Merge m-c to fx-team a=merge

b2g/app/b2g.js

@@ -827,8 +827,11 @@ pref("network.gonk.manage-offline-status", true);
 // On Firefox Mulet, we can't enable shared JSM scope
 // as it breaks most Firefox JSMs (see bug 961777)
 #ifndef MOZ_MULET
+// Break any JSMs or JS components that rely on shared scope
+#ifndef DEBUG
 pref("jsloader.reuseGlobal", true);
 #endif
+#endif
 
 // Enable font inflation for browser tab content.
 pref("font.size.inflation.minTwips", 120);

b2g/chrome/content/settings.js

@@ -486,6 +486,7 @@ let settingsToObserve = {
     resetToPref: true
   },
   'dom.mozApps.use_reviewer_certs': false,
+  'dom.mozApps.signed_apps_installable_from': 'https://marketplace.firefox.com',
   'layers.draw-borders': false,
   'layers.draw-tile-borders': false,
   'layers.dump': false,

b2g/config/dolphin/sources.xml

@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -133,7 +133,7 @@
   <project name="platform/hardware/akm" path="hardware/akm" revision="6d3be412647b0eab0adff8a2768736cf4eb68039"/>
   <project groups="invensense" name="platform/hardware/invensense" path="hardware/invensense" revision="e6d9ab28b4f4e7684f6c07874ee819c9ea0002a2"/>
   <project name="platform/hardware/ril" path="hardware/ril" revision="865ce3b4a2ba0b3a31421ca671f4d6c5595f8690"/>
-  <project name="kernel/common" path="kernel" revision="28aab3bd1139b6beea545f50dee8903c0634de84"/>
+  <project name="kernel/common" path="kernel" revision="f365109310138f85bb91884b7dee60f6f0da042d"/>
   <project name="platform/system/core" path="system/core" revision="53d584d4a4b4316e4de9ee5f210d662f89b44e7e"/>
   <project name="u-boot" path="u-boot" revision="982c1fd67b89d5573317c1796cf5b0143de44e8a"/>
   <project name="vendor/sprd/gps" path="vendor/sprd/gps" revision="6974f8e771d4d8e910357a6739ab124768891e8f"/>

b2g/config/emulator-ics/sources.xml

@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>

b2g/config/emulator-jb/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -134,7 +134,7 @@
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="d259117b4976decbe2f76eeed85218bf0109190f"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="0e56e450367cd802241b27164a2979188242b95f"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="9f28c4faea3b2f01db227b2467b08aeba96d9bec"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="2a5dc67db7c9e6651c5fff855a6f69c1f2061ca7"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="cf9376f0f59ca72333dd24a54efe887d527da612"/>
   <project name="android-sdk" path="sdk" remote="b2g" revision="8b1365af38c9a653df97349ee53a3f5d64fd590a"/>
   <project name="darwinstreamingserver" path="system/darwinstreamingserver" remote="b2g" revision="cf85968c7f85e0ec36e72c87ceb4837a943b8af6"/>
 </manifest>

b2g/config/emulator-kk/sources.xml

@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="f92a936f2aa97526d4593386754bdbf02db07a12"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="6e47ff2790f5656b5b074407829ceecf3e6188c4"/>

b2g/config/emulator/sources.xml

@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>

b2g/config/flame-kk/sources.xml

@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -151,7 +151,7 @@
   <project name="platform/hardware/ril" path="hardware/ril" revision="12b1977cc704b35f2e9db2bb423fa405348bc2f3"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="985bf15264d865fe7b9c5b45f61c451cbaafa43d"/>
   <project name="platform/system/core" path="system/core" revision="350eac5403124dacb2a5fd9e28ac290a59fc3b8e"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="2a5dc67db7c9e6651c5fff855a6f69c1f2061ca7"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="cf9376f0f59ca72333dd24a54efe887d527da612"/>
   <project name="platform/system/qcom" path="system/qcom" revision="63e3f6f176caad587d42bba4c16b66d953fb23c2"/>
   <project name="platform/vendor/qcom-opensource/wlan/prima" path="vendor/qcom/opensource/wlan/prima" revision="d8952a42771045fca73ec600e2b42a4c7129d723"/>
   <project name="platform/vendor/qcom/msm8610" path="device/qcom/msm8610" revision="7704e16da545f4207812e593743d6743e1afb9c5"/>

b2g/config/flame/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -145,7 +145,7 @@
   <project name="platform/hardware/ril" path="hardware/ril" revision="c4e2ac95907a5519a0e09f01a0d8e27fec101af0"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="e1eb226fa3ad3874ea7b63c56a9dc7012d7ff3c2"/>
   <project name="platform/system/core" path="system/core" revision="adc485d8755af6a61641d197de7cfef667722580"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="2a5dc67db7c9e6651c5fff855a6f69c1f2061ca7"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="cf9376f0f59ca72333dd24a54efe887d527da612"/>
   <project name="platform/system/qcom" path="system/qcom" revision="1cdab258b15258b7f9657da70e6f06ebd5a2fc25"/>
   <project name="platform/vendor/qcom/msm8610" path="device/qcom/msm8610" revision="4ae5df252123591d5b941191790e7abed1bce5a4"/>
   <project name="platform/vendor/qcom-opensource/wlan/prima" path="vendor/qcom/opensource/wlan/prima" revision="ce18b47b4a4f93a581d672bbd5cb6d12fe796ca9"/>

b2g/config/gaia.json

@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "fb5a4aa15e266e9aa0e44281241ad081b528c75b", 
+    "revision": "7f097f40e32ecba580890ce1d3df2a493641bdec", 
     "repo_path": "/integration/gaia-central"
 }

b2g/config/hamachi/sources.xml

@@ -17,12 +17,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>

b2g/config/helix/sources.xml

@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>

b2g/config/nexus-4/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -129,7 +129,7 @@
   <project name="device-mako" path="device/lge/mako" remote="b2g" revision="78d17f0c117f0c66dd55ee8d5c5dde8ccc93ecba"/>
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="3a9a17613cc685aa232432566ad6cc607eab4ec1"/>
   <project name="device/lge/mako-kernel" path="device/lge/mako-kernel" revision="d1729e53d71d711c8fde25eab8728ff2b9b4df0e"/>
-  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="2a5dc67db7c9e6651c5fff855a6f69c1f2061ca7"/>
+  <project name="platform_system_nfcd" path="system/nfcd" remote="b2g" revision="cf9376f0f59ca72333dd24a54efe887d527da612"/>
   <project name="platform/external/libnfc-nci" path="external/libnfc-nci" revision="7d33aaf740bbf6c7c6e9c34a92b371eda311b66b"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="0e56e450367cd802241b27164a2979188242b95f"/>
   <project name="platform/hardware/broadcom/wlan" path="hardware/broadcom/wlan" revision="0e1929fa3aa38bf9d40e9e953d619fab8164c82e"/>

b2g/config/wasabi/sources.xml

@@ -17,12 +17,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="77ef35f5429bc3dfe9ca192b9aacc3c0bf8857de"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="0e280591881d44b80f456bc27e12d9114c218868"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="0f7792c39ad26aedecf457117c21b16cc1aee879"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="4f9042d3a705307849a6f63961eaaaa2e1d85d77"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>

browser/base/content/nsContextMenu.js

@@ -384,7 +384,8 @@ nsContextMenu.prototype = {
     if (canSpell) {
       var dictMenu = document.getElementById("spell-dictionaries-menu");
       var dictSep = document.getElementById("spell-language-separator");
-      InlineSpellCheckerUI.addDictionaryListToMenu(dictMenu, dictSep);
+      let count = InlineSpellCheckerUI.addDictionaryListToMenu(dictMenu, dictSep);
+      this.showItem(dictSep, count > 0);
       this.showItem("spell-add-dictionaries-main", false);
     }
     else if (this.onEditableArea) {

build/automationutils.py

@@ -286,14 +286,9 @@ def processSingleLeakFile(leakLogFileName, processType, leakThreshold):
 
   # totalBytesLeaked was seen and is non-zero.
   if totalBytesLeaked > leakThreshold:
-    if processType == "tab":
+    logAsWarning = True
-      # For now, ignore tab process leaks. See bug 1051230.
+    # Fail the run if we're over the threshold (which defaults to 0)
-      log.info("WARNING | leakcheck | ignoring leaks in tab process")
+    prefix = "TEST-UNEXPECTED-FAIL"
-      prefix = "WARNING"
-    else:
-      logAsWarning = True
-      # Fail the run if we're over the threshold (which defaults to 0)
-      prefix = "TEST-UNEXPECTED-FAIL"
   else:
     prefix = "WARNING"
   # Create a comma delimited string of the first N leaked objects found,
@@ -311,7 +306,7 @@ def processSingleLeakFile(leakLogFileName, processType, leakThreshold):
     log.info("%s | leakcheck | %s %d bytes leaked (%s)"
              % (prefix, processString, totalBytesLeaked, leakedObjectSummary))
 
-def processLeakLog(leakLogFile, leakThreshold = 0):
+def processLeakLog(leakLogFile, leakThresholds):
   """Process the leak log, including separate leak logs created
   by child processes.
 
@@ -326,14 +321,28 @@ def processLeakLog(leakLogFile, leakThreshold = 0):
   optional.
 
   All other file names are treated as being for default processes.
+
+  leakThresholds should be a dict mapping process types to leak thresholds,
+  in bytes. If a process type is not present in the dict the threshold
+  will be 0.
   """
 
   if not os.path.exists(leakLogFile):
     log.info("WARNING | leakcheck | refcount logging is off, so leaks can't be detected!")
     return
 
-  if leakThreshold != 0:
+  # This list is based on kGeckoProcessTypeString. ipdlunittest processes likely
-    log.info("TEST-INFO | leakcheck | threshold set at %d bytes" % leakThreshold)
+  # are not going to produce leak logs we will ever see.
+  knownProcessTypes = ["default", "plugin", "tab", "geckomediaplugin"]
+
+  for processType in knownProcessTypes:
+    log.info("TEST-INFO | leakcheck | %s process: leak threshold set at %d bytes"
+             % (processType, leakThresholds.get(processType, 0)))
+
+  for processType in leakThresholds:
+    if not processType in knownProcessTypes:
+      log.info("TEST-UNEXPECTED-FAIL | leakcheck | Unknown process type %s in leakThresholds"
+               % processType)
 
   (leakLogFileDir, leakFileBase) = os.path.split(leakLogFile)
   if leakFileBase[-4:] == ".log":
@@ -350,6 +359,10 @@ def processLeakLog(leakLogFile, leakThreshold = 0):
         processType = m.group(1)
       else:
         processType = "default"
+      if not processType in knownProcessTypes:
+        log.info("TEST-UNEXPECTED-FAIL | leakcheck | Leak log with unknown process type %s"
+                 % processType)
+      leakThreshold = leakThresholds.get(processType, 0)
       processSingleLeakFile(thisFile, processType, leakThreshold)
 
 def replaceBackSlashes(input):

caps/nsIPrincipal.idl

@@ -113,13 +113,9 @@ interface nsIPrincipal : nsISerializable
      * located at the given URI under the same-origin policy. This means that
      * codebase principals are only allowed to load resources from the same
      * domain, the system principal is allowed to load anything, and null
-     * principals are not allowed to load anything. This is changed slightly
+     * principals can only load URIs where they are the principal. This is
-     * by the optional flag allowIfInheritsPrincipal (which defaults to false)
+     * changed by the optional flag allowIfInheritsPrincipal (which defaults to
-     * which allows the load of a data: URI (which inherits the principal of
+     * false) which allows URIs that inherit their loader's principal.
-     * its loader) or a URI with the same principal as its loader (eg. a
-     * Blob URI).
-     * In these cases, with allowIfInheritsPrincipal set to true, the URI can
-     * be loaded by a null principal.
      *
      * If the load is allowed this function does nothing. If the load is not
      * allowed the function throws NS_ERROR_DOM_BAD_URI.

caps/nsNullPrincipal.cpp

@@ -239,17 +239,16 @@ nsNullPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsP
     if (nsPrincipal::IsPrincipalInherited(aURI)) {
       return NS_OK;
     }
+  }
 
-    // Also allow the load if the principal of the URI being checked is exactly
+  // Also allow the load if we are the principal of the URI being checked.
-    // us ie this.
+  nsCOMPtr<nsIURIWithPrincipal> uriPrinc = do_QueryInterface(aURI);
-    nsCOMPtr<nsIURIWithPrincipal> uriPrinc = do_QueryInterface(aURI);
+  if (uriPrinc) {
-    if (uriPrinc) {
+    nsCOMPtr<nsIPrincipal> principal;
-      nsCOMPtr<nsIPrincipal> principal;
+    uriPrinc->GetPrincipal(getter_AddRefs(principal));
-      uriPrinc->GetPrincipal(getter_AddRefs(principal));
 
-      if (principal && principal == this) {
+    if (principal == this) {
-        return NS_OK;
+      return NS_OK;
-      }
     }
   }
 

content/html/content/test/file_iframe_sandbox_b_if3.html

@@ -11,23 +11,50 @@
   }
 
   function testXHR() {
-  var xhr = new XMLHttpRequest();
+    // Standard URL should be blocked as we have a unique origin.
-
+    var xhr = new XMLHttpRequest();
-  xhr.open("GET", "file_iframe_sandbox_b_if1.html");
+    xhr.open("GET", "file_iframe_sandbox_b_if1.html");
-
+    xhr.onreadystatechange = function (oEvent) {
-  xhr.onreadystatechange = function (oEvent) {
+      var result = false;
-    var result = false;
+      if (xhr.readyState == 4) {
-    if (xhr.readyState == 4) {
+        if (xhr.status == 0) {
-      if (xhr.status == 0) {
+          result = true;
-        result = true;
+        }
+        ok(result, "XHR should be blocked in an iframe sandboxed WITHOUT 'allow-same-origin'");
       }
-      ok(result, "XHR should be blocked in an iframe sandboxed WITHOUT 'allow-same-origin'");
+    }
+    xhr.send(null);
+
+    // Blob URL should work as it will have our unique origin.
+    var blobXhr = new XMLHttpRequest();
+    var blobUrl = URL.createObjectURL(new Blob(["wibble"], {type: "text/plain"}));
+    blobXhr.open("GET", blobUrl);
+    blobXhr.onreadystatechange = function () {
+      if (this.readyState == 4) {
+        ok(this.status == 200 && this.response == "wibble", "XHR for a blob URL created in this document should NOT be blocked in an iframe sandboxed WITHOUT 'allow-same-origin'");
+      }
+    }
+    try {
+      blobXhr.send();
+    } catch(e) {
+      ok(false, "failed to send XHR for blob URL: error: " + e);
+    }
+
+    // Data URL should work as it inherits the loader's origin.
+    var dataXhr = new XMLHttpRequest();
+    dataXhr.open("GET", "data:text/html,wibble");
+    dataXhr.onreadystatechange = function () {
+      if (this.readyState == 4) {
+        ok(this.status == 200 && this.response == "wibble", "XHR for a data URL should NOT be blocked in an iframe sandboxed WITHOUT 'allow-same-origin'");
+      }
+    }
+    try {
+      dataXhr.send();
+    } catch(e) {
+      ok(false, "failed to send XHR for data URL: error: " + e);
     }
   }
 
-  xhr.send(null);
-}
-
   function doStuff() {
     try {
       window.parent.ok(false, "documents sandboxed without 'allow-same-origin' should NOT be able to access their parent");
@@ -56,7 +83,7 @@
       ok(true, "a document sandboxed without allow-same-origin should NOT be able to access sessionStorage");
     }
 
-  testXHR();
+    testXHR();
   }
 </script>
 <body onLoad="doStuff()">

content/html/content/test/test_audio_wakelock.html

@@ -39,7 +39,7 @@ function testAudioPlayPause() {
     audio.pause();
   });
 
-  navigator.mozPower.addWakeLockListener(function testAudioPlayListener(topic, state) {
+  function testAudioPlayListener(topic, state) {
     is(topic, "cpu", "Audio element locked the target == cpu");
     var locked = state == "locked-foreground" ||
                  state == "locked-background";
@@ -58,8 +58,9 @@ function testAudioPlayPause() {
       navigator.mozPower.removeWakeLockListener(testAudioPlayListener);
       runTests();
     }
-  });
+  };
 
+  navigator.mozPower.addWakeLockListener(testAudioPlayListener);
   audio.play();
 }
 
@@ -78,7 +79,7 @@ function testAudioPlay() {
     startDate = new Date();
   });
 
-  navigator.mozPower.addWakeLockListener(function testAudioPlayListener(topic, state) {
+  function testAudioPlayListener(topic, state) {
     is(topic, "cpu", "Audio element locked the target == cpu");
     var locked = state == "locked-foreground" ||
                  state == "locked-background";
@@ -101,8 +102,9 @@ function testAudioPlay() {
       navigator.mozPower.removeWakeLockListener(testAudioPlayListener);
       runTests();
     }
-  });
+  };
 
+  navigator.mozPower.addWakeLockListener(testAudioPlayListener);
   audio.play();
 }
 
@@ -117,8 +119,11 @@ function runTests() {
   test();
 };
 
-SpecialPowers.addPermission("power", true, document);
+SpecialPowers.pushPermissions(
-SpecialPowers.pushPrefEnv({"set": [["media.wakelock_timeout", 500]]}, runTests);
+  [{'type': 'power', 'allow': true, 'context': document}],
+  function() {
+    SpecialPowers.pushPrefEnv({"set": [["media.wakelock_timeout", 500]]}, runTests);
+  });
 
 SimpleTest.waitForExplicitFinish();
 

content/html/content/test/test_iframe_sandbox_same_origin.html

@@ -28,8 +28,8 @@ function ok_wrapper(result, desc) {
     passedTests++;
   }
 
-  if (completedTests == 12) {
+  if (completedTests == 14) {
-    is(passedTests, 12, "There are 12 same-origin tests that should pass");
+    is(passedTests, completedTests, "There are " + completedTests + " same-origin tests that should pass");
 
