Merge m-i to m-c, a=merge

.eslintignore

@@ -210,7 +210,6 @@ toolkit/content/widgets/wizard.xml
 toolkit/components/jsdownloads/src/DownloadIntegration.jsm
 toolkit/components/url-classifier/**
 toolkit/components/urlformatter/nsURLFormatter.js
-toolkit/identity/FirefoxAccounts.jsm
 toolkit/modules/AppConstants.jsm
 toolkit/mozapps/downloads/nsHelperAppDlg.js
 toolkit/mozapps/extensions/internal/AddonConstants.jsm

accessible/ipc/DocAccessibleParent.cpp

@@ -12,6 +12,13 @@
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
 
+#if defined(XP_WIN)
+#include "AccessibleWrap.h"
+#include "Compatibility.h"
+#include "nsWinUtils.h"
+#include "RootAccessible.h"
+#endif
+
 namespace mozilla {
 namespace a11y {
 
@@ -525,7 +532,43 @@ DocAccessibleParent::SetCOMProxy(const RefPtr<IAccessible>& aCOMProxy)
 
   IAccessibleHolder::COMPtrType ptr(rawNative);
   IAccessibleHolder holder(Move(ptr));
-  Unused << SendParentCOMProxy(holder);
+
+  if (nsWinUtils::IsWindowEmulationStarted()) {
+    RootAccessible* rootDocument = outerDoc->RootAccessible();
+    MOZ_ASSERT(rootDocument);
+
+    bool isActive = true;
+    nsIntRect rect(CW_USEDEFAULT, CW_USEDEFAULT, 0, 0);
+    if (Compatibility::IsDolphin()) {
+      rect = Bounds();
+      nsIntRect rootRect = rootDocument->Bounds();
+      rect.x = rootRect.x - rect.x;
+      rect.y -= rootRect.y;
+      tab->GetDocShellIsActive(&isActive);
+    }
+
+    HWND parentWnd = reinterpret_cast<HWND>(rootDocument->GetNativeWindow());
+    HWND hWnd = nsWinUtils::CreateNativeWindow(kClassNameTabContent,
+                                               parentWnd, rect.x, rect.y,
+                                               rect.width, rect.height,
+                                               isActive);
+    if (hWnd) {
+      // Attach accessible document to the emulated native window
+      ::SetPropW(hWnd, kPropNameDocAccParent, (HANDLE)this);
+      SetEmulatedWindowHandle(hWnd);
+    }
+  }
+  Unused << SendParentCOMProxy(holder, reinterpret_cast<uintptr_t>(
+                               mEmulatedWindowHandle));
+}
+
+void
+DocAccessibleParent::SetEmulatedWindowHandle(HWND aWindowHandle)
+{
+  if (!aWindowHandle && mEmulatedWindowHandle && IsTopLevel()) {
+    ::DestroyWindow(mEmulatedWindowHandle);
+  }
+  mEmulatedWindowHandle = aWindowHandle;
 }
 
 mozilla::ipc::IPCResult

accessible/ipc/DocAccessibleParent.h

@@ -30,6 +30,9 @@ public:
   DocAccessibleParent() :
     ProxyAccessible(this), mParentDoc(nullptr),
     mTopLevel(false), mShutdown(false)
+#if defined(XP_WIN)
+                                      , mEmulatedWindowHandle(nullptr)
+#endif // defined(XP_WIN)
   { MOZ_COUNT_CTOR_INHERITED(DocAccessibleParent, ProxyAccessible); }
   ~DocAccessibleParent()
   {
@@ -151,6 +154,13 @@ public:
 
   virtual mozilla::ipc::IPCResult RecvGetWindowedPluginIAccessible(
       const WindowsHandle& aHwnd, IAccessibleHolder* aPluginCOMProxy) override;
+
+  /**
+   * Set emulated native window handle for a document.
+   * @param aWindowHandle emulated native window handle
+   */
+  void SetEmulatedWindowHandle(HWND aWindowHandle);
+  HWND GetEmulatedWindowHandle() const { return mEmulatedWindowHandle; }
 #endif
 
 private:
@@ -187,6 +197,11 @@ private:
   nsTArray<DocAccessibleParent*> mChildDocs;
   DocAccessibleParent* mParentDoc;
 
+#if defined(XP_WIN)
+  // The handle associated with the emulated window that contains this document
+  HWND mEmulatedWindowHandle;
+#endif
+
   /*
    * Conceptually this is a map from IDs to proxies, but we store the ID in the
    * proxy object so we can't use a real map.

accessible/ipc/win/DocAccessibleChild.cpp

@@ -18,6 +18,7 @@ static StaticAutoPtr<PlatformChild> sPlatformChild;
 
 DocAccessibleChild::DocAccessibleChild(DocAccessible* aDoc)
   : DocAccessibleChildBase(aDoc)
+  , mEmulatedWindowHandle(nullptr)
   , mIsRemoteConstructed(false)
 {
   MOZ_COUNT_CTOR_INHERITED(DocAccessibleChild, DocAccessibleChildBase);
@@ -45,11 +46,13 @@ DocAccessibleChild::Shutdown()
 }
 
 ipc::IPCResult
-DocAccessibleChild::RecvParentCOMProxy(const IAccessibleHolder& aParentCOMProxy)
+DocAccessibleChild::RecvParentCOMProxy(const IAccessibleHolder& aParentCOMProxy,
+                                       const WindowsHandle& aEmulatedWindowHandle)
 {
   MOZ_ASSERT(!mParentProxy && !aParentCOMProxy.IsNull());
   mParentProxy.reset(const_cast<IAccessibleHolder&>(aParentCOMProxy).Release());
   SetConstructedInParentProcess();
+  mEmulatedWindowHandle = reinterpret_cast<HWND>(aEmulatedWindowHandle);
 
   for (uint32_t i = 0, l = mDeferredEvents.Length(); i < l; ++i) {
     mDeferredEvents[i]->Dispatch();

accessible/ipc/win/DocAccessibleChild.h

@@ -28,7 +28,10 @@ public:
   virtual void Shutdown() override;
 
   virtual ipc::IPCResult
-  RecvParentCOMProxy(const IAccessibleHolder& aParentCOMProxy) override;
+  RecvParentCOMProxy(const IAccessibleHolder& aParentCOMProxy,
+                     const WindowsHandle& aEmulatedWindowHandle) override;
+
+  HWND GetEmulatedWindowHandle() const { return mEmulatedWindowHandle; }
 
   IAccessible* GetParentIAccessible() const { return mParentProxy.get(); }
 
@@ -310,6 +313,7 @@ private:
   bool mIsRemoteConstructed;
   mscom::ProxyUniquePtr<IAccessible> mParentProxy;
   nsTArray<UniquePtr<DeferredEvent>> mDeferredEvents;
+  HWND mEmulatedWindowHandle;
 };
 
 } // namespace a11y

accessible/ipc/win/PDocAccessible.ipdl

@@ -66,7 +66,8 @@ parent:
     returns (IAccessibleHolder aPluginCOMProxy);
 
 child:
-  async ParentCOMProxy(IAccessibleHolder aParentCOMProxy);
+  async ParentCOMProxy(IAccessibleHolder aParentCOMProxy,
+                       WindowsHandle aEmulatedWindowHandle);
 
   async __delete__();
 };

accessible/windows/msaa/AccessibleWrap.cpp

@@ -1399,7 +1399,10 @@ AccessibleWrap::GetIAccessibleFor(const VARIANT& aVarChild, bool* aIsDefunct)
   }
 
   // If the MSAA ID is not a chrome id then we already know that we won't
-  // find it here and should look remotely instead.
+  // find it here and should look remotely instead. This handles the case when
+  // accessible is part of the chrome process and is part of the xul browser
+  // window and the child id points in the content documents. Thus we need to
+  // make sure that it is never called on proxies.
   if (XRE_IsParentProcess() && !IsProxy() && !sIDGen.IsChromeID(varChild.lVal)) {
     return GetRemoteIAccessibleFor(varChild);
   }

accessible/windows/msaa/DocAccessibleWrap.cpp

@@ -120,6 +120,11 @@ DocAccessibleWrap::GetNativeWindow() const
 {
   if (XRE_IsContentProcess()) {
     DocAccessibleChild* ipcDoc = IPCDoc();
+    HWND hWnd = ipcDoc->GetEmulatedWindowHandle();
+    if (hWnd) {
+      return hWnd;
+    }
+
     auto tab = static_cast<dom::TabChild*>(ipcDoc->Manager());
     MOZ_ASSERT(tab);
     return reinterpret_cast<HWND>(tab->GetNativeWindowHandle());

accessible/windows/msaa/Platform.cpp

@@ -85,6 +85,10 @@ a11y::ProxyDestroyed(ProxyAccessible* aProxy)
   if (!wrapper)
     return;
 
+  if (aProxy->IsDoc() && nsWinUtils::IsWindowEmulationStarted()) {
+    aProxy->AsDoc()->SetEmulatedWindowHandle(nullptr);
+  }
+
   wrapper->Shutdown();
   aProxy->SetWrapper(0);
   wrapper->Release();

accessible/windows/msaa/moz.build

@@ -14,6 +14,7 @@ EXPORTS.mozilla.a11y += [
     'HyperTextAccessibleWrap.h',
     'IDSet.h',
     'MsaaIdGenerator.h',
+    'nsWinUtils.h',
 ]
 
 UNIFIED_SOURCES += [

accessible/windows/msaa/nsWinUtils.cpp

@@ -12,6 +12,7 @@
 #include "nsAccessibilityService.h"
 #include "nsCoreUtils.h"
 
+#include "mozilla/a11y/DocAccessibleParent.h"
 #include "mozilla/Preferences.h"
 #include "nsArrayUtils.h"
 #include "nsIArray.h"
@@ -20,6 +21,7 @@
 #include "nsIDocShellTreeItem.h"
 #include "mozilla/dom/Element.h"
 #include "nsXULAppAPI.h"
+#include "ProxyWrappers.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
@@ -153,18 +155,25 @@ WindowProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
       // for details).
       int32_t objId = static_cast<DWORD>(lParam);
       if (objId == OBJID_CLIENT) {
+        IAccessible* msaaAccessible = nullptr;
         DocAccessible* document =
           reinterpret_cast<DocAccessible*>(::GetPropW(hWnd, kPropNameDocAcc));
         if (document) {
-          IAccessible* msaaAccessible = nullptr;
           document->GetNativeInterface((void**)&msaaAccessible); // does an addref
-          if (msaaAccessible) {
-            LRESULT result = ::LresultFromObject(IID_IAccessible, wParam,
-                                                 msaaAccessible); // does an addref
-            msaaAccessible->Release(); // release extra addref
-            return result;
+        } else {
+          DocAccessibleParent* docParent = static_cast<DocAccessibleParent*>(
+            ::GetPropW(hWnd, kPropNameDocAccParent));
+          if (docParent) {
+            auto wrapper = WrapperFor(docParent);
+            wrapper->GetNativeInterface((void**)&msaaAccessible); // does an addref
           }
         }
+        if (msaaAccessible) {
+          LRESULT result = ::LresultFromObject(IID_IAccessible, wParam,
+                                               msaaAccessible); // does an addref
+          msaaAccessible->Release(); // release extra addref
+          return result;
+        }
       }
       return 0;
     }

accessible/windows/msaa/nsWinUtils.h

@@ -23,6 +23,7 @@ class DocAccessible;
 const LPCWSTR kClassNameRoot = L"MozillaUIWindowClass";
 const LPCWSTR kClassNameTabContent = L"MozillaContentWindowClass";
 const LPCWSTR kPropNameDocAcc = L"MozDocAccessible";
+const LPCWSTR kPropNameDocAccParent = L"MozDocAccessibleParent";
 
 class nsWinUtils
 {

browser/base/content/tabbrowser.xml

@@ -4669,8 +4669,15 @@
               label = this.mStringBundle.getString(stringID);
             }
           } else {
-            label = tab.getAttribute("label") +
-                      (this.AppConstants.E10S_TESTING_ONLY && tab.linkedBrowser && tab.linkedBrowser.isRemoteBrowser ? " - e10s" : "");
+            label = tab.getAttribute("label");
+            if (this.AppConstants.E10S_TESTING_ONLY &&
+                tab.linkedBrowser &&
+                tab.linkedBrowser.isRemoteBrowser) {
+              label += " - e10s";
+              if (Services.prefs.getIntPref("dom.ipc.processCount") > 1) {
+                label += " (" + tab.linkedBrowser.frameLoader.tabParent.osPid + ")";
+              }
+            }
             if (tab.userContextId) {
               label = this.mStringBundle.getFormattedString("tabs.containers.tooltip", [label, ContextualIdentityService.getUserContextLabel(tab.userContextId)]);
             }

browser/base/content/test/newtab/browser.ini

@@ -27,7 +27,8 @@ skip-if = (os == "mac" && debug) # temporary skip-if due to increase in intermit
 [browser_newtab_disable.js]
 [browser_newtab_drag_drop.js]
 [browser_newtab_drag_drop_ext.js]
-subsuite = clipboard # temporary until determine why more intermittent on VM
+# temporary until determine why more intermittent on VM
+subsuite = clipboard
 [browser_newtab_drop_preview.js]
 [browser_newtab_enhanced.js]
 [browser_newtab_focus.js]

browser/components/extensions/ext-devtools.js

@@ -24,6 +24,8 @@ const {
 // Map[extension -> DevToolsPageDefinition]
 let devtoolsPageDefinitionMap = new Map();
 
