merge mozilla-inbound to mozilla-central. r=merge a=merge

MozReview-Commit-ID: LcCWQzgwIBi

caps/nsScriptSecurityManager.cpp

@@ -1437,13 +1437,12 @@ nsScriptSecurityManager::InitStatics()
 // Currently this nsGenericFactory constructor is used only from FastLoad
 // (XPCOM object deserialization) code, when "creating" the system principal
 // singleton.
-SystemPrincipal *
+already_AddRefed<SystemPrincipal>
 nsScriptSecurityManager::SystemPrincipalSingletonConstructor()
 {
-    nsIPrincipal *sysprin = nullptr;
     if (gScriptSecMan)
-        NS_ADDREF(sysprin = gScriptSecMan->mSystemPrincipal);
-    return static_cast<SystemPrincipal*>(sysprin);
+        return do_AddRef(gScriptSecMan->mSystemPrincipal.get()).downcast<SystemPrincipal>();
+    return nullptr;
 }
 
 struct IsWhitespace {

caps/nsScriptSecurityManager.h

@@ -53,7 +53,7 @@ public:
     // Invoked exactly once, by XPConnect.
     static void InitStatics();
 
-    static SystemPrincipal*
+    static already_AddRefed<SystemPrincipal>
     SystemPrincipalSingletonConstructor();
 
     /**

dom/base/CustomElementRegistry.cpp

@@ -138,6 +138,48 @@ CustomElementData::CustomElementData(nsAtom* aType, State aState)
 {
 }
 
+void
+CustomElementData::SetCustomElementDefinition(CustomElementDefinition* aDefinition)
+{
+  MOZ_ASSERT(mState == State::eCustom);
+  MOZ_ASSERT(!mCustomElementDefinition);
+  MOZ_ASSERT(aDefinition->mType == mType);
+
+  mCustomElementDefinition = aDefinition;
+}
+
+CustomElementDefinition*
+CustomElementData::GetCustomElementDefinition()
+{
+  MOZ_ASSERT(mCustomElementDefinition ? mState == State::eCustom
+                                      : mState != State::eCustom);
+
+  return mCustomElementDefinition;
+}
+
+void
+CustomElementData::Traverse(nsCycleCollectionTraversalCallback& aCb) const
+{
+  for (uint32_t i = 0; i < mReactionQueue.Length(); i++) {
+    if (mReactionQueue[i]) {
+      mReactionQueue[i]->Traverse(aCb);
+    }
+  }
+
+  if (mCustomElementDefinition) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(aCb, "mCustomElementDefinition");
+    aCb.NoteNativeChild(mCustomElementDefinition,
+      NS_CYCLE_COLLECTION_PARTICIPANT(CustomElementDefinition));
+  }
+}
+
+void
+CustomElementData::Unlink()
+{
+  mReactionQueue.Clear();
+  mCustomElementDefinition = nullptr;
+}
+
 //-----------------------------------------------------
 // CustomElementRegistry
 

dom/base/CustomElementRegistry.h

@@ -132,24 +132,16 @@ struct CustomElementData
   // e.g., create an element, insert a node.
   AutoTArray<UniquePtr<CustomElementReaction>, 3> mReactionQueue;
 
-  RefPtr<CustomElementDefinition> mCustomElementDefinition;
+  void SetCustomElementDefinition(CustomElementDefinition* aDefinition);
+  CustomElementDefinition* GetCustomElementDefinition();
 
-  void
-  SetCustomElementDefinition(CustomElementDefinition* aDefinition)
-  {
-    MOZ_ASSERT(!mCustomElementDefinition);
-
-    mCustomElementDefinition = aDefinition;
-  }
-
-  CustomElementDefinition*
-  GetCustomElementDefinition()
-  {
-    return mCustomElementDefinition;
-  }
+  void Traverse(nsCycleCollectionTraversalCallback& aCb) const;
+  void Unlink();
 
 private:
   virtual ~CustomElementData() {}
+
+  RefPtr<CustomElementDefinition> mCustomElementDefinition;
 };
 
 #define ALEADY_CONSTRUCTED_MARKER nullptr
@@ -169,7 +161,8 @@ struct CustomElementDefinition
                           mozilla::dom::LifecycleCallbacks* aCallbacks,
                           uint32_t aDocOrder);
 
-  // The type (name) for this custom element.
+  // The type (name) for this custom element, for <button is="x-foo"> or <x-foo>
+  // this would be x-foo.
   RefPtr<nsAtom> mType;
 
   // The localname to (e.g. <button is=type> -- this would be button).

dom/base/DOMRequest.h

@@ -103,12 +103,10 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMREQUESTSERVICE
 