     SimpleTest.finish();
   }

content/media/AudioBufferUtils.h

@@ -121,6 +121,11 @@ public:
     aBuffer.WriteFrames(mBuffer, framesToWrite);
 
     mPosition -= FramesToSamples(CHANNELS, framesToWrite);
+    // If we didn't empty the spill buffer for some reason, shift the remaining data down
+    if (mPosition > 0) {
+      PodMove(mBuffer, mBuffer + FramesToSamples(CHANNELS, framesToWrite),
+              mPosition);
+    }
 
     return framesToWrite;
   }

content/media/AudioSink.cpp

@@ -55,18 +55,10 @@ AudioSink::Init()
                                   nullptr,
                                   MEDIA_THREAD_STACK_SIZE);
   if (NS_FAILED(rv)) {
-    mStateMachine->OnAudioSinkError();
     return rv;
   }
-
   nsCOMPtr<nsIRunnable> event = NS_NewRunnableMethod(this, &AudioSink::AudioLoop);
-  rv =  mThread->Dispatch(event, NS_DISPATCH_NORMAL);
+  return mThread->Dispatch(event, NS_DISPATCH_NORMAL);
-  if (NS_FAILED(rv)) {
-    mStateMachine->OnAudioSinkError();
-    return rv;
-  }
-
-  return NS_OK;
 }
 
 int64_t
@@ -146,8 +138,6 @@ AudioSink::AudioLoop()
 
   if (NS_FAILED(InitializeAudioStream())) {
     NS_WARNING("Initializing AudioStream failed.");
-    ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-    mStateMachine->OnAudioSinkError();
     return;
   }
 
@@ -207,13 +197,10 @@ AudioSink::InitializeAudioStream()
   // circumstances, so we take care to drop the decoder monitor while
   // initializing.
   RefPtr<AudioStream> audioStream(new AudioStream());
-  nsresult rv = audioStream->Init(mInfo.mChannels, mInfo.mRate,
+  audioStream->Init(mInfo.mChannels, mInfo.mRate,
-                                  mChannel, AudioStream::HighLatency);
+                    mChannel, AudioStream::HighLatency);
-  if (NS_FAILED(rv)) {
+  // TODO: Check Init's return value and bail on error.  Unfortunately this
-    audioStream->Shutdown();
+  // causes some tests to fail due to playback failing.
-    return rv;
-  }
-
   ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
   mAudioStream = audioStream;
   UpdateStreamSettings();

content/media/GraphDriver.cpp

@@ -805,53 +805,61 @@ AudioCallbackDriver::DataCallback(AudioDataValue* aBuffer, long aFrames)
   if (!mIterationDurationMS) {
     mIterationDurationMS = durationMS;
   } else {
-    mIterationDurationMS += durationMS;
+    mIterationDurationMS = (mIterationDurationMS*3) + durationMS;
-    mIterationDurationMS /= 2;
+    mIterationDurationMS /= 4;
   }
 
   mBuffer.SetBuffer(aBuffer, aFrames);
-
+  // fill part or all with leftover data from last iteration (since we
+  // align to Audio blocks)
   mScratchBuffer.Empty(mBuffer);
+  // if we totally filled the buffer (and mScratchBuffer isn't empty),
+  // we don't need to run an iteration and if we do so we may overflow.
+  if (mBuffer.Available()) {
 
-  mStateComputedTime = mNextStateComputedTime;
+    mStateComputedTime = mNextStateComputedTime;
 
-  // State computed time is decided by the audio callback's buffer length. We
+    // State computed time is decided by the audio callback's buffer length. We
-  // compute the iteration start and end from there, trying to keep the amount
+    // compute the iteration start and end from there, trying to keep the amount
-  // of buffering in the graph constant.
+    // of buffering in the graph constant.
-  mNextStateComputedTime =
+    mNextStateComputedTime =
-    mGraphImpl->RoundUpToNextAudioBlock(mStateComputedTime + mBuffer.Available());
+      mGraphImpl->RoundUpToNextAudioBlock(mStateComputedTime + mBuffer.Available());
 
-  mIterationStart = mIterationEnd;
+    mIterationStart = mIterationEnd;
-  // inGraph is the number of audio frames there is between the state time and
+    // inGraph is the number of audio frames there is between the state time and
-  // the current time, i.e. the maximum theoretical length of the interval we
+    // the current time, i.e. the maximum theoretical length of the interval we
-  // could use as [mIterationStart; mIterationEnd].
+    // could use as [mIterationStart; mIterationEnd].
-  GraphTime inGraph = mStateComputedTime - mIterationStart;
+    GraphTime inGraph = mStateComputedTime - mIterationStart;
-  // We want the interval [mIterationStart; mIterationEnd] to be before the
+    // We want the interval [mIterationStart; mIterationEnd] to be before the
-  // interval [mStateComputedTime; mNextStateComputedTime]. We also want
+    // interval [mStateComputedTime; mNextStateComputedTime]. We also want
-  // the distance between these intervals to be roughly equivalent each time, to
+    // the distance between these intervals to be roughly equivalent each time, to
-  // ensure there is no clock drift between current time and state time. Since
+    // ensure there is no clock drift between current time and state time. Since
-  // we can't act on the state time because we have to fill the audio buffer, we
+    // we can't act on the state time because we have to fill the audio buffer, we
-  // reclock the current time against the state time, here.
+    // reclock the current time against the state time, here.
-  mIterationEnd = mIterationStart + 0.8 * inGraph;
+    mIterationEnd = mIterationStart + 0.8 * inGraph;
 
-  STREAM_LOG(PR_LOG_DEBUG, ("interval[%ld; %ld] state[%ld; %ld] (frames: %ld) (durationMS: %u) (duration ticks: %ld)\n",
+    STREAM_LOG(PR_LOG_DEBUG, ("interval[%ld; %ld] state[%ld; %ld] (frames: %ld) (durationMS: %u) (duration ticks: %ld)\n",
-             (long)mIterationStart, (long)mIterationEnd,
+                              (long)mIterationStart, (long)mIterationEnd,
-             (long)mStateComputedTime, (long)mNextStateComputedTime,
+                              (long)mStateComputedTime, (long)mNextStateComputedTime,
-             (long)aFrames, (uint32_t)durationMS,
+                              (long)aFrames, (uint32_t)durationMS,
-             (long)(mNextStateComputedTime - mStateComputedTime)));
+                              (long)(mNextStateComputedTime - mStateComputedTime)));
 
-  mCurrentTimeStamp = TimeStamp::Now();
+    mCurrentTimeStamp = TimeStamp::Now();
 
-  if (mStateComputedTime < mIterationEnd) {
+    if (mStateComputedTime < mIterationEnd) {
-    STREAM_LOG(PR_LOG_WARNING, ("Media graph global underrun detected"));
+      STREAM_LOG(PR_LOG_WARNING, ("Media graph global underrun detected"));
-    mIterationEnd = mStateComputedTime;
+      mIterationEnd = mStateComputedTime;
+    }
+
+    stillProcessing = mGraphImpl->OneIteration(mIterationStart,
+                                               mIterationEnd,
+                                               mStateComputedTime,
+                                               mNextStateComputedTime);
+  } else {
+    NS_WARNING("DataCallback buffer filled entirely from scratch buffer, skipping iteration.");
+    stillProcessing = true;
   }
 
-  stillProcessing = mGraphImpl->OneIteration(mIterationStart,
-                                             mIterationEnd,
-                                             mStateComputedTime,
-                                             mNextStateComputedTime);
-
   mBuffer.BufferFilled();
 
   if (mNextDriver && stillProcessing) {
@@ -896,7 +904,7 @@ AudioCallbackDriver::MixerCallback(AudioDataValue* aMixedBuffer,
   uint32_t toWrite = mBuffer.Available();
 
   if (!mBuffer.Available()) {
-    NS_WARNING("MediaStreamGraph SpillBuffer full, expect frame drop.");
+    NS_WARNING("DataCallback buffer full, expect frame drops.");
   }
 
   MOZ_ASSERT(mBuffer.Available() <= aFrames);

content/media/MediaDecoderStateMachine.cpp

@@ -1154,9 +1154,9 @@ void MediaDecoderStateMachine::StartPlayback()
   SetPlayStartTime(TimeStamp::Now());
 
   NS_ASSERTION(IsPlaying(), "Should report playing by end of StartPlayback()");
-  nsresult rv = StartAudioThread();
+  if (NS_FAILED(StartAudioThread())) {
-  NS_ENSURE_SUCCESS_VOID(rv);
+    DECODER_WARN("Failed to create audio thread");
-
+  }
   mDecoder->GetReentrantMonitor().NotifyAll();
   mDecoder->UpdateStreamBlockingForStateMachinePlaying();
   DispatchDecodeTasksIfNeeded();
@@ -1791,12 +1791,15 @@ MediaDecoderStateMachine::StartAudioThread()
   mStopAudioThread = false;
   if (HasAudio() && !mAudioSink) {
     mAudioCompleted = false;
-    mAudioSink = new AudioSink(this, mAudioStartTime,
+    mAudioSink = new AudioSink(this,
-                               mInfo.mAudio, mDecoder->GetAudioChannel());
+                               mAudioStartTime, mInfo.mAudio, mDecoder->GetAudioChannel());
-    // OnAudioSinkError() will be called before Init() returns if an error
-    // occurs during initialization.
     nsresult rv = mAudioSink->Init();
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_FAILED(rv)) {
+      DECODER_WARN("Changed state to SHUTDOWN because audio sink initialization failed");
+      SetState(DECODER_STATE_SHUTDOWN);
+      mScheduler->ScheduleAndShutdown();
+      return rv;
+    }
 
     mAudioSink->SetVolume(mVolume);
     mAudioSink->SetPlaybackRate(mPlaybackRate);
@@ -3121,25 +3124,6 @@ void MediaDecoderStateMachine::OnAudioSinkComplete()
   mDecoder->GetReentrantMonitor().NotifyAll();
 }
 
-void MediaDecoderStateMachine::OnAudioSinkError()
-{
-  AssertCurrentThreadInMonitor();
-  // AudioSink not used with captured streams, so ignore errors in this case.
-  if (mAudioCaptured) {
-    return;
-  }
-
-  mAudioCompleted = true;
-
-  // Notify media decoder/element about this error.
-  RefPtr<nsIRunnable> task(
-    NS_NewRunnableMethod(this, &MediaDecoderStateMachine::OnDecodeError));
-  nsresult rv = mDecodeTaskQueue->Dispatch(task);
-  if (NS_FAILED(rv)) {
-    DECODER_WARN("Failed to dispatch OnDecodeError");
-  }
-}
-
 } // namespace mozilla
 
 // avoid redefined macro in unified build

content/media/MediaDecoderStateMachine.h

@@ -636,9 +636,6 @@ protected:
   // and the sink is shutting down.
   void OnAudioSinkComplete();
 
-  // Called by the AudioSink to signal errors.
-  void OnAudioSinkError();
-
   // The decoder object that created this state machine. The state machine
   // holds a strong reference to the decoder to ensure that the decoder stays
   // alive once media element has started the decoder shutdown process, and has

content/media/MediaStreamGraphImpl.h

@@ -153,8 +153,16 @@ public:
   void AssertOnGraphThreadOrNotRunning() {
     // either we're on the right thread (and calling CurrentDriver() is safe),
     // or we're going to assert anyways, so don't cross-check CurrentDriver
-    MOZ_ASSERT(mDriver->OnThread() ||
+#ifdef DEBUG
-               (mLifecycleState > LIFECYCLE_RUNNING && NS_IsMainThread()));
+    // if all the safety checks fail, assert we own the monitor
+    if (!mDriver->OnThread()) {
+      if (!(mDetectedNotRunning &&
+            mLifecycleState > LIFECYCLE_RUNNING &&
+            NS_IsMainThread())) {
+        mMonitor.AssertCurrentThreadOwns();
+      }
+    }
+#endif
   }
   /*
    * This does the actual iteration: Message processing, MediaStream ordering,
@@ -424,12 +432,7 @@ public:
    * Not safe to call off the MediaStreamGraph thread unless monitor is held!
    */
   GraphDriver* CurrentDriver() {
-#ifdef DEBUG
+    AssertOnGraphThreadOrNotRunning();
-    // #ifdef since we're not wrapping it all in MOZ_ASSERT()
-    if (!mDriver->OnThread()) {
-      mMonitor.AssertCurrentThreadOwns();
-    }
-#endif
     return mDriver;
   }
 
@@ -442,12 +445,7 @@ public:
    * monitor is held
    */
   void SetCurrentDriver(GraphDriver* aDriver) {
-#ifdef DEBUG
+    AssertOnGraphThreadOrNotRunning();
-    // #ifdef since we're not wrapping it all in MOZ_ASSERT()
-    if (!mDriver->OnThread()) {
-      mMonitor.AssertCurrentThreadOwns();
-    }
-#endif
     mDriver = aDriver;
   }
 

content/svg/content/src/SVGContentUtils.cpp

@@ -122,10 +122,21 @@ GetStrokeDashData(SVGContentUtils::AutoStrokeOptions* aStrokeOptions,
     }
   }
 
-  // Now that aStrokeOptions.mDashPattern is fully initialized we can safely
+  // Now that aStrokeOptions.mDashPattern is fully initialized (we didn't
-  // set mDashLength:
+  // return early above) we can safely set mDashLength:
   aStrokeOptions->mDashLength = dashArrayLength;
 
+  if ((dashArrayLength % 2) == 1) {
+    // If we have a dash pattern with an odd number of lengths the pattern
+    // repeats a second time, per the SVG spec., and as implemented by Moz2D.
+    // When deciding whether to return eNoStroke or eContinuousStroke below we
+    // need to take into account that in the repeat pattern the dashes become
+    // gaps, and the gaps become dashes.
+    Float origTotalLengthOfDashes = totalLengthOfDashes;
+    totalLengthOfDashes += totalLengthOfGaps;
+    totalLengthOfGaps += origTotalLengthOfDashes;
+  }
+
   if (totalLengthOfDashes <= 0 || totalLengthOfGaps <= 0) {
     if (totalLengthOfGaps > 0 && totalLengthOfDashes <= 0) {
       return eNoStroke;
@@ -172,9 +183,9 @@ SVGContentUtils::GetStrokeOptions(AutoStrokeOptions* aStrokeOptions,
     aStrokeOptions->mLineWidth = 0;
     return;
   }
-  if (dashState == eContinuousStroke) {
+  if (dashState == eContinuousStroke && aStrokeOptions->mDashPattern) {
-    // Prevent our caller from wasting time looking at the dash array:
+    // Prevent our caller from wasting time looking at a pattern without gaps:
-    aStrokeOptions->mDashLength = 0;
+    aStrokeOptions->DiscardDashPattern();
   }
 
   aStrokeOptions->mLineWidth =

content/svg/content/src/SVGContentUtils.h

@@ -116,6 +116,13 @@ public:
       mDashPattern = nonConstArray;
       return nonConstArray;
     }
+    void DiscardDashPattern() {
+      if (mDashPattern && mDashPattern != mSmallArray) {
+        delete [] mDashPattern;
+      }
+      mDashLength = 0;
+      mDashPattern = nullptr;
+    }
   private:
     // Most dasharrays will fit in this and save us allocating
     Float mSmallArray[16];

dom/bluetooth2/bluedroid/hfp/BluetoothHfpManager.cpp

@@ -27,6 +27,7 @@
 #include "nsRadioInterfaceLayer.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
+#include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #define MOZSETTINGS_CHANGED_ID               "mozsettings-changed"

dom/bluetooth2/bluez/BluetoothHfpManager.cpp

@@ -23,6 +23,7 @@
 #include "nsIObserverService.h"
 #include "nsISettingsService.h"
 #include "nsServiceManagerUtils.h"
+#include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #ifdef MOZ_B2G_RIL

dom/indexedDB/ActorsParent.cpp

@@ -6814,6 +6814,12 @@ TransactionBase::VerifyRequestParams(const RequestParams& aParams) const
     }
 
     case RequestParams::TObjectStoreDeleteParams: {
+      if (NS_WARN_IF(mMode != IDBTransaction::READ_WRITE &&
+                     mMode != IDBTransaction::VERSION_CHANGE)) {
+        ASSERT_UNLESS_FUZZING();
+        return false;
+      }
+
       const ObjectStoreDeleteParams& params =
         aParams.get_ObjectStoreDeleteParams();
       const nsRefPtr<FullObjectStoreMetadata> objectStoreMetadata =
@@ -6830,6 +6836,12 @@ TransactionBase::VerifyRequestParams(const RequestParams& aParams) const
     }
 
     case RequestParams::TObjectStoreClearParams: {
+      if (NS_WARN_IF(mMode != IDBTransaction::READ_WRITE &&
+                     mMode != IDBTransaction::VERSION_CHANGE)) {
+        ASSERT_UNLESS_FUZZING();
+        return false;
+      }
+
       const ObjectStoreClearParams& params =
         aParams.get_ObjectStoreClearParams();
       const nsRefPtr<FullObjectStoreMetadata> objectStoreMetadata =

dom/nfc/NfcContentHelper.js

@@ -50,7 +50,6 @@ const NFCCONTENTHELPER_CID =
 const NFC_IPC_MSG_NAMES = [
   "NFC:ReadNDEFResponse",
   "NFC:WriteNDEFResponse",
-  "NFC:GetDetailsNDEFResponse",
   "NFC:MakeReadOnlyNDEFResponse",
   "NFC:ConnectResponse",
   "NFC:CloseResponse",
@@ -64,17 +63,6 @@ XPCOMUtils.defineLazyServiceGetter(this, "cpmm",
                                    "@mozilla.org/childprocessmessagemanager;1",
                                    "nsISyncMessageSender");
 
-function GetDetailsNDEFResponse(details) {
-  this.canBeMadeReadOnly = details.canBeMadeReadOnly;
-  this.isReadOnly = details.isReadOnly;
-  this.maxSupportedLength = details.maxSupportedLength;
-}
-GetDetailsNDEFResponse.prototype = {
-  __exposedProps__ : {canBeMadeReadOnly: 'r',
-                      isReadOnly: 'r',
-                      maxSupportedLength: 'r'}
-};
-
 function NfcContentHelper() {
   this.initDOMRequestHelper(/* aWindow */ null, NFC_IPC_MSG_NAMES);
   Services.obs.addObserver(this, "xpcom-shutdown", false);
@@ -127,22 +115,6 @@ NfcContentHelper.prototype = {
   },
 