+let initDevTools;
+
 /**
  * Retrieve the devtools target for the devtools extension proxy context
  * (lazily cloned from the target of the toolbox associated to the context
@@ -194,6 +196,8 @@ class DevToolsPage extends HiddenExtensionPage {
  */
 class DevToolsPageDefinition {
   constructor(extension, url) {
+    initDevTools();
+
     this.url = url;
     this.extension = extension;
 
@@ -246,41 +250,50 @@ class DevToolsPageDefinition {
 
 /* eslint-disable mozilla/balanced-listeners */
 
-// Create a devtools page context for a new opened toolbox,
-// based on the registered devtools_page definitions.
-gDevTools.on("toolbox-created", (evt, toolbox) => {
-  if (!toolbox.target.isLocalTab) {
-    // Only local tabs are currently supported (See Bug 1304378 for additional details
-    // related to remote targets support).
-    let msg = `Ignoring DevTools Toolbox for target "${toolbox.target.toString()}": ` +
-              `"${toolbox.target.name}" ("${toolbox.target.url}"). ` +
-              "Only local tab are currently supported by the WebExtensions DevTools API.";
-    let scriptError = Cc["@mozilla.org/scripterror;1"].createInstance(Ci.nsIScriptError);
-    scriptError.init(msg, null, null, null, null, Ci.nsIScriptError.warningFlag, "content javascript");
-    let consoleService = Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIConsoleService);
-    consoleService.logMessage(scriptError);
-
+let devToolsInitialized = false;
+initDevTools = function() {
+  if (devToolsInitialized) {
     return;
   }
 
-  for (let devtoolsPage of devtoolsPageDefinitionMap.values()) {
-    devtoolsPage.buildForToolbox(toolbox);
-  }
-});
+  // Create a devtools page context for a new opened toolbox,
+  // based on the registered devtools_page definitions.
+  gDevTools.on("toolbox-created", (evt, toolbox) => {
+    if (!toolbox.target.isLocalTab) {
+      // Only local tabs are currently supported (See Bug 1304378 for additional details
+      // related to remote targets support).
+      let msg = `Ignoring DevTools Toolbox for target "${toolbox.target.toString()}": ` +
+                `"${toolbox.target.name}" ("${toolbox.target.url}"). ` +
+                "Only local tab are currently supported by the WebExtensions DevTools API.";
+      let scriptError = Cc["@mozilla.org/scripterror;1"].createInstance(Ci.nsIScriptError);
+      scriptError.init(msg, null, null, null, null, Ci.nsIScriptError.warningFlag, "content javascript");
+      let consoleService = Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIConsoleService);
+      consoleService.logMessage(scriptError);
 
-// Destroy a devtools page context for a destroyed toolbox,
-// based on the registered devtools_page definitions.
-gDevTools.on("toolbox-destroy", (evt, target) => {
-  if (!target.isLocalTab) {
-    // Only local tabs are currently supported (See Bug 1304378 for additional details
-    // related to remote targets support).
-    return;
-  }
+      return;
+    }
 
-  for (let devtoolsPageDefinition of devtoolsPageDefinitionMap.values()) {
-    devtoolsPageDefinition.shutdownForTarget(target);
-  }
-});
+    for (let devtoolsPage of devtoolsPageDefinitionMap.values()) {
+      devtoolsPage.buildForToolbox(toolbox);
+    }
+  });
+
+  // Destroy a devtools page context for a destroyed toolbox,
+  // based on the registered devtools_page definitions.
+  gDevTools.on("toolbox-destroy", (evt, target) => {
+    if (!target.isLocalTab) {
+      // Only local tabs are currently supported (See Bug 1304378 for additional details
+      // related to remote targets support).
+      return;
+    }
+
+    for (let devtoolsPageDefinition of devtoolsPageDefinitionMap.values()) {
+      devtoolsPageDefinition.shutdownForTarget(target);
+    }
+  });
+
+  devToolsInitialized = true;
+};
 
 // Create and register a new devtools_page definition as specified in the
 // "devtools_page" property in the extension manifest.

browser/installer/package-manifest.in

@@ -233,7 +233,6 @@
 @RESPATH@/components/gfx.xpt
 @RESPATH@/components/html5.xpt
 @RESPATH@/components/htmlparser.xpt
-@RESPATH@/components/identity.xpt
 @RESPATH@/components/imglib2.xpt
 @RESPATH@/components/inspector.xpt
 @RESPATH@/components/intl.xpt

caps/nsNullPrincipalURI.cpp

@@ -98,6 +98,8 @@ nsNullPrincipalURI::GetAsciiSpec(nsACString &_spec)
   nsAutoCString buffer;
   // Ignore the return value -- nsNullPrincipalURI::GetSpec() is infallible.
   Unused << GetSpec(buffer);
+  // This uses the infallible version of |NS_EscapeURL| as |GetSpec| is
+  // already infallible.
   NS_EscapeURL(buffer, esc_OnlyNonASCII | esc_AlwaysCopy, _spec);
   return NS_OK;
 }

docshell/base/nsDocShell.cpp

@@ -756,6 +756,8 @@ DecreasePrivateDocShellCount()
 nsDocShell::nsDocShell()
   : nsDocLoader()
   , mDefaultScrollbarPref(Scrollbar_Auto, Scrollbar_Auto)
+  , mReferrerPolicy(0)
+  , mFailedLoadType(0)
   , mTreeOwner(nullptr)
   , mChromeEventHandler(nullptr)
   , mCharsetReloadState(eCharsetReloadInit)
@@ -805,6 +807,7 @@ nsDocShell::nsDocShell()
   , mIsExecutingOnLoadHandler(false)
   , mIsPrintingOrPP(false)
   , mSavingOldViewer(false)
+  , mDynamicallyCreated(false)
   , mAffectPrivateSessionLifetime(true)
   , mInvisible(false)
   , mHasLoadedNonBlankURI(false)

docshell/base/nsDocShell.h

@@ -158,8 +158,6 @@ public:
 
   nsDocShell();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   virtual nsresult Init() override;
 
   NS_DECL_ISUPPORTS_INHERITED

dom/base/nsDOMMutationObserver.h

@@ -237,14 +237,37 @@ public:
   
 protected:
   nsMutationReceiverBase(nsINode* aTarget, nsDOMMutationObserver* aObserver)
-  : mTarget(aTarget), mObserver(aObserver), mRegisterTarget(aTarget)
+    : mTarget(aTarget)
+    , mObserver(aObserver)
+    , mRegisterTarget(aTarget)
+    , mSubtree(false)
+    , mChildList(false)
+    , mCharacterData(false)
+    , mCharacterDataOldValue(false)
+    , mNativeAnonymousChildList(false)
+    , mAttributes(false)
+    , mAllAttributes(false)
+    , mAttributeOldValue(false)
+    , mAnimations(false)
   {
   }
 
   nsMutationReceiverBase(nsINode* aRegisterTarget,
                          nsMutationReceiverBase* aParent)
-  : mTarget(nullptr), mObserver(nullptr), mParent(aParent),
-    mRegisterTarget(aRegisterTarget), mKungFuDeathGrip(aParent->Target())
+    : mTarget(nullptr)
+    , mObserver(nullptr)
+    , mParent(aParent)
+    , mRegisterTarget(aRegisterTarget)
+    , mKungFuDeathGrip(aParent->Target())
+    , mSubtree(false)
+    , mChildList(false)
+    , mCharacterData(false)
+    , mCharacterDataOldValue(false)
+    , mNativeAnonymousChildList(false)
+    , mAttributes(false)
+    , mAllAttributes(false)
+    , mAttributeOldValue(false)
+    , mAnimations(false)
   {
     NS_ASSERTION(mParent->Subtree(), "Should clone a non-subtree observer!");
   }
@@ -369,7 +392,6 @@ public:
 
   void Disconnect(bool aRemoveFromObserver);
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
   NS_DECL_ISUPPORTS
 
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTEWILLCHANGE

dom/base/nsDocument.cpp

@@ -1283,27 +1283,91 @@ nsIDocument::nsIDocument()
     mUpgradeInsecureRequests(false),
     mUpgradeInsecurePreloads(false),
     mCharacterSet(NS_LITERAL_CSTRING("ISO-8859-1")),
+    mCharacterSetSource(0),
+    mParentDocument(nullptr),
+    mCachedRootElement(nullptr),
     mNodeInfoManager(nullptr),
+    mBidiEnabled(false),
+    mMathMLEnabled(false),
     mIsInitialDocumentInWindow(false),
+    mLoadedAsData(false),
+    mLoadedAsInteractiveData(false),
     mMayStartLayout(true),
+    mHaveFiredTitleChange(false),
+    mIsShowing(false),
     mVisible(true),
+    mHasReferrerPolicyCSP(false),
     mRemovedFromDocShell(false),
     // mAllowDNSPrefetch starts true, so that we can always reliably && it
     // with various values that might disable it.  Since we never prefetch
     // unless we get a window, and in that case the docshell value will get
     // &&-ed in, this is safe.
     mAllowDNSPrefetch(true),
+    mIsStaticDocument(false),
+    mCreatingStaticClone(false),
+    mInUnlinkOrDeletion(false),
+    mHasHadScriptHandlingObject(false),
     mIsBeingUsedAsImage(false),
+    mIsSyntheticDocument(false),
     mHasLinksToUpdate(false),
+    mNeedLayoutFlush(false),
+    mNeedStyleFlush(false),
+    mMayHaveDOMMutationObservers(false),
+    mMayHaveAnimationObservers(false),
+    mHasMixedActiveContentLoaded(false),
+    mHasMixedActiveContentBlocked(false),
+    mHasMixedDisplayContentLoaded(false),
+    mHasMixedDisplayContentBlocked(false),
+    mHasMixedContentObjectSubrequest(false),
+    mHasCSP(false),
+    mHasUnsafeEvalCSP(false),
+    mHasUnsafeInlineCSP(false),
+    mHasTrackingContentBlocked(false),
+    mHasTrackingContentLoaded(false),
+    mBFCacheDisallowed(false),
+    mHasHadDefaultView(false),
+    mStyleSheetChangeEventsEnabled(false),
+    mIsSrcdocDocument(false),
+    mDidDocumentOpen(false),
+    mHasDisplayDocument(false),
     mFontFaceSetDirty(true),
     mGetUserFontSetCalled(false),
     mPostedFlushUserFontSet(false),
+    mEverInForeground(false),
     mCompatMode(eCompatibility_FullStandards),
+    mReadyState(ReadyState::READYSTATE_UNINITIALIZED),
+    mStyleBackendType(mozilla::StyleBackendType::Gecko),
+#ifdef MOZILLA_INTERNAL_API
     mVisibilityState(dom::VisibilityState::Hidden),
+#else
+    mDummy(0),
+#endif
+    mType(eUnknown),
+    mDefaultElementType(0),
+    mAllowXULXBL(eTriUnset),
+#ifdef DEBUG
+    mIsLinkUpdateRegistrationsForbidden(false),
+#endif
     mBidiOptions(IBMBIDI_DEFAULT_BIDI_OPTIONS),
+    mSandboxFlags(0),
     mPartID(0),
+    mMarkedCCGeneration(0),
+    mPresShell(nullptr),
+    mSubtreeModifiedDepth(0),
+    mEventsSuppressed(0),
+    mAnimationsPaused(0),
+    mExternalScriptsBeingEvaluated(0),
+    mFrameRequestCallbackCounter(0),
+    mStaticCloneCount(0),
+    mWindow(nullptr),
+    mBFCacheEntry(nullptr),
+    mInSyncOperationCount(0),
+    mBlockDOMContentLoaded(0),
     mDidFireDOMContentLoaded(true),
     mHasScrollLinkedEffect(false),
+    mUseCounters(0),
+    mChildDocumentUseCounters(0),
+    mNotifiedPageForUseCounter(0),
     mUserHasInteracted(false)
 {
   SetIsInDocument();
@@ -1311,12 +1375,54 @@ nsIDocument::nsIDocument()
   PR_INIT_CLIST(&mDOMMediaQueryLists);
 }
 
-// NOTE! nsDocument::operator new() zeroes out all members, so don't
-// bother initializing members to 0.
-
 nsDocument::nsDocument(const char* aContentType)
   : nsIDocument()
+  , mIsTopLevelContentDocument(false)
+  , mIsContentDocument(false)
+  , mSubDocuments(nullptr)
+  , mHeaderData(nullptr)
+  , mIsGoingAway(false)
+  , mInDestructor(false)
+  , mMayHaveTitleElement(false)
+  , mHasWarnedAboutBoxObjects(false)
+  , mDelayFrameLoaderInitialization(false)
+  , mSynchronousDOMContentLoaded(false)
+  , mInXBLUpdate(false)
+  , mInFlush(false)
+  , mParserAborted(false)
+  , mCurrentOrientationAngle(0)
+  , mCurrentOrientationType(OrientationType::Portrait_primary)
+  , mSSApplicableStateNotificationPending(false)
+  , mReportedUseCounters(false)
+  , mStyleSetFilled(false)
+  , mPendingFullscreenRequests(0)
+  , mXMLDeclarationBits(0)
+  , mBoxObjectTable(nullptr)
+  , mUpdateNestLevel(0)
+  , mOnloadBlockCount(0)
+  , mAsyncOnloadBlockCount(0)
+#ifdef DEBUG
+  , mStyledLinksCleared(false)
+#endif
+  , mPreloadPictureDepth(0)
+  , mScrolledToRefAlready(0)
+  , mChangeScrollPosWhenScrollingToRef(0)
   , mViewportType(Unknown)
+  , mValidWidth(false)
+  , mValidHeight(false)
+  , mAutoSize(false)
+  , mAllowZoom(false)
+  , mAllowDoubleTapZoom(false)
+  , mValidScaleFloat(false)
+  , mValidMaxScale(false)
+  , mScaleStrEmpty(false)
+  , mWidthStrEmpty(false)
+  , mStackRefCnt(0)
+  , mNeedsReleaseAfterStackRefCntRelease(false)
+  , mMaybeServiceWorkerControlled(false)
+#ifdef DEBUG
+  , mWillReparent(false)
+#endif
 {
   SetContentTypeInternal(nsDependentCString(aContentType));
 

dom/base/nsIDocument.h

@@ -9,7 +9,6 @@
 #include "mozilla/FlushType.h"           // for enum
 #include "nsAutoPtr.h"                   // for member
 #include "nsCOMArray.h"                  // for member
-#include "nsCRT.h"                       // for NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
 #include "nsCompatibility.h"             // for member
 #include "nsCOMPtr.h"                    // for member
 #include "nsGkAtoms.h"                   // for static class members
@@ -217,7 +216,6 @@ public:
   typedef mozilla::dom::FullscreenRequest FullscreenRequest;
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IDOCUMENT_IID)
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
 
