Merge mozilla-central to fx-team

accessible/ipc/DocAccessibleParent.cpp

@@ -46,8 +46,15 @@ DocAccessibleParent::RecvShowEvent(const ShowEventData& aData,
     return true;
   }
 
-  DebugOnly<uint32_t> consumed = AddSubtree(parent, aData.NewTree(), 0, newChildIdx);
+  uint32_t consumed = AddSubtree(parent, aData.NewTree(), 0, newChildIdx);
   MOZ_ASSERT(consumed == aData.NewTree().Length());
+
+  // XXX This shouldn't happen, but if we failed to add children then the below
+  // is pointless and can crash.
+  if (!consumed) {
+    return true;
+  }
+
 #ifdef DEBUG
   for (uint32_t i = 0; i < consumed; i++) {
     uint64_t id = aData.NewTree()[i].ID();

b2g/chrome/content/shell.js

@@ -21,7 +21,6 @@ Cu.import('resource://gre/modules/RequestSyncService.jsm');
 Cu.import('resource://gre/modules/SystemUpdateService.jsm');
 
 if (isGonk) {
-  Cu.import('resource://gre/modules/MultiscreenHandler.jsm');
   Cu.import('resource://gre/modules/NetworkStatsService.jsm');
   Cu.import('resource://gre/modules/ResourceStatsService.jsm');
 }

b2g/chrome/content/shell_remote.js

@@ -6,9 +6,10 @@
 
 "use strict";
 
-var {utils: Cu} = Components;
+var {classes: Cc, interfaces: Ci, utils: Cu} = Components;
 
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/SystemAppProxy.jsm");
 
 function debug(aStr) {
   // dump(" -*- ShellRemote.js: " + aStr + "\n");
@@ -16,6 +17,8 @@ function debug(aStr) {
 
 var remoteShell = {
 
+  _started: false,
+
   get homeURL() {
     let systemAppManifestURL = Services.io.newURI(this.systemAppManifestURL, null, null);
     let shellRemoteURL = Services.prefs.getCharPref("b2g.multiscreen.system_remote_url");
@@ -27,14 +30,14 @@ var remoteShell = {
     return Services.prefs.getCharPref("b2g.system_manifest_url");
   },
 
-  _started: false,
-
   hasStarted: function () {
     return this._started;
   },
 
   start: function () {
     this._started = true;
+    this._isEventListenerReady = false;
+    this.id = window.location.hash.substring(1);
 
     let homeURL = this.homeURL;
     if (!homeURL) {
@@ -42,12 +45,13 @@ var remoteShell = {
       return;
     }
     let manifestURL = this.systemAppManifestURL;
-    // <html:iframe id="remote-systemapp"
-    //              mozbrowser="true" allowfullscreen="true"
+    // <html:iframe id="this.id"
+    //              mozbrowser="true"
+    //              allowfullscreen="true"
     //              src="blank.html"/>
     let systemAppFrame =
       document.createElementNS("http://www.w3.org/1999/xhtml", "html:iframe");
-    systemAppFrame.setAttribute("id", "remote-systemapp");
+    systemAppFrame.setAttribute("id", this.id);
     systemAppFrame.setAttribute("mozbrowser", "true");
     systemAppFrame.setAttribute("mozapp", manifestURL);
     systemAppFrame.setAttribute("allowfullscreen", "true");
@@ -56,11 +60,75 @@ var remoteShell = {
     let container = document.getElementById("container");
     this.contentBrowser = container.appendChild(systemAppFrame);
     this.contentBrowser.src = homeURL + window.location.hash;
+
+    window.addEventListener("unload", this);
+    this.contentBrowser.addEventListener("mozbrowserloadstart", this);
   },
 
   stop: function () {
+    window.removeEventListener("unload", this);
+    this.contentBrowser.removeEventListener("mozbrowserloadstart", this);
+    this.contentBrowser.removeEventListener("mozbrowserlocationchange", this, true);
+    SystemAppProxy.unregisterFrameWithId(this.id);
   },
 
+  notifyContentStart: function(evt) {
+    this.contentBrowser.removeEventListener("mozbrowserloadstart", this);
+    this.contentBrowser.removeEventListener("mozbrowserlocationchange", this, true);
+
+    SystemAppProxy.registerFrameWithId(remoteShell.id, remoteShell.contentBrowser);
+    SystemAppProxy.addEventListenerWithId(this.id, "mozContentEvent", this);
+
+    let content = this.contentBrowser.contentWindow;
+    content.addEventListener("load", this, true);
+  },
+
+  notifyContentWindowLoaded: function () {
+    SystemAppProxy.setIsLoadedWithId(this.id);
+  },
+
+  notifyEventListenerReady: function () {
+    if (this._isEventListenerReady) {
+      Cu.reportError("shell_remote.js: SystemApp has already been declared as being ready.");
+      return;
+    }
+    this._isEventListenerReady = true;
+    SystemAppProxy.setIsReadyWithId(this.id);
+  },
+
+  handleEvent: function(evt) {
+    debug("Got an event: " + evt.type);
+    let content = this.contentBrowser.contentWindow;
+
+    switch(evt.type) {
+      case "mozContentEvent":
+        if (evt.detail.type === "system-message-listener-ready") {
+          this.notifyEventListenerReady();
+        }
+        break;
+      case "load":
+        if (content.document.location == "about:blank") {
+          return;
+        }
+        content.removeEventListener("load", this, true);
+        this.notifyContentWindowLoaded();
+        break;
+      case "mozbrowserloadstart":
+        if (content.document.location == "about:blank") {
+          this.contentBrowser.addEventListener("mozbrowserlocationchange", this, true);
+          return;
+        }
+      case "mozbrowserlocationchange":
+        if (content.document.location == "about:blank") {
+          return;
+        }
+        this.notifyContentStart();
+        break;
+      case "unload":
+        this.stop();
+        break;
+    }
+  }
 };
 
 window.onload = function() {

b2g/components/MultiscreenHandler.jsm

@@ -1,92 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-this.EXPORTED_SYMBOLS = ["MultiscreenHandler"];
-
-const Ci = Components.interfaces;
-const Cu = Components.utils;
-
-Cu.import("resource://gre/modules/Services.jsm");
-
-function debug(aStr) {
-  // dump("MultiscreenHandler: " + aStr + "\n");
-}
-
-var window = Services.wm.getMostRecentWindow("navigator:browser");
-
-// Multi-screen support on b2g. The following implementation will open a new
-// top-level window once we receive a display connected event.
-var MultiscreenHandler = {
-
-  topLevelWindows: new Map(),
-
-  init: function init() {
-    Services.obs.addObserver(this, "display-changed", false);
-    Services.obs.addObserver(this, "xpcom-shutdown", false);
-  },
-
-  uninit: function uninit() {
-    Services.obs.removeObserver(this, "display-changed");
-    Services.obs.removeObserver(this, "xpcom-shutdown");
-  },
-
-  observe: function observe(aSubject, aTopic, aData) {
-    switch (aTopic) {
-      case "display-changed":
-        this.handleDisplayChangeEvent(aSubject);
-        break
-      case "xpcom-shutdown":
-        this.uninit();
-        break
-    }
-  },
-
-  openTopLevelWindow: function openTopLevelWindow(aDisplay) {
-    if (this.topLevelWindows.get(aDisplay.id)) {
-      debug("Top level window for display id: " + aDisplay.id + " has been opened.");
-      return;
-    }
-
-    let flags = Services.prefs.getCharPref("toolkit.defaultChromeFeatures") +
-                ",mozDisplayId=" + aDisplay.id;
-    let remoteShellURL = Services.prefs.getCharPref("b2g.multiscreen.chrome_remote_url") +
-                         "#" + aDisplay.id;
-    let win = Services.ww.openWindow(null, remoteShellURL, "myTopWindow" + aDisplay.id, flags, null);
-
-    this.topLevelWindows.set(aDisplay.id, win);
-  },
-
-  closeTopLevelWindow: function closeTopLevelWindow(aDisplay) {
-    let win = this.topLevelWindows.get(aDisplay.id);
-
-    if (win) {
-      win.close();
-      this.topLevelWindows.delete(aDisplay.id);
-    }
-  },
-
-  handleDisplayChangeEvent: function handleDisplayChangeEvent(aSubject) {
-
-    let display = aSubject.QueryInterface(Ci.nsIDisplayInfo);
-    let name = "multiscreen.enabled";
-    let req = window.navigator.mozSettings.createLock().get(name);
-
-    req.addEventListener("success", () => {
-      let isMultiscreenEnabled = req.result[name];
-      if (display.connected) {
-        if (isMultiscreenEnabled) {
-          this.openTopLevelWindow(display);
-        }
-      } else {
-        this.closeTopLevelWindow(display);
-      }
-    });
-  },
-
-};
-
-MultiscreenHandler.init();
-this.MultiscreenHandler = MultiscreenHandler;

b2g/components/PresentationRequestUIGlue.js

@@ -1,6 +1,8 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict"
 
