Merge mozilla-central to UX

.hgtags

@@ -94,3 +94,4 @@ cc37417e2c284aed960f98ffa479de4ccdd5c7c3 FIREFOX_AURORA_21_BASE
 1c070ab0f9db59f13423b9c1db60419f7a9098f9 FIREFOX_AURORA_22_BASE
 d7ce9089999719d5186595d160f25123a4e63e39 FIREFOX_AURORA_23_BASE
 8d3810543edccf4fbe458178b88dd4a6e420b010 FIREFOX_AURORA_24_BASE
+ad0ae007aa9e03cd74e9005cd6652e544139b3b5 FIREFOX_AURORA_25_BASE

accessible/src/base/nsCoreUtils.cpp

@@ -75,8 +75,7 @@ nsCoreUtils::DispatchClickEvent(nsITreeBoxObject *aTreeBoxObj,
   if (!document)
     return;
 
-  nsIPresShell *presShell = nullptr;
-  presShell = document->GetShell();
+  nsCOMPtr<nsIPresShell> presShell = document->GetShell();
   if (!presShell)
     return;
 
@@ -102,14 +101,14 @@ nsCoreUtils::DispatchClickEvent(nsITreeBoxObject *aTreeBoxObj,
   tcBoxObj->GetY(&tcY);
 
   // Dispatch mouse events.
-  nsIFrame* tcFrame = tcContent->GetPrimaryFrame();
+  nsWeakFrame tcFrame = tcContent->GetPrimaryFrame();
   nsIFrame* rootFrame = presShell->GetRootFrame();
 
   nsPoint offset;
   nsIWidget *rootWidget =
     rootFrame->GetViewExternal()->GetNearestWidget(&offset);
 
-  nsPresContext* presContext = presShell->GetPresContext();
+  nsRefPtr<nsPresContext> presContext = presShell->GetPresContext();
 
   int32_t cnvdX = presContext->CSSPixelsToDevPixels(tcX + x + 1) +
     presContext->AppUnitsToDevPixels(offset.x);

accessible/src/generic/Accessible.cpp

@@ -2285,7 +2285,7 @@ Accessible::DispatchClickEvent(nsIContent *aContent, uint32_t aActionIndex)
   if (IsDefunct())
     return;
 
-  nsIPresShell* presShell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> presShell = mDoc->PresShell();
 
   // Scroll into view.
   presShell->ScrollContentIntoView(aContent,
@@ -2293,7 +2293,7 @@ Accessible::DispatchClickEvent(nsIContent *aContent, uint32_t aActionIndex)
                                    nsIPresShell::ScrollAxis(),
                                    nsIPresShell::SCROLL_OVERFLOW_HIDDEN);
 
-  nsIFrame* frame = aContent->GetPrimaryFrame();
+  nsWeakFrame frame = aContent->GetPrimaryFrame();
   if (!frame)
     return;
 
@@ -2305,8 +2305,7 @@ Accessible::DispatchClickEvent(nsIContent *aContent, uint32_t aActionIndex)
 
   nsSize size = frame->GetSize();
 
-  nsPresContext* presContext = presShell->GetPresContext();
-
+  nsRefPtr<nsPresContext> presContext = presShell->GetPresContext();
   int32_t x = presContext->AppUnitsToDevPixels(point.x + size.width / 2);
   int32_t y = presContext->AppUnitsToDevPixels(point.y + size.height / 2);
 

b2g/config/gaia.json

@@ -1,4 +1,4 @@
 {
-    "revision": "5e7a8bbe525c0a43852770665ce9498fdb93ea81", 
+    "revision": "bfebfb81d21bd6a4fb30f11044e6531e8bfaea3a", 
     "repo_path": "/integration/gaia-central"
 }

b2g/confvars.sh

@@ -5,7 +5,7 @@
 MOZ_APP_BASENAME=B2G
 MOZ_APP_VENDOR=Mozilla
 
-MOZ_APP_VERSION=25.0a1
+MOZ_APP_VERSION=26.0a1
 MOZ_APP_UA_NAME=Firefox
 
 MOZ_UA_OS_AGNOSTIC=1

browser/base/content/browser.js

@@ -1245,6 +1245,12 @@ var gBrowserInit = {
 #endif
 #endif
 
+    if (gMultiProcessBrowser) {
+      // Bug 862519 - Backspace doesn't work in electrolysis builds.
+      // We bypass the problem by disabling the backspace-to-go-back command.
+      document.getElementById("cmd_handleBackspace").setAttribute("disabled", true);
+    }
+
     SessionStore.promiseInitialized.then(() => {
       // Enable the Restore Last Session command if needed
       if (SessionStore.canRestoreLastSession &&

browser/base/content/tabbrowser.xml

@@ -1415,9 +1415,15 @@
 
             t.setAttribute("crop", "end");
             t.setAttribute("onerror", "this.removeAttribute('image');");
+            t.className = "tabbrowser-tab";
+
+#ifdef MAKE_E10S_WORK
+            let remote = this._shouldBrowserBeRemote(aURI);
+#else
+            let remote = gMultiProcessBrowser;
+#endif
             if (remote)
               t.setAttribute("remote", "true");
-            t.className = "tabbrowser-tab";
 
             this.tabContainer._unlockTabSizing();
 
@@ -1452,11 +1458,6 @@
             b.setAttribute("contextmenu", this.getAttribute("contentcontextmenu"));
             b.setAttribute("tooltip", this.getAttribute("contenttooltip"));
 
-#ifdef MAKE_E10S_WORK
-            let remote = this._shouldBrowserBeRemote(aURI);
-#else
-            let remote = gMultiProcessBrowser;
-#endif
             if (remote)
               b.setAttribute("remote", "true");
 

browser/base/content/test/browser_CTP_data_urls.js

@@ -95,6 +95,22 @@ function prepareTest(nextTest, url) {
   gTestBrowser.contentWindow.location = url;
 }
 
+// Due to layout being async, "PluginBindAttached" may trigger later.
+// This wraps a function to force a layout flush, thus triggering it,
+// and schedules the function execution so they're definitely executed
+// afterwards.
+function runAfterPluginBindingAttached(func) {
+  let doc = gTestBrowser.contentDocument;
+  return function() {
+    let elems = doc.getElementsByTagName('embed');
+    if (elems.length < 1) {
+      elems = doc.getElementsByTagName('object');
+    }
+    elems[0].clientTop;
+    executeSoon(func);
+  };
+}
+
 // Test that the click-to-play doorhanger still works when navigating to data URLs
 function test1a() {
   let popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
@@ -104,7 +120,7 @@ function test1a() {
   let objLoadingContent = plugin.QueryInterface(Ci.nsIObjectLoadingContent);
   ok(!objLoadingContent.activated, "Test 1a, Plugin should not be activated");
 
-  gNextTest = test1b;
+  gNextTest = runAfterPluginBindingAttached(test1b);
   gTestBrowser.contentDocument.getElementById("data-link-1").click();
 }
 
@@ -126,7 +142,7 @@ function test1b() {
 
 function test1c() {
   clearAllPluginPermissions();
-  prepareTest(test2a, gHttpTestRoot + "plugin_data_url.html");
+  prepareTest(runAfterPluginBindingAttached(test2a), gHttpTestRoot + "plugin_data_url.html");
 }
 
 // Test that the click-to-play notification doesn't break when navigating to data URLs with multiple plugins
@@ -137,7 +153,7 @@ function test2a() {
   let objLoadingContent = plugin.QueryInterface(Ci.nsIObjectLoadingContent);
   ok(!objLoadingContent.activated, "Test 2a, Plugin should not be activated");
 
-  gNextTest = test2b;
+  gNextTest = runAfterPluginBindingAttached(test2b);
   gTestBrowser.contentDocument.getElementById("data-link-2").click();
 }
 
@@ -184,7 +200,7 @@ function test2c() {
   ok(objLoadingContent.activated, "Test 2c, Plugin should be activated");
 
   clearAllPluginPermissions();
-  prepareTest(test3a, gHttpTestRoot + "plugin_data_url.html");
+  prepareTest(runAfterPluginBindingAttached(test3a), gHttpTestRoot + "plugin_data_url.html");
 }
 
 // Test that when navigating to a data url, the plugin permission is inherited
@@ -214,7 +230,8 @@ function test3c() {
   ok(objLoadingContent.activated, "Test 3c, Plugin should be activated");
 
   clearAllPluginPermissions();
-  prepareTest(test4b, 'data:text/html,<embed id="test" style="width: 200px; height: 200px" type="application/x-test"/>');
+  prepareTest(runAfterPluginBindingAttached(test4b),
+              'data:text/html,<embed id="test" style="width: 200px; height: 200px" type="application/x-test"/>');
 }
 
 // Test that the click-to-play doorhanger still works when directly navigating to data URLs

browser/base/content/test/browser_bug752516.js

@@ -29,8 +29,10 @@ function test() {
 }
 
 function tabLoad() {
-  // The plugin events are async dispatched and can come after the load event
-  // This just allows the events to fire before we proceed
+  // Due to layout being async, "PluginBindAttached" may trigger later.
+  // This forces a layout flush, thus triggering it, and schedules the
+  // test so it is definitely executed afterwards.
+  gTestBrowser.contentDocument.getElementById('test').clientTop;
   executeSoon(actualTest);
 }
 

browser/base/content/test/browser_bug787619.js

@@ -21,6 +21,10 @@ function test() {
 }
 
 function pageLoad() {
+  // Due to layout being async, "PluginBindAttached" may trigger later.
+  // This forces a layout flush, thus triggering it, and schedules the
+  // test so it is definitely executed afterwards.
+  gTestBrowser.contentDocument.getElementById('plugin').clientTop;
   executeSoon(part1);
 }
 

browser/base/content/test/browser_bug812562.js

@@ -21,7 +21,14 @@ function test() {
   gTestBrowser.addEventListener("load", pageLoad, true);
   setAndUpdateBlocklist(gHttpTestRoot + "blockPluginVulnerableUpdatable.xml",
   function() {
-    prepareTest(testPart1, gHttpTestRoot + "plugin_test.html");
+    prepareTest(function() {
+        // Due to layout being async, "PluginBindAttached" may trigger later.
+        // This forces a layout flush, thus triggering it, and schedules the
+        // test so it is definitely executed afterwards.
+        gTestBrowser.contentDocument.getElementById('test').clientTop;
+        testPart1();
+      },
+      gHttpTestRoot + "plugin_test.html");
   });
 }
 

browser/base/content/test/browser_bug818118.js

@@ -23,8 +23,10 @@ function test() {
 }
 
 function pageLoad(aEvent) {
-  // The plugin events are async dispatched and can come after the load event
-  // This just allows the events to fire before we then go on to test the states
+  // Due to layout being async, "PluginBindAttached" may trigger later.
+  // This forces a layout flush, thus triggering it, and schedules the
+  // test so it is definitely executed afterwards.
+  gTestBrowser.contentDocument.getElementById('test').clientTop;
   executeSoon(actualTest);
 }
 

browser/base/content/test/browser_pluginnotification.js

@@ -94,6 +94,22 @@ function prepareTest(nextTest, url) {
   gTestBrowser.contentWindow.location = url;
 }
 
+// Due to layout being async, "PluginBindAttached" may trigger later.
+// This wraps a function to force a layout flush, thus triggering it,
+// and schedules the function execution so they're definitely executed
+// afterwards.
+function runAfterPluginBindingAttached(func) {
+  let doc = gTestBrowser.contentDocument;
+  return function() {
+    let elems = doc.getElementsByTagName('embed');
+    if (elems.length < 1) {
+      elems = doc.getElementsByTagName('object');
+    }
+    elems[0].clientTop;
+    executeSoon(func);
+  };
+}
+
 // Tests a page with an unknown plugin in it.
 function test1() {
   ok(PopupNotifications.getNotification("plugins-not-found", gTestBrowser), "Test 1, Should have displayed the missing plugin notification");
@@ -109,7 +125,7 @@ function test1() {
   var plugin = getTestPlugin();
   ok(plugin, "Should have a test plugin");
   plugin.enabledState = Ci.nsIPluginTag.STATE_ENABLED;
-  prepareTest(test2, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test2), gTestRoot + "plugin_test.html");
 }
 
 // Tests a page with a working plugin in it.
@@ -120,7 +136,7 @@ function test2() {
   var plugin = getTestPlugin();
   ok(plugin, "Should have a test plugin");
   plugin.enabledState = Ci.nsIPluginTag.STATE_DISABLED;
-  prepareTest(test3, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test3), gTestRoot + "plugin_test.html");
 }
 
 // Tests a page with a disabled plugin in it.
@@ -152,7 +168,7 @@ function prepareTest5() {
   setAndUpdateBlocklist(gHttpTestRoot + "blockPluginHard.xml",
     function() {
       info("prepareTest5 callback");
-      prepareTest(test5, gTestRoot + "plugin_test.html");
+      prepareTest(runAfterPluginBindingAttached(test5), gTestRoot + "plugin_test.html");
   });
 }
 
@@ -174,7 +190,7 @@ function test5() {
   var objLoadingContent = pluginNode.QueryInterface(Ci.nsIObjectLoadingContent);
   is(objLoadingContent.pluginFallbackType, Ci.nsIObjectLoadingContent.PLUGIN_BLOCKLISTED, "Test 5, plugin fallback type should be PLUGIN_BLOCKLISTED");
 
-  prepareTest(test6, gTestRoot + "plugin_both.html");
+  prepareTest(runAfterPluginBindingAttached(test6), gTestRoot + "plugin_both.html");
 }
 
 // Tests a page with a blocked and unknown plugin in it.
@@ -184,7 +200,7 @@ function test6() {
   ok(gTestBrowser.missingPlugins.has("application/x-unknown"), "Test 6, Should know about application/x-unknown");
   ok(!gTestBrowser.missingPlugins.has("application/x-test"), "Test 6, application/x-test should not be a missing plugin");
 
-  prepareTest(test7, gTestRoot + "plugin_both2.html");
+  prepareTest(runAfterPluginBindingAttached(test7), gTestRoot + "plugin_both2.html");
 }
 
 // Tests a page with a blocked and unknown plugin in it (alternate order to above).
@@ -199,7 +215,7 @@ function test7() {
   getTestPlugin("Second Test Plug-in").enabledState = Ci.nsIPluginTag.STATE_CLICKTOPLAY;
 
   setAndUpdateBlocklist(gHttpTestRoot + "blockNoPlugins.xml", function() {
-    prepareTest(test8, gTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test8), gTestRoot + "plugin_test.html");
   });
 }
 
@@ -214,7 +230,7 @@ function test8() {
   var objLoadingContent = pluginNode.QueryInterface(Ci.nsIObjectLoadingContent);
   is(objLoadingContent.pluginFallbackType, Ci.nsIObjectLoadingContent.PLUGIN_CLICK_TO_PLAY, "Test 8, plugin fallback type should be PLUGIN_CLICK_TO_PLAY");
 
-  prepareTest(test11a, gTestRoot + "plugin_test3.html");
+  prepareTest(runAfterPluginBindingAttached(test11a), gTestRoot + "plugin_test3.html");
 }
 
 // Tests 9 & 10 removed
@@ -224,7 +240,7 @@ function test11a() {
   var popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
   ok(popupNotification, "Test 11a, Should have a click-to-play notification");
 
-  prepareTest(test11b, "about:blank");
+  prepareTest(runAfterPluginBindingAttached(test11b), "about:blank");
 }
 
 // Tests that the going back will reshow the notification for click-to-play plugins (part 2/4)
@@ -248,7 +264,7 @@ function test11d() {
   var popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
   ok(popupNotification, "Test 11d, Should have a click-to-play notification");
 
-  prepareTest(test12a, gHttpTestRoot + "plugin_clickToPlayAllow.html");
+  prepareTest(runAfterPluginBindingAttached(test12a), gHttpTestRoot + "plugin_clickToPlayAllow.html");
 }
 
 // Tests that the "Allow Always" permission works for click-to-play plugins
@@ -270,7 +286,7 @@ function test12a() {
 function test12b() {
   var popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
   ok(popupNotification, "Test 12d, Should have a click-to-play notification");
-  prepareTest(test12c, gHttpTestRoot + "plugin_two_types.html");
+  prepareTest(runAfterPluginBindingAttached(test12c), gHttpTestRoot + "plugin_two_types.html");
 }
 
 // Test that the "Always" permission, when set for just the Test plugin,
@@ -302,7 +318,7 @@ function test14() {
   var plugin = getTestPlugin();
   plugin.enabledState = Ci.nsIPluginTag.STATE_CLICKTOPLAY;
   getTestPlugin("Second Test Plug-in").enabledState = Ci.nsIPluginTag.STATE_CLICKTOPLAY;
-  prepareTest(test15, gTestRoot + "plugin_alternate_content.html");
+  prepareTest(runAfterPluginBindingAttached(test15), gTestRoot + "plugin_alternate_content.html");
 }
 
 // Tests that the overlay is shown instead of alternate content when
@@ -313,7 +329,7 @@ function test15() {
   var mainBox = doc.getAnonymousElementByAttribute(plugin, "class", "mainBox");
   ok(mainBox, "Test 15, Plugin with id=" + plugin.id + " overlay should exist");
 
-  prepareTest(test17, gTestRoot + "plugin_bug749455.html");
+  prepareTest(runAfterPluginBindingAttached(test17), gTestRoot + "plugin_bug749455.html");
 }
 
 // Test 16 removed
@@ -328,7 +344,7 @@ function test17() {
 
   setAndUpdateBlocklist(gHttpTestRoot + "blockPluginVulnerableUpdatable.xml",
   function() {
-    prepareTest(test18a, gHttpTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test18a), gHttpTestRoot + "plugin_test.html");
   });
 }
 
@@ -371,7 +387,7 @@ function test18b() {
 
   setAndUpdateBlocklist(gHttpTestRoot + "blockPluginVulnerableNoUpdate.xml",
   function() {
-    prepareTest(test18c, gHttpTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test18c), gHttpTestRoot + "plugin_test.html");
   });
 }
 
@@ -414,7 +430,7 @@ function test18e() {
   ok(objLoadingContent.activated, "Test 18e, Plugin should be activated");
 
   clearAllPluginPermissions();
-  prepareTest(test18f, gHttpTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test18f), gHttpTestRoot + "plugin_test.html");
 }
 
 // clicking the in-content overlay of a vulnerable plugin should bring
@@ -446,7 +462,7 @@ function test18g() {
   setAndUpdateBlocklist(gHttpTestRoot + "blockNoPlugins.xml",
   function() {
     resetBlocklist();
-    prepareTest(test19a, gTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test19a), gTestRoot + "plugin_test.html");
   });
 }
 
@@ -465,7 +481,7 @@ function test19a() {
 }
 
 function test19b() {
-  prepareTest(test19c, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test19c), gTestRoot + "plugin_test.html");
 }
 
 // Tests that clicking the text of the overlay activates the plugin
@@ -484,7 +500,7 @@ function test19c() {
 }
 
 function test19d() {
-  prepareTest(test19e, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test19e), gTestRoot + "plugin_test.html");
 }
 
 // Tests that clicking the box of the overlay activates the doorhanger
@@ -503,7 +519,7 @@ function test19e() {
 }
 
 function test19f() {
-  prepareTest(test20a, gTestRoot + "plugin_hidden_to_visible.html");
+  prepareTest(runAfterPluginBindingAttached(test20a), gTestRoot + "plugin_hidden_to_visible.html");
 }
 
 // Tests that a plugin in a div that goes from style="display: none" to
@@ -568,7 +584,7 @@ function test20d() {
 
   clearAllPluginPermissions();
 
