Mergre mozilla-central to tracemonkey.

2009-01-01 14:25:18 -08:00 · 2009-01-01 14:25:18 -08:00 · a168b4b0d0
--- a/browser/app/application.ini
+++ b/browser/app/application.ini
@ -47,7 +47,7 @@ SourceRepository=@MOZ_SOURCE_REPO@
 #ifdef MOZ_SOURCE_STAMP
 SourceStamp=@MOZ_SOURCE_STAMP@
 #endif
-Copyright=Copyright (c) 1998 - 2008 mozilla.org
+Copyright=Copyright (c) 1998 - 2009 mozilla.org
 ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}

 [Gecko]
--- a/browser/app/macbuild/Contents/Info.plist.in
+++ b/browser/app/macbuild/Contents/Info.plist.in
@ -74,7 +74,7 @@
 	<key>CFBundleExecutable</key>
 	<string>firefox-bin</string>
 	<key>CFBundleGetInfoString</key>
-	<string>%APP_NAME% %APP_VERSION%, © 1998-2008 Contributors</string>
+	<string>%APP_NAME% %APP_VERSION%, © 1998-2009 Contributors</string>
 	<key>CFBundleIconFile</key>
 	<string>firefox</string>
 	<key>CFBundleIdentifier</key>
--- a/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
+++ b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
@ -1,2 +1,2 @@
 CFBundleName = "%APP_NAME%";
-NSHumanReadableCopyright = "Copyright © 1998-2008 Contributors";
+NSHumanReadableCopyright = "Copyright © 1998-2009 Contributors";
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -6873,7 +6873,14 @@ let gPrivateBrowsingUI = {
    var brandBundle = bundleService.createBundle("chrome://branding/locale/brand.properties");

    var appName = brandBundle.GetStringFromName("brandShortName");
+# On Mac, use the header as the title.
+#ifdef XP_MACOSX
+    var dialogTitle = pbBundle.GetStringFromName("privateBrowsingMessageHeader");
+    var header = "";
+#else
    var dialogTitle = pbBundle.GetStringFromName("privateBrowsingDialogTitle");
+    var header = pbBundle.GetStringFromName("privateBrowsingMessageHeader") + "\n\n";
+#endif
    var message = pbBundle.formatStringFromName("privateBrowsingMessage", [appName], 1);

    var promptService = Cc["@mozilla.org/embedcomp/prompt-service;1"].
@ -6889,7 +6896,7 @@ let gPrivateBrowsingUI = {
    var neverAskText = pbBundle.GetStringFromName("privateBrowsingNeverAsk");

    var result;
-    var choice = promptService.confirmEx(null, dialogTitle, message,
+    var choice = promptService.confirmEx(null, dialogTitle, header + message,
                               flags, button0Title, button1Title, null,
                               neverAskText, neverAsk);

--- a/browser/base/content/credits.xhtml
+++ b/browser/base/content/credits.xhtml
@ -529,7 +529,7 @@
        <p id="gecko" class="center">&credit.poweredByGeckoReg;</p>