-  // Returns an owning reference! No one should call this but the factory.
-  static DOMRequestService* FactoryCreate()
+  // No one should call this but the factory.
+  static already_AddRefed<DOMRequestService> FactoryCreate()
   {
-    DOMRequestService* res = new DOMRequestService;
-    NS_ADDREF(res);
-    return res;
+    return MakeAndAddRef<DOMRequestService>();
   }
 };
 

dom/base/FragmentOrElement.cpp

@@ -710,19 +710,7 @@ FragmentOrElement::nsDOMSlots::Traverse(nsCycleCollectionTraversalCallback &cb)
   cb.NoteXPCOMChild(mExtendedSlots->mXBLInsertionPoint.get());
 
   if (mExtendedSlots->mCustomElementData) {
-    for (uint32_t i = 0;
-         i < mExtendedSlots->mCustomElementData->mReactionQueue.Length(); i++) {
-      if (mExtendedSlots->mCustomElementData->mReactionQueue[i]) {
-        mExtendedSlots->mCustomElementData->mReactionQueue[i]->Traverse(cb);
-      }
-    }
-
-    if (mExtendedSlots->mCustomElementData->mCustomElementDefinition) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-        "mExtendedSlots->mCustomElementData->mCustomElementDefinition");
-      cb.NoteNativeChild(mExtendedSlots->mCustomElementData->mCustomElementDefinition,
-        NS_CYCLE_COLLECTION_PARTICIPANT(CustomElementDefinition));
-    }
+    mExtendedSlots->mCustomElementData->Traverse(cb);
   }
 
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mFrameLoaderOrOpener");
@@ -753,9 +741,7 @@ FragmentOrElement::nsDOMSlots::Unlink()
   MOZ_ASSERT(!(mExtendedSlots->mXBLBinding));
   mExtendedSlots->mXBLInsertionPoint = nullptr;
   if (mExtendedSlots->mCustomElementData) {
-    if (mExtendedSlots->mCustomElementData->mCustomElementDefinition) {
-      mExtendedSlots->mCustomElementData->mCustomElementDefinition = nullptr;
-    }
+    mExtendedSlots->mCustomElementData->Unlink();
     mExtendedSlots->mCustomElementData = nullptr;
   }
   nsCOMPtr<nsIFrameLoader> frameLoader =

dom/quota/QuotaManagerService.cpp

@@ -225,14 +225,11 @@ QuotaManagerService::Get()
 }
 
 // static
-QuotaManagerService*
+already_AddRefed<QuotaManagerService>
 QuotaManagerService::FactoryCreate()
 {
-  // Returns a raw pointer that carries an owning reference! Lame, but the
-  // singleton factory macros force this.
-  QuotaManagerService* quotaManagerService = GetOrCreate();
-  NS_IF_ADDREF(quotaManagerService);
-  return quotaManagerService;
+  RefPtr<QuotaManagerService> quotaManagerService = GetOrCreate();
+  return quotaManagerService.forget();
 }
 
 void

dom/quota/QuotaManagerService.h

@@ -63,8 +63,8 @@ public:
   static QuotaManagerService*
   Get();
 
-  // Returns an owning reference! No one should call this but the factory.
-  static QuotaManagerService*
+  // No one should call this but the factory.
+  static already_AddRefed<QuotaManagerService>
   FactoryCreate();
 
   void

extensions/cookie/nsPermissionManager.cpp

@@ -926,12 +926,11 @@ nsPermissionManager::~nsPermissionManager()
 }
 
 // static
-nsIPermissionManager*
+already_AddRefed<nsIPermissionManager>
 nsPermissionManager::GetXPCOMSingleton()
 {
   if (gPermissionManager) {
-    NS_ADDREF(gPermissionManager);
-    return gPermissionManager;
+    return do_AddRef(gPermissionManager);
   }
 
   // Create a new singleton nsPermissionManager.
@@ -940,15 +939,13 @@ nsPermissionManager::GetXPCOMSingleton()
   // Release our members, since GC cycles have already been completed and
   // would result in serious leaks.
   // See bug 209571.
-  gPermissionManager = new nsPermissionManager();
-  if (gPermissionManager) {
-    NS_ADDREF(gPermissionManager);
-    if (NS_FAILED(gPermissionManager->Init())) {
-      NS_RELEASE(gPermissionManager);
-    }
+  auto permManager = MakeRefPtr<nsPermissionManager>();
+  if (NS_SUCCEEDED(permManager->Init())) {
+    gPermissionManager = permManager.get();
+    return permManager.forget();
   }
 
-  return gPermissionManager;
+  return nullptr;;
 }
 
 nsresult

extensions/cookie/nsPermissionManager.h

@@ -167,7 +167,7 @@ public:
   NS_DECL_NSIOBSERVER
 
   nsPermissionManager();
-  static nsIPermissionManager* GetXPCOMSingleton();
+  static already_AddRefed<nsIPermissionManager> GetXPCOMSingleton();
   nsresult Init();
 
   // enums for AddInternal()

js/src/builtin/Object.cpp

@@ -1142,9 +1142,6 @@ EnumerableOwnProperties(JSContext* cx, const JS::CallArgs& args, EnumerableOwnPr
     RootedId id(cx);
     RootedValue key(cx);
     RootedValue value(cx);
-    RootedNativeObject nobj(cx);
-    if (obj->is<NativeObject>())
-        nobj = &obj->as<NativeObject>();
     RootedShape shape(cx);
     Rooted<PropertyDescriptor> desc(cx);
     // Step 4.
@@ -1161,7 +1158,8 @@ EnumerableOwnProperties(JSContext* cx, const JS::CallArgs& args, EnumerableOwnPr
         }
 