@@ -16,65 +18,90 @@ Cu.import("resource://gre/modules/Services.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "SystemAppProxy",
                                   "resource://gre/modules/SystemAppProxy.jsm");
 
-function PresentationRequestUIGlue() {
-  // This is to store the session ID / resolver binding.
-  // An example of the object literal is shown below:
-  //
-  // {
-  //   "sessionId1" : resolver1,
-  //   ...
-  // }
-  this._resolvers = {};
-
-  // Listen to the result for the opened iframe from front-end.
-  SystemAppProxy.addEventListener("mozPresentationContentEvent", aEvent => {
-    let detail = aEvent.detail;
-
-    switch (detail.type) {
-      case "presentation-receiver-launched": {
-        let sessionId = detail.id;
-        let resolver = this._resolvers[sessionId];
-        if (!resolver) {
-          debug("No correspondent resolver for session ID: " + sessionId);
-          return;
-        }
-
-        delete this._resolvers[sessionId];
-        resolver.resolve(detail.frame);
-        break;
-      }
-      case "presentation-receiver-permission-denied": {
-        let sessionId = detail.id;
-        let resolver = this._resolvers[sessionId];
-        if (!resolver) {
-          debug("No correspondent resolver for session ID: " + sessionId);
-          return;
-        }
-
-        delete this._resolvers[sessionId];
-        resolver.reject();
-        break;
-      }
-      default:
-        return;
-      }
-  });
-}
+function PresentationRequestUIGlue() { }
 
 PresentationRequestUIGlue.prototype = {
 
-  sendRequest: function(aUrl, aSessionId) {
-    return new Promise(function(aResolve, aReject) {
-      this._resolvers[aSessionId] = {
-        resolve: aResolve,
-        reject: aReject,
+  sendRequest: function(aUrl, aSessionId, aDevice) {
+    let localDevice = aDevice.QueryInterface(Ci.nsIPresentationLocalDevice);
+    if (localDevice) {
+      return this.sendTo1UA(aUrl, aSessionId, localDevice.windowId);
+    } else {
+      return this.sendTo2UA(aUrl, aSessionId);
+    }
+  },
+
+  // For 1-UA scenario
+  sendTo1UA: function(aUrl, aSessionId, aWindowId) {
+    return new Promise((aResolve, aReject) => {
+      let handler = (evt) => {
+        if (evt.type === "unload") {
+          SystemAppProxy.removeEventListenerWithId(aWindowId,
+                                                   "unload",
+                                                   handler);
+          SystemAppProxy.removeEventListenerWithId(aWindowId,
+                                                   "mozPresentationContentEvent",
+                                                   handler);
+          aReject();
+        }
+        if (evt.type === "mozPresentationContentEvent" &&
+            evt.detail.id == aSessionId) {
+          SystemAppProxy.removeEventListenerWithId(aWindowId,
+                                                   "unload",
+                                                   handler);
+          SystemAppProxy.removeEventListenerWithId(aWindowId,
+                                                   "mozPresentationContentEvent",
+                                                   handler);
+          this.appLaunchCallback(evt.detail, aResolve, aReject);
+        }
+      };
+      // If system(-remote) app is closed.
+      SystemAppProxy.addEventListenerWithId(aWindowId,
+                                            "unload",
+                                            handler);
+      // Listen to the result for the opened iframe from front-end.
+      SystemAppProxy.addEventListenerWithId(aWindowId,
+                                            "mozPresentationContentEvent",
+                                            handler);
+      SystemAppProxy.sendCustomEventWithId(aWindowId,
+                                           "mozPresentationChromeEvent",
+                                           { type: "presentation-launch-receiver",
+                                             url: aUrl,
+                                             id: aSessionId });
+    });
+  },
+
+  // For 2-UA scenario
+  sendTo2UA: function(aUrl, aSessionId) {
+    return new Promise((aResolve, aReject) => {
+      let handler = (evt) => {
+        if (evt.type === "mozPresentationContentEvent" &&
+            evt.detail.id == aSessionId) {
+          SystemAppProxy.removeEventListener("mozPresentationContentEvent",
+                                            handler);
+          this.appLaunchCallback(evt.detail, aResolve, aReject);
+        }
       };
 
+      // Listen to the result for the opened iframe from front-end.
+      SystemAppProxy.addEventListener("mozPresentationContentEvent",
+                                      handler);
       SystemAppProxy._sendCustomEvent("mozPresentationChromeEvent",
                                       { type: "presentation-launch-receiver",
                                         url: aUrl,
                                         id: aSessionId });
-    }.bind(this));
+    });
+  },
+
+  appLaunchCallback: function(aDetail, aResolve, aReject) {
+    switch(aDetail.type) {
+      case "presentation-receiver-launched":
+        aResolve(aDetail.frame);
+        break;
+      case "presentation-receiver-permission-denied":
+        aReject();
+        break;
+    }
   },
 
   classID: Components.ID("{ccc8a839-0b64-422b-8a60-fb2af0e376d0}"),

b2g/components/SystemAppProxy.jsm

@@ -1,3 +1,5 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- /
+/* vim: set shiftwidth=2 tabstop=2 autoindent cindent expandtab: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -11,67 +13,170 @@ Cu.import('resource://gre/modules/Services.jsm');
 
 this.EXPORTED_SYMBOLS = ['SystemAppProxy'];
 
+const kMainSystemAppId = 'main';
+
 var SystemAppProxy = {
-  _frame: null,
-  _isLoaded: false,
-  _isReady: false,
+  _frameInfoMap: new Map(),
   _pendingLoadedEvents: [],
   _pendingReadyEvents: [],
   _pendingListeners: [],
 
-  // To call when a new system app iframe is created
-  registerFrame: function (frame) {
-    this._isReady = false;
-    this._frame = frame;
+  // To call when a main system app iframe is created
+  // Only used for main system app.
+  registerFrame: function systemApp_registerFrame(frame) {
+    this.registerFrameWithId(kMainSystemAppId, frame);
+  },
 
-    // Register all DOM event listeners added before we got a ref to the app iframe
+  // To call when a new system(-remote) app iframe is created with ID
+  registerFrameWithId: function systemApp_registerFrameWithId(frameId,
+                                                              frame) {
+    // - Frame ID of main system app is predefined as 'main'.
+    // - Frame ID of system-remote app is defined themselves.
+    //
+    // frameInfo = {
+    //    isReady: ...,
+    //    isLoaded: ...,
+    //    frame: ...
+    // }
+
+    let frameInfo = { frameId: frameId,
+                      isReady: false,
+                      isLoaded: false,
+                      frame: frame };
+
+    this._frameInfoMap.set(frameId, frameInfo);
+
+    // Register all DOM event listeners added before we got a ref to
+    // this system app iframe.
     this._pendingListeners
-        .forEach((args) =>
-                 this.addEventListener.apply(this, args));
-    this._pendingListeners = [];
+        .forEach(args => {
+          if (args[0] === frameInfo.frameId) {
+            this.addEventListenerWithId.apply(this, args);
+          }
+        });
+    // Removed registered event listeners.
+    this._pendingListeners =
+      this._pendingListeners
+          .filter(args => { return args[0] != frameInfo.frameId; });
   },
 