 #ifdef MOZILLA_INTERNAL_API
   nsIDocument();

dom/bindings/Configuration.py

@@ -45,7 +45,8 @@ class Configuration(DescriptorProvider):
                 # Our build system doesn't support dep build involving
                 # addition/removal of "implements" statements that appear in a
                 # different .webidl file than their LHS interface.  Make sure we
-                # don't have any of those.
+                # don't have any of those.  See similar block below for partial
+                # interfaces!
                 #
                 # But whitelist a RHS that is LegacyQueryInterface,
                 # since people shouldn't be adding any of those.
@@ -66,6 +67,33 @@ class Configuration(DescriptorProvider):
             if not thing.isInterface() and not thing.isNamespace():
                 continue
             iface = thing
+            # Our build system doesn't support dep builds involving
+            # addition/removal of partial interfaces that appear in a different
+            # .webidl file than the interface they are extending.  Make sure we
+            # don't have any of those.  See similar block above for "implements"
+            # statements!
+            if not iface.isExternal():
+                for partialIface in iface.getPartialInterfaces():
+                    if (partialIface.filename() != iface.filename() and
+                        # Unfortunately, NavigatorProperty does exactly the
+                        # thing we're trying to prevent here.  I'm not sure how
+                        # to deal with that, short of effectively requiring a
+                        # clobber when NavigatorProperty is added/removed and
+                        # whitelisting the things it outputs here as
+                        # restrictively as I can.
+                        (partialIface.identifier.name != "Navigator" or
+                         len(partialIface.members) != 1 or
+                         partialIface.members[0].location != partialIface.location or
+                         partialIface.members[0].identifier.location.filename() !=
+                           "<builtin>")):
+                        raise TypeError(
+                            "The binding build system doesn't really support "
+                            "partial interfaces which don't appear in the "
+                            "file in which the interface they are extending is "
+                            "defined.  Don't do this.\n"
+                            "%s\n"
+                            "%s" %
+                            (partialIface.location, iface.location))
             self.interfaces[iface.identifier.name] = iface
             if iface.identifier.name not in config:
                 # Completely skip consequential interfaces with no descriptor

dom/bindings/parser/WebIDL.py

@@ -1480,6 +1480,10 @@ class IDLInterfaceOrNamespace(IDLObjectWithScope, IDLExposureMixins):
         assert self.identifier.name == partial.identifier.name
         self._partialInterfaces.append(partial)
 
+    def getPartialInterfaces(self):
+        # Don't let people mutate our guts.
+        return list(self._partialInterfaces)
+
     def getJSImplementation(self):
         classId = self.getExtendedAttribute("JSImplementation")
         if not classId:

dom/html/HTMLFormSubmission.cpp

@@ -282,8 +282,12 @@ HandleMailtoSubject(nsCString& aPath)
       return;
     aPath.AppendLiteral("subject=");
     nsCString subjectStrEscaped;
-    aPath.Append(NS_EscapeURL(NS_ConvertUTF16toUTF8(subjectStr), esc_Query,
-                              subjectStrEscaped));
+    rv = NS_EscapeURL(NS_ConvertUTF16toUTF8(subjectStr), esc_Query,
+                      subjectStrEscaped, mozilla::fallible);
+    if (NS_FAILED(rv))
+      return;
+
+    aPath.Append(subjectStrEscaped);
   }
 }
 

dom/html/ImageDocument.cpp

@@ -136,11 +136,21 @@ ImageListener::OnStopRequest(nsIRequest* aRequest, nsISupports* aCtxt, nsresult
 }
 
 ImageDocument::ImageDocument()
-  : MediaDocument(),
-    mOriginalZoomLevel(1.0)
+  : MediaDocument()
+  , mVisibleWidth(0.0)
+  , mVisibleHeight(0.0)
+  , mImageWidth(0)
+  , mImageHeight(0)
+  , mResizeImageByDefault(false)
+  , mClickResizingEnabled(false)
+  , mImageIsOverflowingHorizontally(false)
+  , mImageIsOverflowingVertically(false)
+  , mImageIsResized(false)
+  , mShouldResize(false)
+  , mFirstResize(false)
+  , mObservingImageLoader(false)
+  , mOriginalZoomLevel(1.0)
 {
-  // NOTE! nsDocument::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
 }
 
 ImageDocument::~ImageDocument()

dom/html/PluginDocument.cpp

@@ -102,9 +102,6 @@ PluginStreamListener::OnStartRequest(nsIRequest* request, nsISupports *ctxt)
   return MediaDocumentStreamListener::OnStartRequest(request, ctxt);
 }
 
-  // NOTE! nsDocument::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
-
 PluginDocument::PluginDocument()
 {}
 

dom/html/nsHTMLContentSink.cpp

@@ -121,8 +121,6 @@ public:
 
   HTMLContentSink();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   nsresult Init(nsIDocument* aDoc, nsIURI* aURI, nsISupports* aContainer,
                 nsIChannel* aChannel);
 
@@ -633,8 +631,12 @@ NS_NewHTMLContentSink(nsIHTMLContentSink** aResult,
 }
 
 HTMLContentSink::HTMLContentSink()
+  : mMaxTextRun(0)
+  , mCurrentContext(nullptr)
+  , mHeadContext(nullptr)
+  , mHaveSeenHead(false)
+  , mNotifiedRootInsertion(false)
 {
-  // Note: operator new zeros our memory
 }
 
 HTMLContentSink::~HTMLContentSink()

dom/html/nsHTMLDocument.cpp

@@ -169,15 +169,19 @@ NS_NewHTMLDocument(nsIDocument** aInstancePtrResult, bool aLoadedAsData)
   return NS_OK;
 }
 
-  // NOTE! nsDocument::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
-
 nsHTMLDocument::nsHTMLDocument()
   : nsDocument("text/html")
+  , mNumForms(0)
+  , mWriteLevel(0)
+  , mLoadFlags(0)
+  , mTooDeepWriteRecursion(false)
+  , mDisableDocWrite(false)
+  , mWarnedWidthHeight(false)
+  , mContentEditableCount(0)
+  , mEditingState(EditingState::eOff)
+  , mDisableCookieAccess(false)
+  , mPendingMaybeEditingStateChanged(false)
 {
-  // NOTE! nsDocument::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
-
   mType = eHTML;
   mDefaultElementType = kNameSpaceID_XHTML;
   mCompatMode = eCompatibility_NavQuirks;

dom/ipc/TabChild.cpp

@@ -3013,14 +3013,15 @@ TabChild::ReinitRendering()
 }
 
 void
-TabChild::CompositorUpdated(const TextureFactoryIdentifier& aNewIdentifier)
+TabChild::CompositorUpdated(const TextureFactoryIdentifier& aNewIdentifier,
+                            uint64_t aDeviceResetSeqNo)
 {
   RefPtr<LayerManager> lm = mPuppetWidget->GetLayerManager();
   ClientLayerManager* clm = lm->AsClientLayerManager();
   MOZ_ASSERT(clm);
 
   mTextureFactoryIdentifier = aNewIdentifier;
-  clm->UpdateTextureFactoryIdentifier(aNewIdentifier);
+  clm->UpdateTextureFactoryIdentifier(aNewIdentifier, aDeviceResetSeqNo);
   FrameLayerBuilder::InvalidateAllLayers(clm);
 }
 

dom/ipc/TabChild.h

@@ -566,7 +566,8 @@ public:
   void ClearCachedResources();
   void InvalidateLayers();
   void ReinitRendering();
-  void CompositorUpdated(const TextureFactoryIdentifier& aNewIdentifier);
+  void CompositorUpdated(const TextureFactoryIdentifier& aNewIdentifier,
+                         uint64_t aDeviceResetSeqNo);
 
   static inline TabChild* GetFrom(nsIDOMWindow* aWindow)
   {

dom/ipc/TabParent.cpp

@@ -102,6 +102,7 @@
 
 #if defined(XP_WIN) && defined(ACCESSIBILITY)
 #include "mozilla/a11y/AccessibleWrap.h"
+#include "mozilla/a11y/nsWinUtils.h"
 #endif
 
 using namespace mozilla::dom;
@@ -269,6 +270,16 @@ TabParent::SetOwnerElement(Element* aElement)
         reinterpret_cast<uintptr_t>(widget->GetNativeData(NS_NATIVE_WINDOW));
     }
     Unused << SendUpdateNativeWindowHandle(newWindowHandle);
+    a11y::DocAccessibleParent* doc = GetTopLevelDocAccessible();
+    if (doc) {
+      HWND hWnd = reinterpret_cast<HWND>(doc->GetEmulatedWindowHandle());
+      if (hWnd) {
+        HWND parentHwnd = reinterpret_cast<HWND>(newWindowHandle);
+        if (parentHwnd != ::GetParent(hWnd)) {
+          ::SetParent(hWnd, parentHwnd);
+        }
+      }
+    }
   }
 #endif
 
@@ -921,6 +932,9 @@ TabParent::RecvPDocAccessibleConstructor(PDocAccessibleParent* aDoc,
     MOZ_ASSERT(aDocCOMProxy.IsNull());
     if (added) {
       a11y::WrapperFor(doc)->SetID(aMsaaID);
+      if (a11y::nsWinUtils::IsWindowEmulationStarted()) {
+        doc->SetEmulatedWindowHandle(parentDoc->GetEmulatedWindowHandle());
+      }
     }
 #endif
     if (!added) {

dom/jsurl/nsJSProtocolHandler.cpp

@@ -1145,8 +1145,12 @@ nsJSProtocolHandler::EnsureUTF8Spec(const nsAFlatCString &aSpec, const char *aCh
   rv = mTextToSubURI->UnEscapeNonAsciiURI(nsDependentCString(aCharset), aSpec, uStr);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (!IsASCII(uStr))
-    NS_EscapeURL(NS_ConvertUTF16toUTF8(uStr), esc_AlwaysCopy | esc_OnlyNonASCII, aUTF8Spec);
+  if (!IsASCII(uStr)) {
+    rv = NS_EscapeURL(NS_ConvertUTF16toUTF8(uStr),
+                      esc_AlwaysCopy | esc_OnlyNonASCII, aUTF8Spec,
+                      mozilla::fallible);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   return NS_OK;
 }

dom/plugins/base/nsPluginHost.cpp

@@ -265,8 +265,10 @@ static bool UnloadPluginsASAP()
 }
 
 nsPluginHost::nsPluginHost()
-  // No need to initialize members to nullptr, false etc because this class
-  // has a zeroing operator new.
+  : mPluginsLoaded(false)
+  , mOverrideInternalTypes(false)
+  , mPluginsDisabled(false)
+  , mPluginEpoch(0)
 {
   // Bump the pluginchanged epoch on startup. This insures content gets a
   // good plugin list the first time it requests it. Normally we'd just

dom/plugins/base/nsPluginHost.h

@@ -85,8 +85,6 @@ public:
 
   static already_AddRefed<nsPluginHost> GetInst();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   NS_DECL_ISUPPORTS
   NS_DECL_NSIPLUGINHOST
   NS_DECL_NSIOBSERVER

dom/quota/ActorsParent.cpp

@@ -3396,11 +3396,13 @@ QuotaManager::GetQuotaObject(PersistenceType aPersistenceType,
   }
 
   // Re-escape our parameters above to make sure we get the right quota group.
-  nsAutoCString tempStorage1;
-  const nsCSubstring& group = NS_EscapeURL(aGroup, esc_Query, tempStorage1);
+  nsAutoCString group;
+  rv = NS_EscapeURL(aGroup, esc_Query, group, fallible);
+  NS_ENSURE_SUCCESS(rv, nullptr);
 
-  nsAutoCString tempStorage2;
-  const nsCSubstring& origin = NS_EscapeURL(aOrigin, esc_Query, tempStorage2);
+  nsAutoCString origin;
+  rv = NS_EscapeURL(aOrigin, esc_Query, origin, fallible);
+  NS_ENSURE_SUCCESS(rv, nullptr);
 
   RefPtr<QuotaObject> result;
   {

dom/storage/StorageObserver.cpp

@@ -264,9 +264,11 @@ StorageObserver::Observe(nsISupports* aSubject,
     } else {
       // In case the IDN service is not available, this is the best we can come
       // up with!
-      NS_EscapeURL(NS_ConvertUTF16toUTF8(aData),
-                   esc_OnlyNonASCII | esc_AlwaysCopy,
-                   aceDomain);
+      rv = NS_EscapeURL(NS_ConvertUTF16toUTF8(aData),
+                        esc_OnlyNonASCII | esc_AlwaysCopy,
+                        aceDomain,
+                        fallible);
+      NS_ENSURE_SUCCESS(rv, rv);
     }
 
     nsAutoCString originScope;

dom/webbrowserpersist/nsWebBrowserPersist.cpp

@@ -2546,8 +2546,8 @@ nsWebBrowserPersist::URIData::GetLocalURI(nsIURI *targetBaseURI, nsCString& aSpe
             nsAutoCString rawPathURL(mRelativePathToData);
             rawPathURL.Append(filename);
             
