediasource/MediaSource.cpp b/dom/media/mediasource/MediaSource.cpp
index 6a45d1118cbe..a41fe9eb2542 100644
--- a/dom/media/mediasource/MediaSource.cpp
+++ b/dom/media/mediasource/MediaSource.cpp
@@ -418,14 +418,10 @@ void
 MediaSource::DurationChange(double aOldDuration, double aNewDuration)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MSE_DEBUG("MediaSource(%p)::DurationChange(aNewDuration=%f)", this, aNewDuration);
+  MSE_DEBUG("MediaSource(%p)::DurationChange(aOldDuration=%f, aNewDuration=%f)", this, aOldDuration, aNewDuration);
 
   if (aNewDuration < aOldDuration) {
-    ErrorResult rv;
-    mSourceBuffers->Remove(aNewDuration, aOldDuration, rv);
-    if (rv.Failed()) {
-      return;
-    }
+    mSourceBuffers->RangeRemoval(aNewDuration, aOldDuration);
   }
   // TODO: If partial audio frames/text cues exist, clamp duration based on mSourceBuffers.
 }
diff --git a/dom/media/mediasource/SourceBuffer.cpp b/dom/media/mediasource/SourceBuffer.cpp
index 320e2a6559e1..838e02c56ba9 100644
--- a/dom/media/mediasource/SourceBuffer.cpp
+++ b/dom/media/mediasource/SourceBuffer.cpp
@@ -188,10 +188,19 @@ SourceBuffer::Remove(double aStart, double aEnd, ErrorResult& aRv)
     aRv.Throw(NS_ERROR_DOM_INVALID_ACCESS_ERR);
     return;
   }
-  if (mUpdating || mMediaSource->ReadyState() != MediaSourceReadyState::Open) {
+  if (mUpdating) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
+  if (mMediaSource->ReadyState() == MediaSourceReadyState::Ended) {
+    mMediaSource->SetReadyState(MediaSourceReadyState::Open);
+  }
+  RangeRemoval(aStart, aEnd);
+}
+
+void
+SourceBuffer::RangeRemoval(double aStart, double aEnd)
+{
   StartUpdating();
   /// TODO: Run coded frame removal algorithm.
 
diff --git a/dom/media/mediasource/SourceBuffer.h b/dom/media/mediasource/SourceBuffer.h
index 5be60b50a219..88a6f892a1db 100644
--- a/dom/media/mediasource/SourceBuffer.h
+++ b/dom/media/mediasource/SourceBuffer.h
@@ -108,6 +108,9 @@ public:
   double GetBufferedStart();
   double GetBufferedEnd();
 
+  // Runs the range removal algorithm as defined by the MSE spec.
+  void RangeRemoval(double aStart, double aEnd);
+
 #if defined(DEBUG)
   void Dump(const char* aPath);
 #endif
diff --git a/dom/media/mediasource/SourceBufferList.cpp b/dom/media/mediasource/SourceBufferList.cpp
index d833bc9ddbc9..041fbb80ed96 100644
--- a/dom/media/mediasource/SourceBufferList.cpp
+++ b/dom/media/mediasource/SourceBufferList.cpp
@@ -108,15 +108,12 @@ SourceBufferList::AnyUpdating()
 }
 
 void
-SourceBufferList::Remove(double aStart, double aEnd, ErrorResult& aRv)
+SourceBufferList::RangeRemoval(double aStart, double aEnd)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MSE_DEBUG("SourceBufferList(%p)::Remove(aStart=%f, aEnd=%f", this, aStart, aEnd);
+  MSE_DEBUG("SourceBufferList(%p)::RangeRemoval(aStart=%f, aEnd=%f", this, aStart, aEnd);
   for (uint32_t i = 0; i < mSourceBuffers.Length(); ++i) {
-    mSourceBuffers[i]->Remove(aStart, aEnd, aRv);
-    if (aRv.Failed()) {
-      return;
-    }
+    mSourceBuffers[i]->RangeRemoval(aStart, aEnd);
   }
 }
 
diff --git a/dom/media/mediasource/SourceBufferList.h b/dom/media/mediasource/SourceBufferList.h
index ca5087f2ea22..de02b914a435 100644
--- a/dom/media/mediasource/SourceBufferList.h
+++ b/dom/media/mediasource/SourceBufferList.h
@@ -66,9 +66,8 @@ public:
   // Returns true if updating is true on any SourceBuffers in the list.
   bool AnyUpdating();
 
-  // Calls Remove(aStart, aEnd) on each SourceBuffer in the list.  Aborts on
-  // first error, with result returned in aRv.
-  void Remove(double aStart, double aEnd, ErrorResult& aRv);
+  // Runs the range removal steps from the MSE specification on each SourceBuffer.
+  void RangeRemoval(double aStart, double aEnd);
 
   // Mark all SourceBuffers input buffers as ended.
   void Ended();
diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index 9d527391816b..76b2561e336a 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -9,6 +9,8 @@ support-files =
 [test_MediaSource_disabled.html]
 [test_BufferedSeek.html]
 [test_BufferingWait.html]
+[test_EndOfStream.html]
+skip-if = (toolkit == 'android') #timeout android only bug 1101187
 [test_FrameSelection.html]
 [test_HaveMetadataUnbufferedSeek.html]
 [test_LoadedMetadataFired.html]
diff --git a/dom/media/mediasource/test/test_BufferedSeek.html b/dom/media/mediasource/test/test_BufferedSeek.html
index b800a573576f..949fee773b7d 100644
--- a/dom/media/mediasource/test/test_BufferedSeek.html
+++ b/dom/media/mediasource/test/test_BufferedSeek.html
@@ -12,6 +12,8 @@
 
 SimpleTest.waitForExplicitFinish();
 
+var updateCount = 0;
+
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -19,7 +21,13 @@ runWithMSE(function (ms, v) {
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer));
       sb.addEventListener("updateend", function () {
-        ms.endOfStream()
+        updateCount++;
+        /* Ensure that we endOfStream on the first update event only as endOfStream can
+           raise more if the duration of the last buffered range and the intial duration
+           differ. See bug 1065207 */
+        if (updateCount == 1) {
+          ms.endOfStream();
+        };
       });
     });
 
diff --git a/dom/media/mediasource/test/test_EndOfStream.html b/dom/media/mediasource/test/test_EndOfStream.html
new file mode 100644
index 000000000000..655d21cd320b
--- /dev/null
+++ b/dom/media/mediasource/test/test_EndOfStream.html
@@ -0,0 +1,50 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>MSE: endOfStream call after an appendBuffer</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+runWithMSE(function () {
+  var ms = new MediaSource();
+
+  var v = document.createElement("video");
+  v.src = URL.createObjectURL(ms);
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    var sb = ms.addSourceBuffer("video/webm");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 88966));
+      var count = 0;
+      sb.addEventListener("updateend", function () {
+        ++count;
+        if (count == 1) {
+          setTimeout(function() {
+                       var fail = false;
+                       try {
+                         ms.endOfStream();
+                       } catch (e) {
+                         fail = true;
+                       }
+                       ok(!fail, "MediaSource.endOfStream succeeded");
+                       SimpleTest.finish();
+                     }, 0);
+        }
+      });
+    });
+  });
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/media/mediasource/test/test_FrameSelection.html b/dom/media/mediasource/test/test_FrameSelection.html
index d75d8f7ddedd..bb2634c706a1 100644
--- a/dom/media/mediasource/test/test_FrameSelection.html
+++ b/dom/media/mediasource/test/test_FrameSelection.html
@@ -12,6 +12,8 @@
 
 SimpleTest.waitForExplicitFinish();
 
+var updateCount = 0;
+
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -34,13 +36,13 @@ runWithMSE(function (ms, v) {
       fetchWithXHR("seek_lowres.webm", function (arrayBuffer) {
         // Append initialization segment.
         sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 438));
-        var first = true;
         sb.addEventListener("updateend", function () {
-          if (first) {
+          updateCount++;
+          if (updateCount == 1) {
             // Append media segment covering range [2, 4].
             sb.appendBuffer(new Uint8Array(arrayBuffer, 51003));
-            first = false;
-          } else {
+          }
+          else if (updateCount == 2) {
             ms.endOfStream();
             target = targets.shift();
             v.currentTime = target.currentTime;
diff --git a/dom/media/mediasource/test/test_MediaSource.html b/dom/media/mediasource/test/test_MediaSource.html
index 131d64b1c485..53c03cefa130 100644
--- a/dom/media/mediasource/test/test_MediaSource.html
+++ b/dom/media/mediasource/test/test_MediaSource.html
@@ -57,7 +57,12 @@ runWithMSE(function () {
     sb.addEventListener("update", function () {
       is(sb.updating, false, "SourceBuffer.updating is expected value in update event");
       updateCount++;
-      ms.endOfStream();
+      /* Ensure that we endOfStream on the first update event only as endOfStream can
+         raise more if the duration of the last buffered range and the intial duration
+         differ. See bug 1065207 */
+      if (updateCount == 1) {
+        ms.endOfStream();
+      }
     });
 
     sb.addEventListener("updatestart", function () {
@@ -84,9 +89,10 @@ runWithMSE(function () {
     // XXX: Duration should be exactly 4.0, see bug 1065207.
     ok(Math.abs(v.duration - 4) <= 0.002, "Video has correct duration");
     ok(Math.abs(v.currentTime - 4) <= 0.002, "Video has played to end");
-    is(updateCount, 1, "update event received");
-    is(updateendCount, 1, "updateend event received");
-    is(updatestartCount, 1, "updatestart event received");
+    // XXX: 2 update events can be received dueto duration differences, see bug 1065207.
+    ok(updateCount == 1 || updateCount == 2, "update event received");
+    ok(updateendCount == 1 || updateendCount == 2, "updateend event received");
+    ok(updatestartCount == 1 || updatestartCount == 2, "updatestart event received");
     is(loadedmetadataCount, 1, "loadedmetadata event received");
     v.parentNode.removeChild(v);
     SimpleTest.finish();
diff --git a/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html b/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
index 7ffe68686685..850434429a24 100644
--- a/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
+++ b/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
@@ -12,6 +12,8 @@
 
 SimpleTest.waitForExplicitFinish();
 
+var updateCount = 0;
+
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -19,7 +21,13 @@ runWithMSE(function (ms, v) {
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer));
       sb.addEventListener("updateend", function () {
-        ms.endOfStream()
+        updateCount++;
+        /* Ensure that we endOfStream on the first update event only as endOfStream can
+           raise more if the duration of the last buffered range and the intial duration
+           differ. See bug 1065207 */
+        if (updateCount == 1) {
+          ms.endOfStream();
+        };
       });
     });
 
diff --git a/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html b/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
index 5f75f11ffec2..771f9b159a60 100644
--- a/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
+++ b/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
@@ -24,7 +24,7 @@ runWithMSE(function (ms, v) {
         if (updateCount == 1) {
           sb.appendBuffer(new Uint8Array(arrayBuffer, 25223));
         }
-        else {
+        else if (updateCount == 2) {
           ms.endOfStream();
         }
       });
diff --git a/dom/media/mediasource/test/test_SplitAppend.html b/dom/media/mediasource/test/test_SplitAppend.html
index f743032080d7..e87bd00edca5 100644
--- a/dom/media/mediasource/test/test_SplitAppend.html
+++ b/dom/media/mediasource/test/test_SplitAppend.html
@@ -12,18 +12,20 @@
 
 SimpleTest.waitForExplicitFinish();
 
+var updateCount = 0;
+
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
 
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
-      var first = true;
       sb.addEventListener("updateend", function () {
-        if (first) {
+        updateCount++;
+        if (updateCount == 1) {
           sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
-          first = false;
-        } else {
+        }
+        else if (updateCount == 2) {
           ms.endOfStream();
         }
       });
diff --git a/dom/media/mediasource/test/test_SplitAppendDelay.html b/dom/media/mediasource/test/test_SplitAppendDelay.html
index 10dde8b8156e..f4604b3d0c1c 100644
--- a/dom/media/mediasource/test/test_SplitAppendDelay.html
+++ b/dom/media/mediasource/test/test_SplitAppendDelay.html
@@ -12,20 +12,22 @@
 
 SimpleTest.waitForExplicitFinish();
 
+var updateCount = 0;
+
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
 
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
-      var first = true;
       sb.addEventListener("updateend", function () {
-        if (first) {
+        updateCount++;
+        if (updateCount == 1) {
           window.setTimeout(function () {
             sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
-            first = false;
           }, 1000);
-        } else {
+        }
+        else if (updateCount == 2) {
           ms.endOfStream();
         }
       });

From 063a7358ac142f7e877eb4e1b2cd12fdcaeb723a Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 10:58:55 +1300
Subject: [PATCH 36/84] Bug 1065215 - Fix EME test for changes to
 MediaSource::endOfStream - r=cpearce

--HG--
extra : rebase_source : ca90b01f0f47a64b25d6c6a3cdb752ca14c797c7
---
 dom/media/test/eme.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dom/media/test/eme.js b/dom/media/test/eme.js
index 398f4449281b..c98b20d39de2 100644
--- a/dom/media/test/eme.js
+++ b/dom/media/test/eme.js
@@ -121,6 +121,15 @@ function PlayFragmented(test, elem, token)
     var curFragment = 0;
 
     function addNextFragment() {
+      /* We can get another updateevent as a result of calling ms.endOfStream() if
+         the highest end time of our source buffers is different from that of the
+         media source duration. Due to bug 1065207 this can happen because of
+         inaccuracies in the frame duration calculations. Check if we are already
+         "ended" and ignore the update event */
+      if (ms.readyState == "ended") {
+        return;
+      }
+
       if (curFragment >= test.fragments.length) {
         Log(token, "addNextFragment() end of stream");
         ms.endOfStream();

From e6afd13e304adc38eac37f555393e4710a7918e5 Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 10:59:00 +1300
Subject: [PATCH 37/84] Bug 1065215 - web platform test should expect pass for
 SourceBuffer.remove reopening MediaSource - r=karl

--HG--
extra : rebase_source : 2bf46a82714b8841ef3de381319c841138f5fe32
---
 .../web-platform/meta/media-source/mediasource-remove.html.ini | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/testing/web-platform/meta/media-source/mediasource-remove.html.ini b/testing/web-platform/meta/media-source/mediasource-remove.html.ini
index e1dfbe1f4562..ff9097294991 100644
--- a/testing/web-platform/meta/media-source/mediasource-remove.html.ini
+++ b/testing/web-platform/meta/media-source/mediasource-remove.html.ini
@@ -1,9 +1,6 @@
 [mediasource-remove.html]
   type: testharness
   expected: TIMEOUT
-  [Test remove transitioning readyState from \'ended\' to \'open\'.]
-    expected: FAIL
-
   [Test removing all appended data.]
     expected: FAIL
 

From 085398bba765109e8c5f07534189a9b020344f2d Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 18 Nov 2014 17:27:54 -0800
Subject: [PATCH 38/84] Backed out changeset df60c0297aa2 (bug 1100652) for ggc
 orange

---
 js/src/gc/StoreBuffer.cpp | 139 +++++++++++++++++++++++++++++++++++---
 js/src/gc/StoreBuffer.h   | 136 ++++++++++++++++++++-----------------
 2 files changed, 206 insertions(+), 69 deletions(-)

diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index d262d43d1b56..0587e434f032 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -22,7 +22,7 @@ using mozilla::ReentrancyGuard;
 /*** Edges ***/
 
 void
-StoreBuffer::SlotsEdge::mark(JSTracer *trc) const
+StoreBuffer::SlotsEdge::mark(JSTracer *trc)
 {
     NativeObject *obj = object();
 
@@ -48,7 +48,7 @@ StoreBuffer::SlotsEdge::mark(JSTracer *trc) const
 }
 
 void
-StoreBuffer::WholeCellEdges::mark(JSTracer *trc) const
+StoreBuffer::WholeCellEdges::mark(JSTracer *trc)
 {
     MOZ_ASSERT(edge->isTenured());
     JSGCTraceKind kind = GetGCThingTraceKind(edge);
@@ -64,7 +64,7 @@ StoreBuffer::WholeCellEdges::mark(JSTracer *trc) const
 }
 
 void
-StoreBuffer::CellPtrEdge::mark(JSTracer *trc) const
+StoreBuffer::CellPtrEdge::mark(JSTracer *trc)
 {
     if (!*edge)
         return;
@@ -74,7 +74,7 @@ StoreBuffer::CellPtrEdge::mark(JSTracer *trc) const
 }
 
 void
-StoreBuffer::ValueEdge::mark(JSTracer *trc) const
+StoreBuffer::ValueEdge::mark(JSTracer *trc)
 {
     if (!deref())
         return;
@@ -84,14 +84,135 @@ StoreBuffer::ValueEdge::mark(JSTracer *trc) const
 
 /*** MonoTypeBuffer ***/
 
+template <typename T>
+void
+StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
+{
+    if (!owner->isAboutToOverflow()) {
+        /*
+         * Compact the buffer now, and if that fails to free enough space then
+         * trigger a minor collection.
+         */
+        compact(owner);
+        if (isLowOnSpace())
+            owner->setAboutToOverflow();
+    } else {
+         /*
+          * A minor GC has already been triggered, so there's no point
+          * compacting unless the buffer is totally full.
+          */
+        if (storage_->availableInCurrentChunk() < sizeof(T))
+            maybeCompact(owner);
+    }
+}
+
+template <typename T>
+void
+StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
+{
+    typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> DedupSet;
+
+    DedupSet duplicates;
+    if (!duplicates.init())
+        return; /* Failure to de-dup is acceptable. */
+
+    LifoAlloc::Enum insert(*storage_);
+    for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
+        T *edge = e.get<T>();
+        if (!duplicates.has(*edge)) {
+            insert.updateFront<T>(*edge);
+            insert.popFront<T>();
+
+            /* Failure to insert will leave the set with duplicates. Oh well. */
+            duplicates.put(*edge);
+        }
+    }
+    storage_->release(insert.mark());
+
+    duplicates.clear();
+}
+
+template <typename T>
+void
+StoreBuffer::MonoTypeBuffer<T>::compact(StoreBuffer *owner)
+{
+    MOZ_ASSERT(storage_);
+    compactRemoveDuplicates(owner);
+    usedAtLastCompact_ = storage_->used();
+}
+
+template <typename T>
+void
+StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner)
+{
+    MOZ_ASSERT(storage_);
+    if (storage_->used() != usedAtLastCompact_)
+        compact(owner);
+}
+
 template <typename T>
 void
 StoreBuffer::MonoTypeBuffer<T>::mark(StoreBuffer *owner, JSTracer *trc)
 {
-    MOZ_ASSERT(stores_.initialized());
-    sinkStores(owner);
-    for (typename StoreSet::Range r = stores_.all(); !r.empty(); r.popFront())
-        r.front().mark(trc);
+    MOZ_ASSERT(owner->isEnabled());
+    ReentrancyGuard g(*owner);
+    if (!storage_)
+        return;
+
+    maybeCompact(owner);
+    for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
+        T *edge = e.get<T>();
+        edge->mark(trc);
+    }
+}
+
+/*** RelocatableMonoTypeBuffer ***/
+
+template <typename T>
+void
+StoreBuffer::RelocatableMonoTypeBuffer<T>::compactMoved(StoreBuffer *owner)
+{
+    LifoAlloc &storage = *this->storage_;
+    EdgeSet invalidated;
+    if (!invalidated.init())
+        CrashAtUnhandlableOOM("RelocatableMonoTypeBuffer::compactMoved: Failed to init table.");
+
+    /* Collect the set of entries which are currently invalid. */
+    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>()) {
+        T *edge = e.get<T>();
+        if (edge->isTagged()) {
+            if (!invalidated.put(edge->untagged().edge))
+                CrashAtUnhandlableOOM("RelocatableMonoTypeBuffer::compactMoved: Failed to put removal.");
+        } else {
+            invalidated.remove(edge->untagged().edge);
+        }
+    }
+
+    /* Remove all entries which are in the invalidated set. */
+    LifoAlloc::Enum insert(storage);
+    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>()) {
+        T *edge = e.get<T>();
+        if (!edge->isTagged() && !invalidated.has(edge->untagged().edge)) {
+            insert.updateFront<T>(*edge);
+            insert.popFront<T>();
+        }
+    }
+    storage.release(insert.mark());
+
+    invalidated.clear();
+
+#ifdef DEBUG
+    for (LifoAlloc::Enum e(storage); !e.empty(); e.popFront<T>())
+        MOZ_ASSERT(!e.get<T>()->isTagged());
+#endif
+}
+
+template <typename T>
+void
+StoreBuffer::RelocatableMonoTypeBuffer<T>::compact(StoreBuffer *owner)
+{
+    compactMoved(owner);
+    StoreBuffer::MonoTypeBuffer<T>::compact(owner);
 }
 
 /*** GenericBuffer ***/
@@ -252,5 +373,7 @@ template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::ValueEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::CellPtrEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::SlotsEdge>;
 template struct StoreBuffer::MonoTypeBuffer<StoreBuffer::WholeCellEdges>;
+template struct StoreBuffer::RelocatableMonoTypeBuffer<StoreBuffer::ValueEdge>;
+template struct StoreBuffer::RelocatableMonoTypeBuffer<StoreBuffer::CellPtrEdge>;
 
 #endif /* JSGC_GENERATIONAL */
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 98fb31fe246c..b5b19fb63457 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -80,6 +80,17 @@ class StoreBuffer
     /* The size at which a block is about to overflow. */
     static const size_t LowAvailableThreshold = (size_t)(LifoAllocBlockSize * 1.0 / 16.0);
 
+    /*
+     * If the space available in the store buffer hits the
+     * LowAvailableThreshold and gets compacted, but still doesn't have at
+     * least HighAvailableThreshold space available, then we will trigger a
+     * minor GC. HighAvailableThreshold should be set to provide enough space
+     * for the mutator to run for a while in between compactions. (If
+     * HighAvailableThreshold is too low, we will thrash and spend most of the
+     * time compacting. If it is too high, we will tenure things too early.)
+     */
+    static const size_t HighAvailableThreshold = (size_t)(LifoAllocBlockSize * 1.0 / 4.0);
+
     /*
      * This buffer holds only a single type of edge. Using this buffer is more
      * efficient than the generic buffer when many writes will be to the same
@@ -88,75 +99,89 @@ class StoreBuffer
     template<typename T>
     struct MonoTypeBuffer
     {
-        /* The canonical set of stores. */
-        typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> StoreSet;
-        StoreSet stores_;
+        LifoAlloc *storage_;
+        size_t usedAtLastCompact_;
 
-        /*
-         * A small, fixed-size buffer in front of the canonical set to simplify
-         * insertion via jit code.
-         */
-        const static size_t NumBufferEntries = 4096 / sizeof(T);
-        T buffer_[NumBufferEntries];
-        T *insert_;
-
-        /* Maximum number of entries before we request a minor GC. */
-        const static size_t MaxEntries = 48 * 1024 / sizeof(T);
-
-        explicit MonoTypeBuffer() : insert_(buffer_) {}
-        ~MonoTypeBuffer() { stores_.finish(); }
+        explicit MonoTypeBuffer() : storage_(nullptr), usedAtLastCompact_(0) {}
+        ~MonoTypeBuffer() { js_delete(storage_); }
 
         bool init() {
-            if (!stores_.initialized() && !stores_.init())
-                return false;
+            if (!storage_)
+                storage_ = js_new<LifoAlloc>(LifoAllocBlockSize);
             clear();
-            return true;
+            return bool(storage_);
         }
 
         void clear() {
-            if (stores_.initialized())
-                stores_.clear();
+            if (!storage_)
+                return;
+
+            storage_->used() ? storage_->releaseAll() : storage_->freeAll();
+            usedAtLastCompact_ = 0;
         }
 
+        bool isAboutToOverflow() const {
+            return !storage_->isEmpty() && storage_->availableInCurrentChunk() < LowAvailableThreshold;
+        }
+
+        bool isLowOnSpace() const {
+            return !storage_->isEmpty() && storage_->availableInCurrentChunk() < HighAvailableThreshold;
+        }
+
+        void handleOverflow(StoreBuffer *owner);
+
+        /* Compaction algorithms. */
+        void compactRemoveDuplicates(StoreBuffer *owner);
+
+        /*
+         * Attempts to reduce the usage of the buffer by removing unnecessary
+         * entries.
+         */
+        virtual void compact(StoreBuffer *owner);
+
+        /* Compacts if any entries have been added since the last compaction. */
+        void maybeCompact(StoreBuffer *owner);
+
         /* Add one item to the buffer. */
         void put(StoreBuffer *owner, const T &t) {
-            MOZ_ASSERT(stores_.initialized());
-            *insert_++ = t;
-            if (MOZ_UNLIKELY(insert_ == buffer_ + NumBufferEntries))
-                sinkStores(owner);
-        }
+            MOZ_ASSERT(storage_);
 
-        /* Move any buffered stores to the canonical store set. */
-        void sinkStores(StoreBuffer *owner) {
-            MOZ_ASSERT(stores_.initialized());
+            T *tp = storage_->new_<T>(t);
+            if (!tp)
+                CrashAtUnhandlableOOM("Failed to allocate for MonoTypeBuffer::put.");
 
-            for (T *p = buffer_; p < insert_; ++p) {
-                if (!stores_.put(*p))
-                    CrashAtUnhandlableOOM("Failed to allocate for MonoTypeBuffer::sinkStores.");
-            }
-            insert_ = buffer_;
-
-            if (MOZ_UNLIKELY(stores_.count() > MaxEntries))
-                owner->setAboutToOverflow();
-        }
-
-        /* Remove an item from the store buffer. */
-        void unput(StoreBuffer *owner, const T &v) {
-            sinkStores(owner);
-            stores_.remove(v);
+            if (isAboutToOverflow())
+                handleOverflow(owner);
         }
 
         /* Mark the source of all edges in the store buffer. */
         void mark(StoreBuffer *owner, JSTracer *trc);
 
         size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) {
-            return stores_.sizeOfExcludingThis(mallocSizeOf);
+            return storage_ ? storage_->sizeOfIncludingThis(mallocSizeOf) : 0;
         }
 
       private:
         MonoTypeBuffer &operator=(const MonoTypeBuffer& other) MOZ_DELETE;
     };
 
+    /*
+     * Overrides the MonoTypeBuffer to support pointers that may be moved in
+     * memory outside of the GC's control.
+     */
+    template <typename T>
+    struct RelocatableMonoTypeBuffer : public MonoTypeBuffer<T>
+    {
+        /* Override compaction to filter out removed items. */
+        void compactMoved(StoreBuffer *owner);
+        virtual void compact(StoreBuffer *owner) MOZ_OVERRIDE;
+
+        /* Record a removal from the buffer. */
+        void unput(StoreBuffer *owner, const T &v) {
+            MonoTypeBuffer<T>::put(owner, v.tagged());
+        }
+    };
+
     struct GenericBuffer
     {
         LifoAlloc *storage_;
@@ -226,7 +251,6 @@ class StoreBuffer
     {
         Cell **edge;
 
-        CellPtrEdge() : edge(nullptr) {}
         explicit CellPtrEdge(Cell **v) : edge(v) {}
         bool operator==(const CellPtrEdge &other) const { return edge == other.edge; }
         bool operator!=(const CellPtrEdge &other) const { return edge != other.edge; }
@@ -236,7 +260,7 @@ class StoreBuffer
             return !nursery.isInside(edge);
         }
 
-        void mark(JSTracer *trc) const;
+        void mark(JSTracer *trc);
 
         CellPtrEdge tagged() const { return CellPtrEdge((Cell **)(uintptr_t(edge) | 1)); }
         CellPtrEdge untagged() const { return CellPtrEdge((Cell **)(uintptr_t(edge) & ~1)); }
@@ -249,7 +273,6 @@ class StoreBuffer
     {
         JS::Value *edge;
 
-        ValueEdge() : edge(nullptr) {}
         explicit ValueEdge(JS::Value *v) : edge(v) {}
         bool operator==(const ValueEdge &other) const { return edge == other.edge; }
         bool operator!=(const ValueEdge &other) const { return edge != other.edge; }
@@ -261,7 +284,7 @@ class StoreBuffer
             return !nursery.isInside(edge);
         }
 
-        void mark(JSTracer *trc) const;
+        void mark(JSTracer *trc);
 
         ValueEdge tagged() const { return ValueEdge((JS::Value *)(uintptr_t(edge) | 1)); }
         ValueEdge untagged() const { return ValueEdge((JS::Value *)(uintptr_t(edge) & ~1)); }
@@ -280,7 +303,6 @@ class StoreBuffer
         int32_t start_;
         int32_t count_;
 
-        SlotsEdge() : objectAndKind_(0), start_(0), count_(0) {}
         SlotsEdge(NativeObject *object, int kind, int32_t start, int32_t count)
           : objectAndKind_(uintptr_t(object) | kind), start_(start), count_(count)
         {
@@ -307,7 +329,7 @@ class StoreBuffer
             return !IsInsideNursery(JS::AsCell(reinterpret_cast<JSObject *>(object())));
         }
 
-        void mark(JSTracer *trc) const;
+        void mark(JSTracer *trc);
 
         typedef struct {
             typedef SlotsEdge Lookup;
@@ -320,7 +342,6 @@ class StoreBuffer
     {
         Cell *edge;
 
-        WholeCellEdges() : edge(nullptr) {}
         explicit WholeCellEdges(Cell *cell) : edge(cell) {
             MOZ_ASSERT(edge->isTenured());
         }
@@ -333,7 +354,7 @@ class StoreBuffer
         static bool supportsDeduplication() { return true; }
         void *deduplicationKey() const { return (void *)edge; }
 
-        void mark(JSTracer *trc) const;
+        void mark(JSTracer *trc);
 
         typedef PointerEdgeHasher<WholeCellEdges> Hasher;
     };
@@ -404,8 +425,8 @@ class StoreBuffer
     MonoTypeBuffer<CellPtrEdge> bufferCell;
     MonoTypeBuffer<SlotsEdge> bufferSlot;
     MonoTypeBuffer<WholeCellEdges> bufferWholeCell;
-    MonoTypeBuffer<ValueEdge> bufferRelocVal;
-    MonoTypeBuffer<CellPtrEdge> bufferRelocCell;
+    RelocatableMonoTypeBuffer<ValueEdge> bufferRelocVal;
+    RelocatableMonoTypeBuffer<CellPtrEdge> bufferRelocCell;
     GenericBuffer bufferGeneric;
 
     JSRuntime *runtime_;
@@ -484,13 +505,6 @@ class StoreBuffer
     /* For use by our owned buffers and for testing. */
     void setAboutToOverflow();
 
-    /* For jit access to the raw buffer. */
-    void oolSinkStoresForWholeCellBuffer() { bufferWholeCell.sinkStores(this); }
-    void *addressOfWholeCellBufferPointer() const { return (void *)&bufferWholeCell.insert_; }
-    void *addressOfWholeCellBufferEnd() const {
-        return (void *)(bufferWholeCell.buffer_ + bufferWholeCell.NumBufferEntries);
-    }
-
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::GCSizes *sizes);
 };
 

From 2bcf8c03d0e6f966acf234aefada46a10a2c284c Mon Sep 17 00:00:00 2001
From: James Willcox <snorp@snorp.net>
Date: Tue, 18 Nov 2014 19:28:24 -0600
Subject: [PATCH 39/84] Bug 1097116 - Correctly implement Drain() in
 AndroidDecoderModule r=cpearce

--HG--
extra : rebase_source : 8764f15761c68a6f07a1ce5e0ccd842d56274519
---
 .../fmp4/android/AndroidDecoderModule.cpp     | 64 ++++++++++++++++---
 dom/media/fmp4/android/AndroidDecoderModule.h |  1 +
 2 files changed, 56 insertions(+), 9 deletions(-)

diff --git a/dom/media/fmp4/android/AndroidDecoderModule.cpp b/dom/media/fmp4/android/AndroidDecoderModule.cpp
index f4f8ceaf3002..4aa05523be52 100644
--- a/dom/media/fmp4/android/AndroidDecoderModule.cpp
+++ b/dom/media/fmp4/android/AndroidDecoderModule.cpp
@@ -242,6 +242,7 @@ MediaCodecDataDecoder::MediaCodecDataDecoder(MediaData::Type aType,
   , mInputBuffers(nullptr)
   , mOutputBuffers(nullptr)
   , mMonitor("MediaCodecDataDecoder::mMonitor")
+  , mFlushing(false)
   , mDraining(false)
   , mStopping(false)
 {
@@ -313,6 +314,9 @@ void MediaCodecDataDecoder::DecoderLoop()
 {
   bool outputDone = false;
 
+  bool draining = false;
+  bool waitingEOF = false;
+
   JNIEnv* env = GetJNIForThread();
   mp4_demuxer::MP4Sample* sample = nullptr;
 
@@ -322,7 +326,7 @@ void MediaCodecDataDecoder::DecoderLoop()
   for (;;) {
     {
       MonitorAutoLock lock(mMonitor);
-      while (!mStopping && !mDraining && mQueue.empty()) {
+      while (!mStopping && !mDraining && !mFlushing && mQueue.empty()) {
         if (mQueue.empty()) {
           // We could be waiting here forever if we don't signal that we need more input
           mCallback->InputExhausted();
@@ -335,20 +339,40 @@ void MediaCodecDataDecoder::DecoderLoop()
         break;
       }
 
-      if (mDraining) {
+      if (mFlushing) {
         mDecoder->Flush();
         ClearQueue();
-        mDraining =  false;
+        mFlushing =  false;
         lock.Notify();
         continue;
       }
 
+      if (mDraining && !sample && !waitingEOF) {
+        draining = true;
+      }
+
       // We're not stopping or draining, so try to get a sample
       if (!mQueue.empty()) {
         sample = mQueue.front();
       }
     }
 
+    if (draining && !waitingEOF) {
+      MOZ_ASSERT(!sample, "Shouldn't have a sample when pushing EOF frame");
+
+      int inputIndex = mDecoder->DequeueInputBuffer(DECODER_TIMEOUT, &res);
+      if (NS_FAILED(res)) {
+        NS_WARNING("exiting decoder loop due to exception while dequeuing input\n");
+        mCallback->Error();
+        break;
+      }
+
+      if (inputIndex >= 0) {
+        mDecoder->QueueInputBuffer(inputIndex, 0, 0, 0, MediaCodec::getBUFFER_FLAG_END_OF_STREAM(), &res);
+        waitingEOF = true;
+      }
+    }
+
     if (sample) {
       // We have a sample, try to feed it to the decoder
       int inputIndex = mDecoder->DequeueInputBuffer(DECODER_TIMEOUT, &res);
@@ -417,7 +441,23 @@ void MediaCodecDataDecoder::DecoderLoop()
       } else {
         // We have a valid buffer index >= 0 here
         if (bufferInfo.getFlags() & MediaCodec::getBUFFER_FLAG_END_OF_STREAM()) {
+          if (draining) {
+            draining = false;
+            waitingEOF = false;
+
+            mMonitor.Lock();
+            mDraining = false;
+            mMonitor.Notify();
+            mMonitor.Unlock();
+
+            mCallback->DrainComplete();
+          }
+
+          mDecoder->ReleaseOutputBuffer(outputStatus, false);
           outputDone = true;
+
+          // We only queue empty EOF frames, so we're done for now
+          continue;
         }
 
         MOZ_ASSERT(!mDurations.empty(), "Should have had a duration queued");
@@ -509,20 +549,26 @@ nsresult MediaCodecDataDecoder::ResetOutputBuffers()
 }
 
 nsresult MediaCodecDataDecoder::Flush() {
-  Drain();
+  MonitorAutoLock lock(mMonitor);
+  mFlushing = true;
+  lock.Notify();
+
+  while (mFlushing) {
+    lock.Wait();
+  }
+
   return NS_OK;
 }
 
 nsresult MediaCodecDataDecoder::Drain() {
   MonitorAutoLock lock(mMonitor);
+  if (mDraining) {
+    return NS_OK;
+  }
+
   mDraining = true;
   lock.Notify();
 
-  while (mDraining) {
-    lock.Wait();
-  }
-
-  mCallback->DrainComplete();
   return NS_OK;
 }
 
diff --git a/dom/media/fmp4/android/AndroidDecoderModule.h b/dom/media/fmp4/android/AndroidDecoderModule.h
index 0ae43138e684..a3a1288cf867 100644
--- a/dom/media/fmp4/android/AndroidDecoderModule.h
+++ b/dom/media/fmp4/android/AndroidDecoderModule.h
@@ -87,6 +87,7 @@ protected:
 
   // Only these members are protected by mMonitor.
   Monitor mMonitor;
+  bool mFlushing;
   bool mDraining;
   bool mStopping;
 

From 8062dea9b73d3ab0f1a5a535c0081b6568135dea Mon Sep 17 00:00:00 2001
From: James Willcox <snorp@snorp.net>
Date: Tue, 18 Nov 2014 19:28:49 -0600
Subject: [PATCH 40/84] Bug 1099260 - Clean up logging and error handling in
 AndroidDecoderModule r=cpearce

--HG--
extra : rebase_source : 6cbdd6e7f7874ecebbfe464cf167e03996ec7b06
---
 .../fmp4/android/AndroidDecoderModule.cpp     | 46 ++++++++-----------
 1 file changed, 18 insertions(+), 28 deletions(-)

diff --git a/dom/media/fmp4/android/AndroidDecoderModule.cpp b/dom/media/fmp4/android/AndroidDecoderModule.cpp
index 4aa05523be52..bfe6bc075497 100644
--- a/dom/media/fmp4/android/AndroidDecoderModule.cpp
+++ b/dom/media/fmp4/android/AndroidDecoderModule.cpp
@@ -50,7 +50,7 @@ public:
   nsresult Init() MOZ_OVERRIDE {
     mSurfaceTexture = AndroidSurfaceTexture::Create();
     if (!mSurfaceTexture) {
-      printf_stderr("Failed to create SurfaceTexture for video decode\n");
+      NS_WARNING("Failed to create SurfaceTexture for video decode\n");
       return NS_ERROR_FAILURE;
     }
 
@@ -116,7 +116,7 @@ public:
                                                  aacProfile,
                                                  aSample);
       if (!rv) {
-        printf_stderr("Failed to prepend ADTS header\n");
+        NS_WARNING("Failed to prepend ADTS header\n");
         return NS_ERROR_FAILURE;
       }
     }
@@ -310,6 +310,13 @@ nsresult MediaCodecDataDecoder::InitDecoder(jobject aSurface)
 // This is in usec, so that's 10ms
 #define DECODER_TIMEOUT 10000
 
+#define HANDLE_DECODER_ERROR() \
+  if (NS_FAILED(res)) { \
+    NS_WARNING("exiting decoder loop due to exception"); \
+    mCallback->Error(); \
+    break; \
+  }
+
 void MediaCodecDataDecoder::DecoderLoop()
 {
   bool outputDone = false;
@@ -361,11 +368,7 @@ void MediaCodecDataDecoder::DecoderLoop()
       MOZ_ASSERT(!sample, "Shouldn't have a sample when pushing EOF frame");
 
       int inputIndex = mDecoder->DequeueInputBuffer(DECODER_TIMEOUT, &res);
-      if (NS_FAILED(res)) {
-        NS_WARNING("exiting decoder loop due to exception while dequeuing input\n");
-        mCallback->Error();
-        break;
-      }
+      HANDLE_DECODER_ERROR();
 
       if (inputIndex >= 0) {
         mDecoder->QueueInputBuffer(inputIndex, 0, 0, 0, MediaCodec::getBUFFER_FLAG_END_OF_STREAM(), &res);
@@ -376,11 +379,7 @@ void MediaCodecDataDecoder::DecoderLoop()
     if (sample) {
       // We have a sample, try to feed it to the decoder
       int inputIndex = mDecoder->DequeueInputBuffer(DECODER_TIMEOUT, &res);
-      if (NS_FAILED(res)) {
-        printf_stderr("exiting decoder loop due to exception while dequeuing input\n");
-        mCallback->Error();
-        break;
-      }
+      HANDLE_DECODER_ERROR();
 
       if (inputIndex >= 0) {
         jobject buffer = env->GetObjectArrayElement(mInputBuffers, inputIndex);
@@ -397,11 +396,7 @@ void MediaCodecDataDecoder::DecoderLoop()
         PodCopy((uint8_t*)directBuffer, sample->data, sample->size);
 
         mDecoder->QueueInputBuffer(inputIndex, 0, sample->size, sample->composition_timestamp, 0, &res);
-        if (NS_FAILED(res)) {
-          printf_stderr("exiting decoder loop due to exception while queuing input\n");
-          mCallback->Error();
-          break;
-        }
+        HANDLE_DECODER_ERROR();
 
         mDurations.push(sample->duration);
 
@@ -417,27 +412,22 @@ void MediaCodecDataDecoder::DecoderLoop()
       BufferInfo bufferInfo;
 
       int outputStatus = mDecoder->DequeueOutputBuffer(bufferInfo.wrappedObject(), DECODER_TIMEOUT, &res);
-      if (NS_FAILED(res)) {
-        printf_stderr("exiting decoder loop due to exception while dequeuing output\n");
-        mCallback->Error();
-        break;
-      }
+      HANDLE_DECODER_ERROR();
 
       if (outputStatus == MediaCodec::getINFO_TRY_AGAIN_LATER()) {
         // We might want to call mCallback->InputExhausted() here, but there seems to be
         // some possible bad interactions here with the threading
       } else if (outputStatus == MediaCodec::getINFO_OUTPUT_BUFFERS_CHANGED()) {
         res = ResetOutputBuffers();
-        if (NS_FAILED(res)) {
-          printf_stderr("exiting decoder loop due to exception while restting output buffers\n");
-          mCallback->Error();
-          break;
-        }
+        HANDLE_DECODER_ERROR();
       } else if (outputStatus == MediaCodec::getINFO_OUTPUT_FORMAT_CHANGED()) {
         outputFormat = new MediaFormat(mDecoder->GetOutputFormat(), GetJNIForThread());
       } else if (outputStatus < 0) {
-        printf_stderr("unknown error from decoder! %d\n", outputStatus);
+        NS_WARNING("unknown error from decoder!");
         mCallback->Error();
+
+        // Don't break here just in case it's recoverable. If it's not, others stuff will fail later and
+        // we'll bail out.
       } else {
         // We have a valid buffer index >= 0 here
         if (bufferInfo.getFlags() & MediaCodec::getBUFFER_FLAG_END_OF_STREAM()) {

From ddccc3f03108b5c55673a9be4379d2562f64939e Mon Sep 17 00:00:00 2001
From: James Willcox <snorp@snorp.net>
Date: Tue, 18 Nov 2014 19:29:12 -0600
Subject: [PATCH 41/84] Bug 1099305 - Disable verbose logging in libstagefright
 r=cpearce