   // NFCTag interface
-  getDetailsNDEF: function getDetailsNDEF(window, sessionToken) {
-    if (window == null) {
-      throw Components.Exception("Can't get window object",
-                                  Cr.NS_ERROR_UNEXPECTED);
-    }
-    let request = Services.DOMRequest.createRequest(window);
-    let requestId = btoa(this.getRequestId(request));
-    this._requestMap[requestId] = window;
-
-    cpmm.sendAsyncMessage("NFC:GetDetailsNDEF", {
-      requestId: requestId,
-      sessionToken: sessionToken
-    });
-    return request;
-  },
-
   readNDEF: function readNDEF(window, sessionToken) {
     if (window == null) {
       throw Components.Exception("Can't get window object",
@@ -395,9 +367,6 @@ NfcContentHelper.prototype = {
       case "NFC:ReadNDEFResponse":
         this.handleReadNDEFResponse(result);
         break;
-      case "NFC:GetDetailsNDEFResponse":
-        this.handleGetDetailsNDEFResponse(result);
-        break;
       case "NFC:CheckP2PRegistrationResponse":
         this.handleCheckP2PRegistrationResponse(result);
         break;
@@ -452,16 +421,6 @@ NfcContentHelper.prototype = {
     this.fireRequestSuccess(requestId, ndefMsg);
   },
 
-  handleGetDetailsNDEFResponse: function handleGetDetailsNDEFResponse(result) {
-    if (result.errorMsg) {
-      this.fireRequestError(atob(result.requestId), result.errorMsg);
-      return;
-    }
-
-    let requestId = atob(result.requestId);
-    this.fireRequestSuccess(requestId, new GetDetailsNDEFResponse(result));
-  },
-
   handleCheckP2PRegistrationResponse: function handleCheckP2PRegistrationResponse(result) {
     // Privilaged status API. Always fire success to avoid using exposed props.
     // The receiver must check the boolean mapped status code to handle.

dom/nfc/gonk/Nfc.js

@@ -57,7 +57,6 @@ const NFC_IPC_MSG_NAMES = [
 
 const NFC_IPC_READ_PERM_MSG_NAMES = [
   "NFC:ReadNDEF",
-  "NFC:GetDetailsNDEF",
   "NFC:Connect",
   "NFC:Close",
 ];
@@ -263,7 +262,7 @@ XPCOMUtils.defineLazyGetter(this, "gMessageManager", function () {
       if (message.name == "child-process-shutdown") {
         this.removePeerTarget(message.target);
         this.nfc.removeTarget(message.target);
-        this.removeEventTarget(msg.target);
+        this.removeEventTarget(message.target);
         return null;
       }
 
@@ -538,7 +537,6 @@ Nfc.prototype = {
         break;
       case "ConnectResponse": // Fall through.
       case "CloseResponse":
-      case "GetDetailsNDEFResponse":
       case "ReadNDEFResponse":
       case "MakeReadOnlyNDEFResponse":
       case "WriteNDEFResponse":
@@ -608,9 +606,6 @@ Nfc.prototype = {
         this.setConfig({powerLevel: NFC.NFC_POWER_LEVEL_DISABLED,
                         requestId: message.data.requestId});
         break;
-      case "NFC:GetDetailsNDEF":
-        this.sendToNfcService("getDetailsNDEF", message.data);
-        break;
       case "NFC:ReadNDEF":
         this.sendToNfcService("readNDEF", message.data);
         break;

dom/nfc/gonk/NfcGonkMessage.h

@@ -8,13 +8,12 @@
 namespace mozilla {
 
 #define NFCD_MAJOR_VERSION 1
-#define NFCD_MINOR_VERSION 9
+#define NFCD_MINOR_VERSION 10
 
 enum NfcRequest {
   ConfigReq = 0,
   ConnectReq,
   CloseReq,
-  GetDetailsNDEFReq,
   ReadNDEFReq,
   WriteNDEFReq,
   MakeReadOnlyNDEFReq,
@@ -23,7 +22,6 @@ enum NfcRequest {
 enum NfcResponse {
   GeneralRsp = 1000,
   ConfigRsp,
-  GetDetailsNDEFRsp,
   ReadNDEFRsp,
 };
 

dom/nfc/gonk/NfcMessageHandler.cpp

@@ -17,7 +17,6 @@ using namespace mozilla;
 using namespace mozilla::dom;
 
 static const char* kConfigRequest = "config";
-static const char* kGetDetailsNDEF = "getDetailsNDEF";
 static const char* kReadNDEFRequest = "readNDEF";
 static const char* kWriteNDEFRequest = "writeNDEF";
 static const char* kMakeReadOnlyNDEFRequest = "makeReadOnlyNDEF";
@@ -25,7 +24,6 @@ static const char* kConnectRequest = "connect";
 static const char* kCloseRequest = "close";
 
 static const char* kConfigResponse = "ConfigResponse";
-static const char* kGetDetailsNDEFResponse = "GetDetailsNDEFResponse";
 static const char* kReadNDEFResponse = "ReadNDEFResponse";
 static const char* kWriteNDEFResponse = "WriteNDEFResponse";
 static const char* kMakeReadOnlyNDEFResponse = "MakeReadOnlyNDEFResponse";
@@ -46,8 +44,6 @@ NfcMessageHandler::Marshall(Parcel& aParcel, const CommandOptions& aOptions)
 
   if (!strcmp(type, kConfigRequest)) {
     result = ConfigRequest(aParcel, aOptions);
-  } else if (!strcmp(type, kGetDetailsNDEF)) {
-    result = GetDetailsNDEFRequest(aParcel, aOptions);
   } else if (!strcmp(type, kReadNDEFRequest)) {
     result = ReadNDEFRequest(aParcel, aOptions);
   } else if (!strcmp(type, kWriteNDEFRequest)) {
@@ -83,9 +79,6 @@ NfcMessageHandler::Unmarshall(const Parcel& aParcel, EventOptions& aOptions)
     case NfcResponse::ConfigRsp:
       result = ConfigResponse(aParcel, aOptions);
       break;
-    case NfcResponse::GetDetailsNDEFRsp:
-      result = GetDetailsNDEFResponse(aParcel, aOptions);
-      break;
     case NfcResponse::ReadNDEFRsp:
       result = ReadNDEFResponse(aParcel, aOptions);
       break;
@@ -171,35 +164,6 @@ NfcMessageHandler::ConfigResponse(const Parcel& aParcel, EventOptions& aOptions)
   return true;
 }
 
-bool
-NfcMessageHandler::GetDetailsNDEFRequest(Parcel& aParcel, const CommandOptions& aOptions)
-{
-  aParcel.writeInt32(NfcRequest::GetDetailsNDEFReq);
-  aParcel.writeInt32(aOptions.mSessionId);
-  mRequestIdQueue.AppendElement(aOptions.mRequestId);
-  return true;
-}
-
-bool
-NfcMessageHandler::GetDetailsNDEFResponse(const Parcel& aParcel, EventOptions& aOptions)
-{
-  aOptions.mType = NS_ConvertUTF8toUTF16(kGetDetailsNDEFResponse);
-  aOptions.mStatus = aParcel.readInt32();
-  aOptions.mSessionId = aParcel.readInt32();
-
-  if (aOptions.mStatus == NfcErrorCode::Success) {
-    int readOnly = aParcel.readInt32();
-    aOptions.mIsReadOnly = readOnly & 0xff;
-    aOptions.mCanBeMadeReadOnly = (readOnly >> 8) & 0xff;
-    aOptions.mMaxSupportedLength = aParcel.readInt32();
-  }
-
-  NS_ENSURE_TRUE(!mRequestIdQueue.IsEmpty(), false);
-  aOptions.mRequestId = mRequestIdQueue[0];
-  mRequestIdQueue.RemoveElementAt(0);
-  return true;
-}
-
 bool
 NfcMessageHandler::ReadNDEFRequest(Parcel& aParcel, const CommandOptions& aOptions)
 {

dom/nfc/gonk/NfcMessageHandler.h

@@ -27,8 +27,6 @@ private:
   bool GeneralResponse(const android::Parcel& aParcel, EventOptions& aOptions);
   bool ConfigRequest(android::Parcel& aParcel, const CommandOptions& options);
   bool ConfigResponse(const android::Parcel& aParcel, EventOptions& aOptions);
-  bool GetDetailsNDEFRequest(android::Parcel& aParcel, const CommandOptions& options);
-  bool GetDetailsNDEFResponse(const android::Parcel& aParcel, EventOptions& aOptions);
   bool ReadNDEFRequest(android::Parcel& aParcel, const CommandOptions& options);
   bool ReadNDEFResponse(const android::Parcel& aParcel, EventOptions& aOptions);
   bool WriteNDEFRequest(android::Parcel& aParcel, const CommandOptions& options);

dom/nfc/nsINfcContentHelper.idl

@@ -27,7 +27,7 @@ interface nsINfcDOMEventTarget : nsISupports
    void notifyPeerLost(in DOMString sessionToken);
 };
 
-[scriptable, uuid(7eaf4c31-e1d1-422e-aa55-181f4eb156b0)]
+[scriptable, uuid(d3f1bdc1-048f-44a8-abe2-bc386edce40b)]
 interface nsINfcContentHelper : nsISupports
 {
   const long NFC_EVENT_PEER_READY = 0x01;
@@ -35,7 +35,6 @@ interface nsINfcContentHelper : nsISupports
 
   boolean checkSessionToken(in DOMString sessionToken);
 
-  nsIDOMDOMRequest getDetailsNDEF(in nsIDOMWindow window, in DOMString sessionToken);
   nsIDOMDOMRequest readNDEF(in nsIDOMWindow window, in DOMString sessionToken);
   nsIDOMDOMRequest writeNDEF(in nsIDOMWindow window, in nsIVariant records, in DOMString sessionToken);
   nsIDOMDOMRequest makeReadOnlyNDEF(in nsIDOMWindow window, in DOMString sessionToken);

dom/resourcestats/ResourceStatsDB.jsm

@@ -14,6 +14,7 @@ const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
 
 Cu.import("resource://gre/modules/IndexedDBHelper.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.importGlobalProperties(["indexedDB"]);
 
 XPCOMUtils.defineLazyServiceGetter(this, "appsService",
                                    "@mozilla.org/AppsService;1",

dom/workers/WorkerPrivate.cpp

@@ -2430,10 +2430,10 @@ WorkerPrivateParent<Derived>::Suspend(JSContext* aCx, nsPIDOMWindow* aWindow)
   MOZ_ASSERT(aCx);
 
   // Shared workers are only suspended if all of their owning documents are
-  // suspended.
+  // suspended. It can happen that mSharedWorkers is empty but this thread has
-  if (IsSharedWorker() || IsServiceWorker()) {
+  // not been unregistered yet.
+  if ((IsSharedWorker() || IsServiceWorker()) && mSharedWorkers.Count()) {
     AssertIsOnMainThread();
-    MOZ_ASSERT(mSharedWorkers.Count());
 
     struct Closure
     {
@@ -2515,9 +2515,10 @@ WorkerPrivateParent<Derived>::Resume(JSContext* aCx, nsPIDOMWindow* aWindow)
   MOZ_ASSERT_IF(IsDedicatedWorker(), mParentSuspended);
 
   // Shared workers are resumed if any of their owning documents are resumed.
-  if (IsSharedWorker() || IsServiceWorker()) {
+  // It can happen that mSharedWorkers is empty but this thread has not been
+  // unregistered yet.
+  if ((IsSharedWorker() || IsServiceWorker()) && mSharedWorkers.Count()) {
     AssertIsOnMainThread();
-    MOZ_ASSERT(mSharedWorkers.Count());
 
     struct Closure
     {

gfx/2d/HelpersD2D.h

@@ -467,7 +467,10 @@ CreateStrokeStyleForOptions(const StrokeOptions &aStrokeOptions)
 
 
   HRESULT hr;
-  if (aStrokeOptions.mDashPattern) {
+  // We need to check mDashLength in addition to mDashPattern here since if
+  // mDashPattern is set but mDashLength is zero then the stroke will fail to
+  // paint.
+  if (aStrokeOptions.mDashLength > 0 && aStrokeOptions.mDashPattern) {
     typedef std::vector<Float> FloatVector;
     // D2D "helpfully" multiplies the dash pattern by the line width.
     // That's not what cairo does, or is what <canvas>'s dash wants.

gfx/cairo/cairo/src/cairo-image-surface.c

@@ -1085,6 +1085,12 @@ UNLOCK:
     return image;
 }
 
+static double
+clamp (double val, double min, double max)
+{
+    return val < min ? min : (val > max ? max : val);
+}
+
 static pixman_image_t *
 _pixman_image_for_gradient (const cairo_gradient_pattern_t *pattern,
 			    const cairo_rectangle_int_t *extents,
@@ -1146,6 +1152,7 @@ _pixman_image_for_gradient (const cairo_gradient_pattern_t *pattern,
 	    p2.x = _cairo_fixed_16_16_from_double (_cairo_fixed_to_double (linear->p2.x) * sf);
 	    p2.y = _cairo_fixed_16_16_from_double (_cairo_fixed_to_double (linear->p2.y) * sf);
 
+	    /* cairo_matrix_scale does a pre-scale, we want a post-scale */
 	    cairo_matrix_init_scale (&scale, sf, sf);
 	    cairo_matrix_multiply (&matrix, &matrix, &scale);
 	}
@@ -1210,9 +1217,9 @@ _pixman_image_for_gradient (const cairo_gradient_pattern_t *pattern,
 	    y = _cairo_lround (inv.y0 / 2);
 
 	    max_x = PIXMAN_MAX_INT - 1 - fabs (extents->x + extents->width);
-	    x = x > max_x ? max_x : (x < -max_x ? -max_x : x);
+	    x = clamp(x, -max_x, max_x);
 	    max_y = PIXMAN_MAX_INT - 1 - fabs (extents->y + extents->height);
-	    y = y > max_y ? max_y : (y < -max_y ? -max_y : y);
+	    y = clamp(y, -max_y, max_y);
 
 	    tx = -x;
 	    ty = -y;

gfx/cairo/cairo/src/cairo-pattern.c

@@ -1399,6 +1399,7 @@ _cairo_pattern_acquire_surface_for_gradient (const cairo_gradient_pattern_t *pat
 	    p2.x = _cairo_fixed_16_16_from_double (_cairo_fixed_to_double (linear->p2.x) * sf);
 	    p2.y = _cairo_fixed_16_16_from_double (_cairo_fixed_to_double (linear->p2.y) * sf);
 
+	    /* cairo_matrix_scale does a pre-scale, we want a post-scale */
 	    cairo_matrix_init_scale (&scale, sf, sf);
 	    cairo_matrix_multiply (&matrix, &matrix, &scale);
 	}

gfx/layers/RotatedBuffer.cpp

@@ -229,7 +229,7 @@ RotatedContentBuffer::DrawTo(PaintedLayer* aLayer,
     // Bug 599189 if there is a non-integer-translation transform in aTarget,
     // we might sample pixels outside GetEffectiveVisibleRegion(), which is wrong
     // and may cause gray lines.
-    gfxUtils::ClipToRegionSnapped(aTarget, aLayer->GetEffectiveVisibleRegion());
+    gfxUtils::ClipToRegion(aTarget, aLayer->GetEffectiveVisibleRegion());
     clipped = true;
   }
 

gfx/layers/TiledLayerBuffer.h

@@ -222,8 +222,11 @@ public:
    * ReadLock state, so that the locks can be adopted when recreating a
    * ClientTiledLayerBuffer locally. This lock will be retained until the buffer
    * has completed uploading.
+   *
+   * Returns false if a deserialization error happened, in which case we will
+   * have to kill the child process.
    */
-  virtual void UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
+  virtual bool UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
                                    const SurfaceDescriptorTiles& aTiledDescriptor) = 0;
 
   /**

gfx/layers/apz/src/AsyncPanZoomController.cpp

@@ -1578,8 +1578,9 @@ nsEventStatus AsyncPanZoomController::OnPan(const PanGestureInput& aEvent, bool
 
   // TODO: Handle pan events sent without pan begin / pan end events properly.
   if (mPanGestureState) {
+    ScreenPoint panDistance(fabs(panDisplacement.x), fabs(panDisplacement.y));
     OverscrollHandoffState handoffState(
-        *mPanGestureState->GetOverscrollHandoffChain(), panDisplacement);
+        *mPanGestureState->GetOverscrollHandoffChain(), panDistance);
     CallDispatchScroll(aEvent.mPanStartPoint, aEvent.mPanStartPoint + aEvent.mPanDisplacement,
                        handoffState);
   }
@@ -2649,6 +2650,7 @@ bool AsyncPanZoomController::IsCurrentlyCheckerboarding() const {
 
   CSSPoint currentScrollOffset = mFrameMetrics.GetScrollOffset() + mTestAsyncScrollOffset;
   CSSRect painted = mLastContentPaintMetrics.mDisplayPort + mLastContentPaintMetrics.GetScrollOffset();
+  painted.Inflate(CSSMargin::FromAppUnits(nsMargin(1, 1, 1, 1)));   // fuzz for rounding error
   CSSRect visible = CSSRect(currentScrollOffset, mFrameMetrics.CalculateCompositedSizeInCssPixels());
   return !painted.Contains(visible);
 }

gfx/layers/apz/src/OverscrollHandoffState.h

@@ -131,6 +131,7 @@ struct OverscrollHandoffState {
   // The total distance since touch-start of the pan that triggered the
   // handoff. This is const to indicate that it does not change over the
   // course of handoff.
+  // The x/y components of this are non-negative.
   const ScreenPoint mPanDistance;
 };
 // Don't pollute other files with this macro for now.

gfx/layers/composite/TiledContentHost.cpp

@@ -30,7 +30,7 @@ class Layer;
 TiledLayerBufferComposite::TiledLayerBufferComposite()
   : mFrameResolution(1.0)
   , mHasDoubleBufferedTiles(false)
-  , mUninitialized(true)
+  , mIsValid(false)
 {}
 