-            nsAutoCString buf;
-            aSpecOut = NS_EscapeURL(rawPathURL, esc_FilePath, buf);
+            rv = NS_EscapeURL(rawPathURL, esc_FilePath, aSpecOut, fallible);
+            NS_ENSURE_SUCCESS(rv, rv);
         } else {
             nsAutoCString rawPathURL;
             
@@ -2566,8 +2566,8 @@ nsWebBrowserPersist::URIData::GetLocalURI(nsIURI *targetBaseURI, nsCString& aSpe
             rv = dataFile->GetRelativePath(parentDir, rawPathURL);
             NS_ENSURE_SUCCESS(rv, rv);
             
-            nsAutoCString buf;
-            aSpecOut = NS_EscapeURL(rawPathURL, esc_FilePath, buf);
+            rv = NS_EscapeURL(rawPathURL, esc_FilePath, aSpecOut, fallible);
+            NS_ENSURE_SUCCESS(rv, rv);
         }
     } else {
         fileAsURI->GetSpec(aSpecOut);

dom/webidl/BrowserElement.webidl

@@ -171,3 +171,51 @@ interface BrowserElementPrivileged {
   DOMRequest getWebManifest();
 
 };
+
+// Bits needed for BrowserElementAudioChannel.
+partial interface BrowserElementPrivileged {
+  [Pure, Cached, Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  readonly attribute sequence<BrowserElementAudioChannel> allowedAudioChannels;
+
+  /**
+   * Mutes all audio in this browser.
+   */
+  [Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  void mute();
+
+  /**
+   * Unmutes all audio in this browser.
+   */
+  [Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  void unmute();
+
+  /**
+   * Obtains whether or not the browser is muted.
+   */
+  [Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  DOMRequest getMuted();
+
+  /**
+   * Sets the volume for the browser.
+   */
+  [Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  void setVolume(float volume);
+
+  /**
+   * Gets the volume for the browser.
+   */
+  [Throws,
+   Pref="dom.mozBrowserFramesEnabled",
+   ChromeOnly]
+  DOMRequest getVolume();
+};

dom/webidl/BrowserElementAudioChannel.webidl

@@ -28,50 +28,3 @@ interface BrowserElementAudioChannel : EventTarget {
   [Throws]
   DOMRequest isActive();
 };
-
-partial interface BrowserElementPrivileged {
-  [Pure, Cached, Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  readonly attribute sequence<BrowserElementAudioChannel> allowedAudioChannels;
-
-  /**
-   * Mutes all audio in this browser.
-   */
-  [Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  void mute();
-
-  /**
-   * Unmutes all audio in this browser.
-   */
-  [Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  void unmute();
-
-  /**
-   * Obtains whether or not the browser is muted.
-   */
-  [Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  DOMRequest getMuted();
-
-  /**
-   * Sets the volume for the browser.
-   */
-  [Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  void setVolume(float volume);
-
-  /**
-   * Gets the volume for the browser.
-   */
-  [Throws,
-   Pref="dom.mozBrowserFramesEnabled",
-   ChromeOnly]
-  DOMRequest getVolume();
-};

dom/webidl/Notification.webidl

@@ -4,7 +4,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * The origin of this IDL file is
- * http://notifications.spec.whatwg.org/
+ * https://notifications.spec.whatwg.org/
  *
  * Copyright:
  * To the extent possible under law, the editors have waived all copyright and
@@ -96,10 +96,3 @@ enum NotificationDirection {
   "ltr",
   "rtl"
 };
-
-partial interface ServiceWorkerRegistration {
-  [Throws, Func="mozilla::dom::ServiceWorkerRegistration::NotificationAPIVisible"]
-  Promise<void> showNotification(DOMString title, optional NotificationOptions options);
-  [Throws, Func="mozilla::dom::ServiceWorkerRegistration::NotificationAPIVisible"]
-  Promise<sequence<Notification>> getNotifications(optional GetNotificationOptions filter);
-};

dom/webidl/NotificationEvent.webidl

@@ -20,8 +20,3 @@ interface NotificationEvent : ExtendableEvent {
 dictionary NotificationEventInit : ExtendableEventInit {
   required Notification notification;
 };
-
-partial interface ServiceWorkerGlobalScope {
-  attribute EventHandler onnotificationclick;
-  attribute EventHandler onnotificationclose;
-};

dom/webidl/ServiceWorkerGlobalScope.webidl

@@ -5,6 +5,8 @@
  *
  * The origin of this IDL file is
  * http://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html
+ * http://w3c.github.io/push-api/
+ * https://notifications.spec.whatwg.org/
  *
  * You are granted a license to use, reproduce and create derivative works of
  * this document.
@@ -34,3 +36,8 @@ partial interface ServiceWorkerGlobalScope {
   attribute EventHandler onpushsubscriptionchange;
 };
 
+// https://notifications.spec.whatwg.org/
+partial interface ServiceWorkerGlobalScope {
+  attribute EventHandler onnotificationclick;
+  attribute EventHandler onnotificationclose;
+};

dom/webidl/ServiceWorkerRegistration.webidl

@@ -5,7 +5,8 @@
  *
  * The origin of this IDL file is
  * http://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html
- *
+ * https://w3c.github.io/push-api/
+ * https://notifications.spec.whatwg.org/
  */
 
 [Func="mozilla::dom::ServiceWorkerRegistration::Visible",
@@ -27,7 +28,16 @@ interface ServiceWorkerRegistration : EventTarget {
   attribute EventHandler onupdatefound;
 };
 
+// https://w3c.github.io/push-api/
 partial interface ServiceWorkerRegistration {
   [Throws, Exposed=(Window,Worker), Func="nsContentUtils::PushEnabled"]
   readonly attribute PushManager pushManager;
 };
+
+// https://notifications.spec.whatwg.org/
+partial interface ServiceWorkerRegistration {
+  [Throws, Func="mozilla::dom::ServiceWorkerRegistration::NotificationAPIVisible"]
+  Promise<void> showNotification(DOMString title, optional NotificationOptions options);
+  [Throws, Func="mozilla::dom::ServiceWorkerRegistration::NotificationAPIVisible"]
+  Promise<sequence<Notification>> getNotifications(optional GetNotificationOptions filter);
+};

dom/workers/RuntimeService.cpp

@@ -301,6 +301,7 @@ LoadContextOptions(const char* aPrefName, void* /* aClosure */)
   JS::ContextOptions contextOptions;
   contextOptions.setAsmJS(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asmjs")))
                 .setWasm(GetWorkerPref<bool>(NS_LITERAL_CSTRING("wasm")))
+                .setWasmAlwaysBaseline(GetWorkerPref<bool>(NS_LITERAL_CSTRING("wasm_baselinejit")))
                 .setThrowOnAsmJSValidationFailure(GetWorkerPref<bool>(
                       NS_LITERAL_CSTRING("throw_on_asmjs_validation_failure")))
                 .setBaseline(GetWorkerPref<bool>(NS_LITERAL_CSTRING("baselinejit")))
@@ -1470,13 +1471,25 @@ IsCurrentThreadRunningChromeWorker()
 JSContext*
 GetCurrentThreadJSContext()
 {
-  return GetCurrentThreadWorkerPrivate()->GetJSContext();
+  WorkerPrivate* wp = GetCurrentThreadWorkerPrivate();
+  if (!wp) {
+    return nullptr;
+  }
+  return wp->GetJSContext();
 }
 
 JSObject*
 GetCurrentThreadWorkerGlobal()
 {
-  return GetCurrentThreadWorkerPrivate()->GlobalScope()->GetGlobalJSObject();
+  WorkerPrivate* wp = GetCurrentThreadWorkerPrivate();
+  if (!wp) {
+    return nullptr;
+  }
+  WorkerGlobalScope* scope = wp->GlobalScope();
+  if (!scope) {
+    return nullptr;
+  }
+  return scope->GetGlobalJSObject();
 }
 
 END_WORKERS_NAMESPACE

dom/workers/ServiceWorkerClients.cpp

@@ -625,6 +625,7 @@ private:
   nsresult
   OpenWindow(nsPIDOMWindowOuter** aWindow)
   {
+    MOZ_DIAGNOSTIC_ASSERT(aWindow);
     WorkerPrivate* workerPrivate = mPromiseProxy->GetWorkerPrivate();
 
     // [[1. Let url be the result of parsing url with entry settings object's API
@@ -661,24 +662,31 @@ private:
       NS_ENSURE_STATE(pwwatch);
 
       nsCString spec;
-      uri->GetSpec(spec);
+      rv = uri->GetSpec(spec);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
 
       nsCOMPtr<mozIDOMWindowProxy> newWindow;
-      pwwatch->OpenWindow2(nullptr,
-                           spec.get(),
-                           nullptr,
-                           nullptr,
-                           false, false, true, nullptr,
-                           // Not a spammy popup; we got permission, we swear!
-                           /* aIsPopupSpam = */ false,
-                           // Don't force noopener.  We're not passing in an
-                           // opener anyway, and we _do_ want the returned
-                           // window.
-                           /* aForceNoOpener = */ false,
-                           /* aLoadInfp = */ nullptr,
-                           getter_AddRefs(newWindow));
+      rv = pwwatch->OpenWindow2(nullptr,
+                                spec.get(),
+                                nullptr,
+                                nullptr,
+                                false, false, true, nullptr,
+                                // Not a spammy popup; we got permission, we swear!
+                                /* aIsPopupSpam = */ false,
+                                // Don't force noopener.  We're not passing in an
+                                // opener anyway, and we _do_ want the returned
+                                // window.
+                                /* aForceNoOpener = */ false,
+                                /* aLoadInfp = */ nullptr,
+                                getter_AddRefs(newWindow));
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
       nsCOMPtr<nsPIDOMWindowOuter> pwindow = nsPIDOMWindowOuter::From(newWindow);
       pwindow.forget(aWindow);
+      MOZ_DIAGNOSTIC_ASSERT(*aWindow);
       return NS_OK;
     }
 
@@ -716,6 +724,7 @@ private:
 
     nsCOMPtr<nsPIDOMWindowOuter> pWin = nsPIDOMWindowOuter::From(win);
     pWin.forget(aWindow);
+    MOZ_DIAGNOSTIC_ASSERT(*aWindow);
 
     return NS_OK;
   }

dom/xbl/nsXBLContentSink.h

@@ -60,8 +60,6 @@ public:
   nsXBLContentSink();
   ~nsXBLContentSink();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   nsresult Init(nsIDocument* aDoc,
                 nsIURI* aURL,
                 nsISupports* aContainer);

dom/xml/XMLDocument.cpp

@@ -229,11 +229,13 @@ namespace dom {
 
 XMLDocument::XMLDocument(const char* aContentType)
   : nsDocument(aContentType),
-    mAsync(true)
+    mChannelIsPending(false),
+    mAsync(true),
+    mLoopingForSyncLoad(false),
+    mIsPlainDocument(false),
+    mSuppressParserErrorElement(false),
+    mSuppressParserErrorConsoleMessages(false)
 {
-  // NOTE! nsDocument::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
-
   mType = eGenericXML;
 }
 

dom/xml/nsXMLFragmentContentSink.cpp

@@ -37,8 +37,6 @@ class nsXMLFragmentContentSink : public nsXMLContentSink,
 public:
   nsXMLFragmentContentSink();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsXMLFragmentContentSink,

dom/xul/XULDocument.cpp

@@ -190,13 +190,26 @@ namespace dom {
 
 XULDocument::XULDocument(void)
     : XMLDocument("application/vnd.mozilla.xul+xml"),
+      mNextSrcLoadWaiter(nullptr),
+      mApplyingPersistedAttrs(false),
+      mIsWritingFastLoad(false),
+      mDocumentLoaded(false),
+      mStillWalking(false),
+      mRestrictPersistence(false),
+      mTemplateBuilderTable(nullptr),
+      mPendingSheets(0),
       mDocLWTheme(Doc_Theme_Uninitialized),
       mState(eState_Master),
-      mResolutionPhase(nsForwardReference::eStart)
+      mCurrentScriptProto(nullptr),
+      mOffThreadCompiling(false),
+      mOffThreadCompileStringBuf(nullptr),
+      mOffThreadCompileStringLength(0),
+      mResolutionPhase(nsForwardReference::eStart),
+      mBroadcasterMap(nullptr),
+      mInitialLayoutComplete(false),
+      mHandlingDelayedAttrChange(false),
+      mHandlingDelayedBroadcasters(false)
 {
-    // NOTE! nsDocument::operator new() zeroes out all members, so don't
-    // bother initializing members to 0.
-
     // Override the default in nsDocument
     mCharacterSet.AssignLiteral("UTF-8");
 

gfx/layers/client/ClientLayerManager.cpp

@@ -100,11 +100,15 @@ ClientLayerManager::ClientLayerManager(nsIWidget* aWidget)
   , mCompositorMightResample(false)
   , mNeedsComposite(false)
   , mPaintSequenceNumber(0)
+  , mDeviceResetSequenceNumber(0)
   , mForwarder(new ShadowLayerForwarder(this))
-  , mDeviceCounter(gfxPlatform::GetPlatform()->GetDeviceCounter())
 {
   MOZ_COUNT_CTOR(ClientLayerManager);
   mMemoryPressureObserver = new MemoryPressureObserver(this);
+
+  if (XRE_IsContentProcess()) {
+    mDeviceResetSequenceNumber = CompositorBridgeChild::Get()->DeviceResetSequenceNumber();
+  }
 }
 