--HG--
extra : rebase_source : 266f7f77fc0e7819b5222111d7b45a6c9f931c76
---
 media/libstagefright/moz.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/media/libstagefright/moz.build b/media/libstagefright/moz.build
index 4a71919ecf93..cd39a806d759 100644
--- a/media/libstagefright/moz.build
+++ b/media/libstagefright/moz.build
@@ -5,7 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 DEFINES['ANDROID_SMP'] = 0
-DEFINES['LOG_NDEBUG'] = 0
+DEFINES['LOG_NDEBUG'] = 1
 
 if CONFIG['OS_TARGET'] != 'WINNT':
    DEFINES['_GLIBCXX_OS_DEFINES'] = True

From c7b5999add1233a96d8b4aefb62831c1ed9a25f3 Mon Sep 17 00:00:00 2001
From: Seth Fowler <seth@mozilla.com>
Date: Tue, 18 Nov 2014 18:17:17 -0800
Subject: [PATCH 42/84] Bug 1081012 - Move DecodePool and related helpers out
 of RasterImage. r=tn

---
 image/src/DecodePool.cpp   | 512 +++++++++++++++++++++++++++++++++++++
 image/src/DecodePool.h     | 151 +++++++++++
 image/src/DecodeStrategy.h |  36 ---
 image/src/Decoder.cpp      |  18 +-
 image/src/Decoder.h        |   4 +-
 image/src/RasterImage.cpp  | 508 +++---------------------------------
 image/src/RasterImage.h    | 190 +-------------
 image/src/moz.build        |   1 +
 8 files changed, 715 insertions(+), 705 deletions(-)
 create mode 100644 image/src/DecodePool.cpp
 create mode 100644 image/src/DecodePool.h
 delete mode 100644 image/src/DecodeStrategy.h

diff --git a/image/src/DecodePool.cpp b/image/src/DecodePool.cpp
new file mode 100644
index 000000000000..13d97ba58501
--- /dev/null
+++ b/image/src/DecodePool.cpp
@@ -0,0 +1,512 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DecodePool.h"
+
+#include <algorithm>
+
+#include "mozilla/ClearOnShutdown.h"
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
+#include "nsIObserverService.h"
+#include "nsIThreadPool.h"
+#include "nsXPCOMCIDInternal.h"
+#include "prsystem.h"
+
+#ifdef MOZ_NUWA_PROCESS
+#include "ipc/Nuwa.h"
+#endif
+
+#include "gfxPrefs.h"
+
+#include "Decoder.h"
+#include "RasterImage.h"
+
+using std::max;
+using std::min;
+
+namespace mozilla {
+namespace image {
+
+///////////////////////////////////////////////////////////////////////////////
+// Helper runnables.
+///////////////////////////////////////////////////////////////////////////////
+
+class NotifyProgressWorker : public nsRunnable
+{
+public:
+  /**
+   * Called by the DecodePool when it's done some significant portion of
+   * decoding, so that progress can be recorded and notifications can be sent.
+   */
+  static void Dispatch(RasterImage* aImage)
+  {
+    nsCOMPtr<nsIRunnable> worker = new NotifyProgressWorker(aImage);
+    NS_DispatchToMainThread(worker);
+  }
+
+  NS_IMETHOD Run() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
+
+    mImage->FinishedSomeDecoding(ShutdownReason::DONE);
+
+    return NS_OK;
+  }
+
+private:
+  explicit NotifyProgressWorker(RasterImage* aImage)
+    : mImage(aImage)
+  { }
+
+  nsRefPtr<RasterImage> mImage;
+};
+
+class FrameNeededWorker : public nsRunnable
+{
+public:
+  /**
+   * Called when an off-main-thread decoder needs a new frame to be allocated on
+   * the main thread.
+   *
+   * After allocating the new frame, the worker will call RequestDecode to
+   * continue decoding.
+   */
+  static void Dispatch(RasterImage* aImage)
+  {
+    nsCOMPtr<nsIRunnable> worker = new FrameNeededWorker(aImage);
+    NS_DispatchToMainThread(worker);
+  }
+
+  NS_IMETHOD Run() MOZ_OVERRIDE
+  {
+    ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
+    nsresult rv = NS_OK;
+
+    // If we got a synchronous decode in the mean time, we don't need to do
+    // anything.
+    if (mImage->mDecoder && mImage->mDecoder->NeedsNewFrame()) {
+      rv = mImage->mDecoder->AllocateFrame();
+    }
+
+    if (NS_SUCCEEDED(rv) && mImage->mDecoder) {
+      // By definition, we're not done decoding, so enqueue us for more decoding.
+      DecodePool::Singleton()->RequestDecode(mImage);
+    }
+
+    return NS_OK;
+  }
+
+private:
+  explicit FrameNeededWorker(RasterImage* aImage)
+    : mImage(aImage)
+  { }
+
+  nsRefPtr<RasterImage> mImage;
+};
+
+class DecodeWorker : public nsRunnable
+{
+public:
+  DecodeWorker(RasterImage* aImage)
+    : mImage(aImage)
+  { }
+
+  NS_IMETHOD Run() MOZ_OVERRIDE
+  {
+    ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
+
+    // If we were interrupted, we shouldn't do any work.
+    if (mImage->mDecodeStatus == DecodeStatus::STOPPED) {
+      NotifyProgressWorker::Dispatch(mImage);
+      return NS_OK;
+    }
+
+    // If someone came along and synchronously decoded us, there's nothing for us to do.
+    if (!mImage->mDecoder || mImage->IsDecodeFinished()) {
+      NotifyProgressWorker::Dispatch(mImage);
+      return NS_OK;
+    }
+
+    // If we're a decode job that's been enqueued since a previous decode that
+    // still needs a new frame, we can't do anything. Wait until the
+    // FrameNeededWorker enqueues another frame.
+    if (mImage->mDecoder->NeedsNewFrame()) {
+      return NS_OK;
+    }
+
+    mImage->mDecodeStatus = DecodeStatus::ACTIVE;
+
+    size_t oldByteCount = mImage->mDecoder->BytesDecoded();
+
+    // Multithreaded decoding can be disabled. If we've done so, we don't want
+    // to monopolize the main thread, and will allow a timeout.
+    DecodeUntil type = NS_IsMainThread() ? DecodeUntil::TIME
+                                         : DecodeUntil::DONE_BYTES;
+
+    size_t maxBytes = mImage->mSourceData.Length() -
+                      mImage->mDecoder->BytesDecoded();
+    DecodePool::Singleton()->DecodeSomeOfImage(mImage, DecodeStrategy::ASYNC,
+                                               type, maxBytes);
+
+    size_t bytesDecoded = mImage->mDecoder->BytesDecoded() - oldByteCount;
+
+    mImage->mDecodeStatus = DecodeStatus::WORK_DONE;
+
+    if (mImage->mDecoder && mImage->mDecoder->NeedsNewFrame()) {
+      // The decoder needs a new frame. Enqueue an event to get it; that event
+      // will enqueue another decode request when it's done.
+      FrameNeededWorker::Dispatch(mImage);
+    } else if (mImage->mDecoder &&
+               !mImage->mError &&
+               !mImage->mPendingError &&
+               !mImage->IsDecodeFinished() &&
+               bytesDecoded < maxBytes &&
+               bytesDecoded > 0) {
+      // We aren't finished decoding, and we have more data, so add this request
+      // to the back of the list.
+      DecodePool::Singleton()->RequestDecode(mImage);
+    } else {
+      // Nothing more for us to do - let everyone know what happened.
+      NotifyProgressWorker::Dispatch(mImage);
+    }
+
+    return NS_OK;
+  }
+
+protected:
+  virtual ~DecodeWorker()
+  {
+    if (gfxPrefs::ImageMTDecodingEnabled()) {
+      // Dispatch mImage to main thread to prevent mImage from being destructed by decode thread.
+      nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
+      NS_WARN_IF_FALSE(mainThread, "Couldn't get the main thread!");
+      if (mainThread) {
+        // Handle ambiguous nsISupports inheritance
+        RasterImage* rawImg = nullptr;
+        mImage.swap(rawImg);
+        DebugOnly<nsresult> rv = NS_ProxyRelease(mainThread, NS_ISUPPORTS_CAST(ImageResource*, rawImg));
+        MOZ_ASSERT(NS_SUCCEEDED(rv), "Failed to proxy release to main thread");
+      }
+    }
+  }
+
+private:
+  nsRefPtr<RasterImage> mImage;
+};
+
+#ifdef MOZ_NUWA_PROCESS
+
+class RIDThreadPoolListener MOZ_FINAL : public nsIThreadPoolListener
+{
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSITHREADPOOLLISTENER
+  
+  RIDThreadPoolListener() { }
+
+private:
+  ~RIDThreadPoolListener() { }
+};
+
+NS_IMPL_ISUPPORTS(RIDThreadPoolListener, nsIThreadPoolListener)
+
+NS_IMETHODIMP
+RIDThreadPoolListener::OnThreadCreated()
+{
+    if (IsNuwaProcess()) {
+        NuwaMarkCurrentThread(static_cast<void(*)(void*)>(nullptr), nullptr);
+    }
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+RIDThreadPoolListener::OnThreadShuttingDown()
+{
+    return NS_OK;
+}
+
+#endif // MOZ_NUWA_PROCESS
+
+
+///////////////////////////////////////////////////////////////////////////////
+// DecodePool implementation.
+///////////////////////////////////////////////////////////////////////////////
+
+/* static */ StaticRefPtr<DecodePool> DecodePool::sSingleton;
+
+NS_IMPL_ISUPPORTS(DecodePool, nsIObserver)
+
+/* static */ DecodePool*
+DecodePool::Singleton()
+{
+  if (!sSingleton) {
+    MOZ_ASSERT(NS_IsMainThread());
+    sSingleton = new DecodePool();
+    ClearOnShutdown(&sSingleton);
+  }
+
+  return sSingleton;
+}
+
+already_AddRefed<nsIEventTarget>
+DecodePool::GetEventTarget()
+{
+  nsCOMPtr<nsIEventTarget> target = do_QueryInterface(mThreadPool);
+  return target.forget();
+}
+
+DecodePool::DecodePool()
+  : mThreadPoolMutex("Thread Pool")
+{
+  if (gfxPrefs::ImageMTDecodingEnabled()) {
+    mThreadPool = do_CreateInstance(NS_THREADPOOL_CONTRACTID);
+    if (mThreadPool) {
+      mThreadPool->SetName(NS_LITERAL_CSTRING("ImageDecoder"));
+      int32_t prefLimit = gfxPrefs::ImageMTDecodingLimit();
+      uint32_t limit;
+      if (prefLimit <= 0) {
+        limit = max(PR_GetNumberOfProcessors(), 2) - 1;
+      } else {
+        limit = static_cast<uint32_t>(prefLimit);
+      }
+
+      mThreadPool->SetThreadLimit(limit);
+      mThreadPool->SetIdleThreadLimit(limit);
+
+#ifdef MOZ_NUWA_PROCESS
+      if (IsNuwaProcess()) {
+        mThreadPool->SetListener(new RIDThreadPoolListener());
+      }
+#endif
+
+      nsCOMPtr<nsIObserverService> obsSvc = services::GetObserverService();
+      if (obsSvc) {
+        obsSvc->AddObserver(this, "xpcom-shutdown-threads", false);
+      }
+    }
+  }
+}
+
+DecodePool::~DecodePool()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must shut down DecodePool on main thread!");
+}
+
+NS_IMETHODIMP
+DecodePool::Observe(nsISupports*, const char* aTopic, const char16_t*)
+{
+  MOZ_ASSERT(strcmp(aTopic, "xpcom-shutdown-threads") == 0, "Unexpected topic");
+
+  nsCOMPtr<nsIThreadPool> threadPool;
+
+  {
+    MutexAutoLock threadPoolLock(mThreadPoolMutex);
+    threadPool = mThreadPool;
+    mThreadPool = nullptr;
+  }
+
+  if (threadPool) {
+    threadPool->Shutdown();
+  }
+
+  return NS_OK;
+}
+
+void
+DecodePool::RequestDecode(RasterImage* aImage)
+{
+  MOZ_ASSERT(aImage->mDecoder);
+  aImage->mDecodingMonitor.AssertCurrentThreadIn();
+
+  // If we're currently waiting on a new frame for this image, we can't do any
+  // decoding.
+  if (!aImage->mDecoder->NeedsNewFrame()) {
+    if (aImage->mDecodeStatus == DecodeStatus::PENDING ||
+        aImage->mDecodeStatus == DecodeStatus::ACTIVE) {
+      // The image is already in our list of images to decode, or currently being
+      // decoded, so we don't have to do anything else.
+      return;
+    }
+
+    aImage->mDecodeStatus = DecodeStatus::PENDING;
+    nsCOMPtr<nsIRunnable> worker = new DecodeWorker(aImage);
+
+    MutexAutoLock threadPoolLock(mThreadPoolMutex);
+    if (!gfxPrefs::ImageMTDecodingEnabled() || !mThreadPool) {
+      NS_DispatchToMainThread(worker);
+    } else {
+      mThreadPool->Dispatch(worker, nsIEventTarget::DISPATCH_NORMAL);
+    }
+  }
+}
+
+void
+DecodePool::DecodeABitOf(RasterImage* aImage, DecodeStrategy aStrategy)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  aImage->mDecodingMonitor.AssertCurrentThreadIn();
+
+  // If the image is waiting for decode work to be notified, go ahead and do that.
+  if (aImage->mDecodeStatus == DecodeStatus::WORK_DONE) {
+    aImage->FinishedSomeDecoding();
+  }
+
+  DecodeSomeOfImage(aImage, aStrategy);
+
+  aImage->FinishedSomeDecoding();
+
+  // If the decoder needs a new frame, enqueue an event to get it; that event
+  // will enqueue another decode request when it's done.
+  if (aImage->mDecoder && aImage->mDecoder->NeedsNewFrame()) {
+    FrameNeededWorker::Dispatch(aImage);
+  } else {
+    // If we aren't yet finished decoding and we have more data in hand, add
+    // this request to the back of the priority list.
+    if (aImage->mDecoder &&
+        !aImage->mError &&
+        !aImage->IsDecodeFinished() &&
+        aImage->mSourceData.Length() > aImage->mDecoder->BytesDecoded()) {
+      RequestDecode(aImage);
+    }
+  }
+}
+
+/* static */ void
+DecodePool::StopDecoding(RasterImage* aImage)
+{
+  aImage->mDecodingMonitor.AssertCurrentThreadIn();
+
+  // If we haven't got a decode request, we're not currently decoding. (Having
+  // a decode request doesn't imply we *are* decoding, though.)
+  aImage->mDecodeStatus = DecodeStatus::STOPPED;
+}
+
+nsresult
+DecodePool::DecodeUntilSizeAvailable(RasterImage* aImage)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  ReentrantMonitorAutoEnter lock(aImage->mDecodingMonitor);
+
+  // If the image is waiting for decode work to be notified, go ahead and do that.
+  if (aImage->mDecodeStatus == DecodeStatus::WORK_DONE) {
+    nsresult rv = aImage->FinishedSomeDecoding();
+    if (NS_FAILED(rv)) {
+      aImage->DoError();
+      return rv;
+    }
+  }
+
+  // We use DecodeStrategy::ASYNC here because we just want to get the size
+  // information here and defer the rest of the work.
+  nsresult rv =
+    DecodeSomeOfImage(aImage, DecodeStrategy::ASYNC, DecodeUntil::SIZE);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  // If the decoder needs a new frame, enqueue an event to get it; that event
+  // will enqueue another decode request when it's done.
+  if (aImage->mDecoder && aImage->mDecoder->NeedsNewFrame()) {
+    FrameNeededWorker::Dispatch(aImage);
+  } else {
+    rv = aImage->FinishedSomeDecoding();
+  }
+
+  return rv;
+}
+
+nsresult
+DecodePool::DecodeSomeOfImage(RasterImage* aImage,
+                              DecodeStrategy aStrategy,
+                              DecodeUntil aDecodeUntil /* = DecodeUntil::TIME */,
+                              uint32_t bytesToDecode /* = 0 */)
+{
+  MOZ_ASSERT(aImage->mInitialized, "Worker active for uninitialized container");
+  aImage->mDecodingMonitor.AssertCurrentThreadIn();
+
+  // If an error is flagged, it probably happened while we were waiting
+  // in the event queue.
+  if (aImage->mError) {
+    return NS_OK;
+  }
+
+  // If there is an error worker pending (say because the main thread has enqueued
+  // another decode request for us before processing the error worker) then bail out.
+  if (aImage->mPendingError) {
+    return NS_OK;
+  }
+
+  // If mDecoded or we don't have a decoder, we must have finished already (for
+  // example, a synchronous decode request came while the worker was pending).
+  if (!aImage->mDecoder || aImage->mDecoded) {
+    return NS_OK;
+  }
+
+  if (aImage->mDecoder->NeedsNewFrame()) {
+    if (aStrategy == DecodeStrategy::SYNC) {
+      MOZ_ASSERT(NS_IsMainThread());
+      aImage->mDecoder->AllocateFrame();
+    } else {
+      return NS_OK;
+    }
+  }
+
+  nsRefPtr<Decoder> decoderKungFuDeathGrip = aImage->mDecoder;
+
+  uint32_t maxBytes;
+  if (aImage->mDecoder->IsSizeDecode()) {
+    // Decode all available data if we're a size decode; they're cheap, and we
+    // want them to be more or less synchronous.
+    maxBytes = aImage->mSourceData.Length();
+  } else {
+    // We're only guaranteed to decode this many bytes, so in particular,
+    // gfxPrefs::ImageMemDecodeBytesAtATime should be set high enough for us
+    // to read the size from most images.
+    maxBytes = gfxPrefs::ImageMemDecodeBytesAtATime();
+  }
+
+  if (bytesToDecode == 0) {
+    bytesToDecode = aImage->mSourceData.Length() - aImage->mDecoder->BytesDecoded();
+  }
+
+  TimeStamp deadline = TimeStamp::Now() +
+                       TimeDuration::FromMilliseconds(gfxPrefs::ImageMemMaxMSBeforeYield());
+
+  // We keep decoding chunks until:
+  //  * we don't have any data left to decode,
+  //  * the decode completes,
+  //  * we're an DecodeUntil::SIZE decode and we get the size, or
+  //  * we run out of time.
+  // We also try to decode at least one "chunk" if we've allocated a new frame,
+  // even if we have no more data to send to the decoder.
+  while ((aImage->mSourceData.Length() > aImage->mDecoder->BytesDecoded() &&
+          bytesToDecode > 0 &&
+          !aImage->IsDecodeFinished() &&
+          !(aDecodeUntil == DecodeUntil::SIZE && aImage->mHasSize) &&
+          !aImage->mDecoder->NeedsNewFrame()) ||
+         aImage->mDecoder->NeedsToFlushData()) {
+    uint32_t chunkSize = min(bytesToDecode, maxBytes);
+    nsresult rv = aImage->DecodeSomeData(chunkSize, aStrategy);
+    if (NS_FAILED(rv)) {
+      aImage->DoError();
+      return rv;
+    }
+
+    bytesToDecode -= chunkSize;
+
+    // Yield if we've been decoding for too long. We check this _after_ decoding
+    // a chunk to ensure that we don't yield without doing any decoding.
+    if (aDecodeUntil == DecodeUntil::TIME && TimeStamp::Now() >= deadline) {
+      break;
+    }
+  }
+
+  return NS_OK;
+}
+
+} // namespace image
+} // namespace mozilla
diff --git a/image/src/DecodePool.h b/image/src/DecodePool.h
new file mode 100644
index 000000000000..504d658b153a
--- /dev/null
+++ b/image/src/DecodePool.h
@@ -0,0 +1,151 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * DecodePool manages the threads used for decoding raster images.
+ */
+
+#ifndef MOZILLA_IMAGELIB_DECODEPOOL_H_
+#define MOZILLA_IMAGELIB_DECODEPOOL_H_
+
+#include "mozilla/Mutex.h"
+#include "mozilla/StaticPtr.h"
+#include <mozilla/TypedEnum.h>
+#include "nsCOMPtr.h"
+#include "nsIEventTarget.h"
+#include "nsIObserver.h"
+
+class nsIThreadPool;
+
+namespace mozilla {
+namespace image {
+
+class Decoder;
+class RasterImage;
+
+MOZ_BEGIN_ENUM_CLASS(DecodeStrategy, uint8_t)
+  // DecodeStrategy::SYNC requests a synchronous decode, which will continue
+  // decoding frames as long as it has more source data. It returns to the
+  // caller only once decoding is complete (or until it needs more source data
+  // before continuing). Because DecodeStrategy::SYNC can involve allocating new
+  // imgFrames, it can only be run on the main thread.
+  SYNC,
+
+  // DecodeStrategy::ASYNC requests an asynchronous decode, which will continue
+  // decoding until it either finishes a frame or runs out of source data.
+  // Because DecodeStrategy::ASYNC does not allocate new imgFrames, it can be
+  // safely run off the main thread. (And hence workers in the decode pool
+  // always use it.)
+  ASYNC
+MOZ_END_ENUM_CLASS(DecodeStrategy)
+
+MOZ_BEGIN_ENUM_CLASS(DecodeStatus, uint8_t)
+  INACTIVE,
+  PENDING,
+  ACTIVE,
+  WORK_DONE,
+  STOPPED
+MOZ_END_ENUM_CLASS(DecodeStatus)
+
+MOZ_BEGIN_ENUM_CLASS(DecodeUntil, uint8_t)
+  TIME,
+  SIZE,
+  DONE_BYTES
+MOZ_END_ENUM_CLASS(DecodeUntil)
+
+MOZ_BEGIN_ENUM_CLASS(ShutdownReason, uint8_t)
+  DONE,
+  NOT_NEEDED,
+  FATAL_ERROR
+MOZ_END_ENUM_CLASS(ShutdownReason)
+
+
+/**
+ * DecodePool is a singleton class we use when decoding large images.
+ *
+ * When we wish to decode an image larger than
+ * image.mem.max_bytes_for_sync_decode, we call DecodePool::RequestDecode()
+ * for the image.  This adds the image to a queue of pending requests and posts
+ * the DecodePool singleton to the event queue, if it's not already pending
+ * there.
+ *
+ * When the DecodePool is run from the event queue, it decodes the image (and
+ * all others it's managing) in chunks, periodically yielding control back to
+ * the event loop.
+ */
+class DecodePool : public nsIObserver
+{
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  static DecodePool* Singleton();
+
+  /**
+   * Ask the DecodePool to asynchronously decode this image.
+   */
+  void RequestDecode(RasterImage* aImage);
+
+  /**
+   * Decode aImage for a short amount of time, and post the remainder to the
+   * queue.
+   */
+  void DecodeABitOf(RasterImage* aImage, DecodeStrategy aStrategy);
+
+  /**
+   * Ask the DecodePool to stop decoding this image.  Internally, we also
+   * call this function when we finish decoding an image.
+   *
+   * Since the DecodePool keeps raw pointers to RasterImages, make sure you
+   * call this before a RasterImage is destroyed!
+   */
+  static void StopDecoding(RasterImage* aImage);
+
+  /**
+   * Synchronously decode the beginning of the image until we run out of
+   * bytes or we get the image's size.  Note that this done on a best-effort
+   * basis; if the size is burried too deep in the image, we'll give up.
+   *
+   * @return NS_ERROR if an error is encountered, and NS_OK otherwise.  (Note
+   *         that we return NS_OK even when the size was not found.)
+   */
+  nsresult DecodeUntilSizeAvailable(RasterImage* aImage);
+
+  /**
+   * Returns an event target interface to the thread pool; primarily for
+   * OnDataAvailable delivery off main thread.
+   *
+   * @return An nsIEventTarget interface to mThreadPool.
+   */
+  already_AddRefed<nsIEventTarget> GetEventTarget();
+
+  /**
+   * Decode some chunks of the given image.  If aDecodeUntil is SIZE,
+   * decode until we have the image's size, then stop. If bytesToDecode is
+   * non-0, at most bytesToDecode bytes will be decoded. if aDecodeUntil is
+   * DONE_BYTES, decode until all bytesToDecode bytes are decoded.
+   */
+  nsresult DecodeSomeOfImage(RasterImage* aImage,
+                             DecodeStrategy aStrategy,
+                             DecodeUntil aDecodeUntil = DecodeUntil::TIME,
+                             uint32_t bytesToDecode = 0);
+
+private:
+  DecodePool();
+  virtual ~DecodePool();
+
+  static StaticRefPtr<DecodePool> sSingleton;
+
+  // mThreadPoolMutex protects mThreadPool. For all RasterImages R,
+  // R::mDecodingMonitor must be acquired before mThreadPoolMutex
+  // if both are acquired; the other order may cause deadlock.
+  Mutex                     mThreadPoolMutex;
+  nsCOMPtr<nsIThreadPool>   mThreadPool;
+};
+
+} // namespace image
+} // namespace mozilla
+
+#endif // MOZILLA_IMAGELIB_DECODEPOOL_H_
diff --git a/image/src/DecodeStrategy.h b/image/src/DecodeStrategy.h
deleted file mode 100644
index 44c64b699818..000000000000
--- a/image/src/DecodeStrategy.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/** @file
- * An enumeration used by RasterImage and Decoder to specify which 'strategy' to
- * use for image decoding - synchronous or asynchronous.
- */
-
-#ifndef mozilla_imagelib_DecodeStrategy_h_
-#define mozilla_imagelib_DecodeStrategy_h_
-
-namespace mozilla {
-namespace image {
-
-enum DecodeStrategy {
-  // DECODE_SYNC requests a synchronous decode, which will continue decoding
-  // frames as long as it has more source data. It returns to the caller only
-  // once decoding is complete (or until it needs more source data before
-  // continuing). Because DECODE_SYNC can involve allocating new imgFrames, it
-  // can only be run on the main thread.
-  DECODE_SYNC,
-
-  // DECODE_ASYNC requests an asynchronous decode, which will continue decoding
-  // until it either finishes a frame or runs out of source data. Because
-  // DECODE_ASYNC does not allocate new imgFrames, it can be safely run off the
-  // main thread. (And hence workers in the decode pool always use it.)
-  DECODE_ASYNC
-};
-
-} // namespace image
-} // namespace mozilla
-
-#endif
diff --git a/image/src/Decoder.cpp b/image/src/Decoder.cpp
index c8db09cf7689..a1ffc4b6397f 100644
--- a/image/src/Decoder.cpp
+++ b/image/src/Decoder.cpp
@@ -96,7 +96,7 @@ Decoder::Write(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy)
   PROFILER_LABEL("ImageDecoder", "Write",
     js::ProfileEntry::Category::GRAPHICS);
 
-  MOZ_ASSERT(NS_IsMainThread() || aStrategy == DECODE_ASYNC);
+  MOZ_ASSERT(NS_IsMainThread() || aStrategy == DecodeStrategy::ASYNC);
 
   // We're strict about decoder errors
   MOZ_ASSERT(!HasDecoderError(),
@@ -129,12 +129,14 @@ Decoder::Write(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy)
 
   // If we're a synchronous decoder and we need a new frame to proceed, let's
   // create one and call it again.
-  while (aStrategy == DECODE_SYNC && NeedsNewFrame() && !HasDataError()) {
-    nsresult rv = AllocateFrame();
+  if (aStrategy == DecodeStrategy::SYNC) {
+    while (NeedsNewFrame() && !HasDataError()) {
+      nsresult rv = AllocateFrame();
 
-    if (NS_SUCCEEDED(rv)) {
-      // Tell the decoder to use the data it saved when it asked for a new frame.
-      WriteInternal(nullptr, 0, aStrategy);
+      if (NS_SUCCEEDED(rv)) {
+        // Use the data we saved when we asked for a new frame.
+        WriteInternal(nullptr, 0, aStrategy);
+      }
     }
   }
 
@@ -143,7 +145,7 @@ Decoder::Write(const char* aBuffer, uint32_t aCount, DecodeStrategy aStrategy)
 }
 
 void
-Decoder::Finish(RasterImage::eShutdownIntent aShutdownIntent)
+Decoder::Finish(ShutdownReason aReason)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -180,7 +182,7 @@ Decoder::Finish(RasterImage::eShutdownIntent aShutdownIntent)
     }
 
     bool usable = !HasDecoderError();
-    if (aShutdownIntent != RasterImage::eShutdownIntent_NotNeeded && !HasDecoderError()) {
+    if (aReason != ShutdownReason::NOT_NEEDED && !HasDecoderError()) {
       // If we only have a data error, we're usable if we have at least one complete frame.
       if (GetCompleteFrameCount() == 0) {
         usable = false;
diff --git a/image/src/Decoder.h b/image/src/Decoder.h
index d1c9364d278d..6a1c422d6463 100644
--- a/image/src/Decoder.h
+++ b/image/src/Decoder.h
@@ -8,7 +8,7 @@
 
 #include "RasterImage.h"
 #include "mozilla/RefPtr.h"
-#include "DecodeStrategy.h"
+#include "DecodePool.h"
 #include "ImageMetadata.h"
 #include "Orientation.h"
 #include "mozilla/Telemetry.h"
@@ -62,7 +62,7 @@ public:
    *
    * Notifications Sent: TODO
    */
-  void Finish(RasterImage::eShutdownIntent aShutdownIntent);
+  void Finish(ShutdownReason aReason);
 
   /**
    * Informs the shared decoder that all the data has been written.
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index 375de5542542..f1d20f82c4c0 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -20,9 +20,6 @@
 #include "ImageRegion.h"
 #include "Layers.h"
 #include "nsPresContext.h"
-#include "nsIThreadPool.h"
-#include "nsXPCOMCIDInternal.h"
-#include "nsIObserverService.h"
 #include "SurfaceCache.h"
 #include "FrameAnimator.h"
 
@@ -51,10 +48,6 @@
 #include "gfxPrefs.h"
 #include <algorithm>
 
-#ifdef MOZ_NUWA_PROCESS
-#include "ipc/Nuwa.h"
-#endif
-
 namespace mozilla {
 
 using namespace gfx;
@@ -296,7 +289,6 @@ private:
   ScaleState           mState;
 };
 
-/* static */ StaticRefPtr<RasterImage::DecodePool> RasterImage::DecodePool::sSingleton;
 static nsCOMPtr<nsIThread> sScaleWorkerThread = nullptr;
 
 #ifndef DEBUG
@@ -1545,7 +1537,7 @@ RasterImage::AddSourceData(const char *aBuffer, uint32_t aCount)
   // write the data directly to the decoder. (If we haven't gotten the size,
   // we'll queue up the data and write it out when we do.)
   if (!StoringSourceData() && mHasSize) {
-    rv = WriteToDecoder(aBuffer, aCount, DECODE_SYNC);
+    rv = WriteToDecoder(aBuffer, aCount, DecodeStrategy::SYNC);
     CONTAINER_ENSURE_SUCCESS(rv);
 
     rv = FinishedSomeDecoding();
@@ -1665,7 +1657,7 @@ RasterImage::OnImageDataComplete(nsIRequest*, nsISupports*, nsresult aStatus, bo
   // We just recorded OnStopRequest; we need to inform our listeners.
   {
     ReentrantMonitorAutoEnter lock(mDecodingMonitor);
-    FinishedSomeDecoding(eShutdownIntent_Done,
+    FinishedSomeDecoding(ShutdownReason::DONE,
                          LoadCompleteProgress(aLastPart, mError, finalStatus));
   }
 
@@ -1745,6 +1737,12 @@ RasterImage::OnNewSourceData()
   return NS_OK;
 }
 
+/* static */ already_AddRefed<nsIEventTarget>
+RasterImage::GetEventTarget()
+{
+  return DecodePool::Singleton()->GetEventTarget();
+}
+
 nsresult
 RasterImage::SetSourceSizeHint(uint32_t sizeHint)
 {
@@ -1989,20 +1987,17 @@ RasterImage::InitDecoder(bool aDoSizeDecode)
 // state. It is an error to call this function when there is no initialized
 // decoder.
 //
-// aIntent specifies the intent of the shutdown. If aIntent is
-// eShutdownIntent_Done, an error is flagged if we didn't get what we should
-// have out of the decode. If aIntent is eShutdownIntent_NotNeeded, we don't
-// check this. If aIntent is eShutdownIntent_Error, we shut down in error mode.
+// aReason specifies why the shutdown is happening. If aReason is
+// ShutdownReason::DONE, an error is flagged if we didn't get what we should
+// have out of the decode. If aReason is ShutdownReason::NOT_NEEDED, we don't
+// check this. If aReason is ShutdownReason::FATAL_ERROR, we shut down in error
+// mode.
 nsresult
-RasterImage::ShutdownDecoder(eShutdownIntent aIntent)
+RasterImage::ShutdownDecoder(ShutdownReason aReason)
 {
   MOZ_ASSERT(NS_IsMainThread());
   mDecodingMonitor.AssertCurrentThreadIn();
 
-  // Ensure that our intent is valid
-  NS_ABORT_IF_FALSE((aIntent >= 0) && (aIntent < eShutdownIntent_AllCount),
-                    "Invalid shutdown intent");
-
   // Ensure that the decoder is initialized
   NS_ABORT_IF_FALSE(mDecoder, "Calling ShutdownDecoder() with no active decoder!");
 
@@ -2015,7 +2010,7 @@ RasterImage::ShutdownDecoder(eShutdownIntent aIntent)
   nsRefPtr<Decoder> decoder = mDecoder;
   mDecoder = nullptr;
 
-  decoder->Finish(aIntent);
+  decoder->Finish(aReason);
 
   // Unlock the last frame (if we have any). Our invariant is that, while we
   // have a decoder open, the last frame is always locked.
@@ -2036,12 +2031,8 @@ RasterImage::ShutdownDecoder(eShutdownIntent aIntent)
 
   // We just shut down the decoder. If we didn't get what we want, but expected
   // to, flag an error
-  bool failed = false;
-  if (wasSizeDecode && !mHasSize)
-    failed = true;
-  if (!wasSizeDecode && !mDecoded)
-    failed = true;
-  if ((aIntent == eShutdownIntent_Done) && failed) {
+  bool succeeded = wasSizeDecode ? mHasSize : mDecoded;
+  if ((aReason == ShutdownReason::DONE) && !succeeded) {
     DoError();
     return NS_ERROR_FAILURE;
   }
@@ -2223,7 +2214,7 @@ RasterImage::RequestDecodeCore(RequestDecodeType aDecodeType)
   // If we have a size decode open, interrupt it and shut it down; or if
   // the decoder has different flags than what we need
   if (mDecoder && mDecoder->GetDecodeFlags() != mFrameDecodeFlags) {
-    nsresult rv = FinishedSomeDecoding(eShutdownIntent_NotNeeded);
+    nsresult rv = FinishedSomeDecoding(ShutdownReason::NOT_NEEDED);
     CONTAINER_ENSURE_SUCCESS(rv);
   }
 
@@ -2250,7 +2241,7 @@ RasterImage::RequestDecodeCore(RequestDecodeType aDecodeType)
     PROFILER_LABEL_PRINTF("RasterImage", "DecodeABitOf",
       js::ProfileEntry::Category::GRAPHICS, "%s", GetURIString().get());
 
-    DecodePool::Singleton()->DecodeABitOf(this, DECODE_SYNC);
+    DecodePool::Singleton()->DecodeABitOf(this, DecodeStrategy::SYNC);
     return NS_OK;
   }
 
@@ -2309,7 +2300,7 @@ RasterImage::SyncDecode()
   // If we have a decoder open with different flags than what we need, shut it
   // down
   if (mDecoder && mDecoder->GetDecodeFlags() != mFrameDecodeFlags) {
-    nsresult rv = FinishedSomeDecoding(eShutdownIntent_NotNeeded);
+    nsresult rv = FinishedSomeDecoding(ShutdownReason::NOT_NEEDED);
     CONTAINER_ENSURE_SUCCESS(rv);
 
     if (mDecoded) {
@@ -2337,7 +2328,7 @@ RasterImage::SyncDecode()
 
   // Write everything we have
   rv = DecodeSomeData(mSourceData.Length() - mDecoder->BytesDecoded(),
-                      DECODE_SYNC);
+                      DecodeStrategy::SYNC);
   CONTAINER_ENSURE_SUCCESS(rv);
 
   rv = FinishedSomeDecoding();
@@ -2652,7 +2643,7 @@ RasterImage::UnlockImage()
            ("RasterImage[0x%p] canceling decode because image "
             "is now unlocked.", this));
     ReentrantMonitorAutoEnter lock(mDecodingMonitor);
-    FinishedSomeDecoding(eShutdownIntent_NotNeeded);
+    FinishedSomeDecoding(ShutdownReason::NOT_NEEDED);
     ForceDiscard();
     return NS_OK;
   }
@@ -2773,7 +2764,7 @@ RasterImage::DoError()
 
   // If we're mid-decode, shut down the decoder.
   if (mDecoder) {
-    FinishedSomeDecoding(eShutdownIntent_Error);
+    FinishedSomeDecoding(ShutdownReason::FATAL_ERROR);
   }
 
   // Put the container in an error state.
@@ -2859,7 +2850,7 @@ RasterImage::GetFramesNotified(uint32_t *aFramesNotified)
 
 nsresult
 RasterImage::RequestDecodeIfNeeded(nsresult aStatus,
-                                   eShutdownIntent aIntent,
+                                   ShutdownReason aReason,
                                    bool aDone,
                                    bool aWasSize)
 {
@@ -2867,7 +2858,7 @@ RasterImage::RequestDecodeIfNeeded(nsresult aStatus,
 
   // If we were a size decode and a full decode was requested, now's the time.
   if (NS_SUCCEEDED(aStatus) &&
-      aIntent == eShutdownIntent_Done &&
+      aReason == ShutdownReason::DONE &&
       aDone &&
       aWasSize &&
       mWantFullDecode) {
@@ -2885,7 +2876,7 @@ RasterImage::RequestDecodeIfNeeded(nsresult aStatus,
 }
 
 nsresult
-RasterImage::FinishedSomeDecoding(eShutdownIntent aIntent /* = eShutdownIntent_Done */,
+RasterImage::FinishedSomeDecoding(ShutdownReason aReason /* = ShutdownReason::DONE */,
                                   Progress aProgress /* = NoProgress */)
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -2917,7 +2908,7 @@ RasterImage::FinishedSomeDecoding(eShutdownIntent aIntent /* = eShutdownIntent_D
 
     // If the decode finished, or we're specifically being told to shut down,
     // tell the image and shut down the decoder.
-    if (image->IsDecodeFinished() || aIntent != eShutdownIntent_Done) {
+    if (image->IsDecodeFinished() || aReason != ShutdownReason::DONE) {
       done = true;
 
       // Hold on to a reference to the decoder until we're done with it
@@ -2942,7 +2933,7 @@ RasterImage::FinishedSomeDecoding(eShutdownIntent aIntent /* = eShutdownIntent_D
 
       // We need to shut down the decoder first, in order to ensure all
       // decoding routines have been finished.
-      rv = image->ShutdownDecoder(aIntent);
+      rv = image->ShutdownDecoder(aReason);
       if (NS_FAILED(rv)) {
         image->DoError();
       }
@@ -2994,7 +2985,7 @@ RasterImage::FinishedSomeDecoding(eShutdownIntent aIntent /* = eShutdownIntent_D
     }
   }
 
-  return RequestDecodeIfNeeded(rv, aIntent, done, wasSize);
+  return RequestDecodeIfNeeded(rv, aReason, done, wasSize);
 }
 
 already_AddRefed<imgIContainer>
@@ -3004,447 +2995,6 @@ RasterImage::Unwrap()
   return self.forget();
 }
 