        <p class="footnote">
-          &brandFullName;&trade; &license.part0; &copy;1998-2008 &license.part1;
+          &brandFullName;&trade; &license.part0; &copy;1998-2009 &license.part1;
          <a href="" link="about:credits" onclick="visitLink(event);">&license.contrib;</a>,
          &license.part2;
          <a href="" link="about:license" onclick="visitLink(event);">about:license</a>
--- a/browser/locales/en-US/chrome/browser/aboutDialog.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutDialog.dtd
@ -7,6 +7,6 @@
 <!ENTITY aboutVersion               "version">
 <!ENTITY closeCmdGNOME.label        "Close">  
 <!ENTITY closeCmdGNOME.accesskey    "C">
-<!ENTITY copyrightInfo              "&#169;1998-2008 Contributors. All Rights Reserved. Firefox and the 
+<!ENTITY copyrightInfo              "&#169;1998-2009 Contributors. All Rights Reserved. Firefox and the 
                                     Firefox logos are trademarks of the Mozilla Foundation.  All rights 
                                     reserved.">
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@ -169,6 +169,7 @@ safebrowsing.notAnAttackButton.accessKey=A
 # LOCALIZATION NOTE (privateBrowsingYesTitle, privateBrowsingNoTitle, privateBrowsingNeverAsk):
 # Access keys are specified by prefixing the desired letter with an ampersand.
 privateBrowsingDialogTitle=Start Private Browsing
+privateBrowsingMessageHeader=Would you like to start Private Browsing?
 privateBrowsingMessage=%S will save your current tabs for when you are done with your Private Browsing session.
 privateBrowsingYesTitle=&Start Private Browsing
 privateBrowsingNoTitle=&Cancel
--- a/caps/README.html
+++ b/caps/README.html
@ -1,49 +0,0 @@
-<html>
-<!-- ***** BEGIN LICENSE BLOCK *****
-   - Version: MPL 1.1/GPL 2.0/LGPL 2.1
-   -
-   - The contents of this file are subject to the Mozilla Public License Version
-   - 1.1 (the "License"); you may not use this file except in compliance with
-   - the License. You may obtain a copy of the License at
-   - http://www.mozilla.org/MPL/
-   -
-   - Software distributed under the License is distributed on an "AS IS" basis,
-   - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-   - for the specific language governing rights and limitations under the
-   - License.
-   -
-   - The Original Code is mozilla.org code.
-   -
-   - The Initial Developer of the Original Code is
-   - Netscape Communications Corporation.
-   - Portions created by the Initial Developer are Copyright (C) 1998-1999
-   - the Initial Developer. All Rights Reserved.
-   -
-   - Contributor(s):
-   -   Daniel Howard
-   -
-   - Alternatively, the contents of this file may be used under the terms of
-   - either of the GNU General Public License Version 2 or later (the "GPL"),
-   - or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-   - in which case the provisions of the GPL or the LGPL are applicable instead
-   - of those above. If you wish to allow use of your version of this file only
-   - under the terms of either the GPL or the LGPL, and not to allow others to
-   - use your version of this file under the terms of the MPL, indicate your
-   - decision by deleting the provisions above and replace them with the notice
-   - and other provisions required by the GPL or the LGPL. If you do not delete
-   - the provisions above, a recipient may use your version of this file under
-   - the terms of any one of the MPL, the GPL or the LGPL.
-   -
-   - ***** END LICENSE BLOCK ***** -->
-<body>
-<h1>
-<span CLASS=LXRSHORTDESC>
-capability-based web page security management<p>
-</span>
-</h1>
-<span CLASS=LXRLONGDESC>
-caps contains C++ interfaces and code for determining the capabilities
-of content based on the security settings or certificates (e.g. Verisign).
-</span>
-</body>
-</html>
--- a/content/html/document/crashtests/468562-1.html
+++ b/content/html/document/crashtests/468562-1.html
@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link>
+</body>
+</html>
--- a/content/html/document/crashtests/468562-2.html
+++ b/content/html/document/crashtests/468562-2.html
@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link></table>
+</body>
+</html>
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@ -3,3 +3,5 @@ load 388183-1.html
 load 395340-1.html
 load 407053.html
 load 448564.html
+load 468562-1.html
+load 468562-2.html
--- a/content/svg/content/src/crashtests/466576-1.xhtml
+++ b/content/svg/content/src/crashtests/466576-1.xhtml
@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  try {
+    document.getElementById("y").gradientTransform.baseVal.appendItem(function(){});
+  } catch(e) { }
+
+  document.documentElement.innerHTML;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<linearGradient id="y" xmlns="http://www.w3.org/2000/svg" />
+
+</body>
+</html>
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@ -39,3 +39,4 @@ load 414188-1.svg
 load 427325-1.svg
 load 428228-1.svg
 load 428841-1.svg
+load 466576-1.xhtml
--- a/content/xul/content/crashtests/384740-1.xul
+++ b/content/xul/content/crashtests/384740-1.xul
@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom()">
+
+<script>
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var scrollbar = document.createElementNS(XUL_NS, 'scrollbar');
+  document.documentElement.appendChild(scrollbar);
+  var sbb = document.getAnonymousNodes(scrollbar)[0];
+  var action = document.createElementNS(XUL_NS, 'action');
+  action.setAttribute('datasources', "");
+  sbb.appendChild(action);
+}
+
+</script>
+
+</window>
--- a/content/xul/content/crashtests/crashtests.list
+++ b/content/xul/content/crashtests/crashtests.list
@ -6,6 +6,7 @@ load 336096-1.xhtml
 load 354611-1.html
 load 360078-1.xhtml
 load 363791-1.xul
+load 384740-1.xul
 load 386947-1.xul
 load 425821-1.xul
 load 429085-1.xhtml
--- a/gfx/thebes/crashtests/463307-1.html
+++ b/gfx/thebes/crashtests/463307-1.html
@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="position: relative; bottom: 4449920388in; margin: 200px;">
+<head></head>
+<body style="background: url(../../../layout/reftests/bugs/repeatable-diagonal-gradient.png);"></body>
+</html>
--- a/gfx/thebes/crashtests/467873-1.html
+++ b/gfx/thebes/crashtests/467873-1.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('q').appendChild(document.createTextNode('C'));">
+<div style="white-space: pre; direction: rtl;">A<div id="q" style="text-transform: capitalize;">B
+<div></div></div></div>
+</body></html>
--- a/gfx/thebes/crashtests/470418-1.html
+++ b/gfx/thebes/crashtests/470418-1.html
@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body><div style="text-transform: capitalize">&#x06CD;A</div></body>
+</html>
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@ -39,5 +39,7 @@ load 421393-1.html
 load 421813-1.html
 load 423270-1.html
 load 429899-1.html
+load 463307-1.html
+load 467873-1.html
+load 470418-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="gtk2") load 441360.html # filed bug 455463 for gtk2
-
--- a/gfx/thebes/public/gfxTextRunWordCache.h
+++ b/gfx/thebes/public/gfxTextRunWordCache.h
@ -20,6 +20,8 @@
 *
 * Contributor(s):
 *   Vladimir Vukicevic <vladimir@pobox.com>
+ *   Ehsan Akhgari <ehsan.akhgari@gmail.com>
+ *   Jonathan Kew <jfkthame@gmail.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
@ -48,12 +50,18 @@ class THEBES_API gfxTextRunWordCache {
 public:
    enum {
      TEXT_IN_CACHE = 0x10000000,
+
+      /**
+       * nsTextFrameThebes sets these, but they're defined here rather than in
+       * nsTextFrameUtils.h because the cache also needs to check the _INCOMING flag
+       */
+      TEXT_TRAILING_ARABICCHAR = 0x20000000,
      /**
       * When set, the previous character for this textrun was an Arabic
       * character.  This is used for the context detection necessary for
       * bidi.numeral implementation.
       */
-      TEXT_INCOMING_ARABICCHAR = 0x10000000
+      TEXT_INCOMING_ARABICCHAR = 0x40000000
    };