 
@@ -206,6 +210,23 @@ ClientLayerManager::BeginTransactionWithTarget(gfxContext* aTarget)
     return false;
   }
 
+  if (XRE_IsContentProcess() &&
+      mForwarder->DeviceCanReset() &&
+      mDeviceResetSequenceNumber != CompositorBridgeChild::Get()->DeviceResetSequenceNumber())
+  {
+    // The compositor has informed this process that a device reset occurred,
+    // but it has not finished informing each TabChild of its new
+    // TextureFactoryIdentifier. Until then, it's illegal to paint. Note that
+    // it is also illegal to request a new TIF synchronously, because we're
+    // not guaranteed the UI process has finished acquiring new compositors
+    // for each widget.
+    //
+    // Note that we only do this for accelerated backends, since we do not
+    // perform resets on basic compositors.
+    gfxCriticalNote << "Discarding a paint since a device reset has not yet been acknowledged.";
+    return false;
+  }
+
   mInTransaction = true;
   mTransactionStart = TimeStamp::Now();
 
@@ -217,11 +238,6 @@ ClientLayerManager::BeginTransactionWithTarget(gfxContext* aTarget)
   NS_ASSERTION(!InTransaction(), "Nested transactions not allowed");
   mPhase = PHASE_CONSTRUCTION;
 
-  if (DependsOnStaleDevice()) {
-    FrameLayerBuilder::InvalidateAllLayers(this);
-    mDeviceCounter = gfxPlatform::GetPlatform()->GetDeviceCounter();
-  }
-
   MOZ_ASSERT(mKeepAlive.IsEmpty(), "uncommitted txn?");
 
   // If the last transaction was incomplete (a failed DoEmptyTransaction),
@@ -614,9 +630,14 @@ ClientLayerManager::FlushRendering()
 }
 
 void
-ClientLayerManager::UpdateTextureFactoryIdentifier(const TextureFactoryIdentifier& aNewIdentifier)
+ClientLayerManager::UpdateTextureFactoryIdentifier(const TextureFactoryIdentifier& aNewIdentifier,
+                                                   uint64_t aDeviceResetSeqNo)
 {
+  MOZ_ASSERT_IF(XRE_IsContentProcess(),
+                aDeviceResetSeqNo == CompositorBridgeChild::Get()->DeviceResetSequenceNumber());
+
   mForwarder->IdentifyTextureHost(aNewIdentifier);
+  mDeviceResetSequenceNumber = aDeviceResetSeqNo;
 }
 
 void
@@ -850,13 +871,6 @@ ClientLayerManager::RemoveDidCompositeObserver(DidCompositeObserver* aObserver)
   mDidCompositeObservers.RemoveElement(aObserver);
 }
 
-bool
-ClientLayerManager::DependsOnStaleDevice() const
-{
-  return gfxPlatform::GetPlatform()->GetDeviceCounter() != mDeviceCounter;
-}
-
-
 already_AddRefed<PersistentBufferProvider>
 ClientLayerManager::CreatePersistentBufferProvider(const gfx::IntSize& aSize,
                                                    gfx::SurfaceFormat aFormat)

gfx/layers/client/ClientLayerManager.h

@@ -91,7 +91,8 @@ public:
   virtual already_AddRefed<BorderLayer> CreateBorderLayer() override;
   virtual already_AddRefed<RefLayer> CreateRefLayer() override;
 
-  void UpdateTextureFactoryIdentifier(const TextureFactoryIdentifier& aNewIdentifier);
+  void UpdateTextureFactoryIdentifier(const TextureFactoryIdentifier& aNewIdentifier,
+                                      uint64_t aDeviceResetSeqNo);
   TextureFactoryIdentifier GetTextureFactoryIdentifier()
   {
     return AsShadowForwarder()->GetTextureFactoryIdentifier();
@@ -286,8 +287,6 @@ private:
                               void* aCallbackData,
                               EndTransactionFlags);
 
-  bool DependsOnStaleDevice() const;
-
   LayerRefArray mKeepAlive;
 
   nsIWidget* mWidget;
@@ -329,6 +328,10 @@ private:
   // Incremented in BeginTransaction(), but not for repeat transactions.
   uint32_t mPaintSequenceNumber;
 
+  // A sequence number for checking whether we have not yet acknowledged
+  // a device reset.
+  uint64_t mDeviceResetSequenceNumber;
+
   APZTestData mApzTestData;
 
   RefPtr<ShadowLayerForwarder> mForwarder;

gfx/layers/ipc/CompositorBridgeChild.cpp

@@ -78,6 +78,7 @@ CompositorBridgeChild::CompositorBridgeChild(LayerManager *aLayerManager)
   : mLayerManager(aLayerManager)
   , mCanSend(false)
   , mFwdTransactionId(0)
+  , mDeviceResetSequenceNumber(0)
   , mMessageLoop(MessageLoop::current())
   , mSectionAllocator(nullptr)
 {
@@ -365,10 +366,9 @@ CompositorBridgeChild::RecvCompositorUpdated(const uint64_t& aLayersId,
   } else if (aLayersId != 0) {
     // Update gfxPlatform if this is the first time we're seeing this compositor
     // update (we will get an update for each connected tab).
-    static uint64_t sLastSeqNo = 0;
-    if (sLastSeqNo != aSeqNo) {
+    if (mDeviceResetSequenceNumber != aSeqNo) {
       gfxPlatform::GetPlatform()->CompositorUpdated();
-      sLastSeqNo = aSeqNo;
+      mDeviceResetSequenceNumber = aSeqNo;
 
       // If we still get device reset here, something must wrong when creating
       // d3d11 devices.
@@ -379,12 +379,12 @@ CompositorBridgeChild::RecvCompositorUpdated(const uint64_t& aLayersId,
     }
 
     if (dom::TabChild* child = dom::TabChild::GetFrom(aLayersId)) {
-      child->CompositorUpdated(aNewIdentifier);
+      child->CompositorUpdated(aNewIdentifier, aSeqNo);
     }
     if (!mCanSend) {
       return IPC_OK();
     }
-    SendAcknowledgeCompositorUpdate(aLayersId);
+    SendAcknowledgeCompositorUpdate(aLayersId, aSeqNo);
   }
   return IPC_OK();
 }

gfx/layers/ipc/CompositorBridgeChild.h

@@ -109,7 +109,7 @@ public:
   virtual mozilla::ipc::IPCResult
   RecvCompositorUpdated(const uint64_t& aLayersId,
                         const TextureFactoryIdentifier& aNewIdentifier,
-                        const uint64_t& aSeqNo) override;
+                        const uint64_t& aSequenceNumber) override;
 
   virtual mozilla::ipc::IPCResult
   RecvOverfill(const uint32_t &aOverfill) override;
@@ -231,6 +231,10 @@ public:
 
   void WillEndTransaction();
 
+  uint64_t DeviceResetSequenceNumber() const {
+    return mDeviceResetSequenceNumber;
+  }
+
 private:
   // Private destructor, to discourage deletion outside of Release():
   virtual ~CompositorBridgeChild();
@@ -316,6 +320,11 @@ private:
    */
   uint64_t mFwdTransactionId;
 
+  /**
+   * Last sequence number recognized for a device reset.
+   */
+  uint64_t mDeviceResetSequenceNumber;
+
   /**
    * Hold TextureClients refs until end of their usages on host side.
    * It defer calling of TextureClient recycle callback.

gfx/layers/ipc/CompositorBridgeParent.cpp

@@ -182,7 +182,6 @@ CompositorBridgeParent::LayerTreeState::LayerTreeState()
   , mCrossProcessParent(nullptr)
   , mLayerTree(nullptr)
   , mUpdatedPluginDataAvailable(false)
-  , mPendingCompositorUpdates(0)
 {
 }
 
@@ -1824,9 +1823,9 @@ CompositorBridgeParent::ResetCompositorTask(const nsTArray<LayersBackend>& aBack
       Unused << cpcp->SendCompositorUpdated(layersId, newIdentifier.value(), aSeqNo);
 
       if (LayerTransactionParent* ltp = lts->mLayerTree) {
-        ltp->AddPendingCompositorUpdate();
+        ltp->SetPendingCompositorUpdate(aSeqNo);
       }
-      lts->mPendingCompositorUpdates++;
+      lts->mPendingCompositorUpdate = Some(aSeqNo);
     }
   });
 }

gfx/layers/ipc/CompositorBridgeParent.h

@@ -189,7 +189,7 @@ public:
   virtual mozilla::ipc::IPCResult RecvFlushRendering() override;
   virtual mozilla::ipc::IPCResult RecvForcePresent() override;
 
-  virtual mozilla::ipc::IPCResult RecvAcknowledgeCompositorUpdate(const uint64_t& aLayersId) override {
+  virtual mozilla::ipc::IPCResult RecvAcknowledgeCompositorUpdate(const uint64_t&, const uint64_t&) override {
     MOZ_ASSERT_UNREACHABLE("This message is only sent cross-process");
     return IPC_OK();
   }
@@ -357,9 +357,11 @@ public:
     nsTArray<PluginWindowData> mPluginData;
     bool mUpdatedPluginDataAvailable;
 
-    // Number of times the compositor has been reset without having been
-    // acknowledged by the child.
-    uint32_t mPendingCompositorUpdates;
+    // Most recent device reset sequence number that has not been acknowledged;
+    // this is needed in case a device reset occurs in between allocating a
+    // RefLayer id on the parent, and allocating a PLayerTransaction on the
+    // child.
+    Maybe<uint64_t> mPendingCompositorUpdate;
 
     CompositorController* GetCompositorController() const;
     MetricsSharingController* CrossProcessSharingController() const;

gfx/layers/ipc/CrossProcessCompositorBridgeParent.cpp

@@ -87,7 +87,9 @@ CrossProcessCompositorBridgeParent::AllocPLayerTransactionParent(
     LayerTransactionParent* p = new LayerTransactionParent(lm, this, aId);
     p->AddIPDLReference();
     sIndirectLayerTrees[aId].mLayerTree = p;
-    p->SetPendingCompositorUpdates(state->mPendingCompositorUpdates);
+    if (state->mPendingCompositorUpdate) {
+      p->SetPendingCompositorUpdate(state->mPendingCompositorUpdate.value());
+    }
     return p;
   }
 
@@ -410,16 +412,18 @@ CrossProcessCompositorBridgeParent::GetCompositionManager(LayerTransactionParent
 }
 
 mozilla::ipc::IPCResult
-CrossProcessCompositorBridgeParent::RecvAcknowledgeCompositorUpdate(const uint64_t& aLayersId)
+CrossProcessCompositorBridgeParent::RecvAcknowledgeCompositorUpdate(const uint64_t& aLayersId,
+                                                                    const uint64_t& aSeqNo)
 {
   MonitorAutoLock lock(*sIndirectLayerTreesLock);
   CompositorBridgeParent::LayerTreeState& state = sIndirectLayerTrees[aLayersId];
 
   if (LayerTransactionParent* ltp = state.mLayerTree) {
-    ltp->AcknowledgeCompositorUpdate();
+    ltp->AcknowledgeCompositorUpdate(aSeqNo);
+  }
+  if (state.mPendingCompositorUpdate == Some(aSeqNo)) {
+    state.mPendingCompositorUpdate = Nothing();
   }
-  MOZ_ASSERT(state.mPendingCompositorUpdates > 0);
-  state.mPendingCompositorUpdates--;
   return IPC_OK();
 }
 
@@ -452,7 +456,7 @@ CrossProcessCompositorBridgeParent::AllocPTextureParent(const SurfaceDescriptor&
 
   TextureFlags flags = aFlags;
 
-  if (!state || state->mPendingCompositorUpdates) {
+  if (!state || state->mPendingCompositorUpdate) {
     // The compositor was recreated, and we're receiving layers updates for a
     // a layer manager that will soon be discarded or invalidated. We can't
     // return null because this will mess up deserialization later and we'll

gfx/layers/ipc/CrossProcessCompositorBridgeParent.h

@@ -115,7 +115,9 @@ public:
 
   virtual AsyncCompositionManager* GetCompositionManager(LayerTransactionParent* aParent) override;
   virtual mozilla::ipc::IPCResult RecvRemotePluginsReady()  override { return IPC_FAIL_NO_REASON(this); }
-  virtual mozilla::ipc::IPCResult RecvAcknowledgeCompositorUpdate(const uint64_t& aLayersId) override;
+  virtual mozilla::ipc::IPCResult RecvAcknowledgeCompositorUpdate(
+    const uint64_t& aLayersId,
+    const uint64_t& aSeqNo) override;
 
   void DidComposite(uint64_t aId,
                     TimeStamp& aCompositeStart,

gfx/layers/ipc/KnowsCompositor.h

@@ -68,6 +68,10 @@ public:
     return mTextureFactoryIdentifier;
   }
 
+  bool DeviceCanReset() const {
+    return GetCompositorBackendType() != LayersBackend::LAYERS_BASIC;
+  }
+
   int32_t GetSerial() { return mSerial; }
 