-  // Get the system app frame
-  getFrame: function () {
-    return this._frame;
+  unregisterFrameWithId: function systemApp_unregisterFrameWithId(frameId) {
+    this._frameInfoMap.delete(frameId);
+    // remove all pending event listener to the deleted system(-remote) app
+    this._pendingListeners = this._pendingListeners.filter(
+      args => { return args[0] != frameId; });
+    this._pendingReadyEvents = this._pendingReadyEvents.filter(
+        ([evtFrameId]) => { return evtFrameId != frameId });
+    this._pendingLoadedEvents = this._pendingLoadedEvents.filter(
+        ([evtFrameId]) => { return evtFrameId != frameId });
   },
 
-  // To call when the load event of the System app document is triggered.
+  // Get the main system app frame
+  _getMainSystemAppInfo: function systemApp_getMainSystemAppInfo() {
+    return this._frameInfoMap.get(kMainSystemAppId);
+  },
+
+  // Get the main system app frame
+  // Only used for the main system app.
+  getFrame: function systemApp_getFrame() {
+    return this.getFrameWithId(kMainSystemAppId);
+  },
+
+  // Get the frame of the specific system app
+  getFrameWithId: function systemApp_getFrameWithId(frameId) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+
+    if (!frameInfo) {
+      throw new Error('no frame ID is ' + frameId);
+    }
+    if (!frameInfo.frame) {
+      throw new Error('no content window');
+    }
+    return frameInfo.frame;
+  },
+
+  // To call when the load event of the main system app document is triggered.
   // i.e. everything that is not lazily loaded are run and done.
-  setIsLoaded: function () {
-    if (this._isLoaded) {
+  // Only used for the main system app.
+  setIsLoaded: function systemApp_setIsLoaded() {
+    this.setIsLoadedWithId(kMainSystemAppId);
+  },
+
+  // To call when the load event of the specific system app document is
+  // triggered. i.e. everything that is not lazily loaded are run and done.
+  setIsLoadedWithId: function systemApp_setIsLoadedWithId(frameId) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+    if (!frameInfo) {
+      throw new Error('no frame ID is ' + frameId);
+    }
+
+    if (frameInfo.isLoaded) {
+      if (frameInfo.frameId === kMainSystemAppId) {
         Cu.reportError('SystemApp has already been declared as being loaded.');
       }
-    this._isLoaded = true;
+      else {
+        Cu.reportError('SystemRemoteApp (ID: ' + frameInfo.frameId + ') ' +
+                       'has already been declared as being loaded.');
+      }
+    }
+
+    frameInfo.isLoaded = true;
 
     // Dispatch all events being queued while the system app was still loading
     this._pendingLoadedEvents
-        .forEach(([type, details]) =>
-                 this._sendCustomEvent(type, details, true));
-    this._pendingLoadedEvents = [];
+        .forEach(([evtFrameId, evtType, evtDetails]) => {
+          if (evtFrameId === frameInfo.frameId) {
+            this.sendCustomEventWithId(evtFrameId, evtType, evtDetails, true);
+          }
+        });
+    // Remove sent events.
+    this._pendingLoadedEvents =
+      this._pendingLoadedEvents
+          .filter(([evtFrameId]) => { return evtFrameId != frameInfo.frameId });
   },
 
-  // To call when it is ready to receive events
+  // To call when the main system app is ready to receive events
   // i.e. when system-message-listener-ready mozContentEvent is sent.
-  setIsReady: function () {
-    if (!this._isLoaded) {
+  // Only used for the main system app.
+  setIsReady: function systemApp_setIsReady() {
+    this.setIsReadyWithId(kMainSystemAppId);
+  },
+
+  // To call when the specific system(-remote) app is ready to receive events
+  // i.e. when system-message-listener-ready mozContentEvent is sent.
+  setIsReadyWithId: function systemApp_setIsReadyWithId(frameId) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+    if (!frameInfo) {
+      throw new Error('no frame ID is ' + frameId);
+    }
+
+    if (!frameInfo.isLoaded) {
       Cu.reportError('SystemApp.setIsLoaded() should be called before setIsReady().');
     }
 
-    if (this._isReady) {
+    if (frameInfo.isReady) {
       Cu.reportError('SystemApp has already been declared as being ready.');
     }
-    this._isReady = true;
+
+    frameInfo.isReady = true;
 
     // Dispatch all events being queued while the system app was still not ready
     this._pendingReadyEvents
-        .forEach(([type, details]) =>
-                 this._sendCustomEvent(type, details));
-    this._pendingReadyEvents = [];
+        .forEach(([evtFrameId, evtType, evtDetails]) => {
+          if (evtFrameId === frameInfo.frameId) {
+            this.sendCustomEventWithId(evtFrameId, evtType, evtDetails);
+          }
+        });
+
+    // Remove sent events.
+    this._pendingReadyEvents =
+      this._pendingReadyEvents
+          .filter(([evtFrameId]) => { return evtFrameId != frameInfo.frameId });
   },
 
   /*
-   * Common way to send an event to the system app.
+   * Common way to send an event to the main system app.
+   * Only used for the main system app.
    *
    * // In gecko code:
    *   SystemAppProxy.sendCustomEvent('foo', { data: 'bar' });
@@ -85,6 +190,7 @@ var SystemAppProxy = {
    *   @param noPending Set to true to emit this event even before the system
    *                    app is ready.
    *                    Event is always pending if the app is not loaded yet.
+   *   @param target    The element who dispatch this event.
    *
    *   @returns event?  Dispatched event, or null if the event is pending.
    */
@@ -92,24 +198,54 @@ var SystemAppProxy = {
                                                        details,
                                                        noPending,
                                                        target) {
-    let content = this._frame ? this._frame.contentWindow : null;
+    let args = Array.prototype.slice.call(arguments);
+    return this.sendCustomEventWithId
+               .apply(this, [kMainSystemAppId].concat(args));
+  },
 
+  /*
+   * Common way to send an event to the specific system app.
+   *
+   * // In gecko code (send custom event from main system app):
+   *   SystemAppProxy.sendCustomEventWithId('main', 'foo', { data: 'bar' });
+   * // In system app:
+   *   window.addEventListener('foo', function (event) {
+   *     event.details == 'bar'
+   *   });
+   *
+   *   @param frameId   Specify the system(-remote) app who dispatch this event.
+   *   @param type      The custom event type.
+   *   @param details   The event details.
+   *   @param noPending Set to true to emit this event even before the system
+   *                    app is ready.
+   *                    Event is always pending if the app is not loaded yet.
+   *   @param target    The element who dispatch this event.
+   *
+   *   @returns event?  Dispatched event, or null if the event is pending.
+   */
+  sendCustomEventWithId: function systemApp_sendCustomEventWithId(frameId,
+                                                                  type,
+                                                                  details,
+                                                                  noPending,
+                                                                  target) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+    let content = (frameInfo && frameInfo.frame) ?
+                  frameInfo.frame.contentWindow : null;
     // If the system app isn't loaded yet,
     // queue events until someone calls setIsLoaded
-    if (!content || !this._isLoaded) {
+    if (!content || !(frameInfo && frameInfo.isLoaded)) {
       if (noPending) {
-        this._pendingLoadedEvents.push([type, details]);
+        this._pendingLoadedEvents.push([frameId, type, details]);
       } else {
-        this._pendingReadyEvents.push([type, details]);
+        this._pendingReadyEvents.push([frameId, type, details]);
       }
-
       return null;
     }
 
     // If the system app isn't ready yet,
     // queue events until someone calls setIsReady
-    if (!this._isReady && !noPending) {
-      this._pendingReadyEvents.push([type, details]);
+    if (!(frameInfo && frameInfo.isReady) && !noPending) {
+      this._pendingReadyEvents.push([frameId, type, details]);
       return null;
     }
 