    /**
--- a/js/src/xpconnect/crashtests/468552-1.html
+++ b/js/src/xpconnect/crashtests/468552-1.html
@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var dp = document.__proto__;
+  dp.__proto__ = new XPCNativeWrapper(new XMLSerializer);
+  try {
+    dp.isSupported();
+  } catch(e) { }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@ -11,3 +11,4 @@ load 418139-1.svg
 load 420513-1.html
 load 453935-1.html
 load 462926.html
+load 468552-1.html
--- a/layout/base/crashtests/384392-1.xhtml
+++ b/layout/base/crashtests/384392-1.xhtml
@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var table = document.getElementById("table");
+  document.removeChild(document.documentElement);
+  document.appendChild(table);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+
+
+<table border="1" id="table">
+ <tr>
+  <td><input type="text" value="Textbox" /></td>
+ </tr>
+</table>
+
+
+</body>
+</html>
--- a/layout/base/crashtests/384392-2.svg
+++ b/layout/base/crashtests/384392-2.svg
@ -0,0 +1,3 @@
+<circle xmlns="http://www.w3.org/2000/svg">
+  <foreignObject/>
+</circle>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -72,6 +72,8 @@ load 380096-1.html
 load 382204-1.html
 load 383102-1.xhtml
 load 383806-1.xhtml
+load 384392-1.xhtml
+load 384392-2.svg
 load 384649-1.xhtml
 load 385866-1.xhtml
 load 385880-1.xhtml
--- a/layout/generic/crashtests/413079-1.xhtml
+++ b/layout/generic/crashtests/413079-1.xhtml
@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload='document.getElementById("x").style.letterSpacing = "20px";'>
+
+<div style="-moz-column-count: 15;" id="x"><span>AAA
+<div style="float: left;">BBBB<div>CCCC</div></div></span></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/413079-2.xhtml
+++ b/layout/generic/crashtests/413079-2.xhtml
@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 12; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
--- a/layout/generic/crashtests/413079-3.xhtml
+++ b/layout/generic/crashtests/413079-3.xhtml
@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 2; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
--- a/layout/generic/crashtests/436969-1.html
+++ b/layout/generic/crashtests/436969-1.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.documentElement.style.zIndex = 2;">
+
+<div style="direction: rtl; text-transform: uppercase; width: 1px;"><div style="position: absolute; -moz-column-count: 2;"><span style="padding: 6em 0pt; position: absolute; height: 1.2em;">A !BB CCC D,</span></div></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -137,6 +137,9 @@ load 411851-1.html
 load 412201-1.xhtml
 load 412543-1.html
 load 413048-1.html
+load 413079-1.xhtml
+load 413079-2.xhtml
+load 413079-3.xhtml
 load 413582-1.xhtml
 load 413582-2.html
 load 414061-1.html
@ -156,6 +159,7 @@ load 429981-1.html
 load 430352-1.html
 load 435529.html
 load 436823.html
+load 436969-1.html
 load 437156-1.html
 load 438259-1.html
 load 438509-1.html
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@ -1136,7 +1136,7 @@ void BuildTextRunsScanner::FlushFrames(PRBool aFlushLineBreaks, PRBool aSuppress
  if (!mSkipIncompleteTextRuns && mCurrentFramesAllSameTextRun &&
      ((mCurrentFramesAllSameTextRun->GetFlags() & nsTextFrameUtils::TEXT_INCOMING_WHITESPACE) != 0) ==
      ((mCurrentRunContextInfo & nsTextFrameUtils::INCOMING_WHITESPACE) != 0) &&
-      ((mCurrentFramesAllSameTextRun->GetFlags() & nsTextFrameUtils::TEXT_INCOMING_ARABICCHAR) != 0) ==
+      ((mCurrentFramesAllSameTextRun->GetFlags() & gfxTextRunWordCache::TEXT_INCOMING_ARABICCHAR) != 0) ==
      ((mCurrentRunContextInfo & nsTextFrameUtils::INCOMING_ARABICCHAR) != 0) &&
      IsTextRunValidForMappedFlows(mCurrentFramesAllSameTextRun)) {
    // Optimization: We do not need to (re)build the textrun.
@ -1149,7 +1149,7 @@ void BuildTextRunsScanner::FlushFrames(PRBool aFlushLineBreaks, PRBool aSuppress
    if (textRun->GetFlags() & nsTextFrameUtils::TEXT_TRAILING_WHITESPACE) {
      mNextRunContextInfo |= nsTextFrameUtils::INCOMING_WHITESPACE;
    }
-    if (textRun->GetFlags() & nsTextFrameUtils::TEXT_TRAILING_ARABICCHAR) {
+    if (textRun->GetFlags() & gfxTextRunWordCache::TEXT_TRAILING_ARABICCHAR) {
      mNextRunContextInfo |= nsTextFrameUtils::INCOMING_ARABICCHAR;
    }
  } else {
@ -1485,7 +1485,7 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
    textFlags |= nsTextFrameUtils::TEXT_INCOMING_WHITESPACE;
  }
  if (mCurrentRunContextInfo & nsTextFrameUtils::INCOMING_ARABICCHAR) {
-    textFlags |= nsTextFrameUtils::TEXT_INCOMING_ARABICCHAR;
+    textFlags |= gfxTextRunWordCache::TEXT_INCOMING_ARABICCHAR;
  }