   /**

gfx/layers/ipc/LayerTransactionParent.cpp

@@ -59,7 +59,6 @@ LayerTransactionParent::LayerTransactionParent(HostLayerManager* aManager,
   , mChildEpoch(0)
   , mParentEpoch(0)
   , mPendingTransaction(0)
-  , mPendingCompositorUpdates(0)
   , mDestroyed(false)
   , mIPCOpen(false)
 {
@@ -575,7 +574,7 @@ LayerTransactionParent::RecvUpdate(const TransactionInfo& aInfo,
     case Edit::TOpAttachCompositable: {
       const OpAttachCompositable& op = edit.get_OpAttachCompositable();
       RefPtr<CompositableHost> host = FindCompositable(op.compositable());
-      if (mPendingCompositorUpdates) {
+      if (mPendingCompositorUpdate) {
         // Do not attach compositables from old layer trees. Return true since
         // content cannot handle errors.
         return IPC_OK();
@@ -590,7 +589,7 @@ LayerTransactionParent::RecvUpdate(const TransactionInfo& aInfo,
     }
     case Edit::TOpAttachAsyncCompositable: {
       const OpAttachAsyncCompositable& op = edit.get_OpAttachAsyncCompositable();
-      if (mPendingCompositorUpdates) {
+      if (mPendingCompositorUpdate) {
         // Do not attach compositables from old layer trees. Return true since
         // content cannot handle errors.
         return IPC_OK();

gfx/layers/ipc/LayerTransactionParent.h

@@ -97,17 +97,13 @@ public:
     return OtherPid();
   }
 
-  void AddPendingCompositorUpdate() {
-    mPendingCompositorUpdates++;
+  void SetPendingCompositorUpdate(uint64_t aNumber) {
+    mPendingCompositorUpdate = Some(aNumber);
   }
-  void SetPendingCompositorUpdates(uint32_t aCount) {
-    // Only called after construction.
-    MOZ_ASSERT(mPendingCompositorUpdates == 0);
-    mPendingCompositorUpdates = aCount;
-  }
-  void AcknowledgeCompositorUpdate() {
-    MOZ_ASSERT(mPendingCompositorUpdates > 0);
-    mPendingCompositorUpdates--;
+  void AcknowledgeCompositorUpdate(uint64_t aNumber) {
+    if (mPendingCompositorUpdate == Some(aNumber)) {
+      mPendingCompositorUpdate = Nothing();
+    }
   }
 
 protected:
@@ -200,9 +196,9 @@ private:
 
   uint64_t mPendingTransaction;
 
-  // Number of compositor updates we're waiting for the child to
-  // acknowledge.
-  uint32_t mPendingCompositorUpdates;
+  // Not accepting layers updates until we receive an acknowledgement with this
+  // generation number.
+  Maybe<uint64_t> mPendingCompositorUpdate;
 
   // When the widget/frame/browser stuff in this process begins its
   // destruction process, we need to Disconnect() all the currently

gfx/layers/ipc/PCompositorBridge.ipdl

@@ -162,7 +162,7 @@ parent:
 
   // Confirmation that the child has invalidated all its layers, and will not
   // request layers against an old compositor.
-  async AcknowledgeCompositorUpdate(uint64_t id);
+  async AcknowledgeCompositorUpdate(uint64_t aLayersId, uint64_t aSeqNo);
 
   // Child sends the parent a request for fill ratio numbers.
   async RequestOverfill();

gfx/thebes/gfxPlatform.cpp

@@ -501,7 +501,6 @@ gfxPlatform::gfxPlatform()
   , mTilesInfoCollector(this, &gfxPlatform::GetTilesSupportInfo)
   , mCompositorBackend(layers::LayersBackend::LAYERS_NONE)
   , mScreenDepth(0)
-  , mDeviceCounter(0)
 {
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
     mFallbackUsesCmaps = UNINITIALIZED_VALUE;
@@ -2571,12 +2570,6 @@ gfxPlatform::SupportsApzDragInput() const
   return gfxPrefs::APZDragEnabled();
 }
 
-void
-gfxPlatform::BumpDeviceCounter()
-{
-  mDeviceCounter++;
-}
-
 void
 gfxPlatform::InitOpenGLConfig()
 {

gfx/thebes/gfxPlatform.h

@@ -675,10 +675,6 @@ public:
       return false;
     }
 
-    uint64_t GetDeviceCounter() const {
-      return mDeviceCounter;
-    }
-
     /**
      * Check the blocklist for a feature. Returns false if the feature is blocked
      * with an appropriate message and failure ID.
@@ -862,9 +858,6 @@ private:
     int32_t mScreenDepth;
     mozilla::gfx::IntSize mScreenSize;
 
-    // Generation number for devices that ClientLayerManagers might depend on.
-    uint64_t mDeviceCounter;
-
     // An instance of gfxSkipChars which is empty. It is used as the
     // basis for error-case iterators.
     const gfxSkipChars kEmptySkipChars;

gfx/thebes/gfxWindowsPlatform.cpp

@@ -458,7 +458,6 @@ gfxWindowsPlatform::HandleDeviceReset()
 
   InitializeDevices();
   UpdateANGLEConfig();
-  BumpDeviceCounter();
   return true;
 }
 

js/src/jit-test/tests/cacheir/function-length.js

@@ -0,0 +1,48 @@
+function interpreted() {
+    for (var i = 0; i < 50; i++) {
+        var f = function () {};
+        assertEq(f.length, 0);
+    }
+
+    for (var i = 0; i < 50; i++) {
+        var f = function (a, b) {};
+        assertEq(f.length, 2);
+    }
+}
+
+function bound() {
+    for (var i = 0; i < 50; i++) {
+        var f = (function () {}).bind({});
+        assertEq(f.length, 0);
+    }
+
+    for (var i = 0; i < 50; i++) {
+        var f = (function (a, b) {}).bind({});
+        assertEq(f.length, 2);
+    }
+}
+
+function native() {
+    for (var i = 0; i < 50; i++) {
+        // Use the interpreted function for getting the IC generated in the first place.
+        var f = function (a) {};
+
+        if (i == 15) {
+            f = Math.sin;
+        } else if (i == 20) {
+            f = Math.cos;
+        } else if (i == 25) {
+            f = Math.ceil;
+        } else if (i == 30) {
+            f = Math.tan;
+        } else if (i == 35) {
+            f = Math.tanh;
+        }
+
+        assertEq(f.length, 1);
+    }
+}
+
+interpreted();
+bound();
+native();

js/src/jit/CacheIR.cpp

@@ -149,6 +149,8 @@ GetPropIRGenerator::tryAttachStub()
                 return true;
             if (tryAttachWindowProxy(obj, objId, id))
                 return true;
+            if (tryAttachFunction(obj, objId, id))
+                return true;
             if (tryAttachProxy(obj, objId, id))
                 return true;
             return false;
@@ -911,6 +913,42 @@ GetPropIRGenerator::tryAttachObjectLength(HandleObject obj, ObjOperandId objId,
     return false;
 }
 
+bool
+GetPropIRGenerator::tryAttachFunction(HandleObject obj, ObjOperandId objId, HandleId id)
+{
+    // Function properties are lazily resolved so they might not be defined yet.
+    // And we might end up in a situation where we always have a fresh function
+    // object during the IC generation.
+    if (!obj->is<JSFunction>())
+        return false;
+
+    JSObject* holder = nullptr;
+    PropertyResult prop;
+    // This property exists already, don't attach the stub.
+    if (LookupPropertyPure(cx_, obj, id, &holder, &prop))
+        return false;
+
+    JSFunction* fun = &obj->as<JSFunction>();
+
+    if (JSID_IS_ATOM(id, cx_->names().length)) {
+        // length was probably deleted from the function.
+        if (fun->hasResolvedLength())
+            return false;
+
+        // Lazy functions don't store the length.
+        if (fun->isInterpretedLazy())
+            return false;
+
+        maybeEmitIdGuard(id);
+        writer.guardClass(objId, GuardClassKind::JSFunction);
+        writer.loadFunctionLengthResult(objId);
+        writer.returnFromIC();
+        return true;
+    }
+
+    return false;
+}
+
 bool
 GetPropIRGenerator::tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId, HandleId id)
 {

js/src/jit/CacheIR.h

@@ -189,6 +189,7 @@ enum class CacheKind : uint8_t
     _(LoadUnboxedArrayLengthResult)       \
     _(LoadArgumentsObjectArgResult)       \
     _(LoadArgumentsObjectLengthResult)    \
+    _(LoadFunctionLengthResult)           \
     _(LoadStringCharResult)               \
     _(LoadStringLengthResult)             \
     _(LoadFrameCalleeResult)              \
@@ -280,6 +281,7 @@ enum class GuardClassKind : uint8_t
     MappedArguments,
     UnmappedArguments,
     WindowProxy,
+    JSFunction,
 };
 
 // Class to record CacheIR + some additional metadata for code generation.
@@ -628,6 +630,12 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
     void loadUnboxedArrayLengthResult(ObjOperandId obj) {
         writeOpWithOperandId(CacheOp::LoadUnboxedArrayLengthResult, obj);
     }
+    void loadArgumentsObjectLengthResult(ObjOperandId obj) {
+        writeOpWithOperandId(CacheOp::LoadArgumentsObjectLengthResult, obj);
+    }
+    void loadFunctionLengthResult(ObjOperandId obj) {
+        writeOpWithOperandId(CacheOp::LoadFunctionLengthResult, obj);
+    }
     void loadArgumentsObjectArgResult(ObjOperandId obj, Int32OperandId index) {
         writeOpWithOperandId(CacheOp::LoadArgumentsObjectArgResult, obj);
         writeOperandId(index);
@@ -652,9 +660,6 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
         buffer_.writeByte(uint32_t(layout));
         buffer_.writeByte(uint32_t(elementType));
     }
-    void loadArgumentsObjectLengthResult(ObjOperandId obj) {
-        writeOpWithOperandId(CacheOp::LoadArgumentsObjectLengthResult, obj);
-    }
     void loadStringLengthResult(StringOperandId str) {
         writeOpWithOperandId(CacheOp::LoadStringLengthResult, str);
     }
@@ -804,6 +809,7 @@ class MOZ_RAII GetPropIRGenerator : public IRGenerator
     bool tryAttachObjectLength(HandleObject obj, ObjOperandId objId, HandleId id);
     bool tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId, HandleId id);
     bool tryAttachWindowProxy(HandleObject obj, ObjOperandId objId, HandleId id);
+    bool tryAttachFunction(HandleObject obj, ObjOperandId objId, HandleId id);
 
     bool tryAttachGenericProxy(HandleObject obj, ObjOperandId objId, HandleId id);
     bool tryAttachDOMProxyExpando(HandleObject obj, ObjOperandId objId, HandleId id);

js/src/jit/CacheIRCompiler.cpp

@@ -1228,6 +1228,9 @@ CacheIRCompiler::emitGuardClass()
       case GuardClassKind::WindowProxy:
         clasp = cx_->maybeWindowProxyClass();
         break;
+      case GuardClassKind::JSFunction:
+        clasp = &JSFunction::class_;
+        break;
     }
 
     MOZ_ASSERT(clasp);
@@ -1514,6 +1517,55 @@ CacheIRCompiler::emitLoadArgumentsObjectLengthResult()
     return true;
 }
 
+bool
+CacheIRCompiler::emitLoadFunctionLengthResult()
+{
+    AutoOutputRegister output(*this);
+    Register obj = allocator.useRegister(masm, reader.objOperandId());
+    AutoScratchRegisterMaybeOutput scratch(allocator, masm, output);
+
+    FailurePath* failure;
+    if (!addFailurePath(&failure))
+        return false;
+
+    // Get the JSFunction flags.
+    masm.load16ZeroExtend(Address(obj, JSFunction::offsetOfFlags()), scratch);
+
+    // Functions with lazy scripts don't store their length.
+    // If the length was resolved before the length property might be shadowed.
+    masm.branchTest32(Assembler::NonZero,
+                      scratch,
+                      Imm32(JSFunction::INTERPRETED_LAZY |
+                            JSFunction::RESOLVED_LENGTH),
+                      failure->label());
+
+    Label boundFunction;
+    masm.branchTest32(Assembler::NonZero, scratch, Imm32(JSFunction::BOUND_FUN), &boundFunction);
+    Label interpreted;
+    masm.branchTest32(Assembler::NonZero, scratch, Imm32(JSFunction::INTERPRETED), &interpreted);
+
+    // Load the length of the native function.
+    masm.load16ZeroExtend(Address(obj, JSFunction::offsetOfNargs()), scratch);
+    Label done;
+    masm.jump(&done);
+
+    masm.bind(&boundFunction);
+    // Bound functions might have a non-int32 length.
+    Address boundLength(obj, FunctionExtended::offsetOfExtendedSlot(BOUND_FUN_LENGTH_SLOT));
+    masm.branchTestInt32(Assembler::NotEqual, boundLength, failure->label());
+    masm.unboxInt32(boundLength, scratch);
+    masm.jump(&done);
+
+    masm.bind(&interpreted);
+    // Load the length from the function's script.
+    masm.loadPtr(Address(obj, JSFunction::offsetOfNativeOrScript()), scratch);
+    masm.load16ZeroExtend(Address(scratch, JSScript::offsetOfFunLength()), scratch);
+
+    masm.bind(&done);
+    EmitStoreResult(masm, scratch, JSVAL_TYPE_INT32, output);
+    return true;
+}
+
 bool
 CacheIRCompiler::emitLoadStringLengthResult()
 {

js/src/jit/CacheIRCompiler.h

@@ -38,6 +38,7 @@ namespace jit {
     _(LoadInt32ArrayLengthResult)         \
     _(LoadUnboxedArrayLengthResult)       \
     _(LoadArgumentsObjectLengthResult)    \
+    _(LoadFunctionLengthResult)           \
     _(LoadStringLengthResult)             \
     _(LoadStringCharResult)               \
     _(LoadArgumentsObjectArgResult)       \

js/src/jsscript.h

@@ -1171,6 +1171,10 @@ class JSScript : public js::gc::TenuredCell
         return funLength_;
     }
 
+    static size_t offsetOfFunLength() {
+        return offsetof(JSScript, funLength_);
+    }
+
     size_t sourceStart() const {
         return sourceStart_;
     }

layout/base/PresShell.cpp

@@ -768,8 +768,80 @@ PresShell::AccessibleCaretEnabled(nsIDocShell* aDocShell)
   return false;
 }
 