-NS_IMPL_ISUPPORTS(RasterImage::DecodePool,
-                  nsIObserver)
-
-/* static */ RasterImage::DecodePool*
-RasterImage::DecodePool::Singleton()
-{
-  if (!sSingleton) {
-    MOZ_ASSERT(NS_IsMainThread());
-    sSingleton = new DecodePool();
-    ClearOnShutdown(&sSingleton);
-  }
-
-  return sSingleton;
-}
-
-already_AddRefed<nsIEventTarget>
-RasterImage::DecodePool::GetEventTarget()
-{
-  nsCOMPtr<nsIEventTarget> target = do_QueryInterface(mThreadPool);
-  return target.forget();
-}
-
-#ifdef MOZ_NUWA_PROCESS
-
-class RIDThreadPoolListener MOZ_FINAL : public nsIThreadPoolListener
-{
-public:
-    NS_DECL_THREADSAFE_ISUPPORTS
-    NS_DECL_NSITHREADPOOLLISTENER
-
-    RIDThreadPoolListener() {}
-    ~RIDThreadPoolListener() {}
-};
-
-NS_IMPL_ISUPPORTS(RIDThreadPoolListener, nsIThreadPoolListener)
-
-NS_IMETHODIMP
-RIDThreadPoolListener::OnThreadCreated()
-{
-    if (IsNuwaProcess()) {
-        NuwaMarkCurrentThread((void (*)(void *))nullptr, nullptr);
-    }
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-RIDThreadPoolListener::OnThreadShuttingDown()
-{
-    return NS_OK;
-}
-
-#endif // MOZ_NUWA_PROCESS
-
-RasterImage::DecodePool::DecodePool()
- : mThreadPoolMutex("Thread Pool")
-{
-  if (gfxPrefs::ImageMTDecodingEnabled()) {
-    mThreadPool = do_CreateInstance(NS_THREADPOOL_CONTRACTID);
-    if (mThreadPool) {
-      mThreadPool->SetName(NS_LITERAL_CSTRING("ImageDecoder"));
-      int32_t prefLimit = gfxPrefs::ImageMTDecodingLimit();
-      uint32_t limit;
-      if (prefLimit <= 0) {
-        limit = std::max(PR_GetNumberOfProcessors(), 2) - 1;
-      } else {
-        limit = static_cast<uint32_t>(prefLimit);
-      }
-
-      mThreadPool->SetThreadLimit(limit);
-      mThreadPool->SetIdleThreadLimit(limit);
-
-#ifdef MOZ_NUWA_PROCESS
-      if (IsNuwaProcess()) {
-        mThreadPool->SetListener(new RIDThreadPoolListener());
-      }
-#endif
-
-      nsCOMPtr<nsIObserverService> obsSvc = services::GetObserverService();
-      if (obsSvc) {
-        obsSvc->AddObserver(this, "xpcom-shutdown-threads", false);
-      }
-    }
-  }
-}
-
-RasterImage::DecodePool::~DecodePool()
-{
-  MOZ_ASSERT(NS_IsMainThread(), "Must shut down DecodePool on main thread!");
-}
-
-NS_IMETHODIMP
-RasterImage::DecodePool::Observe(nsISupports *subject, const char *topic,
-                                 const char16_t *data)
-{
-  NS_ASSERTION(strcmp(topic, "xpcom-shutdown-threads") == 0, "oops");
-
-  nsCOMPtr<nsIThreadPool> threadPool;
-
-  {
-    MutexAutoLock threadPoolLock(mThreadPoolMutex);
-    threadPool = mThreadPool;
-    mThreadPool = nullptr;
-  }
-
-  if (threadPool) {
-    threadPool->Shutdown();
-  }
-
-  return NS_OK;
-}
-
-void
-RasterImage::DecodePool::RequestDecode(RasterImage* aImg)
-{
-  MOZ_ASSERT(aImg->mDecoder);
-  aImg->mDecodingMonitor.AssertCurrentThreadIn();
-
-  // If we're currently waiting on a new frame for this image, we can't do any
-  // decoding.
-  if (!aImg->mDecoder->NeedsNewFrame()) {
-    if (aImg->mDecodeStatus == DecodeStatus::PENDING ||
-        aImg->mDecodeStatus == DecodeStatus::ACTIVE) {
-      // The image is already in our list of images to decode, or currently being
-      // decoded, so we don't have to do anything else.
-      return;
-    }
-
-    aImg->mDecodeStatus = DecodeStatus::PENDING;
-    nsRefPtr<DecodeJob> job = new DecodeJob(aImg);
-
-    MutexAutoLock threadPoolLock(mThreadPoolMutex);
-    if (!gfxPrefs::ImageMTDecodingEnabled() || !mThreadPool) {
-      NS_DispatchToMainThread(job);
-    } else {
-      mThreadPool->Dispatch(job, nsIEventTarget::DISPATCH_NORMAL);
-    }
-  }
-}
-
-void
-RasterImage::DecodePool::DecodeABitOf(RasterImage* aImg, DecodeStrategy aStrategy)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  aImg->mDecodingMonitor.AssertCurrentThreadIn();
-
-  // If the image is waiting for decode work to be notified, go ahead and do that.
-  if (aImg->mDecodeStatus == DecodeStatus::WORK_DONE) {
-    aImg->FinishedSomeDecoding();
-  }
-
-  DecodeSomeOfImage(aImg, aStrategy);
-
-  aImg->FinishedSomeDecoding();
-
-  // If the decoder needs a new frame, enqueue an event to get it; that event
-  // will enqueue another decode request when it's done.
-  if (aImg->mDecoder && aImg->mDecoder->NeedsNewFrame()) {
-    FrameNeededWorker::GetNewFrame(aImg);
-  } else {
-    // If we aren't yet finished decoding and we have more data in hand, add
-    // this request to the back of the priority list.
-    if (aImg->mDecoder &&
-        !aImg->mError &&
-        !aImg->IsDecodeFinished() &&
-        aImg->mSourceData.Length() > aImg->mDecoder->BytesDecoded()) {
-      RequestDecode(aImg);
-    }
-  }
-}
-
-/* static */ void
-RasterImage::DecodePool::StopDecoding(RasterImage* aImg)
-{
-  aImg->mDecodingMonitor.AssertCurrentThreadIn();
-
-  // If we haven't got a decode request, we're not currently decoding. (Having
-  // a decode request doesn't imply we *are* decoding, though.)
-  aImg->mDecodeStatus = DecodeStatus::STOPPED;
-}
-
-NS_IMETHODIMP
-RasterImage::DecodePool::DecodeJob::Run()
-{
-  ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
-
-  // If we were interrupted, we shouldn't do any work.
-  if (mImage->mDecodeStatus == DecodeStatus::STOPPED) {
-    DecodeDoneWorker::NotifyFinishedSomeDecoding(mImage);
-    return NS_OK;
-  }
-
-  // If someone came along and synchronously decoded us, there's nothing for us to do.
-  if (!mImage->mDecoder || mImage->IsDecodeFinished()) {
-    DecodeDoneWorker::NotifyFinishedSomeDecoding(mImage);
-    return NS_OK;
-  }
-
-  // If we're a decode job that's been enqueued since a previous decode that
-  // still needs a new frame, we can't do anything. Wait until the
-  // FrameNeededWorker enqueues another frame.
-  if (mImage->mDecoder->NeedsNewFrame()) {
-    return NS_OK;
-  }
-
-  mImage->mDecodeStatus = DecodeStatus::ACTIVE;
-
-  size_t oldByteCount = mImage->mDecoder->BytesDecoded();
-
-  DecodeType type = DECODE_TYPE_UNTIL_DONE_BYTES;
-
-  // Multithreaded decoding can be disabled. If we've done so, we don't want to
-  // monopolize the main thread, and will allow a timeout in DecodeSomeOfImage.
-  if (NS_IsMainThread()) {
-    type = DECODE_TYPE_UNTIL_TIME;
-  }
-
-  size_t maxBytes = mImage->mSourceData.Length() -
-                    mImage->mDecoder->BytesDecoded();
-  DecodePool::Singleton()->DecodeSomeOfImage(mImage, DECODE_ASYNC,
-                                             type, maxBytes);
-
-  size_t bytesDecoded = mImage->mDecoder->BytesDecoded() - oldByteCount;
-
-  mImage->mDecodeStatus = DecodeStatus::WORK_DONE;
-
-  // If the decoder needs a new frame, enqueue an event to get it; that event
-  // will enqueue another decode request when it's done.
-  if (mImage->mDecoder && mImage->mDecoder->NeedsNewFrame()) {
-    FrameNeededWorker::GetNewFrame(mImage);
-  }
-  // If we aren't yet finished decoding and we have more data in hand, add
-  // this request to the back of the list.
-  else if (mImage->mDecoder &&
-           !mImage->mError &&
-           !mImage->mPendingError &&
-           !mImage->IsDecodeFinished() &&
-           bytesDecoded < maxBytes &&
-           bytesDecoded > 0) {
-    DecodePool::Singleton()->RequestDecode(mImage);
-  } else {
-    // Nothing more for us to do - let everyone know what happened.
-    DecodeDoneWorker::NotifyFinishedSomeDecoding(mImage);
-  }
-
-  return NS_OK;
-}
-
-RasterImage::DecodePool::DecodeJob::~DecodeJob()
-{
-  if (gfxPrefs::ImageMTDecodingEnabled()) {
-    // Dispatch mImage to main thread to prevent mImage from being destructed by decode thread.
-    nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
-    NS_WARN_IF_FALSE(mainThread, "Couldn't get the main thread!");
-    if (mainThread) {
-      // Handle ambiguous nsISupports inheritance
-      RasterImage* rawImg = nullptr;
-      mImage.swap(rawImg);
-      DebugOnly<nsresult> rv = NS_ProxyRelease(mainThread, NS_ISUPPORTS_CAST(ImageResource*, rawImg));
-      MOZ_ASSERT(NS_SUCCEEDED(rv), "Failed to proxy release to main thread");
-    }
-  }
-}
-
-nsresult
-RasterImage::DecodePool::DecodeUntilSizeAvailable(RasterImage* aImg)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  ReentrantMonitorAutoEnter lock(aImg->mDecodingMonitor);
-
-  // If the image is waiting for decode work to be notified, go ahead and do that.
-  if (aImg->mDecodeStatus == DecodeStatus::WORK_DONE) {
-    nsresult rv = aImg->FinishedSomeDecoding();
-    if (NS_FAILED(rv)) {
-      aImg->DoError();
-      return rv;
-    }
-  }
-
-  // We use DECODE_ASYNC here because we just want to get the size information
-  // here and defer the rest of the work.
-  nsresult rv = DecodeSomeOfImage(aImg, DECODE_ASYNC, DECODE_TYPE_UNTIL_SIZE);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  // If the decoder needs a new frame, enqueue an event to get it; that event
-  // will enqueue another decode request when it's done.
-  if (aImg->mDecoder && aImg->mDecoder->NeedsNewFrame()) {
-    FrameNeededWorker::GetNewFrame(aImg);
-  } else {
-    rv = aImg->FinishedSomeDecoding();
-  }
-
-  return rv;
-}
-
-nsresult
-RasterImage::DecodePool::DecodeSomeOfImage(RasterImage* aImg,
-                                           DecodeStrategy aStrategy,
-                                           DecodeType aDecodeType /* = DECODE_TYPE_UNTIL_TIME */,
-                                           uint32_t bytesToDecode /* = 0 */)
-{
-  NS_ABORT_IF_FALSE(aImg->mInitialized,
-                    "Worker active for uninitialized container!");
-  aImg->mDecodingMonitor.AssertCurrentThreadIn();
-
-  // If an error is flagged, it probably happened while we were waiting
-  // in the event queue.
-  if (aImg->mError)
-    return NS_OK;
-
-  // If there is an error worker pending (say because the main thread has enqueued
-  // another decode request for us before processing the error worker) then bail out.
-  if (aImg->mPendingError)
-    return NS_OK;
-
-  // If mDecoded or we don't have a decoder, we must have finished already (for
-  // example, a synchronous decode request came while the worker was pending).
-  if (!aImg->mDecoder || aImg->mDecoded)
-    return NS_OK;
-
-  // If we're doing synchronous decodes, and we're waiting on a new frame for
-  // this image, get it now.
-  if (aStrategy == DECODE_SYNC && aImg->mDecoder->NeedsNewFrame()) {
-    MOZ_ASSERT(NS_IsMainThread());
-    aImg->mDecoder->AllocateFrame();
-  }
-
-  // If we're not synchronous, we can't allocate a frame right now.
-  else if (aImg->mDecoder->NeedsNewFrame()) {
-    return NS_OK;
-  }
-
-  nsRefPtr<Decoder> decoderKungFuDeathGrip = aImg->mDecoder;
-
-  uint32_t maxBytes;
-  if (aImg->mDecoder->IsSizeDecode()) {
-    // Decode all available data if we're a size decode; they're cheap, and we
-    // want them to be more or less synchronous.
-    maxBytes = aImg->mSourceData.Length();
-  } else {
-    // We're only guaranteed to decode this many bytes, so in particular,
-    // gfxPrefs::ImageMemDecodeBytesAtATime should be set high enough for us
-    // to read the size from most images.
-    maxBytes = gfxPrefs::ImageMemDecodeBytesAtATime();
-  }
-
-  if (bytesToDecode == 0) {
-    bytesToDecode = aImg->mSourceData.Length() - aImg->mDecoder->BytesDecoded();
-  }
-
-  TimeStamp deadline = TimeStamp::Now() +
-                       TimeDuration::FromMilliseconds(gfxPrefs::ImageMemMaxMSBeforeYield());
-
-  // We keep decoding chunks until:
-  //  * we don't have any data left to decode,
-  //  * the decode completes,
-  //  * we're an UNTIL_SIZE decode and we get the size, or
-  //  * we run out of time.
-  // We also try to decode at least one "chunk" if we've allocated a new frame,
-  // even if we have no more data to send to the decoder.
-  while ((aImg->mSourceData.Length() > aImg->mDecoder->BytesDecoded() &&
-          bytesToDecode > 0 &&
-          !aImg->IsDecodeFinished() &&
-          !(aDecodeType == DECODE_TYPE_UNTIL_SIZE && aImg->mHasSize) &&
-          !aImg->mDecoder->NeedsNewFrame()) ||
-         aImg->mDecoder->NeedsToFlushData()) {
-    uint32_t chunkSize = std::min(bytesToDecode, maxBytes);
-    nsresult rv = aImg->DecodeSomeData(chunkSize, aStrategy);
-    if (NS_FAILED(rv)) {
-      aImg->DoError();
-      return rv;
-    }
-
-    bytesToDecode -= chunkSize;
-
-    // Yield if we've been decoding for too long. We check this _after_ decoding
-    // a chunk to ensure that we don't yield without doing any decoding.
-    if (aDecodeType == DECODE_TYPE_UNTIL_TIME && TimeStamp::Now() >= deadline)
-      break;
-  }
-
-  return NS_OK;
-}
-
-RasterImage::DecodeDoneWorker::DecodeDoneWorker(RasterImage* aImage)
- : mImage(aImage)
-{ }
-
-void
-RasterImage::DecodeDoneWorker::NotifyFinishedSomeDecoding(RasterImage* aImage)
-{
-  aImage->mDecodingMonitor.AssertCurrentThreadIn();
-
-  nsCOMPtr<nsIRunnable> worker = new DecodeDoneWorker(aImage);
-  NS_DispatchToMainThread(worker);
-}
-
-NS_IMETHODIMP
-RasterImage::DecodeDoneWorker::Run()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
-
-  mImage->FinishedSomeDecoding(eShutdownIntent_Done);
-
-  return NS_OK;
-}
-
-RasterImage::FrameNeededWorker::FrameNeededWorker(RasterImage* image)
- : mImage(image)
-{}
-
-
-void
-RasterImage::FrameNeededWorker::GetNewFrame(RasterImage* image)
-{
-  nsCOMPtr<nsIRunnable> worker = new FrameNeededWorker(image);
-  NS_DispatchToMainThread(worker);
-}
-
-NS_IMETHODIMP
-RasterImage::FrameNeededWorker::Run()
-{
-  ReentrantMonitorAutoEnter lock(mImage->mDecodingMonitor);
-  nsresult rv = NS_OK;
-
-  // If we got a synchronous decode in the mean time, we don't need to do
-  // anything.
-  if (mImage->mDecoder && mImage->mDecoder->NeedsNewFrame()) {
-    rv = mImage->mDecoder->AllocateFrame();
-  }
-
-  if (NS_SUCCEEDED(rv) && mImage->mDecoder) {
-    // By definition, we're not done decoding, so enqueue us for more decoding.
-    DecodePool::Singleton()->RequestDecode(mImage);
-  }
-
-  return NS_OK;
-}
-
 nsIntSize
 RasterImage::OptimalImageSizeForDest(const gfxSize& aDest, uint32_t aWhichFrame,
                                      GraphicsFilter aFilter, uint32_t aFlags)
diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h
index ba74f8f45f39..89239ab16e9a 100644
--- a/image/src/RasterImage.h
+++ b/image/src/RasterImage.h
@@ -25,16 +25,14 @@
 #include "nsTArray.h"
 #include "imgFrame.h"
 #include "nsThreadUtils.h"
-#include "DecodeStrategy.h"
+#include "DecodePool.h"
 #include "DiscardTracker.h"
 #include "Orientation.h"
 #include "nsIObserver.h"
 #include "mozilla/MemoryReporting.h"
-#include "mozilla/Mutex.h"
 #include "mozilla/ReentrantMonitor.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/TypedEnum.h"
-#include "mozilla/StaticPtr.h"
 #include "mozilla/WeakPtr.h"
 #include "mozilla/UniquePtr.h"
 #ifdef DEBUG
@@ -135,15 +133,6 @@ namespace image {
 
 class Decoder;
 class FrameAnimator;
-class ScaleRunner;
-
-MOZ_BEGIN_ENUM_CLASS(DecodeStatus, uint8_t)
-  INACTIVE,
-  PENDING,
-  ACTIVE,
-  WORK_DONE,
-  STOPPED
-MOZ_END_ENUM_CLASS(DecodeStatus)
 
 class RasterImage MOZ_FINAL : public ImageResource
                             , public nsIProperties
@@ -260,9 +249,7 @@ public:
                                        bool aLastPart) MOZ_OVERRIDE;
   virtual nsresult OnNewSourceData() MOZ_OVERRIDE;
 
-  static already_AddRefed<nsIEventTarget> GetEventTarget() {
-    return DecodePool::Singleton()->GetEventTarget();
-  }
+  static already_AddRefed<nsIEventTarget> GetEventTarget();
 
   /**
    * A hint of the number of bytes of source data that the image contains. If
@@ -294,8 +281,6 @@ public:
     return mRequestedSampleSize;
   }
 
-
-
  nsCString GetURIString() {
     nsCString spec;
     if (GetURI()) {
@@ -304,168 +289,15 @@ public:
     return spec;
   }
 
-  // Called from module startup. Sets up RasterImage to be used.
   static void Initialize();
 
-  // Decoder shutdown
-  enum eShutdownIntent {
-    eShutdownIntent_Done        = 0,
-    eShutdownIntent_NotNeeded   = 1,
-    eShutdownIntent_Error       = 2,
-    eShutdownIntent_AllCount    = 3
-  };
-
 private:
-  /*
-   * DecodePool is a singleton class we use when decoding large images.
-   *
-   * When we wish to decode an image larger than
-   * image.mem.max_bytes_for_sync_decode, we call DecodePool::RequestDecode()
-   * for the image.  This adds the image to a queue of pending requests and posts
-   * the DecodePool singleton to the event queue, if it's not already pending
-   * there.
-   *
-   * When the DecodePool is run from the event queue, it decodes the image (and
-   * all others it's managing) in chunks, periodically yielding control back to
-   * the event loop.
-   */
-  class DecodePool : public nsIObserver
-  {
-  public:
-    NS_DECL_THREADSAFE_ISUPPORTS
-    NS_DECL_NSIOBSERVER
+  friend class DecodePool;
+  friend class DecodeWorker;
+  friend class FrameNeededWorker;
+  friend class NotifyProgressWorker;
 
-    static DecodePool* Singleton();
-
-    /**
-     * Ask the DecodePool to asynchronously decode this image.
-     */
-    void RequestDecode(RasterImage* aImg);
-
-    /**
-     * Decode aImg for a short amount of time, and post the remainder to the
-     * queue.
-     */
-    void DecodeABitOf(RasterImage* aImg, DecodeStrategy aStrategy);
-
-    /**
-     * Ask the DecodePool to stop decoding this image.  Internally, we also
-     * call this function when we finish decoding an image.
-     *
-     * Since the DecodePool keeps raw pointers to RasterImages, make sure you
-     * call this before a RasterImage is destroyed!
-     */
-    static void StopDecoding(RasterImage* aImg);
-
-    /**
-     * Synchronously decode the beginning of the image until we run out of
-     * bytes or we get the image's size.  Note that this done on a best-effort
-     * basis; if the size is burried too deep in the image, we'll give up.
-     *
-     * @return NS_ERROR if an error is encountered, and NS_OK otherwise.  (Note
-     *         that we return NS_OK even when the size was not found.)
-     */
-    nsresult DecodeUntilSizeAvailable(RasterImage* aImg);
-
-    /**
-     * Returns an event target interface to the thread pool; primarily for
-     * OnDataAvailable delivery off main thread.
-     *
-     * @return An nsIEventTarget interface to mThreadPool.
-     */
-    already_AddRefed<nsIEventTarget> GetEventTarget();
-
-  private: /* statics */
-    static StaticRefPtr<DecodePool> sSingleton;
-
-  private: /* methods */
-    DecodePool();
-    virtual ~DecodePool();
-
-    enum DecodeType {
-      DECODE_TYPE_UNTIL_TIME,
-      DECODE_TYPE_UNTIL_SIZE,
-      DECODE_TYPE_UNTIL_DONE_BYTES
-    };
-
-    /* Decode some chunks of the given image.  If aDecodeType is UNTIL_SIZE,
-     * decode until we have the image's size, then stop. If bytesToDecode is
-     * non-0, at most bytesToDecode bytes will be decoded. if aDecodeType is
-     * UNTIL_DONE_BYTES, decode until all bytesToDecode bytes are decoded.
-     */
-    nsresult DecodeSomeOfImage(RasterImage* aImg,
-                               DecodeStrategy aStrategy,
-                               DecodeType aDecodeType = DECODE_TYPE_UNTIL_TIME,
-                               uint32_t bytesToDecode = 0);
-
-    /* A decode job dispatched to a thread pool by DecodePool.
-     */
-    class DecodeJob : public nsRunnable
-    {
-    public:
-      DecodeJob(RasterImage* aImage) : mImage(aImage) { }
-
-      NS_IMETHOD Run() MOZ_OVERRIDE;
-
-    protected:
-      virtual ~DecodeJob();
-
-    private:
-      nsRefPtr<RasterImage> mImage;
-    };
-
-  private: /* members */
-
-    // mThreadPoolMutex protects mThreadPool. For all RasterImages R,
-    // R::mDecodingMonitor must be acquired before mThreadPoolMutex
-    // if both are acquired; the other order may cause deadlock.
-    Mutex                     mThreadPoolMutex;
-    nsCOMPtr<nsIThreadPool>   mThreadPool;
-  };
-
-  class DecodeDoneWorker : public nsRunnable
-  {
-  public:
-    /**
-     * Called by the DecodePool with an image when it's done some significant
-     * portion of decoding that needs to be notified about.
-     *
-     * Ensures the decode state accumulated by the decoding process gets
-     * applied to the image.
-     */
-    static void NotifyFinishedSomeDecoding(RasterImage* aImage);
-
-    NS_IMETHOD Run();
-
-  private:
-    DecodeDoneWorker(RasterImage* aImage);
-
-    nsRefPtr<RasterImage> mImage;
-  };
-
-  class FrameNeededWorker : public nsRunnable
-  {
-  public:
-    /**
-     * Called by the DecodeJob with an image when it's been told by the
-     * decoder that it needs a new frame to be allocated on the main thread.
-     *
-     * Dispatches an event to do so, which will further dispatch a
-     * RequestDecode event to continue decoding.
-     */
-    static void GetNewFrame(RasterImage* image);
-
-    NS_IMETHOD Run();
-
-  private: /* methods */
-    explicit FrameNeededWorker(RasterImage* image);
-
-  private: /* members */
-
-    nsRefPtr<RasterImage> mImage;
-  };
-
-  nsresult FinishedSomeDecoding(eShutdownIntent intent = eShutdownIntent_Done,
+  nsresult FinishedSomeDecoding(ShutdownReason aReason = ShutdownReason::DONE,
                                 Progress aProgress = NoProgress);
 
   void DrawWithPreDownscaleIfNeeded(DrawableFrameRef&& aFrameRef,
@@ -624,10 +456,8 @@ private: // data
   bool                       mPendingError:1;
 
   // Decoding
-  nsresult RequestDecodeIfNeeded(nsresult aStatus,
-                                 eShutdownIntent aIntent,
-                                 bool aDone,
-                                 bool aWasSize);
+  nsresult RequestDecodeIfNeeded(nsresult aStatus, ShutdownReason aReason,
+                                 bool aDone, bool aWasSize);
   nsresult WantDecodedFrames(uint32_t aFlags, bool aShouldSyncNotify);
   nsresult SyncDecode();
   nsresult InitDecoder(bool aDoSizeDecode);
@@ -639,7 +469,7 @@ private: // data
   // Initializes ProgressTracker and resets it on RasterImage destruction.
   nsAutoPtr<ProgressTrackerInit> mProgressTrackerInit;
 
-  nsresult ShutdownDecoder(eShutdownIntent aIntent);
+  nsresult ShutdownDecoder(ShutdownReason aReason);
 
 
   //////////////////////////////////////////////////////////////////////////////
diff --git a/image/src/moz.build b/image/src/moz.build
index 9ad79f5d524f..c4ebae1ba685 100644
--- a/image/src/moz.build
+++ b/image/src/moz.build
@@ -16,6 +16,7 @@ EXPORTS += [
 
 UNIFIED_SOURCES += [
     'ClippedImage.cpp',
+    'DecodePool.cpp',
     'Decoder.cpp',
     'DiscardTracker.cpp',
     'DynamicImage.cpp',

From 0f65d877bdd0e8cefca0dfc148ad575d33505e3d Mon Sep 17 00:00:00 2001
From: Seth Fowler <seth@mozilla.com>
Date: Tue, 18 Nov 2014 18:41:48 -0800
Subject: [PATCH 43/84] Bug 1100497 - Disable test_animation.html due to
 intermittent oranges. r=me

--HG--
extra : rebase_source : 0042b8128f5c4e53ae84a3b852000389effefd34
---
 image/test/mochitest/chrome.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/image/test/mochitest/chrome.ini b/image/test/mochitest/chrome.ini
index 5195195b61f7..783ab899ffae 100644
--- a/image/test/mochitest/chrome.ini
+++ b/image/test/mochitest/chrome.ini
@@ -32,6 +32,7 @@ support-files =
 [test_animSVGImage.html]
 [test_animSVGImage2.html]
 [test_animation.html]
+skip-if = true # bug 1100497
 [test_animation2.html]
 [test_background_image_anim.html]
 [test_bullet_animation.html]

From fd297089e66f3d005e60ae8a728a5de190f12ac5 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Tue, 18 Nov 2014 18:42:43 -0800
Subject: [PATCH 44/84] Bug 1100219 - Avoid lots of unnecessary string copying
 in ProtocolParser. r=neil.

--HG--
extra : rebase_source : 7d063de7b5ec312724039c2bf6546758ebc0e2fe
---
 toolkit/components/url-classifier/ProtocolParser.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/toolkit/components/url-classifier/ProtocolParser.cpp b/toolkit/components/url-classifier/ProtocolParser.cpp
index 8acc84858d86..5b77fc9a8545 100644
--- a/toolkit/components/url-classifier/ProtocolParser.cpp
+++ b/toolkit/components/url-classifier/ProtocolParser.cpp
@@ -284,7 +284,7 @@ ProtocolParser::ProcessChunk(bool* aDone)
   // Pull the chunk out of the pending stream data.
   nsAutoCString chunk;
   chunk.Assign(Substring(mPending, 0, mChunkState.length));
-  mPending = Substring(mPending, mChunkState.length);
+  mPending.Cut(0, mChunkState.length);
 
   *aDone = false;
   mState = PROTOCOL_STATE_CONTROL;
@@ -590,14 +590,14 @@ ProtocolParser::ProcessHostSubComplete(uint8_t aNumEntries,
 }
 
 bool
-ProtocolParser::NextLine(nsACString& line)
+ProtocolParser::NextLine(nsACString& aLine)
 {
   int32_t newline = mPending.FindChar('\n');
   if (newline == kNotFound) {
     return false;
   }
-  line.Assign(Substring(mPending, 0, newline));
-  mPending = Substring(mPending, newline + 1);
+  aLine.Assign(Substring(mPending, 0, newline));
+  mPending.Cut(0, newline + 1);
   return true;
 }
 

From e0fab12bbdc6039072f213e02b0528d8fd8d2ad6 Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 15:59:23 +1300
Subject: [PATCH 45/84] Backout 739661ba0243 for Mulet test failure

---
 .../web-platform/meta/media-source/mediasource-remove.html.ini | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testing/web-platform/meta/media-source/mediasource-remove.html.ini b/testing/web-platform/meta/media-source/mediasource-remove.html.ini
index ff9097294991..e1dfbe1f4562 100644
--- a/testing/web-platform/meta/media-source/mediasource-remove.html.ini
+++ b/testing/web-platform/meta/media-source/mediasource-remove.html.ini
@@ -1,6 +1,9 @@
 [mediasource-remove.html]
   type: testharness
   expected: TIMEOUT
+  [Test remove transitioning readyState from \'ended\' to \'open\'.]
+    expected: FAIL
+
   [Test removing all appended data.]
     expected: FAIL
 

From 69085d310c34c93547a38e853b6ff6adb3fc9884 Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 15:59:46 +1300
Subject: [PATCH 46/84] Backout c8dacd232b02 for Mulet test failure

---
 dom/media/test/eme.js | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/dom/media/test/eme.js b/dom/media/test/eme.js
index c98b20d39de2..398f4449281b 100644
--- a/dom/media/test/eme.js
+++ b/dom/media/test/eme.js
@@ -121,15 +121,6 @@ function PlayFragmented(test, elem, token)
     var curFragment = 0;
 
     function addNextFragment() {
-      /* We can get another updateevent as a result of calling ms.endOfStream() if
-         the highest end time of our source buffers is different from that of the
-         media source duration. Due to bug 1065207 this can happen because of
-         inaccuracies in the frame duration calculations. Check if we are already
-         "ended" and ignore the update event */
-      if (ms.readyState == "ended") {
-        return;
-      }
-
       if (curFragment >= test.fragments.length) {
         Log(token, "addNextFragment() end of stream");
         ms.endOfStream();

From d73de396fa44b951a0d5c0554cfd076c8ea726cf Mon Sep 17 00:00:00 2001
From: Chris Double <chris.double@double.co.nz>
Date: Wed, 19 Nov 2014 16:00:09 +1300
Subject: [PATCH 47/84] Backout e62c37b8e6b5 for Mulet test failure

---
 dom/media/mediasource/MediaSource.cpp         |  8 ++-
 dom/media/mediasource/SourceBuffer.cpp        | 11 +---
 dom/media/mediasource/SourceBuffer.h          |  3 --
 dom/media/mediasource/SourceBufferList.cpp    |  9 ++--
 dom/media/mediasource/SourceBufferList.h      |  5 +-
 dom/media/mediasource/test/mochitest.ini      |  2 -
 .../mediasource/test/test_BufferedSeek.html   | 10 +---
 .../mediasource/test/test_EndOfStream.html    | 50 -------------------
 .../mediasource/test/test_FrameSelection.html | 10 ++--
 .../mediasource/test/test_MediaSource.html    | 14 ++----
 .../test/test_SeekableAfterEndOfStream.html   | 10 +---
 .../test_SeekableAfterEndOfStreamSplit.html   |  2 +-
 .../mediasource/test/test_SplitAppend.html    | 10 ++--
 .../test/test_SplitAppendDelay.html           | 10 ++--
 14 files changed, 35 insertions(+), 119 deletions(-)
 delete mode 100644 dom/media/mediasource/test/test_EndOfStream.html

diff --git a/dom/media/mediasource/MediaSource.cpp b/dom/media/mediasource/MediaSource.cpp
index a41fe9eb2542..6a45d1118cbe 100644
--- a/dom/media/mediasource/MediaSource.cpp
+++ b/dom/media/mediasource/MediaSource.cpp
@@ -418,10 +418,14 @@ void
 MediaSource::DurationChange(double aOldDuration, double aNewDuration)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MSE_DEBUG("MediaSource(%p)::DurationChange(aOldDuration=%f, aNewDuration=%f)", this, aOldDuration, aNewDuration);
+  MSE_DEBUG("MediaSource(%p)::DurationChange(aNewDuration=%f)", this, aNewDuration);
 
   if (aNewDuration < aOldDuration) {
-    mSourceBuffers->RangeRemoval(aNewDuration, aOldDuration);
+    ErrorResult rv;
+    mSourceBuffers->Remove(aNewDuration, aOldDuration, rv);
+    if (rv.Failed()) {
+      return;
+    }
   }
   // TODO: If partial audio frames/text cues exist, clamp duration based on mSourceBuffers.
 }
diff --git a/dom/media/mediasource/SourceBuffer.cpp b/dom/media/mediasource/SourceBuffer.cpp
index 838e02c56ba9..320e2a6559e1 100644
--- a/dom/media/mediasource/SourceBuffer.cpp
+++ b/dom/media/mediasource/SourceBuffer.cpp
@@ -188,19 +188,10 @@ SourceBuffer::Remove(double aStart, double aEnd, ErrorResult& aRv)
     aRv.Throw(NS_ERROR_DOM_INVALID_ACCESS_ERR);
     return;
   }
-  if (mUpdating) {
+  if (mUpdating || mMediaSource->ReadyState() != MediaSourceReadyState::Open) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
-  if (mMediaSource->ReadyState() == MediaSourceReadyState::Ended) {
-    mMediaSource->SetReadyState(MediaSourceReadyState::Open);
-  }
-  RangeRemoval(aStart, aEnd);
-}
-
-void
-SourceBuffer::RangeRemoval(double aStart, double aEnd)
-{
   StartUpdating();
   /// TODO: Run coded frame removal algorithm.
 
diff --git a/dom/media/mediasource/SourceBuffer.h b/dom/media/mediasource/SourceBuffer.h
index 88a6f892a1db..5be60b50a219 100644
--- a/dom/media/mediasource/SourceBuffer.h
+++ b/dom/media/mediasource/SourceBuffer.h
@@ -108,9 +108,6 @@ public:
   double GetBufferedStart();
   double GetBufferedEnd();
 
-  // Runs the range removal algorithm as defined by the MSE spec.
-  void RangeRemoval(double aStart, double aEnd);
-
 #if defined(DEBUG)
   void Dump(const char* aPath);
 #endif
diff --git a/dom/media/mediasource/SourceBufferList.cpp b/dom/media/mediasource/SourceBufferList.cpp
index 041fbb80ed96..d833bc9ddbc9 100644
--- a/dom/media/mediasource/SourceBufferList.cpp
+++ b/dom/media/mediasource/SourceBufferList.cpp
@@ -108,12 +108,15 @@ SourceBufferList::AnyUpdating()
 }
 
 void
-SourceBufferList::RangeRemoval(double aStart, double aEnd)
+SourceBufferList::Remove(double aStart, double aEnd, ErrorResult& aRv)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MSE_DEBUG("SourceBufferList(%p)::RangeRemoval(aStart=%f, aEnd=%f", this, aStart, aEnd);
+  MSE_DEBUG("SourceBufferList(%p)::Remove(aStart=%f, aEnd=%f", this, aStart, aEnd);
   for (uint32_t i = 0; i < mSourceBuffers.Length(); ++i) {
-    mSourceBuffers[i]->RangeRemoval(aStart, aEnd);
+    mSourceBuffers[i]->Remove(aStart, aEnd, aRv);
+    if (aRv.Failed()) {
+      return;
+    }
   }
 }
 
diff --git a/dom/media/mediasource/SourceBufferList.h b/dom/media/mediasource/SourceBufferList.h
index de02b914a435..ca5087f2ea22 100644
--- a/dom/media/mediasource/SourceBufferList.h
+++ b/dom/media/mediasource/SourceBufferList.h
@@ -66,8 +66,9 @@ public:
   // Returns true if updating is true on any SourceBuffers in the list.
   bool AnyUpdating();
 
-  // Runs the range removal steps from the MSE specification on each SourceBuffer.
-  void RangeRemoval(double aStart, double aEnd);
+  // Calls Remove(aStart, aEnd) on each SourceBuffer in the list.  Aborts on
+  // first error, with result returned in aRv.
+  void Remove(double aStart, double aEnd, ErrorResult& aRv);
 
   // Mark all SourceBuffers input buffers as ended.
   void Ended();
diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index 76b2561e336a..9d527391816b 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -9,8 +9,6 @@ support-files =
 [test_MediaSource_disabled.html]
 [test_BufferedSeek.html]
 [test_BufferingWait.html]
-[test_EndOfStream.html]
-skip-if = (toolkit == 'android') #timeout android only bug 1101187
 [test_FrameSelection.html]
 [test_HaveMetadataUnbufferedSeek.html]
 [test_LoadedMetadataFired.html]
diff --git a/dom/media/mediasource/test/test_BufferedSeek.html b/dom/media/mediasource/test/test_BufferedSeek.html
index 949fee773b7d..b800a573576f 100644
--- a/dom/media/mediasource/test/test_BufferedSeek.html
+++ b/dom/media/mediasource/test/test_BufferedSeek.html
@@ -12,8 +12,6 @@
 
 SimpleTest.waitForExplicitFinish();
 
-var updateCount = 0;
-
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -21,13 +19,7 @@ runWithMSE(function (ms, v) {
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer));
       sb.addEventListener("updateend", function () {
-        updateCount++;
-        /* Ensure that we endOfStream on the first update event only as endOfStream can
-           raise more if the duration of the last buffered range and the intial duration
-           differ. See bug 1065207 */
-        if (updateCount == 1) {
-          ms.endOfStream();
-        };
+        ms.endOfStream()
       });
     });
 
diff --git a/dom/media/mediasource/test/test_EndOfStream.html b/dom/media/mediasource/test/test_EndOfStream.html
deleted file mode 100644
index 655d21cd320b..000000000000
--- a/dom/media/mediasource/test/test_EndOfStream.html
+++ /dev/null
@@ -1,50 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>MSE: endOfStream call after an appendBuffer</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="mediasource.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<pre id="test">
-<script class="testbody" type="text/javascript">
-
-SimpleTest.waitForExplicitFinish();
-
-runWithMSE(function () {
-  var ms = new MediaSource();
-
-  var v = document.createElement("video");
-  v.src = URL.createObjectURL(ms);
-  document.body.appendChild(v);
-
-  ms.addEventListener("sourceopen", function () {
-    var sb = ms.addSourceBuffer("video/webm");
-
-    fetchWithXHR("seek.webm", function (arrayBuffer) {
-      sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 88966));
-      var count = 0;
-      sb.addEventListener("updateend", function () {
-        ++count;
-        if (count == 1) {
-          setTimeout(function() {
-                       var fail = false;
-                       try {
-                         ms.endOfStream();
-                       } catch (e) {
-                         fail = true;
-                       }
-                       ok(!fail, "MediaSource.endOfStream succeeded");
-                       SimpleTest.finish();
-                     }, 0);
-        }
-      });
-    });
-  });
-});
-
-</script>
-</pre>
-</body>
-</html>
diff --git a/dom/media/mediasource/test/test_FrameSelection.html b/dom/media/mediasource/test/test_FrameSelection.html
index bb2634c706a1..d75d8f7ddedd 100644
--- a/dom/media/mediasource/test/test_FrameSelection.html
+++ b/dom/media/mediasource/test/test_FrameSelection.html
@@ -12,8 +12,6 @@
 
 SimpleTest.waitForExplicitFinish();
 
-var updateCount = 0;
-
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -36,13 +34,13 @@ runWithMSE(function (ms, v) {
       fetchWithXHR("seek_lowres.webm", function (arrayBuffer) {
         // Append initialization segment.
         sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 438));
+        var first = true;
         sb.addEventListener("updateend", function () {
-          updateCount++;
-          if (updateCount == 1) {
+          if (first) {
             // Append media segment covering range [2, 4].
             sb.appendBuffer(new Uint8Array(arrayBuffer, 51003));
-          }
-          else if (updateCount == 2) {
+            first = false;
+          } else {
             ms.endOfStream();
             target = targets.shift();
             v.currentTime = target.currentTime;
diff --git a/dom/media/mediasource/test/test_MediaSource.html b/dom/media/mediasource/test/test_MediaSource.html
index 53c03cefa130..131d64b1c485 100644
--- a/dom/media/mediasource/test/test_MediaSource.html
+++ b/dom/media/mediasource/test/test_MediaSource.html
@@ -57,12 +57,7 @@ runWithMSE(function () {
     sb.addEventListener("update", function () {
       is(sb.updating, false, "SourceBuffer.updating is expected value in update event");
       updateCount++;
-      /* Ensure that we endOfStream on the first update event only as endOfStream can
-         raise more if the duration of the last buffered range and the intial duration
-         differ. See bug 1065207 */
-      if (updateCount == 1) {
-        ms.endOfStream();
-      }
+      ms.endOfStream();
     });
 
     sb.addEventListener("updatestart", function () {
@@ -89,10 +84,9 @@ runWithMSE(function () {
     // XXX: Duration should be exactly 4.0, see bug 1065207.
     ok(Math.abs(v.duration - 4) <= 0.002, "Video has correct duration");
     ok(Math.abs(v.currentTime - 4) <= 0.002, "Video has played to end");
-    // XXX: 2 update events can be received dueto duration differences, see bug 1065207.
-    ok(updateCount == 1 || updateCount == 2, "update event received");
-    ok(updateendCount == 1 || updateendCount == 2, "updateend event received");
-    ok(updatestartCount == 1 || updatestartCount == 2, "updatestart event received");
+    is(updateCount, 1, "update event received");
+    is(updateendCount, 1, "updateend event received");
+    is(updatestartCount, 1, "updatestart event received");
     is(loadedmetadataCount, 1, "loadedmetadata event received");
     v.parentNode.removeChild(v);
     SimpleTest.finish();
diff --git a/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html b/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
index 850434429a24..7ffe68686685 100644
--- a/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
+++ b/dom/media/mediasource/test/test_SeekableAfterEndOfStream.html
@@ -12,8 +12,6 @@
 
 SimpleTest.waitForExplicitFinish();
 
-var updateCount = 0;
-
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
@@ -21,13 +19,7 @@ runWithMSE(function (ms, v) {
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer));
       sb.addEventListener("updateend", function () {
-        updateCount++;
-        /* Ensure that we endOfStream on the first update event only as endOfStream can
-           raise more if the duration of the last buffered range and the intial duration
-           differ. See bug 1065207 */
-        if (updateCount == 1) {
-          ms.endOfStream();
-        };
+        ms.endOfStream()
       });
     });
 
diff --git a/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html b/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
index 771f9b159a60..5f75f11ffec2 100644
--- a/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
+++ b/dom/media/mediasource/test/test_SeekableAfterEndOfStreamSplit.html
@@ -24,7 +24,7 @@ runWithMSE(function (ms, v) {
         if (updateCount == 1) {
           sb.appendBuffer(new Uint8Array(arrayBuffer, 25223));
         }
-        else if (updateCount == 2) {
+        else {
           ms.endOfStream();
         }
       });
diff --git a/dom/media/mediasource/test/test_SplitAppend.html b/dom/media/mediasource/test/test_SplitAppend.html
index e87bd00edca5..f743032080d7 100644
--- a/dom/media/mediasource/test/test_SplitAppend.html
+++ b/dom/media/mediasource/test/test_SplitAppend.html
@@ -12,20 +12,18 @@
 
 SimpleTest.waitForExplicitFinish();
 
-var updateCount = 0;
-
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
 
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
+      var first = true;
       sb.addEventListener("updateend", function () {
-        updateCount++;
-        if (updateCount == 1) {
+        if (first) {
           sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
-        }
-        else if (updateCount == 2) {
+          first = false;
+        } else {
           ms.endOfStream();
         }
       });
diff --git a/dom/media/mediasource/test/test_SplitAppendDelay.html b/dom/media/mediasource/test/test_SplitAppendDelay.html
index f4604b3d0c1c..10dde8b8156e 100644
--- a/dom/media/mediasource/test/test_SplitAppendDelay.html
+++ b/dom/media/mediasource/test/test_SplitAppendDelay.html
@@ -12,22 +12,20 @@
 
 SimpleTest.waitForExplicitFinish();
 
-var updateCount = 0;
-
 runWithMSE(function (ms, v) {
   ms.addEventListener("sourceopen", function () {
     var sb = ms.addSourceBuffer("video/webm");
 
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
+      var first = true;
       sb.addEventListener("updateend", function () {
-        updateCount++;
-        if (updateCount == 1) {
+        if (first) {
           window.setTimeout(function () {
             sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
+            first = false;
           }, 1000);
-        }
-        else if (updateCount == 2) {
+        } else {
           ms.endOfStream();
         }
       });

From 4d59b67ef1ad8b4673967a7c284166d0ee8e4487 Mon Sep 17 00:00:00 2001
From: Matthew Gregan <kinetik@flim.org>
Date: Wed, 19 Nov 2014 16:52:03 +1300
Subject: [PATCH 48/84] Bug 1094310 - Disable media context menu items for blob
 and mediasource URLs.  r=gavin