@@ -124,8 +260,8 @@ var SystemAppProxy = {
       payload = details ? Cu.cloneInto(details, content) : {};
     }
 
-    if ((target || content) === this._frame.contentWindow) {
-      dump('XXX FIXME : Dispatch a ' + type + ': ' + details.type + "\n");
+    if ((target || content) === frameInfo.frame.contentWindow) {
+      dump('XXX FIXME : Dispatch a ' + type + ': ' + details.type + '\n');
     }
 
     event.initCustomEvent(type, true, false, payload);
@@ -141,26 +277,27 @@ var SystemAppProxy = {
 
   dispatchKeyboardEvent: function systemApp_dispatchKeyboardEvent(type, details) {
     try {
-      let content = this._frame ? this._frame.contentWindow : null;
+      let frameInfo = this._getMainSystemAppInfo();
+      let content = (frameInfo && frameInfo.frame) ? frameInfo.frame.contentWindow
+                                                   : null;
       if (!content) {
-        throw new Error("no content window");
+        throw new Error('no content window');
       }
-
       // If we don't already have a TextInputProcessor, create one now
       if (!this.TIP) {
-        this.TIP = Cc["@mozilla.org/text-input-processor;1"]
+        this.TIP = Cc['@mozilla.org/text-input-processor;1']
           .createInstance(Ci.nsITextInputProcessor);
         if (!this.TIP) {
-          throw new Error("failed to create textInputProcessor");
+          throw new Error('failed to create textInputProcessor');
         }
       }
 
       if (!this.TIP.beginInputTransactionForTests(content)) {
         this.TIP = null;
-        throw new Error("beginInputTransaction failed");
+        throw new Error('beginInputTransaction failed');
       }
 
-      let e = new content.KeyboardEvent("", { key: details.key, });
+      let e = new content.KeyboardEvent('', { key: details.key, });
 
       if (type === 'keydown') {
         this.TIP.keydown(e);
@@ -169,50 +306,72 @@ var SystemAppProxy = {
         this.TIP.keyup(e);
       }
       else {
-        throw new Error("unexpected event type: " + type);
+        throw new Error('unexpected event type: ' + type);
       }
     }
     catch(e) {
-      dump("dispatchKeyboardEvent: " + e + "\n");
+      dump('dispatchKeyboardEvent: ' + e + '\n');
     }
   },
 
-  // Listen for dom events on the system app
+  // Listen for dom events on the main system app
   addEventListener: function systemApp_addEventListener() {
-    let content = this._frame ? this._frame.contentWindow : null;
-    if (!content) {
+    let args = Array.prototype.slice.call(arguments);
+    this.addEventListenerWithId.apply(this, [kMainSystemAppId].concat(args));
+  },
+
+  // Listen for dom events on the specific system app
+  addEventListenerWithId: function systemApp_addEventListenerWithId(frameId,
+                                                                    ...args) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+
+    if (!frameInfo) {
       this._pendingListeners.push(arguments);
       return false;
     }
 
-    content.addEventListener.apply(content, arguments);
+    let content = frameInfo.frame.contentWindow;
+    content.addEventListener.apply(content, args);
     return true;
   },
 
+  // remove the event listener from the main system app
   removeEventListener: function systemApp_removeEventListener(name, listener) {
-    let content = this._frame ? this._frame.contentWindow : null;
-    if (content) {
-      content.removeEventListener.apply(content, arguments);
-    } else {
+    this.removeEventListenerWithId.apply(this, [kMainSystemAppId, name, listener]);
+  },
+
+  // remove the event listener from the specific system app
+  removeEventListenerWithId: function systemApp_removeEventListenerWithId(frameId,
+                                                                          name,
+                                                                          listener) {
+    let frameInfo = this._frameInfoMap.get(frameId);
+
+    if (frameInfo) {
+      let content = frameInfo.frame.contentWindow;
+      content.removeEventListener.apply(content, [name, listener]);
+    }
+    else {
       this._pendingListeners = this._pendingListeners.filter(
         args => {
-          return args[0] != name || args[1] != listener;
+          return args[0] != frameId || args[1] != name || args[2] != listener;
         });
     }
   },
 
-  getFrames: function systemApp_getFrames() {
-    let systemAppFrame = this._frame;
-    if (!systemAppFrame) {
-      return [];
+  // Get all frame in system app
+  getFrames: function systemApp_getFrames(frameId) {
+    let frameList = [];
+
+    for (let frameId of this._frameInfoMap.keys()) {
+      let frameInfo = this._frameInfoMap.get(frameId);
+      let systemAppFrame = frameInfo.frame;
+      let subFrames = systemAppFrame.contentDocument.querySelectorAll('iframe');
+      frameList.push(systemAppFrame);
+      for (let i = 0; i < subFrames.length; ++i) {
+        frameList.push(subFrames[i]);
       }
-    let list = [systemAppFrame];
-    let frames = systemAppFrame.contentDocument.querySelectorAll('iframe');
-    for (let i = 0; i < frames.length; i++) {
-      list.push(frames[i]);
     }
-    return list;
+    return frameList;
   }
 };
 this.SystemAppProxy = SystemAppProxy;
-

b2g/components/moz.build

@@ -68,7 +68,6 @@ EXTRA_JS_MODULES += [
     'LogCapture.jsm',
     'LogParser.jsm',
     'LogShake.jsm',
-    'MultiscreenHandler.jsm',
     'OrientationChangeHandler.jsm',
     'PersistentDataBlock.jsm',
     'SafeMode.jsm',

browser/base/content/tabbrowser.xml

@@ -6023,8 +6023,11 @@
           let tab = this._getDragTargetTab(event, true);
           if (!tab) {
             // We're adding a new tab.
+            let userContextId = this.selectedItem.getAttribute("usercontextid");
             let newIndex = this._getDropIndex(event, true);
-            let newTab = this.tabbrowser.loadOneTab(url, {inBackground: bgLoad, allowThirdPartyFixup: true});
+            let newTab = this.tabbrowser.loadOneTab(url, {inBackground: bgLoad,
+                                                          allowThirdPartyFixup: true,
+                                                          userContextId});
             this.tabbrowser.moveTabTo(newTab, newIndex);
           } else {
             // Load in an existing tab.

browser/components/contextualidentity/test/browser/browser.ini

@@ -3,7 +3,11 @@ skip-if = buildapp == "mulet"
 support-files =
   empty_file.html
   file_reflect_cookie_into_title.html
+  serviceworker.html
+  worker.js
 
 [browser_usercontext.js]
+[browser_usercontextid_tabdrop.js]
 [browser_windowName.js]
 [browser_windowOpen.js]
+[browser_serviceworkers.js]