-  prepareTest(test21a, gTestRoot + "plugin_two_types.html");
+  prepareTest(runAfterPluginBindingAttached(test21a), gTestRoot + "plugin_two_types.html");
 }
 
 // Test having multiple different types of plugin on one page
@@ -696,7 +712,7 @@ function test21e() {
 
   clearAllPluginPermissions();
 
-  prepareTest(test22, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test22), gTestRoot + "plugin_test.html");
 }
 
 // Tests that a click-to-play plugin retains its activated state upon reloading
@@ -728,7 +744,7 @@ function test22() {
   }
   ok(pluginsDiffer, "Test 22, plugin should have reloaded");
 
-  prepareTest(test23, gTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test23), gTestRoot + "plugin_test.html");
 }
 
 // Tests that a click-to-play plugin resets its activated state when changing types
@@ -758,7 +774,7 @@ function test23() {
   is(objLoadingContent.pluginFallbackType, Ci.nsIObjectLoadingContent.PLUGIN_CLICK_TO_PLAY, "Test 23, Plugin should be click-to-play");
   ok(!pluginNode.activated, "Test 23, plugin node should not be activated");
 
-  prepareTest(test24a, gHttpTestRoot + "plugin_test.html");
+  prepareTest(runAfterPluginBindingAttached(test24a), gHttpTestRoot + "plugin_test.html");
 }
 
 // Test that "always allow"-ing a plugin will not allow it when it becomes
@@ -786,7 +802,7 @@ function test24b() {
   ok(objLoadingContent.activated, "Test 24b, plugin should be activated");
   setAndUpdateBlocklist(gHttpTestRoot + "blockPluginVulnerableUpdatable.xml",
   function() {
-    prepareTest(test24c, gHttpTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test24c), gHttpTestRoot + "plugin_test.html");
   });
 }
 

browser/components/sessionstore/src/SessionStore.jsm

@@ -547,13 +547,6 @@ let SessionStoreInternal = {
       return this._prefBranch.getIntPref("sessionstore.interval");
     });
 
-    // when crash recovery is disabled, session data is not written to disk
-    XPCOMUtils.defineLazyGetter(this, "_resume_from_crash", function () {
-      // get crash recovery state from prefs and allow for proper reaction to state changes
-      this._prefBranch.addObserver("sessionstore.resume_from_crash", this, true);
-      return this._prefBranch.getBoolPref("sessionstore.resume_from_crash");
-    });
-
     XPCOMUtils.defineLazyGetter(this, "_max_tabs_undo", function () {
       this._prefBranch.addObserver("sessionstore.max_tabs_undo", this, true);
       return this._prefBranch.getIntPref("sessionstore.max_tabs_undo");
@@ -1191,14 +1184,6 @@ let SessionStoreInternal = {
         }
         this.saveStateDelayed(null, -1);
         break;
-      case "sessionstore.resume_from_crash":
-        this._resume_from_crash = this._prefBranch.getBoolPref("sessionstore.resume_from_crash");
-        // either create the file with crash recovery information or remove it
-        // (when _loadState is not STATE_RUNNING, that file is used for session resuming instead)
-        if (!this._resume_from_crash)
-          _SessionFile.wipe();
-        this.saveState(true);
-        break;
     }
   },
 
@@ -2547,11 +2532,9 @@ let SessionStoreInternal = {
    * gather session data as object
    * @param aUpdateAll
    *        Bool update all windows
-   * @param aPinnedOnly
-   *        Bool collect pinned tabs only
    * @returns object
    */
-  _getCurrentState: function ssi_getCurrentState(aUpdateAll, aPinnedOnly) {
+  _getCurrentState: function ssi_getCurrentState(aUpdateAll) {
     this._handleClosedWindows();
 
     var activeWindow = this._getMostRecentBrowserWindow();
@@ -2614,24 +2597,6 @@ let SessionStoreInternal = {
     }
 #endif
 
-    if (aPinnedOnly) {
-      // perform a deep copy so that existing session variables are not changed.
-      total = JSON.parse(this._toJSONString(total));
-      total = total.filter(function (win) {
-        win.tabs = win.tabs.filter(function (tab) tab.pinned);
-        // remove closed tabs
-        win._closedTabs = [];
-        // correct selected tab index if it was stripped out
-        if (win.selected > win.tabs.length)
-          win.selected = 1;
-        return win.tabs.length > 0;
-      });
-      if (total.length == 0)
-        return null;
-
-      lastClosedWindowsCopy = [];
-    }
-
     if (activeWindow) {
       this.activeWindowSSiCache = activeWindow.__SSi || "";
     }
@@ -3759,12 +3724,10 @@ let SessionStoreInternal = {
   saveState: function ssi_saveState(aUpdateAll) {
     // If crash recovery is disabled, we only want to resume with pinned tabs
     // if we crash.
-    let pinnedOnly = this._loadState == STATE_RUNNING && !this._resume_from_crash;
-
     TelemetryStopwatch.start("FX_SESSION_RESTORE_COLLECT_DATA_MS");
     TelemetryStopwatch.start("FX_SESSION_RESTORE_COLLECT_DATA_LONGEST_OP_MS");
 
-    var oState = this._getCurrentState(aUpdateAll, pinnedOnly);
+    var oState = this._getCurrentState(aUpdateAll);
     if (!oState) {
       TelemetryStopwatch.cancel("FX_SESSION_RESTORE_COLLECT_DATA_MS");
       TelemetryStopwatch.cancel("FX_SESSION_RESTORE_COLLECT_DATA_LONGEST_OP_MS");
@@ -3844,8 +3807,7 @@ let SessionStoreInternal = {
     }
 
     // Write (atomically) to a session file, using a tmp file.
-    let promise =
-      _SessionFile.write(data, {backupOnFirstWrite: this._resume_from_crash});
+    let promise = _SessionFile.write(data);
 
     // Once the session file is successfully updated, save the time stamp of the
     // last save and notify the observers.

browser/components/sessionstore/src/SessionWorker.js

@@ -124,23 +124,33 @@ let Agent = {
   /**
    * Write the session to disk.
    */
-  write: function (stateString, options) {
+  write: function (stateString) {
+    let exn;
     let telemetry = {};
+
     if (!this.hasWrittenState) {
-      if (options && options.backupOnFirstWrite) {
-        try {
-          let startMs = Date.now();
-          File.move(this.path, this.backupPath);
-          telemetry.FX_SESSION_RESTORE_BACKUP_FILE_MS = Date.now() - startMs;
-        } catch (ex if isNoSuchFileEx(ex)) {
-          // Ignore exceptions about non-existent files.
-        }
+      try {
+        let startMs = Date.now();
+        File.move(this.path, this.backupPath);
+        telemetry.FX_SESSION_RESTORE_BACKUP_FILE_MS = Date.now() - startMs;
+      } catch (ex if isNoSuchFileEx(ex)) {
+        // Ignore exceptions about non-existent files.
+      } catch (ex) {
+        // Throw the exception after we wrote the state to disk
+        // so that the backup can't interfere with the actual write.
+        exn = ex;
       }
 
       this.hasWrittenState = true;
     }
 
-    return this._write(stateString, telemetry);
+    let ret = this._write(stateString, telemetry);
+
+    if (exn) {
+      throw exn;
+    }
+
+    return ret;
   },
 
   /**

browser/components/sessionstore/src/_SessionFile.jsm

@@ -67,8 +67,8 @@ this._SessionFile = {
   /**
    * Write the contents of the session file, asynchronously.
    */
-  write: function (aData, aOptions = {}) {
-    return SessionFileInternal.write(aData, aOptions);
+  write: function (aData) {
+    return SessionFileInternal.write(aData);
   },
   /**
    * Writes the initial state to disk again only to change the session's load
@@ -209,13 +209,13 @@ let SessionFileInternal = {
     });
   },
 
-  write: function (aData, aOptions) {
+  write: function (aData) {
     let refObj = {};
     return TaskUtils.spawn(function task() {
       TelemetryStopwatch.start("FX_SESSION_RESTORE_WRITE_FILE_LONGEST_OP_MS", refObj);
 
       try {
-        let promise = SessionWorker.post("write", [aData, aOptions]);
+        let promise = SessionWorker.post("write", [aData]);
         // At this point, we measure how long we stop the main thread
         TelemetryStopwatch.finish("FX_SESSION_RESTORE_WRITE_FILE_LONGEST_OP_MS", refObj);
 

browser/components/sessionstore/test/unit/test_backup_once.js

@@ -25,7 +25,7 @@ add_task(function test_first_write_backup() {
   let initial_content = decoder.decode(yield OS.File.read(pathStore));
 
   do_check_true(!(yield OS.File.exists(pathBackup)));
-  yield _SessionFile.write(content, {backupOnFirstWrite: true});
+  yield _SessionFile.write(content);
   do_check_true(yield OS.File.exists(pathBackup));
 
   let backup_content = decoder.decode(yield OS.File.read(pathBackup));
@@ -38,7 +38,7 @@ add_task(function test_second_write_no_backup() {
   let initial_content = decoder.decode(yield OS.File.read(pathStore));
   let initial_backup_content = decoder.decode(yield OS.File.read(pathBackup));
 
-  yield _SessionFile.write(content, {backupOnFirstWrite: true});
+  yield _SessionFile.write(content);
 
   let written_content = decoder.decode(yield OS.File.read(pathStore));
   do_check_eq(content, written_content);

browser/components/sessionstore/test/unit/test_no_backup_first_write.js

@@ -1,32 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/ */
-
-let toplevel = this;
-Cu.import("resource://gre/modules/osfile.jsm");
-
-function run_test() {
-  let profd = do_get_profile();
-  Cu.import("resource:///modules/sessionstore/_SessionFile.jsm", toplevel);
-  pathStore = OS.Path.join(OS.Constants.Path.profileDir, "sessionstore.js");
-  pathBackup = OS.Path.join(OS.Constants.Path.profileDir, "sessionstore.bak");
-  let source = do_get_file("data/sessionstore_valid.js");
-  source.copyTo(profd, "sessionstore.js");
-  run_next_test();
-}
-
-let pathStore;
-let pathBackup;
-
-// Write to the store first with |backupOnFirstWrite: false|,
-// and make sure second write does not backup even with
-// |backupOnFirstWrite: true|
-add_task(function test_no_backup_on_second_write() {
-  let content = "test_1";
-
-  do_check_true(!(yield OS.File.exists(pathBackup)));
-  yield _SessionFile.write(content, {backupOnFirstWrite: false});
-  do_check_true(!(yield OS.File.exists(pathBackup)));
-
-  yield _SessionFile.write(content, {backupOnFirstWrite: true});
-  do_check_true(!(yield OS.File.exists(pathBackup)));
-});

browser/components/sessionstore/test/unit/xpcshell.ini

@@ -5,7 +5,6 @@ firefox-appdir = browser
 
 [test_backup.js]
 [test_backup_once.js]
-[test_no_backup_first_write.js]
 [test_startup_nosession_sync.js]
 # bug 845190 - thread pool wasn't shutdown assertions
 skip-if = (os == "win" || "linux") && debug

browser/config/version.txt

@@ -1 +1 @@
-25.0a1
+26.0a1

browser/metro/base/content/bindings/appbar.xml

@@ -73,10 +73,5 @@
         </body>
       </method>
     </implementation>
-
-    <handlers>
-      <!-- Work around for bug 835175 -->
-      <handler event="click">false;</handler>
-    </handlers>
   </binding>
 </bindings>

browser/metro/base/content/bindings/flyoutpanel.xml

@@ -99,10 +99,5 @@
         document.getAnonymousElementByAttribute(this, "class", "flyoutpanel-contents");
       ]]></field>
     </implementation>
-
-    <handlers>
-      <!-- Work around for bug 835175 -->
-      <handler event="click">false;</handler>
-    </handlers>
   </binding>
 </bindings>

browser/metro/base/content/browser.xul

@@ -181,8 +181,7 @@
     <vbox id="page">
       <vbox id="tray" class="tray-toolbar" observes="bcast_windowState" >
         <!-- Tabs -->
-        <!-- onclick handler to work around bug 837242 -->
-        <hbox id="tabs-container" observes="bcast_windowState" onclick="void(0);">
+        <hbox id="tabs-container" observes="bcast_windowState">
           <box id="tabs" flex="1"
                 observes="bcast_preciseInput"
                 onselect="BrowserUI.selectTabAndDismiss(this);"
@@ -243,8 +242,7 @@
         <box id="horizontal-scroller" class="scroller" orient="horizontal" left="0" bottom="0"/>
 
         <!-- Content touch selection overlay -->
-        <!-- onclick addresses dom bug 835175 -->
-        <box onclick="false" class="selection-overlay-hidden" id="content-selection-overlay"/>
+        <box class="selection-overlay-hidden" id="content-selection-overlay"/>
       </stack>
     </vbox>
 
@@ -738,11 +736,9 @@
     </flyoutpanel>
 
     <!-- Chrome touch selection overlay -->
-    <!-- onclick addresses dom bug 835175 -->
-    <box onclick="false" class="selection-overlay-hidden" id="chrome-selection-overlay"/>
+    <box class="selection-overlay-hidden" id="chrome-selection-overlay"/>
 
     <box onclick="event.stopPropagation();" id="context-container" class="menu-container" hidden="true">
-      <!-- onclick is dom bug 835175 -->
       <vbox id="context-popup" class="menu-popup">
         <richlistbox id="context-commands" bindingType="contextmenu" flex="1">
           <!-- priority="low" items are hidden by default when a context is being displayed

browser/metro/base/content/helperui/FindHelperUI.js

@@ -153,10 +153,12 @@ var FindHelperUI = {
   },
 
   goToPrevious: function findHelperGoToPrevious() {
+    this._textbox.blur();
     Browser.selectedBrowser.messageManager.sendAsyncMessage("FindAssist:Previous", { });
   },
 
   goToNext: function findHelperGoToNext() {
+    this._textbox.blur();
     Browser.selectedBrowser.messageManager.sendAsyncMessage("FindAssist:Next", { });
   },
 

browser/modules/webappsUI.jsm

@@ -34,9 +34,10 @@ this.webappsUI = {
 
     switch(aTopic) {
       case "webapps-ask-install":
-        let [chromeWin, browser] = this._getBrowserForId(data.oid);
-        if (chromeWin)
-          this.doInstall(data, browser, chromeWin);
+        let win = this._getWindowForId(data.oid);
+        if (win && win.location.href == data.from) {
+          this.doInstall(data, win);
+        }
         break;
       case "webapps-launch":
         WebappOSUtils.launch(data);
@@ -47,21 +48,20 @@ this.webappsUI = {
     }
   },
 
-  _getBrowserForId: function(aId) {
-    let content = Services.wm.getOuterWindowWithId(aId);
-    if (content) {
-      let browser = content.QueryInterface(Ci.nsIInterfaceRequestor)
-                    .getInterface(Ci.nsIWebNavigation)
-                    .QueryInterface(Ci.nsIDocShell).chromeEventHandler;
-      let win = browser.ownerDocument.defaultView;
-      return [win, browser];
-    }
-
-    return [null, null];
+  _getWindowForId: function(aId) {
+    let someWindow = Services.wm.getMostRecentWindow(null);
+    return someWindow && someWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                                   .getInterface(Ci.nsIDOMWindowUtils)
+                                   .getOuterWindowWithId(aId);
   },
 
-  doInstall: function(aData, aBrowser, aWindow) {
-    let bundle = aWindow.gNavigatorBundle;
+  doInstall: function(aData, aWindow) {
+    let browser = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                         .getInterface(Ci.nsIWebNavigation)
+                         .QueryInterface(Ci.nsIDocShell)
+                         .chromeEventHandler;
+    let chromeWin = browser.ownerDocument.defaultView;
+    let bundle = chromeWin.gNavigatorBundle;
 
     let mainAction = {
       label: bundle.getString("webapps.install"),
@@ -78,7 +78,7 @@ this.webappsUI = {
           DOMApplicationRegistry.confirmInstall(aData, false, localDir, null,
             function (aManifest) {
               if (WebappsInstaller.install(aData, aManifest)) {
-                installationSuccessNotification(aData, app, aWindow);
+                installationSuccessNotification(aData, app, chromeWin);
               }
             }
           );
@@ -88,7 +88,7 @@ this.webappsUI = {
       }
     };
 
-    let requestingURI = aWindow.makeURI(aData.from);
+    let requestingURI = chromeWin.makeURI(aData.from);
     let jsonManifest = aData.isPackage ? aData.app.updateManifest : aData.app.manifest;
     let manifest = new ManifestHelper(jsonManifest, aData.app.origin);
 
@@ -102,7 +102,7 @@ this.webappsUI = {
     let message = bundle.getFormattedString("webapps.requestInstall",
                                             [manifest.name, host], 2);
 
-    aWindow.PopupNotifications.show(aBrowser, "webapps-install", message,
+    chromeWin.PopupNotifications.show(browser, "webapps-install", message,
                                     "webapps-notification-icon", mainAction);
 
   }

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-25.0a1
+26.0a1

configure.in

@@ -4189,7 +4189,6 @@ MOZ_SAFE_BROWSING=
 MOZ_HELP_VIEWER=
 MOZ_SPELLCHECK=1
 MOZ_ANDROID_OMTC=
-MOZ_ONLY_TOUCH_EVENTS=
 MOZ_TOOLKIT_SEARCH=1
 MOZ_UI_LOCALE=en-US
 MOZ_UNIVERSALCHARDET=1
@@ -8403,9 +8402,6 @@ case "$OS_TARGET" in
     NECKO_WIFI=1
     ;;
   Linux)
-    if test -z "$MOZ_ENABLE_DBUS"; then
-      AC_MSG_ERROR([Necko WiFi scanning needs DBus on your platform, remove --disable-dbus or use --disable-necko-wifi])
-    fi
     NECKO_WIFI=1
     NECKO_WIFI_DBUS=1
     ;;
@@ -8417,6 +8413,9 @@ MOZ_ARG_DISABLE_BOOL(necko-wifi,
     NECKO_WIFI=1)
 
 if test "$NECKO_WIFI"; then
+  if test -z "$MOZ_ENABLE_DBUS" -a -n "$NECKO_WIFI_DBUS"; then
+    AC_MSG_ERROR([Necko WiFi scanning needs DBus on your platform, remove --disable-dbus or use --disable-necko-wifi])
+  fi
   AC_DEFINE(NECKO_WIFI)
   _NON_GLOBAL_ACDEFINES="$_NON_GLOBAL_ACDEFINES NECKO_WIFI"
 fi
@@ -8585,7 +8584,6 @@ AC_SUBST(ACCESSIBILITY)
 AC_SUBST(MOZ_SPELLCHECK)
 AC_SUBST(MOZ_ANDROID_OMTC)
 AC_SUBST(MOZ_ANDROID_ANR_REPORTER)
-AC_SUBST(MOZ_ONLY_TOUCH_EVENTS)
 AC_SUBST(MOZ_CRASHREPORTER)
 AC_SUBST(MOZ_CRASHREPORTER_INJECTOR)
 AC_SUBST(MOZ_CRASHREPORTER_UPLOAD_FULL_SYMBOLS)

content/base/src/WebSocket.cpp

@@ -1218,7 +1218,7 @@ WebSocket::Send(nsIDOMBlob* aData,
 }
 
 void
-WebSocket::Send(ArrayBuffer& aData,
+WebSocket::Send(const ArrayBuffer& aData,
                 ErrorResult& aRv)
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "Not running on main thread");
@@ -1232,7 +1232,7 @@ WebSocket::Send(ArrayBuffer& aData,
 }
 
 void
-WebSocket::Send(ArrayBufferView& aData,
+WebSocket::Send(const ArrayBufferView& aData,
                 ErrorResult& aRv)
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "Not running on main thread");

content/base/src/WebSocket.h

@@ -150,9 +150,9 @@ public: // WebIDL interface:
             ErrorResult& aRv);
   void Send(nsIDOMBlob* aData,
             ErrorResult& aRv);
-  void Send(ArrayBuffer& aData,
+  void Send(const ArrayBuffer& aData,
             ErrorResult& aRv);
-  void Send(ArrayBufferView& aData,
+  void Send(const ArrayBufferView& aData,
             ErrorResult& aRv);
 
 private: // constructor && distructor

content/base/src/nsDOMBlobBuilder.cpp

@@ -219,7 +219,7 @@ nsDOMMultipartFile::InitBlob(JSContext* aCx,
     JS_ALWAYS_TRUE(JS_GetArrayLength(aCx, obj, &length));
     for (uint32_t i = 0; i < length; ++i) {
       JS::Rooted<JS::Value> element(aCx);
-      if (!JS_GetElement(aCx, obj, i, element.address()))
+      if (!JS_GetElement(aCx, obj, i, &element))
         return NS_ERROR_TYPE_ERR;
 
       if (element.isObject()) {

content/base/src/nsDOMDataChannel.cpp

@@ -290,7 +290,7 @@ nsDOMDataChannel::Send(nsIDOMBlob* aData, ErrorResult& aRv)
 }
 
 void
-nsDOMDataChannel::Send(ArrayBuffer& aData, ErrorResult& aRv)
+nsDOMDataChannel::Send(const ArrayBuffer& aData, ErrorResult& aRv)
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "Not running on main thread");
 