+nsIPresShell::nsIPresShell()
+    : mFrameConstructor(nullptr)
+    , mViewManager(nullptr)
+    , mFrameManager(nullptr)
+    , mHiddenInvalidationObserverRefreshDriver(nullptr)
+#ifdef ACCESSIBILITY
+    , mDocAccessible(nullptr)
+#endif
+#ifdef DEBUG
+    , mDrawEventTargetFrame(nullptr)
+#endif
+    , mPaintCount(0)
+    , mWeakFrames(nullptr)
+    , mCanvasBackgroundColor(NS_RGBA(0,0,0,0))
+    , mSelectionFlags(0)
+    , mRenderFlags(0)
+    , mStylesHaveChanged(false)
+    , mDidInitialize(false)
+    , mIsDestroying(false)
+    , mIsReflowing(false)
+    , mPaintingSuppressed(false)
+    , mIsThemeSupportDisabled(false)
+    , mIsActive(false)
+    , mFrozen(false)
+    , mIsFirstPaint(false)
+    , mObservesMutationsForPrint(false)
+    , mReflowScheduled(false)
+    , mSuppressInterruptibleReflows(false)
+    , mScrollPositionClampingScrollPortSizeSet(false)
+    , mPresShellId(0)
+    , mFontSizeInflationEmPerLine(0)
+    , mFontSizeInflationMinTwips(0)
+    , mFontSizeInflationLineThreshold(0)
+    , mFontSizeInflationForceEnabled(false)
+    , mFontSizeInflationDisabledInMasterProcess(false)
+    , mFontSizeInflationEnabled(false)
+    , mPaintingIsFrozen(false)
+    , mFontSizeInflationEnabledIsDirty(false)
+    , mIsNeverPainting(false)
+  {}
+
 PresShell::PresShell()
-  : mMouseLocation(NS_UNCONSTRAINEDSIZE, NS_UNCONSTRAINEDSIZE)
+  : mCaretEnabled(false)
+#ifdef DEBUG
+  , mInVerifyReflow(false)
+  , mCurrentReflowRoot(nullptr)
+  , mUpdateCount(0)
+#endif
+#ifdef MOZ_REFLOW_PERF
+  , mReflowCountMgr(nullptr)
+#endif
+  , mMouseLocation(NS_UNCONSTRAINEDSIZE, NS_UNCONSTRAINEDSIZE)
+  , mCurrentEventFrame(nullptr)
+  , mFirstCallbackEventRequest(nullptr)
+  , mLastCallbackEventRequest(nullptr)
+  , mLastReflowStart(0.0)
+  , mLastAnchorScrollPositionY(0)
+  , mChangeNestCount(0)
+  , mDocumentLoading(false)
+  , mIgnoreFrameDestruction(false)
+  , mHaveShutDown(false)
+  , mLastRootReflowHadUnconstrainedBSize(false)
+  , mNoDelayedMouseEvents(false)
+  , mNoDelayedKeyEvents(false)
+  , mIsDocumentGone(false)
+  , mShouldUnsuppressPainting(false)
+  , mAsyncResizeTimerIsActive(false)
+  , mInResize(false)
+  , mApproximateFrameVisibilityVisited(false)
+  , mNextPaintCompressed(false)
+  , mHasCSSBackgroundColor(false)
+  , mScaleToResolution(false)
+  , mIsLastChromeOnlyEscapeKeyConsumed(false)
+  , mHasReceivedPaintMessage(false)
 {
 #ifdef MOZ_REFLOW_PERF
   mReflowCountMgr = new ReflowCountMgr();

layout/base/PresShell.h

@@ -84,8 +84,6 @@ class PresShell final : public nsIPresShell,
 public:
   PresShell();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   // nsISupports
   NS_DECL_ISUPPORTS
 

layout/base/nsDocumentViewer.cpp

@@ -225,8 +225,6 @@ class nsDocumentViewer final : public nsIContentViewer,
 public:
   nsDocumentViewer();
 
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   // nsISupports interface...
   NS_DECL_ISUPPORTS
 
@@ -506,14 +504,36 @@ void nsDocumentViewer::PrepareToStartLoad()
 #endif // NS_PRINTING
 }
 
-// Note: operator new zeros our memory, so no need to init things to null.
 nsDocumentViewer::nsDocumentViewer()
-  : mTextZoom(1.0), mPageZoom(1.0), mOverrideDPPX(0.0), mMinFontSize(0),
+  : mParentWidget(nullptr),
+    mAttachedToParent(false),
+    mTextZoom(1.0),
+    mPageZoom(1.0),
+    mOverrideDPPX(0.0),
+    mMinFontSize(0),
+    mNumURLStarts(0),
+    mDestroyRefCount(0),
+    mStopped(false),
+    mLoaded(false),
+    mDeferredWindowClose(false),
     mIsSticky(true),
-#ifdef NS_PRINT_PREVIEW
+    mInPermitUnload(false),
+    mInPermitUnloadPrompt(false),
+#ifdef NS_PRINTING
+    mClosingWhilePrinting(false),
+#if NS_PRINT_PREVIEW
+    mPrintPreviewZoomed(false),
+    mPrintIsPending(false),
+    mPrintDocIsFullyLoaded(false),
+    mOriginalPrintPreviewScale(0.0),
     mPrintPreviewZoom(1.0),
-#endif
+#endif // NS_PRINT_PREVIEW
+#ifdef DEBUG
+    mDebugFile(nullptr),
+#endif // DEBUG
+#endif // NS_PRINTING
     mHintCharsetSource(kCharsetUninitialized),
+    mIsPageMode(false),
     mInitializedForPrintPreview(false),
     mHidden(false)
 {

layout/base/nsIPresShell.h

@@ -194,6 +194,8 @@ protected:
   typedef uint8_t RenderFlags; // for storing the above flags
 
 public:
+  nsIPresShell();
+
   /**
    * All callers are responsible for calling |Destroy| after calling
    * |EndObservingDocument|.  It needs to be separate only because form

layout/base/nsPresContext.cpp

@@ -202,21 +202,98 @@ IsVisualCharset(const nsCString& aCharset)
   }
 }
 
-  // NOTE! nsPresContext::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
-
 nsPresContext::nsPresContext(nsIDocument* aDocument, nsPresContextType aType)
-  : mType(aType), mDocument(aDocument), mBaseMinFontSize(0),
-    mTextZoom(1.0), mFullZoom(1.0), mOverrideDPPX(0.0),
+  : mType(aType),
+    mShell(nullptr),
+    mDocument(aDocument),
+    mMedium(nullptr),
+    mLinkHandler(nullptr),
+    mInflationDisabledForShrinkWrap(false),
+    mBaseMinFontSize(0),
+    mTextZoom(1.0),
+    mFullZoom(1.0),
+    mOverrideDPPX(0.0),
     mLastFontInflationScreenSize(gfxSize(-1.0, -1.0)),
-    mPageSize(-1, -1), mPPScale(1.0f),
+    mCurAppUnitsPerDevPixel(0),
+    mAutoQualityMinFontSizePixelsPref(0),
+    mPageSize(-1, -1),
+    mPageScale(0.0),
+    mPPScale(1.0f),
+    mDefaultColor(NS_RGBA(0,0,0,0)),
+    mBackgroundColor(NS_RGBA(0,0,0,0)),
+    mLinkColor(NS_RGBA(0,0,0,0)),
+    mActiveLinkColor(NS_RGBA(0,0,0,0)),
+    mVisitedLinkColor(NS_RGBA(0,0,0,0)),
+    mFocusBackgroundColor(NS_RGBA(0,0,0,0)),
+    mFocusTextColor(NS_RGBA(0,0,0,0)),
+    mBodyTextColor(NS_RGBA(0,0,0,0)),
     mViewportStyleScrollbar(NS_STYLE_OVERFLOW_AUTO, NS_STYLE_OVERFLOW_AUTO),
+    mFocusRingWidth(0),
+    mExistThrottledUpdates(false),
+    mImageAnimationMode(0),
     mImageAnimationModePref(imgIContainer::kNormalAnimMode),
+    mInterruptChecksToSkip(0),
+    mElementsRestyled(0),
+    mFramesConstructed(0),
+    mFramesReflowed(0),
+    mInteractionTimeEnabled(false),
+    mHasPendingInterrupt(false),
+    mPendingInterruptFromTest(false),
+    mInterruptsEnabled(false),
+    mUseDocumentFonts(false),
+    mUseDocumentColors(false),
+    mUnderlineLinks(false),
+    mSendAfterPaintToContent(false),
+    mUseFocusColors(false),
+    mFocusRingOnAnything(false),
+    mFocusRingStyle(false),
+    mDrawImageBackground(false),
+    mDrawColorBackground(false),
+    mNeverAnimate(false),
+    mIsRenderingOnlySelection(false),
+    mPaginated(false),
+    mCanPaginatedScroll(false),
+    mDoScaledTwips(false),
+    mIsRootPaginatedDocument(false),
+    mPrefBidiDirection(false),
+    mPrefScrollbarSide(0),
+    mPendingSysColorChanged(false),
+    mPendingThemeChanged(false),
+    mPendingUIResolutionChanged(false),
+    mPendingMediaFeatureValuesChanged(false),
+    mPrefChangePendingNeedsReflow(false),
+    mIsEmulatingMedia(false),
     mAllInvalidated(false),
-    mPaintFlashing(false), mPaintFlashingInitialized(false)
+    mIsGlyph(false),
+    mUsesRootEMUnits(false),
+    mUsesExChUnits(false),
+    mUsesViewportUnits(false),
+    mPendingViewportChange(false),
+    mCounterStylesDirty(false),
+    mPostedFlushCounterStyles(false),
+    mSuppressResizeReflow(false),
+    mIsVisual(false),
+    mFireAfterPaintEvents(false),
+    mIsChrome(false),
+    mIsChromeOriginImage(false),
+    mPaintFlashing(false),
+    mPaintFlashingInitialized(false),
+    mHasWarnedAboutPositionedTableParts(false),
+    mHasWarnedAboutTooLargeDashedOrDottedRadius(false),
+    mQuirkSheetAdded(false),
+    mNeedsPrefUpdate(false),
+    mHadNonBlankPaint(false)
+#ifdef RESTYLE_LOGGING
+    , mRestyleLoggingEnabled(false)
+#endif
+#ifdef DEBUG
+    , mInitialized(false)
+#endif
 {
-  // NOTE! nsPresContext::operator new() zeroes out all members, so don't
-  // bother initializing members to 0.
+  PodZero(&mBorderWidthTable);
+#ifdef DEBUG
+  PodZero(&mLayoutPhaseCount);
+#endif
 
   mDoScaledTwips = true;
 

layout/base/nsPresContext.h

@@ -147,7 +147,6 @@ public:
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIOBSERVER
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
   NS_DECL_CYCLE_COLLECTION_CLASS(nsPresContext)
   MOZ_DECLARE_WEAKREFERENCE_TYPENAME(nsPresContext)
 

layout/style/crashtests/1333001-1.css

@@ -0,0 +1 @@
+@import url(chrome://foo);

layout/style/crashtests/1333001-1.html

@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel=stylesheet href=1333001-1.css type=text/css>
+<link rel=stylesheet href=1333001-1.css type=text/css>
+<body onload="f()">
+<script>
+function f() {
+  document.styleSheets[1].cssRules[0].media;
+}
+</script>

layout/style/crashtests/crashtests.list

@@ -168,3 +168,4 @@ HTTP load 1320423-1.html
 asserts-if(stylo,5-28) load 1321357-1.html # bug 1324669
 load 1328535-1.html
 load 1331272.html
+HTTP load 1333001-1.html

layout/style/nsCSSRules.cpp

@@ -271,6 +271,10 @@ ImportRule::ImportRule(const ImportRule& aCopy)
       aCopy.mChildSheet->Clone(nullptr, this, nullptr, nullptr);
     SetSheet(sheet);
     // SetSheet sets mMedia appropriately
+  } else {
+    // We better just copy mMedia from aCopy, since we have nowhere else to get
+    // one.
+    mMedia = aCopy.mMedia;
   }
 }
 

mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoScreenOrientation.java

@@ -71,6 +71,10 @@ public class GeckoScreenOrientation {
         return sInstance;
     }
 
+    private GeckoScreenOrientation() {
+        update();
+    }
+
     /*
      * Enable Gecko screen orientation events on update.
      */

modules/libpref/init/all.js

@@ -934,11 +934,6 @@ pref("toolkit.telemetry.infoURL", "https://www.mozilla.org/legal/privacy/firefox
 pref("toolkit.telemetry.debugSlowSql", false);
 // Whether to use the unified telemetry behavior, requires a restart.
 pref("toolkit.telemetry.unified", true);
-
-// Identity module
-pref("toolkit.identity.enabled", false);
-pref("toolkit.identity.debug", false);
-
 // AsyncShutdown delay before crashing in case of shutdown freeze
 pref("toolkit.asyncshutdown.crash_timeout", 60000);
 // Extra logging for AsyncShutdown barriers and phases

netwerk/base/CaptivePortalService.cpp

@@ -45,6 +45,8 @@ CaptivePortalService::CaptivePortalService()
 