browser/components/contextualidentity/test/browser/browser_serviceworkers.js

@@ -0,0 +1,110 @@
+let { classes: Cc, interfaces: Ci } = Components;
+
+let swm = Cc["@mozilla.org/serviceworkers/manager;1"].
+          getService(Ci.nsIServiceWorkerManager);
+
+const BASE_ORIGIN = "https://example.com";
+const URI = BASE_ORIGIN +
+  "/browser/browser/components/contextualidentity/test/browser/serviceworker.html";
+const NUM_USER_CONTEXTS = 3;
+
+// opens `uri' in a new tab with the provided userContextId and focuses it.
+// returns the newly opened tab
+function openTabInUserContext(uri, userContextId) {
+  // open the tab in the correct userContextId
+  let tab = gBrowser.addTab(uri, {userContextId});
+
+  // select tab and make sure its browser is focused
+  gBrowser.selectedTab = tab;
+  tab.ownerDocument.defaultView.focus();
+
+  return tab;
+}
+
+add_task(function* setup() {
+  // make sure userContext is enabled.
+  SpecialPowers.pushPrefEnv({"set": [
+    ["privacy.userContext.enabled", true]
+  ]});
+});
+
+add_task(function* cleanup() {
+  // make sure we don't leave any prefs set for the next tests
+  registerCleanupFunction(function() {
+    SpecialPowers.popPrefEnv();
+  });
+});
+
+let infos = [];
+
+add_task(function* test() {
+  // Open the same URI in multiple user contexts, and make sure we have a
+  // separate service worker in each of the contexts
+  for (let userContextId = 0; userContextId < NUM_USER_CONTEXTS; userContextId++) {
+    // Open a tab in given user contexts
+    let tab = openTabInUserContext(URI, userContextId);
+
+    // wait for tab load
+    yield BrowserTestUtils.browserLoaded(gBrowser.getBrowserForTab(tab));
+
+    // remove the tab
+    gBrowser.removeTab(tab);
+  }
+
+  if (!allRegistered()) {
+    yield promiseAllRegistered();
+  }
+  ok(true, "all service workers are registered");
+
+  // Unregistered all service workers added in this test
+  for (let info of infos) {
+    yield promiseUnregister(info);
+  }
+});
+
+function allRegistered() {
+  let results = [];
+  let registrations = swm.getAllRegistrations();
+  for (let i = 0; i < registrations.length; i++) {
+    let info = registrations.queryElementAt(i, Ci.nsIServiceWorkerRegistrationInfo);
+    let principal = info.principal;
+    if (principal.originNoSuffix === BASE_ORIGIN) {
+      results[principal.userContextId] = true;
+      infos[principal.userContextId] = info;
+    }
+  }
+  for (let userContextId = 0; userContextId < NUM_USER_CONTEXTS; userContextId++) {
+    if (!results[userContextId]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function promiseAllRegistered() {
+  return new Promise(function(resolve) {
+    let listener = {
+      onRegister: function() {
+        if (allRegistered()) {
+          swm.removeListener(listener);
+          resolve();
+        }
+      }
+    }
+    swm.addListener(listener);
+  });
+}
+
+function promiseUnregister(info) {
+  return new Promise(function(resolve) {
+    swm.unregister(info.principal, {
+      unregisterSucceeded: function(aState) {
+        ok(aState, "ServiceWorkerRegistration exists");
+        resolve();
+      },
+      unregisterFailed: function(aState) {
+        ok(false, "unregister should succeed");
+      }
+    }, info.scope);
+  });
+}

browser/components/contextualidentity/test/browser/browser_usercontextid_tabdrop.js

@@ -0,0 +1,134 @@
+"use strict";
+
+let ChromeUtils = {};
+Services.scriptloader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/ChromeUtils.js", ChromeUtils);
+
+/**
+ * Dragging an URL to a tab without userContextId set.
+ */
+add_task(function* () {
+  let tab = gBrowser.addTab("http://example.com/");
+  yield BrowserTestUtils.browserLoaded(tab.linkedBrowser);
+
+  let awaitDrop = BrowserTestUtils.waitForEvent(gBrowser.tabContainer, "drop");
+  let newTabPromise = BrowserTestUtils.waitForNewTab(gBrowser, "http://test1.example.com/");
+
+  // A drop type of "link" onto an existing tab would normally trigger a
+  // load in that same tab, but tabbrowser code in _getDragTargetTab treats
+  // drops on the outer edges of a tab differently (loading a new tab
+  // instead). Make events created by synthesizeDrop have all of their
+  // coordinates set to 0 (screenX/screenY), so they're treated as drops
+  // on the outer edge of the tab, thus they open new tabs.
+  let event = {
+    clientX: 0,
+    clientY: 0,
+    screenX: 0,
+    screenY: 0,
+  };
+  ChromeUtils.synthesizeDrop(tab, tab, [[{type: "text/plain", data: "http://test1.example.com/"}]], "link", window, undefined, event);
+
+  yield awaitDrop;
+
+  let tab2 = yield newTabPromise;
+  Assert.ok(!tab2.hasAttribute("usercontextid"), "Tab shouldn't have usercontextid attribute");
+
+  yield BrowserTestUtils.browserLoaded(tab2.linkedBrowser);
+
+  yield ContentTask.spawn(tab2.linkedBrowser, {}, function* () {
+    Assert.equal(content.document.documentURI, "http://test1.example.com/");
+    Assert.equal(content.document.nodePrincipal.originAttributes.userContextId, 0);
+
+    // referrer is empty when urls are dragged to new or existing tabs.
+    // If this changes in the future, it would be okay to send the referrer
+    // in this case because we are creating a new tab with the default
+    // usercontextid as the original tab.
+    Assert.equal(content.document.referrer, "", "referrer should be empty");
+  });
+
+  yield BrowserTestUtils.removeTab(tab);
+  yield BrowserTestUtils.removeTab(tab2);
+});
+
+/**
+ * When dragging an URL to a new tab, the new tab should have the same
+ * userContextId as the original tab.
+ */
+add_task(function* () {
+  let tab = gBrowser.addTab("http://example.com/", {userContextId: 1});
+  yield BrowserTestUtils.browserLoaded(tab.linkedBrowser);
+
+  let awaitDrop = BrowserTestUtils.waitForEvent(gBrowser.tabContainer, "drop");
+  let newTabPromise = BrowserTestUtils.waitForNewTab(gBrowser, "http://test1.example.com/");
+
+  // A drop type of "link" onto an existing tab would normally trigger a
+  // load in that same tab, but tabbrowser code in _getDragTargetTab treats
+  // drops on the outer edges of a tab differently (loading a new tab
+  // instead). Make events created by synthesizeDrop have all of their
+  // coordinates set to 0 (screenX/screenY), so they're treated as drops
+  // on the outer edge of the tab, thus they open new tabs.
+  let event = {
+    clientX: 0,
+    clientY: 0,
+    screenX: 0,
+    screenY: 0,
+  };
+  ChromeUtils.synthesizeDrop(tab, tab, [[{type: "text/plain", data: "http://test1.example.com/"}]], "link", window, undefined, event);
+
+  yield awaitDrop;
+
+  let tab2 = yield newTabPromise;
+  Assert.equal(tab2.getAttribute("usercontextid"), 1);
+
+  yield BrowserTestUtils.browserLoaded(tab2.linkedBrowser);
+
+  yield ContentTask.spawn(tab2.linkedBrowser, {}, function* () {
+    Assert.equal(content.document.documentURI, "http://test1.example.com/");
+    Assert.equal(content.document.nodePrincipal.originAttributes.userContextId, 1);
+
+    // referrer is empty when urls are dragged to new or existing tabs.
+    // If this changes in the future, it would be okay to send the referrer
+    // in this case because we are creating a new tab with the same
+    // usercontextid as the original tab.
+    Assert.equal(content.document.referrer, "", "referrer should be empty");
+  });
+
+  yield BrowserTestUtils.removeTab(tab);
+  yield BrowserTestUtils.removeTab(tab2);
+});
+
+/**
+ * When dragging a URL from one tab or link on a tab to an existing tab, the
+ * existing tab should not change its userContextId.
+ * Ex: if you drag a link from tab 1 with userContext 1 to tab 2 with
+ * userContext 2, the link will open in tab 2 with userContext 2.
+ */
+add_task(function* () {
+  let tab = gBrowser.addTab("http://example.com/", {userContextId: 1});
+  yield BrowserTestUtils.browserLoaded(tab.linkedBrowser);
+
+  let tab2 = gBrowser.addTab("http://example.org/", {userContextId: 2});
+  yield BrowserTestUtils.browserLoaded(tab2.linkedBrowser);
+
+  let awaitDrop = BrowserTestUtils.waitForEvent(gBrowser.tabContainer, "drop");
+
+  ChromeUtils.synthesizeDrop(tab, tab2, [[{type: "text/plain", data: "http://test1.example.com/"}]], "link", window);
+
+  yield awaitDrop;
+  Assert.equal(tab2.getAttribute("usercontextid"), 2);
+
+  yield BrowserTestUtils.browserLoaded(tab2.linkedBrowser);
+
+  yield ContentTask.spawn(tab2.linkedBrowser, {}, function* () {
+    Assert.equal(content.document.documentURI, "http://test1.example.com/");
+    Assert.equal(content.document.nodePrincipal.originAttributes.userContextId, 2);
+
+    // referrer is empty when urls are dragged to new or existing tabs.
+    // If this changes in the future, we should ensure that we are not sending
+    // a referrer for this case!  When opening links across user contexts, we
+    // don't want the referrer to follow the user from one context to another.
+    Assert.equal(content.document.referrer, "", "referrer should be empty");
+  });
+
+  yield BrowserTestUtils.removeTab(tab);
+  yield BrowserTestUtils.removeTab(tab2);
+});

browser/components/contextualidentity/test/browser/serviceworker.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <script>
+       navigator.serviceWorker.register("worker.js");
+    </script>
+  </head>
+  <body>
+    This is a test page.
+  </body>
+<html>

browser/components/contextualidentity/test/browser/worker.js

@@ -0,0 +1 @@
+// empty worker, always succeed!