         // Step 4.a.i.
-        if (nobj) {
+        if (obj->is<NativeObject>()) {
+            HandleNativeObject nobj = obj.as<NativeObject>();
             if (JSID_IS_INT(id) && nobj->containsDenseElement(JSID_TO_INT(id))) {
                 value = nobj->getDenseOrTypedArrayElement(JSID_TO_INT(id));
             } else {

js/xpconnect/src/nsXPConnect.cpp

@@ -141,12 +141,10 @@ nsXPConnect::InitStatics()
     gSelf->mRuntime->InitSingletonScopes();
 }
 
-nsXPConnect*
+already_AddRefed<nsXPConnect>
 nsXPConnect::GetSingleton()
 {
-    nsXPConnect* xpc = nsXPConnect::XPConnect();
-    NS_IF_ADDREF(xpc);
-    return xpc;
+    return do_AddRef(nsXPConnect::XPConnect());
 }
 
 // static

js/xpconnect/src/xpcprivate.h

@@ -257,10 +257,7 @@ public:
         return gSystemPrincipal;
     }
 
-    // This returns an AddRef'd pointer. It does not do this with an 'out' param
-    // only because this form is required by the generic module macro:
-    // NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR
-    static nsXPConnect* GetSingleton();
+    static already_AddRefed<nsXPConnect> GetSingleton();
 
     // Called by module code in dll startup
     static void InitStatics();

layout/base/crashtests/1411138.html

@@ -0,0 +1,13 @@
+<!-- Needs to be in quirks mode -->
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('frameset') } catch(e) { }
+      try { o2 = document.createElement('body') } catch(e) { }
+      try { o2.style.overflow = 'auto'; } catch (e) {}
+      try { document.documentElement.appendChild(o1) } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { }
+      try { o2.scrollLeft } catch(e) { }
+    </script>
+  </head>
+</html>

layout/base/crashtests/crashtests.list

@@ -513,3 +513,4 @@ load 1404789-2.html
 load 1406562.html
 load 1409088.html
 load 1409147.html
+load 1411138.html

layout/base/nsPresContext.cpp

@@ -25,6 +25,7 @@
 #include "nsIContent.h"
 #include "nsIFrame.h"
 #include "nsIDocument.h"
+#include "nsIDocumentInlines.h"
 #include "nsIPrintSettings.h"
 #include "nsLanguageAtomService.h"
 #include "mozilla/LookAndFeel.h"
@@ -56,6 +57,7 @@
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/dom/Element.h"
 #include "nsIMessageManager.h"
+#include "mozilla/dom/HTMLBodyElement.h"
 #include "mozilla/dom/MediaQueryList.h"
 #include "nsSMILAnimationController.h"
 #include "mozilla/css/ImageLoader.h"
@@ -1516,14 +1518,15 @@ GetPropagatedScrollbarStylesForViewport(nsPresContext* aPresContext,
     return nullptr;
   }
 
-  Element* bodyElement = htmlDoc->GetBody();
-
-  if (!bodyElement ||
-      !bodyElement->NodeInfo()->Equals(nsGkAtoms::body)) {
-    // The body is not a <body> tag, it's a <frameset>.
+  Element* bodyElement = htmlDoc->GetBodyElement();
+  if (!bodyElement) {
+    // No body, nothing to do here.
     return nullptr;
   }
 
+  MOZ_ASSERT(bodyElement->IsHTMLElement(nsGkAtoms::body),
+             "GetBodyElement returned something bogus");
+
   RefPtr<nsStyleContext> bodyStyle =
     styleSet->ResolveStyleFor(bodyElement, rootStyle,
                               LazyComputeBehavior::Allow);

mobile/android/components/build/nsAndroidHistory.cpp

@@ -30,7 +30,7 @@ NS_IMPL_ISUPPORTS(nsAndroidHistory, IHistory, nsIRunnable, nsITimerCallback, nsI
 nsAndroidHistory* nsAndroidHistory::sHistory = nullptr;
 
 /*static*/
-nsAndroidHistory*
+already_AddRefed<nsAndroidHistory>
 nsAndroidHistory::GetSingleton()
 {
   if (!sHistory) {
@@ -38,8 +38,7 @@ nsAndroidHistory::GetSingleton()
     NS_ENSURE_TRUE(sHistory, nullptr);
   }
 
-  NS_ADDREF(sHistory);
-  return sHistory;
+  return do_AddRef(sHistory);
 }
 
 nsAndroidHistory::nsAndroidHistory()

mobile/android/components/build/nsAndroidHistory.h

@@ -40,7 +40,7 @@ public:
    * Obtains a pointer that has had AddRef called on it.  Used by the service
    * manager only.
    */
-  static nsAndroidHistory* GetSingleton();
+  static already_AddRefed<nsAndroidHistory> GetSingleton();
 
   nsAndroidHistory();
 

modules/libjar/nsJARProtocolHandler.cpp

@@ -63,23 +63,19 @@ NS_IMPL_ISUPPORTS(nsJARProtocolHandler,
                   nsIProtocolHandler,
                   nsISupportsWeakReference)
 