@@ -303,7 +303,7 @@ nsDOMDataChannel::Send(ArrayBuffer& aData, ErrorResult& aRv)
 }
 
 void
-nsDOMDataChannel::Send(ArrayBufferView& aData, ErrorResult& aRv)
+nsDOMDataChannel::Send(const ArrayBufferView& aData, ErrorResult& aRv)
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "Not running on main thread");
 

content/base/src/nsDOMDataChannel.h

@@ -67,8 +67,9 @@ public:
   }
   void Send(const nsAString& aData, mozilla::ErrorResult& aRv);
   void Send(nsIDOMBlob* aData, mozilla::ErrorResult& aRv);
-  void Send(mozilla::dom::ArrayBuffer& aData, mozilla::ErrorResult& aRv);
-  void Send(mozilla::dom::ArrayBufferView& aData, mozilla::ErrorResult& aRv);
+  void Send(const mozilla::dom::ArrayBuffer& aData, mozilla::ErrorResult& aRv);
+  void Send(const mozilla::dom::ArrayBufferView& aData,
+            mozilla::ErrorResult& aRv);
 
   // Uses XPIDL GetProtocol.
   bool Ordered() const;

content/base/src/nsFrameMessageManager.cpp

@@ -401,7 +401,7 @@ nsFrameMessageManager::SendSyncMessage(const nsAString& aMessageName,
                         retval[i].Length(), &ret)) {
         return NS_ERROR_UNEXPECTED;
       }
-      NS_ENSURE_TRUE(JS_SetElement(aCx, dataArray, i, ret.address()),
+      NS_ENSURE_TRUE(JS_SetElement(aCx, dataArray, i, &ret),
                      NS_ERROR_OUT_OF_MEMORY);
     }
 

content/base/src/nsGkAtomList.h

@@ -25,7 +25,7 @@
 // MACRO_NAME=GK_ATOM
 #ifdef small
 #undef small
-#endif 
+#endif
 
 //---------------------------------------------------------------------------
 // Generic atoms
@@ -766,6 +766,8 @@ GK_ATOM(onpopupshowing, "onpopupshowing")
 GK_ATOM(onpopupshown, "onpopupshown")
 GK_ATOM(onreadystatechange, "onreadystatechange")
 GK_ATOM(onreceived, "onreceived")
+GK_ATOM(onremoteheld, "onremoteheld")
+GK_ATOM(onremoteresumed, "onremoteresumed")
 GK_ATOM(onretrieving, "onretrieving")
 GK_ATOM(onRequest, "onRequest")
 GK_ATOM(onreset, "onreset")

content/base/src/nsTextFragmentSSE2.cpp

@@ -42,7 +42,8 @@ FirstNon8Bit(const PRUnichar *str, const PRUnichar *end)
 
   // Check one XMM register (16 bytes) at a time.
   const int32_t vectWalkEnd = ((len - i) / numUnicharsPerVector) * numUnicharsPerVector;
-  __m128i vectmask = _mm_set1_epi16(0xff00);
+  const uint16_t shortMask = 0xff00;
+  __m128i vectmask = _mm_set1_epi16(static_cast<int16_t>(shortMask));
   for(; i < vectWalkEnd; i += numUnicharsPerVector) {
     const __m128i vect = *reinterpret_cast<const __m128i*>(str + i);
     if (!is_zero(_mm_and_si128(vect, vectmask)))

content/base/src/nsXMLHttpRequest.h

@@ -272,11 +272,11 @@ private:
     RequestBody() : mType(Uninitialized)
     {
     }
-    RequestBody(mozilla::dom::ArrayBuffer* aArrayBuffer) : mType(ArrayBuffer)
+    RequestBody(const mozilla::dom::ArrayBuffer* aArrayBuffer) : mType(ArrayBuffer)
     {
       mValue.mArrayBuffer = aArrayBuffer;
     }
-    RequestBody(mozilla::dom::ArrayBufferView* aArrayBufferView) : mType(ArrayBufferView)
+    RequestBody(const mozilla::dom::ArrayBufferView* aArrayBufferView) : mType(ArrayBufferView)
     {
       mValue.mArrayBufferView = aArrayBufferView;
     }
@@ -312,8 +312,8 @@ private:
       InputStream
     };
     union Value {
-      mozilla::dom::ArrayBuffer* mArrayBuffer;
-      mozilla::dom::ArrayBufferView* mArrayBufferView;
+      const mozilla::dom::ArrayBuffer* mArrayBuffer;
+      const mozilla::dom::ArrayBufferView* mArrayBufferView;
       nsIDOMBlob* mBlob;
       nsIDocument* mDocument;
       const nsAString* mString;
@@ -359,11 +359,12 @@ public:
   {
     aRv = Send(Nullable<RequestBody>());
   }
-  void Send(mozilla::dom::ArrayBuffer& aArrayBuffer, ErrorResult& aRv)
+  void Send(const mozilla::dom::ArrayBuffer& aArrayBuffer, ErrorResult& aRv)
   {
     aRv = Send(RequestBody(&aArrayBuffer));
   }
-  void Send(mozilla::dom::ArrayBufferView& aArrayBufferView, ErrorResult& aRv)
+  void Send(const mozilla::dom::ArrayBufferView& aArrayBufferView,
+            ErrorResult& aRv)
   {
     aRv = Send(RequestBody(&aArrayBufferView));
   }

content/base/test/test_mutationobservers.html

@@ -487,8 +487,12 @@ function testModalDialog() {
     });
   m.observe(div, { childList: true });
   div.innerHTML = "<span><span>foo</span></span>";
-  window.showModalDialog("mutationobserver_dialog.html");
-  ok(didHandleCallback, "Should have called the callback while showing modal dialog!");
+  try {
+    window.showModalDialog("mutationobserver_dialog.html");
+    ok(didHandleCallback, "Should have called the callback while showing modal dialog!");
+  } catch(e) {
+    todo(false, "showModalDialog not implemented on this platform");
+  }
   then(testTakeRecords);
 }
 

content/base/test/test_websocket.html

@@ -1230,14 +1230,14 @@ function test41()
         const Ci = Components.interfaces;
         var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
         var thehost = ios.newURI("http://example.com", null, null);
-        var stss = Cc["@mozilla.org/stsservice;1"].getService(Ci.nsIStrictTransportSecurityService);
+        var sss = Cc["@mozilla.org/ssservice;1"].getService(Ci.nsISiteSecurityService);
         var loadContext = window.QueryInterface(Ci.nsIInterfaceRequestor)
                                 .getInterface(Ci.nsIWebNavigation)
                                 .QueryInterface(Ci.nsILoadContext);
         var flags = 0;
         if (loadContext.usePrivateBrowsing)
           flags |= Ci.nsISocketProvider.NO_PERMANENT_STORAGE;
-        stss.removeStsState(thehost, flags);
+        sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, thehost, flags);
         doTest(42);
        }
      }

content/canvas/src/CanvasRenderingContext2D.cpp

@@ -1232,7 +1232,7 @@ ObjectToMatrix(JSContext* cx, JS::Handle<JSObject*> obj, Matrix& matrix,
   for (uint32_t i = 0; i < 6; ++i) {
     JS::Rooted<JS::Value> elt(cx);
     double d;
-    if (!JS_GetElement(cx, obj, i, elt.address())) {
+    if (!JS_GetElement(cx, obj, i, &elt)) {
       error.Throw(NS_ERROR_FAILURE);
       return false;
     }

content/canvas/src/CanvasUtils.h

@@ -119,7 +119,7 @@ JSValToDashArray(JSContext* cx, const JS::Value& patternArray,
         for (uint32_t i = 0; i < length; ++i) {
             JS::Rooted<JS::Value> elt(cx);
             double d;
-            if (!JS_GetElement(cx, obj, i, elt.address())) {
+            if (!JS_GetElement(cx, obj, i, &elt)) {
                 return NS_ERROR_FAILURE;
             }
             if (!(CoerceDouble(elt, &d) &&

content/canvas/src/WebGLContext.h

@@ -338,13 +338,15 @@ public:
     void BlendFuncSeparate(WebGLenum srcRGB, WebGLenum dstRGB,
                            WebGLenum srcAlpha, WebGLenum dstAlpha);
     void BufferData(WebGLenum target, WebGLsizeiptr size, WebGLenum usage);
-    void BufferData(WebGLenum target, dom::ArrayBufferView &data,
+    void BufferData(WebGLenum target, const dom::ArrayBufferView &data,
+                    WebGLenum usage);
+    void BufferData(WebGLenum target,
+                    const Nullable<dom::ArrayBuffer> &maybeData,
                     WebGLenum usage);
-    void BufferData(WebGLenum target, dom::ArrayBuffer *data, WebGLenum usage);
     void BufferSubData(WebGLenum target, WebGLsizeiptr byteOffset,
-                       dom::ArrayBufferView &data);
+                       const dom::ArrayBufferView &data);
     void BufferSubData(WebGLenum target, WebGLsizeiptr byteOffset,
-                       dom::ArrayBuffer *data);
+                       const Nullable<dom::ArrayBuffer> &maybeData);
     WebGLenum CheckFramebufferStatus(WebGLenum target);
     void Clear(WebGLbitfield mask);
     void ClearColor(WebGLclampf r, WebGLclampf g, WebGLclampf b, WebGLclampf a);
@@ -355,11 +357,12 @@ public:
     void CompressedTexImage2D(WebGLenum target, WebGLint level,
                               WebGLenum internalformat, WebGLsizei width,
                               WebGLsizei height, WebGLint border,
-                              dom::ArrayBufferView& view);
+                              const dom::ArrayBufferView& view);
     void CompressedTexSubImage2D(WebGLenum target, WebGLint level,
                                  WebGLint xoffset, WebGLint yoffset,
                                  WebGLsizei width, WebGLsizei height,
-                                 WebGLenum format, dom::ArrayBufferView& view);
+                                 WebGLenum format,
+                                 const dom::ArrayBufferView& view);
     void CopyTexImage2D(WebGLenum target, WebGLint level,
                         WebGLenum internalformat, WebGLint x, WebGLint y,
                         WebGLsizei width, WebGLsizei height, WebGLint border);
@@ -487,7 +490,8 @@ public:
     }
     void ReadPixels(WebGLint x, WebGLint y, WebGLsizei width, WebGLsizei height,
                     WebGLenum format, WebGLenum type,
-                    dom::ArrayBufferView* pixels, ErrorResult& rv);
+                    const Nullable<dom::ArrayBufferView> &pixels,
+                    ErrorResult& rv);
     void RenderbufferStorage(WebGLenum target, WebGLenum internalformat,
                              WebGLsizei width, WebGLsizei height);
     void SampleCoverage(WebGLclampf value, WebGLboolean invert) {
@@ -509,7 +513,8 @@ public:
     void TexImage2D(WebGLenum target, WebGLint level,
                     WebGLenum internalformat, WebGLsizei width,
                     WebGLsizei height, WebGLint border, WebGLenum format,
-                    WebGLenum type, dom::ArrayBufferView *pixels,
+                    WebGLenum type,
+                    const Nullable<dom::ArrayBufferView> &pixels,
                     ErrorResult& rv);
     void TexImage2D(WebGLenum target, WebGLint level,
                     WebGLenum internalformat, WebGLenum format, WebGLenum type,
@@ -547,7 +552,8 @@ public:
     void TexSubImage2D(WebGLenum target, WebGLint level,
                        WebGLint xoffset, WebGLint yoffset,
                        WebGLsizei width, WebGLsizei height, WebGLenum format,
-                       WebGLenum type, dom::ArrayBufferView* pixels,
+                       WebGLenum type,
+                       const Nullable<dom::ArrayBufferView> &pixels,
                        ErrorResult& rv);
     void TexSubImage2D(WebGLenum target, WebGLint level,
                        WebGLint xoffset, WebGLint yoffset, WebGLenum format,
@@ -592,7 +598,8 @@ public:
     void Uniform4f(WebGLUniformLocation* location, WebGLfloat x, WebGLfloat y,
                    WebGLfloat z, WebGLfloat w);
     
-    void Uniform1iv(WebGLUniformLocation* location, dom::Int32Array& arr) {
+    void Uniform1iv(WebGLUniformLocation* location,
+                    const dom::Int32Array& arr) {
         Uniform1iv_base(location, arr.Length(), arr.Data());
     }
     void Uniform1iv(WebGLUniformLocation* location,
@@ -602,7 +609,8 @@ public:
     void Uniform1iv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLint* data);
 
-    void Uniform2iv(WebGLUniformLocation* location, dom::Int32Array& arr) {
+    void Uniform2iv(WebGLUniformLocation* location,
+                    const dom::Int32Array& arr) {
         Uniform2iv_base(location, arr.Length(), arr.Data());
     }
     void Uniform2iv(WebGLUniformLocation* location,
@@ -612,7 +620,8 @@ public:
     void Uniform2iv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLint* data);
 
-    void Uniform3iv(WebGLUniformLocation* location, dom::Int32Array& arr) {
+    void Uniform3iv(WebGLUniformLocation* location,
+                    const dom::Int32Array& arr) {
         Uniform3iv_base(location, arr.Length(), arr.Data());
     }
     void Uniform3iv(WebGLUniformLocation* location,
@@ -622,7 +631,8 @@ public:
     void Uniform3iv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLint* data);
     
-    void Uniform4iv(WebGLUniformLocation* location, dom::Int32Array& arr) {
+    void Uniform4iv(WebGLUniformLocation* location,
+                    const dom::Int32Array& arr) {
         Uniform4iv_base(location, arr.Length(), arr.Data());
     }
     void Uniform4iv(WebGLUniformLocation* location,
@@ -632,7 +642,8 @@ public:
     void Uniform4iv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLint* data);
 
-    void Uniform1fv(WebGLUniformLocation* location, dom::Float32Array& arr) {
+    void Uniform1fv(WebGLUniformLocation* location,
+                    const dom::Float32Array& arr) {
         Uniform1fv_base(location, arr.Length(), arr.Data());
     }
     void Uniform1fv(WebGLUniformLocation* location,
@@ -642,7 +653,8 @@ public:
     void Uniform1fv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLfloat* data);
 
-    void Uniform2fv(WebGLUniformLocation* location, dom::Float32Array& arr) {
+    void Uniform2fv(WebGLUniformLocation* location,
+                    const dom::Float32Array& arr) {
         Uniform2fv_base(location, arr.Length(), arr.Data());
     }
     void Uniform2fv(WebGLUniformLocation* location,
@@ -652,7 +664,8 @@ public:
     void Uniform2fv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLfloat* data);
 
-    void Uniform3fv(WebGLUniformLocation* location, dom::Float32Array& arr) {
+    void Uniform3fv(WebGLUniformLocation* location,
+                    const dom::Float32Array& arr) {
         Uniform3fv_base(location, arr.Length(), arr.Data());
     }
     void Uniform3fv(WebGLUniformLocation* location,
@@ -662,7 +675,8 @@ public:
     void Uniform3fv_base(WebGLUniformLocation* location, uint32_t arrayLength,
                          const WebGLfloat* data);
     
-    void Uniform4fv(WebGLUniformLocation* location, dom::Float32Array& arr) {
+    void Uniform4fv(WebGLUniformLocation* location,
+                    const dom::Float32Array& arr) {
         Uniform4fv_base(location, arr.Length(), arr.Data());
     }
     void Uniform4fv(WebGLUniformLocation* location,
@@ -674,7 +688,7 @@ public:
 
     void UniformMatrix2fv(WebGLUniformLocation* location,
                           WebGLboolean transpose,
-                          dom::Float32Array &value) {
+                          const dom::Float32Array &value) {
         UniformMatrix2fv_base(location, transpose, value.Length(), value.Data());
     }
     void UniformMatrix2fv(WebGLUniformLocation* location,
@@ -689,7 +703,7 @@ public:
 
     void UniformMatrix3fv(WebGLUniformLocation* location,
                           WebGLboolean transpose,
-                          dom::Float32Array &value) {
+                          const dom::Float32Array &value) {
         UniformMatrix3fv_base(location, transpose, value.Length(), value.Data());
     }
     void UniformMatrix3fv(WebGLUniformLocation* location,
@@ -704,7 +718,7 @@ public:
 
     void UniformMatrix4fv(WebGLUniformLocation* location,
                           WebGLboolean transpose,
-                          dom::Float32Array &value) {
+                          const dom::Float32Array &value) {
         UniformMatrix4fv_base(location, transpose, value.Length(), value.Data());
     }
     void UniformMatrix4fv(WebGLUniformLocation* location,
@@ -738,7 +752,7 @@ public:
     void VertexAttrib4f(WebGLuint index, WebGLfloat x0, WebGLfloat x1,
                         WebGLfloat x2, WebGLfloat x3);
 
-    void VertexAttrib1fv(WebGLuint idx, dom::Float32Array &arr) {
+    void VertexAttrib1fv(WebGLuint idx, const dom::Float32Array &arr) {
         VertexAttrib1fv_base(idx, arr.Length(), arr.Data());
     }
     void VertexAttrib1fv(WebGLuint idx, const dom::Sequence<WebGLfloat>& arr) {
@@ -747,7 +761,7 @@ public:
     void VertexAttrib1fv_base(WebGLuint idx, uint32_t arrayLength,
                               const WebGLfloat* ptr);
 
-    void VertexAttrib2fv(WebGLuint idx, dom::Float32Array &arr) {
+    void VertexAttrib2fv(WebGLuint idx, const dom::Float32Array &arr) {
         VertexAttrib2fv_base(idx, arr.Length(), arr.Data());
     }
     void VertexAttrib2fv(WebGLuint idx, const dom::Sequence<WebGLfloat>& arr) {
@@ -756,7 +770,7 @@ public:
     void VertexAttrib2fv_base(WebGLuint idx, uint32_t arrayLength,
                               const WebGLfloat* ptr);
 