 /* static */ void
@@ -43,7 +43,7 @@ TiledLayerBufferComposite::TiledLayerBufferComposite(ISurfaceAllocator* aAllocat
                                                      const SurfaceDescriptorTiles& aDescriptor,
                                                      const nsIntRegion& aOldPaintedRegion)
 {
-  mUninitialized = false;
+  mIsValid = true;
   mHasDoubleBufferedTiles = false;
   mValidRegion = aDescriptor.validRegion();
   mPaintedRegion = aDescriptor.paintedRegion();
@@ -57,6 +57,8 @@ TiledLayerBufferComposite::TiledLayerBufferComposite(ISurfaceAllocator* aAllocat
   oldPaintedRegion.And(oldPaintedRegion, mValidRegion);
   mPaintedRegion.Or(mPaintedRegion, oldPaintedRegion);
 
+  bool isSameProcess = aAllocator->IsSameProcess();
+
   const InfallibleTArray<TileDescriptor>& tiles = aDescriptor.tiles();
   for(size_t i = 0; i < tiles.Length(); i++) {
     RefPtr<TextureHost> texture;
@@ -74,6 +76,17 @@ TiledLayerBufferComposite::TiledLayerBufferComposite(ISurfaceAllocator* aAllocat
         if (ipcLock.type() == TileLock::TShmemSection) {
           sharedLock = gfxShmSharedReadLock::Open(aAllocator, ipcLock.get_ShmemSection());
         } else {
+          if (!isSameProcess) {
+            // Trying to use a memory based lock instead of a shmem based one in
+            // the cross-process case is a bad security violation.
+            NS_ERROR("A client process may be trying to peek at the host's address space!");
+            // This tells the TiledContentHost that deserialization failed so that
+            // it can propagate the error.
+            mIsValid = false;
+
+            mRetainedTiles.Clear();
+            return;
+          }
           sharedLock = reinterpret_cast<gfxMemorySharedReadLock*>(ipcLock.get_uintptr_t());
           if (sharedLock) {
             // The corresponding AddRef is in TiledClient::GetTileDescriptor
@@ -287,7 +300,7 @@ TiledContentHost::Detach(Layer* aLayer,
   CompositableHost::Detach(aLayer,aFlags);
 }
 
-void
+bool
 TiledContentHost::UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
                                       const SurfaceDescriptorTiles& aTiledDescriptor)
 {
@@ -310,6 +323,14 @@ TiledContentHost::UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
     mLowPrecisionTiledBuffer =
       TiledLayerBufferComposite(aAllocator, aTiledDescriptor,
                                 mLowPrecisionTiledBuffer.GetPaintedRegion());
+    if (!mLowPrecisionTiledBuffer.IsValid()) {
+      // Something bad happened. Stop here, return false (kills the child process),
+      // and do as little work as possible on the received data as it appears
+      // to be corrupted.
+      mPendingLowPrecisionUpload = false;
+      mPendingUpload = false;
+      return false;
+    }
   } else {
     if (mPendingUpload) {
       mTiledBuffer.ReadUnlock();
@@ -322,7 +343,16 @@ TiledContentHost::UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
     }
     mTiledBuffer = TiledLayerBufferComposite(aAllocator, aTiledDescriptor,
                                              mTiledBuffer.GetPaintedRegion());
+    if (!mTiledBuffer.IsValid()) {
+      // Something bad happened. Stop here, return false (kills the child process),
+      // and do as little work as possible on the received data as it appears
+      // to be corrupted.
+      mPendingLowPrecisionUpload = false;
+      mPendingUpload = false;
+      return false;
+    }
   }
+  return true;
 }
 
 void

gfx/layers/composite/TiledContentHost.h

@@ -137,7 +137,7 @@ public:
 
   bool HasDoubleBufferedTiles() { return mHasDoubleBufferedTiles; }
 
-  bool IsValid() const { return !mUninitialized; }
+  bool IsValid() const { return mIsValid; }
 
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
   virtual void SetReleaseFence(const android::sp<android::Fence>& aReleaseFence);
@@ -162,7 +162,7 @@ protected:
 private:
   CSSToParentLayerScale mFrameResolution;
   bool mHasDoubleBufferedTiles;
-  bool mUninitialized;
+  bool mIsValid;
 };
 
 /**
@@ -215,8 +215,8 @@ public:
     return mLowPrecisionTiledBuffer.GetValidRegion();
   }
 
-  void UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
+  virtual bool UseTiledLayerBuffer(ISurfaceAllocator* aAllocator,
-                           const SurfaceDescriptorTiles& aTiledDescriptor);
+                                   const SurfaceDescriptorTiles& aTiledDescriptor) MOZ_OVERRIDE;
 
   void Composite(EffectChain& aEffectChain,
                  float aOpacity,

gfx/layers/ipc/CompositableTransactionParent.cpp

@@ -148,7 +148,10 @@ CompositableParentManager::ReceiveCompositableUpdate(const CompositableOperation
       NS_ASSERTION(tileComposer, "compositable is not a tile composer");
 
       const SurfaceDescriptorTiles& tileDesc = op.tileLayerDescriptor();
-      tileComposer->UseTiledLayerBuffer(this, tileDesc);
+      bool success = tileComposer->UseTiledLayerBuffer(this, tileDesc);
+      if (!success) {
+        return false;
+      }
       break;
     }
     case CompositableOperation::TOpRemoveTexture: {

gfx/layers/ipc/CompositorParent.cpp

@@ -685,6 +685,8 @@ CompositorParent::CompositeToTarget(DrawTarget* aTarget, const nsIntRect* aRect)
     }
   }
 
+  mCompositionManager->ComputeRotation();
+
   TimeStamp time = mIsTesting ? mTestTime : mLastCompose;
   bool requestNextFrame = mCompositionManager->TransformShadowTree(time);
   if (requestNextFrame) {
@@ -693,8 +695,6 @@ CompositorParent::CompositeToTarget(DrawTarget* aTarget, const nsIntRect* aRect)
 
   RenderTraceLayers(mLayerManager->GetRoot(), "0000");
 
-  mCompositionManager->ComputeRotation();
-
 #ifdef MOZ_DUMP_PAINTING
   static bool gDumpCompositorTree = false;
   if (gDumpCompositorTree) {

gfx/thebes/gfxUtils.cpp

@@ -665,50 +665,25 @@ ClipToRegionInternal(gfxContext* aContext, const nsIntRegion& aRegion,
 }
 
 static TemporaryRef<Path>
-PathFromRegionInternal(DrawTarget* aTarget, const nsIntRegion& aRegion,
+PathFromRegionInternal(DrawTarget* aTarget, const nsIntRegion& aRegion)
-                       bool aSnap)
 {
-  Matrix mat = aTarget->GetTransform();
-  const gfxFloat epsilon = 0.000001;
-#define WITHIN_E(a,b) (fabs((a)-(b)) < epsilon)
-  // We're essentially duplicating the logic in UserToDevicePixelSnapped here.
-  bool shouldNotSnap = !aSnap || (WITHIN_E(mat._11,1.0) &&
-                                  WITHIN_E(mat._22,1.0) &&
-                                  WITHIN_E(mat._12,0.0) &&
-                                  WITHIN_E(mat._21,0.0));
-#undef WITHIN_E
-
   RefPtr<PathBuilder> pb = aTarget->CreatePathBuilder();
   nsIntRegionRectIterator iter(aRegion);
 
   const nsIntRect* r;
-  if (shouldNotSnap) {
+  while ((r = iter.Next()) != nullptr) {
-    while ((r = iter.Next()) != nullptr) {
+    pb->MoveTo(Point(r->x, r->y));
-      pb->MoveTo(Point(r->x, r->y));
+    pb->LineTo(Point(r->XMost(), r->y));
-      pb->LineTo(Point(r->XMost(), r->y));
+    pb->LineTo(Point(r->XMost(), r->YMost()));
-      pb->LineTo(Point(r->XMost(), r->YMost()));
+    pb->LineTo(Point(r->x, r->YMost()));
-      pb->LineTo(Point(r->x, r->YMost()));
+    pb->Close();
-      pb->Close();
-    }
-  } else {
-    while ((r = iter.Next()) != nullptr) {
-      Rect rect(r->x, r->y, r->width, r->height);
-
-      rect.Round();
-      pb->MoveTo(rect.TopLeft());
-      pb->LineTo(rect.TopRight());
-      pb->LineTo(rect.BottomRight());
-      pb->LineTo(rect.BottomLeft());
-      pb->Close();
-    }
   }
   RefPtr<Path> path = pb->Finish();
   return path;
 }
 
 static void
-ClipToRegionInternal(DrawTarget* aTarget, const nsIntRegion& aRegion,
+ClipToRegionInternal(DrawTarget* aTarget, const nsIntRegion& aRegion)
-                     bool aSnap)
 {
   if (!aRegion.IsComplex()) {
     nsIntRect rect = aRegion.GetBounds();
@@ -716,7 +691,7 @@ ClipToRegionInternal(DrawTarget* aTarget, const nsIntRegion& aRegion,
     return;
   }
 
-  RefPtr<Path> path = PathFromRegionInternal(aTarget, aRegion, aSnap);
+  RefPtr<Path> path = PathFromRegionInternal(aTarget, aRegion);
   aTarget->PushClip(path);
 }
 
@@ -729,7 +704,7 @@ gfxUtils::ClipToRegion(gfxContext* aContext, const nsIntRegion& aRegion)
 /*static*/ void
 gfxUtils::ClipToRegion(DrawTarget* aTarget, const nsIntRegion& aRegion)
 {
-  ClipToRegionInternal(aTarget, aRegion, false);
+  ClipToRegionInternal(aTarget, aRegion);
 }
 
 /*static*/ void
@@ -738,12 +713,6 @@ gfxUtils::ClipToRegionSnapped(gfxContext* aContext, const nsIntRegion& aRegion)
   ClipToRegionInternal(aContext, aRegion, true);
 }
 
-/*static*/ void
-gfxUtils::ClipToRegionSnapped(DrawTarget* aTarget, const nsIntRegion& aRegion)
-{
-  ClipToRegionInternal(aTarget, aRegion, true);
-}
-
 /*static*/ gfxFloat
 gfxUtils::ClampToScaleFactor(gfxFloat aVal)
 {

gfx/thebes/gfxUtils.h

@@ -99,11 +99,6 @@ public:
      */
     static void ClipToRegionSnapped(gfxContext* aContext, const nsIntRegion& aRegion);
 
-    /**
-     * Clip aTarget to the region aRegion, snapping the rectangles.
-     */
-    static void ClipToRegionSnapped(mozilla::gfx::DrawTarget* aTarget, const nsIntRegion& aRegion);
-
     /**
      * Create a path consisting of rectangles in |aRegion|.
      */

gfx/thebes/gfxWindowsPlatform.cpp

@@ -1537,6 +1537,8 @@ gfxWindowsPlatform::InitD3D11Devices()
     return;
   }
 
+  mD3D11Device->SetExceptionMode(0);
+
 #ifdef USE_D2D1_1
   if (Factory::SupportsD2D1()) {
     hr = d3d11CreateDevice(adapter, D3D_DRIVER_TYPE_UNKNOWN, nullptr,
@@ -1549,6 +1551,8 @@ gfxWindowsPlatform::InitD3D11Devices()
       return;
     }
 
+    mD3D11ContentDevice->SetExceptionMode(0);
+
     Factory::SetDirect3D11Device(mD3D11ContentDevice);
   }
 #endif

js/src/builtin/Object.cpp

@@ -1034,15 +1034,19 @@ obj_isExtensible(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+// ES6 draft rev27 (2014/08/24) 19.1.2.15 Object.preventExtensions(O)
 static bool
 obj_preventExtensions(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    RootedObject obj(cx);
+    args.rval().set(args.get(0));
-    if (!GetFirstArgumentAsObject(cx, args, "Object.preventExtensions", &obj))
-        return false;
 
-    args.rval().setObject(*obj);
+    // step 1
+    if (!args.get(0).isObject())
+        return true;
+
+    // steps 2-5
+    RootedObject obj(cx, &args.get(0).toObject());
 
     return JSObject::preventExtensions(cx, obj);
 }

js/src/jit-test/tests/asm.js/bug885976.js

@@ -8,5 +8,5 @@ function test(stdlib, foreign) {
     }
     return f;
 };
-f = test(this, {ff: Object.preventExtensions});
+f = test(this, {ff: Object.defineProperty});
 f();

js/src/jit-test/tests/asm.js/simd-fbirds.js

@@ -0,0 +1,210 @@
+/* -*- Mode: javascript; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 ; js-indent-level : 2 ; js-curly-indent-offset: 0 -*- */
+/* vim: set ts=4 et sw=4 tw=80: */
+
+// Author: Peter Jensen
+
+load(libdir + "asm.js");
+if (!isSimdAvailable() || typeof SIMD === 'undefined') {
+    print("won't run tests as simd extensions aren't activated yet");
+    quit(0);
+}
+
+const NUM_BIRDS = 30;
+const NUM_UPDATES = 20;
+const ACCEL_DATA_STEPS = 30;
+
+var buffer = new ArrayBuffer(0x200000);
+var bufferF32 = new Float32Array(buffer);
+
+var actualBirds = 0;
+
+function init() {
+    actualBirds = 0;
+    // Make it a power of two, for quick modulo wrapping.
+    var accelDataValues = [10.0, 9.5, 9.0, 8.0, 7.0, 6.0, 5.5, 5.0, 5.0, 5.0, 5.5, 6.0, 7.0, 8.0, 9.0, 10.0];
+    accelDataValues = accelDataValues.map(function(v) { return 50*v; });
+    var accelDataValuesLength = accelDataValues.length;
+    assertEq(accelDataValuesLength, 16); // Hard coded in the asm.js module
+    for (i = 0; i < accelDataValuesLength; i++)
+        bufferF32[i + NUM_BIRDS * 2] = accelDataValues[i];
+}
+
+function addBird(pos, vel) {
+    bufferF32[actualBirds] = pos;
+    bufferF32[actualBirds + NUM_BIRDS] = vel;
+    actualBirds++;
+    return actualBirds - 1;
+}
+
+function getActualBirds() {
+    return actualBirds;
+}
+
+var code = `
+    "use asm";
+    var toF = global.Math.fround;
+    var f32 = new global.Float32Array(buffer);
+    const maxBirds = 100000;
+    const maxBirdsx4 = 400000;
+    const maxBirdsx4Plus4 = 400004;
+    const maxBirdsx4Plus8 = 400008;
+    const maxBirdsx4Plus12 = 400012;
+    const maxBirdsx8 = 800000;
+    const accelMask = 0x3c;
+    const mk2 = 0x000ffffc;
+
+    const getMaxPos = 1000.0;
+    const getAccelDataSteps = imp.accelDataSteps | 0;
+    var getActualBirds = imp.getActualBirds;
+
+    var i4 = global.SIMD.int32x4;
+    var f4 = global.SIMD.float32x4;
+    var i4add = i4.add;
+    var i4and = i4.and;
+    var f4select = f4.select;
+    var f4add = f4.add;
+    var f4sub = f4.sub;
+    var f4mul = f4.mul;
+    var f4greaterThan = f4.greaterThan;
+    var f4splat = f4.splat;
+
+    const zerox4 = f4(0.0,0.0,0.0,0.0);
+
+    function declareHeapSize() {
+        f32[0x0007ffff] = toF(0.0);
+    }
+
+    function update(timeDelta) {
+        timeDelta = toF(timeDelta);
+        //      var steps               = Math.ceil(timeDelta/accelData.interval);
+        var steps = 0;
+        var subTimeDelta = toF(0.0);
+        var actualBirds = 0;
+        var maxPos = toF(0.0);
+        var maxPosx4 = f4(0.0,0.0,0.0,0.0);
+        var subTimeDeltax4  = f4(0.0,0.0,0.0,0.0);
+        var subTimeDeltaSquaredx4 = f4(0.0,0.0,0.0,0.0);
+        var point5x4 = f4(0.5, 0.5, 0.5, 0.5);
+        var i = 0;
+        var len = 0;
+        var accelIndex = 0;
+        var newPosx4 = f4(0.0,0.0,0.0,0.0);
+        var newVelx4 = f4(0.0,0.0,0.0,0.0);
+        var accel = toF(0.0);
+        var accelx4 = f4(0.0,0.0,0.0,0.0);
+        var a = 0;
+        var posDeltax4 = f4(0.0,0.0,0.0,0.0);
+        var cmpx4 = i4(0,0,0,0);
+        var newVelTruex4 = f4(0.0,0.0,0.0,0.0);
+
+        steps = getAccelDataSteps | 0;
+        subTimeDelta = toF(toF(timeDelta / toF(steps | 0)) / toF(1000.0));
+        actualBirds = getActualBirds() | 0;
+        maxPos = toF(+getMaxPos);
+        maxPosx4 = f4splat(maxPos);
+        subTimeDeltax4 = f4splat(subTimeDelta);
+        subTimeDeltaSquaredx4 = f4mul(subTimeDeltax4, subTimeDeltax4);
+
+        len = ((actualBirds + 3) >> 2) << 4;
+
+        for (i = 0; (i | 0) < (len | 0); i = (i + 16) | 0) {
+            accelIndex = 0;
+            // Work around unimplemented Float32x4Array
+            newPosx4 = f4(toF(f32[(i & mk2) >> 2]),
+                    toF(f32[(i & mk2) + 4 >> 2]),
+                    toF(f32[(i & mk2) + 8 >> 2]),
+                    toF(f32[(i & mk2) + 12 >> 2]));
+            newVelx4 = f4(toF(f32[(i & mk2) + maxBirdsx4 >> 2]),
+                    toF(f32[(i & mk2) + maxBirdsx4Plus4 >> 2]),
+                    toF(f32[(i & mk2) + maxBirdsx4Plus8 >> 2]),
+                    toF(f32[(i & mk2) + maxBirdsx4Plus12 >> 2]));
+            for (a = 0; (a | 0) < (steps | 0); a = (a + 1) | 0) {
+                accel = toF(f32[(accelIndex & accelMask) + maxBirdsx8 >> 2]);
+                accelx4 = f4splat(accel);
+                accelIndex = (accelIndex + 4) | 0;
+                posDeltax4 = f4mul(point5x4, f4mul(accelx4, subTimeDeltaSquaredx4));
+                posDeltax4 = f4add(posDeltax4, f4mul(newVelx4, subTimeDeltax4));
+                newPosx4 = f4add(newPosx4, posDeltax4);
+                newVelx4 = f4add(newVelx4, f4mul(accelx4, subTimeDeltax4));
+                cmpx4 = f4greaterThan(newPosx4, maxPosx4);
+
+                if (cmpx4.signMask) {
+                    // Work around unimplemented 'neg' operation, using 0 - x.
+                    newVelTruex4 = f4sub(zerox4, newVelx4);
+                    newVelx4 = f4select(cmpx4, newVelTruex4, newVelx4);
+                }
+            }
+            // Work around unimplemented Float32x4Array
+            f32[(i & mk2) >> 2] = newPosx4.x;
+            f32[(i & mk2) + 4 >> 2] = newPosx4.y;
+            f32[(i & mk2) + 8 >> 2] = newPosx4.z;
+            f32[(i & mk2) + 12 >> 2] = newPosx4.w;
+            f32[(i & mk2) + maxBirdsx4 >> 2] = newVelx4.x;
+            f32[(i & mk2) + maxBirdsx4Plus4 >> 2] = newVelx4.y;
+            f32[(i & mk2) + maxBirdsx4Plus8 >> 2] = newVelx4.z;
+            f32[(i & mk2) + maxBirdsx4Plus12 >> 2] = newVelx4.w;
+        }
+    }
+
+    return update;
+`
+
+var ffi = {
+    getActualBirds,
+    accelDataSteps: ACCEL_DATA_STEPS
+};
+
+var fbirds = asmLink(asmCompile('global', 'imp', 'buffer', code), this, ffi, buffer);
+
+init();
+for (var i = 0; i < NUM_BIRDS; i++) {
+    addBird(i / 10, Math.exp(2, NUM_BIRDS - i));
+}
+
+var b = dateNow();
+for (var j = 0; j < NUM_UPDATES; j++) {
+    fbirds(16);
+}
+print(dateNow() - b);
+
+assertEq(bufferF32[0], 0);
+assertEq(bufferF32[1], 0.10000000149011612);
+assertEq(bufferF32[2], 0.20000000298023224);
+assertEq(bufferF32[3], 0.30000001192092896);
+assertEq(bufferF32[4], 0.4000000059604645);
+assertEq(bufferF32[5], 0.5);
+assertEq(bufferF32[6], 0.6000000238418579);
+assertEq(bufferF32[7], 0.699999988079071);
+assertEq(bufferF32[8], 0.800000011920929);
+assertEq(bufferF32[9], 0.8999999761581421);
+assertEq(bufferF32[10], 1);
+assertEq(bufferF32[11], 1.100000023841858);
+assertEq(bufferF32[12], 1.2000000476837158);
+assertEq(bufferF32[13], 1.2999999523162842);
+assertEq(bufferF32[14], 1.399999976158142);
+assertEq(bufferF32[15], 1.5);
+assertEq(bufferF32[16], 1.600000023841858);
+assertEq(bufferF32[17], 1.7000000476837158);
+assertEq(bufferF32[18], 1.7999999523162842);
+assertEq(bufferF32[19], 1.899999976158142);
+assertEq(bufferF32[20], 2);
+assertEq(bufferF32[21], 2.0999999046325684);
+assertEq(bufferF32[22], 2.200000047683716);
+assertEq(bufferF32[23], 2.299999952316284);
+assertEq(bufferF32[24], 2.4000000953674316);
+assertEq(bufferF32[25], 2.5);
+assertEq(bufferF32[26], 2.5999999046325684);
+assertEq(bufferF32[27], 2.700000047683716);
+assertEq(bufferF32[28], 2.799999952316284);
+assertEq(bufferF32[29], 2.9000000953674316);
+
+
+// Code used to generate the assertEq list above.
+function generateAssertList() {
+    var buf = '';
+    for (var k = 0; k < NUM_BIRDS; k++) {
+        buf += 'assertEq(bufferF32['+ k + '], ' + bufferF32[k] + ');\n';
+    }
+    print(buf);
+}
+//generateAssertList();