browser/components/feeds/FeedWriter.js

@@ -887,12 +887,16 @@ FeedWriter.prototype = {
    *        The window of the document invoking the BrowserFeedWriter
    */
   _getOriginalURI(aWindow) {
-    let chan = aWindow.QueryInterface(Ci.nsIInterfaceRequestor).
-               getInterface(Ci.nsIWebNavigation).
-               QueryInterface(Ci.nsIDocShell).currentDocumentChannel;
+    let docShell = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIWebNavigation)
+                          .QueryInterface(Ci.nsIDocShell);
+    let chan = docShell.currentDocumentChannel;
 
-    let nullPrincipal = Cc["@mozilla.org/nullprincipal;1"].
-                        createInstance(Ci.nsIPrincipal);
+    // We probably need to call InheritFromDocShellToDoc for this, but right now
+    // we can't call it from JS.
+    let attrs = docShell.getOriginAttributes();
+    let ssm = Services.scriptSecurityManager;
+    let nullPrincipal = ssm.createNullPrincipal(attrs);
 
     let resolvedURI = Cc["@mozilla.org/network/io-service;1"].
                       getService(Ci.nsIIOService).
@@ -1185,13 +1189,19 @@ FeedWriter.prototype = {
     }
     let faviconURI = makeURI(readerURI.prePath + "/favicon.ico");
     let self = this;
-    let usePrivateBrowsing = this._window.QueryInterface(Ci.nsIInterfaceRequestor)
+
+    let docShell = this._window.QueryInterface(Ci.nsIInterfaceRequestor)
                                .getInterface(Ci.nsIWebNavigation)
-                                         .QueryInterface(Ci.nsIDocShell)
-                                         .QueryInterface(Ci.nsILoadContext)
+                               .QueryInterface(Ci.nsIDocShell);
+    let usePrivateBrowsing = docShell.QueryInterface(Ci.nsILoadContext)
                                      .usePrivateBrowsing;
-    let nullPrincipal = Cc["@mozilla.org/nullprincipal;1"]
-                          .createInstance(Ci.nsIPrincipal);
+
+    // We probably need to call InheritFromDocShellToDoc for this, but right now
+    // we can't call it from JS.
+    let attrs = docShell.getOriginAttributes();
+    let ssm = Services.scriptSecurityManager;
+    let nullPrincipal = ssm.createNullPrincipal(attrs);
+
     this._faviconService.setAndFetchFaviconForPage(readerURI, faviconURI, false,
       usePrivateBrowsing ? this._faviconService.FAVICON_LOAD_PRIVATE
                          : this._faviconService.FAVICON_LOAD_NON_PRIVATE,

browser/confvars.sh

@@ -61,8 +61,5 @@ MOZ_ACTIVITIES=1
 MOZ_JSDOWNLOADS=1
 MOZ_RUST_MP4PARSE=1
 
-# Enable checking that add-ons are signed by the trusted root
-MOZ_ADDON_SIGNING=1
-
 # Include the DevTools client, not just the server (which is the default)
 MOZ_DEVTOOLS=all

browser/experiments/Experiments.jsm

@@ -1720,13 +1720,14 @@ Experiments.ExperimentEntry.prototype = {
   _runFilterFunction: Task.async(function* (jsfilter) {
     this._log.trace("runFilterFunction() - filter: " + jsfilter);
 
-    const nullprincipal = Cc["@mozilla.org/nullprincipal;1"].createInstance(Ci.nsIPrincipal);
+    let ssm = Services.scriptSecurityManager;
+    const nullPrincipal = ssm.createNullPrincipal({});
     let options = {
       sandboxName: "telemetry experiments jsfilter sandbox",
       wantComponents: false,
     };
 
-    let sandbox = Cu.Sandbox(nullprincipal, options);
+    let sandbox = Cu.Sandbox(nullPrincipal, options);
     try {
       Cu.evalInSandbox(jsfilter, sandbox);
     } catch (e) {

browser/modules/Feeds.jsm

@@ -20,6 +20,7 @@ this.Feeds = {
   init() {
     let mm = Cc["@mozilla.org/globalmessagemanager;1"].getService(Ci.nsIMessageListenerManager);
     mm.addMessageListener("WCCR:registerProtocolHandler", this);
+    mm.addMessageListener("WCCR:registerContentHandler", this);
 
     Services.ppmm.addMessageListener("WCCR:setAutoHandler", this);
     Services.ppmm.addMessageListener("FeedConverter:addLiveBookmark", this);

browser/themes/shared/privatebrowsing/aboutPrivateBrowsing.css

@@ -52,7 +52,7 @@ a:visited {
 }
 
 .about-content-container {
-  width: 780px;
+  max-width: 780px;
 }
 
 section.section-main {

build/mozconfig.common

@@ -16,6 +16,11 @@ ac_add_options --enable-crashreporter
 
 ac_add_options --enable-release
 
+# Enable checking that add-ons are signed by the trusted root
+MOZ_ADDON_SIGNING=${MOZ_ADDON_SIGNING-1}
+# Disable enforcing that add-ons are signed by the trusted root
+MOZ_REQUIRE_SIGNING=${MOZ_REQUIRE_SIGNING-0}
+
 ac_add_options --enable-js-shell
 
 . "$topsrcdir/build/mozconfig.automation"

caps/BasePrincipal.cpp

@@ -553,7 +553,7 @@ BasePrincipal::CreateCodebasePrincipal(nsIURI* aURI, const PrincipalOriginAttrib
                                     &inheritsPrincipal);
   nsCOMPtr<nsIPrincipal> principal;
   if (NS_FAILED(rv) || inheritsPrincipal) {
-    return nsNullPrincipal::Create();
+    return nsNullPrincipal::Create(aAttrs);
   }
 
   // Check whether the URI knows what its principal is supposed to be.
@@ -562,7 +562,7 @@ BasePrincipal::CreateCodebasePrincipal(nsIURI* aURI, const PrincipalOriginAttrib
     nsCOMPtr<nsIPrincipal> principal;
     uriPrinc->GetPrincipal(getter_AddRefs(principal));
     if (!principal) {
-      return nsNullPrincipal::Create();
+      return nsNullPrincipal::Create(aAttrs);
     }
     RefPtr<BasePrincipal> concrete = Cast(principal);
     return concrete.forget();

caps/nsJSPrincipals.cpp

@@ -123,6 +123,32 @@ nsJSPrincipals::ReadPrincipals(JSContext* aCx, JSStructuredCloneReader* aReader,
     return ReadKnownPrincipalType(aCx, aReader, tag, aOutPrincipals);
 }
 