  nsAutoTArray<PRInt32,50> textBreakPoints;
@ -1658,7 +1658,7 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
    textFlags |= nsTextFrameUtils::TEXT_TRAILING_WHITESPACE;
  }
  if (mNextRunContextInfo & nsTextFrameUtils::INCOMING_ARABICCHAR) {
-    textFlags |= nsTextFrameUtils::TEXT_TRAILING_ARABICCHAR;
+    textFlags |= gfxTextRunWordCache::TEXT_TRAILING_ARABICCHAR;
  }
  // ContinueTextRunAcrossFrames guarantees that it doesn't matter which
  // frame's style is used, so use the last frame's
--- a/layout/generic/nsTextFrameUtils.h
+++ b/layout/generic/nsTextFrameUtils.h
@ -79,9 +79,12 @@ public:
    // We normally don't use this break opportunity because the following text
    // will have a break opportunity at the start, but it's useful for line
    // layout to know about it in case the following content is not text
-    TEXT_HAS_TRAILING_BREAK  = 0x4000000,
-    TEXT_TRAILING_ARABICCHAR = 0x8000000,
-    TEXT_INCOMING_ARABICCHAR = 0x10000000
+    TEXT_HAS_TRAILING_BREAK  = 0x4000000
+
+    // The following are defined by gfxTextRunWordCache rather than here,
+    // so that it also has access to the _INCOMING flag
+    // TEXT_TRAILING_ARABICCHAR
+    // TEXT_INCOMING_ARABICCHAR
  };