js/src/jit-test/tests/asm.js/testStackWalking.js

@@ -65,7 +65,7 @@ assertEq(caught, true);
 
 var caught = false;
 try {
-    callFFI(null, {ffi:Object.preventExtensions})();
+    callFFI(null, {ffi:Object.defineProperty})();
 } catch (e) {
     caught = true;
 }

js/src/jit-test/tests/sharedbuf/bug1068458-toolong.js

@@ -1,14 +0,0 @@
-// This used to assert, now it will throw because the limit
-// (in bytes) on a SharedArrayBuffer is INT32_MAX.
-
-if (!this.SharedUint16Array)
-    quit();
-
-var thrown = false;
-try {
-    new SharedUint16Array(2147483647);
-}
-catch (e) {
-    thrown = true;
-}
-assertEq(thrown, true);

js/src/jit-test/tests/sharedbuf/toolong.js

@@ -0,0 +1,22 @@
+// Various cases that used to assert, but will now throw (as they should).
+
+if (!this.SharedUint16Array)
+    quit();
+
+var thrown = false;
+try {
+    new SharedUint16Array(2147483647); // Bug 1068458
+}
+catch (e) {
+    thrown = true;
+}
+assertEq(thrown, true);
+
+var thrown = false;
+try {
+    new SharedUint16Array(0xdeadbeef); // Bug 1072176
+}
+catch (e) {
+    thrown = true;
+}
+assertEq(thrown, true);

js/src/jit/BacktrackingAllocator.cpp

@@ -1128,7 +1128,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res, def->type()))
+                        if (!group->addAfter(sourceAlloc, res, reg->type()))
                             return false;
                         *alloc = *res;
                     }

js/src/jit/LIR.cpp

@@ -348,6 +348,8 @@ static const char * const TypeChars[] =
     "s",            // SLOTS
     "f",            // FLOAT32
     "d",            // DOUBLE
+    "i32x4",        // INT32X4
+    "f32x4",        // FLOAT32X4
 #ifdef JS_NUNBOX32
     "t",            // TYPE
     "p"             // PAYLOAD
@@ -541,9 +543,25 @@ bool
 LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
 #ifdef DEBUG
-    JS_ASSERT(*from != *to);
+    MOZ_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
-        JS_ASSERT(*to != *moves_[i].to());
+        MOZ_ASSERT(*to != *moves_[i].to());
+
+    // Check that SIMD moves are aligned according to ABI requirements.
+    if (LDefinition(type).isSimdType()) {
+        if (from->isMemory()) {
+            if (from->isArgument())
+                MOZ_ASSERT(from->toArgument()->index() % SimdStackAlignment == 0);
+            else
+                MOZ_ASSERT(from->toStackSlot()->slot() % SimdStackAlignment == 0);
+        }
+        if (to->isMemory()) {
+            if (to->isArgument())
+                MOZ_ASSERT(to->toArgument()->index() % SimdStackAlignment == 0);
+            else
+                MOZ_ASSERT(to->toStackSlot()->slot() % SimdStackAlignment == 0);
+        }
+    }
 #endif
     return moves_.append(LMove(from, to, type));
 }
@@ -582,7 +600,11 @@ LMoveGroup::printOperands(FILE *fp)
         const LMove &move = getMove(i);
         // Use two printfs, as LAllocation::toString is not reentrant.
         fprintf(fp, " [%s", move.from()->toString());
-        fprintf(fp, " -> %s]", move.to()->toString());
+        fprintf(fp, " -> %s", move.to()->toString());
+#ifdef DEBUG
+        fprintf(fp, ", %s", TypeChars[move.type()]);
+#endif
+        fprintf(fp, "]");
         if (i != numMoves() - 1)
             fprintf(fp, ",");
     }

js/src/jit/LIR.h

@@ -416,6 +416,7 @@ class LDefinition
         MUST_REUSE_INPUT
     };
 
+    // This should be kept in sync with LIR.cpp's TypeChars.
     enum Type {
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         INT32,      // int32 data (GPR).

js/src/jit/RegisterAllocator.cpp

@@ -407,7 +407,7 @@ AllocationIntegrityState::dump()
             if (ins->isMoveGroup()) {
                 LMoveGroup *group = ins->toMoveGroup();
                 for (int i = group->numMoves() - 1; i >= 0; i--) {
-                    // Use two printfs, as LAllocation::toString is not reentant.
+                    // Use two printfs, as LAllocation::toString is not reentrant.
                     fprintf(stderr, " [%s", group->getMove(i).from()->toString());
                     fprintf(stderr, " -> %s]", group->getMove(i).to()->toString());
                 }

js/src/jsmath.cpp

@@ -742,9 +742,6 @@ random_generateSeed()
      * do, so just mix in the fd error code and the current time.
      */
     int fd = open("/dev/urandom", O_RDONLY);
-    if (fd < 0) {
-        perror("FITZGEN: error opening /dev/urandom: ");
-    }
     MOZ_ASSERT(fd >= 0, "Can't open /dev/urandom");
     if (fd >= 0) {
         (void)read(fd, seed.u8, mozilla::ArrayLength(seed.u8));

js/src/jsobj.cpp

@@ -1525,8 +1525,10 @@ js::NewObjectWithGivenProto(ExclusiveContext *cxArg, const js::Class *clasp,
         allocKind = GetBackgroundAllocKind(allocKind);
 
     NewObjectCache::EntryIndex entry = -1;
+    uint64_t gcNumber = 0;
     if (JSContext *cx = cxArg->maybeJSContext()) {
-        NewObjectCache &cache = cx->runtime()->newObjectCache;
+        JSRuntime *rt = cx->runtime();
+        NewObjectCache &cache = rt->newObjectCache;
         if (protoArg.isObject() &&
             newKind == GenericObject &&
             !cx->compartment()->hasObjectMetadataCallback() &&
@@ -1547,6 +1549,7 @@ js::NewObjectWithGivenProto(ExclusiveContext *cxArg, const js::Class *clasp,
                 }
             }
         }
+        gcNumber = rt->gc.gcNumber();
     }
 
     Rooted<TaggedProto> proto(cxArg, protoArg);
@@ -1567,7 +1570,9 @@ js::NewObjectWithGivenProto(ExclusiveContext *cxArg, const js::Class *clasp,
     if (!obj)
         return nullptr;
 
-    if (entry != -1 && !obj->hasDynamicSlots()) {
+    if (entry != -1 && !obj->hasDynamicSlots() &&
+        cxArg->asJSContext()->runtime()->gc.gcNumber() == gcNumber)
+    {
         cxArg->asJSContext()->runtime()->newObjectCache.fillProto(entry, clasp,
                                                                   proto, allocKind, obj);
     }

js/src/tests/ecma_6/Object/preventExtensions.js

@@ -0,0 +1,21 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * https://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+var BUGNUMBER = 1073446;
+var summary = "Object.preventExtensions() should return its argument with no conversion when the argument is a primitive value";
+
+print(BUGNUMBER + ": " + summary);
+assertEq(Object.preventExtensions(), undefined);
+assertEq(Object.preventExtensions(undefined), undefined);
+assertEq(Object.preventExtensions(null), null);
+assertEq(Object.preventExtensions(1), 1);
+assertEq(Object.preventExtensions("foo"), "foo");
+assertEq(Object.preventExtensions(true), true);
+if (typeof Symbol === "function") {
+    assertEq(Object.preventExtensions(Symbol.for("foo")), Symbol.for("foo"));
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);

js/src/vm/Runtime.h

@@ -315,18 +315,23 @@ class NewObjectCache
     void invalidateEntriesForShape(JSContext *cx, HandleShape shape, HandleObject proto);
 
   private:
-    bool lookup(const Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry) {
+    EntryIndex makeIndex(const Class *clasp, gc::Cell *key, gc::AllocKind kind) {
         uintptr_t hash = (uintptr_t(clasp) ^ uintptr_t(key)) + kind;
-        *pentry = hash % mozilla::ArrayLength(entries);
+        return hash % mozilla::ArrayLength(entries);
+    }
 
+    bool lookup(const Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry) {
+        *pentry = makeIndex(clasp, key, kind);
         Entry *entry = &entries[*pentry];
 
         /* N.B. Lookups with the same clasp/key but different kinds map to different entries. */
         return entry->clasp == clasp && entry->key == key;
     }
 
-    void fill(EntryIndex entry_, const Class *clasp, gc::Cell *key, gc::AllocKind kind, JSObject *obj) {
+    void fill(EntryIndex entry_, const Class *clasp, gc::Cell *key, gc::AllocKind kind,
+              JSObject *obj) {
         JS_ASSERT(unsigned(entry_) < mozilla::ArrayLength(entries));
+        JS_ASSERT(entry_ == makeIndex(clasp, key, kind));
         Entry *entry = &entries[entry_];
 
         JS_ASSERT(!obj->hasDynamicSlots() && !obj->hasDynamicElements());

js/src/vm/SharedTypedArrayObject.cpp

@@ -145,6 +145,8 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
     static SharedTypedArrayObject *
     makeTypedInstance(JSContext *cx, uint32_t len, AllocKind allocKind)
     {
+        JS_ASSERT(len <= MAX_LENGTH / sizeof(NativeType));
+
         // Multiplication is safe due to preconditions for makeInstance().
         if (len * sizeof(NativeType) >= SharedTypedArrayObject::SINGLETON_TYPE_BYTE_LENGTH) {
             return &NewBuiltinClassInstance(cx, instanceClass(), allocKind,
@@ -173,8 +175,8 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
                  HandleObject proto)
     {
         JS_ASSERT(buffer);
-        JS_ASSERT(len <= MAX_LENGTH / sizeof(NativeType));
         JS_ASSERT(byteOffset <= MAX_BYTEOFFSET);
+        JS_ASSERT(len <= MAX_LENGTH / sizeof(NativeType));
 
         gc::AllocKind allocKind = GetGCObjectKind(instanceClass());
 
@@ -304,18 +306,6 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
         return fromBuffer(cx, dataObj, byteOffset, length);
     }
 
-    static bool
-    createArrayBuffer(JSContext *cx, uint32_t nelements, MutableHandle<SharedArrayBufferObject *> buffer)
-    {
-        if (nelements > MAX_LENGTH / sizeof(NativeType)) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                                 JSMSG_NEED_DIET, "shared typed array");
-            return false;
-        }
-        buffer.set(SharedArrayBufferObject::New(cx, nelements * sizeof(NativeType)));
-        return !!buffer;
-    }
-
     template<Value ValueGetter(SharedTypedArrayObject *tarr)>
     static bool
     GetterImpl(JSContext *cx, CallArgs args)
@@ -412,6 +402,11 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
 
     static Value getIndexValue(JSObject *tarray, uint32_t index);
 
+    static bool fun_subarray(JSContext *cx, unsigned argc, Value *vp);
+    static bool fun_copyWithin(JSContext *cx, unsigned argc, Value *vp);
+    static bool fun_set(JSContext *cx, unsigned argc, Value *vp);
+
+  public:
     static JSObject *
     fromBufferWithProto(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, uint32_t length,
                         HandleObject proto)
@@ -421,8 +416,6 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
             return nullptr; // must be SharedArrayBuffer
         }
 
-        JS_ASSERT(IsSharedArrayBuffer(bufobj) || bufobj->is<ProxyObject>());
-
         if (bufobj->is<ProxyObject>()) {
             // Complicated, see TypedArrayObject.cpp for code.  For now, punt.
             JS_ReportError(cx, "Permission denied to access object");
@@ -437,7 +430,6 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
             return nullptr;
         }
 
-        JS_ASSERT(byteOffset <= buffer->byteLength());
         uint32_t bytesAvailable = buffer->byteLength() - byteOffset;
 
         if (length == LENGTH_NOT_PROVIDED) {
@@ -449,23 +441,16 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
         }
 
         if (length > MAX_LENGTH / sizeof(NativeType) || length * sizeof(NativeType) > bytesAvailable) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_SHARED_TYPED_ARRAY_BAD_ARGS);
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
             return nullptr;
         }
 
         return makeInstance(cx, buffer, byteOffset, length, proto);
     }
 
-    static bool fun_subarray(JSContext *cx, unsigned argc, Value *vp);
-    static bool fun_copyWithin(JSContext *cx, unsigned argc, Value *vp);
-    static bool fun_set(JSContext *cx, unsigned argc, Value *vp);
-
-  public:
     static JSObject *
     fromBuffer(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, uint32_t length)
     {
-        JS_ASSERT(byteOffset <= MAX_BYTEOFFSET);
-        JS_ASSERT(length <= MAX_LENGTH || length == LENGTH_NOT_PROVIDED);
         RootedObject proto(cx, nullptr);
         return fromBufferWithProto(cx, bufobj, byteOffset, length, proto);
     }
@@ -473,10 +458,13 @@ class SharedTypedArrayObjectTemplate : public SharedTypedArrayObject
     static JSObject *
     fromLength(JSContext *cx, uint32_t nelements)
     {
-        JS_ASSERT(nelements <= MAX_LENGTH);
+        if (nelements > MAX_LENGTH / sizeof(NativeType)) {
-        Rooted<SharedArrayBufferObject *> buffer(cx);
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
-        // Invariant established by createArrayBuffer(): nelements * sizeof(NativeType) <= MAX_LENGTH.
+            return nullptr;
-        if (!createArrayBuffer(cx, nelements, &buffer))
+        }
+        Rooted<SharedArrayBufferObject *> buffer(
+            cx, SharedArrayBufferObject::New(cx, nelements * sizeof(NativeType)));
+        if (!buffer)
             return nullptr;
         return makeInstance(cx, buffer, 0, nelements);
     }

js/xpconnect/loader/mozJSComponentLoader.cpp

@@ -389,7 +389,8 @@ mozJSComponentLoader::ReallyInit()
     // XXXkhuey B2G child processes have some sort of preferences race that
     // results in getting the wrong value.
     // But we don't want that on Firefox Mulet as it break most Firefox JSMs...
-#if defined(MOZ_B2G) && !defined(MOZ_MULET)
+    // Also disable on debug builds to break js components that rely on this.
+#if defined(MOZ_B2G) && !defined(MOZ_MULET) && !defined(DEBUG)
     mReuseLoaderGlobal = true;
 #endif
 

layout/reftests/svg/reftest.list

@@ -326,7 +326,7 @@ fuzzy-if(cocoaWidget&&layersGPUAccelerated,1,3) == text-layout-06.svg text-layou
 HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
-fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
+== stroke-dasharray-01.svg stroke-dasharray-01-ref.svg
 == stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg

layout/svg/SVGTextFrame.cpp

@@ -2709,7 +2709,7 @@ public:
                            bool aShouldPaintSVGGlyphs)
     : DrawPathCallbacks(aShouldPaintSVGGlyphs),
       gfx(aContext->ThebesContext()),
-      mRenderMode(SVGAutoRenderState::GetRenderMode(aContext)),
+      mRenderMode(SVGAutoRenderState::GetRenderMode(aContext->GetDrawTarget())),
       mFrame(aFrame),
       mCanvasTM(aCanvasTM)
   {
@@ -5117,7 +5117,8 @@ SVGTextFrame::ShouldRenderAsPath(nsRenderingContext* aContext,
                                  bool& aShouldPaintSVGGlyphs)
 {
   // Rendering to a clip path.
-  if (SVGAutoRenderState::GetRenderMode(aContext) != SVGAutoRenderState::NORMAL) {
+  if (SVGAutoRenderState::GetRenderMode(aContext->GetDrawTarget()) !=
+        SVGAutoRenderState::NORMAL) {
     aShouldPaintSVGGlyphs = false;
     return true;
   }

layout/svg/nsSVGClipPathFrame.cpp

@@ -94,7 +94,8 @@ nsSVGClipPathFrame::ApplyClipOrPaintClipMask(nsRenderingContext* aContext,
   // Seems like this is a non-trivial clipPath, so we need to use a clip mask.
 