-nsJARProtocolHandler*
+already_AddRefed<nsJARProtocolHandler>
 nsJARProtocolHandler::GetSingleton()
 {
     if (!gJarHandler) {
-        gJarHandler = new nsJARProtocolHandler();
-        if (!gJarHandler)
-            return nullptr;
-
-        NS_ADDREF(gJarHandler);
-        nsresult rv = gJarHandler->Init();
-        if (NS_FAILED(rv)) {
-            NS_RELEASE(gJarHandler);
+        auto jar = MakeRefPtr<nsJARProtocolHandler>();
+        gJarHandler = jar.get();
+        if (NS_FAILED(jar->Init())) {
+            gJarHandler = nullptr;
             return nullptr;
         }
+        return jar.forget();
     }
-    NS_ADDREF(gJarHandler);
-    return gJarHandler;
+    return do_AddRef(gJarHandler);
 }
 
 NS_IMETHODIMP

modules/libjar/nsJARProtocolHandler.h

@@ -25,7 +25,7 @@ public:
     // nsJARProtocolHandler methods:
     nsJARProtocolHandler();
 
-    static nsJARProtocolHandler *GetSingleton();
+    static already_AddRefed<nsJARProtocolHandler> GetSingleton();
 
     nsresult Init();
 

modules/libpref/Preferences.cpp

@@ -3826,12 +3826,11 @@ public:
 
 } // namespace
 
-/* static */ Preferences*
+/* static */ already_AddRefed<Preferences>
 Preferences::GetInstanceForService()
 {
   if (sPreferences) {
-    NS_ADDREF(sPreferences);
-    return sPreferences;
+    return do_AddRef(sPreferences);
   }
 
   if (sShutdown) {
@@ -3868,8 +3867,7 @@ Preferences::GetInstanceForService()
     new AddPreferencesMemoryReporterRunnable();
   NS_DispatchToMainThread(runnable);
 
-  NS_ADDREF(sPreferences);
-  return sPreferences;
+  return do_AddRef(sPreferences);
 }
 
 /* static */ bool

modules/libpref/Preferences.h

@@ -78,7 +78,7 @@ public:
   static void InitializeUserPrefs();
 
   // Returns the singleton instance which is addreffed.
-  static Preferences* GetInstanceForService();
+  static already_AddRefed<Preferences> GetInstanceForService();
 
   // Finallizes global members.
   static void Shutdown();

netwerk/base/nsIOService.cpp

@@ -351,23 +351,19 @@ nsIOService::InitializeProtocolProxyService()
     return rv;
 }
 
-nsIOService*
+already_AddRefed<nsIOService>
 nsIOService::GetInstance() {
     if (!gIOService) {
-        gIOService = new nsIOService();
-        if (!gIOService)
+        RefPtr<nsIOService> ios = new nsIOService();
+        gIOService = ios.get();
+        if (NS_FAILED(ios->Init())) {
+            gIOService = nullptr;
             return nullptr;
-        NS_ADDREF(gIOService);
+        }
 
-        nsresult rv = gIOService->Init();
-        if (NS_FAILED(rv)) {
-            NS_RELEASE(gIOService);
-            return nullptr;
+        return ios.forget();
     }
-        return gIOService;
-    }
-    NS_ADDREF(gIOService);
-    return gIOService;
+    return do_AddRef(gIOService);
 }
 
 NS_IMPL_ISUPPORTS(nsIOService,

netwerk/base/nsIOService.h

@@ -64,8 +64,7 @@ public:
 
     // Gets the singleton instance of the IO Service, creating it as needed
     // Returns nullptr on out of memory or failure to initialize.
-    // Returns an addrefed pointer.
-    static nsIOService* GetInstance();
+    static already_AddRefed<nsIOService> GetInstance();
 
     nsresult Init();
     nsresult NewURI(const char* aSpec, nsIURI* aBaseURI,

netwerk/dns/ChildDNSService.cpp

@@ -26,7 +26,7 @@ namespace net {
 static ChildDNSService *gChildDNSService;
 static const char kPrefNameDisablePrefetch[] = "network.dns.disablePrefetch";
 
-ChildDNSService* ChildDNSService::GetSingleton()
+already_AddRefed<ChildDNSService> ChildDNSService::GetSingleton()
 {
   MOZ_ASSERT(IsNeckoChild());
 
@@ -34,8 +34,7 @@ ChildDNSService* ChildDNSService::GetSingleton()
     gChildDNSService = new ChildDNSService();
   }
 
-  NS_ADDREF(gChildDNSService);
-  return gChildDNSService;
+  return do_AddRef(gChildDNSService);
 }
 
 NS_IMPL_ISUPPORTS(ChildDNSService,

netwerk/dns/ChildDNSService.h

@@ -32,7 +32,7 @@ public:
 
   ChildDNSService();
 
-  static ChildDNSService* GetSingleton();
+  static already_AddRefed<ChildDNSService> GetSingleton();
 
   void NotifyRequestDone(DNSRequestChild *aDnsRequest);
 

netwerk/dns/nsDNSService2.cpp

@@ -499,7 +499,7 @@ NS_IMPL_ISUPPORTS(nsDNSService, nsIDNSService, nsPIDNSService, nsIObserver,
  ******************************************************************************/
 static nsDNSService *gDNSService;
 