---
 browser/base/content/nsContextMenu.js | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 6f9d04571fd1..19b18602d824 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -627,7 +627,10 @@ nsContextMenu.prototype = {
         this.onCanvas = true;
       }
       else if (this.target instanceof HTMLVideoElement) {
-        this.mediaURL = this.target.currentSrc || this.target.src;
+        let mediaURL = this.target.currentSrc || this.target.src;
+        if (this.isMediaURLReusable(mediaURL)) {
+          this.mediaURL = mediaURL;
+        }
         // Firefox always creates a HTMLVideoElement when loading an ogg file
         // directly. If the media is actually audio, be smarter and provide a
         // context menu with audio operations.
@@ -640,7 +643,10 @@ nsContextMenu.prototype = {
       }
       else if (this.target instanceof HTMLAudioElement) {
         this.onAudio = true;
-        this.mediaURL = this.target.currentSrc || this.target.src;
+        let mediaURL = this.target.currentSrc || this.target.src;
+        if (this.isMediaURLReusable(mediaURL)) {
+          this.mediaURL = mediaURL;
+        }
       }
       else if (editFlags & (SpellCheckHelper.INPUT | SpellCheckHelper.TEXTAREA)) {
         this.onTextInput = (editFlags & SpellCheckHelper.TEXTINPUT) !== 0;
@@ -1504,6 +1510,10 @@ nsContextMenu.prototype = {
     return !this.focusedWindow.getSelection().isCollapsed;
   },
 
+  isMediaURLReusable: function(aURL) {
+    return !/^(?:blob|mediasource):/.test(aURL);
+  },
+
   toString: function () {
     return "contextMenu.target     = " + this.target + "\n" +
            "contextMenu.onImage    = " + this.onImage + "\n" +

From 7583c5ae7e53aa58c13959b4a85d120fcd47cfc1 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 18 Nov 2014 23:27:15 -0500
Subject: [PATCH 49/84] Bug 1101001.  Stop checking compileAndGo in
 GetPCCountScriptContents.  r=bhackett

---
 js/src/jsopcode.cpp | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 66e14fb6936f..8b1e990a3e4a 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -2393,9 +2393,6 @@ js::GetPCCountScriptContents(JSContext *cx, size_t index)
 
     StringBuffer buf(cx);
 
-    if (!script->functionNonDelazifying() && !script->compileAndGo())
-        return buf.finishString();
-
     {
         AutoCompartment ac(cx, &script->global());
         if (!GetPCCountJSON(cx, sac, buf))

From 67d7197390023545d44eec8671cf0a9294626e99 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 18 Nov 2014 23:27:16 -0500
Subject: [PATCH 50/84] Bug 1100579 part 1.  Remove the overloads of
 JS::Evaluate that don't take an rval mutable handle, and control the behavior
 via the JS::CompileOptions instead.  r=waldo,bholley

---
 dom/base/nsJSUtils.cpp                  |  6 +-
 dom/workers/ScriptLoader.cpp            |  3 +-
 dom/workers/WorkerPrivate.cpp           |  4 +-
 js/src/jsapi-tests/testSourcePolicy.cpp |  8 ++-
 js/src/jsapi.cpp                        | 88 +++++++------------------
 js/src/jsapi.h                          | 20 ------
 js/src/shell/js.cpp                     |  3 +-
 7 files changed, 39 insertions(+), 93 deletions(-)

diff --git a/dom/base/nsJSUtils.cpp b/dom/base/nsJSUtils.cpp
index 4c17648a9d1a..b6846c3f5652 100644
--- a/dom/base/nsJSUtils.cpp
+++ b/dom/base/nsJSUtils.cpp
@@ -253,11 +253,7 @@ nsJSUtils::EvaluateString(JSContext* aCx,
         ok = false;
       }
     } else if (ok) {
-      if (!aCompileOptions.noScriptRval) {
-        ok = JS::Evaluate(aCx, scopeChain, aCompileOptions, aSrcBuf, aRetValue);
-      } else {
-        ok = JS::Evaluate(aCx, scopeChain, aCompileOptions, aSrcBuf);
-      }
+      ok = JS::Evaluate(aCx, scopeChain, aCompileOptions, aSrcBuf, aRetValue);
     }
 
     if (ok && aEvaluateOptions.coerceToString && !aRetValue.isUndefined()) {
diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
index 1f4b4b6841b8..e1a0bc459edb 100644
--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -758,7 +758,8 @@ ScriptExecutorRunnable::WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
     loadInfo.mScriptTextBuf = nullptr;
     loadInfo.mScriptTextLength = 0;
 
-    if (!JS::Evaluate(aCx, global, options, srcBuf)) {
+    JS::Rooted<JS::Value> unused(aCx);
+    if (!JS::Evaluate(aCx, global, options, srcBuf, &unused)) {
       return true;
     }
 
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 4ff3ac77388f..2ff28cebc1c8 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -5631,8 +5631,10 @@ WorkerPrivate::RunExpiredTimeouts(JSContext* aCx)
       options.setFileAndLine(info->mFilename.get(), info->mLineNumber)
              .setNoScriptRval(true);
 
+      JS::Rooted<JS::Value> unused(aCx);
       if ((expression.IsEmpty() ||
-           !JS::Evaluate(aCx, global, options, expression.get(), expression.Length())) &&
+           !JS::Evaluate(aCx, global, options,
+                         expression.get(), expression.Length(), &unused)) &&
           !JS_ReportPendingException(aCx)) {
         retval = false;
         break;
diff --git a/js/src/jsapi-tests/testSourcePolicy.cpp b/js/src/jsapi-tests/testSourcePolicy.cpp
index d108273d8677..52c53b744323 100644
--- a/js/src/jsapi-tests/testSourcePolicy.cpp
+++ b/js/src/jsapi-tests/testSourcePolicy.cpp
@@ -16,9 +16,15 @@ BEGIN_TEST(testBug795104)
     s[0] = '"';
     memset(s + 1, 'x', strLen - 2);
     s[strLen - 1] = '"';
-    CHECK(JS::Evaluate(cx, global, opts, s, strLen));
+    // We don't want an rval for our Evaluate call
+    opts.setNoScriptRval(true);
+    JS::RootedValue unused(cx);
+    CHECK(JS::Evaluate(cx, global, opts, s, strLen, &unused));
     JS::RootedFunction fun(cx);
     JS::AutoObjectVector emptyScopeChain(cx);
+    // But when compiling a function we don't want to use no-rval
+    // mode, since it's not supported for functions.
+    opts.setNoScriptRval(false);
     CHECK(JS::CompileFunction(cx, emptyScopeChain, opts, "f", 0, nullptr, s, strLen, &fun));
     CHECK(fun);
     JS_free(cx, s);
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index f5ab88f7ec6c..e729b969d8d2 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4764,7 +4764,7 @@ static const unsigned LARGE_SCRIPT_LENGTH = 500*1024;
 
 static bool
 Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-         SourceBufferHolder &srcBuf, JS::Value *rval)
+         SourceBufferHolder &srcBuf, MutableHandleValue rval)
 {
     CompileOptions options(cx, optionsArg);
     MOZ_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
@@ -4775,7 +4775,6 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsA
     AutoLastFrameCheck lfc(cx);
 
     options.setCompileAndGo(obj->is<GlobalObject>());
-    options.setNoScriptRval(!rval);
     SourceCompressionTask sct(cx);
     RootedScript script(cx, frontend::CompileScript(cx, &cx->tempLifoAlloc(),
                                                     obj, NullPtr(), options,
@@ -4785,7 +4784,8 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsA
 
     MOZ_ASSERT(script->getVersion() == options.version);
 
-    bool result = Execute(cx, script, *obj, rval);
+    bool result = Execute(cx, script, *obj,
+                          options.noScriptRval ? nullptr : rval.address());
     if (!sct.complete())
         result = false;
 
@@ -4805,7 +4805,7 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsA
 
 static bool
 Evaluate(JSContext *cx, AutoObjectVector &scopeChain, const ReadOnlyCompileOptions &optionsArg,
-         SourceBufferHolder &srcBuf, JS::Value *rval)
+         SourceBufferHolder &srcBuf, MutableHandleValue rval)
 {
     RootedObject dynamicScope(cx);
     RootedObject unusedStaticScope(cx);
@@ -4816,15 +4816,15 @@ Evaluate(JSContext *cx, AutoObjectVector &scopeChain, const ReadOnlyCompileOptio
 
 static bool
 Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-         const char16_t *chars, size_t length, JS::Value *rval)
+         const char16_t *chars, size_t length, MutableHandleValue rval)
 {
   SourceBufferHolder srcBuf(chars, length, SourceBufferHolder::NoOwnership);
   return ::Evaluate(cx, obj, optionsArg, srcBuf, rval);
 }
 
-static bool
-Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
-         const char *bytes, size_t length, JS::Value *rval)
+extern JS_PUBLIC_API(bool)
+JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
+         const char *bytes, size_t length, MutableHandleValue rval)
 {
     char16_t *chars;
     if (options.utf8)
@@ -4841,7 +4841,7 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
 
 static bool
 Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-         const char *filename, JS::Value *rval)
+         const char *filename, MutableHandleValue rval)
 {
     FileContents buffer(cx);
     {
@@ -4855,74 +4855,32 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsA
     return Evaluate(cx, obj, options, buffer.begin(), buffer.length(), rval);
 }
 
-extern JS_PUBLIC_API(bool)
+JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
              SourceBufferHolder &srcBuf, MutableHandleValue rval)
 {
-    return ::Evaluate(cx, obj, optionsArg, srcBuf, rval.address());
+    return ::Evaluate(cx, obj, optionsArg, srcBuf, rval);
 }
 
-extern JS_PUBLIC_API(bool)
+JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, AutoObjectVector &scopeChain, const ReadOnlyCompileOptions &optionsArg,
              SourceBufferHolder &srcBuf, MutableHandleValue rval)
 {
-    return ::Evaluate(cx, scopeChain, optionsArg, srcBuf, rval.address());
+    return ::Evaluate(cx, scopeChain, optionsArg, srcBuf, rval);
 }
 
-extern JS_PUBLIC_API(bool)
+JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
              const char16_t *chars, size_t length, MutableHandleValue rval)
 {
-    return ::Evaluate(cx, obj, optionsArg, chars, length, rval.address());
+    return ::Evaluate(cx, obj, optionsArg, chars, length, rval);
 }
 
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
-             const char *bytes, size_t length, MutableHandleValue rval)
-{
-    return ::Evaluate(cx, obj, options, bytes, length, rval.address());
-}
-
-extern JS_PUBLIC_API(bool)
+JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
              const char *filename, MutableHandleValue rval)
 {
-    return ::Evaluate(cx, obj, optionsArg, filename, rval.address());
-}
-
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-             SourceBufferHolder &srcBuf)
-{
-    return ::Evaluate(cx, obj, optionsArg, srcBuf, nullptr);
-}
-
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, AutoObjectVector &scopeChain, const ReadOnlyCompileOptions &optionsArg,
-             SourceBufferHolder &srcBuf)
-{
-    return ::Evaluate(cx, scopeChain, optionsArg, srcBuf, nullptr);
-}
-
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-             const char16_t *chars, size_t length)
-{
-    return ::Evaluate(cx, obj, optionsArg, chars, length, nullptr);
-}
-
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
-             const char *bytes, size_t length)
-{
-    return ::Evaluate(cx, obj, options, bytes, length, nullptr);
-}
-
-extern JS_PUBLIC_API(bool)
-JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-             const char *filename)
-{
-    return ::Evaluate(cx, obj, optionsArg, filename, nullptr);
+    return ::Evaluate(cx, obj, optionsArg, filename, rval);
 }
 
 JS_PUBLIC_API(bool)
@@ -4932,7 +4890,7 @@ JS_EvaluateUCScript(JSContext *cx, HandleObject obj, const char16_t *chars, unsi
     CompileOptions options(cx);
     options.setFileAndLine(filename, lineno);
 
-    return ::Evaluate(cx, obj, options, chars, length, rval.address());
+    return ::Evaluate(cx, obj, options, chars, length, rval);
 }
 
 JS_PUBLIC_API(bool)
@@ -4942,7 +4900,7 @@ JS_EvaluateUCScript(JSContext *cx, HandleObject obj, SourceBufferHolder &srcBuf,
     CompileOptions options(cx);
     options.setFileAndLine(filename, lineno);
 
-    return ::Evaluate(cx, obj, options, srcBuf, rval.address());
+    return ::Evaluate(cx, obj, options, srcBuf, rval);
 }
 
 JS_PUBLIC_API(bool)
@@ -4952,7 +4910,7 @@ JS_EvaluateScript(JSContext *cx, HandleObject obj, const char *bytes, unsigned n
     CompileOptions options(cx);
     options.setFileAndLine(filename, lineno);
 
-    return ::Evaluate(cx, obj, options, bytes, nbytes, rval.address());
+    return JS::Evaluate(cx, obj, options, bytes, nbytes, rval);
 }
 
 JS_PUBLIC_API(bool)
@@ -4960,9 +4918,11 @@ JS_EvaluateScript(JSContext *cx, HandleObject obj, const char *bytes, unsigned n
                   const char *filename, unsigned lineno)
 {
     CompileOptions options(cx);
-    options.setFileAndLine(filename, lineno);
+    options.setFileAndLine(filename, lineno)
+           .setNoScriptRval(true);
 
-    return ::Evaluate(cx, obj, options, bytes, nbytes, nullptr);
+    RootedValue unused(cx);
+    return JS::Evaluate(cx, obj, options, bytes, nbytes, &unused);
 }
 
 JS_PUBLIC_API(bool)
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index f6a1a164ec00..c75e83bc9dba 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -4106,26 +4106,6 @@ extern JS_PUBLIC_API(bool)
 Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
          const char *filename, JS::MutableHandleValue rval);
 
-extern JS_PUBLIC_API(bool)
-Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         SourceBufferHolder &srcBuf);
-
-extern JS_PUBLIC_API(bool)
-Evaluate(JSContext *cx, AutoObjectVector &scopeChain,
-         const ReadOnlyCompileOptions &options, SourceBufferHolder &srcBuf);
-
-extern JS_PUBLIC_API(bool)
-Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         const char16_t *chars, size_t length);
-
-extern JS_PUBLIC_API(bool)
-Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         const char *bytes, size_t length);
-
-extern JS_PUBLIC_API(bool)
-Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         const char *filename);
-
 } /* namespace JS */
 
 extern JS_PUBLIC_API(bool)
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index ea53b5a5842a..090aa084eb72 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -860,8 +860,9 @@ LoadScript(JSContext *cx, unsigned argc, jsval *vp, bool scriptRelative)
             .setCompileAndGo(true)
             .setNoScriptRval(true);
         RootedScript script(cx);
+        RootedValue unused(cx);
         if ((compileOnly && !Compile(cx, thisobj, opts, filename.ptr(), &script)) ||
-            !Evaluate(cx, thisobj, opts, filename.ptr()))
+            !Evaluate(cx, thisobj, opts, filename.ptr(), &unused))
         {
             return false;
         }

From dcb78a0257a333e0b9e9a51dfbef6a10b6d121ca Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 18 Nov 2014 23:27:16 -0500
Subject: [PATCH 51/84] Bug 1100579 part 2.  Kill off JS_Evaluate(UC)Script. 
 r=waldo

---
 js/src/jsapi-tests/README                     |  2 +-
 js/src/jsapi-tests/testArrayBufferView.cpp    |  4 +-
 .../testFreshGlobalEvalRedefinition.cpp       |  4 +-
 js/src/jsapi-tests/testGCOutOfMemory.cpp      |  3 +-
 js/src/jsapi-tests/testJSEvaluateScript.cpp   |  7 +++-
 js/src/jsapi-tests/tests.cpp                  |  8 +++-
 js/src/jsapi.cpp                              | 42 -------------------
 js/src/jsapi.h                                | 36 ++++------------
 js/src/shell/js.cpp                           | 11 ++---
 js/xpconnect/src/XPCShellImpl.cpp             |  4 +-
 10 files changed, 38 insertions(+), 83 deletions(-)

diff --git a/js/src/jsapi-tests/README b/js/src/jsapi-tests/README
index 05575dba0804..e25174374359 100644
--- a/js/src/jsapi-tests/README
+++ b/js/src/jsapi-tests/README
@@ -72,7 +72,7 @@ tests.h:
 
     EXEC(const char *code);
 
-        Execute some JS code in global scope, using JS_EvaluateScript. Return
+        Execute some JS code in global scope, using JS::Evaluate. Return
         false if that fails. (This means that if the code throws an uncaught JS
         exception, the test fails.)
 
diff --git a/js/src/jsapi-tests/testArrayBufferView.cpp b/js/src/jsapi-tests/testArrayBufferView.cpp
index c0dd736dd512..0bfdf99921e9 100644
--- a/js/src/jsapi-tests/testArrayBufferView.cpp
+++ b/js/src/jsapi-tests/testArrayBufferView.cpp
@@ -93,7 +93,9 @@ CreateDataView(JSContext *cx)
     static const char code[] = "new DataView(new ArrayBuffer(8))";
 
     JS::Rooted<JS::Value> val(cx);
-    if (!JS_EvaluateScript(cx, global, code, strlen(code), __FILE__, __LINE__, &val))
+    JS::CompileOptions opts(cx);
+    if (!JS::Evaluate(cx, global, opts.setFileAndLine(__FILE__, __LINE__),
+                      code, strlen(code), &val))
         return nullptr;
 
     JS::Rooted<JSObject*> dv(cx, &val.toObject());
diff --git a/js/src/jsapi-tests/testFreshGlobalEvalRedefinition.cpp b/js/src/jsapi-tests/testFreshGlobalEvalRedefinition.cpp
index 6ced7401cf55..db8d98b06d33 100644
--- a/js/src/jsapi-tests/testFreshGlobalEvalRedefinition.cpp
+++ b/js/src/jsapi-tests/testFreshGlobalEvalRedefinition.cpp
@@ -41,7 +41,9 @@ BEGIN_TEST(testRedefineGlobalEval)
     CHECK(JS_GetProperty(cx, g, "Object", &v));
 
     static const char data[] = "Object.defineProperty(this, 'eval', { configurable: false });";
-    CHECK(JS_EvaluateScript(cx, g, data, mozilla::ArrayLength(data) - 1, __FILE__, __LINE__, &v));
+    JS::CompileOptions opts(cx);
+    CHECK(JS::Evaluate(cx, g, opts.setFileAndLine(__FILE__, __LINE__),
+                       data, mozilla::ArrayLength(data) - 1, &v));
 
     return true;
 }
diff --git a/js/src/jsapi-tests/testGCOutOfMemory.cpp b/js/src/jsapi-tests/testGCOutOfMemory.cpp
index a8f37b9c1a02..b65653660827 100644
--- a/js/src/jsapi-tests/testGCOutOfMemory.cpp
+++ b/js/src/jsapi-tests/testGCOutOfMemory.cpp
@@ -29,7 +29,8 @@ BEGIN_TEST(testGCOutOfMemory)
         "        array.push({});"
         "    array = []; array.push(0);"
         "})();";
-    bool ok = JS_EvaluateScript(cx, global, source, strlen(source), "", 1, &root);
+    JS::CompileOptions opts(cx);
+    bool ok = JS::Evaluate(cx, global, opts, source, strlen(source), &root);
 
     /* Check that we get OOM. */
     CHECK(!ok);
diff --git a/js/src/jsapi-tests/testJSEvaluateScript.cpp b/js/src/jsapi-tests/testJSEvaluateScript.cpp
index f25f48ff7ef6..c2040af2eb7e 100644
--- a/js/src/jsapi-tests/testJSEvaluateScript.cpp
+++ b/js/src/jsapi-tests/testJSEvaluateScript.cpp
@@ -14,7 +14,9 @@ BEGIN_TEST(testJSEvaluateScript)
     static const char src[] = "var x = 5;";
 
     JS::RootedValue retval(cx);
-    CHECK(JS_EvaluateScript(cx, obj, src, sizeof(src) - 1, __FILE__, __LINE__, &retval));
+    JS::CompileOptions opts(cx);
+    CHECK(JS::Evaluate(cx, obj, opts.setFileAndLine(__FILE__, __LINE__),
+                       src, sizeof(src) - 1, &retval));
 
     bool hasProp = true;
     CHECK(JS_AlreadyHasOwnProperty(cx, obj, "x", &hasProp));
@@ -29,7 +31,8 @@ BEGIN_TEST(testJSEvaluateScript)
 
     static const char src2[] = "var y = 5;";
 
-    CHECK(JS_EvaluateScript(cx, obj, src2, sizeof(src2) - 1, __FILE__, __LINE__, &retval));
+    CHECK(JS::Evaluate(cx, obj, opts.setFileAndLine(__FILE__, __LINE__),
+                       src2, sizeof(src2) - 1, &retval));
 
     hasProp = false;
     CHECK(JS_AlreadyHasOwnProperty(cx, obj, "y", &hasProp));
diff --git a/js/src/jsapi-tests/tests.cpp b/js/src/jsapi-tests/tests.cpp
index 0be730b81edf..b0da687a325c 100644
--- a/js/src/jsapi-tests/tests.cpp
+++ b/js/src/jsapi-tests/tests.cpp
@@ -54,7 +54,9 @@ bool JSAPITest::exec(const char *bytes, const char *filename, int lineno)
 {
     JS::RootedValue v(cx);
     JS::HandleObject global = JS::HandleObject::fromMarkedLocation(this->global.unsafeGet());
-    return JS_EvaluateScript(cx, global, bytes, strlen(bytes), filename, lineno, &v) ||
+    JS::CompileOptions opts(cx);
+    opts.setFileAndLine(filename, lineno);
+    return JS::Evaluate(cx, global, opts, bytes, strlen(bytes), &v) ||
         fail(JSAPITestString(bytes), filename, lineno);
 }
 
@@ -62,7 +64,9 @@ bool JSAPITest::evaluate(const char *bytes, const char *filename, int lineno,
                          JS::MutableHandleValue vp)
 {
     JS::HandleObject global = JS::HandleObject::fromMarkedLocation(this->global.unsafeGet());
-    return JS_EvaluateScript(cx, global, bytes, strlen(bytes), filename, lineno, vp) ||
+    JS::CompileOptions opts(cx);
+    opts.setFileAndLine(filename, lineno);
+    return JS::Evaluate(cx, global, opts, bytes, strlen(bytes), vp) ||
         fail(JSAPITestString(bytes), filename, lineno);
 }
 
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index e729b969d8d2..e1a8ea861784 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4883,48 +4883,6 @@ JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &opti
     return ::Evaluate(cx, obj, optionsArg, filename, rval);
 }
 
-JS_PUBLIC_API(bool)
-JS_EvaluateUCScript(JSContext *cx, HandleObject obj, const char16_t *chars, unsigned length,
-                    const char *filename, unsigned lineno, MutableHandleValue rval)
-{
-    CompileOptions options(cx);
-    options.setFileAndLine(filename, lineno);
-
-    return ::Evaluate(cx, obj, options, chars, length, rval);
-}
-
-JS_PUBLIC_API(bool)
-JS_EvaluateUCScript(JSContext *cx, HandleObject obj, SourceBufferHolder &srcBuf,
-                    const char *filename, unsigned lineno, MutableHandleValue rval)
-{
-    CompileOptions options(cx);
-    options.setFileAndLine(filename, lineno);
-
-    return ::Evaluate(cx, obj, options, srcBuf, rval);
-}
-
-JS_PUBLIC_API(bool)
-JS_EvaluateScript(JSContext *cx, HandleObject obj, const char *bytes, unsigned nbytes,
-                  const char *filename, unsigned lineno, MutableHandleValue rval)
-{
-    CompileOptions options(cx);
-    options.setFileAndLine(filename, lineno);
-
-    return JS::Evaluate(cx, obj, options, bytes, nbytes, rval);
-}
-
-JS_PUBLIC_API(bool)
-JS_EvaluateScript(JSContext *cx, HandleObject obj, const char *bytes, unsigned nbytes,
-                  const char *filename, unsigned lineno)
-{
-    CompileOptions options(cx);
-    options.setFileAndLine(filename, lineno)
-           .setNoScriptRval(true);
-
-    RootedValue unused(cx);
-    return JS::Evaluate(cx, obj, options, bytes, nbytes, &unused);
-}
-
 JS_PUBLIC_API(bool)
 JS_CallFunction(JSContext *cx, HandleObject obj, HandleFunction fun, const HandleValueArray& args,
                 MutableHandleValue rval)
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index c75e83bc9dba..d7e6baea8379 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -4006,7 +4006,7 @@ extern JS_PUBLIC_API(JSString *)
 JS_DecompileFunctionBody(JSContext *cx, JS::Handle<JSFunction*> fun, unsigned indent);
 
 /*
- * NB: JS_ExecuteScript and the JS_Evaluate*Script* quadruplets use the obj
+ * NB: JS_ExecuteScript and the JS::Evaluate APIs use the obj
  * parameter as the initial scope chain header, the 'this' keyword value, and
  * the variables object (ECMA parlance for where 'var' and 'function' bind
  * names) of the execution context for script.
@@ -4026,17 +4026,16 @@ JS_DecompileFunctionBody(JSContext *cx, JS::Handle<JSFunction*> fun, unsigned in
  * non-ECMA explicit vs. implicit variable creation.
  *
  * Caveat embedders: unless you already depend on this buggy variables object
- * binding behavior, you should call ContextOptionsRef(cx).setVarObjFix(true)
+ * binding behavior, you should call RuntimeOptionsRef(rt).setVarObjFix(true)
  * for each context in the application, if you pass parented objects as the obj
  * parameter, or may ever pass such objects in the future.
  *
- * Why a runtime option?  The alternative is to add six or so new API entry
- * points with signatures matching the following six, and that doesn't seem
- * worth the code bloat cost.  Such new entry points would probably have less
- * obvious names, too, so would not tend to be used.  The JS_SetOption call,
- * OTOH, can be more easily hacked into existing code that does not depend on
- * the bug; such code can continue to use the familiar JS_EvaluateScript,
- * etc., entry points.
+ * Why a runtime option?  The alternative is to add APIs duplicating those below
+ * for the other value of varobjfix, and that doesn't seem worth the code bloat
+ * cost.  Such new entry points would probably have less obvious names, too, so
+ * would not tend to be used.  The RuntimeOptionsRef adjustment, OTOH, can be
+ * more easily hacked into existing code that does not depend on the bug; such
+ * code can continue to use the familiar JS::Evaluate, etc., entry points.
  */
 extern JS_PUBLIC_API(bool)
 JS_ExecuteScript(JSContext *cx, JS::HandleObject obj, JS::HandleScript script, JS::MutableHandleValue rval);
@@ -4067,23 +4066,6 @@ CloneAndExecuteScript(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<JSScr
 
 } /* namespace JS */
 
-extern JS_PUBLIC_API(bool)
-JS_EvaluateScript(JSContext *cx, JS::HandleObject obj,
-                  const char *bytes, unsigned length,
-                  const char *filename, unsigned lineno,
-                  JS::MutableHandleValue rval);
-
-extern JS_PUBLIC_API(bool)
-JS_EvaluateScript(JSContext *cx, JS::HandleObject obj,
-                  const char *bytes, unsigned length,
-                  const char *filename, unsigned lineno);
-
-extern JS_PUBLIC_API(bool)
-JS_EvaluateUCScript(JSContext *cx, JS::Handle<JSObject*> obj,
-                    const char16_t *chars, unsigned length,
-                    const char *filename, unsigned lineno,
-                    JS::MutableHandle<JS::Value> rval);
-
 namespace JS {
 
 extern JS_PUBLIC_API(bool)
@@ -4959,7 +4941,7 @@ namespace JS {
  *
  * Typical usage:
  *
- *     bool ok = JS_EvaluateScript(cx, ...);
+ *     bool ok = JS::Evaluate(cx, ...);
  *     AutoSaveExceptionState savedExc(cx);
  *     ... cleanup that might re-enter JS ...
  *     return ok;
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 090aa084eb72..6d953c09f385 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -2625,10 +2625,9 @@ EvalInContext(JSContext *cx, unsigned argc, jsval *vp)
             JS_ReportError(cx, "Invalid scope argument to evalcx");
             return false;
         }
-        if (!JS_EvaluateUCScript(cx, sobj, src, srclen,
-                                 filename.get(),
-                                 lineno,
-                                 args.rval())) {
+        JS::CompileOptions opts(cx);
+        opts.setFileAndLine(filename.get(), lineno);
+        if (!JS::Evaluate(cx, sobj, opts, src, srclen, args.rval())) {
             return false;
         }
     }
@@ -5404,7 +5403,9 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
         } else {
             const char *code = codeChunks.front();
             RootedValue rval(cx);
-            if (!JS_EvaluateScript(cx, obj, code, strlen(code), "-e", 1, &rval))
+            JS::CompileOptions opts(cx);
+            opts.setFileAndLine("-e", 1);
+            if (!JS::Evaluate(cx, obj, opts, code, strlen(code), &rval))
                 return gExitCode ? gExitCode : EXITCODE_RUNTIME_ERROR;
             codeChunks.popFront();
         }
diff --git a/js/xpconnect/src/XPCShellImpl.cpp b/js/xpconnect/src/XPCShellImpl.cpp
index 3b38167398e8..9990b9e50b4e 100644
--- a/js/xpconnect/src/XPCShellImpl.cpp
+++ b/js/xpconnect/src/XPCShellImpl.cpp
@@ -1066,7 +1066,9 @@ ProcessArgs(JSContext *cx, JS::Handle<JSObject*> obj, char **argv, int argc, XPC
                 return usage();
             }
 
-            JS_EvaluateScript(cx, obj, argv[i], strlen(argv[i]), "-e", 1, &rval);
+            JS::CompileOptions opts(cx);
+            opts.setFileAndLine("-e", 1);
+            JS::Evaluate(cx, obj, opts, argv[i], strlen(argv[i]), &rval);
 
             isInteractive = false;
             break;

From d29b938e70f38b2c74d8cfd1fd17311785fe774f Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Wed, 19 Nov 2014 13:45:07 +0900
Subject: [PATCH 52/84] Bug 1099956 - Parse regular expression after yield
 correctly. r=Waldo

---
 js/src/frontend/Parser.cpp                    |  6 ++-
 js/src/frontend/Parser.h                      |  3 ++
 .../jit-test/tests/generators/yield-regexp.js | 41 +++++++++++++++++++
 .../ecma_6/Generators/yield-non-regexp.js     | 16 ++++++++
 4 files changed, 64 insertions(+), 2 deletions(-)
 create mode 100644 js/src/jit-test/tests/generators/yield-regexp.js
 create mode 100644 js/src/tests/ecma_6/Generators/yield-non-regexp.js

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 32bbc6dba4a3..80168dbe9e8a 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -5812,7 +5812,9 @@ Parser<ParseHandler>::statement(bool canHaveDirectives)
 
       case TOK_YIELD: {
         TokenKind next;
-        if (!tokenStream.peekToken(&next))
+        TokenStream::Modifier modifier = yieldExpressionsSupported() ? TokenStream::Operand
+                                                                     : TokenStream::None;
+        if (!tokenStream.peekToken(&next, modifier))
             return null();
         if (next == TOK_COLON) {
             if (!checkYieldNameValidity())
@@ -6171,7 +6173,7 @@ Parser<ParseHandler>::assignExpr()
             return stringLiteral();
     }
 
-    if (tt == TOK_YIELD && (versionNumber() >= JSVERSION_1_7 || pc->isGenerator()))
+    if (tt == TOK_YIELD && yieldExpressionsSupported())
         return yieldExpression();
 
     tokenStream.ungetToken();
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index eb0a37356fa4..94721af6e65a 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -506,6 +506,9 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
     // whether it's prohibited due to strictness, JS version, or occurrence
     // inside a star generator.
     bool checkYieldNameValidity();
+    bool yieldExpressionsSupported() {
+        return versionNumber() >= JSVERSION_1_7 || pc->isGenerator();
+    }
 
     virtual bool strictMode() { return pc->sc->strict; }
 
diff --git a/js/src/jit-test/tests/generators/yield-regexp.js b/js/src/jit-test/tests/generators/yield-regexp.js
new file mode 100644
index 000000000000..bcef03af0abf
--- /dev/null
+++ b/js/src/jit-test/tests/generators/yield-regexp.js
@@ -0,0 +1,41 @@
+// Bug 1099956
+
+load(libdir + "asserts.js");
+
+// ES6 treating yield as an identifier except in ES6 generators introduces a
+// syntax conflict with permissible JS >= 1.7 legacy generator syntax.  Is
+// |yield /a/g| inside a function an attempt to convert the function into a
+// legacy generator, yielding a RegExp instance?  Or does it instead read as
+// |(yield / a) / g|?  Similar ambiguities exist for different textual content
+// in place of |a| -- |yield /x+17/g| or |(yield / x) + 17 / g|, and so on.
+// (And, much less importantly, is |yield /a/g| a syntax error in global code
+// as in JS >= 1.7, or is it |(yield / a) / g|.)
+//
+// For now, in JS >= 1.7, we preserve the old behavior.  In all other JS we
+// conform to ES6: |yield /a/g| is a YieldExpression inside an ES6 generator,
+// and it's an IdentifierReference divided twice when not in an ES6 generator.
+// This test will need changes if we change our JS >= 1.7 parsing to be
+// ES6-compatible.
+
+function f1() {
+  yield /abc/g;
+}
+
+var g = f1();
+var v;
+v = g.next();
+assertEq(v instanceof RegExp, true);
+assertEq(v.toString(), "/abc/g");
+assertThrowsValue(() => g.next(), StopIteration);
+
+function* f2() {
+  yield /abc/g;
+}
+
+g = f2();
+v = g.next();
+assertEq(v.done, false);
+assertEq(v.value instanceof RegExp, true);
+assertEq(v.value.toString(), "/abc/g");
+v = g.next();
+assertEq(v.done, true);
diff --git a/js/src/tests/ecma_6/Generators/yield-non-regexp.js b/js/src/tests/ecma_6/Generators/yield-non-regexp.js
new file mode 100644
index 000000000000..d9fbcd3598a7
--- /dev/null
+++ b/js/src/tests/ecma_6/Generators/yield-non-regexp.js
@@ -0,0 +1,16 @@
+var BUGNUMBER = 1099956;
+var summary =
+  "The token next to yield should be tokenized as non-operand if yield is " +
+  "a valid name";
+
+printBugNumber(BUGNUMBER);
+printStatus(summary);
+
+var yield = 12, a = 3, b = 6, g = 2;
+var yieldParsedAsIdentifier = false;
+
+yield /a; yieldParsedAsIdentifier = true; b/g;
+
+assertEq(yieldParsedAsIdentifier, true);
+
+reportCompare(true, true);

From 64e5bce38a91160e51a1be065e80c02e7e6ddb8f Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Thu, 13 Nov 2014 18:20:38 -0800
Subject: [PATCH 53/84] Bug 1083285 - Fix noisy IndexedDB error, replace with
 better warning. r=khuey.

---
 dom/indexedDB/ActorsChild.cpp               |  13 ++-
 dom/indexedDB/IDBDatabase.cpp               | 100 ++++++++++++++++++--
 dom/indexedDB/IDBDatabase.h                 |   7 +-
 dom/indexedDB/IDBFactory.cpp                |  20 +++-
 dom/indexedDB/IDBFactory.h                  |  13 +++
 dom/indexedDB/IDBRequest.cpp                |  50 +++++-----
 dom/indexedDB/IDBRequest.h                  |   8 +-
 dom/indexedDB/IDBTransaction.cpp            |  16 ++++
 dom/indexedDB/IDBTransaction.h              |   8 ++
 dom/indexedDB/IndexedDatabaseManager.cpp    |   2 +-
 dom/locales/en-US/chrome/dom/dom.properties |   2 +
 11 files changed, 194 insertions(+), 45 deletions(-)

diff --git a/dom/indexedDB/ActorsChild.cpp b/dom/indexedDB/ActorsChild.cpp
index 221026679035..5fd0c120e9e3 100644
--- a/dom/indexedDB/ActorsChild.cpp
+++ b/dom/indexedDB/ActorsChild.cpp
@@ -1240,8 +1240,14 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   auto actor = static_cast<BackgroundVersionChangeTransactionChild*>(aActor);
 
+  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
+  MOZ_ASSERT(request);
+
   nsRefPtr<IDBTransaction> transaction =
-    IDBTransaction::CreateVersionChange(mDatabase, actor, aNextObjectStoreId,
+    IDBTransaction::CreateVersionChange(mDatabase,
+                                        actor,
+                                        request,
+                                        aNextObjectStoreId,
                                         aNextIndexId);
   if (NS_WARN_IF(!transaction)) {
     return false;
@@ -1253,9 +1259,6 @@ BackgroundDatabaseChild::RecvPBackgroundIDBVersionChangeTransactionConstructor(
 
   mDatabase->EnterSetVersionTransaction(aRequestedVersion);
 
-  nsRefPtr<IDBOpenDBRequest> request = mOpenRequestActor->GetOpenDBRequest();
-  MOZ_ASSERT(request);
-
   request->SetTransaction(transaction);
 
   nsCOMPtr<nsIDOMEvent> upgradeNeededEvent =
@@ -1316,7 +1319,7 @@ BackgroundDatabaseChild::RecvVersionChange(const uint64_t& aOldVersion,
     if (shouldAbortAndClose) {
       // Invalidate() doesn't close the database in the parent, so we have
       // to call Close() and AbortTransactions() manually.
-      mDatabase->AbortTransactions();
+      mDatabase->AbortTransactions(/* aShouldWarn */ false);
       mDatabase->Close();
       return true;
     }
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 3826265d93ff..8dae654bfa01 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -39,9 +39,12 @@
 #include "mozilla/ipc/InputStreamParams.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "nsCOMPtr.h"
+#include "nsContentUtils.h"
+#include "nsIConsoleService.h"
 #include "nsIDocument.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
+#include "nsIScriptError.h"
 #include "nsISupportsPrimitives.h"
 #include "nsThreadUtils.h"
 #include "ProfilerHelpers.h"
@@ -314,7 +317,7 @@ IDBDatabase::InvalidateInternal()
   AssertIsOnOwningThread();
 
   InvalidateMutableFiles();
-  AbortTransactions();
+  AbortTransactions(/* aShouldWarn */ true);
 
   CloseInternal();
 }
@@ -751,7 +754,7 @@ IDBDatabase::UnregisterTransaction(IDBTransaction* aTransaction)
 }
 
 void
-IDBDatabase::AbortTransactions()
+IDBDatabase::AbortTransactions(bool aShouldWarn)
 {
   AssertIsOnOwningThread();
 
@@ -759,27 +762,31 @@ IDBDatabase::AbortTransactions()
   {
   public:
     static void
-    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable)
+    AbortTransactions(nsTHashtable<nsPtrHashKey<IDBTransaction>>& aTable,
+                      nsTArray<nsRefPtr<IDBTransaction>>& aAbortedTransactions)
     {
       const uint32_t count = aTable.Count();
       if (!count) {
         return;
       }
 
-      nsTArray<nsRefPtr<IDBTransaction>> transactions;
+      nsAutoTArray<nsRefPtr<IDBTransaction>, 20> transactions;
       transactions.SetCapacity(count);
 
       aTable.EnumerateEntries(Collect, &transactions);
 
       MOZ_ASSERT(transactions.Length() == count);
 
-      IDB_REPORT_INTERNAL_ERR();
-
       for (uint32_t index = 0; index < count; index++) {
-        nsRefPtr<IDBTransaction> transaction = transactions[index].forget();
+        nsRefPtr<IDBTransaction> transaction = Move(transactions[index]);
         MOZ_ASSERT(transaction);
 
         transaction->Abort(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
+
+        // We only care about warning for write transactions.
+        if (transaction->GetMode() != IDBTransaction::READ_ONLY) {
+          aAbortedTransactions.AppendElement(Move(transaction));
+        }
       }
     }
 
@@ -798,7 +805,25 @@ IDBDatabase::AbortTransactions()
     }
   };
 
-  Helper::AbortTransactions(mTransactions);
+  nsAutoTArray<nsRefPtr<IDBTransaction>, 5> abortedTransactions;
+  Helper::AbortTransactions(mTransactions, abortedTransactions);
+
+  if (aShouldWarn && !abortedTransactions.IsEmpty()) {
+    static const char kWarningMessage[] = "IndexedDBTransactionAbortNavigation";
+
+    for (uint32_t count = abortedTransactions.Length(), index = 0;
+         index < count;
+         index++) {
+      nsRefPtr<IDBTransaction>& transaction = abortedTransactions[index];
+      MOZ_ASSERT(transaction);
+
+      nsString filename;
+      uint32_t lineNo;
+      transaction->GetCallerLocation(filename, &lineNo);
+
+      LogWarning(kWarningMessage, filename, lineNo);
+    }
+  }
 }
 
 PBackgroundIDBDatabaseFileChild*
@@ -1155,6 +1180,65 @@ IDBDatabase::Invalidate()
   }
 }
 
+void
+IDBDatabase::LogWarning(const char* aMessageName,
+                        const nsAString& aFilename,
+                        uint32_t aLineNumber)
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aMessageName);
+
+  // For now this is main-thread only.
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsXPIDLString localizedMessage;
+  if (NS_WARN_IF(NS_FAILED(
+    nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
+                                       aMessageName,
+                                       localizedMessage)))) {
+    return;
+  }
+
+  nsAutoCString category;
+  if (mFactory->IsChrome()) {
+    category.AssignLiteral("chrome ");
+  } else {
+    category.AssignLiteral("content ");
+  }
+  category.AppendLiteral("javascript");
+
+  nsCOMPtr<nsIConsoleService> consoleService =
+    do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+  MOZ_ASSERT(consoleService);
+
+  nsCOMPtr<nsIScriptError> scriptError =
+    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
+  MOZ_ASSERT(consoleService);
+
+  if (mFactory->GetParentObject()) {
+    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
+      scriptError->InitWithWindowID(localizedMessage,
+                                    aFilename,
+                                    /* aSourceLine */ EmptyString(),
+                                    aLineNumber,
+                                    /* aColumnNumber */ 0,
+                                    nsIScriptError::warningFlag,
+                                    category,
+                                    mFactory->InnerWindowID())));
+  } else {
+    MOZ_ALWAYS_TRUE(NS_SUCCEEDED(
+      scriptError->Init(localizedMessage,
+                        aFilename,
+                        /* aSourceLine */ EmptyString(),
+                        aLineNumber,
+                        /* aColumnNumber */ 0,
+                        nsIScriptError::warningFlag,
+                        category.get())));
+  }
+
+  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(consoleService->LogMessage(scriptError)));
+}
+
 NS_IMPL_ADDREF_INHERITED(IDBDatabase, IDBWrapperCache)
 NS_IMPL_RELEASE_INHERITED(IDBDatabase, IDBWrapperCache)
 
diff --git a/dom/indexedDB/IDBDatabase.h b/dom/indexedDB/IDBDatabase.h
index 811b7f2b8729..63f3ea727dcf 100644
--- a/dom/indexedDB/IDBDatabase.h
+++ b/dom/indexedDB/IDBDatabase.h
@@ -171,7 +171,7 @@ public:
   UnregisterTransaction(IDBTransaction* aTransaction);
 
   void
-  AbortTransactions();
+  AbortTransactions(bool aShouldWarn);
 
   PBackgroundIDBDatabaseFileChild*
   GetOrCreateFileActorForBlob(File* aBlob);
@@ -299,6 +299,11 @@ private:
 
   void
   InvalidateMutableFiles();
+
+  void
+  LogWarning(const char* aMessageName,
+             const nsAString& aFilename,
+             uint32_t aLineNumber);
 };
 