   // Notify our children that they're painting into a clip mask:
-  SVGAutoRenderState mode(aContext, SVGAutoRenderState::CLIP_MASK);
+  SVGAutoRenderState mode(aContext->GetDrawTarget(),
+                          SVGAutoRenderState::CLIP_MASK);
 
   // Check if this clipPath is itself clipped by another clipPath:
   nsSVGClipPathFrame *clipPathFrame =

layout/svg/nsSVGForeignObjectFrame.cpp

@@ -266,7 +266,7 @@ nsSVGForeignObjectFrame::PaintSVG(nsRenderingContext *aContext,
   gfx->Multiply(canvasTMForChildren);
 
   uint32_t flags = nsLayoutUtils::PAINT_IN_TRANSFORM;
-  if (SVGAutoRenderState::IsPaintingToWindow(aContext)) {
+  if (SVGAutoRenderState::IsPaintingToWindow(aContext->GetDrawTarget())) {
     flags |= nsLayoutUtils::PAINT_TO_WINDOW;
   }
   nsresult rv = nsLayoutUtils::PaintFrame(aContext, kid, nsRegion(kidDirtyRect),

layout/svg/nsSVGGradientFrame.cpp

@@ -263,13 +263,12 @@ nsSVGGradientFrame::GetPaintServerPattern(nsIFrame* aSource,
     return nullptr;
   }
 
-  // revert the vector effect transform so that the gradient appears unchanged
+  // revert any vector effect transform so that the gradient appears unchanged
   if (aFillOrStroke == &nsStyleSVG::mStroke) {
-    gfxMatrix nonScalingStrokeTM = nsSVGUtils::GetStrokeTransform(aSource);
+    gfxMatrix userToOuterSVG;
-    if (!nonScalingStrokeTM.Invert()) {
+    if (nsSVGUtils::GetNonScalingStrokeTransform(aSource, &userToOuterSVG)) {
-      return nullptr;
+      patternMatrix *= userToOuterSVG;
     }
-    patternMatrix *= nonScalingStrokeTM;
   }
 
   if (!patternMatrix.Invert()) {

layout/svg/nsSVGOuterSVGFrame.cpp

@@ -590,7 +590,8 @@ nsDisplayOuterSVG::Paint(nsDisplayListBuilder* aBuilder,
 
   // Create an SVGAutoRenderState so we can call SetPaintingToWindow on
   // it, but do so without changing the render mode:
-  SVGAutoRenderState state(aContext, SVGAutoRenderState::GetRenderMode(aContext));
+  SVGAutoRenderState state(aContext->GetDrawTarget(),
+    SVGAutoRenderState::GetRenderMode(aContext->GetDrawTarget()));
 
   if (aBuilder->IsPaintingToWindow()) {
     state.SetPaintingToWindow(true);

layout/svg/nsSVGPathGeometryFrame.cpp

@@ -12,6 +12,7 @@
 #include "gfxPlatform.h"
 #include "gfxSVGGlyphs.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/gfx/Helpers.h"
 #include "mozilla/RefPtr.h"
 #include "nsDisplayList.h"
 #include "nsGkAtoms.h"
@@ -107,11 +108,9 @@ nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
   gfxPoint devPixelOffset =
     nsLayoutUtils::PointToGfxPoint(offset, appUnitsPerDevPixel);
 
-  aCtx->ThebesContext()->Save();
   gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
                    gfxMatrix::Translation(devPixelOffset);
   static_cast<nsSVGPathGeometryFrame*>(mFrame)->PaintSVG(aCtx, tm);
-  aCtx->ThebesContext()->Restore();
 }
 
 //----------------------------------------------------------------------
@@ -219,9 +218,18 @@ nsSVGPathGeometryFrame::PaintSVG(nsRenderingContext *aContext,
   if (!StyleVisibility()->IsVisible())
     return NS_OK;
 
+  gfxContext* gfx = aContext->ThebesContext();
+
+  // Matrix to the geometry's user space:
+  gfxMatrix newMatrix =
+    gfx->CurrentMatrix().PreMultiply(aTransform).NudgeToIntegers();
+  if (newMatrix.IsSingular()) {
+    return NS_OK;
+  }
+
   uint32_t paintOrder = StyleSVG()->mPaintOrder;
   if (paintOrder == NS_STYLE_PAINT_ORDER_NORMAL) {
-    Render(aContext, eRenderFill | eRenderStroke, aTransform);
+    Render(gfx, eRenderFill | eRenderStroke, newMatrix);
     PaintMarkers(aContext, aTransform);
   } else {
     while (paintOrder) {
@@ -229,10 +237,10 @@ nsSVGPathGeometryFrame::PaintSVG(nsRenderingContext *aContext,
         paintOrder & ((1 << NS_STYLE_PAINT_ORDER_BITWIDTH) - 1);
       switch (component) {
         case NS_STYLE_PAINT_ORDER_FILL:
-          Render(aContext, eRenderFill, aTransform);
+          Render(gfx, eRenderFill, newMatrix);
           break;
         case NS_STYLE_PAINT_ORDER_STROKE:
-          Render(aContext, eRenderStroke, aTransform);
+          Render(gfx, eRenderStroke, newMatrix);
           break;
         case NS_STYLE_PAINT_ORDER_MARKERS:
           PaintMarkers(aContext, aTransform);
@@ -294,18 +302,15 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
     Point point = ToPoint(aPoint);
     SVGContentUtils::AutoStrokeOptions stroke;
     SVGContentUtils::GetStrokeOptions(&stroke, content, StyleContext(), nullptr);
-    Matrix nonScalingStrokeMatrix = ToMatrix(nsSVGUtils::GetStrokeTransform(this));
+    gfxMatrix userToOuterSVG;
-    if (!nonScalingStrokeMatrix.IsIdentity()) {
+    if (nsSVGUtils::GetNonScalingStrokeTransform(this, &userToOuterSVG)) {
       // We need to transform the path back into the appropriate ancestor
       // coordinate system in order for non-scaled stroke to be correct.
       // Naturally we also need to transform the point into the same
       // coordinate system in order to hit-test against the path.
-      if (!nonScalingStrokeMatrix.Invert()) {
+      point = ToMatrix(userToOuterSVG) * point;
-        return nullptr;
-      }
-      point = nonScalingStrokeMatrix * point;
       RefPtr<PathBuilder> builder =
-        path->TransformedCopyToBuilder(nonScalingStrokeMatrix, fillRule);
+        path->TransformedCopyToBuilder(ToMatrix(userToOuterSVG), fillRule);
       path = builder->Finish();
     }
     isHit = path->StrokeContainsPoint(stroke, point, Matrix());
@@ -608,25 +613,24 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 }
 
 void
-nsSVGPathGeometryFrame::Render(nsRenderingContext *aContext,
+nsSVGPathGeometryFrame::Render(gfxContext* aContext,
                                uint32_t aRenderComponents,
-                               const gfxMatrix& aTransform)
+                               const gfxMatrix& aNewTransform)
 {
-  gfxContext *gfx = aContext->ThebesContext();
+  MOZ_ASSERT(!aNewTransform.IsSingular());
 
-  gfxMatrix newMatrix =
+  DrawTarget* drawTarget = aContext->GetDrawTarget();
-    gfx->CurrentMatrix().PreMultiply(aTransform).NudgeToIntegers();
+
-  if (newMatrix.IsSingular()) {
+  uint16_t renderMode = SVGAutoRenderState::GetRenderMode(drawTarget);
-    return;
+  MOZ_ASSERT(renderMode == SVGAutoRenderState::NORMAL ||
-  }
+             renderMode == SVGAutoRenderState::CLIP_MASK,
+             "Unknown render mode");
 
-  uint16_t renderMode = SVGAutoRenderState::GetRenderMode(aContext);
   FillRule fillRule =
-    nsSVGUtils::ToFillRule(renderMode == SVGAutoRenderState::CLIP_MASK ?
+    nsSVGUtils::ToFillRule(renderMode == SVGAutoRenderState::NORMAL ?
-                             StyleSVG()->mClipRule : StyleSVG()->mFillRule);
+                             StyleSVG()->mFillRule : StyleSVG()->mClipRule);
 
-  RefPtr<PathBuilder> builder =
+  RefPtr<PathBuilder> builder = drawTarget->CreatePathBuilder(fillRule);
-    aContext->GetDrawTarget()->CreatePathBuilder(fillRule);
   if (!builder) {
     return;
   }
@@ -637,62 +641,65 @@ nsSVGPathGeometryFrame::Render(nsRenderingContext *aContext,
     return;
   }
 
-  switch (StyleSVG()->mShapeRendering) {
+  AntialiasMode aaMode =
-  case NS_STYLE_SHAPE_RENDERING_OPTIMIZESPEED:
+    (StyleSVG()->mShapeRendering == NS_STYLE_SHAPE_RENDERING_OPTIMIZESPEED ||
-  case NS_STYLE_SHAPE_RENDERING_CRISPEDGES:
+     StyleSVG()->mShapeRendering == NS_STYLE_SHAPE_RENDERING_CRISPEDGES) ?
-    gfx->SetAntialiasMode(AntialiasMode::NONE);
+    AntialiasMode::NONE : AntialiasMode::SUBPIXEL;
-    break;
+
-  default:
+  // We wait as late as possible before setting the transform so that we don't
-    gfx->SetAntialiasMode(AntialiasMode::SUBPIXEL);
+  // set it unnecessarily if we return early (it's an expensive operation for
-    break;
+  // some backends).
-  }
+  gfxContextMatrixAutoSaveRestore autoRestoreTransform(aContext);
+  aContext->SetMatrix(aNewTransform);
 
   if (renderMode == SVGAutoRenderState::CLIP_MASK) {
-    FillRule oldFillRule = gfx->CurrentFillRule();
+    drawTarget->Fill(path, ColorPattern(Color(1.0f, 1.0f, 1.0f, 1.0f)),
-    gfxContextMatrixAutoSaveRestore autoSaveRestore(gfx);
+                     DrawOptions(1.0f, CompositionOp::OP_OVER, aaMode));
-
-    gfx->SetMatrix(newMatrix);
-    gfx->SetFillRule(fillRule);
-    gfx->SetColor(gfxRGBA(1.0f, 1.0f, 1.0f, 1.0f));
-    gfx->SetPath(path);
-    gfx->Fill();
-
-    gfx->SetFillRule(oldFillRule);
-    gfx->NewPath();
     return;
   }
 
-  NS_ABORT_IF_FALSE(renderMode == SVGAutoRenderState::NORMAL,
-                    "Unknown render mode");
-
-  gfxContextAutoSaveRestore autoSaveRestore(gfx);
-  gfx->SetMatrix(newMatrix);
-
   gfxTextContextPaint *contextPaint =
-    (gfxTextContextPaint*)aContext->GetDrawTarget()->GetUserData(&gfxTextContextPaint::sUserDataKey);
+    (gfxTextContextPaint*)drawTarget->
+      GetUserData(&gfxTextContextPaint::sUserDataKey);
 
-  if ((aRenderComponents & eRenderFill)) {
+  if (aRenderComponents & eRenderFill) {
     GeneralPattern fillPattern;
-    nsSVGUtils::MakeFillPatternFor(this, gfx, &fillPattern, contextPaint);
+    nsSVGUtils::MakeFillPatternFor(this, aContext, &fillPattern, contextPaint);
     if (fillPattern.GetPattern()) {
-      gfx->SetPath(path);
+      drawTarget->Fill(path, fillPattern,
-      gfx->SetFillRule(fillRule);
+                       DrawOptions(1.0f, CompositionOp::OP_OVER, aaMode));
-      gfx->Fill(fillPattern);
     }
   }
 
   if ((aRenderComponents & eRenderStroke) &&
       nsSVGUtils::HasStroke(this, contextPaint)) {
+    // Account for vector-effect:non-scaling-stroke:
+    gfxMatrix userToOuterSVG;
+    if (nsSVGUtils::GetNonScalingStrokeTransform(this, &userToOuterSVG)) {
+      // We need to transform the path back into the appropriate ancestor
+      // coordinate system, and paint it it that coordinate system, in order
+      // for non-scaled stroke to paint correctly.
+      gfxMatrix outerSVGToUser = userToOuterSVG;
+      outerSVGToUser.Invert();
+      aContext->Multiply(outerSVGToUser);
+      builder = path->TransformedCopyToBuilder(ToMatrix(userToOuterSVG), fillRule);
+      path = builder->Finish();
+    }
     GeneralPattern strokePattern;
-    nsSVGUtils::MakeStrokePatternFor(this, gfx, &strokePattern, contextPaint);
+    nsSVGUtils::MakeStrokePatternFor(this, aContext, &strokePattern, contextPaint);
     if (strokePattern.GetPattern()) {
-      gfx->SetPath(path);
+      SVGContentUtils::AutoStrokeOptions strokeOptions;
-      nsSVGUtils::SetupCairoStrokeGeometry(this, gfx, contextPaint);
+      SVGContentUtils::GetStrokeOptions(&strokeOptions,
-      gfx->Stroke(strokePattern);
+                                        static_cast<nsSVGElement*>(mContent),
+                                        StyleContext(), contextPaint);
+      // GetStrokeOptions may set the line width to zero as an optimization
+      if (strokeOptions.mLineWidth <= 0) {
+        return;
+      }
+      drawTarget->Stroke(path, strokePattern, strokeOptions,
+                         DrawOptions(1.0f, CompositionOp::OP_OVER, aaMode));
     }
   }
-
-  gfx->NewPath();
 }
 
 void

layout/svg/nsSVGPathGeometryFrame.h

@@ -15,6 +15,12 @@
 #include "nsQueryFrame.h"
 #include "nsSVGUtils.h"
 
+namespace mozilla {
+namespace gfx {
+class DrawTarget;
+}
+}
+
 class gfxContext;
 class nsDisplaySVGPathGeometry;
 class nsIAtom;
@@ -34,6 +40,8 @@ typedef nsFrame nsSVGPathGeometryFrameBase;
 class nsSVGPathGeometryFrame : public nsSVGPathGeometryFrameBase,
                                public nsISVGChildFrame
 {
+  typedef mozilla::gfx::DrawTarget DrawTarget;
+
   friend nsIFrame*
   NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
@@ -113,7 +121,7 @@ protected:
   virtual uint16_t GetHitTestFlags();
 private:
   enum { eRenderFill = 1, eRenderStroke = 2 };
-  void Render(nsRenderingContext *aContext, uint32_t aRenderComponents,
+  void Render(gfxContext* aContext, uint32_t aRenderComponents,
               const gfxMatrix& aTransform);
 
   /**

layout/svg/nsSVGPatternFrame.cpp

@@ -251,11 +251,11 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
    *    Return
    */
 
-  // Get the first child of the pattern data we will render
+  nsSVGPatternFrame* patternWithChildren = GetPatternWithChildren();
-  nsIFrame* firstKid = GetPatternFirstChild();
+  if (!patternWithChildren) {
-  if (!firstKid) {
     return nullptr; // Either no kids or a bad reference
   }
+  nsIFrame* firstKid = patternWithChildren->mFrames.FirstChild();
 
   const nsSVGViewBox& viewBox = GetViewBox();
 
@@ -303,13 +303,10 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
     return nullptr;
   }
 
-  // Get the pattern we are going to render
+  if (patternWithChildren->mCTM) {
-  nsSVGPatternFrame *patternFrame =
+    *patternWithChildren->mCTM = ctm;
-    static_cast<nsSVGPatternFrame*>(firstKid->GetParent());
-  if (patternFrame->mCTM) {
-    *patternFrame->mCTM = ctm;
   } else {
-    patternFrame->mCTM = new gfxMatrix(ctm);
+    patternWithChildren->mCTM = new gfxMatrix(ctm);
   }
 
   // Get the bounding box of the pattern.  This will be used to determine
@@ -325,12 +322,14 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
 
   // revert the vector effect transform so that the pattern appears unchanged
   if (aFillOrStroke == &nsStyleSVG::mStroke) {
-    Matrix strokeTransform = ToMatrix(nsSVGUtils::GetStrokeTransform(aSource));
+    gfxMatrix userToOuterSVG;
-    if (!strokeTransform.Invert()) {
+    if (nsSVGUtils::GetNonScalingStrokeTransform(aSource, &userToOuterSVG)) {
-      NS_WARNING("Should we get here if the stroke transform is singular?");
+      patternTransform *= ToMatrix(userToOuterSVG);
-      return nullptr;
+      if (patternTransform.IsSingular()) {
+        NS_WARNING("Singular matrix painting non-scaling-stroke");
+        return nullptr;
+      }
     }
-    patternTransform *= strokeTransform;
   }
 
   // Get the transformation matrix that we will hand to the renderer's pattern
@@ -366,7 +365,7 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
       gfxMatrix(surfaceSize.width / patternWidth, 0.0f,
                 0.0f, surfaceSize.height / patternHeight,
                 0.0f, 0.0f);
-    patternFrame->mCTM->PreMultiply(tempTM);
+    patternWithChildren->mCTM->PreMultiply(tempTM);
 
