Merge inbound to mozilla-central r=merge a=merge

dom/media/MediaDecoder.cpp

@@ -15,6 +15,7 @@
 #include "VideoFrameContainer.h"
 #include "VideoUtils.h"
 #include "mozilla/AbstractThread.h"
+#include "mozilla/AsyncEventDispatcher.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/Preferences.h"
@@ -203,30 +204,32 @@ class MediaDecoder::BackgroundVideoDecodingPermissionObserver final :
 
     void EnableEvent() const
     {
-      nsCOMPtr<nsPIDOMWindowOuter> win = GetOwnerWindow();
-      if (!win) {
+      nsIDocument* doc = GetOwnerDoc();
+      if (!doc) {
         return;
       }
-      nsContentUtils::DispatchEventOnlyToChrome(
-        GetOwnerDoc(), ToSupports(win),
-        NS_LITERAL_STRING("UnselectedTabHover:Enable"),
-        /* Bubbles */ true,
-        /* Cancelable */ false,
-        /* DefaultAction */ nullptr);
+
+      RefPtr<AsyncEventDispatcher> asyncDispatcher =
+        new AsyncEventDispatcher(doc,
+                                 NS_LITERAL_STRING("UnselectedTabHover:Enable"),
+                                 /* Bubbles */ true,
+                                 /* OnlyChromeDispatch */ true);
+      asyncDispatcher->PostDOMEvent();
     }
 
     void DisableEvent() const
     {
-      nsCOMPtr<nsPIDOMWindowOuter> win = GetOwnerWindow();
-      if (!win) {
+      nsIDocument* doc = GetOwnerDoc();
+      if (!doc) {
         return;
       }
-      nsContentUtils::DispatchEventOnlyToChrome(
-        GetOwnerDoc(), ToSupports(win),
-        NS_LITERAL_STRING("UnselectedTabHover:Disable"),
-        /* Bubbles */ true,
-        /* Cancelable */ false,
-        /* DefaultAction */ nullptr);
+
+      RefPtr<AsyncEventDispatcher> asyncDispatcher =
+        new AsyncEventDispatcher(doc,
+                                 NS_LITERAL_STRING("UnselectedTabHover:Disable"),
+                                 /* Bubbles */ true,
+                                 /* OnlyChromeDispatch */ true);
+      asyncDispatcher->PostDOMEvent();
     }
 
     already_AddRefed<nsPIDOMWindowOuter> GetOwnerWindow() const

extensions/spellcheck/locales/en-US/hunspell/en-US.dic

@@ -1,4 +1,4 @@
-52374
+52375
 0/nm
 0th/pt
 1/n1
@@ -43519,6 +43519,7 @@ scolding/M
 scoliosis/M
 sconce/SM
 scone/MS
+scooch/DGS
 scoop/MDSG
 scoopful/MS
 scoot/DRSZG

gfx/2d/DrawTargetSkia.cpp

@@ -307,6 +307,9 @@ DrawTargetSkia::~DrawTargetSkia()
 already_AddRefed<SourceSurface>
 DrawTargetSkia::Snapshot()
 {
+  // Without this lock, this could cause us to get out a snapshot and race with
+  // Snapshot::~Snapshot() actually destroying itself.
+  MutexAutoLock lock(*mSnapshotLock);
   RefPtr<SourceSurfaceSkia> snapshot = mSnapshot;
   if (mSurface && !snapshot) {
     snapshot = new SourceSurfaceSkia();

js/src/gc/Cell.h

@@ -10,6 +10,7 @@
 #include "gc/GCEnum.h"
 #include "gc/Heap.h"
 #include "js/GCAnnotations.h"
+#include "js/TraceKind.h"
 
 namespace JS {
 
@@ -75,6 +76,23 @@ struct Cell
 
     static MOZ_ALWAYS_INLINE bool needWriteBarrierPre(JS::Zone* zone);
 
+    template <class T>
+    inline bool is() const {
+        return getTraceKind() == JS::MapTypeToTraceKind<T>::kind;
+    }
+
+    template<class T>
+    inline T* as() {
+        MOZ_ASSERT(is<T>());
+        return static_cast<T*>(this);
+    }
+
+    template <class T>
+    inline const T* as() const {
+        MOZ_ASSERT(is<T>());
+        return static_cast<const T*>(this);
+    }
+
 #ifdef DEBUG
     inline bool isAligned() const;
     void dump(GenericPrinter& out) const;

js/src/gc/GCEnum.h

@@ -49,7 +49,8 @@ enum class State {
     D(MallocBytesTrigger) \
     D(GCBytesTrigger) \
     D(ZoneChange) \
-    D(CompartmentRevived)
+    D(CompartmentRevived) \
+    D(GrayRootBufferingFailed)
 enum class AbortReason {
 #define MAKE_REASON(name) name,
     GC_ABORT_REASONS(MAKE_REASON)

js/src/gc/Verifier.cpp

@@ -690,9 +690,9 @@ CheckGrayMarkingTracer::checkCell(Cell* cell)
         dumpCellPath();
 
 #ifdef DEBUG
-        if (cell->getTraceKind() == JS::TraceKind::Object) {
+        if (cell->is<JSObject>()) {
             fprintf(stderr, "\n");
-            DumpObject(static_cast<JSObject*>(cell), stderr);
+            DumpObject(cell->as<JSObject>(), stderr);
         }
 #endif
     }

js/src/jsgc.cpp

@@ -6956,6 +6956,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget& budget, JS::gcreason::Reason rea
         if (!hasBufferedGrayRoots()) {
             budget.makeUnlimited();
             isIncremental = false;
+            stats().nonincremental(AbortReason::GrayRootBufferingFailed);
         }
 
         if (drainMarkStack(budget, gcstats::PhaseKind::MARK) == NotFinished)
@@ -8268,7 +8269,7 @@ JS_FRIEND_API(void)
 JS::AssertGCThingIsNotAnObjectSubclass(Cell* cell)
 {
     MOZ_ASSERT(cell);
-    MOZ_ASSERT(cell->getTraceKind() != JS::TraceKind::Object);
+    MOZ_ASSERT(!cell->is<JSObject>());
 }
 