-nsIDNSService*
+already_AddRefed<nsIDNSService>
 nsDNSService::GetXPCOMSingleton()
 {
     if (IsNeckoChild()) {
@@ -509,25 +509,23 @@ nsDNSService::GetXPCOMSingleton()
     return GetSingleton();
 }
 
-nsDNSService*
+already_AddRefed<nsDNSService>
 nsDNSService::GetSingleton()
 {
     NS_ASSERTION(!IsNeckoChild(), "not a parent process");
 
     if (gDNSService) {
-        NS_ADDREF(gDNSService);
-        return gDNSService;
+        return do_AddRef(gDNSService);
     }
 
-    gDNSService = new nsDNSService();
-    if (gDNSService) {
-        NS_ADDREF(gDNSService);
-        if (NS_FAILED(gDNSService->Init())) {
-              NS_RELEASE(gDNSService);
-        }
+    auto dns = MakeRefPtr<nsDNSService>();
+    gDNSService = dns.get();
+    if (NS_FAILED(dns->Init())) {
+        gDNSService = nullptr;
+        return nullptr;
     }
 
-    return gDNSService;
+    return dns.forget();
 }
 
 NS_IMETHODIMP

netwerk/dns/nsDNSService2.h

@@ -34,7 +34,7 @@ public:
 
     nsDNSService();
 
-    static nsIDNSService* GetXPCOMSingleton();
+    static already_AddRefed<nsIDNSService> GetXPCOMSingleton();
 
     size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
 
@@ -51,7 +51,7 @@ protected:
 private:
     ~nsDNSService();
 
-    static nsDNSService* GetSingleton();
+    static already_AddRefed<nsDNSService> GetSingleton();
 
     uint16_t GetAFForLookup(const nsACString &host, uint32_t flags);
 

startupcache/StartupCache.cpp

@@ -700,13 +700,12 @@ StartupCacheWrapper* StartupCacheWrapper::gStartupCacheWrapper = nullptr;
 
 NS_IMPL_ISUPPORTS(StartupCacheWrapper, nsIStartupCache)
 
-StartupCacheWrapper* StartupCacheWrapper::GetSingleton()
+already_AddRefed<StartupCacheWrapper> StartupCacheWrapper::GetSingleton()
 {
   if (!gStartupCacheWrapper)
     gStartupCacheWrapper = new StartupCacheWrapper();
 
-  NS_ADDREF(gStartupCacheWrapper);
-  return gStartupCacheWrapper;
+  return do_AddRef(gStartupCacheWrapper);
 }
 
 nsresult

startupcache/StartupCache.h

@@ -214,7 +214,7 @@ class StartupCacheWrapper final
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSISTARTUPCACHE
 
-  static StartupCacheWrapper* GetSingleton();
+  static already_AddRefed<StartupCacheWrapper> GetSingleton();
   static StartupCacheWrapper *gStartupCacheWrapper;
 };
 

storage/VacuumManager.cpp

@@ -311,7 +311,7 @@ NS_IMPL_ISUPPORTS(
 VacuumManager *
 VacuumManager::gVacuumManager = nullptr;
 
-VacuumManager *
+already_AddRefed<VacuumManager>
 VacuumManager::getSingleton()
 {
   //Don't allocate it in the child Process.
@@ -319,15 +319,10 @@ VacuumManager::getSingleton()
     return nullptr;
   }
 
-  if (gVacuumManager) {
-    NS_ADDREF(gVacuumManager);
-    return gVacuumManager;
-  }
+  if (!gVacuumManager) {
     gVacuumManager = new VacuumManager();
-  if (gVacuumManager) {
-    NS_ADDREF(gVacuumManager);
   }
-  return gVacuumManager;
+  return do_AddRef(gVacuumManager);
 }
 
 VacuumManager::VacuumManager()

storage/VacuumManager.h

@@ -28,7 +28,7 @@ public:
   /**
    * Obtains the VacuumManager object.
    */
-  static VacuumManager * getSingleton();
+  static already_AddRefed<VacuumManager> getSingleton();
 
 private:
   ~VacuumManager();

storage/mozStorageService.cpp

@@ -193,12 +193,11 @@ NS_IMPL_ISUPPORTS(
 
 Service *Service::gService = nullptr;
 
-Service *
+already_AddRefed<Service>
 Service::getSingleton()
 {
   if (gService) {
-    NS_ADDREF(gService);
-    return gService;
+    return do_AddRef(gService);
   }
 
   // Ensure that we are using the same version of SQLite that we compiled with
@@ -222,14 +221,14 @@ Service::getSingleton()
   // The first reference to the storage service must be obtained on the
   // main thread.
   NS_ENSURE_TRUE(NS_IsMainThread(), nullptr);
-  gService = new Service();
-  if (gService) {
-    NS_ADDREF(gService);
-    if (NS_FAILED(gService->initialize()))
-      NS_RELEASE(gService);
+  RefPtr<Service> service = new Service();
+  gService = service.get();
+  if (NS_FAILED(service->initialize())) {
+    gService = nullptr;
+    return nullptr;
   }
 
-  return gService;
+  return service.forget();
 }
 
 nsIXPConnect *Service::sXPConnect = nullptr;

storage/mozStorageService.h

@@ -52,7 +52,7 @@ public:
                            const nsAString &aStr2,
                            int32_t aComparisonStrength);
 