  // These constants are used in TransformText to represent context information
--- a/layout/reftests/bugs/240029-1-ref.html
+++ b/layout/reftests/bugs/240029-1-ref.html
@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+body {
+ font-size: 10px;
+}
+.float {
+ width: 100%;
+ float: left;
+ height: 10px;
+ padding-bottom: 10px;
+}
+table {
+ clear: left;
+}
+</style>
+</head>
+<body>
+<div class="float"></div>
+<br>
+<table cellpadding="0" cellspacing="0">
+ <tr>
+  <td>should_be_at_left_edge</td>
+ </tr>
+</table>
+</body>
+</html>
--- a/layout/reftests/bugs/240029-1.html
+++ b/layout/reftests/bugs/240029-1.html
@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+body {
+ font-size: 10px;
+}
+.float {
+ width: 100%;
+ float: left;
+ height: 10px;
+ padding-bottom: 10px;
+}
+</style>
+</head>
+<body>
+<div class="float"></div>
+<br>
+<table cellpadding="0" cellspacing="0">
+ <tr>
+  <td>should_be_at_left_edge</td>
+ </tr>
+</table>
+</body>
+</html>
--- a/layout/reftests/bugs/302379-ref.html
+++ b/layout/reftests/bugs/302379-ref.html
@ -0,0 +1,17 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html><head><title></title></head>
+<body>
+<table width="400">
+<tbody><tr> 
+<td> 
+<font><b>
+long string long string long string long string long string long string long string long string
+<select id="sel">
+<option value="b">short string</option>
+<option value="a">long string long string long string long string</option>
+</select>
+</b></font>
+</td>
+</tr>
+</tbody></table>
+</body></html>
--- a/layout/reftests/bugs/302379.html
+++ b/layout/reftests/bugs/302379.html
@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html class="reftest-wait"><head><title></title></head>
+<body onload="document.documentElement.className='';">
+<table width="400">
+<tbody><tr> 
+<td> 
+<font><b>
+long string long string long string long string long string long string long string long string
+<select id="sel">
+<option value="a">long string long string long string long string</option>
+<option value="b">short string</option>
+</select>
+</b></font>
+</td>
+</tr>
+</tbody></table>
+<script>
+sel = document.getElementById('sel');
+sel.selectedIndex=1;
+</script>
+</body></html>
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@ -169,6 +169,7 @@ fails == 25888-3r.html 25888-3r-ref.html # bug 25888
 == 234964-2.html 234964-2-ref.html
 == 235593-1.html 235593-1-ref.html
 == 236539-1.html 236539-1-ref.html
+== 240029-1.html 240029-1-ref.html
 == 240470-1.html 240470-1-ref.html
 == 243266-1.html 243266-1-ref.html
 == 243302-1.html 243302-1-ref.html
@ -223,6 +224,7 @@ fails-if(MOZ_WIDGET_TOOLKIT!="cocoa") HTTP == 289480.html#top 289480-ref.html #
 == 300691-1f.html 300691-1-ref.html
 == 301726-1.html 301726-1-ref.html
 != 301726-2.html 301726-2-ref.html
+== 302379.html 302379-ref.html
 == 306630-1.html 306630-1-ref.html
 == 306660-1.html 306660-1-ref.html
 == 306660-2.html 306660-2-ref.html
--- a/layout/svg/crashtests/453754-1.svg
+++ b/layout/svg/crashtests/453754-1.svg
@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <filter id="f" height="-1" filterRes="1"/>
+
+  <rect filter="url(#f)" />
+
+</svg>
--- a/layout/svg/crashtests/464374-1.svg
+++ b/layout/svg/crashtests/464374-1.svg
@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+  document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
--- a/layout/svg/crashtests/470124-1.svg
+++ b/layout/svg/crashtests/470124-1.svg
@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter>
+
+<g filter="url(#f7)"/>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@ -53,6 +53,9 @@ load 409565-1.xhtml
 load 409573-1.svg
 load 429774-1.svg
 load 441368-1.svg
+load 453754-1.svg
 load 455314-1.xhtml
 load 458453.html
+load 464374-1.svg
+load 470124-1.svg
 load extref-test-1.xhtml
--- a/layout/xul/base/src/crashtests/470063-1.html
+++ b/layout/xul/base/src/crashtests/470063-1.html
@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.removeChild(document.documentElement)
+  document.appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@ -27,3 +27,4 @@ load 412479-1.xhtml
 load 430356-1.xhtml
 load 431738.xhtml
 load 434458-1.xul
+load 470063-1.html
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@ -84,6 +84,7 @@
 #include "nsIDocShellTreeOwner.h"
 #include "nsIBaseWindow.h"
 #include "nsISound.h"
+#include "nsIRootBox.h"

 PRInt8 nsMenuPopupFrame::sDefaultLevelParent = -1;

@ -1487,6 +1488,12 @@ nsMenuPopupFrame::Destroy()
  if (pm)
    pm->PopupDestroyed(this);

+  nsIRootBox* rootBox =
+    nsIRootBox::GetRootBox(PresContext()->GetPresShell());
+  if (rootBox && rootBox->GetDefaultTooltip() == mContent) {
+    rootBox->SetDefaultTooltip(nsnull);
+  }
+
  nsBoxFrame::Destroy();
 }

--- a/parser/htmlparser/tests/crashtests/468538-1.xhtml
+++ b/parser/htmlparser/tests/crashtests/468538-1.xhtml
@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var v = document.getElementById("v");
+  document.body.removeChild(document.body.firstChild);
+  v.innerHTML = "f";
+}
+
+</script>
+</head>
+<body onload="boom();"><xul:box><div id="v"/></xul:box></body>
+</html>
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@ -1 +1,2 @@
 load 423373-1.html
+load 468538-1.xhtml
--- a/toolkit/components/help/content/help.xul
+++ b/toolkit/components/help/content/help.xul
@ -153,7 +153,6 @@
  <stringbundle id="bundle_help"
                src="chrome://help/locale/help.properties"/>