+static bool
+ReadSuffixAndSpec(JSStructuredCloneReader* aReader,
+                  PrincipalOriginAttributes& aAttrs,
+                  nsACString& aSpec)
+{
+    uint32_t suffixLength, specLength;
+    if (!JS_ReadUint32Pair(aReader, &suffixLength, &specLength)) {
+        return false;
+    }
+
+    nsAutoCString suffix;
+    suffix.SetLength(suffixLength);
+    if (!JS_ReadBytes(aReader, suffix.BeginWriting(), suffixLength)) {
+        return false;
+    }
+
+    aAttrs.PopulateFromSuffix(suffix);
+
+    aSpec.SetLength(specLength);
+    if (!JS_ReadBytes(aReader, aSpec.BeginWriting(), specLength)) {
+        return false;
+    }
+
+    return true;
+}
+
 static bool
 ReadPrincipalInfo(JSStructuredCloneReader* aReader,
                   uint32_t aTag,
@@ -131,7 +157,12 @@ ReadPrincipalInfo(JSStructuredCloneReader* aReader,
     if (aTag == SCTAG_DOM_SYSTEM_PRINCIPAL) {
         aInfo = SystemPrincipalInfo();
     } else if (aTag == SCTAG_DOM_NULL_PRINCIPAL) {
-        aInfo = NullPrincipalInfo();
+        PrincipalOriginAttributes attrs;
+        nsAutoCString dummy;
+        if (!ReadSuffixAndSpec(aReader, attrs, dummy)) {
+            return false;
+        }
+        aInfo = NullPrincipalInfo(attrs);
     } else if (aTag == SCTAG_DOM_EXPANDED_PRINCIPAL) {
         uint32_t length, unused;
         if (!JS_ReadUint32Pair(aReader, &length, &unused)) {
@@ -155,25 +186,12 @@ ReadPrincipalInfo(JSStructuredCloneReader* aReader,
 
         aInfo = expanded;
     } else if (aTag == SCTAG_DOM_CONTENT_PRINCIPAL) {
-        uint32_t suffixLength, specLength;
-        if (!JS_ReadUint32Pair(aReader, &suffixLength, &specLength)) {
-            return false;
-        }
-
-        nsAutoCString suffix;
-        suffix.SetLength(suffixLength);
-        if (!JS_ReadBytes(aReader, suffix.BeginWriting(), suffixLength)) {
-            return false;
-        }
-
-        nsAutoCString spec;
-        spec.SetLength(specLength);
-        if (!JS_ReadBytes(aReader, spec.BeginWriting(), specLength)) {
-            return false;
-        }
-
         PrincipalOriginAttributes attrs;
-        attrs.PopulateFromSuffix(suffix);
+        nsAutoCString spec;
+        if (!ReadSuffixAndSpec(aReader, attrs, spec)) {
+            return false;
+        }
+
         aInfo = ContentPrincipalInfo(attrs, spec);
     } else {
         MOZ_CRASH("unexpected principal structured clone tag");
@@ -214,11 +232,26 @@ nsJSPrincipals::ReadKnownPrincipalType(JSContext* aCx,
     return true;
 }
 
+static bool
+WriteSuffixAndSpec(JSStructuredCloneWriter* aWriter,
+                   const PrincipalOriginAttributes& aAttrs,
+                   const nsCString& aSpec)
+{
+  nsAutoCString suffix;
+  aAttrs.CreateSuffix(suffix);
+
+  return JS_WriteUint32Pair(aWriter, suffix.Length(), aSpec.Length()) &&
+         JS_WriteBytes(aWriter, suffix.get(), suffix.Length()) &&
+         JS_WriteBytes(aWriter, aSpec.get(), aSpec.Length());
+}
+
 static bool
 WritePrincipalInfo(JSStructuredCloneWriter* aWriter, const PrincipalInfo& aInfo)
 {
     if (aInfo.type() == PrincipalInfo::TNullPrincipalInfo) {
-        return JS_WriteUint32Pair(aWriter, SCTAG_DOM_NULL_PRINCIPAL, 0);
+        const NullPrincipalInfo& nullInfo = aInfo;
+        return JS_WriteUint32Pair(aWriter, SCTAG_DOM_NULL_PRINCIPAL, 0) &&
+               WriteSuffixAndSpec(aWriter, nullInfo.attrs(), EmptyCString());
     }
     if (aInfo.type() == PrincipalInfo::TSystemPrincipalInfo) {
         return JS_WriteUint32Pair(aWriter, SCTAG_DOM_SYSTEM_PRINCIPAL, 0);
@@ -240,12 +273,8 @@ WritePrincipalInfo(JSStructuredCloneWriter* aWriter, const PrincipalInfo& aInfo)
 
     MOZ_ASSERT(aInfo.type() == PrincipalInfo::TContentPrincipalInfo);
     const ContentPrincipalInfo& cInfo = aInfo;
-    nsAutoCString suffix;
-    cInfo.attrs().CreateSuffix(suffix);
     return JS_WriteUint32Pair(aWriter, SCTAG_DOM_CONTENT_PRINCIPAL, 0) &&
-           JS_WriteUint32Pair(aWriter, suffix.Length(), cInfo.spec().Length()) &&
-           JS_WriteBytes(aWriter, suffix.get(), suffix.Length()) &&
-           JS_WriteBytes(aWriter, cInfo.spec().get(), cInfo.spec().Length());
+           WriteSuffixAndSpec(aWriter, cInfo.attrs(), cInfo.spec());
 }
 
 bool

caps/nsNullPrincipal.cpp

@@ -12,6 +12,7 @@
 
 #include "mozilla/ArrayUtils.h"
 
+#include "nsDocShell.h"
 #include "nsNullPrincipal.h"
 #include "nsNullPrincipalURI.h"
 #include "nsMemory.h"
@@ -40,7 +41,20 @@ nsNullPrincipal::CreateWithInheritedAttributes(nsIPrincipal* aInheritFrom)
 {
   RefPtr<nsNullPrincipal> nullPrin = new nsNullPrincipal();
   nsresult rv = nullPrin->Init(Cast(aInheritFrom)->OriginAttributesRef());
-  return NS_SUCCEEDED(rv) ? nullPrin.forget() : nullptr;
+  MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv));
+  return nullPrin.forget();
+}
+
+/* static */ already_AddRefed<nsNullPrincipal>
+nsNullPrincipal::CreateWithInheritedAttributes(nsIDocShell* aDocShell)
+{
+  PrincipalOriginAttributes attrs;
+  attrs.InheritFromDocShellToDoc(nsDocShell::Cast(aDocShell)->GetOriginAttributes(), nullptr);
+
+  RefPtr<nsNullPrincipal> nullPrin = new nsNullPrincipal();
+  nsresult rv = nullPrin->Init(attrs);
+  MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv));
+  return nullPrin.forget();
 }
 
 /* static */ already_AddRefed<nsNullPrincipal>
@@ -48,7 +62,7 @@ nsNullPrincipal::Create(const PrincipalOriginAttributes& aOriginAttributes)
 {
   RefPtr<nsNullPrincipal> nullPrin = new nsNullPrincipal();
   nsresult rv = nullPrin->Init(aOriginAttributes);
-  NS_ENSURE_SUCCESS(rv, nullptr);
+  MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv));
 
   return nullPrin.forget();
 }

caps/nsNullPrincipal.h

@@ -20,6 +20,7 @@
 
 #include "mozilla/BasePrincipal.h"
 
+class nsIDocShell;
 class nsIURI;
 
 #define NS_NULLPRINCIPAL_CID \
@@ -47,10 +48,10 @@ public:
   NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain) override;
   nsresult GetOriginInternal(nsACString& aOrigin) override;
 
-  // Returns null on failure.
   static already_AddRefed<nsNullPrincipal> CreateWithInheritedAttributes(nsIPrincipal* aInheritFrom);
 