-  static Service *getSingleton();
+  static already_AddRefed<Service> getSingleton();
 
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_MOZISTORAGESERVICE

testing/web-platform/meta/MANIFEST.json

@@ -95709,6 +95709,42 @@
      {}
     ]
    ],
+   "css/CSS2/visufx/overflow-propagation-001a.html": [
+    [
+     "/css/CSS2/visufx/overflow-propagation-001a.html",
+     [
+      [
+       "/css/CSS2/visufx/support/overflow-propagation-001-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/CSS2/visufx/overflow-propagation-001b.html": [
+    [
+     "/css/CSS2/visufx/overflow-propagation-001b.html",
+     [
+      [
+       "/css/CSS2/visufx/support/overflow-propagation-001-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/CSS2/visufx/overflow-propagation-001c.html": [
+    [
+     "/css/CSS2/visufx/overflow-propagation-001c.html",
+     [
+      [
+       "/css/CSS2/visufx/support/overflow-propagation-001-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "css/CSS2/visufx/visibility-005.xht": [
     [
      "/css/CSS2/visufx/visibility-005.xht",
@@ -224201,6 +224237,11 @@
      {}
     ]
    ],
+   "css/CSS2/visufx/support/overflow-propagation-001-ref.html": [
+    [
+     {}
+    ]
+   ],
    "css/CSS2/visuren/anonymous-boxes-001a-ref.xht": [
     [
      {}
@@ -391656,7 +391697,7 @@
    "support"
   ],
   "XMLHttpRequest/resources/auth2/corsenabled.py": [
-   "a70576e6ae82a030c6776923082e5aa50fad0078",
+   "4136b00b543096216f9f1ad1314c7062dda04179",
    "support"
   ],
   "XMLHttpRequest/resources/auth3/auth.py": [
@@ -391676,11 +391717,11 @@
    "support"
   ],
   "XMLHttpRequest/resources/auth7/corsenabled.py": [
-   "3f8fe382e3aa4ffe0e7c1ecb4571a55866bba27f",
+   "cbc1e4a39cc2e999ef7bd4053a600e8b0d515bb5",
    "support"
   ],
   "XMLHttpRequest/resources/auth8/corsenabled-no-authorize.py": [
-   "c3add811ecf33bf3452fe471d27756dc152db81f",
+   "523fbc134ecfee5b13e4ef93508712847fc4e396",
    "support"
   ],
   "XMLHttpRequest/resources/auth9/auth.py": [
@@ -469823,6 +469864,18 @@
    "d71b8aa84a63f7579a5f33b05960571e24417110",
    "reftest"
   ],
+  "css/CSS2/visufx/overflow-propagation-001a.html": [
+   "3aaba555d04ae9a0f6ee48aa7ac8fc4600554645",
+   "reftest"
+  ],
+  "css/CSS2/visufx/overflow-propagation-001b.html": [
+   "c582c21c5fb8079047d6a2350351fede33c0f6db",
+   "reftest"
+  ],
+  "css/CSS2/visufx/overflow-propagation-001c.html": [
+   "57062d2e0eb9077f965183aaed2a4c18675585a7",
+   "reftest"
+  ],
   "css/CSS2/visufx/shape-spaces-001.xht": [
    "2449b8843064386c9854436bbc59eccb695b9578",
    "visual"
@@ -469831,6 +469884,10 @@
    "e4843d42a26189132e1bdd53e8618521330baeca",
    "support"
   ],
+  "css/CSS2/visufx/support/overflow-propagation-001-ref.html": [
+   "b5df0a9c23e9556ade5179681452a40b913d392d",
+   "support"
+  ],
   "css/CSS2/visufx/visibility-001.xht": [
    "f75f3db564058f469756ec1398078fc76473d632",
    "visual"
@@ -585972,7 +586029,7 @@
    "wdspec"
   ],
   "webdriver/tests/element_retrieval/get_active_element.py": [
-   "9080770b60a988cb37e30700efb118d392a896c7",
+   "41dab8ecf11556f7b1490d515557de659813881e",
    "wdspec"
   ],
   "webdriver/tests/fullscreen_window.py": [
@@ -586100,7 +586157,7 @@
    "support"
   ],
   "webdriver/tests/support/asserts.py": [
-   "b02f45e99cdee49f12608e60333e566c8c0e04d0",
+   "4e4f29b9d305383e5bcfa01fa1ba789d0c12ef93",
    "support"
   ],
   "webdriver/tests/support/fixtures.py": [

testing/web-platform/tests/css/CSS2/visufx/overflow-propagation-001a.html

@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Ensure that body propagates its scrollbars</title>
+<link rel=match href="support/overflow-propagation-001-ref.html">
+<link rel=help href="https://www.w3.org/TR/CSS21/visufx.html#overflow-clipping">
+<body style="overflow: hidden; margin: 100px; width: 100px; height: 100px; border: 1px solid green; position: absolute; top: 0; left: 0">
+  The body should have visible overflow of the text that totally doesn't fit
+  in the little box.
+</body>