-  <vbox flex="1">
    <toolbox id="help-toolbox" class="toolbox-top">
      <toolbar id="HelpToolbar" class="chromeclass-toolbar" chromedir="&locale.dir;">
        <toolbarbutton id="help-back-button" type="menu-button"
@ -310,5 +309,5 @@
        <findbar id="FindToolbar" browserid="help-content"/>
      </vbox>
    </hbox>
-  </vbox>
+
 </window>
--- a/toolkit/components/viewsource/content/viewSource.js
+++ b/toolkit/components/viewsource/content/viewSource.js
@ -39,6 +39,7 @@

 const Cc = Components.classes;
 const Ci = Components.interfaces;
+const Cr = Components.results;
 const pageLoaderIface = Components.interfaces.nsIWebPageDescriptor;
 const nsISelectionPrivate = Components.interfaces.nsISelectionPrivate;
 const nsISelectionController = Components.interfaces.nsISelectionController;
--- a/toolkit/content/tests/chrome/Makefile.in
+++ b/toolkit/content/tests/chrome/Makefile.in
@ -57,6 +57,7 @@ _TEST_FILES = 	findbar_window.xul \
 		test_bug331215.xul \
 		bug263683_window.xul \
 		test_bug263683.xul \
+		test_bug418874.xul \
 		bug451286_window.xul \
 		test_bug451286.xul \
 		test_popup_preventdefault_chrome.xul \
--- a/toolkit/content/tests/chrome/test_bug418874.xul
+++ b/toolkit/content/tests/chrome/test_bug418874.xul
@ -0,0 +1,99 @@
+<?xml version="1.0"?>
+
+<!-- ***** BEGIN LICENSE BLOCK *****
+   - Version: MPL 1.1/GPL 2.0/LGPL 2.1
+   -
+   - The contents of this file are subject to the Mozilla Public License Version
+   - 1.1 (the "License"); you may not use this file except in compliance with
+   - the License. You may obtain a copy of the License at
+   - http://www.mozilla.org/MPL/
+   -
+   - Software distributed under the License is distributed on an "AS IS" basis,
+   - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+   - for the specific language governing rights and limitations under the
+   - License.
+   -
+   - The Original Code is XUL Textbox Widget Test code
+   -
+   - The Initial Developer of the Original Code is
+   - Graeme McCutcheon <graememcc_firefox@graeme-online.co.uk>.
+   - Portions created by the Initial Developer are Copyright (C) 2008
+   - the Initial Developer. All Rights Reserved.
+   -
+   - Contributor(s):
+   -
+   -
+   - Alternatively, the contents of this file may be used under the terms of
+   - either the GNU General Public License Version 2 or later (the "GPL"), or
+   - the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+   - in which case the provisions of the GPL or the LGPL are applicable instead
+   - of those above. If you wish to allow use of your version of this file only
+   - under the terms of either the GPL or the LGPL, and not to allow others to
+   - use your version of this file under the terms of the MPL, indicate your
+   - decision by deleting the provisions above and replace them with the notice
+   - and other provisions required by the GPL or the LGPL. If you do not delete
+   - the provisions above, a recipient may use your version of this file under
+   - the terms of any one of the MPL, the GPL or the LGPL.
+   -
+   - ***** END LICENSE BLOCK ***** -->
+
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Textbox with emptyText test" width="500" height="600"
+        onload="doTest();"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+
+  <hbox>
+    <textbox id="t1" emptytext="empty"/>
+  </hbox>
+
+  <hbox>
+    <textbox id="t2" emptytext="empty"/>
+  </hbox>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml" style="height: 300px; overflow: auto;">
+    <p id="display">
+    </p>
+    <div id="content" style="display: none">
+    </div>
+    <pre id="test">
+    </pre>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+    SimpleTest.waitForExplicitFinish();
+
+    function doTest() {
+      var t1 = $("t1");
+      var t2 = $("t2");
+      t1.focus();
+      synthesizeKey("1", {});
+      var t1Enabled = {};
+      var t1CanUndo = {};
+      t1.editor.canUndo(t1Enabled, t1CanUndo);
+      ok(t1CanUndo.value, "undo correctly enabled when emptyText was not changed through property");
+      t2.emptyText = "reallyempty";
+
+      // Remaining tests after timeout - emptyText is displayed asynchronously.
+      setTimeout(function () {
+        is(t2.inputField.value, "reallyempty", "updated emptyText displayed");
+        t2.click();
+        synthesizeKey("2", {});
+        var t2Enabled = {};
+        var t2CanUndo = {};
+        t2.editor.canUndo(t2Enabled, t2CanUndo);
+        ok(t2CanUndo.value, "undo correctly enabled when emptyText explicitly changed through property");
+        SimpleTest.finish();
+      }, 100);
+   }
+
+  ]]></script>
+
+</window>
--- a/toolkit/content/widgets/textbox.xml
+++ b/toolkit/content/widgets/textbox.xml
@ -164,6 +164,7 @@
      <method name="_updateVisibleText">
        <body><![CDATA[
          if (!this.hasAttribute("focused") &&
+              !this.hasAttribute("empty") &&
              !this.value &&
              this.emptyText) {
            // This section is a wee bit hacky; without the timeout, the CSS
--- a/toolkit/crashreporter/client/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
+++ b/toolkit/crashreporter/client/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
@ -2,4 +2,4 @@