 CaptivePortalService::~CaptivePortalService()
 {
+  LOG(("CaptivePortalService::~CaptivePortalService isParentProcess:%d\n",
+       XRE_GetProcessType() == GeckoProcessType_Default));
 }
 
 nsresult
@@ -76,6 +78,7 @@ CaptivePortalService::PerformCheck()
 nsresult
 CaptivePortalService::RearmTimer()
 {
+  LOG(("CaptivePortalService::RearmTimer\n"));
   // Start a timer to recheck
   MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
   if (mTimer) {
@@ -292,13 +295,12 @@ CaptivePortalService::Observe(nsISupports *aSubject,
     // The user has successfully logged in. We have connectivity.
     mState = UNLOCKED_PORTAL;
     mLastChecked = TimeStamp::Now();
-    mRequestInProgress = false;
     mSlackCount = 0;
     mDelay = mMinInterval;
+
     RearmTimer();
   } else if (!strcmp(aTopic, kAbortCaptivePortalLoginEvent)) {
     // The login has been aborted
-    mRequestInProgress = false;
     mState = UNKNOWN;
     mLastChecked = TimeStamp::Now();
     mSlackCount = 0;
@@ -336,15 +338,16 @@ CaptivePortalService::Complete(bool success)
   LOG(("CaptivePortalService::Complete(success=%d) mState=%d\n", success, mState));
   MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
   mLastChecked = TimeStamp::Now();
-  if ((mState == UNKNOWN || mState == NOT_CAPTIVE) && success) {
-    mState = NOT_CAPTIVE;
-    // If this check succeeded and we have never been in a captive portal
-    // since the service was started, there is no need to keep polling
-    if (!mEverBeenCaptive) {
-      mDelay = 0;
-      if (mTimer) {
-        mTimer->Cancel();
-      }
+
+  // Note: this callback gets called when:
+  // 1. the request is completed, and content is valid (success == true)
+  // 2. when the request is aborted or times out (success == false)
+
+  if (success) {
+    if (mEverBeenCaptive) {
+      mState = UNLOCKED_PORTAL;
+    } else {
+      mState = NOT_CAPTIVE;
     }
   }
 

netwerk/base/nsSimpleURI.cpp

@@ -660,8 +660,7 @@ nsSimpleURI::GetAsciiSpec(nsACString &result)
     nsAutoCString buf;
     nsresult rv = GetSpec(buf);
     if (NS_FAILED(rv)) return rv;
-    NS_EscapeURL(buf, esc_OnlyNonASCII|esc_AlwaysCopy, result);
-    return NS_OK;
+    return NS_EscapeURL(buf, esc_OnlyNonASCII|esc_AlwaysCopy, result, fallible);
 }
 
 NS_IMETHODIMP

netwerk/base/nsStandardURL.cpp

@@ -1391,6 +1391,8 @@ nsStandardURL::GetAsciiSpec(nsACString &result)
 
     result = Substring(mSpec, 0, mScheme.mLen + 3);
 
+    // This is left fallible as this entire function is expected to be
+    // infallible.
     NS_EscapeURL(Userpass(true), esc_OnlyNonASCII | esc_AlwaysCopy, result);
 
     // get the hostport
@@ -1398,6 +1400,8 @@ nsStandardURL::GetAsciiSpec(nsACString &result)
     MOZ_ALWAYS_SUCCEEDS(GetAsciiHostPort(hostport));
     result += hostport;
 
+    // This is left fallible as this entire function is expected to be
+    // infallible.
     NS_EscapeURL(Path(), esc_OnlyNonASCII | esc_AlwaysCopy, result);
     CALL_RUST_GETTER_STR(result, GetAsciiSpec, result);
     return NS_OK;

netwerk/base/nsTemporaryFileInputStream.cpp

@@ -84,6 +84,11 @@ nsTemporaryFileInputStream::ReadSegments(nsWriteSegmentFun writer,
   while (*result < count) {
     uint32_t bufCount = std::min(count - *result, (uint32_t) sizeof(buf));
     int32_t bytesRead = PR_Read(mFileDescOwner->mFD, buf, bufCount);
+    if (bytesRead == 0) {
+      mClosed = true;
+      return NS_OK;
+    }
+
     if (bytesRead < 0) {
       return NS_ErrorAccordingToNSPR();
     }

netwerk/base/nsURLHelperUnix.cpp

@@ -65,13 +65,24 @@ net_GetFileFromURLSpec(const nsACString &aURL, nsIFile **result)
     rv = net_ParseFileURL(aURL, directory, fileBaseName, fileExtension);
     if (NS_FAILED(rv)) return rv;
 
-    if (!directory.IsEmpty())
-        NS_EscapeURL(directory, esc_Directory|esc_AlwaysCopy, path);
-    if (!fileBaseName.IsEmpty())
-        NS_EscapeURL(fileBaseName, esc_FileBaseName|esc_AlwaysCopy, path);
+    if (!directory.IsEmpty()) {
+        rv = NS_EscapeURL(directory, esc_Directory|esc_AlwaysCopy, path,
+                         mozilla::fallible);
+        if (NS_FAILED(rv))
+          return rv;
+    }
+    if (!fileBaseName.IsEmpty()) {
+        rv = NS_EscapeURL(fileBaseName, esc_FileBaseName|esc_AlwaysCopy, path,
+                          mozilla::fallible);
+        if (NS_FAILED(rv))
+          return rv;
+    }
     if (!fileExtension.IsEmpty()) {
         path += '.';
-        NS_EscapeURL(fileExtension, esc_FileExtension|esc_AlwaysCopy, path);
+        rv = NS_EscapeURL(fileExtension, esc_FileExtension|esc_AlwaysCopy, path,
+                          mozilla::fallible);
+        if (NS_FAILED(rv))
+          return rv;
     }
     
     NS_UnescapeURL(path);

netwerk/protocol/http/nsHttpChannel.cpp

@@ -5755,6 +5755,7 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context)
 
     if (!gHttpHandler->Active()) {
         LOG(("  after HTTP shutdown..."));
+        ReleaseListeners();
         return NS_ERROR_NOT_AVAILABLE;
     }
 
@@ -5833,7 +5834,10 @@ nsHttpChannel::AsyncOpen2(nsIStreamListener *aListener)
 {
   nsCOMPtr<nsIStreamListener> listener = aListener;
   nsresult rv = nsContentSecurityManager::doContentSecurityCheck(this, listener);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+      ReleaseListeners();
+      return rv;
+  }
   return AsyncOpen(listener, nullptr);
 }
 

netwerk/protocol/http/nsHttpDigestAuth.cpp

@@ -121,7 +121,10 @@ nsHttpDigestAuth::GetMethodAndPath(nsIHttpAuthenticableChannel *authChannel,
           // instead of regenerating it here.
           //
           nsAutoCString buf;
-          path = NS_EscapeURL(path, esc_OnlyNonASCII, buf);
+          rv = NS_EscapeURL(path, esc_OnlyNonASCII, buf, mozilla::fallible);
+          if (NS_SUCCEEDED(rv)) {
+            path = buf;
+          }
         }
       }
     }

parser/html/nsHtml5DocumentBuilder.cpp

@@ -22,6 +22,8 @@ NS_IMPL_ADDREF_INHERITED(nsHtml5DocumentBuilder, nsContentSink)
 NS_IMPL_RELEASE_INHERITED(nsHtml5DocumentBuilder, nsContentSink)
 
 nsHtml5DocumentBuilder::nsHtml5DocumentBuilder(bool aRunsToCompletion)
+  : mBroken(NS_OK)
+  , mFlushState(eHtml5FlushState::eNotFlushing)
 {
   mRunsToCompletion = aRunsToCompletion;
 }

parser/html/nsHtml5DocumentBuilder.h

@@ -119,9 +119,6 @@ protected:
    * parser needs to be marked as broken, because some input has been lost
    * and parsing more input could lead to a DOM where pieces of HTML source
    * that weren't supposed to become scripts become scripts.
-   *
-   * Since NS_OK is actually 0, zeroing operator new takes care of
-   * initializing this.
    */
   nsresult                             mBroken;
   eHtml5FlushState                     mFlushState;

parser/html/nsHtml5OplessBuilder.h

@@ -23,8 +23,6 @@ class nsParserBase;
 class nsHtml5OplessBuilder : public nsHtml5DocumentBuilder
 {
 public:
-  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
-
   nsHtml5OplessBuilder();
   ~nsHtml5OplessBuilder();
   void Start();

parser/html/nsHtml5Parser.cpp

@@ -35,15 +35,22 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsHtml5Parser)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 nsHtml5Parser::nsHtml5Parser()
-  : mFirstBuffer(new nsHtml5OwningUTF16Buffer((void*)nullptr))
+  : mLastWasCR(false)
+  , mDocWriteSpeculativeLastWasCR(false)
+  , mBlocked(false)
+  , mDocWriteSpeculatorActive(false)
+  , mInsertionPointPushLevel(0)
+  , mDocumentClosed(false)
+  , mInDocumentWrite(false)
+  , mFirstBuffer(new nsHtml5OwningUTF16Buffer((void*)nullptr))
   , mLastBuffer(mFirstBuffer)
   , mExecutor(new nsHtml5TreeOpExecutor())
   , mTreeBuilder(new nsHtml5TreeBuilder(mExecutor, nullptr))
   , mTokenizer(new nsHtml5Tokenizer(mTreeBuilder, false))
   , mRootContextLineNumber(1)
+  , mReturnToStreamParserPermitted(false)
 {
   mTokenizer->setInterner(&mAtomTable);
-  // There's a zeroing operator new for everything else
 }
 
 nsHtml5Parser::~nsHtml5Parser()

parser/html/nsHtml5Parser.h

@@ -31,7 +31,6 @@ class nsHtml5Parser final : public nsIParser,
                             public nsSupportsWeakReference
 {
   public:
-    NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsHtml5Parser, nsIParser)

parser/html/nsHtml5StreamParser.cpp

@@ -149,7 +149,10 @@ class nsHtml5LoadFlusher : public Runnable
 nsHtml5StreamParser::nsHtml5StreamParser(nsHtml5TreeOpExecutor* aExecutor,
                                          nsHtml5Parser* aOwner,
                                          eParserMode aMode)
-  : mFirstBuffer(nullptr) // Will be filled when starting
+  : mSniffingLength(0)
+  , mBomState(eBomState::BOM_SNIFFING_NOT_STARTED)
+  , mCharsetSource(kCharsetUninitialized)
+  , mReparseForbidden(false)
   , mLastBuffer(nullptr) // Will be filled when starting
   , mExecutor(aExecutor)
   , mTreeBuilder(new nsHtml5TreeBuilder((aMode == VIEW_SOURCE_HTML ||
@@ -160,12 +163,23 @@ nsHtml5StreamParser::nsHtml5StreamParser(nsHtml5TreeOpExecutor* aExecutor,
   , mTokenizer(new nsHtml5Tokenizer(mTreeBuilder, aMode == VIEW_SOURCE_XML))
   , mTokenizerMutex("nsHtml5StreamParser mTokenizerMutex")
   , mOwner(aOwner)
+  , mLastWasCR(false)
+  , mStreamState(eHtml5StreamState::STREAM_NOT_STARTED)
+  , mSpeculating(false)
+  , mAtEOF(false)
   , mSpeculationMutex("nsHtml5StreamParser mSpeculationMutex")
+  , mSpeculationFailureCount(0)
+  , mTerminated(false)
+  , mInterrupted(false)
   , mTerminatedMutex("nsHtml5StreamParser mTerminatedMutex")
   , mThread(nsHtml5Module::GetStreamParserThread())
   , mExecutorFlusher(new nsHtml5ExecutorFlusher(aExecutor))
   , mLoadFlusher(new nsHtml5LoadFlusher(aExecutor))
+  , mFeedChardet(false)
+  , mInitialEncodingWasFromParentFrame(false)
   , mFlushTimer(do_CreateInstance("@mozilla.org/timer;1"))
+  , mFlushTimerArmed(false)
+  , mFlushTimerEverFired(false)
   , mMode(aMode)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");

parser/html/nsHtml5StreamParser.h

@@ -108,7 +108,6 @@ class nsHtml5StreamParser : public nsICharsetDetectionObserver {
   friend class nsHtml5TimerKungFu;
 
   public:
-    NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsHtml5StreamParser,
                                              nsICharsetDetectionObserver)

parser/html/nsHtml5TreeOpExecutor.cpp

@@ -65,10 +65,16 @@ static nsITimer* gFlushTimer = nullptr;
 
 nsHtml5TreeOpExecutor::nsHtml5TreeOpExecutor()
   : nsHtml5DocumentBuilder(false)
+  , mSuppressEOF(false)
+  , mReadingFromStage(false)
+  , mStreamParser(nullptr)
   , mPreloadedURLs(23)  // Mean # of preloadable resources per page on dmoz
   , mSpeculationReferrerPolicy(mozilla::net::RP_Unset)
+  , mStarted(false)
+  , mRunFlushLoopOnStack(false)
+  , mCallContinueInterruptedParsingIfEnabled(false)
+  , mAlreadyComplainedAboutCharset(false)
 {
-  // zeroing operator new for everything else
 }
 
 nsHtml5TreeOpExecutor::~nsHtml5TreeOpExecutor()

parser/html/nsHtml5TreeOpExecutor.h

@@ -38,7 +38,6 @@ class nsHtml5TreeOpExecutor final : public nsHtml5DocumentBuilder,
   typedef mozilla::net::ReferrerPolicy ReferrerPolicy;
 
   public:
-    NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
     NS_DECL_ISUPPORTS_INHERITED
 
   private:

python/mozbuild/mozbuild/preprocessor.py

@@ -754,7 +754,7 @@ class Preprocessor:
                 raise
             except:
                 raise Preprocessor.Error(self, 'FILE_NOT_FOUND', str(args))
-        self.checkLineNumbers = bool(re.search('\.(js|jsm|java)(?:\.in)?$', args.name))
+        self.checkLineNumbers = bool(re.search('\.(js|jsm|java|webidl)(?:\.in)?$', args.name))
         oldFile = self.context['FILE']
         oldLine = self.context['LINE']
         oldDir = self.context['DIRECTORY']