testing/web-platform/tests/css/CSS2/visufx/overflow-propagation-001b.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Ensure that body propagates its scrollbars</title>
+<link rel=match href="support/overflow-propagation-001-ref.html">
+<link rel=help href="https://www.w3.org/TR/CSS21/visufx.html#overflow-clipping">
+<script>
+  onload = function() {
+    document.body.remove();
+    var b = document.createElement("body");
+    b.style = "overflow: hidden; margin: 100px; width: 100px; height: 100px; border: 1px solid green; position: absolute; top: 0; left: 0";
+    b.textContent = "The body should have visible overflow of the text that totally doesn't fit in the little box.";
+    document.documentElement.appendChild(b);
+  }
+</script>

testing/web-platform/tests/css/CSS2/visufx/overflow-propagation-001c.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Ensure that body propagates its scrollbars even if there is a preceding frameset</title>
+<link rel=match href="support/overflow-propagation-001-ref.html">
+<link rel=help href="https://www.w3.org/TR/CSS21/visufx.html#overflow-clipping">
+<script>
+  onload = function() {
+    document.body.remove();
+    var f = document.createElement("frameset");
+    document.documentElement.appendChild(f);
+    var b = document.createElement("body");
+    b.style = "overflow: hidden; margin: 100px; width: 100px; height: 100px; border: 1px solid green; position: absolute; top: 0; left: 0";
+    b.textContent = "The body should have visible overflow of the text that totally doesn't fit in the little box.";
+    document.documentElement.appendChild(b);
+  }
+</script>

testing/web-platform/tests/css/CSS2/visufx/support/overflow-propagation-001-ref.html

@@ -0,0 +1,7 @@
+<!doctype html>
+<html style="overflow: hidden">
+<meta charset=utf-8>
+<body style="margin: 100px; width: 100px; height: 100px; border: 1px solid green; position: absolute; top: 0; left: 0">
+    The body should have visible overflow of the text that totally doesn't fit
+    in the little box.
+</body>

toolkit/components/downloads/ApplicationReputation.cpp

@@ -1552,21 +1552,13 @@ NS_IMPL_ISUPPORTS(ApplicationReputationService,
 ApplicationReputationService*
   ApplicationReputationService::gApplicationReputationService = nullptr;
 
-ApplicationReputationService*
+already_AddRefed<ApplicationReputationService>
 ApplicationReputationService::GetSingleton()
 {
-  if (gApplicationReputationService) {
-    NS_ADDREF(gApplicationReputationService);
-    return gApplicationReputationService;
-  }
-
-  // We're not initialized yet.
+  if (!gApplicationReputationService) {
     gApplicationReputationService = new ApplicationReputationService();
-  if (gApplicationReputationService) {
-    NS_ADDREF(gApplicationReputationService);
   }
-
-  return gApplicationReputationService;
+  return do_AddRef(gApplicationReputationService);
 }
 
 ApplicationReputationService::ApplicationReputationService()

toolkit/components/downloads/ApplicationReputation.h

@@ -27,7 +27,7 @@ public:
   NS_DECL_NSIAPPLICATIONREPUTATIONSERVICE
 
 public:
-  static ApplicationReputationService* GetSingleton();
+  static already_AddRefed<ApplicationReputationService> GetSingleton();
 
 private:
   friend class PendingLookup;

toolkit/components/downloads/nsDownloadManager.cpp

@@ -25,22 +25,20 @@ NS_IMPL_ISUPPORTS(
 
 nsDownloadManager *nsDownloadManager::gDownloadManagerService = nullptr;
 
-nsDownloadManager *
+already_AddRefed<nsDownloadManager>
 nsDownloadManager::GetSingleton()
 {
   if (gDownloadManagerService) {
-    NS_ADDREF(gDownloadManagerService);
-    return gDownloadManagerService;
+    return do_AddRef(gDownloadManagerService);
   }
 
-  gDownloadManagerService = new nsDownloadManager();
-  if (gDownloadManagerService) {
-    NS_ADDREF(gDownloadManagerService);
-    if (NS_FAILED(gDownloadManagerService->Init()))
-      NS_RELEASE(gDownloadManagerService);
+  auto serv = MakeRefPtr<nsDownloadManager>();
+  gDownloadManagerService = serv.get();
+  if (NS_FAILED(serv->Init())) {
+    gDownloadManagerService = nullptr;
+    return nullptr;
   }
-
-  return gDownloadManagerService;
+  return serv.forget();
 }
 
 nsDownloadManager::~nsDownloadManager()

toolkit/components/downloads/nsDownloadManager.h

@@ -21,7 +21,7 @@ public:
 
   nsresult Init();
 
-  static nsDownloadManager *GetSingleton();
+  static already_AddRefed<nsDownloadManager> GetSingleton();
 
   nsDownloadManager()
   {

toolkit/components/places/History.cpp

@@ -2421,7 +2421,7 @@ History::GetService()
 }
 
 /* static */
-History*
+already_AddRefed<History>
 History::GetSingleton()
 {
   if (!gService) {
@@ -2430,8 +2430,7 @@ History::GetSingleton()
     gService->InitMemoryReporter();
   }
 
-  NS_ADDREF(gService);
-  return gService;
+  return do_AddRef(gService);
 }
 
 mozIStorageConnection*

toolkit/components/places/History.h

@@ -107,10 +107,9 @@ public:
   static History* GetService();
 