 CFBundleName = "Crash Reporter";
 CFBundleDisplayName = "Crash Reporter";
-NSHumanReadableCopyright = "Copyright © 2007-2008 Mozilla Foundation";
+NSHumanReadableCopyright = "Copyright © 2007-2009 Mozilla Foundation";
--- a/toolkit/locales/en-US/chrome/global/about.dtd
+++ b/toolkit/locales/en-US/chrome/global/about.dtd
@ -1,6 +1,6 @@
 <!ENTITY about.version                "version">

-<!ENTITY about.copy.beforeLink        "Copyright &copy; 1998-2008 by">
+<!ENTITY about.copy.beforeLink        "Copyright &copy; 1998-2009 by">
 <!ENTITY about.copy.linkTitle         "contributors">
 <!ENTITY about.copy.afterLink         "to the Mozilla Project.">

--- a/toolkit/locales/en-US/chrome/mozapps/help/welcome.xhtml
+++ b/toolkit/locales/en-US/chrome/mozapps/help/welcome.xhtml
@ -59,7 +59,7 @@ Contributors:
    &quot;page&quot; will likely return more topics than you want.</li>
 </ul>

-<p>Copyright &copy; 2003-2008 Contributors to the Mozilla project.</p>
+<p>Copyright &copy; 2003-2009 Contributors to the Mozilla project.</p>

 </body>
 </html>
--- a/toolkit/mozapps/update/src/updater/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
+++ b/toolkit/mozapps/update/src/updater/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
@ -1,4 +1,4 @@
 /* Localized versions of Info.plist keys */

 CFBundleName = "%APP_NAME% Software Update";
-NSHumanReadableCopyright = "Copyright © 2005-2008 Mozilla Foundation";
+NSHumanReadableCopyright = "Copyright © 2005-2009 Mozilla Foundation";
--- a/widget/src/cocoa/nsClipboard.h
+++ b/widget/src/cocoa/nsClipboard.h
@ -61,6 +61,7 @@ public:
  // Helper methods, used also by nsDragService
  static NSDictionary* PasteboardDictFromTransferable(nsITransferable *aTransferable);
  static PRBool IsStringType(const nsCString& aMIMEType, const NSString** aPasteboardType);
+  static NSString* WrapHtmlForSystemPasteboard(NSString* aString);

 protected:

--- a/widget/src/cocoa/nsClipboard.mm
+++ b/widget/src/cocoa/nsClipboard.mm
@ -115,13 +115,16 @@ nsClipboard::SetNativeClipboardData(PRInt32 aWhichClipboard)
    NSString* currentKey = [outputKeys objectAtIndex:i];
    id currentValue = [pasteboardOutputDict valueForKey:currentKey];
    if (currentKey == NSStringPboardType ||
-        currentKey == NSHTMLPboardType ||
        currentKey == kCorePboardType_url ||
        currentKey == kCorePboardType_urld ||
-        currentKey == kCorePboardType_urln)
+        currentKey == kCorePboardType_urln) {
      [generalPBoard setString:currentValue forType:currentKey];
-    else
+    } else if (currentKey == NSHTMLPboardType) {
+      [generalPBoard setString:(nsClipboard::WrapHtmlForSystemPasteboard(currentValue))
+                       forType:currentKey];
+    } else {
      [generalPBoard setData:currentValue forType:currentKey];
+    }
  }

  mChangeCount = [generalPBoard changeCount];
@ -539,6 +542,7 @@ nsClipboard::PasteboardDictFromTransferable(nsITransferable* aTransferable)
  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }

+
 PRBool nsClipboard::IsStringType(const nsCString& aMIMEType, const NSString** aPasteboardType)
 {
  if (aMIMEType.EqualsLiteral(kUnicodeMime) ||
@ -552,3 +556,19 @@ PRBool nsClipboard::IsStringType(const nsCString& aMIMEType, const NSString** aP
    return PR_FALSE;
  }
 }
+
+
+NSString* nsClipboard::WrapHtmlForSystemPasteboard(NSString* aString)
+{
+  NSString* wrapped =
+    [NSString stringWithFormat:
+      @"<html>"
+         "<head>"
+           "<meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\">"
+         "</head>"
+         "<body>"
+           "%@"
+         "</body>"
+       "</html>", aString];
+  return wrapped;
+}
--- a/widget/src/cocoa/nsDragService.mm
+++ b/widget/src/cocoa/nsDragService.mm
@ -138,12 +138,15 @@ static nsresult SetUpDragClipboard(nsISupportsArray* aTransferableArray)
      NSString* currentKey = [types objectAtIndex:i];
      id currentValue = [pasteboardOutputDict valueForKey:currentKey];
      if (currentKey == NSStringPboardType ||
-          currentKey == NSHTMLPboardType ||
          currentKey == kCorePboardType_url ||
          currentKey == kCorePboardType_urld ||
          currentKey == kCorePboardType_urln) {
        [dragPBoard setString:currentValue forType:currentKey];
      }
+      else if (currentKey == NSHTMLPboardType) {
+        [dragPBoard setString:(nsClipboard::WrapHtmlForSystemPasteboard(currentValue))
+                      forType:currentKey];
+      }
      else if (currentKey == NSTIFFPboardType) {
        [dragPBoard setData:currentValue forType:currentKey];
      }
--- a/widget/tests/Makefile.in
+++ b/widget/tests/Makefile.in
@ -52,7 +52,9 @@ _TEST_FILES =	test_bug343416.xul \
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 _TEST_FILES += native_menus_window.xul \
               test_native_menus.xul \
-               test_bug428405.xul
+               test_bug428405.xul \
+               test_bug466599.xul \
+               $(NULL)
 endif

 libs:: $(_TEST_FILES)
--- a/widget/tests/test_bug466599.xul
+++ b/widget/tests/test_bug466599.xul
@ -0,0 +1,102 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=466599
+-->
+<window title="Mozilla Bug 466599"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="initAndRunTests()">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"/>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+    <p id="display"></p>
+    <div id="content" style="display: none"></div>
+    <pre id="test"></pre>
+  </body>
+
+  <!-- test code goes here -->
+  <script class="testbody" type="application/javascript">
+  <![CDATA[
+
+  /** Test for Bug 466599 **/
+
+function copyToClipboard(txt)
+{
+  var clipid = Components.interfaces.nsIClipboard;
+  var clip =
+    Components.classes['@mozilla.org/widget/clipboard;1'].createInstance(clipid);
+  if (!clip)
+    return false;
+  var trans =
+    Components.classes['@mozilla.org/widget/transferable;1'].createInstance(Components.interfaces.nsITransferable);
+  if (!trans)
+    return false;
+  trans.addDataFlavor('text/html');
+  var str =
+    Components.classes['@mozilla.org/supports-string;1'].createInstance(Components.interfaces.nsISupportsString);
+  var copytext = txt;
+  str.data = copytext;
+  trans.setTransferData("text/html",str,copytext.length*2);
+  if (!clip)
+    return false;
+  clip.setData(trans,null,clipid.kGlobalClipboard);
+  return true;
+}
+
+function readFromClipboard()
+{
+  var clipid = Components.interfaces.nsIClipboard;
+  var clip =
+    Components.classes['@mozilla.org/widget/clipboard;1'].createInstance(clipid);
+  if (!clip)
+    return;
+  var trans =
+    Components.classes['@mozilla.org/widget/transferable;1'].createInstance(Components.interfaces.nsITransferable);
+  if (!trans)
+    return;
+  trans.addDataFlavor('text/html');
+  clip.getData(trans,clipid.kGlobalClipboard);
+  var str = new Object();
+  var strLength = new Object();
+  trans.getTransferData("text/html",str,strLength);
+  if (str)
+    str = str.value.QueryInterface(Components.interfaces.nsISupportsString);
+  if (str)
+    pastetext = str.data.substring(0,strLength.value / 2);
+  return pastetext;
+}
+
+function encodeHtmlEntities(s)
+{
+  var result = '';
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charAt(i);
+    result += {'<':'&lt;', '>':'&gt;', '&':'&amp;', '"':'&quot;'}[c] || c;
+  }
+  return result;
+}
+
+function initAndRunTests()
+{
+  var source = '<p>Lorem ipsum</p>';
+  var expect = new RegExp('<html>.*charset=utf-8.*' + source + '.*</html>', 'im');
+
+  var result = copyToClipboard(source);
+  ok(result, "copied HTML data to system pasteboard");
+
+  result = readFromClipboard();
+  ok(expect.test(result), "data on system pasteboard is wrapped with charset metadata");
+
+  $("display").innerHTML = 
+    '<em>source:</em> <pre>' + encodeHtmlEntities(source) + '</pre><br/>' +
+    '<em>result:</em> <pre>' + encodeHtmlEntities(result) + '</pre>';
+}
+
+  ]]>
+  </script>
+</window>