 } // namespace indexedDB
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index bf22ab5f3b70..bdab53dbed8d 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -29,7 +29,7 @@
 #include "ActorsChild.h"
 
 #ifdef DEBUG
-#include "nsContentUtils.h" // For IsCallerChrome assertions.
+#include "nsContentUtils.h" // For assertions.
 #endif
 
 namespace mozilla {
@@ -110,6 +110,7 @@ struct IDBFactory::PendingRequestInfo
 IDBFactory::IDBFactory()
   : mOwningObject(nullptr)
   , mBackgroundActor(nullptr)
+  , mInnerWindowID(0)
   , mBackgroundActorFailed(false)
   , mPrivateBrowsingMode(false)
 {
@@ -183,6 +184,7 @@ IDBFactory::CreateForWindow(nsPIDOMWindow* aWindow,
   factory->mPrincipalInfo = Move(principalInfo);
   factory->mWindow = aWindow;
   factory->mTabChild = TabChild::GetFrom(aWindow);
+  factory->mInnerWindowID = aWindow->WindowID();
   factory->mPrivateBrowsingMode = privateBrowsingMode;
 
   factory.forget(aFactory);
@@ -285,6 +287,15 @@ IDBFactory::AssertIsOnOwningThread() const
 
 #endif // DEBUG
 
+bool
+IDBFactory::IsChrome() const
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(mPrincipalInfo);
+
+  return mPrincipalInfo->type() == PrincipalInfo::TSystemPrincipalInfo;
+}
+
 void
 IDBFactory::SetBackgroundActor(BackgroundFactoryChild* aBackgroundActor)
 {
@@ -524,19 +535,20 @@ IDBFactory::OpenInternal(nsIPrincipal* aPrincipal,
   nsRefPtr<IDBOpenDBRequest> request;
 
   if (mWindow) {
-    if (NS_WARN_IF(!autoJS.Init(mWindow))) {
+    AutoJSContext cx;
+    if (NS_WARN_IF(!autoJS.Init(mWindow, cx))) {
       IDB_REPORT_INTERNAL_ERR();
       aRv.Throw(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
       return nullptr;
     }
 
-    JS::Rooted<JSObject*> scriptOwner(autoJS.cx(),
+    JS::Rooted<JSObject*> scriptOwner(cx,
       static_cast<nsGlobalWindow*>(mWindow.get())->FastGetGlobalJSObject());
     MOZ_ASSERT(scriptOwner);
 
     request = IDBOpenDBRequest::CreateForWindow(this, mWindow, scriptOwner);
   } else {
-    autoJS.Init();
+    autoJS.Init(mOwningObject.get());
     JS::Rooted<JSObject*> scriptOwner(autoJS.cx(), mOwningObject);
 
     request = IDBOpenDBRequest::CreateForJS(this, scriptOwner);
diff --git a/dom/indexedDB/IDBFactory.h b/dom/indexedDB/IDBFactory.h
index 69952a4158da..b88d055195bd 100644
--- a/dom/indexedDB/IDBFactory.h
+++ b/dom/indexedDB/IDBFactory.h
@@ -73,6 +73,8 @@ class IDBFactory MOZ_FINAL
   PRThread* mOwningThread;
 #endif
 
+  uint64_t mInnerWindowID;
+
   bool mBackgroundActorFailed;
   bool mPrivateBrowsingMode;
 
@@ -130,6 +132,17 @@ public:
     return mPrincipalInfo;
   }
 
+  uint64_t
+  InnerWindowID() const
+  {
+    AssertIsOnOwningThread();
+
+    return mInnerWindowID;
+  }
+
+  bool
+  IsChrome() const;
+
   already_AddRefed<IDBOpenDBRequest>
   Open(const nsAString& aName,
        uint64_t aVersion,
diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
index 2f360ab995cd..388e8046131a 100644
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@@ -99,12 +99,11 @@ IDBRequest::Create(IDBDatabase* aDatabase,
   aDatabase->AssertIsOnOwningThread();
 
   nsRefPtr<IDBRequest> request = new IDBRequest(aDatabase);
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->mTransaction = aTransaction;
   request->SetScriptOwner(aDatabase->GetScriptOwner());
 
-  request->CaptureCaller();
-
   return request.forget();
 }
 
@@ -140,6 +139,26 @@ IDBRequest::Create(IDBIndex* aSourceAsIndex,
   return request.forget();
 }
 
+// static
+void
+IDBRequest::CaptureCaller(nsAString& aFilename, uint32_t* aLineNo)
+{
+  MOZ_ASSERT(aFilename.IsEmpty());
+  MOZ_ASSERT(aLineNo);
+
+  ThreadsafeAutoJSContext cx;
+
+  const char* filename = nullptr;
+  uint32_t lineNo = 0;
+  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
+    *aLineNo = 0;
+    return;
+  }
+
+  aFilename.Assign(NS_ConvertUTF8toUTF16(filename));
+  *aLineNo = lineNo;
+}
+
 void
 IDBRequest::GetSource(
              Nullable<OwningIDBObjectStoreOrIDBIndexOrIDBCursor>& aSource) const
@@ -227,25 +246,13 @@ IDBRequest::GetErrorCode() const
 #endif // DEBUG
 
 void
-IDBRequest::CaptureCaller()
+IDBRequest::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
 {
-  AutoJSContext cx;
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aLineNo);
 
-  const char* filename = nullptr;
-  uint32_t lineNo = 0;
-  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
-    return;
-  }
-
-  mFilename.Assign(NS_ConvertUTF8toUTF16(filename));
-  mLineNo = lineNo;
-}
-
-void
-IDBRequest::FillScriptErrorEvent(ErrorEventInit& aEventInit) const
-{
-  aEventInit.mLineno = mLineNo;
-  aEventInit.mFilename = mFilename;
+  aFilename = mFilename;
+  *aLineNo = mLineNo;
 }
 
 IDBRequestReadyState
@@ -301,7 +308,6 @@ IDBRequest::SetResultCallback(ResultCallback* aCallback)
 
   // See if our window is still valid.
   if (NS_WARN_IF(NS_FAILED(CheckInnerWindowCorrectness()))) {
-    IDB_REPORT_INTERNAL_ERR();
     SetError(NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
     return;
   }
@@ -424,7 +430,7 @@ IDBOpenDBRequest::CreateForWindow(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, aOwner);
-  request->CaptureCaller();
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->SetScriptOwner(aScriptOwner);
 
@@ -441,7 +447,7 @@ IDBOpenDBRequest::CreateForJS(IDBFactory* aFactory,
   MOZ_ASSERT(aScriptOwner);
 
   nsRefPtr<IDBOpenDBRequest> request = new IDBOpenDBRequest(aFactory, nullptr);
-  request->CaptureCaller();
+  CaptureCaller(request->mFilename, &request->mLineNo);
 
   request->SetScriptOwner(aScriptOwner);
 
diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
index eda2d4e41cf9..170dc0e25624 100644
--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@@ -81,6 +81,9 @@ public:
          IDBDatabase* aDatabase,
          IDBTransaction* aTransaction);
 
+  static void
+  CaptureCaller(nsAString& aFilename, uint32_t* aLineNo);
+
   // nsIDOMEventTarget
   virtual nsresult
   PreHandleEvent(EventChainPreVisitor& aVisitor) MOZ_OVERRIDE;
@@ -114,7 +117,7 @@ public:
   GetError(ErrorResult& aRv);
 
   void
-  FillScriptErrorEvent(ErrorEventInit& aEventInit) const;
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
 
   bool
   IsPending() const
@@ -189,9 +192,6 @@ protected:
 
   void
   ConstructResult();
-
-  void
-  CaptureCaller();
 };
 
 class NS_NO_VTABLE IDBRequest::ResultCallback
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index b210e7bda2f6..a914dc1b2f86 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -48,6 +48,7 @@ IDBTransaction::IDBTransaction(IDBDatabase* aDatabase,
   , mNextIndexId(0)
   , mAbortCode(NS_OK)
   , mPendingRequestCount(0)
+  , mLineNo(0)
   , mReadyState(IDBTransaction::INITIAL)
   , mMode(aMode)
   , mCreating(false)
@@ -127,12 +128,14 @@ already_AddRefed<IDBTransaction>
 IDBTransaction::CreateVersionChange(
                                 IDBDatabase* aDatabase,
                                 BackgroundVersionChangeTransactionChild* aActor,
+                                IDBOpenDBRequest* aOpenRequest,
                                 int64_t aNextObjectStoreId,
                                 int64_t aNextIndexId)
 {
   MOZ_ASSERT(aDatabase);
   aDatabase->AssertIsOnOwningThread();
   MOZ_ASSERT(aActor);
+  MOZ_ASSERT(aOpenRequest);
   MOZ_ASSERT(aNextObjectStoreId > 0);
   MOZ_ASSERT(aNextIndexId > 0);
 
@@ -140,6 +143,8 @@ IDBTransaction::CreateVersionChange(
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, emptyObjectStoreNames, VERSION_CHANGE);
+  aOpenRequest->GetCallerLocation(transaction->mFilename,
+                                  &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
   transaction->mBackgroundActor.mVersionChangeBackgroundActor = aActor;
@@ -175,6 +180,7 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
 
   nsRefPtr<IDBTransaction> transaction =
     new IDBTransaction(aDatabase, aObjectStoreNames, aMode);
+  IDBRequest::CaptureCaller(transaction->mFilename, &transaction->mLineNo);
 
   transaction->SetScriptOwner(aDatabase->GetScriptOwner());
 
@@ -391,6 +397,16 @@ IDBTransaction::IsOpen() const
   return false;
 }
 
+void
+IDBTransaction::GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const
+{
+  AssertIsOnOwningThread();
+  MOZ_ASSERT(aLineNo);
+
+  aFilename = mFilename;
+  *aLineNo = mLineNo;
+}
+
 already_AddRefed<IDBObjectStore>
 IDBTransaction::CreateObjectStore(const ObjectStoreSpec& aSpec)
 {
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index 2624afaff78a..476489b12ec0 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -37,6 +37,7 @@ class BackgroundTransactionChild;
 class BackgroundVersionChangeTransactionChild;
 class IDBDatabase;
 class IDBObjectStore;
+class IDBOpenDBRequest;
 class IDBRequest;
 class IndexMetadata;
 class ObjectStoreSpec;
@@ -94,6 +95,9 @@ private:
   nsresult mAbortCode;
   uint32_t mPendingRequestCount;
 
+  nsString mFilename;
+  uint32_t mLineNo;
+
   ReadyState mReadyState;
   Mode mMode;
 
@@ -109,6 +113,7 @@ public:
   static already_AddRefed<IDBTransaction>
   CreateVersionChange(IDBDatabase* aDatabase,
                       BackgroundVersionChangeTransactionChild* aActor,
+                      IDBOpenDBRequest* aOpenRequest,
                       int64_t aNextObjectStoreId,
                       int64_t aNextIndexId);
 
@@ -184,6 +189,9 @@ public:
     return NS_FAILED(mAbortCode);
   }
 
+  void
+  GetCallerLocation(nsAString& aFilename, uint32_t* aLineNo) const;
+
   // 'Get' prefix is to avoid name collisions with the enum
   Mode
   GetMode() const
diff --git a/dom/indexedDB/IndexedDatabaseManager.cpp b/dom/indexedDB/IndexedDatabaseManager.cpp
index 13f969b5e64c..0e72c817df50 100644
--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@@ -366,7 +366,7 @@ IndexedDatabaseManager::FireWindowOnError(nsPIDOMWindow* aOwner,
 
   ThreadsafeAutoJSContext cx;
   RootedDictionary<ErrorEventInit> init(cx);
-  request->FillScriptErrorEvent(init);
+  request->GetCallerLocation(init.mFilename, &init.mLineno);
 
   init.mMessage = errorName;
   init.mCancelable = true;
diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties
index 357a52e06c9c..9c68b3392b80 100644
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -209,3 +209,5 @@ KeyNameZoomWarning=KeyboardEvent.key value "Zoom" is obsolete and will be rename
 KeyNameDeadKeysWarning=KeyboardEvent.key values starting with "Dead" are obsolete and will be merged into just "Dead". For more help https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.key
 ImportXULIntoContentWarning=Importing XUL nodes into a content document is deprecated. This functionality may be removed soon.
 XMLDocumentLoadPrincipalMismatch=Use of document.load forbidden on Documents that come from other Windows. Only the Window in which a Document was created is allowed to call .load on that Document. Preferably, use XMLHttpRequest instead.
+# LOCALIZATION NOTE: Do not translate "IndexedDB".
+IndexedDBTransactionAbortNavigation=An IndexedDB transaction that was not yet complete has been aborted due to page navigation.
\ No newline at end of file

From e4e05ee727b370b9aaa556ba4abc8220116ff55b Mon Sep 17 00:00:00 2001
From: Jim Blandy <jimb@mozilla.com>
Date: Tue, 18 Nov 2014 20:50:57 -0800
Subject: [PATCH 54/84] Bug 1087549: Give IonScript::refcount_ and associated
 functions better names. r=jandem

This patch renames:

  - IonScript::refcount_ to invalidationCount_
  - IonScript::refcount to invalidationCount
  - IonScript::incref to incrementInvalidationCount
  - IonScript::decref to decrementInvalidationCount
  - IonScript::offsetOfRefcount to offsetOfInvalidationCount
---
 js/src/jit/Bailouts.cpp      |  4 ++--
 js/src/jit/CodeGenerator.cpp |  4 ++--
 js/src/jit/Ion.cpp           | 12 ++++++------
 js/src/jit/IonCode.h         | 24 ++++++++++++------------
 js/src/jit/IonFrames.cpp     |  4 ++--
 5 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index 6476ce8b2728..5893f889dad8 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -87,7 +87,7 @@ jit::Bailout(BailoutStack *sp, BaselineBailoutInfo **bailoutInfo)
     // increment the reference counter for each activation that appear on the
     // stack. As the bailed frame is one of them, we have to decrement it now.
     if (iter.ionScript()->invalidated())
-        iter.ionScript()->decref(cx->runtime()->defaultFreeOp());
+        iter.ionScript()->decrementInvalidationCount(cx->runtime()->defaultFreeOp());
 
     return retval;
 }
@@ -159,7 +159,7 @@ jit::InvalidationBailout(InvalidationBailoutStack *sp, size_t *frameSizeOut,
         JitSpew(JitSpew_IonInvalidate, "   new  ra %p", (void *) frame->returnAddress());
     }
 
-    iter.ionScript()->decref(cx->runtime()->defaultFreeOp());
+    iter.ionScript()->decrementInvalidationCount(cx->runtime()->defaultFreeOp());
 
     return retval;
 }
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 6f3cd1e3b4e3..5dd4f9df01af 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -3899,9 +3899,9 @@ CodeGenerator::branchIfInvalidated(Register temp, Label *invalidated)
     if (!ionScriptLabels_.append(label))
         return false;
 
-    // If IonScript::refcount != 0, the script has been invalidated.
+    // If IonScript::invalidationCount_ != 0, the script has been invalidated.
     masm.branch32(Assembler::NotEqual,
-                  Address(temp, IonScript::offsetOfRefcount()),
+                  Address(temp, IonScript::offsetOfInvalidationCount()),
                   Imm32(0),
                   invalidated);
     return true;
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 0bd597700a16..502c6e8bc06e 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -839,7 +839,7 @@ IonScript::IonScript()
     callTargetEntries_(0),
     backedgeList_(0),
     backedgeEntries_(0),
-    refcount_(0),
+    invalidationCount_(0),
     parallelAge_(0),
     recompileInfo_(),
     osrPcMismatchCounter_(0),
@@ -2677,7 +2677,7 @@ InvalidateActivation(FreeOp *fop, const JitActivationIterator &activations, bool
         // instructions after the call) in to capture an appropriate
         // snapshot after the call occurs.
 
-        ionScript->incref();
+        ionScript->incrementInvalidationCount();
 
         JitCode *ionCode = ionScript->method();
 
@@ -2711,8 +2711,8 @@ InvalidateActivation(FreeOp *fop, const JitActivationIterator &activations, bool
         CodeLocationLabel osiPatchPoint = SafepointReader::InvalidationPatchPoint(ionScript, si);
         CodeLocationLabel invalidateEpilogue(ionCode, CodeOffsetLabel(ionScript->invalidateEpilogueOffset()));
 
-        JitSpew(JitSpew_IonInvalidate, "   ! Invalidate ionScript %p (ref %u) -> patching osipoint %p",
-                ionScript, ionScript->refcount(), (void *) osiPatchPoint.raw());
+        JitSpew(JitSpew_IonInvalidate, "   ! Invalidate ionScript %p (inv count %u) -> patching osipoint %p",
+                ionScript, ionScript->invalidationCount(), (void *) osiPatchPoint.raw());
         Assembler::PatchWrite_NearCall(osiPatchPoint, invalidateEpilogue);
     }
 
@@ -2771,7 +2771,7 @@ jit::Invalidate(types::TypeZone &types, FreeOp *fop,
         // Keep the ion script alive during the invalidation and flag this
         // ionScript as being invalidated.  This increment is removed by the
         // loop after the calls to InvalidateActivation.
-        co->ion()->incref();
+        co->ion()->incrementInvalidationCount();
         numInvalidations++;
     }
 
@@ -2799,7 +2799,7 @@ jit::Invalidate(types::TypeZone &types, FreeOp *fop,
             continue;
 
         SetIonScript(nullptr, script, executionMode, nullptr);
-        ionScript->decref(fop);
+        ionScript->decrementInvalidationCount(fop);
         co->invalidate();
         numInvalidations--;
 
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index eb5240e16d29..e598830d0aba 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -279,7 +279,7 @@ struct IonScript
     uint32_t backedgeEntries_;
 
     // Number of references from invalidation records.
-    uint32_t refcount_;
+    uint32_t invalidationCount_;
 
     // If this is a parallel script, the number of major GC collections it has
     // been idle, otherwise 0.
@@ -394,8 +394,8 @@ struct IonScript
     static inline size_t offsetOfSkipArgCheckEntryOffset() {
         return offsetof(IonScript, skipArgCheckEntryOffset_);
     }
-    static inline size_t offsetOfRefcount() {
-        return offsetof(IonScript, refcount_);
+    static inline size_t offsetOfInvalidationCount() {
+        return offsetof(IonScript, invalidationCount_);
     }
     static inline size_t offsetOfRecompiling() {
         return offsetof(IonScript, recompiling_);
@@ -581,22 +581,22 @@ struct IonScript
                                 MacroAssembler &masm);
 
     bool invalidated() const {
-        return refcount_ != 0;
+        return invalidationCount_ != 0;
     }
 
     // Invalidate the current compilation.
     bool invalidate(JSContext *cx, bool resetUses, const char *reason);
 
-    size_t refcount() const {
-        return refcount_;
+    size_t invalidationCount() const {
+        return invalidationCount_;
     }
-    void incref() {
-        refcount_++;
+    void incrementInvalidationCount() {
+        invalidationCount_++;
     }
-    void decref(FreeOp *fop) {
-        MOZ_ASSERT(refcount_);
-        refcount_--;
-        if (!refcount_)
+    void decrementInvalidationCount(FreeOp *fop) {
+        MOZ_ASSERT(invalidationCount_);
+        invalidationCount_--;
+        if (!invalidationCount_)
             Destroy(fop, this);
     }
     const types::RecompileInfo& recompileInfo() const {
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index 8d37f3d4b355..c37b8a55bf46 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -731,7 +731,7 @@ HandleException(ResumeFromException *rfe)
 
                 if (rfe->kind == ResumeFromException::RESUME_BAILOUT) {
                     if (invalidated)
-                        ionScript->decref(cx->runtime()->defaultFreeOp());
+                        ionScript->decrementInvalidationCount(cx->runtime()->defaultFreeOp());
                     return;
                 }
 
@@ -764,7 +764,7 @@ HandleException(ResumeFromException *rfe)
             }
 
             if (invalidated)
-                ionScript->decref(cx->runtime()->defaultFreeOp());
+                ionScript->decrementInvalidationCount(cx->runtime()->defaultFreeOp());
 
         } else if (iter.isBaselineJS()) {
             // It's invalid to call DebugEpilogue twice for the same frame.

From 202ba2f5677ef20b75604b7d02fa1e8b5b27c795 Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Tue, 18 Nov 2014 20:52:33 -0800
Subject: [PATCH 55/84] Bug 1101217 - Upgrade to SQLite 3.8.7.2, r=mak

---
 configure.in              |   2 +-
 db/sqlite3/README.MOZILLA |   4 +-
 db/sqlite3/src/sqlite3.c  | 190 ++++++++++++++++++++++++--------------
 db/sqlite3/src/sqlite3.h  |   4 +-
 4 files changed, 124 insertions(+), 76 deletions(-)

diff --git a/configure.in b/configure.in
index 411d4f3f7611..b2b45e7304a6 100644
--- a/configure.in
+++ b/configure.in
@@ -71,7 +71,7 @@ GCONF_VERSION=1.2.1
 GIO_VERSION=2.20
 STARTUP_NOTIFICATION_VERSION=0.8
 DBUS_VERSION=0.60
-SQLITE_VERSION=3.8.7.1
+SQLITE_VERSION=3.8.7.2
 
 MSMANIFEST_TOOL=
 
diff --git a/db/sqlite3/README.MOZILLA b/db/sqlite3/README.MOZILLA
index d3394532de71..3bfe47f94633 100644
--- a/db/sqlite3/README.MOZILLA
+++ b/db/sqlite3/README.MOZILLA
@@ -1,6 +1,4 @@
-This is SQLite 3.8.7.1
-
--- Ryan VanderMeulen <ryanvm@gmail.com>, 11/2014
+This is SQLite 3.8.7.2
 
 See http://www.sqlite.org/ for more info.
 
diff --git a/db/sqlite3/src/sqlite3.c b/db/sqlite3/src/sqlite3.c
index 62f39e9910c6..9a8a0eac8caa 100644
--- a/db/sqlite3/src/sqlite3.c
+++ b/db/sqlite3/src/sqlite3.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 ** This file is an amalgamation of many separate C source files from SQLite
-** version 3.8.7.1.  By combining all the individual C code files into this 
+** version 3.8.7.2.  By combining all the individual C code files into this 
 ** single large file, the entire code can be compiled as a single translation
 ** unit.  This allows many compilers to do optimizations that would not be
 ** possible if the files were compiled separately.  Performance improvements
@@ -231,9 +231,9 @@ extern "C" {
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.8.7.1"
+#define SQLITE_VERSION        "3.8.7.2"
 #define SQLITE_VERSION_NUMBER 3008007
-#define SQLITE_SOURCE_ID      "2014-10-29 13:59:56 3b7b72c4685aa5cf5e675c2c47ebec10d9704221"
+#define SQLITE_SOURCE_ID      "2014-11-18 20:57:56 2ab564bf9655b7c7b97ab85cafc8a48329b27f93"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -9013,7 +9013,7 @@ SQLITE_PRIVATE int sqlite3BtreeBeginTrans(Btree*,int);
 SQLITE_PRIVATE int sqlite3BtreeCommitPhaseOne(Btree*, const char *zMaster);
 SQLITE_PRIVATE int sqlite3BtreeCommitPhaseTwo(Btree*, int);
 SQLITE_PRIVATE int sqlite3BtreeCommit(Btree*);
-SQLITE_PRIVATE int sqlite3BtreeRollback(Btree*,int);
+SQLITE_PRIVATE int sqlite3BtreeRollback(Btree*,int,int);
 SQLITE_PRIVATE int sqlite3BtreeBeginStmt(Btree*,int);
 SQLITE_PRIVATE int sqlite3BtreeCreateTable(Btree*, int*, int flags);
 SQLITE_PRIVATE int sqlite3BtreeIsInTrans(Btree*);
@@ -9046,7 +9046,7 @@ SQLITE_PRIVATE int sqlite3BtreeIncrVacuum(Btree *);
 SQLITE_PRIVATE int sqlite3BtreeDropTable(Btree*, int, int*);
 SQLITE_PRIVATE int sqlite3BtreeClearTable(Btree*, int, int*);
 SQLITE_PRIVATE int sqlite3BtreeClearTableOfCursor(BtCursor*);
-SQLITE_PRIVATE void sqlite3BtreeTripAllCursors(Btree*, int);
+SQLITE_PRIVATE int sqlite3BtreeTripAllCursors(Btree*, int, int);
 
 SQLITE_PRIVATE void sqlite3BtreeGetMeta(Btree *pBtree, int idx, u32 *pValue);
 SQLITE_PRIVATE int sqlite3BtreeUpdateMeta(Btree*, int idx, u32 value);
@@ -13062,7 +13062,7 @@ SQLITE_PRIVATE int sqlite3OpenTempDatabase(Parse *);
 SQLITE_PRIVATE void sqlite3StrAccumInit(StrAccum*, char*, int, int);
 SQLITE_PRIVATE void sqlite3StrAccumAppend(StrAccum*,const char*,int);
 SQLITE_PRIVATE void sqlite3StrAccumAppendAll(StrAccum*,const char*);
-SQLITE_PRIVATE void sqlite3AppendSpace(StrAccum*,int);
+SQLITE_PRIVATE void sqlite3AppendChar(StrAccum*,int,char);
 SQLITE_PRIVATE char *sqlite3StrAccumFinish(StrAccum*);
 SQLITE_PRIVATE void sqlite3StrAccumReset(StrAccum*);
 SQLITE_PRIVATE void sqlite3SelectDestInit(SelectDest*,int,int);
@@ -20947,7 +20947,7 @@ SQLITE_PRIVATE void sqlite3VXPrintf(
   const et_info *infop;      /* Pointer to the appropriate info structure */
   char *zOut;                /* Rendering buffer */
   int nOut;                  /* Size of the rendering buffer */
-  char *zExtra;              /* Malloced memory used by some conversion */
+  char *zExtra = 0;          /* Malloced memory used by some conversion */
 #ifndef SQLITE_OMIT_FLOATING_POINT
   int  exp, e2;              /* exponent of real numbers */
   int nsd;                   /* Number of significant digits returned */
@@ -21064,7 +21064,6 @@ SQLITE_PRIVATE void sqlite3VXPrintf(
         break;
       }
     }
-    zExtra = 0;
 
     /*
     ** At this point, variables are initialized as follows:
@@ -21355,13 +21354,16 @@ SQLITE_PRIVATE void sqlite3VXPrintf(
         }else{
           c = va_arg(ap,int);
         }
-        buf[0] = (char)c;
-        if( precision>=0 ){
-          for(idx=1; idx<precision; idx++) buf[idx] = (char)c;
-          length = precision;
-        }else{
-          length =1;
+        if( precision>1 ){
+          width -= precision-1;
+          if( width>1 && !flag_leftjustify ){
+            sqlite3AppendChar(pAccum, width-1, ' ');
+            width = 0;
+          }
+          sqlite3AppendChar(pAccum, precision-1, c);
         }
+        length = 1;
+        buf[0] = c;
         bufpt = buf;
         break;
       case etSTRING:
@@ -21462,11 +21464,14 @@ SQLITE_PRIVATE void sqlite3VXPrintf(
     ** the output.
     */
     width -= length;
-    if( width>0 && !flag_leftjustify ) sqlite3AppendSpace(pAccum, width);
+    if( width>0 && !flag_leftjustify ) sqlite3AppendChar(pAccum, width, ' ');
     sqlite3StrAccumAppend(pAccum, bufpt, length);
-    if( width>0 && flag_leftjustify ) sqlite3AppendSpace(pAccum, width);
+    if( width>0 && flag_leftjustify ) sqlite3AppendChar(pAccum, width, ' ');
 
-    if( zExtra ) sqlite3_free(zExtra);
+    if( zExtra ){
+      sqlite3_free(zExtra);
+      zExtra = 0;
+    }
   }/* End for loop over the format string */
 } /* End of function */
 
@@ -21519,11 +21524,11 @@ static int sqlite3StrAccumEnlarge(StrAccum *p, int N){
 }
 
 /*
-** Append N space characters to the given string buffer.
+** Append N copies of character c to the given string buffer.
 */
-SQLITE_PRIVATE void sqlite3AppendSpace(StrAccum *p, int N){
+SQLITE_PRIVATE void sqlite3AppendChar(StrAccum *p, int N, char c){
   if( p->nChar+N >= p->nAlloc && (N = sqlite3StrAccumEnlarge(p, N))<=0 ) return;
-  while( (N--)>0 ) p->zText[p->nChar++] = ' ';
+  while( (N--)>0 ) p->zText[p->nChar++] = c;
 }
 
 /*
@@ -50636,7 +50641,6 @@ SQLITE_PRIVATE int sqlite3WalUndo(Wal *pWal, int (*xUndo)(void *, Pgno), void *p
     }
     if( iMax!=pWal->hdr.mxFrame ) walCleanupHash(pWal);
   }
-  assert( rc==SQLITE_OK );
   return rc;
 }
 
@@ -51715,6 +51719,11 @@ struct CellInfo {
 **
 ** Fields in this structure are accessed under the BtShared.mutex
 ** found at self->pBt->mutex. 
+**
+** skipNext meaning:
+**    eState==SKIPNEXT && skipNext>0:  Next sqlite3BtreeNext() is no-op.
+**    eState==SKIPNEXT && skipNext<0:  Next sqlite3BtreePrevious() is no-op.
+**    eState==FAULT:                   Cursor fault with skipNext as error code.
 */
 struct BtCursor {
   Btree *pBtree;            /* The Btree to which this cursor belongs */
@@ -51727,7 +51736,8 @@ struct BtCursor {
   void *pKey;               /* Saved key that was cursor last known position */
   Pgno pgnoRoot;            /* The root page of this tree */
   int nOvflAlloc;           /* Allocated size of aOverflow[] array */
-  int skipNext;    /* Prev() is noop if negative. Next() is noop if positive */
+  int skipNext;    /* Prev() is noop if negative. Next() is noop if positive.
+                   ** Error code if eState==CURSOR_FAULT */
   u8 curFlags;              /* zero or more BTCF_* flags defined below */
   u8 eState;                /* One of the CURSOR_XXX constants (see below) */
   u8 hints;                             /* As configured by CursorSetHints() */
@@ -51773,7 +51783,7 @@ struct BtCursor {
 **   on a different connection that shares the BtShared cache with this
 **   cursor.  The error has left the cache in an inconsistent state.
 **   Do nothing else with this cursor.  Any attempt to use the cursor
-**   should return the error code stored in BtCursor.skip
+**   should return the error code stored in BtCursor.skipNext
 */
 #define CURSOR_INVALID           0
 #define CURSOR_VALID             1
@@ -54355,7 +54365,7 @@ SQLITE_PRIVATE int sqlite3BtreeClose(Btree *p){
   ** The call to sqlite3BtreeRollback() drops any table-locks held by
   ** this handle.
   */
-  sqlite3BtreeRollback(p, SQLITE_OK);
+  sqlite3BtreeRollback(p, SQLITE_OK, 0);
   sqlite3BtreeLeave(p);
 
   /* If there are still other outstanding references to the shared-btree
@@ -55648,60 +55658,91 @@ SQLITE_PRIVATE int sqlite3BtreeCommit(Btree *p){
 
 /*
 ** This routine sets the state to CURSOR_FAULT and the error
-** code to errCode for every cursor on BtShared that pBtree
-** references.
+** code to errCode for every cursor on any BtShared that pBtree
+** references.  Or if the writeOnly flag is set to 1, then only
+** trip write cursors and leave read cursors unchanged.
 **
-** Every cursor is tripped, including cursors that belong
-** to other database connections that happen to be sharing
-** the cache with pBtree.
+** Every cursor is a candidate to be tripped, including cursors
+** that belong to other database connections that happen to be
+** sharing the cache with pBtree.
 **
-** This routine gets called when a rollback occurs.
-** All cursors using the same cache must be tripped
-** to prevent them from trying to use the btree after
-** the rollback.  The rollback may have deleted tables
-** or moved root pages, so it is not sufficient to
-** save the state of the cursor.  The cursor must be
-** invalidated.
+** This routine gets called when a rollback occurs. If the writeOnly
+** flag is true, then only write-cursors need be tripped - read-only
+** cursors save their current positions so that they may continue 
+** following the rollback. Or, if writeOnly is false, all cursors are 
+** tripped. In general, writeOnly is false if the transaction being
+** rolled back modified the database schema. In this case b-tree root
+** pages may be moved or deleted from the database altogether, making
+** it unsafe for read cursors to continue.
+**
+** If the writeOnly flag is true and an error is encountered while 
+** saving the current position of a read-only cursor, all cursors, 
+** including all read-cursors are tripped.
+**
+** SQLITE_OK is returned if successful, or if an error occurs while
+** saving a cursor position, an SQLite error code.
 */
-SQLITE_PRIVATE void sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode){
+SQLITE_PRIVATE int sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode, int writeOnly){
   BtCursor *p;
-  if( pBtree==0 ) return;
-  sqlite3BtreeEnter(pBtree);
-  for(p=pBtree->pBt->pCursor; p; p=p->pNext){
-    int i;
-    sqlite3BtreeClearCursor(p);
-    p->eState = CURSOR_FAULT;
-    p->skipNext = errCode;
-    for(i=0; i<=p->iPage; i++){
-      releasePage(p->apPage[i]);
-      p->apPage[i] = 0;
+  int rc = SQLITE_OK;
+
+  assert( (writeOnly==0 || writeOnly==1) && BTCF_WriteFlag==1 );
+  if( pBtree ){
+    sqlite3BtreeEnter(pBtree);
+    for(p=pBtree->pBt->pCursor; p; p=p->pNext){
+      int i;
+      if( writeOnly && (p->curFlags & BTCF_WriteFlag)==0 ){
+        if( p->eState==CURSOR_VALID ){
+          rc = saveCursorPosition(p);
+          if( rc!=SQLITE_OK ){
+            (void)sqlite3BtreeTripAllCursors(pBtree, rc, 0);
+            break;
+          }
+        }
+      }else{
+        sqlite3BtreeClearCursor(p);
+        p->eState = CURSOR_FAULT;
+        p->skipNext = errCode;
+      }
+      for(i=0; i<=p->iPage; i++){
+        releasePage(p->apPage[i]);
+        p->apPage[i] = 0;
+      }
     }
+    sqlite3BtreeLeave(pBtree);
   }
-  sqlite3BtreeLeave(pBtree);
+  return rc;
 }
 
 /*
-** Rollback the transaction in progress.  All cursors will be
-** invalided by this operation.  Any attempt to use a cursor
-** that was open at the beginning of this operation will result
-** in an error.
+** Rollback the transaction in progress.
+**
+** If tripCode is not SQLITE_OK then cursors will be invalidated (tripped).
+** Only write cursors are tripped if writeOnly is true but all cursors are
+** tripped if writeOnly is false.  Any attempt to use
+** a tripped cursor will result in an error.
 **
 ** This will release the write lock on the database file.  If there
 ** are no active cursors, it also releases the read lock.
 */
-SQLITE_PRIVATE int sqlite3BtreeRollback(Btree *p, int tripCode){
+SQLITE_PRIVATE int sqlite3BtreeRollback(Btree *p, int tripCode, int writeOnly){
   int rc;
   BtShared *pBt = p->pBt;
   MemPage *pPage1;
 
+  assert( writeOnly==1 || writeOnly==0 );
+  assert( tripCode==SQLITE_ABORT_ROLLBACK || tripCode==SQLITE_OK );
   sqlite3BtreeEnter(p);
   if( tripCode==SQLITE_OK ){
     rc = tripCode = saveAllCursors(pBt, 0, 0);
+    if( rc ) writeOnly = 0;
   }else{
     rc = SQLITE_OK;
   }
   if( tripCode ){
-    sqlite3BtreeTripAllCursors(p, tripCode);
+    int rc2 = sqlite3BtreeTripAllCursors(p, tripCode, writeOnly);
+    assert( rc==SQLITE_OK || (writeOnly==0 && rc2==SQLITE_OK) );
+    if( rc2!=SQLITE_OK ) rc = rc2;
   }
   btreeIntegrity(p);
 
@@ -56036,13 +56077,9 @@ SQLITE_PRIVATE int sqlite3BtreeCursorIsValid(BtCursor *pCur){
 */
 SQLITE_PRIVATE int sqlite3BtreeKeySize(BtCursor *pCur, i64 *pSize){
   assert( cursorHoldsMutex(pCur) );
-  assert( pCur->eState==CURSOR_INVALID || pCur->eState==CURSOR_VALID );
-  if( pCur->eState!=CURSOR_VALID ){
-    *pSize = 0;
-  }else{
-    getCellInfo(pCur);
-    *pSize = pCur->info.nKey;
-  }
+  assert( pCur->eState==CURSOR_VALID );
+  getCellInfo(pCur);
+  *pSize = pCur->info.nKey;
   return SQLITE_OK;
 }
 
@@ -61466,7 +61503,7 @@ SQLITE_API int sqlite3_backup_finish(sqlite3_backup *p){
   }
 
   /* If a transaction is still open on the Btree, roll it back. */
-  sqlite3BtreeRollback(p->pDest, SQLITE_OK);
+  sqlite3BtreeRollback(p->pDest, SQLITE_OK, 0);
 
   /* Set the error code of the destination database handle. */
   rc = (p->rc==SQLITE_DONE) ? SQLITE_OK : p->rc;
@@ -71304,7 +71341,7 @@ case OP_Column: {
         pC->payloadSize = pC->szRow = avail = pReg->n;
         pC->aRow = (u8*)pReg->z;
       }else{
-        MemSetTypeFlag(pDest, MEM_Null);
+        sqlite3VdbeMemSetNull(pDest);
         goto op_column_out;
       }
     }else{
@@ -71828,11 +71865,18 @@ case OP_Savepoint: {
         db->isTransactionSavepoint = 0;
         rc = p->rc;
       }else{
+        int isSchemaChange;
         iSavepoint = db->nSavepoint - iSavepoint - 1;
         if( p1==SAVEPOINT_ROLLBACK ){
+          isSchemaChange = (db->flags & SQLITE_InternChanges)!=0;
           for(ii=0; ii<db->nDb; ii++){
-            sqlite3BtreeTripAllCursors(db->aDb[ii].pBt, SQLITE_ABORT);
+            rc = sqlite3BtreeTripAllCursors(db->aDb[ii].pBt,
+                                       SQLITE_ABORT_ROLLBACK,
+                                       isSchemaChange==0);
+            if( rc!=SQLITE_OK ) goto abort_due_to_error;
           }
+        }else{
+          isSchemaChange = 0;
         }
         for(ii=0; ii<db->nDb; ii++){
           rc = sqlite3BtreeSavepoint(db->aDb[ii].pBt, p1, iSavepoint);
@@ -71840,7 +71884,7 @@ case OP_Savepoint: {
             goto abort_due_to_error;
           }
         }
-        if( p1==SAVEPOINT_ROLLBACK && (db->flags&SQLITE_InternChanges)!=0 ){
+        if( isSchemaChange ){
           sqlite3ExpirePreparedStatements(db);
           sqlite3ResetAllSchemasOfConnection(db);
           db->flags = (db->flags | SQLITE_InternChanges);
@@ -72237,7 +72281,7 @@ case OP_OpenWrite: {
           || p->readOnly==0 );
 
   if( p->expired ){
-    rc = SQLITE_ABORT;
+    rc = SQLITE_ABORT_ROLLBACK;
     break;
   }
 
@@ -73404,6 +73448,10 @@ case OP_Rowid: {                 /* out2-prerelease */
     assert( pC->pCursor!=0 );
     rc = sqlite3VdbeCursorRestore(pC);
     if( rc ) goto abort_due_to_error;
+    if( pC->nullRow ){
+      pOut->flags = MEM_Null;
+      break;
+    }
     rc = sqlite3BtreeKeySize(pC->pCursor, &v);
     assert( rc==SQLITE_OK );  /* Always so because of CursorRestore() above */
   }
@@ -82435,7 +82483,6 @@ SQLITE_PRIVATE int sqlite3CodeSubselect(
         assert( (pExpr->iTable&0x0000FFFF)==pExpr->iTable );
         pSelect->iLimit = 0;
         testcase( pSelect->selFlags & SF_Distinct );
-        pSelect->selFlags &= ~SF_Distinct;
         testcase( pKeyInfo==0 ); /* Caused by OOM in sqlite3KeyInfoAlloc() */
         if( sqlite3Select(pParse, pSelect, &dest) ){
           sqlite3KeyInfoUnref(pKeyInfo);
@@ -125927,13 +125974,15 @@ SQLITE_PRIVATE void sqlite3LeaveMutexAndCloseZombie(sqlite3 *db){
 
 /*
 ** Rollback all database files.  If tripCode is not SQLITE_OK, then
-** any open cursors are invalidated ("tripped" - as in "tripping a circuit
+** any write cursors are invalidated ("tripped" - as in "tripping a circuit
 ** breaker") and made to return tripCode if there are any further
-** attempts to use that cursor.
+** attempts to use that cursor.  Read cursors remain open and valid
+** but are "saved" in case the table pages are moved around.
 */
 SQLITE_PRIVATE void sqlite3RollbackAll(sqlite3 *db, int tripCode){
   int i;
   int inTrans = 0;
+  int schemaChange;
   assert( sqlite3_mutex_held(db->mutex) );
   sqlite3BeginBenignMalloc();
 
@@ -125944,6 +125993,7 @@ SQLITE_PRIVATE void sqlite3RollbackAll(sqlite3 *db, int tripCode){
   ** the database rollback and schema reset, which can cause false
   ** corruption reports in some cases.  */
   sqlite3BtreeEnterAll(db);
+  schemaChange = (db->flags & SQLITE_InternChanges)!=0 && db->init.busy==0;
 
   for(i=0; i<db->nDb; i++){
     Btree *p = db->aDb[i].pBt;
@@ -125951,7 +126001,7 @@ SQLITE_PRIVATE void sqlite3RollbackAll(sqlite3 *db, int tripCode){
       if( sqlite3BtreeIsInTrans(p) ){
         inTrans = 1;
       }
-      sqlite3BtreeRollback(p, tripCode);
+      sqlite3BtreeRollback(p, tripCode, !schemaChange);
     }
   }
   sqlite3VtabRollback(db);
diff --git a/db/sqlite3/src/sqlite3.h b/db/sqlite3/src/sqlite3.h
index 184003ea9489..023dad184657 100644
--- a/db/sqlite3/src/sqlite3.h
+++ b/db/sqlite3/src/sqlite3.h
@@ -107,9 +107,9 @@ extern "C" {
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.8.7.1"
+#define SQLITE_VERSION        "3.8.7.2"
 #define SQLITE_VERSION_NUMBER 3008007
-#define SQLITE_SOURCE_ID      "2014-10-29 13:59:56 3b7b72c4685aa5cf5e675c2c47ebec10d9704221"
+#define SQLITE_SOURCE_ID      "2014-11-18 20:57:56 2ab564bf9655b7c7b97ab85cafc8a48329b27f93"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers

From 36ce9f8f767db7d3321b260b6dfd8283beafee1c Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 21:45:01 -0800
Subject: [PATCH 56/84] Bug 1101083 - js_DumpBacktrace should dump all frames
 (r=bholley,nbp)

---
 js/src/jsobj.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index e658f8c64f93..b751cbc23876 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -4153,7 +4153,7 @@ js_DumpBacktrace(JSContext *cx)
     Sprinter sprinter(cx);
     sprinter.init();
     size_t depth = 0;
-    for (ScriptFrameIter i(cx); !i.done(); ++i, ++depth) {
+    for (AllFramesIter i(cx); !i.done(); ++i, ++depth) {
         const char *filename = JS_GetScriptFilename(i.script());
         unsigned line = PCToLineNumber(i.script(), i.pc());
         JSScript *script = i.script();

From f5c20f47d7c3d2bda837d90327903b8542b9a005 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 18 Nov 2014 21:46:01 -0800
Subject: [PATCH 57/84] Bug 1093693 - [e10s] Don't use sync messages between
 plugins and chrome process (r=jimm)

---
 dom/plugins/ipc/PPluginModule.ipdl     |  27 +++--
 dom/plugins/ipc/PluginModuleChild.cpp  |  43 ++++---
 dom/plugins/ipc/PluginModuleChild.h    |  12 +-
 dom/plugins/ipc/PluginModuleParent.cpp | 149 +++++++++++++++++++------
 dom/plugins/ipc/PluginModuleParent.h   |  23 ++--
 5 files changed, 178 insertions(+), 76 deletions(-)

diff --git a/dom/plugins/ipc/PPluginModule.ipdl b/dom/plugins/ipc/PPluginModule.ipdl
index bb878c4c063c..6d7613f13e26 100644
--- a/dom/plugins/ipc/PPluginModule.ipdl
+++ b/dom/plugins/ipc/PPluginModule.ipdl
@@ -17,6 +17,21 @@ using struct nsID from "nsID.h";
 namespace mozilla {
 namespace plugins {
 
+struct PluginSettings
+{
+  // These settings correspond to NPNVariable. They are fetched from
+  // mozilla::plugins::parent::_getvalue.
+  bool javascriptEnabled;
+  bool asdEnabled;
+  bool isOffline;
+  bool supportsXembed;
+  bool supportsWindowless;
+
+  // These settings come from elsewhere.
+  nsCString userAgent;
+  bool nativeCursorsSupported;
+};
+
 intr protocol PPluginModule
 {
   bridges PContent, PPluginModule;
@@ -34,7 +49,7 @@ child:
   intr NP_GetEntryPoints()
     returns (NPError rv);
 
-  intr NP_Initialize()
+  intr NP_Initialize(PluginSettings settings)
     returns (NPError rv);
 
   intr PPluginInstance(nsCString aMimeType,
@@ -69,6 +84,8 @@ child:
   intr GeckoGetProfile()
     returns (nsCString aProfile);
 
+  async SettingChanged(PluginSettings settings);
+
 parent:
   /**
    * This message is only used on X11 platforms.
@@ -83,13 +100,6 @@ parent:
    */
   async BackUpXResources(FileDescriptor aXSocketFd);
 
-  intr NPN_UserAgent()
-    returns (nsCString userAgent);
-
-  intr NPN_GetValue_WithBoolReturn(NPNVariable aVariable)
-    returns (NPError aError,
-             bool aBoolVal);
-
   // Wake up and process a few native events.  Periodically called by
   // Gtk-specific code upon detecting that the plugin process has
   // entered a nested event loop.  If the browser doesn't process
@@ -108,7 +118,6 @@ parent:
   async ShowCursor(bool show);
   async PushCursor(NSCursorInfo cursorInfo);
   async PopCursor();
-  sync GetNativeCursorsSupported() returns (bool supported);
 
   sync NPN_SetException(nsCString message);
 
diff --git a/dom/plugins/ipc/PluginModuleChild.cpp b/dom/plugins/ipc/PluginModuleChild.cpp
index 3fcb851c314b..08cf0f5a13aa 100644
--- a/dom/plugins/ipc/PluginModuleChild.cpp
+++ b/dom/plugins/ipc/PluginModuleChild.cpp
@@ -821,10 +821,7 @@ PluginModuleChild::CleanUp()
 const char*
 PluginModuleChild::GetUserAgent()
 {
-    if (mUserAgent.IsVoid() && !CallNPN_UserAgent(&mUserAgent))
-        return nullptr;
-
-    return NullableStringGet(mUserAgent);
+    return NullableStringGet(Settings().userAgent());
 }
 
 //-----------------------------------------------------------------------------
@@ -1120,18 +1117,21 @@ _getvalue(NPP aNPP,
 #endif
             return NPERR_GENERIC_ERROR;
 
-        case NPNVjavascriptEnabledBool: // Intentional fall-through
-        case NPNVasdEnabledBool: // Intentional fall-through
-        case NPNVisOfflineBool: // Intentional fall-through
-        case NPNVSupportsXEmbedBool: // Intentional fall-through
-        case NPNVSupportsWindowless: { // Intentional fall-through
-            NPError result;
-            bool value;
-            PluginModuleChild::GetChrome()->
-                CallNPN_GetValue_WithBoolReturn(aVariable, &result, &value);
-            *(NPBool*)aValue = value ? true : false;
-            return result;
-        }
+        case NPNVjavascriptEnabledBool:
+            *(NPBool*)aValue = PluginModuleChild::GetChrome()->Settings().javascriptEnabled();
+            return NPERR_NO_ERROR;
+        case NPNVasdEnabledBool:
+            *(NPBool*)aValue = PluginModuleChild::GetChrome()->Settings().asdEnabled();
+            return NPERR_NO_ERROR;
+        case NPNVisOfflineBool:
+            *(NPBool*)aValue = PluginModuleChild::GetChrome()->Settings().isOffline();
+            return NPERR_NO_ERROR;
+        case NPNVSupportsXEmbedBool:
+            *(NPBool*)aValue = PluginModuleChild::GetChrome()->Settings().supportsXembed();
+            return NPERR_NO_ERROR;
+        case NPNVSupportsWindowless:
+            *(NPBool*)aValue = PluginModuleChild::GetChrome()->Settings().supportsWindowless();
+            return NPERR_NO_ERROR;
 #if defined(MOZ_WIDGET_GTK)
         case NPNVxDisplay: {
             if (aNPP) {
@@ -1834,6 +1834,13 @@ _urlredirectresponse(NPP instance, void* notifyData, NPBool allow)
 
 //-----------------------------------------------------------------------------
 
+bool
+PluginModuleChild::RecvSettingChanged(const PluginSettings& aSettings)
+{
+    mCachedSettings = aSettings;
+    return true;
+}
+
 bool
 PluginModuleChild::AnswerNP_GetEntryPoints(NPError* _retval)
 {
@@ -1852,12 +1859,14 @@ PluginModuleChild::AnswerNP_GetEntryPoints(NPError* _retval)
 }
 
 bool
-PluginModuleChild::AnswerNP_Initialize(NPError* _retval)
+PluginModuleChild::AnswerNP_Initialize(const PluginSettings& aSettings, NPError* _retval)
 {
     PLUGIN_LOG_DEBUG_METHOD;
     AssertPluginThread();
     MOZ_ASSERT(mIsChrome);
 
+    mCachedSettings = aSettings;
+
 #ifdef OS_WIN
     SetEventHooks();
 #endif
diff --git a/dom/plugins/ipc/PluginModuleChild.h b/dom/plugins/ipc/PluginModuleChild.h
index 7305fe4f9a7b..a161afa608c2 100644
--- a/dom/plugins/ipc/PluginModuleChild.h
+++ b/dom/plugins/ipc/PluginModuleChild.h
@@ -72,9 +72,11 @@ protected:
 
     virtual bool ShouldContinueFromReplyTimeout() MOZ_OVERRIDE;
 
+    virtual bool RecvSettingChanged(const PluginSettings& aSettings) MOZ_OVERRIDE;
+
     // Implement the PPluginModuleChild interface
     virtual bool AnswerNP_GetEntryPoints(NPError* rv) MOZ_OVERRIDE;
-    virtual bool AnswerNP_Initialize(NPError* rv) MOZ_OVERRIDE;
+    virtual bool AnswerNP_Initialize(const PluginSettings& aSettings, NPError* rv) MOZ_OVERRIDE;
 
     virtual PPluginModuleChild*
     AllocPPluginModuleChild(mozilla::ipc::Transport* aTransport,
@@ -226,9 +228,7 @@ public:
     }
 
     bool GetNativeCursorsSupported() {
-        bool supported = false;
-        SendGetNativeCursorsSupported(&supported);
-        return supported;
+        return Settings().nativeCursorsSupported();
     }
 #endif
 
@@ -278,6 +278,8 @@ public:
 
     int GetQuirks() { return mQuirks; }
 
+    const PluginSettings& Settings() const { return mCachedSettings; }
+
 private:
     void AddQuirk(PluginQuirks quirk) {
       if (mQuirks == QUIRKS_NOT_INITIALIZED)
@@ -318,6 +320,8 @@ private:
 
     NPPluginFuncs mFunctions;
 
+    PluginSettings mCachedSettings;
+
 #if defined(MOZ_WIDGET_GTK)
     // If a plugin spins a nested glib event loop in response to a
     // synchronous IPC message from the browser, the loop might break
diff --git a/dom/plugins/ipc/PluginModuleParent.cpp b/dom/plugins/ipc/PluginModuleParent.cpp
index 84d8eea5cae9..ee0b8049e46c 100755
--- a/dom/plugins/ipc/PluginModuleParent.cpp
+++ b/dom/plugins/ipc/PluginModuleParent.cpp
@@ -252,6 +252,8 @@ PluginModuleChromeParent::PluginModuleChromeParent(const char* aFilePath, uint32
     Preferences::RegisterCallback(TimeoutChanged, kHangUIMinDisplayPref, this);
 #endif
 
+    RegisterSettingsCallbacks();
+
 #ifdef MOZ_ENABLE_PROFILER_SPS
     InitPluginProfiling();
 #endif
@@ -295,6 +297,8 @@ PluginModuleChromeParent::~PluginModuleChromeParent()
     Preferences::UnregisterCallback(TimeoutChanged, kHangUITimeoutPref, this);
     Preferences::UnregisterCallback(TimeoutChanged, kHangUIMinDisplayPref, this);
 
+    UnregisterSettingsCallbacks();
+
     if (mHangUIParent) {
         delete mHangUIParent;
         mHangUIParent = nullptr;
@@ -903,6 +907,9 @@ PluginModuleChromeParent::ActorDestroy(ActorDestroyReason why)
 #endif
     }
 
+    // We can't broadcast settings changes anymore.
+    UnregisterSettingsCallbacks();
+
     PluginModuleParent::ActorDestroy(why);
 }
 
@@ -1156,13 +1163,6 @@ PluginModuleParent::NPP_URLRedirectNotify(NPP instance, const char* url,
   i->NPP_URLRedirectNotify(url, status, notifyData);
 }
 
-bool
-PluginModuleParent::AnswerNPN_UserAgent(nsCString* userAgent)
-{
-    *userAgent = NullableString(mNPNIface->uagent(nullptr));
-    return true;
-}
-
 PluginInstanceParent*
 PluginModuleParent::InstCast(NPP instance)
 {
@@ -1262,6 +1262,107 @@ PluginModuleParent::EndUpdateBackground(NPP instance,
     return i->EndUpdateBackground(aCtx, aRect);
 }
 
+class OfflineObserver MOZ_FINAL : public nsIObserver
+{
+public:
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSIOBSERVER
+
+    explicit OfflineObserver(PluginModuleChromeParent* pmp)
+      : mPmp(pmp)
+    {}
+
+private:
+    ~OfflineObserver() {}
+    PluginModuleChromeParent* mPmp;
+};
+
+NS_IMPL_ISUPPORTS(OfflineObserver, nsIObserver)
+
+NS_IMETHODIMP
+OfflineObserver::Observe(nsISupports *aSubject,
+                         const char *aTopic,
+                         const char16_t *aData)
+{
+    MOZ_ASSERT(!strcmp(aTopic, "ipc:network:set-offline"));
+    mPmp->CachedSettingChanged();
+    return NS_OK;
+}
+
+static const char* kSettingsPrefs[] =
+    {"javascript.enabled",
+     "dom.ipc.plugins.nativeCursorSupport"};
+
+void
+PluginModuleChromeParent::RegisterSettingsCallbacks()
+{
+    for (size_t i = 0; i < ArrayLength(kSettingsPrefs); i++) {
+        Preferences::RegisterCallback(CachedSettingChanged, kSettingsPrefs[i], this);
+    }
+
+    nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
+    if (observerService) {
+        mOfflineObserver = new OfflineObserver(this);
+        observerService->AddObserver(mOfflineObserver, "ipc:network:set-offline", false);
+    }
+}
+
+void
+PluginModuleChromeParent::UnregisterSettingsCallbacks()
+{
+    for (size_t i = 0; i < ArrayLength(kSettingsPrefs); i++) {
+        Preferences::UnregisterCallback(CachedSettingChanged, kSettingsPrefs[i], this);
+    }
+
+    nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
+    if (observerService) {
+        observerService->RemoveObserver(mOfflineObserver, "ipc:network:set-offline");
+        mOfflineObserver = nullptr;
+    }
+}
+
+bool
+PluginModuleParent::GetSetting(NPNVariable aVariable)
+{
+    NPBool boolVal = false;
+    mozilla::plugins::parent::_getvalue(nullptr, aVariable, &boolVal);
+    return boolVal;
+}
+
+void
+PluginModuleParent::GetSettings(PluginSettings* aSettings)
+{
+    aSettings->javascriptEnabled() = GetSetting(NPNVjavascriptEnabledBool);
+    aSettings->asdEnabled() = GetSetting(NPNVasdEnabledBool);
+    aSettings->isOffline() = GetSetting(NPNVisOfflineBool);
+    aSettings->supportsXembed() = GetSetting(NPNVSupportsXEmbedBool);
+    aSettings->supportsWindowless() = GetSetting(NPNVSupportsWindowless);
+    aSettings->userAgent() = NullableString(mNPNIface->uagent(nullptr));
+
+#if defined(XP_MACOSX)
+    aSettings->nativeCursorsSupported() =
+      Preferences::GetBool("dom.ipc.plugins.nativeCursorSupport", false);
+#else
+    // Need to initialize this to satisfy IPDL.
+    aSettings->nativeCursorsSupported() = false;
+#endif
+}
+
+void
+PluginModuleChromeParent::CachedSettingChanged()
+{
+    PluginSettings settings;
+    GetSettings(&settings);
+    unused << SendSettingChanged(settings);
+}
+
+/* static */ void
+PluginModuleChromeParent::CachedSettingChanged(const char* aPref, void* aModule)
+{
+    PluginModuleChromeParent *module = static_cast<PluginModuleChromeParent*>(aModule);
+    module->CachedSettingChanged();
+}
+
 #if defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK)
 nsresult
 PluginModuleParent::NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, NPError* error)
@@ -1277,7 +1378,9 @@ PluginModuleParent::NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs
 
     *error = NPERR_NO_ERROR;
     if (IsChrome()) {
-        if (!CallNP_Initialize(error)) {
+        PluginSettings settings;
+        GetSettings(&settings);
+        if (!CallNP_Initialize(settings, error)) {
             Close();
             return NS_ERROR_FAILURE;
         }
@@ -1315,7 +1418,9 @@ PluginModuleChromeParent::NP_Initialize(NPNetscapeFuncs* bFuncs, NPError* error)
     if (NS_FAILED(rv))
         return rv;
 
-    if (!CallNP_Initialize(error)) {
+    PluginSettings settings;
+    GetSettings(&settings);
+    if (!CallNP_Initialize(settings, error)) {
         Close();
         return NS_ERROR_FAILURE;
     }
@@ -1539,17 +1644,6 @@ PluginModuleParent::ContentsScaleFactorChanged(NPP instance, double aContentsSca
 }
 #endif // #if defined(XP_MACOSX)
 
-bool
-PluginModuleParent::AnswerNPN_GetValue_WithBoolReturn(const NPNVariable& aVariable,
-                                                      NPError* aError,
-                                                      bool* aBoolVal)
-{
-    NPBool boolVal = false;
-    *aError = mozilla::plugins::parent::_getvalue(nullptr, aVariable, &boolVal);
-    *aBoolVal = boolVal ? true : false;
-    return true;
-}
-
 #if defined(MOZ_WIDGET_QT)
 static const int kMaxtimeToProcessEvents = 30;
 bool
@@ -1749,21 +1843,6 @@ PluginModuleParent::RecvPopCursor()
 #endif
 }
 
-bool
-PluginModuleParent::RecvGetNativeCursorsSupported(bool* supported)
-{
-    PLUGIN_LOG_DEBUG(("%s", FULLFUNCTION));
-#if defined(XP_MACOSX)
-    *supported =
-      Preferences::GetBool("dom.ipc.plugins.nativeCursorSupport", false);
-    return true;
-#else
-    NS_NOTREACHED(
-        "PluginInstanceParent::RecvGetNativeCursorSupportLevel not implemented!");
-    return false;
-#endif
-}
-
 bool
 PluginModuleParent::RecvNPN_SetException(const nsCString& aMessage)
 {
diff --git a/dom/plugins/ipc/PluginModuleParent.h b/dom/plugins/ipc/PluginModuleParent.h
index 529576d0636f..5868c181bb90 100644
--- a/dom/plugins/ipc/PluginModuleParent.h
+++ b/dom/plugins/ipc/PluginModuleParent.h
@@ -115,14 +115,6 @@ protected:
     virtual bool
     RecvBackUpXResources(const FileDescriptor& aXSocketFd) MOZ_OVERRIDE;
 
-    virtual bool
-    AnswerNPN_UserAgent(nsCString* userAgent) MOZ_OVERRIDE;
-
-    virtual bool
-    AnswerNPN_GetValue_WithBoolReturn(const NPNVariable& aVariable,
-                                      NPError* aError,
-                                      bool* aBoolVal) MOZ_OVERRIDE;
-
     virtual bool AnswerProcessSomeEvents() MOZ_OVERRIDE;
 
     virtual bool
@@ -154,9 +146,6 @@ protected:
     virtual bool
     RecvPopCursor() MOZ_OVERRIDE;
 
-    virtual bool
-    RecvGetNativeCursorsSupported(bool* supported) MOZ_OVERRIDE;
-
     virtual bool
     RecvNPN_SetException(const nsCString& aMessage) MOZ_OVERRIDE;
 
@@ -242,6 +231,9 @@ protected:
 protected:
     void NotifyPluginCrashed();
 
+    bool GetSetting(NPNVariable aVariable);
+    void GetSettings(PluginSettings* aSettings);
+
     bool mIsChrome;
     bool mShutdown;
     bool mClearSiteDataSupported;
@@ -312,6 +304,8 @@ class PluginModuleChromeParent
     OnHangUIContinue();
 #endif // XP_WIN
 
+    void CachedSettingChanged();
+
 private:
     virtual void
     EnteredCxxStack() MOZ_OVERRIDE;
@@ -360,8 +354,13 @@ private:
     void ShutdownPluginProfiling();
 #endif
 
+    void RegisterSettingsCallbacks();
+    void UnregisterSettingsCallbacks();
+
     virtual bool RecvNotifyContentModuleDestroyed() MOZ_OVERRIDE;
 
+    static void CachedSettingChanged(const char* aPref, void* aModule);
+
     PluginProcessParent* mSubprocess;
     uint32_t mPluginId;
 
@@ -422,6 +421,8 @@ private:
     DWORD mFlashProcess1;
     DWORD mFlashProcess2;
 #endif
+
+    nsCOMPtr<nsIObserver> mOfflineObserver;
 };
 
 } // namespace plugins

From 31b5e57828473203bae4520be00dbb0c80719357 Mon Sep 17 00:00:00 2001
From: James Willcox <snorp@snorp.net>
Date: Tue, 18 Nov 2014 16:01:00 -0800
Subject: [PATCH 58/84] Bug 1101225 - Don't set the is-adts flag for the
 Android PDM. r=rillian

Pass raw aac frames to the platform, which handles those fine.
---
 .../fmp4/android/AndroidDecoderModule.cpp     | 25 -------------------
 1 file changed, 25 deletions(-)

diff --git a/dom/media/fmp4/android/AndroidDecoderModule.cpp b/dom/media/fmp4/android/AndroidDecoderModule.cpp
index bfe6bc075497..97314be4de20 100644
--- a/dom/media/fmp4/android/AndroidDecoderModule.cpp
+++ b/dom/media/fmp4/android/AndroidDecoderModule.cpp
@@ -8,7 +8,6 @@
 
 #include "MediaData.h"
 
-#include "mp4_demuxer/Adts.h"
 #include "mp4_demuxer/AnnexB.h"
 #include "mp4_demuxer/DecoderData.h"
 
@@ -104,25 +103,6 @@ public:
   {
   }
 
-  virtual nsresult Input(mp4_demuxer::MP4Sample* aSample) MOZ_OVERRIDE {
-    if (!strcmp(mMimeType, "audio/mp4a-latm")) {
-      uint32_t numChannels = mFormat->GetInteger(NS_LITERAL_CSTRING("channel-count"));
-      uint32_t sampleRate = mFormat->GetInteger(NS_LITERAL_CSTRING("sample-rate"));
-      uint8_t frequencyIndex =
-          mp4_demuxer::Adts::GetFrequencyIndex(sampleRate);
-      uint32_t aacProfile = mFormat->GetInteger(NS_LITERAL_CSTRING("aac-profile"));
-      bool rv = mp4_demuxer::Adts::ConvertSample(numChannels,
-                                                 frequencyIndex,
-                                                 aacProfile,
-                                                 aSample);
-      if (!rv) {
-        NS_WARNING("Failed to prepend ADTS header\n");
-        return NS_ERROR_FAILURE;
-      }
-    }
-    return MediaCodecDataDecoder::Input(aSample);
-  }
-
   nsresult Output(BufferInfo* aInfo, void* aBuffer, MediaFormat* aFormat, Microseconds aDuration) {
     // The output on Android is always 16-bit signed
 
@@ -213,11 +193,6 @@ AndroidDecoderModule::CreateAudioDecoder(const mp4_demuxer::AudioDecoderConfig&
     env->DeleteLocalRef(buffer);
   }
 
-  if (strcmp(aConfig.mime_type, "audio/mp4a-latm") == 0) {
-    format->SetInteger(NS_LITERAL_CSTRING("is-adts"), 1);
-    format->SetInteger(NS_LITERAL_CSTRING("aac-profile"), aConfig.aac_profile);
-  }
-
   nsRefPtr<MediaDataDecoder> decoder =
     new AudioDataDecoder(aConfig.mime_type, format, aCallback);
 

From 856e7191b0bc7231c84b9e662a4024b72c0d9b30 Mon Sep 17 00:00:00 2001
From: David Zbarsky <dzbarsky@gmail.com>
Date: Wed, 19 Nov 2014 02:48:22 -0500
Subject: [PATCH 59/84] Bug 1089811 - remove nsIDOMGlobalObjectConstructor
 because it is dead code r=bz

---
 dom/base/nsDOMClassInfo.cpp                   | 60 -------------------
 dom/interfaces/base/moz.build                 |  1 -
 .../base/nsIDOMGlobalObjectConstructor.idl    | 19 ------
 3 files changed, 80 deletions(-)
 delete mode 100644 dom/interfaces/base/nsIDOMGlobalObjectConstructor.idl

diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index d489bccc3ec8..3b3aee9534c8 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -108,7 +108,6 @@
 #include "FMRadio.h"
 #endif
 
-#include "nsIDOMGlobalObjectConstructor.h"
 #include "nsDebug.h"
 
 #include "mozilla/dom/BindingUtils.h"
@@ -1351,65 +1350,6 @@ BaseStubConstructor(nsIWeakReference* aWeakOwner,
     return rv;
   }
 
-  nsCOMPtr<nsIDOMGlobalObjectConstructor> constructor(do_QueryInterface(native));
-  if (constructor) {
-    // Initialize object using the current inner window, but only if
-    // the caller can access it.
-    nsCOMPtr<nsPIDOMWindow> owner = do_QueryReferent(aWeakOwner);
-    nsPIDOMWindow* outerWindow = owner ? owner->GetOuterWindow() : nullptr;
-    nsPIDOMWindow* currentInner =
-      outerWindow ? outerWindow->GetCurrentInnerWindow() : nullptr;
-    if (!currentInner ||
-        (owner != currentInner &&
-         !nsContentUtils::CanCallerAccess(currentInner))) {
-      return NS_ERROR_DOM_SECURITY_ERR;
-    }
-
-    nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS = do_QueryInterface(native);
-
-    JS::Rooted<JSObject*> thisObject(cx, wrappedJS->GetJSObject());
-    if (!thisObject) {
-      return NS_ERROR_UNEXPECTED;
-    }
-
-    JSAutoCompartment ac(cx, thisObject);
-
-    JS::Rooted<JS::Value> funval(cx);
-    if (!JS_GetProperty(cx, thisObject, "constructor", &funval) ||
-        !funval.isObject()) {
-      return NS_ERROR_UNEXPECTED;
-    }
-
-    // Check if the object is even callable.
-    NS_ENSURE_STATE(JS::IsCallable(&funval.toObject()));
-    {
-      // wrap parameters in the target compartment
-      // we also pass in the calling window as the first argument
-      unsigned argc = args.length() + 1;
-      JS::AutoValueVector argv(cx);
-      if (!argv.resize(argc)) {
-        return NS_ERROR_OUT_OF_MEMORY;
-      }
-
-      nsCOMPtr<nsIDOMWindow> currentWin(do_GetInterface(currentInner));
-      rv = WrapNative(cx, currentWin, &NS_GET_IID(nsIDOMWindow),
-                      true, argv[0]);
-
-      for (size_t i = 1; i < argc; ++i) {
-        argv[i].set(args[i - 1]);
-        if (!JS_WrapValue(cx, argv[i]))
-          return NS_ERROR_FAILURE;
-      }
-
-      JS::Rooted<JS::Value> frval(cx);
-      bool ret = JS_CallFunctionValue(cx, thisObject, funval, argv, &frval);
-
-      if (!ret) {
-        return NS_ERROR_FAILURE;
-      }
-    }
-  }
-
   js::AssertSameCompartment(cx, obj);
   return WrapNative(cx, native, true, args.rval());
 }
diff --git a/dom/interfaces/base/moz.build b/dom/interfaces/base/moz.build
index c1422f6e69de..20ae0d05f46f 100644
--- a/dom/interfaces/base/moz.build
+++ b/dom/interfaces/base/moz.build
@@ -17,7 +17,6 @@ XPIDL_SOURCES += [
     'nsIDOMClientRectList.idl',
     'nsIDOMConstructor.idl',
     'nsIDOMCrypto.idl',
-    'nsIDOMGlobalObjectConstructor.idl',
     'nsIDOMGlobalPropertyInitializer.idl',
     'nsIDOMHistory.idl',
     'nsIDOMJSWindow.idl',
diff --git a/dom/interfaces/base/nsIDOMGlobalObjectConstructor.idl b/dom/interfaces/base/nsIDOMGlobalObjectConstructor.idl
deleted file mode 100644
index 6d49efdcb765..000000000000
--- a/dom/interfaces/base/nsIDOMGlobalObjectConstructor.idl
+++ /dev/null
@@ -1,19 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "domstubs.idl"
-
-[scriptable, uuid(cb439c73-0129-4289-a349-c5216e6b912a)]
-interface nsIDOMGlobalObjectConstructor : nsISupports
-{
-  /*
-   * JS use only
-   *
-   * The constructor() method will be called with any parameters passed
-   * to the object constructor.
-   * If the JS implementation returns a value, it will be ignored.
-   */
-  void constructor();
-};

From e189fc86de2752eb077dfc9751ba3b094b2f3b86 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Fri, 24 Oct 2014 13:54:20 -0400
Subject: [PATCH 60/84] Bug 1074952 - Part 1. Expose the level of logging as a
 preference. r=bschouten

---
 gfx/2d/Factory.cpp      | 27 +++++++++++++++++++++++--
 gfx/2d/Logging.h        | 45 ++++++++++++++++++++++++++++++++++++++---
 gfx/thebes/gfxPrefs.cpp | 28 +++++++++++++++++++++++++
 gfx/thebes/gfxPrefs.h   |  5 +++++
 4 files changed, 100 insertions(+), 5 deletions(-)

diff --git a/gfx/2d/Factory.cpp b/gfx/2d/Factory.cpp
index a1dfc18c2bf1..9e5da4512e98 100644
--- a/gfx/2d/Factory.cpp
+++ b/gfx/2d/Factory.cpp
@@ -156,8 +156,31 @@ HasCPUIDBit(unsigned int level, CPUIDRegister reg, unsigned int bit)
 namespace mozilla {
 namespace gfx {
 
-// XXX - Need to define an API to set this.
-GFX2D_API int sGfxLogLevel = LOG_DEBUG;
+// These values we initialize with should match those in
+// PreferenceAccess::RegisterAll method.
+int32_t PreferenceAccess::sGfxLogLevel = LOG_DEFAULT;
+
+PreferenceAccess* PreferenceAccess::sAccess = nullptr;
+PreferenceAccess::~PreferenceAccess()
+{
+}
+
+// Just a placeholder, the derived class will set the variable to default
+// if the preference doesn't exist.
+void PreferenceAccess::LivePref(const char* aName, int32_t* aVar, int32_t aDef)
+{
+  *aVar = aDef;
+}
+
+// This will be called with the derived class, so we will want to register
+// the callbacks with it.
+void PreferenceAccess::SetAccess(PreferenceAccess* aAccess) {
+  sAccess = aAccess;
+  if (sAccess) {
+    RegisterAll();
+  }
+}
+
 
 #ifdef WIN32
 ID3D10Device1 *Factory::mD3D10Device;
diff --git a/gfx/2d/Logging.h b/gfx/2d/Logging.h
index b60ceba8b9ee..fe5eba63dcdd 100644
--- a/gfx/2d/Logging.h
+++ b/gfx/2d/Logging.h
@@ -44,6 +44,12 @@ const int LOG_DEBUG = 1;
 const int LOG_WARNING = 2;
 const int LOG_CRITICAL = 3;
 
+#if defined(DEBUG)
+const int LOG_DEFAULT = LOG_DEBUG;
+#else
+const int LOG_DEFAULT = LOG_CRITICAL;
+#endif
+
 #if defined(PR_LOGGING)
 
 inline PRLogModuleLevel PRLogLevelForLevel(int aLevel) {
@@ -52,19 +58,52 @@ inline PRLogModuleLevel PRLogLevelForLevel(int aLevel) {
     return PR_LOG_DEBUG;
   case LOG_WARNING:
     return PR_LOG_WARNING;
+  case LOG_CRITICAL:
+    return PR_LOG_ERROR;
   }
   return PR_LOG_DEBUG;
 }
 
 #endif
 
-extern GFX2D_API int sGfxLogLevel;
+class PreferenceAccess
+{
+public:
+  virtual ~PreferenceAccess();
+
+  // This should connect the variable aVar to be updated whenever a preference
+  // aName is modified.  aDefault would be used if the preference is undefined,
+  // so that we always get the valid value for aVar.
+  virtual void LivePref(const char* aName, int32_t* aVar, int32_t aDefault);
+
+public:
+  static void SetAccess(PreferenceAccess* aAccess);
+
+public:
+  // For each preference that needs to be accessed in Moz2D, add a variable
+  // to hold it, as well as the call to LivePref in the RegisterAll() method
+  // below.
+
+  // Used to choose the level of logging we get.  The higher the number,
+  // the less logging we get.  Value of zero will give you all the logging
+  // we have.  The default is LOG_DEBUG (1).
+  static int32_t sGfxLogLevel;
+
+private:
+  static void RegisterAll() {
+    // The default values (last parameter) should match the initialization
+    // values in Factory.cpp, otherwise the standalone Moz2D will get different
+    // defaults.
+    sAccess->LivePref("gfx.logging.level", &sGfxLogLevel, LOG_DEFAULT);
+  }
+  static PreferenceAccess* sAccess;
+};
 
 struct BasicLogger
 {
   static void OutputMessage(const std::string &aString, int aLevel) {
 #if defined(WIN32) && !defined(PR_LOGGING)
-    if (aLevel >= sGfxLogLevel) {
+    if (aLevel >= PreferenceAccess::sGfxLogLevel) {
       ::OutputDebugStringA(aString.c_str());
     }
 #elif defined(PR_LOGGING) && !(defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID))
@@ -72,7 +111,7 @@ struct BasicLogger
       PR_LogPrint(aString.c_str());
     }
 #else
-    if (aLevel >= sGfxLogLevel) {
+    if (aLevel >= PreferenceAccess::sGfxLogLevel) {
 #if defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID)
       printf_stderr("%s", aString.c_str());
 #else
diff --git a/gfx/thebes/gfxPrefs.cpp b/gfx/thebes/gfxPrefs.cpp
index 1e59820db37b..35ae12c54217 100644
--- a/gfx/thebes/gfxPrefs.cpp
+++ b/gfx/thebes/gfxPrefs.cpp
@@ -7,12 +7,31 @@
 
 #include "mozilla/Preferences.h"
 #include "MainThreadUtils.h"
+#include "mozilla/gfx/Logging.h"
 
 using namespace mozilla;
 
 gfxPrefs* gfxPrefs::sInstance = nullptr;
 bool gfxPrefs::sInstanceHasBeenDestroyed = false;
 
+class PreferenceAccessImpl : public mozilla::gfx::PreferenceAccess
+{
+public:
+  virtual ~PreferenceAccessImpl();
+  virtual void LivePref(const char* aName, int32_t* aVar, int32_t aDefault) MOZ_OVERRIDE;
+};
+
+PreferenceAccessImpl::~PreferenceAccessImpl()
+{
+}
+
+void PreferenceAccessImpl::LivePref(const char* aName,
+                                    int32_t* aVar,
+                                    int32_t aDefault)
+{
+  Preferences::AddIntVarCache(aVar, aName, aDefault);
+}
+
 void
 gfxPrefs::DestroySingleton()
 {
@@ -33,11 +52,19 @@ gfxPrefs::SingletonExists()
 gfxPrefs::gfxPrefs()
 {
   gfxPrefs::AssertMainThread();
+  mMoz2DPrefAccess = new PreferenceAccessImpl;
+  mozilla::gfx::PreferenceAccess::SetAccess(mMoz2DPrefAccess);
 }
 
 gfxPrefs::~gfxPrefs()
 {
   gfxPrefs::AssertMainThread();
+
+  // gfxPrefs is a singleton, we can reset this to null once
+  // it goes away.
+  mozilla::gfx::PreferenceAccess::SetAccess(nullptr);
+  delete mMoz2DPrefAccess;
+  mMoz2DPrefAccess = nullptr;
 }
 
 void gfxPrefs::AssertMainThread()
@@ -112,3 +139,4 @@ void gfxPrefs::PrefSet(const char* aPref, float aValue)
 {
   Preferences::SetFloat(aPref, aValue);
 }
+
diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
index 50c8940aaf42..d6e862351060 100644
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -68,9 +68,14 @@ static const char* Get##Name##PrefName() { return Pref; }                     \
 static Type Get##Name##PrefDefault() { return Default; }                      \
 PrefTemplate<UpdatePolicy::Update, Type, Get##Name##PrefDefault, Get##Name##PrefName> mPref##Name
 
+class PreferenceAccessImpl;
 class gfxPrefs;
 class gfxPrefs MOZ_FINAL
 {
+private:
+  /// See Logging.h.  This lets Moz2D access preference values it owns.
+  PreferenceAccessImpl* mMoz2DPrefAccess;
+
 private:
   // Enums for the update policy.
   MOZ_BEGIN_NESTED_ENUM_CLASS(UpdatePolicy)

From 7f44b60a595deb280c044e7dc2504c8d94a4e6b6 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Fri, 24 Oct 2014 13:54:23 -0400
Subject: [PATCH 61/84] Bug 1074952 - Part 2. gfxWarning() should be available
 in both debug and release builds. r=bas

---
 gfx/2d/gfx2d.vcxproj | 2 +-
 gfx/2d/moz.build     | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/gfx/2d/gfx2d.vcxproj b/gfx/2d/gfx2d.vcxproj
index f1af481bd6b2..746856a10ac5 100644
--- a/gfx/2d/gfx2d.vcxproj
+++ b/gfx/2d/gfx2d.vcxproj
@@ -62,7 +62,7 @@
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
-      <PreprocessorDefinitions>USE_SSE2;WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>USE_SSE2;WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions);GFX_LOG_WARNING</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
       <WarningLevel>Level3</WarningLevel>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
diff --git a/gfx/2d/moz.build b/gfx/2d/moz.build
index 162a31e3f01c..63aec6ad3afc 100644
--- a/gfx/2d/moz.build
+++ b/gfx/2d/moz.build
@@ -157,6 +157,13 @@ if CONFIG['MOZ_DEBUG']:
     DEFINES['GFX_LOG_DEBUG'] = True
     DEFINES['GFX_LOG_WARNING'] = True
 
+# Define the GFX_LOG_WARNING in release builds (available, but controlled by a
+# preference), though we may want to consider only doing it in the nightly
+# build, if the size of gfxWarning() code ends up making a difference.
+# See bug 1074952.
+# if CONFIG['NIGHTLY_BUILD']:
+DEFINES['GFX_LOG_WARNING'] = True
+
 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gtk2', 'gtk3', 'gonk', 'qt'):

From 1fa8d3a91b243116bde2ced95f6f183471de90a5 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Fri, 24 Oct 2014 13:54:26 -0400
Subject: [PATCH 62/84] Bug 1074952 - Part 3. Redo the const values and
 optimize for the case where we decide runtime not to log messages. Move the
 decision about newline to OutputMessage. Make [GFX#] the default automatic
 prefix. r=bschouten

---
 gfx/2d/Factory.cpp |   5 +-
 gfx/2d/Logging.h   | 255 +++++++++++++++++++++++++++++++++++----------
 2 files changed, 203 insertions(+), 57 deletions(-)

diff --git a/gfx/2d/Factory.cpp b/gfx/2d/Factory.cpp
index 9e5da4512e98..daf64426d828 100644
--- a/gfx/2d/Factory.cpp
+++ b/gfx/2d/Factory.cpp
@@ -818,13 +818,14 @@ Factory::SetLogForwarder(LogForwarder* aLogFwd) {
 
 // static
 void
-CriticalLogger::OutputMessage(const std::string &aString, int aLevel)
+CriticalLogger::OutputMessage(const std::string &aString,
+                              int aLevel, bool aNoNewline)
 {
   if (Factory::GetLogForwarder()) {
     Factory::GetLogForwarder()->Log(aString);
   }
 
-  BasicLogger::OutputMessage(aString, aLevel);
+  BasicLogger::OutputMessage(aString, aLevel, aNoNewline);
 }
 
 }
diff --git a/gfx/2d/Logging.h b/gfx/2d/Logging.h
index fe5eba63dcdd..a6b543781286 100644
--- a/gfx/2d/Logging.h
+++ b/gfx/2d/Logging.h
@@ -40,12 +40,17 @@ extern GFX2D_API PRLogModuleInfo *GetGFX2DLog();
 namespace mozilla {
 namespace gfx {
 
-const int LOG_DEBUG = 1;
+// Attempting to be consistent with prlog values, but that isn't critical
+// (and note that 5 has a special meaning - see the description
+// with sGfxLogLevel)
+const int LOG_CRITICAL = 1;
 const int LOG_WARNING = 2;
-const int LOG_CRITICAL = 3;
+const int LOG_DEBUG = 3;
+const int LOG_DEBUG_PRLOG = 4;
+const int LOG_EVERYTHING = 5; // This needs to be the highest value
 
 #if defined(DEBUG)
-const int LOG_DEFAULT = LOG_DEBUG;
+const int LOG_DEFAULT = LOG_EVERYTHING;
 #else
 const int LOG_DEFAULT = LOG_CRITICAL;
 #endif
@@ -54,12 +59,16 @@ const int LOG_DEFAULT = LOG_CRITICAL;
 
 inline PRLogModuleLevel PRLogLevelForLevel(int aLevel) {
   switch (aLevel) {
-  case LOG_DEBUG:
-    return PR_LOG_DEBUG;
-  case LOG_WARNING:
-    return PR_LOG_WARNING;
   case LOG_CRITICAL:
     return PR_LOG_ERROR;
+  case LOG_WARNING:
+    return PR_LOG_WARNING;
+  case LOG_DEBUG:
+    return PR_LOG_DEBUG;
+  case LOG_DEBUG_PRLOG:
+    return PR_LOG_DEBUG;
+  case LOG_EVERYTHING:
+    return PR_LOG_ALWAYS;
   }
   return PR_LOG_DEBUG;
 }
@@ -85,8 +94,12 @@ public:
   // below.
 