-    void VertexAttrib3fv(WebGLuint idx, dom::Float32Array &arr) {
+    void VertexAttrib3fv(WebGLuint idx, const dom::Float32Array &arr) {
         VertexAttrib3fv_base(idx, arr.Length(), arr.Data());
     }
     void VertexAttrib3fv(WebGLuint idx, const dom::Sequence<WebGLfloat>& arr) {
@@ -765,7 +779,7 @@ public:
     void VertexAttrib3fv_base(WebGLuint idx, uint32_t arrayLength,
                               const WebGLfloat* ptr);
 
-    void VertexAttrib4fv(WebGLuint idx, dom::Float32Array &arr) {
+    void VertexAttrib4fv(WebGLuint idx, const dom::Float32Array &arr) {
         VertexAttrib4fv_base(idx, arr.Length(), arr.Data());
     }
     void VertexAttrib4fv(WebGLuint idx, const dom::Sequence<WebGLfloat>& arr) {

content/canvas/src/WebGLContextGL.cpp

@@ -400,16 +400,20 @@ WebGLContext::BufferData(WebGLenum target, WebGLsizeiptr size,
 }
 
 void
-WebGLContext::BufferData(WebGLenum target, ArrayBuffer *data, WebGLenum usage)
+WebGLContext::BufferData(WebGLenum target,
+                         const Nullable<ArrayBuffer> &maybeData,
+                         WebGLenum usage)
 {
     if (!IsContextStable())
         return;
 
-    if (!data) {
+    if (maybeData.IsNull()) {
         // see http://www.khronos.org/bugzilla/show_bug.cgi?id=386
         return ErrorInvalidValue("bufferData: null object passed");
     }
 
+    const ArrayBuffer& data = maybeData.Value();
+
     WebGLBuffer *boundBuffer = nullptr;
 
     if (target == LOCAL_GL_ARRAY_BUFFER) {
@@ -429,21 +433,22 @@ WebGLContext::BufferData(WebGLenum target, ArrayBuffer *data, WebGLenum usage)
     MakeContextCurrent();
     InvalidateCachedMinInUseAttribArrayLength();
 
-    GLenum error = CheckedBufferData(target, data->Length(), data->Data(), usage);
+    GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
 
     if (error) {
         GenerateWarning("bufferData generated error %s", ErrorName(error));
         return;
     }
 
-    boundBuffer->SetByteLength(data->Length());
-    if (!boundBuffer->ElementArrayCacheBufferData(data->Data(), data->Length())) {
+    boundBuffer->SetByteLength(data.Length());
+    if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) {
         return ErrorOutOfMemory("bufferData: out of memory");
     }
 }
 
 void
-WebGLContext::BufferData(WebGLenum target, ArrayBufferView& data, WebGLenum usage)
+WebGLContext::BufferData(WebGLenum target, const ArrayBufferView& data,
+                         WebGLenum usage)
 {
     if (!IsContextStable())
         return;
@@ -481,16 +486,18 @@ WebGLContext::BufferData(WebGLenum target, ArrayBufferView& data, WebGLenum usag
 
 void
 WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
-                            ArrayBuffer *data)
+                            const Nullable<ArrayBuffer> &maybeData)
 {
     if (!IsContextStable())
         return;
 
-    if (!data) {
+    if (maybeData.IsNull()) {
         // see http://www.khronos.org/bugzilla/show_bug.cgi?id=386
         return;
     }
 
+    const ArrayBuffer& data = maybeData.Value();
+
     WebGLBuffer *boundBuffer = nullptr;
 
     if (target == LOCAL_GL_ARRAY_BUFFER) {
@@ -507,7 +514,7 @@ WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
     if (!boundBuffer)
         return ErrorInvalidOperation("bufferData: no buffer bound!");
 
-    CheckedUint32 checked_neededByteLength = CheckedUint32(byteOffset) + data->Length();
+    CheckedUint32 checked_neededByteLength = CheckedUint32(byteOffset) + data.Length();
     if (!checked_neededByteLength.isValid())
         return ErrorInvalidValue("bufferSubData: integer overflow computing the needed byte length");
 
@@ -517,14 +524,14 @@ WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
 
     MakeContextCurrent();
 
-    boundBuffer->ElementArrayCacheBufferSubData(byteOffset, data->Data(), data->Length());
+    boundBuffer->ElementArrayCacheBufferSubData(byteOffset, data.Data(), data.Length());
 
-    gl->fBufferSubData(target, byteOffset, data->Length(), data->Data());
+    gl->fBufferSubData(target, byteOffset, data.Length(), data.Data());
 }
 
 void
 WebGLContext::BufferSubData(WebGLenum target, WebGLsizeiptr byteOffset,
-                            ArrayBufferView& data)
+                            const ArrayBufferView& data)
 {
     if (!IsContextStable())
         return;
@@ -3014,7 +3021,7 @@ WebGLContext::PixelStorei(WebGLenum pname, WebGLint param)
 void
 WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
                          WebGLsizei height, WebGLenum format,
-                         WebGLenum type, ArrayBufferView* pixels,
+                         WebGLenum type, const Nullable<ArrayBufferView> &pixels,
                          ErrorResult& rv)
 {
     if (!IsContextStable()) {
@@ -3029,7 +3036,7 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
     if (width < 0 || height < 0)
         return ErrorInvalidValue("readPixels: negative size passed");
 
-    if (!pixels)
+    if (pixels.IsNull())
         return ErrorInvalidValue("readPixels: null destination buffer");
 
     const WebGLRectangleObject *framebufferRect = FramebufferRectangleObject();
@@ -3072,7 +3079,7 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
             return ErrorInvalidEnum("readPixels: Bad type");
     }
 
-    int dataType = JS_GetArrayBufferViewType(pixels->Obj());
+    int dataType = JS_GetArrayBufferViewType(pixels.Value().Obj());
 
     // Check the pixels param type
     if (dataType != requiredDataType)
@@ -3090,11 +3097,11 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
     if (!checked_neededByteLength.isValid())
         return ErrorInvalidOperation("readPixels: integer overflow computing the needed buffer size");
 
-    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj());
+    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels.Value().Obj());
     if (checked_neededByteLength.value() > dataByteLen)
         return ErrorInvalidOperation("readPixels: buffer too small");
 
-    void* data = pixels->Data();
+    void* data = pixels.Value().Data();
     if (!data) {
         ErrorOutOfMemory("readPixels: buffer storage is null. Did we run out of memory?");
         return rv.Throw(NS_ERROR_OUT_OF_MEMORY);
@@ -4289,7 +4296,7 @@ WebGLContext::CompileShader(WebGLShader *shader)
 void
 WebGLContext::CompressedTexImage2D(WebGLenum target, WebGLint level, WebGLenum internalformat,
                                    WebGLsizei width, WebGLsizei height, WebGLint border,
-                                   ArrayBufferView& view)
+                                   const ArrayBufferView& view)
 {
     if (!IsContextStable()) {
         return;
@@ -4329,7 +4336,7 @@ WebGLContext::CompressedTexImage2D(WebGLenum target, WebGLint level, WebGLenum i
 void
 WebGLContext::CompressedTexSubImage2D(WebGLenum target, WebGLint level, WebGLint xoffset,
                                       WebGLint yoffset, WebGLsizei width, WebGLsizei height,
-                                      WebGLenum format, ArrayBufferView& view)
+                                      WebGLenum format, const ArrayBufferView& view)
 {
     if (!IsContextStable()) {
         return;
@@ -4861,15 +4868,15 @@ void
 WebGLContext::TexImage2D(WebGLenum target, WebGLint level,
                          WebGLenum internalformat, WebGLsizei width,
                          WebGLsizei height, WebGLint border, WebGLenum format,
-                         WebGLenum type, ArrayBufferView *pixels, ErrorResult& rv)
+                         WebGLenum type, const Nullable<ArrayBufferView> &pixels, ErrorResult& rv)
 {
     if (!IsContextStable())
         return;
 
     return TexImage2D_base(target, level, internalformat, width, height, 0, border, format, type,
-                           pixels ? pixels->Data() : 0,
-                           pixels ? pixels->Length() : 0,
-                           pixels ? (int)JS_GetArrayBufferViewType(pixels->Obj()) : -1,
+                           pixels.IsNull() ? 0 : pixels.Value().Data(),
+                           pixels.IsNull() ? 0 : pixels.Value().Length(),
+                           pixels.IsNull() ? -1 : (int)JS_GetArrayBufferViewType(pixels.Value().Obj()),
                            WebGLTexelConversions::Auto, false);
 }
 
@@ -5011,19 +5018,19 @@ WebGLContext::TexSubImage2D(WebGLenum target, WebGLint level,
                             WebGLint xoffset, WebGLint yoffset,
                             WebGLsizei width, WebGLsizei height,
                             WebGLenum format, WebGLenum type,
-                            ArrayBufferView* pixels,
+                            const Nullable<ArrayBufferView> &pixels,
                             ErrorResult& rv)
 {
     if (!IsContextStable())
         return;
 
-    if (!pixels)
+    if (pixels.IsNull())
         return ErrorInvalidValue("texSubImage2D: pixels must not be null!");
 
     return TexSubImage2D_base(target, level, xoffset, yoffset,
                               width, height, 0, format, type,
-                              pixels->Data(), pixels->Length(),
-                              JS_GetArrayBufferViewType(pixels->Obj()),
+                              pixels.Value().Data(), pixels.Value().Length(),
+                              JS_GetArrayBufferViewType(pixels.Value().Obj()),
                               WebGLTexelConversions::Auto, false);
 }
 
@@ -5277,6 +5284,7 @@ WebGLContext::ReattachTextureToAnyFramebufferToWorkAroundBugs(WebGLTexture *tex,
         return;
 
     MakeContextCurrent();
+    WebGLFramebuffer* curFB = mBoundFramebuffer;
 
     for(WebGLFramebuffer *framebuffer = mFramebuffers.getFirst();
         framebuffer;
@@ -5286,29 +5294,31 @@ WebGLContext::ReattachTextureToAnyFramebufferToWorkAroundBugs(WebGLTexture *tex,
         for (size_t i = 0; i < colorAttachmentCount; i++)
         {
             if (framebuffer->ColorAttachment(i).Texture() == tex) {
-                ScopedBindFramebuffer autoFB(gl, framebuffer->GLName());
+                BindFramebuffer(LOCAL_GL_FRAMEBUFFER, framebuffer);
                 framebuffer->FramebufferTexture2D(
                   LOCAL_GL_FRAMEBUFFER, LOCAL_GL_COLOR_ATTACHMENT0 + i,
                   tex->Target(), tex, level);
             }
         }
         if (framebuffer->DepthAttachment().Texture() == tex) {
-            ScopedBindFramebuffer autoFB(gl, framebuffer->GLName());
+            BindFramebuffer(LOCAL_GL_FRAMEBUFFER, framebuffer);
             framebuffer->FramebufferTexture2D(
               LOCAL_GL_FRAMEBUFFER, LOCAL_GL_DEPTH_ATTACHMENT,
               tex->Target(), tex, level);
         }
         if (framebuffer->StencilAttachment().Texture() == tex) {
-            ScopedBindFramebuffer autoFB(gl, framebuffer->GLName());
+            BindFramebuffer(LOCAL_GL_FRAMEBUFFER, framebuffer);
             framebuffer->FramebufferTexture2D(
               LOCAL_GL_FRAMEBUFFER, LOCAL_GL_STENCIL_ATTACHMENT,
               tex->Target(), tex, level);
         }
         if (framebuffer->DepthStencilAttachment().Texture() == tex) {
-            ScopedBindFramebuffer autoFB(gl, framebuffer->GLName());
+            BindFramebuffer(LOCAL_GL_FRAMEBUFFER, framebuffer);
             framebuffer->FramebufferTexture2D(
               LOCAL_GL_FRAMEBUFFER, LOCAL_GL_DEPTH_STENCIL_ATTACHMENT,
               tex->Target(), tex, level);
         }
     }
+
+    BindFramebuffer(LOCAL_GL_FRAMEBUFFER, curFB);
 }

content/events/src/Touch.cpp

@@ -25,27 +25,12 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_1(Touch, mTarget)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(Touch)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
-  NS_INTERFACE_MAP_ENTRY(nsIDOMTouch)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(Touch)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(Touch)
 
-NS_IMETHODIMP
-Touch::GetIdentifier(int32_t* aIdentifier)
-{
-  *aIdentifier = Identifier();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetTarget(nsIDOMEventTarget** aTarget)
-{
-  NS_ADDREF(*aTarget = Target());
-  return NS_OK;
-}
-
 EventTarget*
 Touch::Target() const
 {
@@ -58,76 +43,6 @@ Touch::Target() const
   return mTarget;
 }
 
-NS_IMETHODIMP
-Touch::GetScreenX(int32_t* aScreenX)
-{
-  *aScreenX = ScreenX();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetScreenY(int32_t* aScreenY)
-{
-  *aScreenY = ScreenY();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetClientX(int32_t* aClientX)
-{
-  *aClientX = ClientX();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetClientY(int32_t* aClientY)
-{
-  *aClientY = ClientY();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetPageX(int32_t* aPageX)
-{
-  *aPageX = PageX();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetPageY(int32_t* aPageY)
-{
-  *aPageY = PageY();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetRadiusX(int32_t* aRadiusX)
-{
-  *aRadiusX = RadiusX();
-  return NS_OK;
-}
-                                             
-NS_IMETHODIMP
-Touch::GetRadiusY(int32_t* aRadiusY)
-{
-  *aRadiusY = RadiusY();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetRotationAngle(float* aRotationAngle)
-{
-  *aRotationAngle = RotationAngle();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-Touch::GetForce(float* aForce)
-{
-  *aForce = Force();
-  return NS_OK;
-}
-
 void
 Touch::InitializePoints(nsPresContext* aPresContext, nsEvent* aEvent)
 {

content/events/src/Touch.h

@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_Touch_h
 #define mozilla_dom_Touch_h
 
-#include "nsIDOMTouchEvent.h"
 #include "nsString.h"
 #include "nsTArray.h"
 #include "mozilla/Attributes.h"
@@ -18,7 +17,7 @@
 namespace mozilla {
 namespace dom {
 
-class Touch MOZ_FINAL : public nsIDOMTouch
+class Touch MOZ_FINAL : public nsISupports
                       , public nsWrapperCache
 {
 public:
@@ -77,7 +76,6 @@ public:
     }
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(Touch)
-  NS_DECL_NSIDOMTOUCH
 
   void InitializePoints(nsPresContext* aPresContext, nsEvent* aEvent);
 

content/events/src/nsDOMTouchEvent.cpp

@@ -20,7 +20,6 @@ using namespace mozilla::dom;
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMTouchList)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMTouchList)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_2(nsDOMTouchList, mParent, mPoints)
@@ -40,27 +39,6 @@ nsDOMTouchList::PrefEnabled()
   return nsDOMTouchEvent::PrefEnabled();
 }
 
-NS_IMETHODIMP
-nsDOMTouchList::GetLength(uint32_t* aLength)
-{
-  *aLength = Length();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchList::Item(uint32_t aIndex, nsIDOMTouch** aRetVal)
-{
-  NS_IF_ADDREF(*aRetVal = Item(aIndex));
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchList::IdentifiedTouch(int32_t aIdentifier, nsIDOMTouch** aRetVal)
-{
-  NS_IF_ADDREF(*aRetVal = IdentifiedTouch(aIdentifier));
-  return NS_OK;
-}
-
 Touch*
 nsDOMTouchList::IdentifiedTouch(int32_t aIdentifier) const
 {
@@ -108,14 +86,13 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED_3(nsDOMTouchEvent, nsDOMUIEvent,
                                      mChangedTouches)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsDOMTouchEvent)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMTouchEvent)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMUIEvent)
 
 NS_IMPL_ADDREF_INHERITED(nsDOMTouchEvent, nsDOMUIEvent)
 NS_IMPL_RELEASE_INHERITED(nsDOMTouchEvent, nsDOMUIEvent)
 
 
-NS_IMETHODIMP
+void
 nsDOMTouchEvent::InitTouchEvent(const nsAString& aType,
                                 bool aCanBubble,
                                 bool aCancelable,
@@ -125,31 +102,25 @@ nsDOMTouchEvent::InitTouchEvent(const nsAString& aType,
                                 bool aAltKey,
                                 bool aShiftKey,
                                 bool aMetaKey,
-                                nsIDOMTouchList* aTouches,
-                                nsIDOMTouchList* aTargetTouches,
-                                nsIDOMTouchList* aChangedTouches)
+                                nsDOMTouchList* aTouches,
+                                nsDOMTouchList* aTargetTouches,
+                                nsDOMTouchList* aChangedTouches,
+                                mozilla::ErrorResult& aRv)
 {
-  nsresult rv = nsDOMUIEvent::InitUIEvent(aType,
-                                          aCanBubble,
-                                          aCancelable,
-                                          aView,
-                                          aDetail);
-  NS_ENSURE_SUCCESS(rv, rv);
+  aRv = nsDOMUIEvent::InitUIEvent(aType,
+                                  aCanBubble,
+                                  aCancelable,
+                                  aView,
+                                  aDetail);
+  if (aRv.Failed()) {
+    return;
+  }
 
   static_cast<nsInputEvent*>(mEvent)->InitBasicModifiers(aCtrlKey, aAltKey,
                                                          aShiftKey, aMetaKey);
-  mTouches = static_cast<nsDOMTouchList*>(aTouches);
-  mTargetTouches = static_cast<nsDOMTouchList*>(aTargetTouches);
-  mChangedTouches = static_cast<nsDOMTouchList*>(aChangedTouches);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchEvent::GetTouches(nsIDOMTouchList** aTouches)
-{
-  NS_ENSURE_ARG_POINTER(aTouches);
-  NS_ADDREF(*aTouches = Touches());
-  return NS_OK;
+  mTouches = aTouches;
+  mTargetTouches = aTargetTouches;
+  mChangedTouches = aChangedTouches;
 }
 
 nsDOMTouchList*
@@ -174,14 +145,6 @@ nsDOMTouchEvent::Touches()
   return mTouches;
 }
 
-NS_IMETHODIMP
-nsDOMTouchEvent::GetTargetTouches(nsIDOMTouchList** aTargetTouches)
-{
-  NS_ENSURE_ARG_POINTER(aTargetTouches);
-  NS_ADDREF(*aTargetTouches = TargetTouches());
-  return NS_OK;
-}
-
 nsDOMTouchList*
 nsDOMTouchEvent::TargetTouches()
 {
@@ -204,14 +167,6 @@ nsDOMTouchEvent::TargetTouches()
   return mTargetTouches;
 }
 
-NS_IMETHODIMP
-nsDOMTouchEvent::GetChangedTouches(nsIDOMTouchList** aChangedTouches)
-{
-  NS_ENSURE_ARG_POINTER(aChangedTouches);
-  NS_ADDREF(*aChangedTouches = ChangedTouches());
-  return NS_OK;
-}
-
 nsDOMTouchList*
 nsDOMTouchEvent::ChangedTouches()
 {
@@ -229,34 +184,6 @@ nsDOMTouchEvent::ChangedTouches()
   return mChangedTouches;
 }
 
-NS_IMETHODIMP
-nsDOMTouchEvent::GetAltKey(bool* aAltKey)
-{
-  *aAltKey = AltKey();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchEvent::GetMetaKey(bool* aMetaKey)
-{
-  *aMetaKey = MetaKey();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchEvent::GetCtrlKey(bool* aCtrlKey)
-{
-  *aCtrlKey = CtrlKey();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMTouchEvent::GetShiftKey(bool* aShiftKey)
-{
-  *aShiftKey = ShiftKey();
-  return NS_OK;
-}
-
 #ifdef XP_WIN
 namespace mozilla {
 namespace widget {

content/events/src/nsDOMTouchEvent.h

@@ -6,7 +6,6 @@
 #define nsDOMTouchEvent_h_
 
 #include "nsDOMUIEvent.h"
-#include "nsIDOMTouchEvent.h"
 #include "nsString.h"
 #include "nsTArray.h"
 #include "mozilla/Attributes.h"
@@ -14,7 +13,7 @@
 #include "mozilla/dom/TouchEventBinding.h"
 #include "nsWrapperCache.h"
 