 JS_FRIEND_API(void)

js/src/vm/Debugger.cpp

@@ -5187,9 +5187,9 @@ GetScriptReferent(JSObject* obj)
 {
     MOZ_ASSERT(obj->getClass() == &DebuggerScript_class);
     if (gc::Cell* cell = GetScriptReferentCell(obj)) {
-        if (cell->getTraceKind() == JS::TraceKind::Script)
-            return AsVariant(static_cast<JSScript*>(cell));
-        MOZ_ASSERT(cell->getTraceKind() == JS::TraceKind::Object);
+        if (cell->is<JSScript>())
+            return AsVariant(cell->as<JSScript>());
+        MOZ_ASSERT(cell->is<JSObject>());
         return AsVariant(&static_cast<NativeObject*>(cell)->as<WasmInstanceObject>());
     }
     return AsVariant(static_cast<JSScript*>(nullptr));
@@ -5201,13 +5201,13 @@ DebuggerScript_trace(JSTracer* trc, JSObject* obj)
     /* This comes from a private pointer, so no barrier needed. */
     gc::Cell* cell = GetScriptReferentCell(obj);
     if (cell) {
-        if (cell->getTraceKind() == JS::TraceKind::Script) {
-            JSScript* script = static_cast<JSScript*>(cell);
+        if (cell->is<JSScript>()) {
+            JSScript* script = cell->as<JSScript>();
             TraceManuallyBarrieredCrossCompartmentEdge(trc, obj, &script,
                                                        "Debugger.Script script referent");
             obj->as<NativeObject>().setPrivateUnbarriered(script);
         } else {
-            JSObject* wasm = static_cast<JSObject*>(cell);
+            JSObject* wasm = cell->as<JSObject>();
             TraceManuallyBarrieredCrossCompartmentEdge(trc, obj, &wasm,
                                                        "Debugger.Script wasm referent");
             MOZ_ASSERT(wasm->is<WasmInstanceObject>());

layout/base/nsLayoutUtils.cpp

@@ -3074,10 +3074,12 @@ TransformGfxRectToAncestor(nsIFrame *aFrame,
     *aPreservesAxisAlignedRectangles =
       ctm.Is2D(&matrix2d) && matrix2d.PreservesAxisAlignedRectangles();
   }
-  Rect maxBounds = Rect(-std::numeric_limits<float>::max() * 0.5,
-                        -std::numeric_limits<float>::max() * 0.5,
-                        std::numeric_limits<float>::max(),
-                        std::numeric_limits<float>::max());
+  const nsIFrame* ancestor = aOutAncestor ? *aOutAncestor : aAncestor;
+  float factor = ancestor->PresContext()->AppUnitsPerDevPixel();
+  Rect maxBounds = Rect(float(nscoord_MIN) / factor * 0.5,
+                        float(nscoord_MIN) / factor * 0.5,
+                        float(nscoord_MAX) / factor,
+                        float(nscoord_MAX) / factor);
   return ctm.TransformAndClipBounds(aRect, maxBounds);
 }
 

layout/generic/nsFrame.cpp

@@ -2740,6 +2740,12 @@ nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder* aBuilder,
     aBuilder->AddToWillChangeBudget(this, GetSize());
   }
 
+  // For preserves3d, use the dirty rect already installed on the
+  // builder, since aDirtyRect maybe distorted for transforms along
+  // the chain.
+  nsRect visibleRect = aBuilder->GetVisibleRect();
+  nsRect dirtyRect = aBuilder->GetDirtyRect();
+
   bool extend3DContext = Extend3DContext(disp, effectSet);
   Maybe<nsDisplayListBuilder::AutoPreserves3DContext> autoPreserves3DContext;
   if (extend3DContext && !Combines3DTransformWithAncestors(disp)) {
@@ -2749,13 +2755,14 @@ nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder* aBuilder,
     // Save dirty rect on the builder to avoid being distorted for
     // multiple transforms along the chain.
     aBuilder->SavePreserves3DRect();
-  }
 
-  // For preserves3d, use the dirty rect already installed on the
-  // builder, since aDirtyRect maybe distorted for transforms along
-  // the chain.
-  nsRect visibleRect = aBuilder->GetVisibleRect();
-  nsRect dirtyRect = aBuilder->GetDirtyRect();
+    // We rebuild everything within preserve-3d and don't try
+    // to retain, so override the dirty rect now.
+    if (aBuilder->IsRetainingDisplayList()) {
+      dirtyRect = visibleRect;
+      aBuilder->MarkFrameModifiedDuringBuilding(this);
+    }
+  }
 
   bool inTransform = aBuilder->IsInTransform();
   bool isTransformed = IsTransformed(disp);
@@ -2808,7 +2815,9 @@ nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder* aBuilder,
   }
 
   bool hasOverrideDirtyRect = false;
-  if (HasOverrideDirtyRegion() && !aBuilder->InInvalidSubtree()) {
+  // If we have an override dirty region, and neither us nor our ancestors are
+  // modified, then use it.
+  if (HasOverrideDirtyRegion() && !aBuilder->InInvalidSubtree() && !IsFrameModified()) {
     nsDisplayListBuilder::DisplayListBuildingData* data =
       GetProperty(nsDisplayListBuilder::DisplayListBuildingRect());
     if (data) {