   // Used to choose the level of logging we get.  The higher the number,
-  // the less logging we get.  Value of zero will give you all the logging
-  // we have.  The default is LOG_DEBUG (1).
+  // the more logging we get.  Value of zero will give you no logging,
+  // 1 just errors, 2 adds warnings and 3 adds logging/debug.  4 is used to
+  // selectively enable logging on the configurations that
+  // support prlog (on other systems, 3 and 4 are the same.)  For prlog,
+  // in addition to setting the value to 4, you will need to set an
+  // environment variable NSPR_LOG_MODULES to gfx:4. See prlog.h for details.
   static int32_t sGfxLogLevel;
 
 private:
@@ -101,29 +114,62 @@ private:
 
 struct BasicLogger
 {
-  static void OutputMessage(const std::string &aString, int aLevel) {
+  // For efficiency, this method exists and copies the logic of the
+  // OutputMessage below.  If making any changes here, also make it
+  // in the appropriate places in that method.
+  static bool ShouldOutputMessage(int aLevel) {
+    if (PreferenceAccess::sGfxLogLevel >= aLevel) {
 #if defined(WIN32) && !defined(PR_LOGGING)
-    if (aLevel >= PreferenceAccess::sGfxLogLevel) {
-      ::OutputDebugStringA(aString.c_str());
-    }
-#elif defined(PR_LOGGING) && !(defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID))
-    if (PR_LOG_TEST(GetGFX2DLog(), PRLogLevelForLevel(aLevel))) {
-      PR_LogPrint(aString.c_str());
-    }
+      return true;
+#elif defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID)
+      return true;
+#elif defined(PR_LOGGING)
+      if (PR_LOG_TEST(GetGFX2DLog(), PRLogLevelForLevel(aLevel))) {
+        return true;
+      } else if ((PreferenceAccess::sGfxLogLevel >= LOG_DEBUG_PRLOG) ||
+                 (aLevel < LOG_DEBUG)) {
+        return true;
+      }
 #else
-    if (aLevel >= PreferenceAccess::sGfxLogLevel) {
-#if defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID)
-      printf_stderr("%s", aString.c_str());
-#else
-      printf("%s", aString.c_str());
+      return true;
 #endif
     }
+    return false;
+  }
+
+  static void OutputMessage(const std::string &aString,
+                            int aLevel,
+                            bool aNoNewline) {
+    // This behavior (the higher the preference, the more we log)
+    // is consistent with what prlog does in general.  Note that if prlog
+    // is in the build, but disabled, we will printf if the preferences
+    // requires us to log something (see sGfxLogLevel for the special
+    // treatment of LOG_DEBUG and LOG_DEBUG_PRLOG)
+    //
+    // If making any logic changes to this method, you should probably
+    // make the corresponding change in the ShouldOutputMessage method
+    // above.
+    if (PreferenceAccess::sGfxLogLevel >= aLevel) {
+#if defined(WIN32) && !defined(PR_LOGGING)
+      ::OutputDebugStringA((aNoNewline ? aString : aString+"\n").c_str());
+#elif defined(MOZ_WIDGET_GONK) || defined(MOZ_WIDGET_ANDROID)
+      printf_stderr("%s%s", aString.c_str(), aNoNewline ? "" : "\n");
+#elif defined(PR_LOGGING)
+      if (PR_LOG_TEST(GetGFX2DLog(), PRLogLevelForLevel(aLevel))) {
+        PR_LogPrint("%s%s", aString.c_str(), aNoNewline ? "" : "\n");
+      } else if ((PreferenceAccess::sGfxLogLevel >= LOG_DEBUG_PRLOG) ||
+                 (aLevel < LOG_DEBUG)) {
+        printf("%s%s", aString.c_str(), aNoNewline ? "" : "\n");
+      }
+#else
+      printf("%s%s", aString.c_str(), aNoNewline ? "" : "\n");
 #endif
+    }
   }
 };
 
 struct CriticalLogger {
-  static void OutputMessage(const std::string &aString, int aLevel);
+  static void OutputMessage(const std::string &aString, int aLevel, bool aNoNewline);
 };
 
 // Implement this interface and init the Factory with an instance to
@@ -145,7 +191,8 @@ public:
 };
 
 MOZ_BEGIN_ENUM_CLASS(LogOptions, int)
-  NoNewline = 0x01
+  NoNewline = 0x01,
+  AutoPrefix = 0x02
 MOZ_END_ENUM_CLASS(LogOptions)
 
 template<typename T>
@@ -160,58 +207,156 @@ template<int L, typename Logger = BasicLogger>
 class Log
 {
 public:
-  explicit Log(LogOptions aOptions = LogOptions(0)) : mOptions(aOptions) {}
+  explicit Log(int aOptions = (int)LogOptions::AutoPrefix)
+    : mOptions(aOptions)
+    , mLogIt(BasicLogger::ShouldOutputMessage(L))
+  {
+    if (mLogIt && AutoPrefix()) {
+      mMessage << "[GFX" << L << "]: ";
+    }
+  }
   ~Log() {
     Flush();
   }
 
   void Flush() {
-    if (!(int(mOptions) & int(LogOptions::NoNewline))) {
-      mMessage << '\n';
-    }
+    if (MOZ_LIKELY(!LogIt())) return;
+
     std::string str = mMessage.str();
     if (!str.empty()) {
       WriteLog(str);
     }
-    mMessage.str("");
+    if (AutoPrefix()) {
+      mMessage.str("[GFX");
+      mMessage << L << "]: ";
+    } else {
+      mMessage.str("");
+    }
     mMessage.clear();
   }
 
-  Log &operator <<(char aChar) { mMessage << aChar; return *this; }
-  Log &operator <<(const std::string &aLogText) { mMessage << aLogText; return *this; }
-  Log &operator <<(const char aStr[]) { mMessage << static_cast<const char*>(aStr); return *this; }
-  Log &operator <<(bool aBool) { mMessage << (aBool ? "true" : "false"); return *this; }
-  Log &operator <<(int aInt) { mMessage << aInt; return *this; }
-  Log &operator <<(unsigned int aInt) { mMessage << aInt; return *this; }
-  Log &operator <<(long aLong) { mMessage << aLong; return *this; }
-  Log &operator <<(unsigned long aLong) { mMessage << aLong; return *this; }
-  Log &operator <<(long long aLong) { mMessage << aLong; return *this; }
-  Log &operator <<(unsigned long long aLong) { mMessage << aLong; return *this; }
-  Log &operator <<(Float aFloat) { mMessage << aFloat; return *this; }
-  Log &operator <<(double aDouble) { mMessage << aDouble; return *this; }
+  Log &operator <<(char aChar) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aChar;
+    }
+    return *this;
+  }
+  Log &operator <<(const std::string &aLogText) { 
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aLogText;
+    }
+    return *this;
+  }
+  Log &operator <<(const char aStr[]) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << static_cast<const char*>(aStr);
+    }
+    return *this;
+  }
+  Log &operator <<(bool aBool) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << (aBool ? "true" : "false");
+    }
+    return *this;
+  }
+  Log &operator <<(int aInt) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aInt;
+    }
+    return *this;
+  }
+  Log &operator <<(unsigned int aInt) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aInt;
+    }
+    return *this;
+  }
+  Log &operator <<(long aLong) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aLong;
+    }
+    return *this;
+  }
+  Log &operator <<(unsigned long aLong) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aLong;
+    }
+    return *this;
+  }
+  Log &operator <<(long long aLong) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aLong;
+    }
+    return *this;
+  }
+  Log &operator <<(unsigned long long aLong) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aLong;
+    }
+    return *this;
+  }
+  Log &operator <<(Float aFloat) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aFloat;
+    }
+    return *this;
+  }
+  Log &operator <<(double aDouble) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << aDouble;
+    }
+    return *this;
+  }
   template <typename T, typename Sub, typename Coord>
-  Log &operator <<(const BasePoint<T, Sub, Coord>& aPoint)
-    { mMessage << "Point" << aPoint; return *this; }
+  Log &operator <<(const BasePoint<T, Sub, Coord>& aPoint) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << "Point" << aPoint;
+    }
+    return *this;
+  }
   template <typename T, typename Sub>
-  Log &operator <<(const BaseSize<T, Sub>& aSize)
-    { mMessage << "Size(" << aSize.width << "," << aSize.height << ")"; return *this; }
+  Log &operator <<(const BaseSize<T, Sub>& aSize) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << "Size(" << aSize.width << "," << aSize.height << ")";
+    }
+    return *this;
+  }
   template <typename T, typename Sub, typename Point, typename SizeT, typename Margin>
-  Log &operator <<(const BaseRect<T, Sub, Point, SizeT, Margin>& aRect)
-    { mMessage << "Rect" << aRect; return *this; }
-  Log &operator<<(const Matrix& aMatrix)
-    { mMessage << "Matrix(" << aMatrix._11 << " " << aMatrix._12 << " ; " << aMatrix._21 << " " << aMatrix._22 << " ; " << aMatrix._31 << " " << aMatrix._32 << ")"; return *this; }
+  Log &operator <<(const BaseRect<T, Sub, Point, SizeT, Margin>& aRect) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << "Rect" << aRect;
+    }
+    return *this;
+  }
+  Log &operator<<(const Matrix& aMatrix) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << "Matrix(" << aMatrix._11 << " " << aMatrix._12 << " ; " << aMatrix._21 << " " << aMatrix._22 << " ; " << aMatrix._31 << " " << aMatrix._32 << ")";
+    }
+    return *this;
+  }
   template<typename T>
-  Log &operator<<(Hexa<T> aHex)
-    { mMessage << "0x" << std::hex << aHex.mVal << std::dec; return *this; }
+  Log &operator<<(Hexa<T> aHex) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      mMessage << "0x" << std::hex << aHex.mVal << std::dec;
+    }
+    return *this;
+  }
+
+  inline bool LogIt() const { return mLogIt; }
+  inline bool NoNewline() const { return mOptions & int(LogOptions::NoNewline); }
+  inline bool AutoPrefix() const { return mOptions & int(LogOptions::AutoPrefix); }
+
 
 private:
-
   void WriteLog(const std::string &aString) {
-    Logger::OutputMessage(aString, L);
+    if (MOZ_UNLIKELY(LogIt())) {
+      Logger::OutputMessage(aString, L, NoNewline());
+    }
   }
 
   std::stringstream mMessage;
-  LogOptions mOptions;
+  int mOptions;
+  bool mLogIt;
 };
 
 typedef Log<LOG_DEBUG> DebugLog;
@@ -257,7 +402,7 @@ class TreeLog
 {
 public:
   explicit TreeLog(const std::string& aPrefix = "")
-        : mLog(LogOptions::NoNewline),
+        : mLog(int(LogOptions::NoNewline)),
           mPrefix(aPrefix),
           mDepth(0),
           mStartOfLine(true),

From de11f7eed9f1d735d47ddc99b77d41e6b06dd5b1 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Mon, 17 Nov 2014 17:16:55 -0500
Subject: [PATCH 63/84] Bug 1074952 - Part 4. For the critical log, save the
 first, then circular buffer the rest into the crash annotations. r=bas

---
 gfx/thebes/gfxPlatform.cpp | 112 +++++++++++++++++++++++++++++++++----
 gfx/thebes/gfxPrefs.h      |   2 +
 2 files changed, 102 insertions(+), 12 deletions(-)

diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index a542568d4765..0202e1aa5b59 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -11,6 +11,7 @@
 #include "mozilla/layers/ISurfaceAllocator.h"     // for GfxMemoryImageReporter
 
 #include "prlog.h"
+#include "prprf.h"
 
 #include "gfxPlatform.h"
 #include "gfxPrefs.h"
@@ -152,22 +153,103 @@ public:
     NS_DECL_NSIOBSERVER
 };
 
+/// This override of the LogForwarder, initially used for the critical graphics
+/// errors, is sending the log to the crash annotations as well, but only
+/// if the capacity set with the method below is >= 2.  We always retain the
+/// very first critical message, and the latest capacity-1 messages are
+/// rotated through. Note that we don't expect the total number of times
+/// this gets called to be large - it is meant for critical errors only.
+
 class CrashStatsLogForwarder: public mozilla::gfx::LogForwarder
 {
 public:
-    virtual void Log(const std::string& aString) MOZ_OVERRIDE {
-        if (!NS_IsMainThread()) {
-            return;
-        }
-#ifdef MOZ_CRASHREPORTER
-        nsCString reportString(aString.c_str());
-        CrashReporter::AppendAppNotesToCrashReport(reportString);
-#else
-        printf("GFX ERROR: %s", aString.c_str());
-#endif
-    }
+  CrashStatsLogForwarder(const char* aKey);
+  virtual void Log(const std::string& aString) MOZ_OVERRIDE;
+
+  void SetCircularBufferSize(uint32_t aCapacity);
+
+private:
+  // Helpers for the Log()
+  bool UpdateStringsVector(const std::string& aString);
+  void UpdateCrashReport();
+
+private:
+  std::vector<std::pair<int32_t,std::string> > mBuffer;
+  nsCString mCrashCriticalKey;
+  uint32_t mMaxCapacity;
+  int32_t mIndex;
 };
 
+CrashStatsLogForwarder::CrashStatsLogForwarder(const char* aKey)
+  : mBuffer()
+  , mCrashCriticalKey(aKey)
+  , mMaxCapacity(0)
+  , mIndex(-1)
+{
+}
+
+void CrashStatsLogForwarder::SetCircularBufferSize(uint32_t aCapacity)
+{
+  mMaxCapacity = aCapacity;
+  mBuffer.reserve(static_cast<size_t>(aCapacity));
+}
+
+bool
+CrashStatsLogForwarder::UpdateStringsVector(const std::string& aString)
+{
+  // We want at least the first one and the last one.  Otherwise, no point.
+  if (mMaxCapacity < 2) {
+    return false;
+  }
+
+  mIndex += 1;
+  MOZ_ASSERT(mIndex >= 0);
+
+  // index will count 0, 1, 2, ..., max-1, 1, 2, ..., max-1, 1, 2, ...
+  int32_t index = mIndex ? (mIndex-1) % (mMaxCapacity-1) + 1 : 0;
+  MOZ_ASSERT(index >= 0 && index < (int32_t)mMaxCapacity);
+  MOZ_ASSERT(index <= mIndex && index <= (int32_t)mBuffer.size());
+
+  // Checking for index >= mBuffer.size(), rather than index == mBuffer.size()
+  // just out of paranoia, but we know index <= mBuffer.size().
+  std::pair<int32_t,std::string> newEntry(mIndex,aString);
+  if (index >= static_cast<int32_t>(mBuffer.size())) {
+    mBuffer.push_back(newEntry);
+  } else {
+    mBuffer[index] = newEntry;
+  }
+  return true;
+}
+
+void CrashStatsLogForwarder::UpdateCrashReport()
+{
+  std::stringstream message;
+  for(std::vector<std::pair<int32_t, std::string> >::iterator it = mBuffer.begin(); it != mBuffer.end(); ++it) {
+    message << "|[" << (*it).first << "]" << (*it).second;
+  }
+
+#ifdef MOZ_CRASHREPORTER
+  if (!NS_IsMainThread()) {
+    return;
+  }
+  nsCString reportString(message.str().c_str());
+  nsresult annotated = CrashReporter::AnnotateCrashReport(mCrashCriticalKey, reportString);
+#else
+  nsresult annotated = NS_ERROR_NOT_IMPLEMENTED;
+#endif
+  if (annotated != NS_OK) {
+    printf("Crash Annotation %s: %s",
+           mCrashCriticalKey.get(), message.str().c_str());
+  }
+}
+  
+void CrashStatsLogForwarder::Log(const std::string& aString)
+{
+  if (UpdateStringsVector(aString)) {
+    UpdateCrashReport();
+  }
+}
+
 NS_IMPL_ISUPPORTS(SRGBOverrideObserver, nsIObserver, nsISupportsWeakReference)
 
 #define GFX_DOWNLOADABLE_FONTS_ENABLED "gfx.downloadable_fonts.enabled"
@@ -358,11 +440,14 @@ gfxPlatform::Init()
     }
     gEverInitialized = true;
 
-    mozilla::gfx::Factory::SetLogForwarder(new CrashStatsLogForwarder);
+    CrashStatsLogForwarder* logForwarder = new CrashStatsLogForwarder("GraphicsCriticalError");
+    mozilla::gfx::Factory::SetLogForwarder(logForwarder);
 
     // Initialize the preferences by creating the singleton.
     gfxPrefs::GetSingleton();
 
+    logForwarder->SetCircularBufferSize(gfxPrefs::GfxLoggingCrashLength());
+
     gGfxPlatformPrefsLock = new Mutex("gfxPlatform::gGfxPlatformPrefsLock");
 
     /* Initialize the GfxInfo service.
@@ -530,6 +615,9 @@ gfxPlatform::Shutdown()
     mozilla::gl::GLContextProviderEGL::Shutdown();
 #endif
 
+    // This is a bit iffy - we're assuming that we were the ones that set the
+    // log forwarder in the Factory, so that it's our responsibility to 
+    // delete it.
     delete mozilla::gfx::Factory::GetLogForwarder();
     mozilla::gfx::Factory::SetLogForwarder(nullptr);
 
diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
index d6e862351060..cce19600b322 100644
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -209,6 +209,8 @@ private:
   DECL_GFX_PREF(Live, "gfx.gralloc.fence-with-readpixels",     GrallocFenceWithReadPixels, bool, false);
   DECL_GFX_PREF(Live, "gfx.layerscope.enabled",                LayerScopeEnabled, bool, false);
   DECL_GFX_PREF(Live, "gfx.layerscope.port",                   LayerScopePort, int32_t, 23456);
+  // Note that        "gfx.logging.level" is defined in Logging.h
+  DECL_GFX_PREF(Once, "gfx.logging.crash.length",              GfxLoggingCrashLength, uint32_t, 6);
   DECL_GFX_PREF(Live, "gfx.perf-warnings.enabled",             PerfWarnings, bool, false);
   DECL_GFX_PREF(Once, "gfx.work-around-driver-bugs",           WorkAroundDriverBugs, bool, true);
 

From 1d0aad208e72ae4e67aec21e57a70837aca262c3 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Thu, 13 Nov 2014 14:52:05 -0500
Subject: [PATCH 64/84] Bug 1074952 - Part 5. Let the CrashReporter decide what
 threading combination is allowed. r=nsilva

---
 gfx/thebes/gfxPlatform.cpp | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 0202e1aa5b59..5e299bc2a2ab 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -229,9 +229,6 @@ void CrashStatsLogForwarder::UpdateCrashReport()
   }
 
 #ifdef MOZ_CRASHREPORTER
-  if (!NS_IsMainThread()) {
-    return;
-  }
   nsCString reportString(message.str().c_str());
   nsresult annotated = CrashReporter::AnnotateCrashReport(mCrashCriticalKey, reportString);
 #else

From d19b0d26a256fc52fc90a8f819d0056934277276 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Tue, 18 Nov 2014 10:51:39 -0500
Subject: [PATCH 65/84] Bug 1074952 - Part 6. Fully qualify the appropriate
 logs in the logging macros, otherwise we can't call these from other
 namespaces. An example in non-gfx/2d where it would not have worked without
 this change. r=botond

---
 gfx/2d/Logging.h                        | 10 +++++-----
 gfx/layers/client/TextureClientPool.cpp |  3 +++
 gfx/layers/d3d11/TextureD3D11.cpp       |  4 ++--
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/gfx/2d/Logging.h b/gfx/2d/Logging.h
index a6b543781286..7a296fa8af0c 100644
--- a/gfx/2d/Logging.h
+++ b/gfx/2d/Logging.h
@@ -364,18 +364,18 @@ typedef Log<LOG_WARNING> WarningLog;
 typedef Log<LOG_CRITICAL, CriticalLogger> CriticalLog;
 
 #ifdef GFX_LOG_DEBUG
-#define gfxDebug DebugLog
+#define gfxDebug mozilla::gfx::DebugLog
 #else
-#define gfxDebug if (1) ; else NoLog
+#define gfxDebug if (1) ; else mozilla::gfx::NoLog
 #endif
 #ifdef GFX_LOG_WARNING
-#define gfxWarning WarningLog
+#define gfxWarning mozilla::gfx::WarningLog
 #else
-#define gfxWarning if (1) ; else NoLog
+#define gfxWarning if (1) ; else mozilla::gfx::NoLog
 #endif
 
 // This log goes into crash reports, use with care.
-#define gfxCriticalError CriticalLog
+#define gfxCriticalError mozilla::gfx::CriticalLog
 
 // See nsDebug.h and the NS_WARN_IF macro
 
diff --git a/gfx/layers/client/TextureClientPool.cpp b/gfx/layers/client/TextureClientPool.cpp
index 297018de45ca..796b7f57e23e 100644
--- a/gfx/layers/client/TextureClientPool.cpp
+++ b/gfx/layers/client/TextureClientPool.cpp
@@ -32,6 +32,9 @@ TextureClientPool::TextureClientPool(gfx::SurfaceFormat aFormat, gfx::IntSize aS
   , mSurfaceAllocator(aAllocator)
 {
   mTimer = do_CreateInstance("@mozilla.org/timer;1");
+  if (aFormat == gfx::SurfaceFormat::UNKNOWN) {
+    gfxWarning() << "Creating texture pool for SurfaceFormat::UNKNOWN format";
+  }
 }
 
 TextureClientPool::~TextureClientPool()
diff --git a/gfx/layers/d3d11/TextureD3D11.cpp b/gfx/layers/d3d11/TextureD3D11.cpp
index d7477b85e4a8..3e38210fc874 100644
--- a/gfx/layers/d3d11/TextureD3D11.cpp
+++ b/gfx/layers/d3d11/TextureD3D11.cpp
@@ -288,7 +288,7 @@ TextureClientD3D11::Unlock()
     HRESULT hr = device->CreateTexture2D(&desc, nullptr, byRef(tex));
 
     if (FAILED(hr)) {
-      gfx::gfxCriticalError() << "[D3D11] CreateTexture2D failure " << mSize << " Code: " << gfx::hexa(hr);
+      gfxCriticalError() << "[D3D11] CreateTexture2D failure " << mSize << " Code: " << gfx::hexa(hr);
       return;
     }
 
@@ -375,7 +375,7 @@ TextureClientD3D11::AllocateForSurface(gfx::IntSize aSize, TextureAllocationFlag
   }
 
   if (FAILED(hr)) {
-    gfx::gfxCriticalError() << "[D3D11] CreateTexture2D failure " << aSize << " Code: " << gfx::hexa(hr);
+    gfxCriticalError() << "[D3D11] CreateTexture2D failure " << aSize << " Code: " << gfx::hexa(hr);
     return false;
   }
 

From 730dbf410b1961ba61da64a6a892aa2519c49b8a Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Tue, 11 Nov 2014 16:09:35 -0500
Subject: [PATCH 66/84] Bug 1074952 - Part 7. Add a logging support for a
 couple of common Moz2d enums. r=bschouten

---
 gfx/2d/Logging.h | 82 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/gfx/2d/Logging.h b/gfx/2d/Logging.h
index 7a296fa8af0c..e8f6445ca7f7 100644
--- a/gfx/2d/Logging.h
+++ b/gfx/2d/Logging.h
@@ -342,6 +342,88 @@ public:
     return *this;
   }
 
+  Log& operator<<(SurfaceFormat aFormat) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      switch(aFormat) {
+        case SurfaceFormat::B8G8R8A8:
+          mMessage << "SurfaceFormat::B8G8R8A8";
+          break;
+        case SurfaceFormat::B8G8R8X8:
+          mMessage << "SurfaceFormat::B8G8R8X8";
+          break;
+        case SurfaceFormat::R8G8B8A8:
+          mMessage << "SurfaceFormat::R8G8B8A8";
+          break;
+        case SurfaceFormat::R8G8B8X8:
+          mMessage << "SurfaceFormat::R8G8B8X8";
+          break;
+        case SurfaceFormat::R5G6B5:
+          mMessage << "SurfaceFormat::R5G6B5";
+          break;
+        case SurfaceFormat::A8:
+          mMessage << "SurfaceFormat::A8";
+          break;
+        case SurfaceFormat::YUV:
+          mMessage << "SurfaceFormat::YUV";
+          break;
+        case SurfaceFormat::UNKNOWN:
+          mMessage << "SurfaceFormat::UNKNOWN";
+          break;
+        default:
+          mMessage << "Invalid SurfaceFormat (" << (int)aFormat << ")";
+          break;
+      }
+    }
+    return *this;
+  }
+
+  Log& operator<<(SurfaceType aType) {
+    if (MOZ_UNLIKELY(LogIt())) {
+      switch(aType) {
+        case SurfaceType::DATA:
+          mMessage << "SurfaceType::DATA";
+          break;
+        case SurfaceType::D2D1_BITMAP:
+          mMessage << "SurfaceType::D2D1_BITMAP";
+          break;
+        case SurfaceType::D2D1_DRAWTARGET:
+          mMessage << "SurfaceType::D2D1_DRAWTARGET";
+          break;
+        case SurfaceType::CAIRO:
+          mMessage << "SurfaceType::CAIRO";
+          break;
+        case SurfaceType::CAIRO_IMAGE:
+          mMessage << "SurfaceType::CAIRO_IMAGE";
+          break;
+        case SurfaceType::COREGRAPHICS_IMAGE:
+          mMessage << "SurfaceType::COREGRAPHICS_IMAGE";
+          break;
+        case SurfaceType::COREGRAPHICS_CGCONTEXT:
+          mMessage << "SurfaceType::COREGRAPHICS_CGCONTEXT";
+          break;
+        case SurfaceType::SKIA:
+          mMessage << "SurfaceType::SKIA";
+          break;
+        case SurfaceType::DUAL_DT:
+          mMessage << "SurfaceType::DUAL_DT";
+          break;
+        case SurfaceType::D2D1_1_IMAGE:
+          mMessage << "SurfaceType::D2D1_1_IMAGE";
+          break;
+        case SurfaceType::RECORDING:
+          mMessage << "SurfaceType::RECORDING";
+          break;
+        case SurfaceType::TILED:
+          mMessage << "SurfaceType::TILED";
+          break;
+        default:
+          mMessage << "Invalid SurfaceType (" << (int)aType << ")";
+          break;
+      }
+    }
+    return *this;
+  }
+
   inline bool LogIt() const { return mLogIt; }
   inline bool NoNewline() const { return mOptions & int(LogOptions::NoNewline); }
   inline bool AutoPrefix() const { return mOptions & int(LogOptions::AutoPrefix); }

From 53c1e0eefb060c01728ef3702f7485ebb046a4a2 Mon Sep 17 00:00:00 2001
From: James Kitchener <jkitch.bug@internode.on.net>
Date: Sun, 16 Nov 2014 04:44:00 +0100
Subject: [PATCH 67/84] Bug 1002526 - Execute dynamic code only once in
 reftest. r=fred

---
 layout/reftests/mathml/font-inflation-1.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/mathml/font-inflation-1.html b/layout/reftests/mathml/font-inflation-1.html
index 6e52dd19b7ea..caa5fa4296eb 100644
--- a/layout/reftests/mathml/font-inflation-1.html
+++ b/layout/reftests/mathml/font-inflation-1.html
@@ -48,7 +48,7 @@
       window.addEventListener("MozReftestInvalidate", verifySizes, false);
     </script>
   </head>
-  <body onload="verifySizes()">
+  <body>
 
 <p>The text
 '<math>

From 312667013f06db43b8b3085863a43c9763a7269c Mon Sep 17 00:00:00 2001
From: Tom Tromey <tom@tromey.com>
Date: Wed, 12 Nov 2014 08:11:00 +0100
Subject: [PATCH 68/84] Bug 1097731 - emit using declarations for infallible
 convenience methods. r=nfroyd

---
 xpcom/idl-parser/header.py | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/xpcom/idl-parser/header.py b/xpcom/idl-parser/header.py
index 49b80b921dfb..7c1ed9161296 100644
--- a/xpcom/idl-parser/header.py
+++ b/xpcom/idl-parser/header.py
@@ -400,6 +400,8 @@ def write_interface(iface, fd):
 
     for member in iface.members:
         if isinstance(member, xpidl.Attribute):
+            if member.infallible:
+                fd.write("\\\n  using %s::%s; " % (iface.name, attributeNativeName(member, True)))
             fd.write("\\\n  %s MOZ_OVERRIDE; " % attributeAsNative(member, True))
             if not member.readonly:
                 fd.write("\\\n  %s MOZ_OVERRIDE; " % attributeAsNative(member, False))
@@ -412,11 +414,13 @@ def write_interface(iface, fd):
 
     fd.write(iface_forward % names)
 
-    def emitTemplate(tmpl, tmpl_notxpcom=None):
+    def emitTemplate(forward_infallible, tmpl, tmpl_notxpcom=None):
         if tmpl_notxpcom == None:
             tmpl_notxpcom = tmpl
         for member in iface.members:
             if isinstance(member, xpidl.Attribute):
+                if forward_infallible and member.infallible:
+                    fd.write("\\\n  using %s::%s; " % (iface.name, attributeNativeName(member, True)))
                 fd.write(tmpl % {'asNative': attributeAsNative(member, True),
                                  'nativeName': attributeNativeName(member, True),
                                  'paramList': attributeParamNames(member)})
@@ -438,14 +442,16 @@ def write_interface(iface, fd):
         elif not member.kind in ('attribute', 'method'):
             fd.write('\\')
 
-    emitTemplate("\\\n  %(asNative)s MOZ_OVERRIDE { return _to %(nativeName)s(%(paramList)s); } ")
+    emitTemplate(True,
+                 "\\\n  %(asNative)s MOZ_OVERRIDE { return _to %(nativeName)s(%(paramList)s); } ")
 
     fd.write(iface_forward_safe % names)
 
     # Don't try to safely forward notxpcom functions, because we have no
     # sensible default error return.  Instead, the caller will have to
     # implement them.
-    emitTemplate("\\\n  %(asNative)s MOZ_OVERRIDE { return !_to ? NS_ERROR_NULL_POINTER : _to->%(nativeName)s(%(paramList)s); } ",
+    emitTemplate(False,
+                 "\\\n  %(asNative)s MOZ_OVERRIDE { return !_to ? NS_ERROR_NULL_POINTER : _to->%(nativeName)s(%(paramList)s); } ",
                  "\\\n  %(asNative)s MOZ_OVERRIDE; ")
 
     fd.write(iface_template_prolog % names)

From 74e49d7ff31d764989198452a3267b4d36373571 Mon Sep 17 00:00:00 2001
From: Lebedev Maksim <Alessarik@gmail.com>
Date: Tue, 18 Nov 2014 01:13:00 +0100
Subject: [PATCH 69/84] Bug 1098139 - Add attribute isPrimary detection for
 got/lostpointercapture events. r=smaug

---
 dom/base/nsDOMWindowUtils.cpp                 |  2 +-
 layout/base/nsIPresShell.h                    | 23 ++++++---
 layout/base/nsPresShell.cpp                   | 48 +++++++++++++------
 layout/base/tests/bug977003_inner_1.html      | 10 +++-
 layout/base/tests/bug977003_inner_5.html      | 16 +++++--
 .../mochitest/tests/SimpleTest/EventUtils.js  |  3 +-
 6 files changed, 73 insertions(+), 29 deletions(-)

diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 325837923ad7..98c2bd9634a2 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -866,7 +866,7 @@ nsDOMWindowUtils::SendPointerEventCommon(const nsAString& aType,
   event.height = aHeight;
   event.tiltX = aTiltX;
   event.tiltY = aTiltY;
-  event.isPrimary = aIsPrimary;
+  event.isPrimary = (nsIDOMMouseEvent::MOZ_SOURCE_MOUSE == aInputSourceArg) ? true : aIsPrimary;
   event.clickCount = aClickCount;
   event.time = PR_IntervalNow();
   event.mFlags.mIsSynthesizedForTests = aOptionalArgCount >= 10 ? aIsSynthesized : true;
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index e256da2dd6f0..d55e536f685c 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -1253,9 +1253,10 @@ public:
     nsCOMPtr<nsIContent> mPendingContent;
     nsCOMPtr<nsIContent> mOverrideContent;
     bool                 mReleaseContent;
+    bool                 mPrimaryState;
     
-    explicit PointerCaptureInfo(nsIContent* aPendingContent) :
-      mPendingContent(aPendingContent), mReleaseContent(false)
+    explicit PointerCaptureInfo(nsIContent* aPendingContent, bool aPrimaryState) :
+      mPendingContent(aPendingContent), mReleaseContent(false), mPrimaryState(aPrimaryState)
     {
       MOZ_COUNT_CTOR(PointerCaptureInfo);
     }
@@ -1273,27 +1274,29 @@ public:
   // Keeps a map between pointerId and element that currently capturing pointer
   // with such pointerId. If pointerId is absent in this map then nobody is
   // capturing it. Additionally keep information about pending capturing content.
+  // Additionally keep information about primaryState of pointer event.
   static nsClassHashtable<nsUint32HashKey, PointerCaptureInfo>* gPointerCaptureList;
 
   struct PointerInfo
   {
     bool      mActiveState;
     uint16_t  mPointerType;
-    PointerInfo(bool aActiveState, uint16_t aPointerType) :
-      mActiveState(aActiveState), mPointerType(aPointerType) {}
+    bool      mPrimaryState;
+    PointerInfo(bool aActiveState, uint16_t aPointerType, bool aPrimaryState) :
+      mActiveState(aActiveState), mPointerType(aPointerType), mPrimaryState(aPrimaryState) {}
   };
-  // Keeps information about pointers such as pointerId, activeState, pointerType
+  // Keeps information about pointers such as pointerId, activeState, pointerType, primaryState
   static nsClassHashtable<nsUint32HashKey, PointerInfo>* gActivePointersIds;
 
   static void DispatchGotOrLostPointerCaptureEvent(bool aIsGotCapture,
                                                    uint32_t aPointerId,
                                                    uint16_t aPointerType,
+                                                   bool aIsPrimary,
                                                    nsIContent* aCaptureTarget);
   static void SetPointerCapturingContent(uint32_t aPointerId, nsIContent* aContent);
   static void ReleasePointerCapturingContent(uint32_t aPointerId, nsIContent* aContent);
   static nsIContent* GetPointerCapturingContent(uint32_t aPointerId);
-  static uint16_t GetPointerType(uint32_t aPointerId);
-  
+
   // CheckPointerCaptureState checks cases, when got/lostpointercapture events should be fired.
   // Function returns true, if any of events was fired; false, if no one event was fired.
   static bool CheckPointerCaptureState(uint32_t aPointerId);
@@ -1302,6 +1305,12 @@ public:
   // aActiveState is additional information, which shows state of pointer like button state for mouse.
   static bool GetPointerInfo(uint32_t aPointerId, bool& aActiveState);
 
+  // GetPointerType returns pointer type like mouse, pen or touch for pointer event with pointerId
+  static uint16_t GetPointerType(uint32_t aPointerId);
+
+  // GetPointerPrimaryState returns state of attribute isPrimary for pointer event with pointerId
+  static bool GetPointerPrimaryState(uint32_t aPointerId);
+
   /**
    * When capturing content is set, it traps all mouse events and retargets
    * them at this content node. If capturing is not allowed
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index bf37e35e8850..b1fb8b77eda1 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -6411,7 +6411,8 @@ nsIPresShell::SetPointerCapturingContent(uint32_t aPointerId, nsIContent* aConte
   if (pointerCaptureInfo) {
     pointerCaptureInfo->mPendingContent = aContent;
   } else {
-    gPointerCaptureList->Put(aPointerId, new PointerCaptureInfo(aContent));
+    gPointerCaptureList->Put(aPointerId,
+                             new PointerCaptureInfo(aContent, GetPointerPrimaryState(aPointerId)));
   }
 }
 
@@ -6442,16 +6443,6 @@ nsIPresShell::GetPointerCapturingContent(uint32_t aPointerId)
   return nullptr;
 }
 
-/* static */ uint16_t
-nsIPresShell::GetPointerType(uint32_t aPointerId)
-{
-  PointerInfo* pointerInfo = nullptr;
-  if (gActivePointersIds->Get(aPointerId, &pointerInfo) && pointerInfo) {
-    return pointerInfo->mPointerType;
-  }
-  return nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN;
-}
-
 /* static */ bool
 nsIPresShell::CheckPointerCaptureState(uint32_t aPointerId)
 {
@@ -6463,6 +6454,7 @@ nsIPresShell::CheckPointerCaptureState(uint32_t aPointerId)
     if (pointerCaptureInfo->mPendingContent || pointerCaptureInfo->mReleaseContent) {
       if (pointerCaptureInfo->mOverrideContent) {
         uint16_t pointerType = GetPointerType(aPointerId);
+        bool isPrimary = pointerCaptureInfo->mPrimaryState;
         nsCOMPtr<nsIContent> content;
         pointerCaptureInfo->mOverrideContent.swap(content);
         if (pointerCaptureInfo->mReleaseContent) {
@@ -6471,7 +6463,7 @@ nsIPresShell::CheckPointerCaptureState(uint32_t aPointerId)
         if (pointerCaptureInfo->Empty()) {
           gPointerCaptureList->Remove(aPointerId);
         }
-        DispatchGotOrLostPointerCaptureEvent(false, aPointerId, pointerType, content);
+        DispatchGotOrLostPointerCaptureEvent(false, aPointerId, pointerType, isPrimary, content);
         didDispatchEvent = true;
       } else if (pointerCaptureInfo->mPendingContent && pointerCaptureInfo->mReleaseContent) {
         // If anybody calls element.releasePointerCapture
@@ -6489,6 +6481,7 @@ nsIPresShell::CheckPointerCaptureState(uint32_t aPointerId)
       pointerCaptureInfo->mReleaseContent = false;
       DispatchGotOrLostPointerCaptureEvent(true, aPointerId,
                                            GetPointerType(aPointerId),
+                                           pointerCaptureInfo->mPrimaryState,
                                            pointerCaptureInfo->mOverrideContent);
       didDispatchEvent = true;
     }
@@ -6496,6 +6489,26 @@ nsIPresShell::CheckPointerCaptureState(uint32_t aPointerId)
   return didDispatchEvent;
 }
 
+/* static */ uint16_t
+nsIPresShell::GetPointerType(uint32_t aPointerId)
+{
+  PointerInfo* pointerInfo = nullptr;
+  if (gActivePointersIds->Get(aPointerId, &pointerInfo) && pointerInfo) {
+    return pointerInfo->mPointerType;
+  }
+  return nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN;
+}
+
+/* static */ bool
+nsIPresShell::GetPointerPrimaryState(uint32_t aPointerId)
+{
+  PointerInfo* pointerInfo = nullptr;
+  if (gActivePointersIds->Get(aPointerId, &pointerInfo) && pointerInfo) {
+    return pointerInfo->mPrimaryState;
+  }
+  return false;
+}
+
 /* static */ bool
 nsIPresShell::GetPointerInfo(uint32_t aPointerId, bool& aActiveState)
 {
@@ -6514,20 +6527,23 @@ PresShell::UpdateActivePointerState(WidgetGUIEvent* aEvent)
   case NS_MOUSE_ENTER:
     // In this case we have to know information about available mouse pointers
     if (WidgetMouseEvent* mouseEvent = aEvent->AsMouseEvent()) {
-      gActivePointersIds->Put(mouseEvent->pointerId, new PointerInfo(false, mouseEvent->inputSource));
+      gActivePointersIds->Put(mouseEvent->pointerId,
+                              new PointerInfo(false, mouseEvent->inputSource, true));
     }
     break;
   case NS_POINTER_DOWN:
     // In this case we switch pointer to active state
     if (WidgetPointerEvent* pointerEvent = aEvent->AsPointerEvent()) {
-      gActivePointersIds->Put(pointerEvent->pointerId, new PointerInfo(true, pointerEvent->inputSource));
+      gActivePointersIds->Put(pointerEvent->pointerId,
+                              new PointerInfo(true, pointerEvent->inputSource, pointerEvent->isPrimary));
     }
     break;
   case NS_POINTER_UP:
     // In this case we remove information about pointer or turn off active state
     if (WidgetPointerEvent* pointerEvent = aEvent->AsPointerEvent()) {
       if(pointerEvent->inputSource != nsIDOMMouseEvent::MOZ_SOURCE_TOUCH) {
-        gActivePointersIds->Put(pointerEvent->pointerId, new PointerInfo(false, pointerEvent->inputSource));
+        gActivePointersIds->Put(pointerEvent->pointerId,
+                                new PointerInfo(false, pointerEvent->inputSource, pointerEvent->isPrimary));
       } else {
         gActivePointersIds->Remove(pointerEvent->pointerId);
       }
@@ -8245,12 +8261,14 @@ void
 nsIPresShell::DispatchGotOrLostPointerCaptureEvent(bool aIsGotCapture,
                                                    uint32_t aPointerId,
                                                    uint16_t aPointerType,
+                                                   bool aIsPrimary,
                                                    nsIContent* aCaptureTarget)
 {
   PointerEventInit init;
   init.mPointerId = aPointerId;
   init.mBubbles = true;
   ConvertPointerTypeToString(aPointerType, init.mPointerType);
+  init.mIsPrimary = aIsPrimary;
   nsRefPtr<mozilla::dom::PointerEvent> event;
   event = PointerEvent::Constructor(aCaptureTarget,
                                     aIsGotCapture
diff --git a/layout/base/tests/bug977003_inner_1.html b/layout/base/tests/bug977003_inner_1.html
index dee6f124fdbd..c4c7f2d84aba 100644
--- a/layout/base/tests/bug977003_inner_1.html
+++ b/layout/base/tests/bug977003_inner_1.html
@@ -3,10 +3,11 @@
 <!--
 https://bugzilla.mozilla.org/show_bug.cgi?id=977003
 https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
+https://bugzilla.mozilla.org/show_bug.cgi?id=1098139
 -->
 <head>
   <meta charset="utf-8">
-  <title>Test for Bugs 977003, 1094913</title>
+  <title>Test for Bugs 977003, 1094913, 1098139</title>
   <meta name="author" content="Maksim Lebedev" />
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
@@ -19,9 +20,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
     var test_send_got = 0;
     var test_got_async = 0;
     var test_got_type = "";
+    var test_got_primary = false;
     var test_send_lost = 0;
     var test_lost_async = 0;
     var test_lost_type = "";
+    var test_lost_primary = false;
 
     function DownHandler(event) {
       logger("Receive event: " + event.type);
@@ -35,6 +38,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
       if(test_send_got)
         test_got_async++;
       test_got_type = event.pointerType;
+      test_got_primary = event.isPrimary;
       logger("Send releasePointerCapture from target");
       target.releasePointerCapture(event.pointerId);
       logger("releasePointerCapture was executed");
@@ -45,6 +49,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
       if(test_send_lost)
         test_lost_async++;
       test_lost_type = event.pointerType;
+      test_lost_primary = event.isPrimary;
     }
     function logger(message) {
       console.log(message);
@@ -71,9 +76,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
       parent.is(test_send_got,        1, "Part 1: gotpointercapture event should be sent once");
       parent.is(test_got_async,       1, "Part 1: gotpointercapture event should be asynchronous");
       parent.is(test_got_type,  "mouse", "Part 1: gotpointercapture event should have pointerType mouse");
+      parent.is(test_got_primary,  true, "Part 1: gotpointercapture event should have isPrimary as true");
       parent.is(test_send_lost,       1, "Part 1: lostpointercapture event should be sent once");
       parent.is(test_lost_async,      1, "Part 1: lostpointercapture event should be asynchronous");
       parent.is(test_lost_type, "mouse", "Part 1: lostpointercapture event should have pointerType mouse");
+      parent.is(test_lost_primary, true, "Part 1: lostpointercapture event should have isPrimary as true");
       logger("finishTest");
       parent.finishTest();
     }
@@ -82,6 +89,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
 <body onload="prepareTest()">
   <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=977003">Mozilla Bug 977003 Test 1</a>
   <br><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1094913">Mozilla Bug 1094913</a>
+  <br><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1098139">Mozilla Bug 1098139</a>
   <p id="display"></p>
   <div id="content" style="display: none">
   </div>
diff --git a/layout/base/tests/bug977003_inner_5.html b/layout/base/tests/bug977003_inner_5.html
index b505d9cdda2e..2bd12291a46c 100644
--- a/layout/base/tests/bug977003_inner_5.html
+++ b/layout/base/tests/bug977003_inner_5.html
@@ -4,10 +4,11 @@
 https://bugzilla.mozilla.org/show_bug.cgi?id=977003
 https://bugzilla.mozilla.org/show_bug.cgi?id=1073563
 https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
+https://bugzilla.mozilla.org/show_bug.cgi?id=1098139
 -->
 <head>
   <meta charset="utf-8">
-  <title>Test for Bugs 977003, 1073563, 1094913</title>
+  <title>Test for Bugs 977003, 1073563, 1094913, 1098139</title>
   <meta name="author" content="Maksim Lebedev" />
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
@@ -21,9 +22,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
     var test_down_target = false;
     var test_got_listener = false;
     var test_got_type = "";
+    var test_got_primary = false;
     var test_lost_listener = false;
     var test_lost_type = "";
     var test_listener = false;
+    var test_lost_primary = false;
 
     function TargetDownHandler(event) {
       logger("Target receive event: " + event.type);
@@ -37,11 +40,13 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
       listener.releasePointerCapture(event.pointerId);
       test_got_listener = true;
       test_got_type = event.pointerType;
+      test_got_primary = event.isPrimary;
     }
     function ListenerLostPCHandler(event) {
       logger("Receive event on Listener: " + event.type + "(" + event.pointerType + ")");
       test_lost_listener = true;
       test_lost_type = event.pointerType;
+      test_lost_primary = event.isPrimary;
     }
     function ListenerHandler(event) {
       logger("Receive event on Listener: " + event.type);
@@ -69,17 +74,19 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
       listener.addEventListener("pointerup",          ListenerHandler,        false);
       listener.addEventListener("pointerout",         ListenerHandler,        false);
       var rect = target.getBoundingClientRect();
-      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointerdown", inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
-      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointermove", inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
-      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointerup",   inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
+      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointerdown", isPrimary: true, inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
+      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointermove", isPrimary: true, inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
+      synthesizePointer(target, rect.width/2, rect.height/2, {type: "pointerup",   isPrimary: true, inputSource: SpecialPowers.Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH});
       finishTest();
     }
     function finishTest() {
       parent.is(test_down_target,     true, "Part 5: pointerdown event should be received by target");
       parent.is(test_got_listener,    true, "Part 5: listener should receive gotpointercapture event");
       parent.is(test_got_type,     "touch", "Part 5: gotpointercapture event should have pointerType touch");
+      parent.is(test_got_primary,     true, "Part 5: gotpointercapture event should have isPrimary as true");
       parent.is(test_lost_listener,   true, "Part 5: listener should receive lostpointercapture event");
       parent.is(test_lost_type,    "touch", "Part 5: lostpointercapture event should have pointerType touch");
+      parent.is(test_lost_primary,    true, "Part 5: lostpointercapture event should have isPrimary as true");
       parent.is(test_listener,       false, "Part 5: listener should not receive any other events");
       logger("finishTest");
       parent.finishTest();
@@ -90,6 +97,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1094913
   <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=977003">Mozilla Bug 977003 Test 5</a>
   <br><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1073563">Mozilla Bug 1073563</a>
   <br><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1094913">Mozilla Bug 1094913</a>
+  <br><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1098139">Mozilla Bug 1098139</a>
   <p id="display"></p>
   <div id="content" style="display: none">
   </div>
diff --git a/testing/mochitest/tests/SimpleTest/EventUtils.js b/testing/mochitest/tests/SimpleTest/EventUtils.js
index 4028bbae2fcd..36bd4be9dca7 100644
--- a/testing/mochitest/tests/SimpleTest/EventUtils.js
+++ b/testing/mochitest/tests/SimpleTest/EventUtils.js
@@ -305,12 +305,13 @@ function synthesizePointerAtPoint(left, top, aEvent, aWindow)
     var pressure = ("pressure" in aEvent) ? aEvent.pressure : 0;
     var inputSource = ("inputSource" in aEvent) ? aEvent.inputSource : 0;
     var synthesized = ("isSynthesized" in aEvent) ? aEvent.isSynthesized : true;
+    var isPrimary = ("isPrimary" in aEvent) ? aEvent.isPrimary : false;
 
     if (("type" in aEvent) && aEvent.type) {
       defaultPrevented = utils.sendPointerEventToWindow(aEvent.type, left, top, button,
                                                         clickCount, modifiers, false,
                                                         pressure, inputSource,
-                                                        synthesized);
+                                                        synthesized, 0, 0, 0, 0, isPrimary);
     }
     else {
       utils.sendPointerEventToWindow("pointerdown", left, top, button, clickCount, modifiers, false, pressure, inputSource);