-class nsDOMTouchList MOZ_FINAL : public nsIDOMTouchList
+class nsDOMTouchList MOZ_FINAL : public nsISupports
                                , public nsWrapperCache
 {
   typedef mozilla::dom::Touch Touch;
@@ -22,7 +21,6 @@ class nsDOMTouchList MOZ_FINAL : public nsIDOMTouchList
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsDOMTouchList)
-  NS_DECL_NSIDOMTOUCHLIST
 
   nsDOMTouchList(nsISupports* aParent)
     : mParent(aParent)
@@ -77,8 +75,7 @@ protected:
   nsTArray< nsRefPtr<Touch> > mPoints;
 };
 
-class nsDOMTouchEvent : public nsDOMUIEvent,
-                        public nsIDOMTouchEvent
+class nsDOMTouchEvent : public nsDOMUIEvent
 {
 public:
   nsDOMTouchEvent(mozilla::dom::EventTarget* aOwner,
@@ -87,12 +84,9 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsDOMTouchEvent, nsDOMUIEvent)
-  NS_DECL_NSIDOMTOUCHEVENT
-
-  NS_FORWARD_TO_NSDOMUIEVENT
 
   virtual JSObject* WrapObject(JSContext* aCx,
-			       JS::Handle<JSObject*> aScope) MOZ_OVERRIDE
+                               JS::Handle<JSObject*> aScope) MOZ_OVERRIDE
   {
     return mozilla::dom::TouchEventBinding::Wrap(aCx, aScope, this);
   }
@@ -130,15 +124,10 @@ public:
                       bool aAltKey,
                       bool aShiftKey,
                       bool aMetaKey,
-                      nsIDOMTouchList* aTouches,
-                      nsIDOMTouchList* aTargetTouches,
-                      nsIDOMTouchList* aChangedTouches,
-                      mozilla::ErrorResult& aRv)
-  {
-    aRv = InitTouchEvent(aType, aCanBubble, aCancelable, aView, aDetail,
-                         aCtrlKey, aAltKey, aShiftKey, aMetaKey,
-                         aTouches, aTargetTouches, aChangedTouches);
-  }
+                      nsDOMTouchList* aTouches,
+                      nsDOMTouchList* aTargetTouches,
+                      nsDOMTouchList* aChangedTouches,
+                      mozilla::ErrorResult& aRv);
 
   static bool PrefEnabled();
 protected:

content/html/content/src/HTMLInputElement.cpp

@@ -6025,10 +6025,14 @@ HTMLInputElement::SetFilePickerFiltersFromAccept(nsIFilePicker* filePicker)
         continue;
       }
 
-      // Get mime type name
-      nsCString mimeTypeName;
-      mimeInfo->GetType(mimeTypeName);
-      CopyUTF8toUTF16(mimeTypeName, filterName);
+      // Get a name for the filter: first try the description, then the mime type
+      // name if there is no description
+      mimeInfo->GetDescription(filterName);
+      if (filterName.IsEmpty()) {
+        nsCString mimeTypeName;
+        mimeInfo->GetType(mimeTypeName);
+        CopyUTF8toUTF16(mimeTypeName, filterName);
+      }
 
       // Get extension list
       nsCOMPtr<nsIUTF8StringEnumerator> extensions;

content/media/encoder/TrackEncoder.cpp

@@ -67,16 +67,24 @@ AudioTrackEncoder::NotifyRemoved(MediaStreamGraph* aGraph)
 {
   // In case that MediaEncoder does not receive a TRACK_EVENT_ENDED event.
   LOG("[AudioTrackEncoder]: NotifyRemoved.");
+  NotifyEndOfStream();
+}
 
+void
+AudioTrackEncoder::NotifyEndOfStream()
+{
   // If source audio chunks are completely silent till the end of encoding,
   // initialize the encoder with default channel counts and sampling rate, and
   // append this many null data to the segment of track encoder.
-  if (!mInitialized && mSilentDuration > 0) {
+  if (!mCanceled && !mInitialized && mSilentDuration > 0) {
     Init(DEFAULT_CHANNELS, DEFAULT_SAMPLING_RATE);
     mRawSegment->AppendNullData(mSilentDuration);
     mSilentDuration = 0;
   }
-  NotifyEndOfStream();
+
+  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  mEndOfStream = true;
+  mReentrantMonitor.NotifyAll();
 }
 
 nsresult

content/media/encoder/TrackEncoder.h

@@ -130,12 +130,7 @@ protected:
    * Notifies the audio encoder that we have reached the end of source stream,
    * and wakes up mReentrantMonitor if encoder is waiting for more track data.
    */
-  void NotifyEndOfStream()
-  {
-    ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-    mEndOfStream = true;
-    mReentrantMonitor.NotifyAll();
-  }
+  void NotifyEndOfStream();
 
   /**
    * Interleaves the track data and stores the result into aOutput. Might need

content/media/mediasource/SourceBuffer.cpp

@@ -89,13 +89,13 @@ SourceBuffer::SetAppendWindowEnd(double aAppendWindowEnd, ErrorResult& aRv)
 }
 
 void
-SourceBuffer::AppendBuffer(ArrayBuffer& aData, ErrorResult& aRv)
+SourceBuffer::AppendBuffer(const ArrayBuffer& aData, ErrorResult& aRv)
 {
   AppendData(aData.Data(), aData.Length(), aRv);
 }
 
 void
-SourceBuffer::AppendBuffer(ArrayBufferView& aData, ErrorResult& aRv)
+SourceBuffer::AppendBuffer(const ArrayBufferView& aData, ErrorResult& aRv)
 {
   AppendData(aData.Data(), aData.Length(), aRv);
 }

content/media/mediasource/SourceBuffer.h

@@ -62,8 +62,8 @@ public:
 
   void SetAppendWindowEnd(double aAppendWindowEnd, ErrorResult& aRv);
 
-  void AppendBuffer(ArrayBuffer& aData, ErrorResult& aRv);
-  void AppendBuffer(ArrayBufferView& aData, ErrorResult& aRv);
+  void AppendBuffer(const ArrayBuffer& aData, ErrorResult& aRv);
+  void AppendBuffer(const ArrayBufferView& aData, ErrorResult& aRv);
 
   void Abort(ErrorResult& aRv);
 

content/media/webaudio/AnalyserNode.cpp

@@ -143,7 +143,7 @@ AnalyserNode::SetSmoothingTimeConstant(double aValue, ErrorResult& aRv)
 }
 
 void
-AnalyserNode::GetFloatFrequencyData(Float32Array& aArray)
+AnalyserNode::GetFloatFrequencyData(const Float32Array& aArray)
 {
   if (!FFTAnalysis()) {
     // Might fail to allocate memory
@@ -159,7 +159,7 @@ AnalyserNode::GetFloatFrequencyData(Float32Array& aArray)
 }
 
 void
-AnalyserNode::GetByteFrequencyData(Uint8Array& aArray)
+AnalyserNode::GetByteFrequencyData(const Uint8Array& aArray)
 {
   if (!FFTAnalysis()) {
     // Might fail to allocate memory
@@ -181,7 +181,7 @@ AnalyserNode::GetByteFrequencyData(Uint8Array& aArray)
 }
 
 void
-AnalyserNode::GetByteTimeDomainData(Uint8Array& aArray)
+AnalyserNode::GetByteTimeDomainData(const Uint8Array& aArray)
 {
   unsigned char* buffer = aArray.Data();
   uint32_t length = std::min(aArray.Length(), mBuffer.Length());

content/media/webaudio/AnalyserNode.h

@@ -25,9 +25,9 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  void GetFloatFrequencyData(Float32Array& aArray);
-  void GetByteFrequencyData(Uint8Array& aArray);
-  void GetByteTimeDomainData(Uint8Array& aArray);
+  void GetFloatFrequencyData(const Float32Array& aArray);
+  void GetByteFrequencyData(const Uint8Array& aArray);
+  void GetByteTimeDomainData(const Uint8Array& aArray);
   uint32_t FftSize() const
   {
     return mAnalysisBlock.FFTSize();

content/media/webaudio/AudioContext.cpp

@@ -160,7 +160,7 @@ AudioContext::CreateBuffer(JSContext* aJSContext, uint32_t aNumberOfChannels,
 }
 
 already_AddRefed<AudioBuffer>
-AudioContext::CreateBuffer(JSContext* aJSContext, ArrayBuffer& aBuffer,
+AudioContext::CreateBuffer(JSContext* aJSContext, const ArrayBuffer& aBuffer,
                           bool aMixToMono, ErrorResult& aRv)
 {
   // Do not accept this method unless the legacy pref has been set.

content/media/webaudio/AudioContext.h

@@ -124,7 +124,7 @@ public:
                ErrorResult& aRv);
 
   already_AddRefed<AudioBuffer>
-  CreateBuffer(JSContext* aJSContext, ArrayBuffer& aBuffer,
+  CreateBuffer(JSContext* aJSContext, const ArrayBuffer& aBuffer,
                bool aMixToMono, ErrorResult& aRv);
 
   already_AddRefed<MediaStreamAudioDestinationNode>

content/media/webaudio/BiquadFilterNode.cpp

@@ -248,8 +248,8 @@ BiquadFilterNode::SetType(BiquadFilterType aType)
 
 void
 BiquadFilterNode::GetFrequencyResponse(const Float32Array& aFrequencyHz,
-                                       Float32Array& aMagResponse,
-                                       Float32Array& aPhaseResponse)
+                                       const Float32Array& aMagResponse,
+                                       const Float32Array& aPhaseResponse)
 {
   uint32_t length = std::min(std::min(aFrequencyHz.Length(), aMagResponse.Length()),
                              aPhaseResponse.Length());

content/media/webaudio/BiquadFilterNode.h

@@ -54,8 +54,8 @@ public:
   }
 
   void GetFrequencyResponse(const Float32Array& aFrequencyHz,
-                            Float32Array& aMagResponse,
-                            Float32Array& aPhaseResponse);
+                            const Float32Array& aMagResponse,
+                            const Float32Array& aPhaseResponse);
 
 private:
   static void SendFrequencyToStream(AudioNode* aNode);

content/media/webaudio/WaveShaperNode.cpp

@@ -121,14 +121,14 @@ WaveShaperNode::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aScope)
 }
 
 void
-WaveShaperNode::SetCurve(const Float32Array* aCurve)
+WaveShaperNode::SetCurve(const Nullable<Float32Array>& aCurve)
 {
   nsTArray<float> curve;
-  if (aCurve) {
-    mCurve = aCurve->Obj();
+  if (!aCurve.IsNull()) {
+    mCurve = aCurve.Value().Obj();
 
-    curve.SetLength(aCurve->Length());
-    PodCopy(curve.Elements(), aCurve->Data(), aCurve->Length());
+    curve.SetLength(aCurve.Value().Length());
+    PodCopy(curve.Elements(), aCurve.Value().Data(), aCurve.Value().Length());
   } else {
     mCurve = nullptr;
   }

content/media/webaudio/WaveShaperNode.h

@@ -31,7 +31,7 @@ public:
   {
     return mCurve;
   }
-  void SetCurve(const Float32Array* aData);
+  void SetCurve(const Nullable<Float32Array>& aData);
 
 private:
   void ClearCurve();

content/svg/content/src/SVGLengthList.h

@@ -204,7 +204,7 @@ public:
   /**
    * The value returned by this function depends on which attribute this object
    * is for. If appending a list of zeros to the attribute's list would have no
-   * affect on rendering (e.g. the attributes 'dx' and 'dy' on <text>), then
+   * effect on rendering (e.g. the attributes 'dx' and 'dy' on <text>), then
    * this method will return true. If appending a list of zeros to the
    * attribute's list could *change* rendering (e.g. the attributes 'x' and 'y'
    * on <text>), then this method will return false.

content/xbl/src/nsXBLProtoImpl.cpp

@@ -303,7 +303,7 @@ nsXBLProtoImpl::UndefineFields(JSContext *cx, JS::Handle<JSObject*> obj) const
     JSBool hasProp;
     if (::JS_AlreadyHasOwnUCProperty(cx, obj, s, name.Length(), &hasProp) &&
         hasProp) {
-      JS::Rooted<JS::Value> dummy(cx);
+      bool dummy;
       ::JS_DeleteUCProperty2(cx, obj, s, name.Length(), &dummy);
     }
   }

docshell/base/nsDocShell.cpp

@@ -135,7 +135,7 @@
 #include "nsIDOMHTMLAnchorElement.h"
 #include "nsIWebBrowserChrome3.h"
 #include "nsITabChild.h"
-#include "nsIStrictTransportSecurityService.h"
+#include "nsISiteSecurityService.h"
 #include "nsStructuredCloneContainer.h"
 #include "nsIStructuredCloneContainer.h"
 #ifdef MOZ_PLACES
@@ -4266,14 +4266,15 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
 
                 // if this is a Strict-Transport-Security host and the cert
                 // is bad, don't allow overrides (STS Spec section 7.3).
-                nsCOMPtr<nsIStrictTransportSecurityService> stss =
-                          do_GetService(NS_STSSERVICE_CONTRACTID, &rv);
+                nsCOMPtr<nsISiteSecurityService> sss =
+                          do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
                 NS_ENSURE_SUCCESS(rv, rv);
                 uint32_t flags =
                   mInPrivateBrowsing ? nsISocketProvider::NO_PERMANENT_STORAGE : 0;
                 
                 bool isStsHost = false;
-                rv = stss->IsStsURI(aURI, flags, &isStsHost);
+                rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS,
+                                      aURI, flags, &isStsHost);
                 NS_ENSURE_SUCCESS(rv, rv);
 
                 uint32_t bucketId;

dom/base/Crypto.cpp

@@ -55,7 +55,8 @@ Crypto::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
 }
 
 JSObject *
-Crypto::GetRandomValues(JSContext* aCx, ArrayBufferView& aArray, ErrorResult& aRv)
+Crypto::GetRandomValues(JSContext* aCx, const ArrayBufferView& aArray,
+			ErrorResult& aRv)
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "Called on the wrong thread");
 

dom/base/Crypto.h

@@ -34,7 +34,8 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(Crypto)
 
   JSObject *
-  GetRandomValues(JSContext* aCx, ArrayBufferView& aArray, ErrorResult& aRv);
+  GetRandomValues(JSContext* aCx, const ArrayBufferView& aArray,
+		  ErrorResult& aRv);
 
 #ifndef MOZ_DISABLE_CRYPTOLEGACY
   virtual bool EnableSmartCardEvents() = 0;

dom/base/nsDOMWindowUtils.cpp

@@ -20,7 +20,6 @@
 #include "nsRefreshDriver.h"
 #include "nsDOMTouchEvent.h"
 #include "mozilla/dom/Touch.h"
-#include "nsIDOMTouchEvent.h"
 #include "nsObjectLoadingContent.h"
 #include "nsFrame.h"
 

dom/base/nsGlobalWindow.h

@@ -54,7 +54,6 @@
 #include "nsFrameMessageManager.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/TimeStamp.h"
-#include "nsIDOMTouchEvent.h"
 #include "nsIInlineEventHandlers.h"
 #include "nsWrapperCacheInlines.h"
 #include "nsIIdleObserver.h"
@@ -63,6 +62,7 @@
 #include "mozilla/dom/Gamepad.h"
 #endif
 #include "nsIDocument.h"
+#include "nsIDOMTouchEvent.h"
 
 #include "mozilla/dom/EventTarget.h"
 #include "Units.h"

dom/base/nsScreen.cpp

@@ -259,7 +259,7 @@ nsScreen::MozLockOrientation(const JS::Value& aOrientation, JSContext* aCx,
 
       for (uint32_t i = 0; i < length; ++i) {
         JS::Rooted<JS::Value> temp(aCx);
-        if (!JS_GetElement(aCx, seq, i, temp.address())) {
+        if (!JS_GetElement(aCx, seq, i, &temp)) {
           return NS_ERROR_FAILURE;
         }
 

dom/bindings/BindingDeclarations.h

@@ -37,6 +37,13 @@ struct DictionaryBase
 {
 };
 
+// Struct that serves as a base class for all typed arrays and array buffers and
+// array buffer views.  Particularly useful so we can use IsBaseOf to detect
+// typed array/buffer/view template arguments.
+struct AllTypedArraysBase {
+};
+
+
 struct MainThreadDictionaryBase : public DictionaryBase
 {
 protected:

dom/bindings/BindingUtils.h

@@ -1646,7 +1646,9 @@ public:
 
 // Class used to trace sequences, with specializations for various
 // sequence types.
-template<typename T, bool isDictionary=IsBaseOf<DictionaryBase, T>::value>
+template<typename T,
+         bool isDictionary=IsBaseOf<DictionaryBase, T>::value,
+         bool isTypedArray=IsBaseOf<AllTypedArraysBase, T>::value>
 class SequenceTracer
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
@@ -1654,13 +1656,13 @@ class SequenceTracer
 
 // sequence<object> or sequence<object?>
 template<>
-class SequenceTracer<JSObject*, false>
+class SequenceTracer<JSObject*, false, false>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
   static void TraceSequence(JSTracer* trc, JSObject** objp, JSObject** end) {
-    for ( ; objp != end; ++objp) {
+    for (; objp != end; ++objp) {
       JS_CallObjectTracer(trc, objp, "sequence<object>");
     }
   }
@@ -1668,13 +1670,13 @@ public:
 
 // sequence<any>
 template<>
-class SequenceTracer<JS::Value, false>
+class SequenceTracer<JS::Value, false, false>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
   static void TraceSequence(JSTracer* trc, JS::Value* valp, JS::Value* end) {
-    for ( ; valp != end; ++valp) {
+    for (; valp != end; ++valp) {
       JS_CallValueTracer(trc, valp, "sequence<any>");
     }
   }
@@ -1682,13 +1684,13 @@ public:
 
 // sequence<sequence<T>>
 template<typename T>
-class SequenceTracer<Sequence<T>, false>
+class SequenceTracer<Sequence<T>, false, false>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
   static void TraceSequence(JSTracer* trc, Sequence<T>* seqp, Sequence<T>* end) {
-    for ( ; seqp != end; ++seqp) {
+    for (; seqp != end; ++seqp) {
       DoTraceSequence(trc, *seqp);
     }
   }
@@ -1696,13 +1698,13 @@ public:
 
 // sequence<sequence<T>> as return value
 template<typename T>
-class SequenceTracer<nsTArray<T>, false>
+class SequenceTracer<nsTArray<T>, false, false>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
   static void TraceSequence(JSTracer* trc, nsTArray<T>* seqp, nsTArray<T>* end) {
-    for ( ; seqp != end; ++seqp) {
+    for (; seqp != end; ++seqp) {
       DoTraceSequence(trc, *seqp);
     }
   }
@@ -1710,30 +1712,48 @@ public:
 
 // sequence<someDictionary>
 template<typename T>
-class SequenceTracer<T, true>
+class SequenceTracer<T, true, false>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
   static void TraceSequence(JSTracer* trc, T* dictp, T* end) {
-    for ( ; dictp != end; ++dictp) {
+    for (; dictp != end; ++dictp) {
       dictp->TraceDictionary(trc);
     }
   }
 };
 