   /**
-   * Obtains a pointer that has had AddRef called on it.  Used by the service
-   * manager only.
+   * Used by the service manager only.
    */
-  static History* GetSingleton();
+  static already_AddRefed<History> GetSingleton();
 
   template<int N>
   already_AddRefed<mozIStorageStatement>

toolkit/mozapps/extensions/AddonPathService.cpp

@@ -57,14 +57,13 @@ NS_IMPL_ISUPPORTS(AddonPathService, amIAddonPathService)
 
 AddonPathService *AddonPathService::sInstance;
 
-/* static */ AddonPathService*
+/* static */ already_AddRefed<AddonPathService>
 AddonPathService::GetInstance()
 {
   if (!sInstance) {
     sInstance = new AddonPathService();
   }
-  NS_ADDREF(sInstance);
-  return sInstance;
+  return do_AddRef(sInstance);
 }
 
 static JSAddonId*

toolkit/mozapps/extensions/AddonPathService.h

@@ -23,7 +23,7 @@ class AddonPathService final : public amIAddonPathService
 public:
   AddonPathService();
 
-  static AddonPathService* GetInstance();
+  static already_AddRefed<AddonPathService> GetInstance();
 
   JSAddonId* Find(const nsAString& path);
   static JSAddonId* FindAddonId(const nsAString& path);

uriloader/prefetch/nsOfflineCacheUpdate.h

@@ -356,8 +356,7 @@ public:
      */
     static nsOfflineCacheUpdateService *EnsureService();
 
-    /** Addrefs and returns the singleton nsOfflineCacheUpdateService. */
-    static nsOfflineCacheUpdateService *GetInstance();
+    static already_AddRefed<nsOfflineCacheUpdateService> GetInstance();
 
     static nsresult OfflineAppPinnedForURI(nsIURI *aDocumentURI,
                                            nsIPrefBranch *aPrefBranch,

uriloader/prefetch/nsOfflineCacheUpdateService.cpp

@@ -292,25 +292,20 @@ nsOfflineCacheUpdateService::Init()
 }
 
 /* static */
-nsOfflineCacheUpdateService *
+already_AddRefed<nsOfflineCacheUpdateService>
 nsOfflineCacheUpdateService::GetInstance()
 {
     if (!gOfflineCacheUpdateService) {
-        gOfflineCacheUpdateService = new nsOfflineCacheUpdateService();
-        if (!gOfflineCacheUpdateService)
-            return nullptr;
-        NS_ADDREF(gOfflineCacheUpdateService);
-        nsresult rv = gOfflineCacheUpdateService->Init();
-        if (NS_FAILED(rv)) {
-            NS_RELEASE(gOfflineCacheUpdateService);
+        auto serv = MakeRefPtr<nsOfflineCacheUpdateService>();
+        gOfflineCacheUpdateService = serv.get();
+        if (NS_FAILED(serv->Init())) {
+            gOfflineCacheUpdateService = nullptr;
             return nullptr;
         }
-        return gOfflineCacheUpdateService;
+        return serv.forget();
     }
 
-    NS_ADDREF(gOfflineCacheUpdateService);
-
-    return gOfflineCacheUpdateService;
+    return do_AddRef(gOfflineCacheUpdateService);
 }
 
 /* static */

xpcom/components/ModuleUtils.h

@@ -49,8 +49,25 @@ _InstanceClass##Constructor(nsISupports *aOuter, REFNSIID aIID,               \
   return rv;                                                                  \
 }
 
+namespace mozilla {
+namespace detail {
+
+template<typename T>
+struct RemoveAlreadyAddRefed
+{
+  using Type = T;
+};
+
+template<typename T>
+struct RemoveAlreadyAddRefed<already_AddRefed<T>>
+{
+  using Type = T;
+};
+
+} // namespace detail
+} // namespace mozilla
+
 // 'Constructor' that uses an existing getter function that gets a singleton.
-// NOTE: assumes that getter does an AddRef - so additional AddRef is not done.
 #define NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(_InstanceClass, _GetterProc) \
 static nsresult                                                               \
 _InstanceClass##Constructor(nsISupports *aOuter, REFNSIID aIID,               \
@@ -63,7 +80,12 @@ _InstanceClass##Constructor(nsISupports *aOuter, REFNSIID aIID,               \
     return NS_ERROR_NO_AGGREGATION;                                           \
   }                                                                           \
                                                                               \
-  inst = already_AddRefed<_InstanceClass>(_GetterProc());                     \
+  using T = mozilla::detail::RemoveAlreadyAddRefed<decltype(_GetterProc())>::Type; \
+  static_assert(mozilla::IsSame<already_AddRefed<T>, decltype(_GetterProc())>::value, \
+                "Singleton constructor must return already_AddRefed");        \
+  static_assert(mozilla::IsBaseOf<_InstanceClass, T>::value,                  \
+                "Singleton constructor must return correct already_AddRefed");\
+  inst = _GetterProc();                                                       \
   if (nullptr == inst) {                                                      \
     return NS_ERROR_OUT_OF_MEMORY;                                            \
   }                                                                           \