     // and rescale pattern to compensate
     patternMatrix->PreScale(patternWidth / surfaceSize.width,
@@ -399,13 +398,13 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
 
   if (aSource->IsFrameOfType(nsIFrame::eSVGGeometry)) {
     // Set the geometrical parent of the pattern we are rendering
-    patternFrame->mSource = static_cast<nsSVGPathGeometryFrame*>(aSource);
+    patternWithChildren->mSource = static_cast<nsSVGPathGeometryFrame*>(aSource);
   }
 
   // Delay checking NS_FRAME_DRAWING_AS_PAINTSERVER bit until here so we can
   // give back a clear surface if there's a loop
-  if (!(patternFrame->GetStateBits() & NS_FRAME_DRAWING_AS_PAINTSERVER)) {
+  if (!(patternWithChildren->GetStateBits() & NS_FRAME_DRAWING_AS_PAINTSERVER)) {
-    patternFrame->AddStateBits(NS_FRAME_DRAWING_AS_PAINTSERVER);
+    patternWithChildren->AddStateBits(NS_FRAME_DRAWING_AS_PAINTSERVER);
     for (nsIFrame* kid = firstKid; kid;
          kid = kid->GetNextSibling()) {
       // The CTM of each frame referencing us can be different
@@ -413,17 +412,17 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
       if (SVGFrame) {
         SVGFrame->NotifySVGChanged(nsISVGChildFrame::TRANSFORM_CHANGED);
       }
-      gfxMatrix tm = *(patternFrame->mCTM);
+      gfxMatrix tm = *(patternWithChildren->mCTM);
       if (kid->GetContent()->IsSVG()) {
         tm = static_cast<nsSVGElement*>(kid->GetContent())->
               PrependLocalTransformsTo(tm, nsSVGElement::eUserSpaceToParent);
       }
       nsSVGUtils::PaintFrameWithEffects(kid, context, tm);
     }
-    patternFrame->RemoveStateBits(NS_FRAME_DRAWING_AS_PAINTSERVER);
+    patternWithChildren->RemoveStateBits(NS_FRAME_DRAWING_AS_PAINTSERVER);
   }
 
-  patternFrame->mSource = nullptr;
+  patternWithChildren->mSource = nullptr;
 
   if (aGraphicOpacity != 1.0f) {
     gfx->PopGroupToSource();
@@ -439,13 +438,12 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
 // How do we handle the insertion of a new frame?
 // We really don't want to rerender this every time,
 // do we?
-nsIFrame*
+nsSVGPatternFrame*
-nsSVGPatternFrame::GetPatternFirstChild()
+nsSVGPatternFrame::GetPatternWithChildren()
 {
   // Do we have any children ourselves?
-  nsIFrame* kid = mFrames.FirstChild();
+  if (!mFrames.IsEmpty())
-  if (kid)
+    return this;
-    return kid;
 
   // No, see if we chain to someone who does
   AutoPatternReferencer patternRef(this);
@@ -454,7 +452,7 @@ nsSVGPatternFrame::GetPatternFirstChild()
   if (!next)
     return nullptr;
 
-  return next->GetPatternFirstChild();
+  return next->GetPatternWithChildren();
 }
 
 uint16_t

layout/svg/nsSVGPatternFrame.h

@@ -120,7 +120,17 @@ protected:
                nsStyleSVGPaint nsStyleSVG::*aFillOrStroke,
                float aGraphicOpacity,
                const gfxRect *aOverrideBounds);
-  nsIFrame*  GetPatternFirstChild();
+
+  /**
+   * A <pattern> element may reference another <pattern> element using
+   * xlink:href and, if it doesn't have any child content of its own, then it
+   * will "inherit" the children of the referenced pattern (which may itself be
+   * inheriting its children if it references another <pattern>).  This
+   * function returns this nsSVGPatternFrame or the first pattern along the
+   * reference chain (if there is one) to have children.
+   */
+  nsSVGPatternFrame* GetPatternWithChildren();
+
   gfxRect    GetPatternRect(uint16_t aPatternUnits,
                             const gfxRect &bbox,
                             const Matrix &callerCTM,

layout/svg/nsSVGUtils.cpp

@@ -83,28 +83,28 @@ NS_SVGNewGetBBoxEnabled()
 // we only take the address of this:
 static mozilla::gfx::UserDataKey sSVGAutoRenderStateKey;
 
-SVGAutoRenderState::SVGAutoRenderState(nsRenderingContext *aContext,
+SVGAutoRenderState::SVGAutoRenderState(DrawTarget* aDrawTarget,
                                        RenderMode aMode
                                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
-  : mContext(aContext)
+  : mDrawTarget(aDrawTarget)
   , mOriginalRenderState(nullptr)
   , mMode(aMode)
   , mPaintingToWindow(false)
 {
   MOZ_GUARD_OBJECT_NOTIFIER_INIT;
   mOriginalRenderState =
-    aContext->GetDrawTarget()->RemoveUserData(&sSVGAutoRenderStateKey);
+    aDrawTarget->RemoveUserData(&sSVGAutoRenderStateKey);
   // We always remove ourselves from aContext before it dies, so
   // passing nullptr as the destroy function is okay.
-  aContext->GetDrawTarget()->AddUserData(&sSVGAutoRenderStateKey, this, nullptr);
+  aDrawTarget->AddUserData(&sSVGAutoRenderStateKey, this, nullptr);
 }
 
 SVGAutoRenderState::~SVGAutoRenderState()
 {
-  mContext->GetDrawTarget()->RemoveUserData(&sSVGAutoRenderStateKey);
+  mDrawTarget->RemoveUserData(&sSVGAutoRenderStateKey);
   if (mOriginalRenderState) {
-    mContext->GetDrawTarget()->AddUserData(&sSVGAutoRenderStateKey,
+    mDrawTarget->AddUserData(&sSVGAutoRenderStateKey,
-                                           mOriginalRenderState, nullptr);
+                             mOriginalRenderState, nullptr);
   }
 }
 
@@ -115,9 +115,9 @@ SVGAutoRenderState::SetPaintingToWindow(bool aPaintingToWindow)
 }
 
 /* static */ SVGAutoRenderState::RenderMode
-SVGAutoRenderState::GetRenderMode(nsRenderingContext *aContext)
+SVGAutoRenderState::GetRenderMode(DrawTarget* aDrawTarget)
 {
-  void *state = aContext->GetDrawTarget()->GetUserData(&sSVGAutoRenderStateKey);
+  void *state = aDrawTarget->GetUserData(&sSVGAutoRenderStateKey);
   if (state) {
     return static_cast<SVGAutoRenderState*>(state)->mMode;
   }
@@ -125,9 +125,9 @@ SVGAutoRenderState::GetRenderMode(nsRenderingContext *aContext)
 }
 
 /* static */ bool
-SVGAutoRenderState::IsPaintingToWindow(nsRenderingContext *aContext)
+SVGAutoRenderState::IsPaintingToWindow(DrawTarget* aDrawTarget)
 {
-  void *state = aContext->GetDrawTarget()->GetUserData(&sSVGAutoRenderStateKey);
+  void *state = aDrawTarget->GetUserData(&sSVGAutoRenderStateKey);
   if (state) {
     return static_cast<SVGAutoRenderState*>(state)->mPaintingToWindow;
   }
@@ -774,25 +774,6 @@ nsSVGUtils::GetCoveredRegion(const nsFrameList &aFrames)
   return rect;
 }
 
-nsPoint
-nsSVGUtils::TransformOuterSVGPointToChildFrame(nsPoint aPoint,
-                                               const gfxMatrix& aFrameToCanvasTM,
-                                               nsPresContext* aPresContext)
-{
-  NS_ABORT_IF_FALSE(!aFrameToCanvasTM.IsSingular(),
-                    "Callers must not pass a singular matrix");
-  gfxMatrix canvasDevToFrameUserSpace = aFrameToCanvasTM;
-  canvasDevToFrameUserSpace.Invert();
-  gfxPoint cssPxPt =
-    gfxPoint(aPoint.x, aPoint.y) / aPresContext->AppUnitsPerCSSPixel();
-  gfxPoint userPt = canvasDevToFrameUserSpace.Transform(cssPxPt);
-  gfxPoint appPt = (userPt * aPresContext->AppUnitsPerCSSPixel()).Round();
-  userPt.x = clamped(appPt.x, gfxFloat(nscoord_MIN), gfxFloat(nscoord_MAX));
-  userPt.y = clamped(appPt.y, gfxFloat(nscoord_MIN), gfxFloat(nscoord_MAX));
-  // now guaranteed to be safe:
-  return nsPoint(nscoord(userPt.x), nscoord(userPt.y));
-}
-
 nsRect
 nsSVGUtils::TransformFrameRectToOuterSVG(const nsRect& aRect,
                                          const gfxMatrix& aMatrix,
@@ -1119,31 +1100,26 @@ nsSVGUtils::GetFirstNonAAncestorFrame(nsIFrame* aStartFrame)
   return nullptr;
 }
 
-gfxMatrix
+bool
-nsSVGUtils::GetStrokeTransform(nsIFrame *aFrame)
+nsSVGUtils::GetNonScalingStrokeTransform(nsIFrame *aFrame,
+                                         gfxMatrix* aUserToOuterSVG)
 {
   if (aFrame->GetContent()->IsNodeOfType(nsINode::eTEXT)) {
     aFrame = aFrame->GetParent();
   }
 
-  if (aFrame->StyleSVGReset()->mVectorEffect ==
+  if (aFrame->StyleSVGReset()->mVectorEffect !=
-      NS_STYLE_VECTOR_EFFECT_NON_SCALING_STROKE) {
+        NS_STYLE_VECTOR_EFFECT_NON_SCALING_STROKE) {
- 
+    return false;
-    nsIContent *content = aFrame->GetContent();
-    NS_ABORT_IF_FALSE(content->IsSVG(), "bad cast");
-
-    // a non-scaling stroke is in the screen co-ordinate
-    // space rather so we need to invert the transform
-    // to the screen co-ordinate space to get there.
-    // See http://www.w3.org/TR/SVGTiny12/painting.html#NonScalingStroke
-    gfx::Matrix transform = SVGContentUtils::GetCTM(
-                              static_cast<nsSVGElement*>(content), true);
-    if (!transform.IsSingular()) {
-      transform.Invert();
-      return ThebesMatrix(transform);
-    }
   }
-  return gfxMatrix();
+
+  nsIContent *content = aFrame->GetContent();
+  NS_ABORT_IF_FALSE(content->IsSVG(), "bad cast");
+
+  *aUserToOuterSVG = ThebesMatrix(SVGContentUtils::GetCTM(
+                       static_cast<nsSVGElement*>(content), true));
+
+  return !aUserToOuterSVG->IsIdentity();
 }
 
 // The logic here comes from _cairo_stroke_style_max_distance_from_path
@@ -1156,7 +1132,13 @@ PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
   double style_expansion =
     aStyleExpansionFactor * nsSVGUtils::GetStrokeWidth(aFrame);
 
-  gfxMatrix matrix = aMatrix * nsSVGUtils::GetStrokeTransform(aFrame);
+  gfxMatrix matrix = aMatrix;
+
+  gfxMatrix outerSVGToUser;
+  if (nsSVGUtils::GetNonScalingStrokeTransform(aFrame, &outerSVGToUser)) {
+    outerSVGToUser.Invert();
+    matrix *= outerSVGToUser;
+  }
 
   double dx = style_expansion * (fabs(matrix._11) + fabs(matrix._21));
   double dy = style_expansion * (fabs(matrix._22) + fabs(matrix._12));
@@ -1496,9 +1478,10 @@ nsSVGUtils::SetupCairoStrokeGeometry(nsIFrame* aFrame,
   aContext->SetLineWidth(width);
 
   // Apply any stroke-specific transform
-  gfxMatrix strokeTransform = GetStrokeTransform(aFrame);
+  gfxMatrix outerSVGToUser;
-  if (!strokeTransform.IsIdentity()) {
+  if (GetNonScalingStrokeTransform(aFrame, &outerSVGToUser) &&
-    aContext->Multiply(strokeTransform);
+      outerSVGToUser.Invert()) {
+    aContext->Multiply(outerSVGToUser);
   }
 
   const nsStyleSVG* style = aFrame->StyleSVG();

layout/svg/nsSVGUtils.h

@@ -61,6 +61,7 @@ class Element;
 class UserSpaceMetrics;
 } // namespace dom
 namespace gfx {
+class DrawTarget;
 class GeneralPattern;
 class SourceSurface;
 }
@@ -145,6 +146,8 @@ private:
 
 class MOZ_STACK_CLASS SVGAutoRenderState
 {
+  typedef mozilla::gfx::DrawTarget DrawTarget;
+
 public:
   enum RenderMode {
     /**
@@ -160,18 +163,18 @@ public:
     CLIP_MASK 
   };
 
-  SVGAutoRenderState(nsRenderingContext *aContext, RenderMode aMode
+  SVGAutoRenderState(DrawTarget* aDrawTarget, RenderMode aMode
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
   ~SVGAutoRenderState();
 
   void SetPaintingToWindow(bool aPaintingToWindow);
 
-  static RenderMode GetRenderMode(nsRenderingContext *aContext);
+  static RenderMode GetRenderMode(DrawTarget* aDrawTarget);
-  static bool IsPaintingToWindow(nsRenderingContext *aContext);
+  static bool IsPaintingToWindow(DrawTarget* aDrawTarget);
 
 private:
-  nsRenderingContext *mContext;
+  DrawTarget* mDrawTarget;
-  void *mOriginalRenderState;
+  void* mOriginalRenderState;
   RenderMode mMode;
   bool mPaintingToWindow;
   MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
@@ -339,15 +342,6 @@ public:
   static nsRect
   GetCoveredRegion(const nsFrameList &aFrames);
 
-  // Converts aPoint from an app unit point in outer-<svg> content rect space
-  // to an app unit point in a frame's SVG userspace. 
-  // This is a temporary helper we should no longer need after bug 614732 is
-  // fixed.
-  static nsPoint
-  TransformOuterSVGPointToChildFrame(nsPoint aPoint,
-                                     const gfxMatrix& aFrameToCanvasTM,
-                                     nsPresContext* aPresContext);
-
   static nsRect
   TransformFrameRectToOuterSVG(const nsRect& aRect,
                                const gfxMatrix& aMatrix,
@@ -464,11 +458,18 @@ public:
   static bool OuterSVGIsCallingReflowSVG(nsIFrame *aFrame);
   static bool AnyOuterSVGIsCallingReflowSVG(nsIFrame *aFrame);
 
-  /*
+  /**
-   * Get any additional transforms that apply only to stroking
+   * See https://svgwg.org/svg2-draft/painting.html#NonScalingStroke
-   * e.g. non-scaling-stroke
+   *
+   * If the computed value of the 'vector-effect' property on aFrame is
+   * 'non-scaling-stroke', then this function will set aUserToOuterSVG to the
+   * transform from aFrame's SVG user space to the initial coordinate system
+   * established by the viewport of aFrame's outer-<svg>'s (the coordinate
+   * system in which the stroke is fixed).  If aUserToOuterSVG is set to a
+   * non-identity matrix this function returns true, else it returns false.
    */
-  static gfxMatrix GetStrokeTransform(nsIFrame *aFrame);
+  static bool GetNonScalingStrokeTransform(nsIFrame *aFrame,
+                                           gfxMatrix* aUserToOuterSVG);
 
   /**
    * Compute the maximum possible device space stroke extents of a path given

layout/tools/reftest/remotereftest.py

@@ -162,6 +162,9 @@ class RemoteOptions(ReftestOptions):
         if not options.httpdPath:
             options.httpdPath = os.path.join(options.utilityPath, "components")
 
+        # Android does not run leak tests, but set some reasonable defaults to avoid errors.
+        options.leakThresholds = {}
+
         # TODO: Copied from main, but I think these are no longer used in a post xulrunner world
         #options.xrePath = options.remoteTestRoot + self.automation._product + '/xulrunner'
         #options.utilityPath = options.testRoot + self.automation._product + '/bin'

layout/tools/reftest/runreftest.py

@@ -344,7 +344,7 @@ class RefTest(object):
                                  # give the JS harness 30 seconds to deal
                                  # with its own timeouts
                                  timeout=options.timeout + 30.0)
-      processLeakLog(self.leakLogFile, options.leakThreshold)
+      processLeakLog(self.leakLogFile, options.leakThresholds)
       self.automation.log.info("\nREFTEST INFO | runreftest.py | Running tests: end.")
     finally:
       self.cleanup(profileDir)
@@ -394,12 +394,12 @@ class ReftestOptions(OptionParser):
                     default = 5 * 60, # 5 minutes per bug 479518
                     help = "reftest will timeout in specified number of seconds. [default %default s].")
     self.add_option("--leak-threshold",
-                    action = "store", type = "int", dest = "leakThreshold",
+                    action = "store", type = "int", dest = "defaultLeakThreshold",
                     default = 0,
-                    help = "fail if the number of bytes leaked through "
+                    help = "fail if the number of bytes leaked in default "
-                           "refcounted objects (or bytes in classes with "
+                           "processes through refcounted objects (or bytes "
-                           "MOZ_COUNT_CTOR and MOZ_COUNT_DTOR) is greater "
+                           "in classes with MOZ_COUNT_CTOR and MOZ_COUNT_DTOR) "
-                           "than the given number")
+                           "is greater than the given number")
     self.add_option("--utility-path",
                     action = "store", type = "string", dest = "utilityPath",
                     default = self.automation.DIST_BIN,
@@ -511,6 +511,8 @@ class ReftestOptions(OptionParser):
       if options.debugger is not None:
         self.error("cannot specify a debugger with parallel tests")
 
+      options.leakThresholds = {"default": options.defaultLeakThreshold}
+
     return options
 
 def main():

netwerk/base/public/nsICachingChannel.idl

@@ -17,7 +17,7 @@ interface nsIFile;
  *   3) Support for uniquely identifying cached data in cases when the URL
  *      is insufficient (e.g., HTTP form submission).
  */
-[scriptable, uuid(a77b664e-e707-4017-9c03-47bcedcb5b05)]
+[scriptable, uuid(3d46b469-7405-416e-ba42-84899963b403)]
 interface nsICachingChannel : nsICacheInfoChannel
 {
     /**
@@ -64,6 +64,14 @@ interface nsICachingChannel : nsICacheInfoChannel
      */
     attribute nsISupports cacheKey;
 