-// sequence<sequence<T>?>
+// sequence<SomeTypedArray>
 template<typename T>
-class SequenceTracer<Nullable<Sequence<T> >, false>
+class SequenceTracer<T, false, true>
 {
   explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
 
 public:
-  static void TraceSequence(JSTracer* trc, Nullable<Sequence<T> >* seqp,
-                            Nullable<Sequence<T> >* end) {
-    for ( ; seqp != end; ++seqp) {
+  static void TraceSequence(JSTracer* trc, T* arrayp, T* end) {
+    for (; arrayp != end; ++arrayp) {
+      arrayp->TraceSelf(trc);
+    }
+  }
+};
+
+// sequence<T?> with T? being a Nullable<T>
+template<typename T>
+class SequenceTracer<Nullable<T>, false, false>
+{
+  explicit SequenceTracer() MOZ_DELETE; // Should never be instantiated
+
+public:
+  static void TraceSequence(JSTracer* trc, Nullable<T>* seqp,
+                            Nullable<T>* end) {
+    for (; seqp != end; ++seqp) {
       if (!seqp->IsNull()) {
-        DoTraceSequence(trc, seqp->Value());
+        // Pretend like we actually have a length-one sequence here so
+        // we can do template instantiation correctly for T.
+        T& val = seqp->Value();
+        T* ptr = &val;
+        SequenceTracer<T>::TraceSequence(trc, ptr, ptr+1);
       }
     }
   }

dom/bindings/Codegen.py

@@ -2771,7 +2771,7 @@ if (!arr.SetCapacity(length)) {
 }
 for (uint32_t i = 0; i < length; ++i) {
   JS::Rooted<JS::Value> temp(cx);
-  if (!JS_GetElement(cx, seq, i, temp.address())) {
+  if (!JS_GetElement(cx, seq, i, &temp)) {
 %s
   }
   %s& slot = *arr.AppendElement();
@@ -2801,7 +2801,7 @@ for (uint32_t i = 0; i < length; ++i) {
                                           "${declName}.SetNull()", notSequence)
         # Sequence arguments that might contain traceable things need
         # to get traced
-        if not isMember and typeNeedsCx(elementType, descriptorProvider):
+        if not isMember and typeNeedsRooting(elementType, descriptorProvider):
             holderType = CGTemplatedType("SequenceRooter", elementInfo.declType)
             holderArgs = "cx, &%s" % arrayRef
         else:
@@ -3200,60 +3200,25 @@ for (uint32_t i = 0; i < length; ++i) {
 
     if type.isSpiderMonkeyInterface():
         assert not isEnforceRange and not isClamp
-        if isMember:
-            raise TypeError("Can't handle member arraybuffers or "
-                            "arraybuffer views because making sure all the "
-                            "objects are properly rooted is hard")
         name = type.name
-        # By default, we use a Maybe<> to hold our typed array.  And in the optional
-        # non-nullable case we want to pass Optional<TypedArray> to consumers, not
-        # Optional<NonNull<TypedArray> >, so jump though some hoops to do that.
-        holderType = "Maybe<%s>" % name
-        constructLoc = "${holderName}"
-        constructMethod = "construct"
-        constructInternal = "ref"
+        declType = CGGeneric(name)
         if type.nullable():
-            if isOptional:
-                declType = "Optional<" + name + "*>"
-            else:
-                declType = name + "*"
+            declType = CGTemplatedType("Nullable", declType)
+            objRef = "${declName}.SetValue()"
         else:
-            if isOptional:
-                declType = "Optional<" + name + ">"
-                # We don't need a holder in this case
-                holderType = None
-                constructLoc = "${declName}"
-                constructMethod = "Construct"
-                constructInternal = "Value"
-            else:
-                declType = "NonNull<" + name + ">"
+            objRef = "${declName}"
+
         template = (
-            "%s.%s(&${val}.toObject());\n"
-            "if (!%s.%s().inited()) {\n"
+            "if (!%s.Init(&${val}.toObject())) {\n"
             "%s" # No newline here because onFailureBadType() handles that
             "}\n" %
-            (constructLoc, constructMethod, constructLoc, constructInternal,
+            (objRef,
              CGIndenter(onFailureBadType(failureCode, type.name)).define()))
-        nullableTarget = ""
-        if type.nullable():
-            if isOptional:
-                template += "${declName}.Construct();\n"
-                nullableTarget = "${declName}.Value()"
-            else:
-                nullableTarget = "${declName}"
-            template += "%s = ${holderName}.addr();" % nullableTarget
-        elif not isOptional:
-            template += "${declName} = ${holderName}.addr();"
-        template = wrapObjectTemplate(template, type,
-                                      "%s = nullptr" % nullableTarget,
+        template = wrapObjectTemplate(template, type, "${declName}.SetNull()",
                                       failureCode)
-
-        if holderType is not None:
-            holderType = CGGeneric(holderType)
-        # We handle all the optional stuff ourselves; no need for caller to do it.
         return JSToNativeConversionInfo(template,
-                                        declType=CGGeneric(declType),
-                                        holderType=holderType)
+                                        declType=declType,
+                                        dealWithOptional=isOptional)
 
     if type.isDOMString():
         assert not isEnforceRange and not isClamp
@@ -3531,7 +3496,7 @@ for (uint32_t i = 0; i < length; ++i) {
 
         # Dictionary arguments that might contain traceable things need to get
         # traced
-        if not isMember and typeNeedsCx(type, descriptorProvider):
+        if not isMember and typeNeedsRooting(type, descriptorProvider):
             declType = CGTemplatedType("RootedDictionary", declType);
             declArgs = "cx"
         else:
@@ -3843,7 +3808,7 @@ class CGArgumentConverter(CGThing):
         replacer = dict(self.argcAndIndex, **self.replacementVariables)
         replacer["seqType"] = CGTemplatedType("AutoSequence",
                                               typeConversion.declType).define()
-        if typeNeedsCx(self.argument.type, self.descriptorProvider):
+        if typeNeedsRooting(self.argument.type, self.descriptorProvider):
             rooterDecl = ("SequenceRooter<%s> ${holderName}(cx, &${declName});\n" %
                           typeConversion.declType.define())
         else:
@@ -3886,7 +3851,7 @@ class CGArgumentConverter(CGThing):
 sequenceWrapLevel = 0
 
 def getWrapTemplateForType(type, descriptorProvider, result, successCode,
-                           isCreator, exceptionCode):
+                           isCreator, exceptionCode, typedArraysAreStructs):
     """
     Reflect a C++ value stored in "result", of IDL type "type" into JS.  The
     "successCode" is the code to run once we have successfully done the
@@ -3895,6 +3860,9 @@ def getWrapTemplateForType(type, descriptorProvider, result, successCode,
     doing a 'break' if the entire conversion template is inside a block that
     the 'break' will exit).
 
+    If typedArraysAreStructs is true, then if the type is a typed array,
+    "result" is one of the dom::TypedArray subclasses, not a JSObject*.
+
     The resulting string should be used with string.Template.  It
     needs the following keys when substituting:
 
@@ -3970,7 +3938,8 @@ def getWrapTemplateForType(type, descriptorProvider, result, successCode,
             # Nullable sequences are Nullable< nsTArray<T> >
             (recTemplate, recInfall) = getWrapTemplateForType(type.inner, descriptorProvider,
                                                               "%s.Value()" % result, successCode,
-                                                              isCreator, exceptionCode)
+                                                              isCreator, exceptionCode,
+                                                              typedArraysAreStructs)
             return ("""
 if (%s.IsNull()) {
 %s
@@ -4135,7 +4104,8 @@ if (!returnArray) {
         # NB: setValue(..., True) calls JS_WrapValue(), so is fallible
         return (setValue(result, "value"), False)
 
-    if type.isObject() or type.isSpiderMonkeyInterface():
+    if (type.isObject() or (type.isSpiderMonkeyInterface() and
+                            not typedArraysAreStructs)):
         # See comments in WrapNewBindingObject explaining why we need
         # to wrap here.
         if type.nullable():
@@ -4153,17 +4123,28 @@ if (!returnArray) {
         # NB: setValue(..., True) calls JS_WrapValue(), so is fallible
         return (setValue(toValue % result, wrapType), False)
 
-    if not (type.isUnion() or type.isPrimitive() or type.isDictionary() or type.isDate()):
+    if not (type.isUnion() or type.isPrimitive() or type.isDictionary() or
+            type.isDate() or
+            (type.isSpiderMonkeyInterface() and typedArraysAreStructs)):
         raise TypeError("Need to learn to wrap %s" % type)
 
     if type.nullable():
         (recTemplate, recInfal) = getWrapTemplateForType(type.inner, descriptorProvider,
                                                          "%s.Value()" % result, successCode,
-                                                         isCreator, exceptionCode)
+                                                         isCreator, exceptionCode,
+                                                         typedArraysAreStructs)
         return ("if (%s.IsNull()) {\n" % result +
                 CGIndenter(CGGeneric(setValue("JSVAL_NULL"))).define() + "\n" +
                 "}\n" + recTemplate, recInfal)
 
+    if type.isSpiderMonkeyInterface():
+        assert typedArraysAreStructs
+        # See comments in WrapNewBindingObject explaining why we need
+        # to wrap here.
+        # NB: setValue(..., True) calls JS_WrapValue(), so is fallible
+        return (setValue("JS::ObjectValue(*%s.Obj())" % result,
+                         "nonDOMObject"), False)
+
     if type.isUnion():
         return (wrapAndSetPtr("%s.ToJSVal(cx, ${obj}, ${jsvalHandle})" % result),
                 False)
@@ -4234,7 +4215,9 @@ def wrapForType(type, descriptorProvider, templateValues):
                                   templateValues.get('successCode', None),
                                   templateValues.get('isCreator', False),
                                   templateValues.get('exceptionCode',
-                                                     "return false;"))[0]
+                                                     "return false;"),
+                                  templateValues.get('typedArraysAreStructs',
+                                                     False))[0]
 
     defaultValues = {'obj': 'obj'}
     return string.Template(wrap).substitute(defaultValues, **templateValues)
@@ -4251,29 +4234,43 @@ def infallibleForMember(member, type, descriptorProvider):
         failure conditions.
     """
     return getWrapTemplateForType(type, descriptorProvider, 'result', None,\
-                                  memberIsCreator(member), "return false;")[1]
+                                  memberIsCreator(member), "return false;",
+                                  False)[1]
+
+def leafTypeNeedsCx(type, descriptorProvider, retVal):
+    return (type.isAny() or type.isObject() or
+            (retVal and type.isSpiderMonkeyInterface()) or
+            (descriptorProvider.workers and type.isCallback()))
+
+def leafTypeNeedsRooting(type, descriptorProvider):
+    return (leafTypeNeedsCx(type, descriptorProvider, False) or
+            type.isSpiderMonkeyInterface())
+
+def typeNeedsRooting(type, descriptorProvider):
+    return typeMatchesLambda(type,
+                             lambda t: leafTypeNeedsRooting(t, descriptorProvider))
 
 def typeNeedsCx(type, descriptorProvider, retVal=False):
+    return typeMatchesLambda(type,
+                             lambda t: leafTypeNeedsCx(t, descriptorProvider, retVal))
+
+def typeMatchesLambda(type, func):
     if type is None:
         return False
     if type.nullable():
-        return typeNeedsCx(type.inner, descriptorProvider, retVal)
+        return typeMatchesLambda(type.inner, func)
     if type.isSequence() or type.isArray():
-        return typeNeedsCx(type.inner, descriptorProvider, retVal)
+        return typeMatchesLambda(type.inner, func)
     if type.isUnion():
-        return any(typeNeedsCx(t, descriptorProvider) for t in
+        return any(typeMatchesLambda(t, func) for t in
                    type.unroll().flatMemberTypes)
     if type.isDictionary():
-        return dictionaryNeedsCx(type.inner, descriptorProvider)
-    if retVal and type.isSpiderMonkeyInterface():
-        return True
-    if type.isCallback():
-        return descriptorProvider.workers
-    return type.isAny() or type.isObject()
+        return dictionaryMatchesLambda(type.inner, func)
+    return func(type)
 
-def dictionaryNeedsCx(dictionary, descriptorProvider):
-    return (any(typeNeedsCx(m.type, descriptorProvider) for m in dictionary.members) or
-        (dictionary.parent and dictionaryNeedsCx(dictionary.parent, descriptorProvider)))
+def dictionaryMatchesLambda(dictionary, func):
+    return (any(typeMatchesLambda(m.type, func) for m in dictionary.members) or
+        (dictionary.parent and dictionaryMatchesLambda(dictionary.parent, func)))
 
 # Whenever this is modified, please update CGNativeMember.getRetvalInfo as
 # needed to keep the types compatible.
@@ -4345,7 +4342,7 @@ def getRetvalDeclarationForType(returnType, descriptorProvider,
                                                         resultAlreadyAddRefed,
                                                         isMember="Sequence")
         # While we have our inner type, set up our rooter, if needed
-        if not isMember and typeNeedsCx(returnType, descriptorProvider):
+        if not isMember and typeNeedsRooting(returnType, descriptorProvider):
             rooter = CGGeneric("SequenceRooter<%s > resultRooter(cx, &result);" %
                                result.define())
         else:
@@ -4360,7 +4357,7 @@ def getRetvalDeclarationForType(returnType, descriptorProvider,
                                                     descriptorProvider.workers) +
                     "Initializer")
         result = CGGeneric(dictName)
-        if not isMember and typeNeedsCx(returnType, descriptorProvider):
+        if not isMember and typeNeedsRooting(returnType, descriptorProvider):
             if nullable:
                 result = CGTemplatedType("NullableRootedDictionary", result)
             else:
@@ -4442,11 +4439,13 @@ class CGCallGenerator(CGThing):
                     return True
                 if a.type.isUnion():
                     return True
+                if a.type.isSpiderMonkeyInterface():
+                    return True
                 return False
             if needsConst(a):
                 arg = CGWrapper(arg, pre="Constify(", post=")")
             # And convert NonNull<T> to T&
-            if (((a.type.isInterface() or a.type.isCallback()) and
+            if (((a.type.isGeckoInterface() or a.type.isCallback()) and
                  not a.type.nullable()) or
                 a.type.isDOMString()):
                 arg = CGWrapper(arg, pre="NonNullHelper(", post=")")
@@ -4525,10 +4524,19 @@ def wrapTypeIntoCurrentCompartment(type, value, isMember=True):
                          "}" % value)
 
     if type.isSpiderMonkeyInterface():
-        raise TypeError("Can't handle wrapping of spidermonkey interfaces in "
-                        "constructor arguments yet")
+        origValue = value
+        if type.nullable():
+            value = "%s.Value()" % value
+        wrapCode = CGGeneric("if (!%s.WrapIntoNewCompartment(cx)) {\n"
+                             "  return false;\n"
+                             "}" % value)
+        if type.nullable():
+            wrapCode = CGIfWrapper(wrapCode, "!%s.IsNull()" % origValue)
+        return wrapCode
 
     if type.isSequence():
+        origValue = value
+        origType = type
         if type.nullable():
             type = type.inner
             value = "%s.Value()" % value
@@ -4540,10 +4548,13 @@ def wrapTypeIntoCurrentCompartment(type, value, isMember=True):
         sequenceWrapLevel -= 1
         if not wrapElement:
             return None
-        return CGWrapper(CGIndenter(wrapElement),
-                         pre=("for (uint32_t %s = 0; %s < %s.Length(); ++%s) {\n" %
-                              (index, index, value, index)),
-                         post="\n}")
+        wrapCode = CGWrapper(CGIndenter(wrapElement),
+                             pre=("for (uint32_t %s = 0; %s < %s.Length(); ++%s) {\n" %
+                                  (index, index, value, index)),
+                             post="\n}")
+        if origType.nullable():
+            wrapCode = CGIfWrapper(wrapCode, "!%s.IsNull()" % origValue)
+        return wrapCode
 
     if type.isDictionary():
         assert not type.nullable()
@@ -5893,10 +5904,8 @@ def getUnionAccessorSignatureType(type, descriptorProvider):
     if type.isSpiderMonkeyInterface():
         typeName = CGGeneric(type.name)
         if type.nullable():
-            typeName = CGWrapper(typeName, post="*")
-        else:
-            typeName = CGWrapper(typeName, post="&")
-        return typeName
+            typeName = CGTemplatedType("Nullable", typeName)
+        return CGWrapper(typeName, post="&")
 
     if type.isDOMString():
         return CGGeneric("const nsAString&")
@@ -6146,11 +6155,6 @@ ${doConversionsToJS}
         (templateVars, type) = arg
         assert not type.nullable() # flatMemberTypes never has nullable types
         val = "mValue.m%(name)s.Value()" % templateVars
-        if type.isSpiderMonkeyInterface():
-            # We have a NonNull<TypedArray> object while the wrapping code
-            # wants a JSObject*.  Cheat with .get() so we don't have to
-            # figure out the right reference type to cast to.
-            val = "%s.get()->Obj()" % val
         wrapCode = wrapForType(
             type, self.descriptorProvider,
             {
@@ -6158,6 +6162,7 @@ ${doConversionsToJS}
                 "jsvalHandle": "rval",
                 "obj": "scopeObj",
                 "result": val,
+                "typedArraysAreStructs": True
                 })
         return CGIndenter(CGList([CGGeneric("case e%(name)s:" % templateVars),
                                   CGWrapper(CGIndenter(CGGeneric(wrapCode)),
@@ -7771,7 +7776,7 @@ class CGDOMJSProxyHandler_getElementIfPresent(ClassMethod):
 JS::Rooted<JSObject*> expando(cx, GetExpandoObject(proxy));
 if (expando) {
   JSBool isPresent;
-  if (!JS_GetElementIfPresent(cx, expando, index, expando, vp.address(), &isPresent)) {
+  if (!JS_GetElementIfPresent(cx, expando, index, expando, vp, &isPresent)) {
     return false;
   }
   if (isPresent) {
@@ -7791,7 +7796,7 @@ if (!js::GetObjectProto(cx, proxy, &proto)) {
 }
 if (proto) {
   JSBool isPresent;
-  if (!JS_GetElementIfPresent(cx, proto, index, proxy, vp.address(), &isPresent)) {
+  if (!JS_GetElementIfPresent(cx, proto, index, proxy, vp, &isPresent)) {
     return false;
   }
   *present = isPresent;
@@ -8235,7 +8240,7 @@ class CGDictionary(CGThing):
 
         memberTraces = [self.getMemberTrace(m)
                         for m in self.dictionary.members
-                        if typeNeedsCx(m.type, self.descriptorProvider)]
+                        if typeNeedsRooting(m.type, self.descriptorProvider)]
 
         body += "\n\n".join(memberTraces)
 