From 40a7818ade899bf1e56287d38102ac3817e1507c Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 09:06:57 -0800
Subject: [PATCH 70/84] Bumping gaia.json for 3 gaia revision(s) a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f1780ba84565
Author: Florin Strugariu <florin.strugariu@softvision.ro>
Desc: Merge pull request #26257 from chirarobert/bug_1100994

Bug 1100994 - [v2.2] Fix test_settings_device_info.py failure

========

https://hg.mozilla.org/integration/gaia-central/rev/72068b0d3e50
Author: Robert Chira <robertchira@P5075.(none)>
Desc: Bug 1100994 - [v2.2] Fix test_settings_device_info.py failure

========

https://hg.mozilla.org/integration/gaia-central/rev/3abadcdbd9ce
Author: Dale Harvey <dale@arandomurl.com>
Desc: Bug 1100305 - Disable intermittent failing browser test. r=me
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index f15a617ffddc..fbeb867c85a8 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "4f3818d9c5577c26d8368fad5e87e546519c4b13", 
+    "revision": "f1780ba8456558491b1bce02e0951045eb11d0ba", 
     "repo_path": "integration/gaia-central"
 }

From 38d93554ec505dd8dd3081b1d58419d707236194 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 09:17:06 -0800
Subject: [PATCH 71/84] Bumping manifests a=b2g-bump

---
 b2g/config/dolphin/sources.xml      | 2 +-
 b2g/config/emulator-ics/sources.xml | 2 +-
 b2g/config/emulator-jb/sources.xml  | 2 +-
 b2g/config/emulator-kk/sources.xml  | 2 +-
 b2g/config/emulator/sources.xml     | 2 +-
 b2g/config/flame-kk/sources.xml     | 2 +-
 b2g/config/flame/sources.xml        | 2 +-
 b2g/config/hamachi/sources.xml      | 2 +-
 b2g/config/helix/sources.xml        | 2 +-
 b2g/config/nexus-4/sources.xml      | 2 +-
 b2g/config/wasabi/sources.xml       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index 4021502a7b5f..dc61b08bd463 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index d0bb4dfc23cc..2d3463720d13 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index 5c16258be608..3e9ee238c1a6 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index f7904bc11560..4c8f27f50538 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index d0bb4dfc23cc..2d3463720d13 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 8af9902833f8..92fb99385791 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index dc6f27dbf348..5a0484b9aa03 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index d8de2e81b909..d928b870f782 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index 2bf0dbcab92f..c1f7c63843a9 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index b476f79c7260..4f9a32aa47fe 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 96f1fa47455e..cde1b82eb2f4 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0da467aba9ecf354b905f9cc08dfa1a4169659e4"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>

From 9390984b2c9f34b250a1240cb31bda24ef4e8a80 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 09:41:59 -0800
Subject: [PATCH 72/84] Bumping gaia.json for 4 gaia revision(s) a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/9650380d8ede
Author: Eitan Isaacson <eitan@monotonous.org>
Desc: Merge pull request #26208 from eeejay/bug-1069422

Bug 1069422 - Use gaia-select for combo boxes. r=salva

========

https://hg.mozilla.org/integration/gaia-central/rev/236618bbe7e1
Author: Eitan Isaacson <eitan@monotonous.org>
Desc: Bug 1069422 - Use gaia-select for combo boxes.

========

https://hg.mozilla.org/integration/gaia-central/rev/87d2fd662016
Author: James Lal <james@lightsofapollo.com>
Desc: Merge pull request #26259 from lightsofapollo/bug-1097591

Bug 1097591 - vbump marionette-apps = v0.3.12

========

https://hg.mozilla.org/integration/gaia-central/rev/a5c685cb161a
Author: James Lal <james@lightsofapollo.com>
Desc: Bug 1097591 - vbump marionette-apps = v0.3.12
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index fbeb867c85a8..cde3db86eb80 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "f1780ba8456558491b1bce02e0951045eb11d0ba", 
+    "revision": "9650380d8ede5ca571d35885e9c1150745f75d1a", 
     "repo_path": "integration/gaia-central"
 }

From 4c737a142d301b965d08388c6bb3aea463863e94 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 09:47:09 -0800
Subject: [PATCH 73/84] Bumping manifests a=b2g-bump

---
 b2g/config/dolphin/sources.xml      | 2 +-
 b2g/config/emulator-ics/sources.xml | 2 +-
 b2g/config/emulator-jb/sources.xml  | 2 +-
 b2g/config/emulator-kk/sources.xml  | 2 +-
 b2g/config/emulator/sources.xml     | 2 +-
 b2g/config/flame-kk/sources.xml     | 2 +-
 b2g/config/flame/sources.xml        | 2 +-
 b2g/config/hamachi/sources.xml      | 2 +-
 b2g/config/helix/sources.xml        | 2 +-
 b2g/config/nexus-4/sources.xml      | 2 +-
 b2g/config/wasabi/sources.xml       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index dc61b08bd463..a769a6241e12 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index 2d3463720d13..bce7a69016fd 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index 3e9ee238c1a6..ab72db598c19 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 4c8f27f50538..7357ad0ee3b9 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index 2d3463720d13..bce7a69016fd 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 92fb99385791..adce45acc66c 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index 5a0484b9aa03..c61c3fd33af1 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index d928b870f782..ea277b94add3 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index c1f7c63843a9..c0ac98d56e25 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 4f9a32aa47fe..63c13e62e442 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index cde1b82eb2f4..13bf715f2f10 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="69f2f961d7df1257a6e8fe222a036a72ea68ec55"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>

From a126672c41d28d3a0537f7438f3447ef4ed197de Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 11:27:12 -0800
Subject: [PATCH 74/84] Bumping gaia.json for 1 gaia revision(s) a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/84488fe79fc6
Author: Dale Harvey <dale@arandomurl.com>
Desc: Bug 1094076 - Disabling intermittent failed tests. r=me
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index cde3db86eb80..d833645b3922 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "9650380d8ede5ca571d35885e9c1150745f75d1a", 
+    "revision": "84488fe79fc69481e192f0e5221afb59533e37e0", 
     "repo_path": "integration/gaia-central"
 }

From e20a587d5ee75ec1c97b9354d92d8fb167b7d416 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 11:32:02 -0800
Subject: [PATCH 75/84] Bumping manifests a=b2g-bump

---
 b2g/config/dolphin/sources.xml      | 2 +-
 b2g/config/emulator-ics/sources.xml | 2 +-
 b2g/config/emulator-jb/sources.xml  | 2 +-
 b2g/config/emulator-kk/sources.xml  | 2 +-
 b2g/config/emulator/sources.xml     | 2 +-
 b2g/config/flame-kk/sources.xml     | 2 +-
 b2g/config/flame/sources.xml        | 2 +-
 b2g/config/hamachi/sources.xml      | 2 +-
 b2g/config/helix/sources.xml        | 2 +-
 b2g/config/nexus-4/sources.xml      | 2 +-
 b2g/config/wasabi/sources.xml       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index a769a6241e12..7ce4520ecbe1 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index bce7a69016fd..21df9f32f95e 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index ab72db598c19..0f38c64402ad 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 7357ad0ee3b9..885036749295 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index bce7a69016fd..21df9f32f95e 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index adce45acc66c..993932ab0422 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index c61c3fd33af1..263d55dafbc9 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index ea277b94add3..c17b87e19325 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index c0ac98d56e25..9b6df32cef46 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 63c13e62e442..1fd5284a8caa 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 13bf715f2f10..0e6eb18e44c7 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="2194cfae6ca32b1c7bfd8f18cfbe2f1ba9cb1b91"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>

From b16636541199132f3302357f0137ce630063082b Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 15:23:32 -0800
Subject: [PATCH 76/84] Bumping manifests a=b2g-bump

---
 b2g/config/dolphin/sources.xml      | 2 +-
 b2g/config/emulator-ics/sources.xml | 2 +-
 b2g/config/emulator-jb/sources.xml  | 2 +-
 b2g/config/emulator-kk/sources.xml  | 2 +-
 b2g/config/emulator/sources.xml     | 2 +-
 b2g/config/flame-kk/sources.xml     | 2 +-
 b2g/config/flame/sources.xml        | 2 +-
 b2g/config/hamachi/sources.xml      | 2 +-
 b2g/config/nexus-4/sources.xml      | 2 +-
 b2g/config/wasabi/sources.xml       | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index 7ce4520ecbe1..240d7fcc5db8 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index 21df9f32f95e..44c39d24421a 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -25,7 +25,7 @@
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="a47dd04f8f66e42fd331711140f2c3e2fed0767d"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index 0f38c64402ad..c05e975f8683 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -20,7 +20,7 @@
   <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 885036749295..832da7384c15 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="f92a936f2aa97526d4593386754bdbf02db07a12"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="6e47ff2790f5656b5b074407829ceecf3e6188c4"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index 21df9f32f95e..44c39d24421a 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -25,7 +25,7 @@
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="a47dd04f8f66e42fd331711140f2c3e2fed0767d"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 993932ab0422..1461049e5935 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index 263d55dafbc9..f698a335c32a 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -20,7 +20,7 @@
   <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index c17b87e19325..7d2fcc7b5ade 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -21,7 +21,7 @@
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 1fd5284a8caa..3b57a83eeba7 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -20,7 +20,7 @@
   <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 0e6eb18e44c7..98701c3b624b 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -22,7 +22,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="93935064318f39906400a9e9fd636dd9528f5c16"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>

From 8497714d58883e3ae712c20fc475c7758631b467 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 20:26:51 -0800
Subject: [PATCH 77/84] Bumping gaia.json for 2 gaia revision(s) a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f155f8ab67a6
Author: Andrew Sutherland <asutherland@asutherland.org>
Desc: Merge pull request #26250 from asutherland/email-reader-move-pred

Bug 1100860 - [email/UI] message_reader should filter move targets. r=jrburke

========

https://hg.mozilla.org/integration/gaia-central/rev/813e4e17f9e5
Author: Andrew Sutherland <asutherland@asutherland.org>
Desc: Bug 1100860 - [email/UI] message_reader should filter move targets

The message_list card already does this.  Without this fix it's possible
to break the back-end, at least for ActiveSync.  Spinning off a separate
bug to harden the back-end, specifically ActiveSync.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index d833645b3922..191bd5dc53b5 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "84488fe79fc69481e192f0e5221afb59533e37e0", 
+    "revision": "f155f8ab67a65c066730976e0b7cef0d39579a24", 
     "repo_path": "integration/gaia-central"
 }

From c1d07f07ae0f6a88fb1ba1409517af126d384ab5 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 20:31:54 -0800
Subject: [PATCH 78/84] Bumping manifests a=b2g-bump

---
 b2g/config/dolphin/sources.xml      | 2 +-
 b2g/config/emulator-ics/sources.xml | 2 +-
 b2g/config/emulator-jb/sources.xml  | 2 +-
 b2g/config/emulator-kk/sources.xml  | 2 +-
 b2g/config/emulator/sources.xml     | 2 +-
 b2g/config/flame-kk/sources.xml     | 2 +-
 b2g/config/flame/sources.xml        | 2 +-
 b2g/config/hamachi/sources.xml      | 2 +-
 b2g/config/helix/sources.xml        | 2 +-
 b2g/config/nexus-4/sources.xml      | 2 +-
 b2g/config/wasabi/sources.xml       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index 240d7fcc5db8..9f217f3e79f0 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index 44c39d24421a..8ba5a700cf26 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index c05e975f8683..e5f9ea5dad41 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 832da7384c15..f14f6dc85d4a 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index 44c39d24421a..8ba5a700cf26 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 1461049e5935..7b1dc23706d6 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3ab0d9c70f0b2e1ededc679112c392303f037361">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index f698a335c32a..056b2ee3e6fb 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index 7d2fcc7b5ade..63dee5861c01 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index 9b6df32cef46..1a4f0fce314e 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 3b57a83eeba7..3c2ddc82dbff 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="b6f8267794b8c7f2a33236d46a857a84388b8485"/>
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 98701c3b624b..00b636b10bef 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="3cad1e7b884a56992ce662eab5206da84d482c23"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="e64428c5b2dce5db90b75a5055077a04f4bd4819"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>

From c57d2071c24aad2f4f9890054ddb4c36362f6cc6 Mon Sep 17 00:00:00 2001
From: Jonathan Hao <jhao@mozilla.com>
Date: Tue, 18 Nov 2014 09:52:39 +0800
Subject: [PATCH 79/84] Bug 1086179 - Add a format API to MozNFCTag. r=smaug,
 allstars.chh

---
 dom/nfc/NfcContentHelper.js        | 14 ++++++++++++++
 dom/nfc/gonk/Nfc.js                |  5 +++++
 dom/nfc/gonk/NfcGonkMessage.h      |  3 ++-
 dom/nfc/gonk/NfcMessageHandler.cpp | 17 +++++++++++++++++
 dom/nfc/gonk/NfcMessageHandler.h   |  1 +
 dom/nfc/nsINfcContentHelper.idl    |  3 ++-
 dom/nfc/nsNfc.js                   | 13 +++++++++++++
 dom/webidl/MozNFCTag.webidl        |  3 +++
 8 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/dom/nfc/NfcContentHelper.js b/dom/nfc/NfcContentHelper.js
index 5449a34d11bb..e188b2e55067 100644
--- a/dom/nfc/NfcContentHelper.js
+++ b/dom/nfc/NfcContentHelper.js
@@ -54,6 +54,7 @@ const NFC_IPC_MSG_NAMES = [
   "NFC:ReadNDEFResponse",
   "NFC:WriteNDEFResponse",
   "NFC:MakeReadOnlyResponse",
+  "NFC:FormatResponse",
   "NFC:ConnectResponse",
   "NFC:CloseResponse",
   "NFC:CheckP2PRegistrationResponse",
@@ -176,6 +177,18 @@ NfcContentHelper.prototype = {
     return request;
   },
 
+  format: function format(sessionToken) {
+    let request = Services.DOMRequest.createRequest(this._window);
+    let requestId = btoa(this.getRequestId(request));
+    this._requestMap[requestId] = this._window;
+
+    cpmm.sendAsyncMessage("NFC:Format", {
+      requestId: requestId,
+      sessionToken: sessionToken
+    });
+    return request;
+  },
+
   connect: function connect(techType, sessionToken) {
     let request = Services.DOMRequest.createRequest(this._window);
     let requestId = btoa(this.getRequestId(request));
@@ -322,6 +335,7 @@ NfcContentHelper.prototype = {
       case "NFC:CloseResponse":
       case "NFC:WriteNDEFResponse":
       case "NFC:MakeReadOnlyResponse":
+      case "NFC:FormatResponse":
       case "NFC:NotifySendFileStatusResponse":
       case "NFC:ChangeRFStateResponse":
         if (result.errorMsg) {
diff --git a/dom/nfc/gonk/Nfc.js b/dom/nfc/gonk/Nfc.js
index 06209163e0af..0fdad4a34a40 100644
--- a/dom/nfc/gonk/Nfc.js
+++ b/dom/nfc/gonk/Nfc.js
@@ -71,6 +71,7 @@ const NFC_IPC_READ_PERM_MSG_NAMES = [
 const NFC_IPC_WRITE_PERM_MSG_NAMES = [
   "NFC:WriteNDEF",
   "NFC:MakeReadOnly",
+  "NFC:Format",
   "NFC:SendFile",
   "NFC:RegisterPeerReadyTarget",
   "NFC:UnregisterPeerReadyTarget"
@@ -564,6 +565,7 @@ Nfc.prototype = {
       case "CloseResponse":
       case "ReadNDEFResponse":
       case "MakeReadOnlyResponse":
+      case "FormatResponse":
       case "WriteNDEFResponse":
         this.sendNfcResponse(message);
         break;
@@ -622,6 +624,9 @@ Nfc.prototype = {
       case "NFC:MakeReadOnly":
         this.sendToNfcService("makeReadOnly", message.data);
         break;
+      case "NFC:Format":
+        this.sendToNfcService("format", message.data);
+        break;
       case "NFC:Connect":
         this.sendToNfcService("connect", message.data);
         break;
diff --git a/dom/nfc/gonk/NfcGonkMessage.h b/dom/nfc/gonk/NfcGonkMessage.h
index 0160578e25b6..3195e97e0bcb 100644
--- a/dom/nfc/gonk/NfcGonkMessage.h
+++ b/dom/nfc/gonk/NfcGonkMessage.h
@@ -8,7 +8,7 @@
 namespace mozilla {
 
 #define NFCD_MAJOR_VERSION 1
-#define NFCD_MINOR_VERSION 16
+#define NFCD_MINOR_VERSION 17
 
 enum NfcRequest {
   ChangeRFStateReq = 0,
@@ -17,6 +17,7 @@ enum NfcRequest {
   ReadNDEFReq,
   WriteNDEFReq,
   MakeReadOnlyReq,
+  FormatReq,
 };
 
 enum NfcResponse {
diff --git a/dom/nfc/gonk/NfcMessageHandler.cpp b/dom/nfc/gonk/NfcMessageHandler.cpp
index b465f54f8252..2ef32504a504 100644
--- a/dom/nfc/gonk/NfcMessageHandler.cpp
+++ b/dom/nfc/gonk/NfcMessageHandler.cpp
@@ -20,6 +20,7 @@ static const char* kChangeRFStateRequest = "changeRFState";
 static const char* kReadNDEFRequest = "readNDEF";
 static const char* kWriteNDEFRequest = "writeNDEF";
 static const char* kMakeReadOnlyRequest = "makeReadOnly";
+static const char* kFormatRequest = "format";
 static const char* kConnectRequest = "connect";
 static const char* kCloseRequest = "close";
 
@@ -27,6 +28,7 @@ static const char* kChangeRFStateResponse = "ChangeRFStateResponse";
 static const char* kReadNDEFResponse = "ReadNDEFResponse";
 static const char* kWriteNDEFResponse = "WriteNDEFResponse";
 static const char* kMakeReadOnlyResponse = "MakeReadOnlyResponse";
+static const char* kFormatResponse = "FormatResponse";
 static const char* kConnectResponse = "ConnectResponse";
 static const char* kCloseResponse = "CloseResponse";
 
@@ -52,6 +54,9 @@ NfcMessageHandler::Marshall(Parcel& aParcel, const CommandOptions& aOptions)
   } else if (!strcmp(type, kMakeReadOnlyRequest)) {
     result = MakeReadOnlyRequest(aParcel, aOptions);
     mPendingReqQueue.AppendElement(NfcRequest::MakeReadOnlyReq);
+  } else if (!strcmp(type, kFormatRequest)) {
+    result = FormatRequest(aParcel, aOptions);
+    mPendingReqQueue.AppendElement(NfcRequest::FormatReq);
   } else if (!strcmp(type, kConnectRequest)) {
     result = ConnectRequest(aParcel, aOptions);
     mPendingReqQueue.AppendElement(NfcRequest::ConnectReq);
@@ -117,6 +122,9 @@ NfcMessageHandler::GeneralResponse(const Parcel& aParcel, EventOptions& aOptions
     case NfcRequest::MakeReadOnlyReq:
       type = kMakeReadOnlyResponse;
       break;
+    case NfcRequest::FormatReq:
+      type = kFormatResponse;
+      break;
     case NfcRequest::ConnectReq:
       type = kConnectResponse;
       break;
@@ -207,6 +215,15 @@ NfcMessageHandler::MakeReadOnlyRequest(Parcel& aParcel, const CommandOptions& aO
   return true;
 }
 
+bool
+NfcMessageHandler::FormatRequest(Parcel& aParcel, const CommandOptions& aOptions)
+{
+  aParcel.writeInt32(NfcRequest::FormatReq);
+  aParcel.writeInt32(aOptions.mSessionId);
+  mRequestIdQueue.AppendElement(aOptions.mRequestId);
+  return true;
+}
+
 bool
 NfcMessageHandler::ConnectRequest(Parcel& aParcel, const CommandOptions& aOptions)
 {
diff --git a/dom/nfc/gonk/NfcMessageHandler.h b/dom/nfc/gonk/NfcMessageHandler.h
index 5f48a00b711a..0068060684db 100644
--- a/dom/nfc/gonk/NfcMessageHandler.h
+++ b/dom/nfc/gonk/NfcMessageHandler.h
@@ -31,6 +31,7 @@ private:
   bool ReadNDEFResponse(const android::Parcel& aParcel, EventOptions& aOptions);
   bool WriteNDEFRequest(android::Parcel& aParcel, const CommandOptions& options);
   bool MakeReadOnlyRequest(android::Parcel& aParcel, const CommandOptions& options);
+  bool FormatRequest(android::Parcel& aParcel, const CommandOptions& options);
   bool ConnectRequest(android::Parcel& aParcel, const CommandOptions& options);
   bool CloseRequest(android::Parcel& aParcel, const CommandOptions& options);
 
diff --git a/dom/nfc/nsINfcContentHelper.idl b/dom/nfc/nsINfcContentHelper.idl
index 42f04901b323..c3e46e92a5ae 100644
--- a/dom/nfc/nsINfcContentHelper.idl
+++ b/dom/nfc/nsINfcContentHelper.idl
@@ -65,7 +65,7 @@ interface nsINfcEventListener : nsISupports
   void notifyPeerLost(in DOMString sessionToken);
 };
 
-[scriptable, uuid(486dff99-6755-428b-834d-3647ce276b54)]
+[scriptable, uuid(9343ae1a-6e2f-11e4-b5c4-fbb166b38b62)]
 interface nsINfcContentHelper : nsISupports
 {
   void init(in nsIDOMWindow window);
@@ -75,6 +75,7 @@ interface nsINfcContentHelper : nsISupports
   nsIDOMDOMRequest readNDEF(in DOMString sessionToken);
   nsIDOMDOMRequest writeNDEF(in nsIVariant records, in DOMString sessionToken);
   nsIDOMDOMRequest makeReadOnly(in DOMString sessionToken);
+  nsIDOMDOMRequest format(in DOMString sessionToken);
 
   nsIDOMDOMRequest connect(in unsigned long techType, in DOMString sessionToken);
   nsIDOMDOMRequest close(in DOMString sessionToken);
diff --git a/dom/nfc/nsNfc.js b/dom/nfc/nsNfc.js
index bdd0254bc372..3a1eba1bb60c 100644
--- a/dom/nfc/nsNfc.js
+++ b/dom/nfc/nsNfc.js
@@ -101,6 +101,19 @@ MozNFCTagImpl.prototype = {
     return this._nfcContentHelper.makeReadOnly(this.session);
   },
 
+  format: function format() {
+    if (this.isLost) {
+      throw new this._window.DOMError("InvalidStateError", "NFCTag object is invalid");
+    }
+
+    if (!this.isFormatable) {
+      throw new this._window.DOMError("InvalidAccessError",
+                                      "NFCTag object is not formatable");
+    }
+
+    return this._nfcContentHelper.format(this.session);
+  },
+
   classID: Components.ID("{4e1e2e90-3137-11e3-aa6e-0800200c9a66}"),
   contractID: "@mozilla.org/nfc/NFCTag;1",
   QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports,
diff --git a/dom/webidl/MozNFCTag.webidl b/dom/webidl/MozNFCTag.webidl
index e3d7a5772cf2..b2107411d8f2 100644
--- a/dom/webidl/MozNFCTag.webidl
+++ b/dom/webidl/MozNFCTag.webidl
@@ -74,6 +74,9 @@ interface MozNFCTag {
 
   [Throws]
   DOMRequest makeReadOnly();
+
+  [Throws]
+  DOMRequest format();
 };
 
 // Mozilla Only

From a0b87c69e490421445d6b71dd87c4334fe6ba5b9 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Tue, 18 Nov 2014 12:11:12 -0500
Subject: [PATCH 80/84] Bug 1099148 -  Implement Canvas2D resetTransform
 method.   r=gw280,bz

---
 dom/canvas/CanvasRenderingContext2D.cpp       |  6 ++++
 dom/canvas/CanvasRenderingContext2D.h         |  1 +
 dom/canvas/test/test_canvas.html              | 34 +++++++++++++++++++
 dom/webidl/CanvasRenderingContext2D.webidl    |  3 +-
 .../meta/html/dom/interfaces.html.ini         |  6 ----
 5 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index d2872b28e328..3f0b2113ab75 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -1735,6 +1735,12 @@ CanvasRenderingContext2D::SetTransform(double m11, double m12,
   mTarget->SetTransform(matrix);
 }
 
+void
+CanvasRenderingContext2D::ResetTransform(ErrorResult& error)
+{
+  SetTransform(1.0, 0.0, 0.0, 1.0, 0.0, 0.0, error);
+}
+
 static void
 MatrixToJSObject(JSContext* cx, const Matrix& matrix,
                  JS::MutableHandle<JSObject*> result, ErrorResult& error)
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index d4358a404074..8593502248dd 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -148,6 +148,7 @@ public:
                  double dy, mozilla::ErrorResult& error);
   void SetTransform(double m11, double m12, double m21, double m22, double dx,
                     double dy, mozilla::ErrorResult& error);
+  void ResetTransform(mozilla::ErrorResult& error);
 
   double GlobalAlpha()
   {
diff --git a/dom/canvas/test/test_canvas.html b/dom/canvas/test/test_canvas.html
index 6a241fcf756e..48f26e22a1a7 100644
--- a/dom/canvas/test/test_canvas.html
+++ b/dom/canvas/test/test_canvas.html
@@ -19182,6 +19182,7 @@ isPixel(ctx, 50,25, 0,255,0,255, 0);
 
 
 }
+
 </script>
 
 <!-- [[[ test_2d.transformation.transform.multiply.html ]]] -->
@@ -19558,6 +19559,9 @@ if (ctx.transform) { // (avoid spurious failures, since the aim here is not to t
 if (ctx.setTransform) {
     ok(ctx.setTransform(1, 0, 0, 1, 0, 0) === undefined, "ctx.setTransform(1, 0, 0, 1, 0, 0) === undefined");
 }
+if (ctx.resetTransform) {
+    ok(ctx.resetTransform() === undefined, "ctx.resetTransform() === undefined");
+}
 ok(ctx.clearRect(0, 0, 0, 0) === undefined, "ctx.clearRect(0, 0, 0, 0) === undefined");
 ok(ctx.fillRect(0, 0, 0, 0) === undefined, "ctx.fillRect(0, 0, 0, 0) === undefined");
 ok(ctx.strokeRect(0, 0, 0, 0) === undefined, "ctx.strokeRect(0, 0, 0, 0) === undefined");
@@ -21552,6 +21556,31 @@ function test_opaque() {
 }
 </script>
 
+<p>Canvas test: 2d.transformation.transform.identity</p>
+<!-- Testing: resetTransform() changes to the identity matrix -->
+<canvas id="c689" width="100" height="50"><p class="fallback">FAIL (fallback content)</p></canvas>
+<script>
+
+
+function test_2d_transformation_reset_transform() {
+
+var canvas = document.getElementById('c689');
+var ctx = canvas.getContext('2d');
+
+ctx.fillStyle = '#f00';
+ctx.fillRect(0, 0, 100, 50);
+
+ctx.setTransform(0.1, 0.0, 0.0, 0.1, 80.0, 30.0);
+ctx.resetTransform();
+ctx.fillStyle = '#0f0';
+ctx.fillRect(0, 0, 100, 50);
+isPixel(ctx, 50,25, 0,255,0,255, 0);
+
+
+}
+
+</script>
+
 <script>
 
 function asyncTestsDone() {
@@ -24844,6 +24873,11 @@ try {
   throw e;
   ok(false, "unexpected exception thrown in: test_opaque");
  }
+ try {
+  test_2d_transformation_reset_transform();
+ } catch (e) {
+  ok(false, "unexpected exception thrown in: test_2d_transformation_reset_transform");
+ }
  try {
   // run this test last since it replaces the getContext method
   test_type_replace();
diff --git a/dom/webidl/CanvasRenderingContext2D.webidl b/dom/webidl/CanvasRenderingContext2D.webidl
index 3f37795925dd..0f24f684a064 100644
--- a/dom/webidl/CanvasRenderingContext2D.webidl
+++ b/dom/webidl/CanvasRenderingContext2D.webidl
@@ -47,7 +47,8 @@ interface CanvasRenderingContext2D {
   void transform(double a, double b, double c, double d, double e, double f);
   [Throws, LenientFloat]
   void setTransform(double a, double b, double c, double d, double e, double f);
-// NOT IMPLEMENTED  void resetTransform();
+  [Throws]
+  void resetTransform();
 
   // compositing
            attribute unrestricted double globalAlpha; // (default 1.0)
diff --git a/testing/web-platform/meta/html/dom/interfaces.html.ini b/testing/web-platform/meta/html/dom/interfaces.html.ini
index 8b081b685e68..9b7400b7eeaa 100644
--- a/testing/web-platform/meta/html/dom/interfaces.html.ini
+++ b/testing/web-platform/meta/html/dom/interfaces.html.ini
@@ -2214,9 +2214,6 @@
   [CanvasRenderingContext2D interface: attribute currentTransform]
     expected: FAIL
 
-  [CanvasRenderingContext2D interface: operation resetTransform()]
-    expected: FAIL
-
   [CanvasRenderingContext2D interface: attribute imageSmoothingEnabled]
     expected: FAIL
 
@@ -2295,9 +2292,6 @@
   [CanvasRenderingContext2D interface: document.createElement("canvas").getContext("2d") must inherit property "currentTransform" with the proper type (6)]
     expected: FAIL
 
-  [CanvasRenderingContext2D interface: document.createElement("canvas").getContext("2d") must inherit property "resetTransform" with the proper type (12)]
-    expected: FAIL
-
   [CanvasRenderingContext2D interface: document.createElement("canvas").getContext("2d") must inherit property "imageSmoothingEnabled" with the proper type (15)]
     expected: FAIL
 

From 0936f06df63c2d55464695fa5561cee1c6447488 Mon Sep 17 00:00:00 2001
From: Blake <bwu@mozilla.com>
Date: Tue, 18 Nov 2014 18:04:29 +0800
Subject: [PATCH 81/84] Bug 1100820 - Stop reading output data from
 MediaCodecProxy. r=edwin.

---
 dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp | 5 ++++-
 dom/media/fmp4/gonk/GonkMediaDataDecoder.h   | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp b/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp
index a9c91350de8e..0fb97e8d233e 100644
--- a/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp
+++ b/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp
@@ -32,6 +32,7 @@ GonkMediaDataDecoder::GonkMediaDataDecoder(GonkDecoderManager* aManager,
   , mCallback(aCallback)
   , mManager(aManager)
   , mSignaledEOS(false)
+  , mDrainComplete(false)
 {
   MOZ_COUNT_CTOR(GonkMediaDataDecoder);
 }
@@ -45,6 +46,7 @@ nsresult
 GonkMediaDataDecoder::Init()
 {
   mDecoder = mManager->Init(mCallback);
+  mDrainComplete = false;
   return mDecoder.get() ? NS_OK : NS_ERROR_UNEXPECTED;
 }
 
@@ -89,7 +91,7 @@ GonkMediaDataDecoder::ProcessOutput()
 {
   nsAutoPtr<MediaData> output;
   nsresult rv;
-  while (true) {
+  while (true && !mDrainComplete) {
     rv = mManager->Output(mLastStreamOffset, output);
     if (rv == NS_OK) {
       mCallback->Output(output.forget());
@@ -117,6 +119,7 @@ GonkMediaDataDecoder::ProcessOutput()
       }
       mCallback->DrainComplete();
       mSignaledEOS = false;
+      mDrainComplete = true;
       return;
     }
     mCallback->Error();
diff --git a/dom/media/fmp4/gonk/GonkMediaDataDecoder.h b/dom/media/fmp4/gonk/GonkMediaDataDecoder.h
index bb6a5e9b3ad0..43ca92b3a1cf 100644
--- a/dom/media/fmp4/gonk/GonkMediaDataDecoder.h
+++ b/dom/media/fmp4/gonk/GonkMediaDataDecoder.h
@@ -92,6 +92,8 @@ private:
   int64_t mLastStreamOffset;
   // Set it ture when there is no input data
   bool mSignaledEOS;
+  // Set if there is no more output data from decoder
+  bool mDrainComplete;
 };
 
 } // namespace mozilla

From be3be8a2f95fd8649c1296f124738c6bcce95bf0 Mon Sep 17 00:00:00 2001
From: B2G Bumper Bot <release+b2gbumper@mozilla.com>
Date: Tue, 18 Nov 2014 22:48:28 -0800
Subject: [PATCH 82/84] Bumping manifests a=b2g-bump

---
 b2g/config/emulator-jb/sources.xml | 2 +-
 b2g/config/flame-kk/sources.xml    | 2 +-
 b2g/config/flame/sources.xml       | 2 +-
 b2g/config/nexus-4/sources.xml     | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index e5f9ea5dad41..d9e0b37cb324 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -134,7 +134,7 @@
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c5f8d282efe4a4e8b1e31a37300944e338e60e4f"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="0e56e450367cd802241b27164a2979188242b95f"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="9f28c4faea3b2f01db227b2467b08aeba96d9bec"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="5502ba6f3f7606d0142cf38b1067d3d0a669f314"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="7e257a260fb6a6c3811f9c396cfe3ccf191241f6"/>
   <project name="android-sdk" path="sdk" remote="b2g" revision="8b1365af38c9a653df97349ee53a3f5d64fd590a"/>
   <project name="darwinstreamingserver" path="system/darwinstreamingserver" remote="b2g" revision="cf85968c7f85e0ec36e72c87ceb4837a943b8af6"/>
 </manifest>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 7b1dc23706d6..c0a056872d0e 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -153,7 +153,7 @@
   <project name="platform/hardware/ril" path="hardware/ril" revision="12b1977cc704b35f2e9db2bb423fa405348bc2f3"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="985bf15264d865fe7b9c5b45f61c451cbaafa43d"/>
   <project name="platform/system/core" path="system/core" revision="350eac5403124dacb2a5fd9e28ac290a59fc3b8e"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="5502ba6f3f7606d0142cf38b1067d3d0a669f314"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="7e257a260fb6a6c3811f9c396cfe3ccf191241f6"/>
   <project name="platform/system/qcom" path="system/qcom" revision="63e3f6f176caad587d42bba4c16b66d953fb23c2"/>
   <project name="platform/vendor/qcom-opensource/wlan/prima" path="vendor/qcom/opensource/wlan/prima" revision="d8952a42771045fca73ec600e2b42a4c7129d723"/>
   <project name="platform/vendor/qcom/msm8610" path="device/qcom/msm8610" revision="018b44e52b2bac5d3631d559550e88a4b68c6e67"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index 056b2ee3e6fb..a05ca8320354 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -145,7 +145,7 @@
   <project name="platform/hardware/ril" path="hardware/ril" revision="c4e2ac95907a5519a0e09f01a0d8e27fec101af0"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="e1eb226fa3ad3874ea7b63c56a9dc7012d7ff3c2"/>
   <project name="platform/system/core" path="system/core" revision="adc485d8755af6a61641d197de7cfef667722580"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="5502ba6f3f7606d0142cf38b1067d3d0a669f314"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="7e257a260fb6a6c3811f9c396cfe3ccf191241f6"/>
   <project name="platform/system/qcom" path="system/qcom" revision="1cdab258b15258b7f9657da70e6f06ebd5a2fc25"/>
   <project name="platform/vendor/qcom/msm8610" path="device/qcom/msm8610" revision="4ae5df252123591d5b941191790e7abed1bce5a4"/>
   <project name="platform/vendor/qcom-opensource/wlan/prima" path="vendor/qcom/opensource/wlan/prima" revision="ce18b47b4a4f93a581d672bbd5cb6d12fe796ca9"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 3c2ddc82dbff..411789912c87 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -129,7 +129,7 @@
   <project name="device-mako" path="device/lge/mako" remote="b2g" revision="78d17f0c117f0c66dd55ee8d5c5dde8ccc93ecba"/>
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="3a9a17613cc685aa232432566ad6cc607eab4ec1"/>
   <project name="device/lge/mako-kernel" path="device/lge/mako-kernel" revision="d1729e53d71d711c8fde25eab8728ff2b9b4df0e"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="5502ba6f3f7606d0142cf38b1067d3d0a669f314"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="7e257a260fb6a6c3811f9c396cfe3ccf191241f6"/>
   <project name="platform/external/libnfc-nci" path="external/libnfc-nci" revision="7d33aaf740bbf6c7c6e9c34a92b371eda311b66b"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="0e56e450367cd802241b27164a2979188242b95f"/>
   <project name="platform/hardware/broadcom/wlan" path="hardware/broadcom/wlan" revision="0e1929fa3aa38bf9d40e9e953d619fab8164c82e"/>

From 7432afee81332e7220cc092d58c1051c7132c7f5 Mon Sep 17 00:00:00 2001
From: Mark Banner <standard8@mozilla.com>
Date: Wed, 19 Nov 2014 08:10:56 +0000
Subject: [PATCH 83/84] Bug 1099128 Swap Loop to use 2 person conversations
 (aka 'rooms') rather than call urls.
 r=mikedeboer,a=enabling-for-dogfooding,a=Tomcat

---
 browser/app/profile/firefox.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index abb3d524d4ec..36d2166c482b 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1666,7 +1666,7 @@ pref("loop.CSP", "default-src 'self' about: file: chrome:; img-src 'self' data:
 #endif
 pref("loop.oauth.google.redirect_uri", "urn:ietf:wg:oauth:2.0:oob:auto");
 pref("loop.oauth.google.scope", "https://www.google.com/m8/feeds");
-pref("loop.rooms.enabled", false);
+pref("loop.rooms.enabled", true);
 pref("loop.fxa_oauth.tokendata", "");
 pref("loop.fxa_oauth.profile", "");
 

From ec54cd53724d59a9cde84295130cac97ae206551 Mon Sep 17 00:00:00 2001
From: Mark Banner <standard8@mozilla.com>
Date: Wed, 19 Nov 2014 09:55:34 +0000
Subject: [PATCH 84/84] Follow-up to bug 1099128 - temporarily turn off rooms
 for mochitests to fix bc1 test failures. rs+a=bustage-fix

---
 browser/components/loop/test/mochitest/head.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/browser/components/loop/test/mochitest/head.js b/browser/components/loop/test/mochitest/head.js
index 44160fca035e..6b438cade46e 100644
--- a/browser/components/loop/test/mochitest/head.js
+++ b/browser/components/loop/test/mochitest/head.js
@@ -77,6 +77,11 @@ function promiseGetMozLoopAPI() {
  * This assumes that the tests are running in a generatorTest.
  */
 function loadLoopPanel(aOverrideOptions = {}) {
+  Services.prefs.setBoolPref("loop.rooms.enabled", false);
+  registerCleanupFunction(function() {
+     Services.prefs.clearUserPref("loop.rooms.enabled");
+  });
+
   // Set prefs to ensure we don't access the network externally.
   Services.prefs.setCharPref("services.push.serverURL", aOverrideOptions.pushURL || "ws://localhost/");
   Services.prefs.setCharPref("loop.server", aOverrideOptions.loopURL || "http://localhost/");