+    /**
+     * Instructs the channel to only store the metadata of the entry, and not
+     * the content. When reading an existing entry, this automatically sets
+     * LOAD_ONLY_IF_MODIFIED flag.
+     * Must be called before asyncOpen().
+     */
+    attribute boolean cacheOnlyMetadata;
+
     /**************************************************************************
      * Caching channel specific load flags:
      */

netwerk/protocol/http/nsHttpChannel.cpp

@@ -208,6 +208,7 @@ nsHttpChannel::nsHttpChannel()
     , mOfflineCacheLastModifiedTime(0)
     , mCachedContentIsValid(false)
     , mCachedContentIsPartial(false)
+    , mCacheOnlyMetadata(false)
     , mTransactionReplaced(false)
     , mAuthRetryPending(false)
     , mProxyAuthPending(false)
@@ -2826,8 +2827,16 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
             if (mCachedContentIsPartial) {
                 rv = OpenCacheInputStream(entry, false, !!appCache);
                 *aResult = ENTRY_NEEDS_REVALIDATION;
+                return rv;
+            } else if (size == 0 && mCacheOnlyMetadata) {
+                // Don't break cache entry load when the entry's data size
+                // is 0 and mCacheOnlyMetadata flag is set. In that case we
+                // want to proceed since the LOAD_ONLY_IF_MODIFIED flag is
+                // also set.
+                MOZ_ASSERT(mLoadFlags & LOAD_ONLY_IF_MODIFIED);
+            } else {
+                return rv;
             }
-            return rv;
         }
     }
 
@@ -4003,14 +4012,24 @@ nsHttpChannel::InstallCacheListener(int64_t offset)
     nsCOMPtr<nsIOutputStream> out;
     rv = mCacheEntry->OpenOutputStream(offset, getter_AddRefs(out));
     if (rv == NS_ERROR_NOT_AVAILABLE) {
-      LOG(("  entry doomed, not writing it [channel=%p]", this));
+        LOG(("  entry doomed, not writing it [channel=%p]", this));
-      // Entry is already doomed.
+        // Entry is already doomed.
-      // This may happen when expiration time is set to past and the entry
+        // This may happen when expiration time is set to past and the entry
-      // has been removed by the background eviction logic.
+        // has been removed by the background eviction logic.
-      return NS_OK;
+        return NS_OK;
     }
     if (NS_FAILED(rv)) return rv;
 
+    if (mCacheOnlyMetadata) {
+        LOG(("Not storing content, cacheOnlyMetadata set"));
+        // We must open and then close the output stream of the cache entry.
+        // This way we indicate the content has been written (despite with zero
+        // length) and the entry is now in the ready state with "having data".
+
+        out->Close();
+        return NS_OK;
+    }
+
     // XXX disk cache does not support overlapped i/o yet
 #if 0
     // Mark entry valid inorder to allow simultaneous reading...
@@ -5716,6 +5735,30 @@ nsHttpChannel::SetCacheKey(nsISupports *key)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsHttpChannel::GetCacheOnlyMetadata(bool *aOnlyMetadata)
+{
+    NS_ENSURE_ARG(aOnlyMetadata);
+    *aOnlyMetadata = mCacheOnlyMetadata;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHttpChannel::SetCacheOnlyMetadata(bool aOnlyMetadata)
+{
+    LOG(("nsHttpChannel::SetCacheOnlyMetadata [this=%p only-metadata=%d]\n",
+        this, aOnlyMetadata));
+
+    ENSURE_CALLED_BEFORE_ASYNC_OPEN();
+
+    mCacheOnlyMetadata = aOnlyMetadata;
+    if (aOnlyMetadata) {
+        mLoadFlags |= LOAD_ONLY_IF_MODIFIED;
+    }
+
+    return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // nsHttpChannel::nsIResumableChannel
 //-----------------------------------------------------------------------------

netwerk/protocol/http/nsHttpChannel.h

@@ -385,6 +385,7 @@ private:
     // state flags
     uint32_t                          mCachedContentIsValid     : 1;
     uint32_t                          mCachedContentIsPartial   : 1;
+    uint32_t                          mCacheOnlyMetadata        : 1;
     uint32_t                          mTransactionReplaced      : 1;
     uint32_t                          mAuthRetryPending         : 1;
     uint32_t                          mProxyAuthPending         : 1;

netwerk/test/unit/test_bug1064258.js

@@ -0,0 +1,154 @@
+/**
+ * Check how nsICachingChannel.cacheOnlyMetadata works.
+ * - all channels involved in this test are set cacheOnlyMetadata = true
+ * - do a previously uncached request for a long living content
+ * - check we have downloaded the content from the server (channel provides it)
+ * - check the entry has metadata, but zero-length content
+ * - load the same URL again, now cached
+ * - check the channel is giving no content (no call to OnDataAvailable) but succeeds
+ * - repeat again, but for a different URL that is not cached (immediately expires)
+ * - only difference is that we get a newer version of the content from the server during the second request
+ */
+
+Cu.import("resource://testing-common/httpd.js");
+
+XPCOMUtils.defineLazyGetter(this, "URL", function() {
+  return "http://localhost:" + httpServer.identity.primaryPort;
+});
+
+var httpServer = null;
+
+function make_channel(url, callback, ctx) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+const responseBody1 = "response body 1";
+const responseBody2a = "response body 2a";
+const responseBody2b = "response body 2b";
+
+function contentHandler1(metadata, response)
+{
+  response.setHeader("Content-Type", "text/plain");
+  response.setHeader("Cache-control", "max-age=999999");
+  response.bodyOutputStream.write(responseBody1, responseBody1.length);
+}
+
+var content2passCount = 0;
+
+function contentHandler2(metadata, response)
+{
+  response.setHeader("Content-Type", "text/plain");
+  response.setHeader("Cache-control", "no-cache");
+  switch (content2passCount++) {
+    case 0:
+      response.setHeader("ETag", "testetag");
+      response.bodyOutputStream.write(responseBody2a, responseBody2a.length);
+      break;
+    case 1:
+      do_check_true(metadata.hasHeader("If-None-Match"));
+      do_check_eq(metadata.getHeader("If-None-Match"), "testetag");
+      response.bodyOutputStream.write(responseBody2b, responseBody2b.length);
+      break;
+    default:
+      throw "Unexpected request in the test";
+  }
+}
+
+
+function run_test()
+{
+  httpServer = new HttpServer();
+  httpServer.registerPathHandler("/content1", contentHandler1);
+  httpServer.registerPathHandler("/content2", contentHandler2);
+  httpServer.start(-1);
+
+  run_test_content1a();
+  do_test_pending();
+}
+
+function run_test_content1a()
+{
+  var chan = make_channel(URL + "/content1");
+  caching = chan.QueryInterface(Ci.nsICachingChannel);
+  caching.cacheOnlyMetadata = true;
+  chan.asyncOpen(new ChannelListener(contentListener1a, null), null);
+}
+
+function contentListener1a(request, buffer)
+{
+  do_check_eq(buffer, responseBody1);
+
+  asyncOpenCacheEntry(URL + "/content1", "disk", 0, null, cacheCheck1)
+}
+
+function cacheCheck1(status, entry)
+{
+  do_check_eq(status, 0);
+  do_check_eq(entry.dataSize, 0);
+  try {
+    do_check_neq(entry.getMetaDataElement("response-head"), null);
+  }
+  catch (ex) {
+    do_throw("Missing response head");
+  }
+
+  var chan = make_channel(URL + "/content1");
+  caching = chan.QueryInterface(Ci.nsICachingChannel);
+  caching.cacheOnlyMetadata = true;
+  chan.asyncOpen(new ChannelListener(contentListener1b, null, CL_IGNORE_CL), null);
+}
+
+function contentListener1b(request, buffer)
+{
+  request.QueryInterface(Ci.nsIHttpChannel);
+  do_check_eq(request.requestMethod, "GET");
+  do_check_eq(request.responseStatus, 200);
+  do_check_eq(request.getResponseHeader("Cache-control"), "max-age=999999");
+
+  do_check_eq(buffer, "");
+  run_test_content2a();
+}
+
+// Now same set of steps but this time for an immediately expiring content.
+
+function run_test_content2a()
+{
+  var chan = make_channel(URL + "/content2");
+  caching = chan.QueryInterface(Ci.nsICachingChannel);
+  caching.cacheOnlyMetadata = true;
+  chan.asyncOpen(new ChannelListener(contentListener2a, null), null);
+}
+
+function contentListener2a(request, buffer)
+{
+  do_check_eq(buffer, responseBody2a);
+
+  asyncOpenCacheEntry(URL + "/content2", "disk", 0, null, cacheCheck2)
+}
+
+function cacheCheck2(status, entry)
+{
+  do_check_eq(status, 0);
+  do_check_eq(entry.dataSize, 0);
+  try {
+    do_check_neq(entry.getMetaDataElement("response-head"), null);
+    do_check_true(entry.getMetaDataElement("response-head").match('Etag: testetag'));
+  }
+  catch (ex) {
+    do_throw("Missing response head");
+  }
+
+  var chan = make_channel(URL + "/content2");
+  caching = chan.QueryInterface(Ci.nsICachingChannel);
+  caching.cacheOnlyMetadata = true;
+  chan.asyncOpen(new ChannelListener(contentListener2b, null), null);
+}
+
+function contentListener2b(request, buffer)
+{
+  do_check_eq(buffer, responseBody2b);
+
+  httpServer.stop(do_test_finished);
+}

netwerk/test/unit/xpcshell.ini

@@ -158,6 +158,7 @@ skip-if = os == "android"
 # Allocating 4GB might actually succeed on 64 bit machines
 skip-if = bits != 32
 [test_bug935499.js]
+[test_bug1064258.js]
 [test_udpsocket.js]
 [test_doomentry.js]
 [test_cacheflags.js]

parser/html/nsHtml5TreeBuilderCppSupplement.h

@@ -15,6 +15,8 @@ class nsPresContext;
 nsHtml5TreeBuilder::nsHtml5TreeBuilder(nsHtml5OplessBuilder* aBuilder)
   : scriptingEnabled(false)
   , fragment(false)
+  , contextName(nullptr)
+  , contextNamespace(kNameSpaceID_None)
   , contextNode(nullptr)
   , formPointer(nullptr)
   , headPointer(nullptr)
@@ -37,6 +39,8 @@ nsHtml5TreeBuilder::nsHtml5TreeBuilder(nsAHtml5TreeOpSink* aOpSink,
                                        nsHtml5TreeOpStage* aStage)
   : scriptingEnabled(false)
   , fragment(false)
+  , contextName(nullptr)
+  , contextNamespace(kNameSpaceID_None)
   , contextNode(nullptr)
   , formPointer(nullptr)
   , headPointer(nullptr)

testing/config/tooltool-manifests/androidarm/releng.manifest

@@ -0,0 +1,7 @@
+[{
+"size": 261782928,
+"digest": "7140e026b7b747236545dc30e377a959b0bdf91bb4d70efd7f97f92fce12a9196042503124b8df8d30c2d97b7eb5f9df9556afdffa0b5d9625008aead305c32b",
+"algorithm": "sha512",
+"filename": "AVDs-armv7a-gingerbread-build-2014-01-23-ubuntu.tar.gz",
+"unpack": "True"
+}]

testing/config/tooltool-manifests/androidx86/releng.manifest

@@ -0,0 +1,7 @@
+[{
+"size": 561274118,
+"digest": "3b2d18eb0194d82c70c5ee17487ccbac309f9b2e9839fe7ca4a27a9a06f6338bb24394476da78559685d99151fccc85fdde03297aa73ee2f7fb3183e11925c4d",
+"algorithm": "sha512",
+"filename": "AVDs-x86-android-4.2_r1-build-2013-11-13-ubuntu.tar.gz",
+"unpack": "True"
+}]

testing/mochitest/mochitest_options.py

@@ -223,12 +223,12 @@ class MochitestOptions(optparse.OptionParser):
         [["--leak-threshold"],
         { "action": "store",
           "type": "int",
-          "dest": "leakThreshold",
+          "dest": "defaultLeakThreshold",
           "metavar": "THRESHOLD",
-          "help": "fail if the number of bytes leaked through "
+          "help": "fail if the number of bytes leaked in default "
-                 "refcounted objects (or bytes in classes with "
+                 "processes through refcounted objects (or bytes "
-                 "MOZ_COUNT_CTOR and MOZ_COUNT_DTOR) is greater "
+                 "in classes with MOZ_COUNT_CTOR and MOZ_COUNT_DTOR) "
-                 "than the given number",
+                 "is greater than the given number",
           "default": 0,
         }],
         [["--fatal-assertions"],
@@ -610,6 +610,11 @@ class MochitestOptions(optparse.OptionParser):
                 if not os.path.isfile(f):
                     self.error('Missing binary %s required for --use-test-media-devices')
 
+        options.leakThresholds = {
+            "default": options.defaultLeakThreshold,
+            "tab": 10000, # See dependencies of bug 1051230.
+        }
+
         return options
 
 
@@ -767,7 +772,7 @@ class B2GOptions(MochitestOptions):
         defaults["testPath"] = ""
         defaults["extensionsToExclude"] = ["specialpowers"]
         # See dependencies of bug 1038943.
-        defaults["leakThreshold"] = 5180
+        defaults["defaultLeakThreshold"] = 5180
         self.set_defaults(**defaults)
 
     def verifyRemoteOptions(self, options):

testing/mochitest/runtests.py

@@ -1842,7 +1842,7 @@ class Mochitest(MochitestUtilsMixin):
         self.stopVMwareRecording();
       self.stopServers()
 
-    processLeakLog(self.leak_report_file, options.leakThreshold)
+    processLeakLog(self.leak_report_file, options.leakThresholds)
 
     if self.nsprLogs:
       with zipfile.ZipFile("%s/nsprlog.zip" % browserEnv["MOZ_UPLOAD_DIR"], "w", zipfile.ZIP_DEFLATED) as logzip:

testing/mochitest/runtestsb2g.py

@@ -202,7 +202,7 @@ class B2GMochitest(MochitestUtilsMixin):
             self.app_ctx.dm.getFile(self.leak_report_file, local_leak_file.name)
             self.app_ctx.dm.removeFile(self.leak_report_file)
 
-            processLeakLog(local_leak_file.name, options.leakThreshold)
+            processLeakLog(local_leak_file.name, options.leakThresholds)
         except KeyboardInterrupt:
             self.log.info("runtests.py | Received keyboard interrupt.\n");
             status = -1

toolkit/modules/InlineSpellChecker.jsm

@@ -159,6 +159,11 @@ InlineSpellChecker.prototype = {
     if (! this.mInlineSpellChecker || ! this.enabled)
       return 0;
     var spellchecker = this.mInlineSpellChecker.spellChecker;
+
+    // Cannot access the dictionary list from another process so just return 0.
+    if (Components.utils.isCrossProcessWrapper(spellchecker))
+      return 0;
+
     var o1 = {}, o2 = {};
     spellchecker.GetDictionaryList(o1, o2);
     var list = o1.value;

tools/profiler/GeckoTaskTracer.cpp

@@ -200,7 +200,7 @@ void
 LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId, uint64_t aSourceEventId,
             SourceEventType aSourceEventType)
 {
-  NS_ENSURE_TRUE_VOID(IsInitialized() && aSourceEventId);
+  NS_ENSURE_TRUE_VOID(IsInitialized());
 
   // Log format:
   // [0 taskId dispatchTime sourceEventId sourceEventType parentTaskId]
@@ -209,7 +209,7 @@ LogDispatch(uint64_t aTaskId, uint64_t aParentTaskId, uint64_t aSourceEventId,
 void
 LogBegin(uint64_t aTaskId, uint64_t aSourceEventId)
 {
-  NS_ENSURE_TRUE_VOID(IsInitialized() && aSourceEventId);
+  NS_ENSURE_TRUE_VOID(IsInitialized());
 
   // Log format:
   // [1 taskId beginTime processId threadId]
@@ -218,7 +218,7 @@ LogBegin(uint64_t aTaskId, uint64_t aSourceEventId)
 void
 LogEnd(uint64_t aTaskId, uint64_t aSourceEventId)
 {
-  NS_ENSURE_TRUE_VOID(IsInitialized() && aSourceEventId);
+  NS_ENSURE_TRUE_VOID(IsInitialized());
 
   // Log format:
   // [2 taskId endTime]
@@ -227,7 +227,7 @@ LogEnd(uint64_t aTaskId, uint64_t aSourceEventId)
 void
 LogVirtualTablePtr(uint64_t aTaskId, uint64_t aSourceEventId, int* aVptr)
 {
-  NS_ENSURE_TRUE_VOID(IsInitialized() && aSourceEventId);
+  NS_ENSURE_TRUE_VOID(IsInitialized());
 
   // Log format:
   // [4 taskId address]

widget/cocoa/nsNativeThemeCocoa.mm

@@ -2833,6 +2833,11 @@ nsNativeThemeCocoa::DrawWidgetBackground(nsRenderingContext* aContext,
       break;
   }
 
+  if (hidpi) {
+    // Reset the base CTM.
+    CGContextSetBaseCTM(cgContext, CGAffineTransformIdentity);
+  }
+
   nativeDrawing.EndNativeDrawing();
 
   return NS_OK;

widget/gonk/GeckoTouchDispatcher.cpp

@@ -349,8 +349,13 @@ IsExpired(const MultiTouchInput& aTouch)
 void
 GeckoTouchDispatcher::DispatchTouchEvent(MultiTouchInput& aMultiTouch)
 {
-  if (aMultiTouch.mType == MultiTouchInput::MULTITOUCH_START &&
+  if ((aMultiTouch.mType == MultiTouchInput::MULTITOUCH_END ||
+       aMultiTouch.mType == MultiTouchInput::MULTITOUCH_CANCEL) &&
       aMultiTouch.mTouches.Length() == 1) {
+    MutexAutoLock lock(mTouchQueueLock);
+    mTouchMoveEvents.clear();
+  } else if (aMultiTouch.mType == MultiTouchInput::MULTITOUCH_START &&
+             aMultiTouch.mTouches.Length() == 1) {
     mTouchEventsFiltered = IsExpired(aMultiTouch);
   }