@@ -8395,7 +8400,8 @@ class CGDictionary(CGThing):
                 'jsvalRef': "temp",
                 'jsvalHandle': "&temp",
                 'isCreator': False,
-                'obj': "parentObject"
+                'obj': "parentObject",
+                'typedArraysAreStructs': True
             })
         conversion = CGGeneric(innerTemplate)
         conversion = CGWrapper(conversion,
@@ -8419,7 +8425,7 @@ class CGDictionary(CGThing):
 
     def getMemberTrace(self, member):
         type = member.type;
-        assert typeNeedsCx(type, self.descriptorProvider)
+        assert typeNeedsRooting(type, self.descriptorProvider)
         memberLoc = self.makeMemberName(member.identifier.name)
         if member.defaultValue:
             memberData = memberLoc
@@ -8436,15 +8442,18 @@ class CGDictionary(CGThing):
         elif type.isAny():
             trace = CGGeneric('JS_CallValueTracer(trc, %s, "%s");' %
                               ("&"+memberData, memberName))
-        elif type.isSequence() or type.isDictionary():
+        elif (type.isSequence() or type.isDictionary() or
+              type.isSpiderMonkeyInterface()):
             if type.nullable():
                 memberNullable = memberData
                 memberData = "%s.Value()" % memberData
             if type.isSequence():
                 trace = CGGeneric('DoTraceSequence(trc, %s);' % memberData)
-            else:
-                assert type.isDictionary()
+            elif type.isDictionary():
                 trace = CGGeneric('%s.TraceDictionary(trc);' % memberData)
+            else:
+                assert type.isSpiderMonkeyInterface()
+                trace = CGGeneric('%s.TraceSelf(trc);' % memberData)
             if type.nullable():
                 trace = CGIfWrapper(trace, "!%s.IsNull()" % memberNullable)
         else:
@@ -8988,9 +8997,9 @@ class CGNativeMember(ClassMethod):
             return "JSObject*", "nullptr", "return ${declName};"
         if type.isSpiderMonkeyInterface():
             if type.nullable():
-                returnCode = "return ${declName} ? ${declName}->Obj() : nullptr;"
+                returnCode = "return ${declName}.IsNull() ? nullptr : ${declName}.Value().Obj();"
             else:
-                returnCode = ("return static_cast<%s&>(${declName}).Obj();" % type.name)
+                returnCode = "return ${declName}.Obj();"
             return "JSObject*", "nullptr", returnCode
         if type.isSequence():
             # If we want to handle sequence-of-sequences return values, we're
@@ -9103,18 +9112,10 @@ class CGNativeMember(ClassMethod):
                     False, False)
 
         if type.isSpiderMonkeyInterface():
-            assert not isMember
             if self.jsObjectsArePtr:
-                typeDecl = "JSObject*"
-            else:
-                if type.nullable():
-                    typeDecl = "%s*"
-                else:
-                    typeDecl = "%s"
-                    if not optional:
-                        typeDecl += "&"
-                typeDecl = typeDecl % type.name
-            return typeDecl, False, False
+                return "JSObject*", False, False
+
+            return type.name, True, True
 
         if type.isDOMString():
             if isMember:

dom/bindings/DOMJSProxyHandler.cpp

@@ -211,18 +211,12 @@ bool
 DOMProxyHandler::delete_(JSContext* cx, JS::Handle<JSObject*> proxy,
                          JS::Handle<jsid> id, bool* bp)
 {
-  JSBool b = true;
-
   JS::Rooted<JSObject*> expando(cx);
   if (!xpc::WrapperFactory::IsXrayWrapper(proxy) && (expando = GetExpandoObject(proxy))) {
-    JS::Rooted<Value> v(cx);
-    if (!JS_DeletePropertyById2(cx, expando, id, &v) ||
-        !JS_ValueToBoolean(cx, v, &b)) {
-      return false;
-    }
+    return JS_DeletePropertyById2(cx, expando, id, bp);
   }
 
-  *bp = !!b;
+  *bp = true;
   return true;
 }
 

dom/bindings/TypedArray.h

@@ -9,6 +9,8 @@
 
 #include "jsfriendapi.h"
 #include "js/RootingAPI.h"
+#include "jsapi.h"
+#include "mozilla/dom/BindingDeclarations.h"
 
 namespace mozilla {
 namespace dom {
@@ -21,10 +23,15 @@ namespace dom {
  */
 template<typename T,
          JSObject* UnboxArray(JSObject*, uint32_t*, T**)>
-struct TypedArray_base {
+struct TypedArray_base : AllTypedArraysBase {
   TypedArray_base(JSObject* obj)
   {
-    mObj = UnboxArray(obj, &mLength, &mData);
+    DoInit(obj);
+  }
+
+  TypedArray_base() :
+    mObj(nullptr)
+  {
   }
 
 private:
@@ -33,6 +40,13 @@ private:
   JSObject* mObj;
 
 public:
+  inline bool Init(JSObject* obj)
+  {
+    MOZ_ASSERT(!inited());
+    DoInit(obj);
+    return inited();
+  }
+
   inline bool inited() const {
     return !!mObj;
   }
@@ -51,6 +65,22 @@ public:
     MOZ_ASSERT(inited());
     return mObj;
   }
+
+  inline bool WrapIntoNewCompartment(JSContext* cx)
+  {
+    return JS_WrapObject(cx, &mObj);
+  }
+
+  inline void TraceSelf(JSTracer* trc)
+  {
+    JS_CallObjectTracer(trc, &mObj, "TypedArray.mObj");
+  }
+
+protected:
+  inline void DoInit(JSObject* obj)
+  {
+    mObj = UnboxArray(obj, &mLength, &mData);
+  }
 };
 
 
@@ -63,6 +93,10 @@ struct TypedArray : public TypedArray_base<T,UnboxArray> {
     TypedArray_base<T,UnboxArray>(obj)
   {}
 
+  TypedArray() :
+    TypedArray_base<T,UnboxArray>()
+  {}
+
   static inline JSObject*
   Create(JSContext* cx, nsWrapperCache* creator, uint32_t length,
          const T* data = NULL) {

dom/bindings/parser/WebIDL.py

@@ -3690,21 +3690,33 @@ class Parser(Tokenizer):
 
     def p_EnumValueList(self, p):
         """
-            EnumValueList : STRING EnumValues
+            EnumValueList : STRING EnumValueListComma
         """
         p[0] = [p[1]]
         p[0].extend(p[2])
 
-    def p_EnumValues(self, p):
+    def p_EnumValueListComma(self, p):
         """
-            EnumValues : COMMA STRING EnumValues
+            EnumValueListComma : COMMA EnumValueListString
         """
-        p[0] = [p[2]]
-        p[0].extend(p[3])
+        p[0] = p[2]
 
-    def p_EnumValuesEmpty(self, p):
+    def p_EnumValueListCommaEmpty(self, p):
         """
-            EnumValues :
+            EnumValueListComma :
+        """
+        p[0] = []
+
+    def p_EnumValueListString(self, p):
+        """
+            EnumValueListString : STRING EnumValueListComma
+        """
+        p[0] = [p[1]]
+        p[0].extend(p[2])
+
+    def p_EnumValueListStringEmpty(self, p):
+        """
+            EnumValueListString :
         """
         p[0] = []
 

dom/bindings/parser/tests/test_enum.py

@@ -79,3 +79,15 @@ def WebIDLTest(parser, harness):
         threw = True
 
     harness.ok(threw, "Should not allow a bogus default value for an enum")
+
+    # Now reset our parser
+    parser = parser.reset()
+    parser.parse("""
+      enum Enum {
+        "a",
+        "b",
+        "c",
+      };
+    """)
+    results = parser.finish()
+    harness.check(len(results), 1, "Should allow trailing comma in enum")

dom/bindings/test/TestBindingHeader.h

@@ -384,21 +384,25 @@ public:
   void ReceiveSequenceOfSequences(nsTArray< nsTArray<int32_t> >&);
 
   // Typed array types
-  void PassArrayBuffer(ArrayBuffer&);
-  void PassNullableArrayBuffer(ArrayBuffer*);
+  void PassArrayBuffer(const ArrayBuffer&);
+  void PassNullableArrayBuffer(const Nullable<ArrayBuffer>&);
   void PassOptionalArrayBuffer(const Optional<ArrayBuffer>&);
-  void PassOptionalNullableArrayBuffer(const Optional<ArrayBuffer*>&);
-  void PassOptionalNullableArrayBufferWithDefaultValue(ArrayBuffer*);
-  void PassArrayBufferView(ArrayBufferView&);
-  void PassInt8Array(Int8Array&);
-  void PassInt16Array(Int16Array&);
-  void PassInt32Array(Int32Array&);
-  void PassUint8Array(Uint8Array&);
-  void PassUint16Array(Uint16Array&);
-  void PassUint32Array(Uint32Array&);
-  void PassUint8ClampedArray(Uint8ClampedArray&);
-  void PassFloat32Array(Float32Array&);
-  void PassFloat64Array(Float64Array&);
+  void PassOptionalNullableArrayBuffer(const Optional<Nullable<ArrayBuffer> >&);
+  void PassOptionalNullableArrayBufferWithDefaultValue(const Nullable<ArrayBuffer>&);
+  void PassArrayBufferView(const ArrayBufferView&);
+  void PassInt8Array(const Int8Array&);
+  void PassInt16Array(const Int16Array&);
+  void PassInt32Array(const Int32Array&);
+  void PassUint8Array(const Uint8Array&);
+  void PassUint16Array(const Uint16Array&);
+  void PassUint32Array(const Uint32Array&);
+  void PassUint8ClampedArray(const Uint8ClampedArray&);
+  void PassFloat32Array(const Float32Array&);
+  void PassFloat64Array(const Float64Array&);
+  void PassSequenceOfArrayBuffers(const Sequence<ArrayBuffer>&);
+  void PassSequenceOfNullableArrayBuffers(const Sequence<Nullable<ArrayBuffer> >&);
+  void PassVariadicTypedArray(const Sequence<Float32Array>&);
+  void PassVariadicNullableTypedArray(const Sequence<Nullable<Float32Array> >&);
   JSObject* ReceiveUint8Array(JSContext*);
 
   // DOMString types

dom/bindings/test/TestCodeGen.webidl

@@ -355,6 +355,10 @@ interface TestInterface {
   void passUint8ClampedArray(Uint8ClampedArray arg);
   void passFloat32Array(Float32Array arg);
   void passFloat64Array(Float64Array arg);
+  void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
+  void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
+  void passVariadicTypedArray(Float32Array... arg);
+  void passVariadicNullableTypedArray(Float32Array?... arg);
   Uint8Array receiveUint8Array();
 
   // DOMString types
@@ -704,6 +708,10 @@ dictionary Dict : ParentDict {
   unrestricted double  negativeInfUrDouble = -Infinity;
   unrestricted double  nanUrDouble = NaN;
 
+  ArrayBuffer arrayBuffer;
+  ArrayBuffer? nullableArrayBuffer;
+  Uint8Array uint8Array;
+  Float64Array? float64Array = null;
 };
 
 dictionary ParentDict : GrandparentDict {

dom/bindings/test/TestExampleGen.webidl

@@ -253,6 +253,10 @@ interface TestExampleInterface {
   void passUint8ClampedArray(Uint8ClampedArray arg);
   void passFloat32Array(Float32Array arg);
   void passFloat64Array(Float64Array arg);
+  void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
+  void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
+  void passVariadicTypedArray(Float32Array... arg);
+  void passVariadicNullableTypedArray(Float32Array?... arg);
   Uint8Array receiveUint8Array();
 
   // DOMString types

dom/bindings/test/TestJSImplGen.webidl

@@ -275,6 +275,10 @@ interface TestJSImplInterface {
   //void passUint8ClampedArray(Uint8ClampedArray arg);
   //void passFloat32Array(Float32Array arg);
   //void passFloat64Array(Float64Array arg);
+  //void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
+  //void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
+  //void passVariadicTypedArray(Float32Array... arg);
+  //void passVariadicNullableTypedArray(Float32Array?... arg);
   //Uint8Array receiveUint8Array();
 
   // DOMString types

dom/bluetooth/BluetoothHfpManager.cpp

@@ -1368,6 +1368,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
           // Incoming call, no break
           sStopSendingRingFlag = true;
           ConnectSco();
+        case nsITelephonyProvider::CALL_STATE_DIALING:
         case nsITelephonyProvider::CALL_STATE_ALERTING:
           // Outgoing call
           UpdateCIND(CINDType::CALL, CallState::IN_PROGRESS, aSend);

dom/bluetooth/BluetoothTelephonyListener.cpp

@@ -63,6 +63,13 @@ TelephonyListener::EnumerateCallState(uint32_t aCallIndex,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+TelephonyListener::SupplementaryServiceNotification(int32_t aCallIndex,
+                                                    uint16_t aNotification)
+{
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 TelephonyListener::NotifyError(int32_t aCallIndex,
                                const nsAString& aError)

dom/camera/CameraControlImpl.cpp

@@ -3,6 +3,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/basictypes.h"
+#include "mozilla/Assertions.h"
 #include "DOMCameraPreview.h"
 #include "CameraRecorderProfiles.h"
 #include "CameraControlImpl.h"
@@ -20,6 +21,7 @@ CameraControlImpl::CameraControlImpl(uint32_t aCameraId, nsIThread* aCameraThrea
   , mFileFormat()
   , mMaxMeteringAreas(0)
   , mMaxFocusAreas(0)
+  , mPreviewState(PREVIEW_STOPPED)
   , mDOMPreview(nullptr)
   , mAutoFocusOnSuccessCb(nullptr)
   , mAutoFocusOnErrorCb(nullptr)
@@ -28,6 +30,7 @@ CameraControlImpl::CameraControlImpl(uint32_t aCameraId, nsIThread* aCameraThrea
   , mOnShutterCb(nullptr)
   , mOnClosedCb(nullptr)
   , mOnRecorderStateChangeCb(nullptr)
+  , mOnPreviewStateChangeCb(nullptr)
 {
   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
 }
@@ -104,7 +107,7 @@ CameraControlImpl::Set(JSContext* aCx, uint32_t aKey, const JS::Value& aValue, u
   for (uint32_t i = 0; i < length; ++i) {
     JS::Rooted<JS::Value> v(aCx);
 
-    if (!JS_GetElement(aCx, regions, i, v.address())) {
+    if (!JS_GetElement(aCx, regions, i, &v)) {
       return NS_ERROR_FAILURE;
     }
 
@@ -186,7 +189,7 @@ CameraControlImpl::Get(JSContext* aCx, uint32_t aKey, JS::Value* aValue)
     }
 
     v = OBJECT_TO_JSVAL(o);
-    if (!JS_SetElement(aCx, array, i, v.address())) {
+    if (!JS_SetElement(aCx, array, i, &v)) {
       return NS_ERROR_FAILURE;
     }
   }
@@ -237,6 +240,20 @@ CameraControlImpl::Get(nsICameraRecorderStateChange** aOnRecorderStateChange)
   return NS_OK;
 }
 
+nsresult
+CameraControlImpl::Set(nsICameraPreviewStateChange* aOnPreviewStateChange)
+{
+  mOnPreviewStateChangeCb = new nsMainThreadPtrHolder<nsICameraPreviewStateChange>(aOnPreviewStateChange);
+  return NS_OK;
+}
+
+nsresult
+CameraControlImpl::Get(nsICameraPreviewStateChange** aOnPreviewStateChange)
+{
+  *aOnPreviewStateChange = mOnPreviewStateChangeCb;
+  return NS_OK;
+}
+
 already_AddRefed<RecorderProfileManager>
 CameraControlImpl::GetRecorderProfileManager()
 {
@@ -254,6 +271,7 @@ CameraControlImpl::Shutdown()
   mOnShutterCb = nullptr;
   mOnClosedCb = nullptr;
   mOnRecorderStateChangeCb = nullptr;
+  mOnPreviewStateChangeCb = nullptr;
 }
 
 void
@@ -327,6 +345,39 @@ CameraControlImpl::OnRecorderStateChange(const nsString& aStateMsg, int32_t aSta
   }
 }
 
+void
+CameraControlImpl::OnPreviewStateChange(PreviewState aNewState)
+{
+  if (aNewState == mPreviewState) {
+    DOM_CAMERA_LOGI("OnPreviewStateChange: state did not change from %d\n", mPreviewState);
+    return;
+  }
+
+  nsString msg;
+  switch (aNewState) {
+    case PREVIEW_STOPPED:
+      msg = NS_LITERAL_STRING("stopped");
+      break;
+
+    case PREVIEW_STARTED:
+      msg = NS_LITERAL_STRING("started");
+      break;
+
+    default:
+      MOZ_ASSUME_UNREACHABLE("Preview state can only be PREVIEW_STOPPED or _STARTED!");
+  }
+
+  // const nsString& aStateMsg)
+  DOM_CAMERA_LOGI("OnPreviewStateChange: '%s'\n", NS_ConvertUTF16toUTF8(msg).get());
+  mPreviewState = aNewState;
+
+  nsCOMPtr<nsIRunnable> onPreviewStateChange = new CameraPreviewStateChange(mOnPreviewStateChangeCb, msg, mWindowId);
+  nsresult rv = NS_DispatchToMainThread(onPreviewStateChange);
+  if (NS_FAILED(rv)) {
+    DOM_CAMERA_LOGE("Failed to dispatch onPreviewStateChange event to main thread (%d)\n", rv);
+  }
+}
+
 nsresult
 CameraControlImpl::GetPreviewStream(CameraSize aSize, nsICameraPreviewStreamCallback* onSuccess, nsICameraErrorCallback* onError)
 {

dom/camera/CameraControlImpl.h

@@ -71,6 +71,8 @@ public:
   nsresult Get(nsICameraClosedCallback** aOnClosed);
   nsresult Set(nsICameraRecorderStateChange* aOnRecorderStateChange);
   nsresult Get(nsICameraRecorderStateChange** aOnRecorderStateChange);
+  nsresult Set(nsICameraPreviewStateChange* aOnPreviewStateChange);
+  nsresult Get(nsICameraPreviewStateChange** aOnPreviewStateChange);
 
   nsresult SetFocusAreas(JSContext* aCx, const JS::Value& aValue)
   {
@@ -102,6 +104,12 @@ public:
   void OnClosed();
   void OnRecorderStateChange(const nsString& aStateMsg, int32_t aStatus, int32_t aTrackNumber);
 
+  enum PreviewState {
+    PREVIEW_STOPPED,
+    PREVIEW_STARTED
+  };
+  void OnPreviewStateChange(PreviewState aNewState);
+
   uint64_t GetWindowId()
   {
     return mWindowId;
@@ -132,6 +140,7 @@ protected:
   nsString            mFileFormat;
   uint32_t            mMaxMeteringAreas;
   uint32_t            mMaxFocusAreas;
+  PreviewState        mPreviewState;
 
   /**
    * 'mDOMPreview' is a raw pointer to the object that will receive incoming
@@ -150,6 +159,7 @@ protected:
   nsMainThreadPtrHandle<nsICameraShutterCallback>     mOnShutterCb;
   nsMainThreadPtrHandle<nsICameraClosedCallback>      mOnClosedCb;
   nsMainThreadPtrHandle<nsICameraRecorderStateChange> mOnRecorderStateChangeCb;
+  nsMainThreadPtrHandle<nsICameraPreviewStateChange>  mOnPreviewStateChangeCb;
 
 private:
   CameraControlImpl(const CameraControlImpl&) MOZ_DELETE;
@@ -696,6 +706,32 @@ protected:
   uint64_t mWindowId;
 };
 
+// Report that the preview stream state has changed.
+class CameraPreviewStateChange : public nsRunnable
+{
+public:
+  CameraPreviewStateChange(nsMainThreadPtrHandle<nsICameraPreviewStateChange> onStateChange, const nsString& aStateMsg, uint64_t aWindowId)
+    : mOnStateChangeCb(onStateChange)
+    , mStateMsg(aStateMsg)
+    , mWindowId(aWindowId)
+  { }
+
+  NS_IMETHOD Run()
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    if (mOnStateChangeCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+      mOnStateChangeCb->HandleStateChange(mStateMsg);
+    }
+    return NS_OK;
+  }
+
+protected:
+  nsMainThreadPtrHandle<nsICameraPreviewStateChange> mOnStateChangeCb;
+  const nsString mStateMsg;
+  uint64_t mWindowId;
+};
+
 } // namespace mozilla
 
 #endif // DOM_CAMERA_CAMERACONTROLIMPL_H

dom/camera/DOMCameraCapabilities.cpp

@@ -46,7 +46,7 @@ ParseZoomRatioItemAndAdd(JSContext* aCx, JS::Handle<JSObject*> aArray,
 
   JS::Rooted<JS::Value> v(aCx, JS_NumberValue(d));
 
-  if (!JS_SetElement(aCx, aArray, aIndex, v.address())) {
+  if (!JS_SetElement(aCx, aArray, aIndex, &v)) {
     return NS_ERROR_FAILURE;
   }
 
@@ -69,7 +69,7 @@ ParseStringItemAndAdd(JSContext* aCx, JS::Handle<JSObject*> aArray,
   }
 
   JS::Rooted<JS::Value> v(aCx, STRING_TO_JSVAL(s));
-  if (!JS_SetElement(aCx, aArray, aIndex, v.address())) {
+  if (!JS_SetElement(aCx, aArray, aIndex, &v)) {
     return NS_ERROR_FAILURE;
   }
 
@@ -103,7 +103,7 @@ ParseDimensionItemAndAdd(JSContext* aCx, JS::Handle<JSObject*> aArray,
   }
 
   JS::Rooted<JS::Value> v(aCx, OBJECT_TO_JSVAL(o));
-  if (!JS_SetElement(aCx, aArray, aIndex, v.address())) {
+  if (!JS_SetElement(aCx, aArray, aIndex, &v)) {
     return NS_ERROR_FAILURE;
   }
 
@@ -380,7 +380,7 @@ DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::Value* aVideoSizes)
     }
 
     v = OBJECT_TO_JSVAL(o);
-    if (!JS_SetElement(cx, array, i, v.address())) {
+    if (!JS_SetElement(cx, array, i, &v)) {
       return NS_ERROR_FAILURE;
     }
   }

dom/camera/DOMCameraControl.cpp

@@ -239,6 +239,18 @@ nsDOMCameraControl::SetOnRecorderStateChange(nsICameraRecorderStateChange* aOnRe
   return mCameraControl->Set(aOnRecorderStateChange);
 }
 
+/* attribute nsICameraPreviewStateChange onPreviewStateChange; */
+NS_IMETHODIMP
+nsDOMCameraControl::GetOnPreviewStateChange(nsICameraPreviewStateChange** aOnPreviewStateChange)
+{
+  return mCameraControl->Get(aOnPreviewStateChange);
+}
+NS_IMETHODIMP
+nsDOMCameraControl::SetOnPreviewStateChange(nsICameraPreviewStateChange* aOnPreviewStateChange)
+{
+  return mCameraControl->Set(aOnPreviewStateChange);
+}
+
 /* [implicit_jscontext] void startRecording (in jsval aOptions, in nsIDOMDeviceStorage storageArea, in DOMString filename, in nsICameraStartRecordingCallback onSuccess, [optional] in nsICameraErrorCallback onError); */
 NS_IMETHODIMP
 nsDOMCameraControl::StartRecording(const JS::Value& aOptions, nsIDOMDeviceStorage* storageArea, const nsAString& filename, nsICameraStartRecordingCallback* onSuccess, nsICameraErrorCallback* onError, JSContext* cx)

dom/camera/GonkCameraControl.cpp

@@ -676,6 +676,8 @@ nsGonkCameraControl::StartPreviewImpl(StartPreviewTask* aStartPreview)
   if (aStartPreview->mDOMPreview) {
     mDOMPreview->Started();
   }
+
+  OnPreviewStateChange(PREVIEW_STARTED);
   return NS_OK;
 }
 
@@ -694,6 +696,7 @@ nsGonkCameraControl::StopPreviewInternal(bool aForced)
     mDOMPreview = nullptr;
   }
 
+  OnPreviewStateChange(PREVIEW_STOPPED);
   return NS_OK;
 }
 
@@ -863,6 +866,10 @@ nsGonkCameraControl::TakePictureImpl(TakePictureTask* aTakePicture)
   if (mCameraHw->TakePicture() != OK) {
     return NS_ERROR_FAILURE;
   }
+  
+  // In Gonk, taking a picture implicitly kills the preview stream,
+  // so we need to reflect that here.
+  OnPreviewStateChange(PREVIEW_STOPPED);
   return NS_OK;
 }
 

dom/camera/ICameraControl.h

@@ -44,6 +44,8 @@ public:
   virtual nsresult Get(nsICameraClosedCallback** aOnClosed) = 0;
   virtual nsresult Set(nsICameraRecorderStateChange* aOnRecorderStateChange) = 0;
   virtual nsresult Get(nsICameraRecorderStateChange** aOnRecorderStateChange) = 0;
+  virtual nsresult Set(nsICameraPreviewStateChange* aOnPreviewStateChange) = 0;
+  virtual nsresult Get(nsICameraPreviewStateChange** aOnPreviewStateChange) = 0;
   virtual nsresult SetFocusAreas(JSContext* aCx, const JS::Value& aValue) = 0;
   virtual nsresult SetMeteringAreas(JSContext* aCx, const JS::Value& aValue) = 0;
   virtual nsresult GetVideoSizes(nsTArray<idl::CameraSize>& aVideoSizes) = 0;

dom/camera/nsIDOMCameraManager.idl

@@ -199,6 +199,12 @@ interface nsICameraRecorderStateChange : nsISupports
     void handleStateChange(in DOMString newState);
 };
 
+[scriptable, function, uuid(d1634592-43fd-4117-a2b2-419aec841cc4)]
+interface nsICameraPreviewStateChange : nsISupports
+{
+    void handleStateChange(in DOMString newState);
+};
+
 [scriptable, function, uuid(f84d607b-554c-413d-8810-cf848642765a)]
 interface nsICameraReleaseCallback : nsISupports
 {
@@ -215,7 +221,7 @@ interface nsICameraErrorCallback : nsISupports
     attributes here affect the preview, any pictures taken, and/or
     any video recorded by the camera.
 */
-[scriptable, uuid(c8e7418d-8913-4b66-bd9f-562fba627266)]
+[scriptable, uuid(74dc7f1f-c88f-4774-860b-44aef9de5dc8)]
 interface nsICameraControl : nsISupports
 {
     readonly attribute nsICameraCapabilities capabilities;
@@ -316,6 +322,12 @@ interface nsICameraControl : nsISupports
        recording limits (see CameraStartRecordingOptions) was reached. */
     attribute nsICameraRecorderStateChange onRecorderStateChange;
 
+    /* the function to call when the preview stream is actually started and
+       stopped; this is usually used to enable and disable the camera UI,
+       since the low-level hardware often does not support taking pictures
+       unless the preview is running. */
+    attribute nsICameraPreviewStateChange onPreviewStateChange;
+
     /* tell the camera to attempt to focus the image */
     void autoFocus(in nsICameraAutoFocusCallback onSuccess, [optional] in nsICameraErrorCallback onError);
 

dom/file/ArchiveRequest.cpp

@@ -196,7 +196,7 @@ ArchiveRequest::GetFilenamesResult(JSContext* aCx,
 
     JS::Rooted<JS::Value> item(aCx, STRING_TO_JSVAL(str));
 
-    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, item.address())) {
+    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, &item)) {
       return NS_ERROR_FAILURE;
     }
   }
@@ -249,7 +249,7 @@ ArchiveRequest::GetFilesResult(JSContext* aCx,
     nsresult rv = nsContentUtils::WrapNative(aCx, global, file,
                                              &NS_GET_IID(nsIDOMFile),
                                              value.address());
-    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, value.address())) {
+    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, &value)) {
       return NS_ERROR_FAILURE;
     }
   }

dom/indexedDB/AsyncConnectionHelper.cpp

@@ -78,7 +78,7 @@ ConvertCloneReadInfosToArrayInternal(
         return NS_ERROR_DOM_DATA_CLONE_ERR;
       }
 
-      if (!JS_SetElement(aCx, array, index, val.address())) {
+      if (!JS_SetElement(aCx, array, index, &val)) {
         NS_WARNING("Failed to set array element!");
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }

dom/indexedDB/IDBIndex.cpp

@@ -1462,7 +1462,7 @@ GetAllKeysHelper::GetSuccessResult(JSContext* aCx,
         return rv;
       }
 
-      if (!JS_SetElement(aCx, array, index, value.address())) {
+      if (!JS_SetElement(aCx, array, index, &value)) {
         NS_WARNING("Failed to set array element!");
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }

dom/indexedDB/IDBObjectStore.cpp

@@ -953,7 +953,7 @@ IDBObjectStore::AppendIndexUpdateInfo(
 
     for (uint32_t arrayIndex = 0; arrayIndex < arrayLength; arrayIndex++) {
       JS::Rooted<JS::Value> arrayItem(aCx);
-      if (!JS_GetElement(aCx, array, arrayIndex, arrayItem.address())) {
+      if (!JS_GetElement(aCx, array, arrayIndex, &arrayItem)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
 

dom/indexedDB/Key.cpp

@@ -152,7 +152,7 @@ Key::EncodeJSValInternal(JSContext* aCx, const jsval aVal,
 
       for (uint32_t index = 0; index < length; index++) {
         JS::Rooted<JS::Value> val(aCx);
-        if (!JS_GetElement(aCx, obj, index, val.address())) {
+        if (!JS_GetElement(aCx, obj, index, &val)) {
           return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
         }
 
@@ -205,15 +205,15 @@ Key::DecodeJSValInternal(const unsigned char*& aPos, const unsigned char* aEnd,
     }
 
     uint32_t index = 0;
+    JS::Rooted<JS::Value> val(aCx);
     while (aPos < aEnd && *aPos - aTypeOffset != eTerminator) {
-      JS::Rooted<JS::Value> val(aCx);
       nsresult rv = DecodeJSValInternal(aPos, aEnd, aCx, aTypeOffset,
                                         &val, aRecursionDepth + 1);
       NS_ENSURE_SUCCESS(rv, rv);
 
       aTypeOffset = 0;
 
-      if (!JS_SetElement(aCx, array, index++, val.address())) {
+      if (!JS_SetElement(aCx, array, index++, &val)) {
         NS_WARNING("Failed to set array element!");
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }

dom/indexedDB/KeyPath.cpp

@@ -204,16 +204,14 @@ GetJSValFromKeyPathString(JSContext* aCx,
   if (targetObject) {
     // If this fails, we lose, and the web page sees a magical property
     // appear on the object :-(
-    JS::Rooted<JS::Value> succeeded(aCx);
+    bool succeeded;
     if (!JS_DeleteUCProperty2(aCx, targetObject,
                               targetObjectPropName.get(),
                               targetObjectPropName.Length(),
                               &succeeded)) {
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
-    NS_ASSERTION(JSVAL_IS_BOOLEAN(succeeded), "Wtf?");
-    NS_ENSURE_TRUE(JSVAL_TO_BOOLEAN(succeeded),
-                   NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
+    NS_ENSURE_TRUE(succeeded, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
   }
 
   NS_ENSURE_SUCCESS(rv, rv);
@@ -284,7 +282,7 @@ KeyPath::Parse(JSContext* aCx, const JS::Value& aValue, KeyPath* aKeyPath)
       JS::Rooted<JS::Value> val(aCx);
       JSString* jsstr;
       nsDependentJSString str;
-      if (!JS_GetElement(aCx, obj, index, val.address()) ||
+      if (!JS_GetElement(aCx, obj, index, &val) ||
           !(jsstr = JS_ValueToString(aCx, val)) ||
           !str.init(aCx, jsstr)) {
         return NS_ERROR_FAILURE;
@@ -399,7 +397,7 @@ KeyPath::ExtractKeyAsJSVal(JSContext* aCx, const JS::Value& aValue,
       return rv;
     }
 
-    if (!JS_SetElement(aCx, arrayObj, i, value.address())) {
+    if (!JS_SetElement(aCx, arrayObj, i, &value)) {
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
   }
@@ -508,7 +506,7 @@ KeyPath::ToJSVal(JSContext* aCx, JS::MutableHandle<JS::Value> aValue) const
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
 
-      if (!JS_SetElement(aCx, array, i, val.address())) {
+      if (!JS_SetElement(aCx, array, i, &val)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
     }

dom/interfaces/events/nsIDOMTouchEvent.idl

@@ -30,36 +30,6 @@ interface nsIDOMTouch : nsISupports {
   readonly attribute float             force;
 };
 
-[scriptable, builtinclass, uuid(60706eb7-d50d-4379-b01c-e78e6af84213)]
-interface nsIDOMTouchList : nsISupports {
-  readonly attribute unsigned long length;
-  nsIDOMTouch item(in unsigned long index);
-  nsIDOMTouch identifiedTouch(in long identifier);
-};
-
-[scriptable, builtinclass, uuid(9a043d55-f59e-4790-8fc7-1fab1c727732)]
-interface nsIDOMTouchEvent : nsIDOMUIEvent {
-  readonly attribute nsIDOMTouchList touches;
-  readonly attribute nsIDOMTouchList targetTouches;
-  readonly attribute nsIDOMTouchList changedTouches;
-  readonly attribute boolean         altKey;
-  readonly attribute boolean         metaKey;
-  readonly attribute boolean         ctrlKey;
-  readonly attribute boolean         shiftKey;
-  void initTouchEvent(in DOMString type,
-                      in boolean canBubble,
-                      in boolean cancelable,
-                      in nsIDOMWindow view,
-                      in long detail,
-                      in boolean ctrlKey,
-                      in boolean altKey,
-                      in boolean shiftKey,
-                      in boolean metaKey,
-                      in nsIDOMTouchList touches,
-                      in nsIDOMTouchList targetTouches,
-                      in nsIDOMTouchList changedTouches);
-};
-
 [scriptable, uuid(6d5484f7-92ac-45f8-9388-39b5bad055ce)]
 interface nsITouchEventReceiver : nsISupports {
   [implicit_jscontext] attribute jsval           ontouchstart;

dom/interfaces/svg/nsIDOMSVGElement.idl

@@ -9,7 +9,7 @@ interface nsIDOMCSSStyleDeclaration;
 interface nsIDOMCSSValue;
 
 
-[scriptable, uuid(12488d4f-1ee5-40bf-9c5d-3a285d4170ab)]
+[scriptable, uuid(abdf347a-0063-42cc-b6fc-c9a19a65248e)]
 interface nsIDOMSVGElement : nsIDOMElement
 {
   attribute DOMString id;

dom/ipc/ContentParent.cpp

@@ -855,7 +855,10 @@ ContentParent::ShutDownProcess(bool aCloseWithError)
   // CC'ed objects, so we need to null them out here, while we still can.  See
   // bug 899761.
   mMemoryReporters.Clear();
-  mMessageManager = nullptr;
+  if (mMessageManager) {
+    mMessageManager->Disconnect();
+    mMessageManager = nullptr;
+  }
 }
 
 void
@@ -994,7 +997,9 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
 #endif
     }
 
-    mMessageManager->Disconnect();
+    if (ppm) {
+      ppm->Disconnect();
+    }
 
     // clear the child memory reporters
     InfallibleTArray<MemoryReport> empty;

dom/media/bridge/IPeerConnection.idl

@@ -24,7 +24,7 @@ interface IPeerConnectionManager : nsISupports
  *
  * See media/webrtc/signaling/include/PeerConnectionImpl.h
  */
-[scriptable, uuid(85ba28da-53d0-401d-afed-9cad69f727ff)]
+[scriptable, uuid(cf9152f0-c9a8-4093-9435-1daa056e0177)]
 interface IPeerConnectionObserver : nsISupports
 {
   /* Constants */
@@ -68,7 +68,7 @@ interface IPeerConnectionObserver : nsISupports
   void foundIceCandidate(in string candidate);
 };
 
-[scriptable, uuid(80b98a4f-c629-4e81-b738-a4608f6a4cd3)]
+[scriptable, uuid(930dce8b-7c5e-4393-b8c0-cb3a928f68bd)]
 interface IPeerConnection : nsISupports
 {
   const unsigned long kHintAudio = 0x00000001;

dom/mobilemessage/src/MmsMessage.cpp

@@ -173,7 +173,7 @@ MmsMessage::Create(int32_t               aId,
   nsTArray<DeliveryStatus> deliveryStatus;
   JS::Rooted<JS::Value> statusJsVal(aCx);
   for (uint32_t i = 0; i < length; ++i) {
-    if (!JS_GetElement(aCx, deliveryStatusObj, i, statusJsVal.address()) ||
+    if (!JS_GetElement(aCx, deliveryStatusObj, i, &statusJsVal) ||
         !statusJsVal.isString()) {
       return NS_ERROR_INVALID_ARG;
     }
@@ -215,7 +215,7 @@ MmsMessage::Create(int32_t               aId,
   nsTArray<nsString> receivers;
   JS::Rooted<JS::Value> receiverJsVal(aCx);
   for (uint32_t i = 0; i < length; ++i) {
-    if (!JS_GetElement(aCx, receiversObj, i, receiverJsVal.address()) ||
+    if (!JS_GetElement(aCx, receiversObj, i, &receiverJsVal) ||
         !receiverJsVal.isString()) {
       return NS_ERROR_INVALID_ARG;
     }
@@ -244,7 +244,7 @@ MmsMessage::Create(int32_t               aId,
 
   JS::Rooted<JS::Value> attachmentJsVal(aCx);
   for (uint32_t i = 0; i < length; ++i) {
-    if (!JS_GetElement(aCx, attachmentsObj, i, attachmentJsVal.address())) {
+    if (!JS_GetElement(aCx, attachmentsObj, i, &attachmentJsVal)) {
       return NS_ERROR_INVALID_ARG;
     }
 
@@ -526,7 +526,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
     }
 
     tmpJsVal = OBJECT_TO_JSVAL(attachmentObj);
-    if (!JS_SetElement(aCx, attachments, i, tmpJsVal.address())) {
+    if (!JS_SetElement(aCx, attachments, i, &tmpJsVal)) {
       return NS_ERROR_FAILURE;
     }
   }

dom/mobilemessage/src/MobileMessageCallback.cpp

@@ -143,11 +143,10 @@ MobileMessageCallback::NotifyMessageDeleted(bool *aDeleted, uint32_t aSize)
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
   JS::Rooted<JSObject*> deleteArrayObj(cx, JS_NewArrayObject(cx, aSize, NULL));
-  JS::Rooted<JS::Value> jsValTrue(cx, JS::BooleanValue(true));
-  JS::Rooted<JS::Value> jsValFalse(cx, JS::BooleanValue(false));
+  JS::Rooted<JS::Value> value(cx);
   for (uint32_t i = 0; i < aSize; i++) {
-    JS_SetElement(cx, deleteArrayObj, i,
-                  aDeleted[i] ? jsValTrue.address() : jsValFalse.address());
+    value.setBoolean(aDeleted[i]);
+    JS_SetElement(cx, deleteArrayObj, i, &value);
   }
 
   JS::Rooted<JS::Value> deleteArrayVal(cx, JS::ObjectValue(*deleteArrayObj));

dom/mobilemessage/src/MobileMessageManager.cpp

@@ -175,7 +175,7 @@ MobileMessageManager::Send(const JS::Value& aNumber_, const nsAString& aMessage,
 
   JS::Rooted<JS::Value> number(cx);
   for (uint32_t i=0; i<size; ++i) {
-    if (!JS_GetElement(cx, numbers, i, number.address())) {
+    if (!JS_GetElement(cx, numbers, i, &number)) {
       return NS_ERROR_INVALID_ARG;
     }
 
@@ -278,7 +278,7 @@ MobileMessageManager::Delete(const JS::Value& aParam, nsIDOMDOMRequest** aReques
 
     JS::Rooted<JS::Value> idJsValue(cx);
     for (uint32_t i = 0; i < size; i++) {
-      if (!JS_GetElement(cx, ids, i, idJsValue.address())) {
+      if (!JS_GetElement(cx, ids, i, &idJsValue)) {
         return NS_ERROR_INVALID_ARG;
       }