-  // Returns null on failure.
+  static already_AddRefed<nsNullPrincipal> CreateWithInheritedAttributes(nsIDocShell* aDocShell);
+
   static already_AddRefed<nsNullPrincipal>
   Create(const mozilla::PrincipalOriginAttributes& aOriginAttributes = mozilla::PrincipalOriginAttributes());
 

caps/nsScriptSecurityManager.cpp

@@ -348,14 +348,12 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
             if (loadInfo->LoadingPrincipal()) {
               prin =
                 nsNullPrincipal::CreateWithInheritedAttributes(loadInfo->LoadingPrincipal());
-              NS_ENSURE_TRUE(prin, NS_ERROR_FAILURE);
             } else {
               NeckoOriginAttributes nAttrs;
               loadInfo->GetOriginAttributes(&nAttrs);
               PrincipalOriginAttributes pAttrs;
               pAttrs.InheritFromNecko(nAttrs);
               prin = nsNullPrincipal::Create(pAttrs);
-              NS_ENSURE_TRUE(prin, NS_ERROR_FAILURE);
             }
             prin.forget(aPrincipal);
             return NS_OK;
@@ -1174,7 +1172,6 @@ nsScriptSecurityManager::CreateNullPrincipal(JS::Handle<JS::Value> aOriginAttrib
       return NS_ERROR_INVALID_ARG;
   }
   nsCOMPtr<nsIPrincipal> prin = nsNullPrincipal::Create(attrs);
-  NS_ENSURE_TRUE(prin, NS_ERROR_FAILURE);
   prin.forget(aPrincipal);
   return NS_OK;
 }

devtools/client/inspector/rules/rules.js

@@ -120,8 +120,12 @@ function createDummyDocument() {
   });
   let docShell = getDocShell(frame);
   let eventTarget = docShell.chromeEventHandler;
-  docShell.createAboutBlankContentViewer(Cc["@mozilla.org/nullprincipal;1"]
-                                         .createInstance(Ci.nsIPrincipal));
+  let ssm = Services.scriptSecurityManager;
+
+  // We probably need to call InheritFromDocShellToDoc to get the correct origin
+  // attributes, but right now we can't call it from JS.
+  let nullPrincipal = ssm.createNullPrincipal(docShell.getOriginAttributes());
+  docShell.createAboutBlankContentViewer(nullPrincipal);
   let window = docShell.contentViewer.DOMDocument.defaultView;
   window.location = "data:text/html,<html></html>";
   let deferred = promise.defer();

docshell/base/nsDocShell.cpp

@@ -1475,8 +1475,8 @@ nsDocShell::LoadURI(nsIURI* aURI,
   //       for in InternalLoad is data:, javascript:, and about:blank
   //       URIs.  For other URIs this would all be dead wrong!
 
-  if (owner && mItemType != typeChrome) {
   nsCOMPtr<nsIPrincipal> ownerPrincipal = do_QueryInterface(owner);
+  if (owner && mItemType != typeChrome) {
     if (nsContentUtils::IsSystemPrincipal(ownerPrincipal)) {
       if (ownerIsExplicit) {
         return NS_ERROR_DOM_SECURITY_ERR;
@@ -1489,7 +1489,10 @@ nsDocShell::LoadURI(nsIURI* aURI,
       }
       // Don't inherit from the current page.  Just do the safe thing
       // and pretend that we were loaded by a nullprincipal.
-      owner = nsNullPrincipal::Create();
+      //
+      // We didn't inherit OriginAttributes here as ExpandedPrincipal doesn't
+      // have origin attributes.
+      owner = nsNullPrincipal::CreateWithInheritedAttributes(this);
       inheritOwner = false;
     }
   }
@@ -1500,7 +1503,9 @@ nsDocShell::LoadURI(nsIURI* aURI,
 
   if (aLoadFlags & LOAD_FLAGS_DISALLOW_INHERIT_OWNER) {
     inheritOwner = false;
-    owner = nsNullPrincipal::Create();
+    owner = ownerPrincipal ?
+              nsNullPrincipal::CreateWithInheritedAttributes(ownerPrincipal) :
+              nsNullPrincipal::CreateWithInheritedAttributes(this);
   }
 
   uint32_t flags = 0;
@@ -7948,7 +7953,6 @@ nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
     nsCOMPtr<nsIPrincipal> principal;
     if (mSandboxFlags & SANDBOXED_ORIGIN) {
       principal = nsNullPrincipal::CreateWithInheritedAttributes(aPrincipal);
-      NS_ENSURE_TRUE(principal, NS_ERROR_FAILURE);
     } else {
       principal = aPrincipal;
     }
@@ -12070,7 +12074,6 @@ nsDocShell::AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
           if (loadInfo->LoadingPrincipal()) {
             owner = nsNullPrincipal::CreateWithInheritedAttributes(
               loadInfo->LoadingPrincipal());
-            NS_ENSURE_TRUE(owner, NS_ERROR_FAILURE);
           } else {
             // get the OriginAttributes
             NeckoOriginAttributes nAttrs;
@@ -12079,7 +12082,6 @@ nsDocShell::AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
             pAttrs.InheritFromNecko(nAttrs);
 
             owner = nsNullPrincipal::Create(pAttrs);
-            NS_ENSURE_TRUE(owner, NS_ERROR_FAILURE);
           }
         } else if (loadInfo->GetForceInheritPrincipal()) {
           owner = loadInfo->TriggeringPrincipal();
@@ -12252,8 +12254,7 @@ nsDocShell::LoadHistoryEntry(nsISHEntry* aEntry, uint32_t aLoadType)
       // Ensure that we have an owner.  Otherwise javascript: URIs will
       // pick it up from the about:blank page we just loaded, and we
       // don't really want even that in this case.
-      owner = nsNullPrincipal::Create();
-      NS_ENSURE_TRUE(owner, NS_ERROR_OUT_OF_MEMORY);
+      owner = nsNullPrincipal::CreateWithInheritedAttributes(this);
     }
   }
 
@@ -13934,8 +13935,7 @@ nsDocShell::GetPrintPreview(nsIWebBrowserPrint** aPrintPreview)
   nsCOMPtr<nsIDocumentViewerPrint> print = do_QueryInterface(mContentViewer);
   if (!print || !print->IsInitializedForPrintPreview()) {
     Stop(nsIWebNavigation::STOP_ALL);
-    nsCOMPtr<nsIPrincipal> principal = nsNullPrincipal::Create();
-    NS_ENSURE_STATE(principal);
+    nsCOMPtr<nsIPrincipal> principal = nsNullPrincipal::CreateWithInheritedAttributes(this);
     nsresult rv = CreateAboutBlankContentViewer(principal, nullptr);
     NS_ENSURE_SUCCESS(rv, rv);
     print = do_QueryInterface(mContentViewer);

dom/animation/Animation.cpp

@@ -199,7 +199,7 @@ Animation::SetStartTime(const Nullable<TimeDuration>& aNewStartTime)
     mReady->MaybeResolve(this);
   }
 
-  UpdateTiming(SeekFlag::NoSeek, SyncNotifyFlag::Async);
+  UpdateTiming(SeekFlag::DidSeek, SyncNotifyFlag::Async);
   if (IsRelevant()) {
     nsNodeUtils::AnimationChanged(this);
   }

dom/animation/KeyframeEffect.h

@@ -11,7 +11,6 @@
 #include "nsCSSProperty.h"
 #include "nsCSSValue.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsIDocument.h"
 #include "nsTArray.h"
 #include "nsWrapperCache.h"
 #include "mozilla/AnimationPerformanceWarning.h"

dom/animation/test/chrome/test_restyles.html

@@ -369,6 +369,79 @@ waitForAllPaints(function() {
     yield ensureElementRemoval(div);
   });
 
+  add_task(function* script_animation_on_display_none_element() {
+    var div = addDiv(null);
+    var animation = div.animate({ backgroundColor: [ 'red', 'blue' ] },
+                                100 * MS_PER_SEC);
+
+    yield animation.ready;
+
+    div.style.display = 'none';
+
+    // We need to wait a frame to apply display:none style.
+    yield waitForFrame();
+
+    is(animation.playState, 'running',
+       'Script animations keep running even when the target element has ' +
+       '"display: none" style');
+
+    ok(!animation.isRunningOnCompositor,
+       'Script animations on "display:none" element should not run on the ' +
+       'compositor');
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'Script animations on "display: none" element should not update styles');
+
+    div.style.display = '';
+
+    // We need to wait a frame to unapply display:none style.
+    yield waitForFrame();
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 5,
+       'Script animations restored from "display: none" state should update ' +
+       'styles');
+
+    yield ensureElementRemoval(div);
+  });
+
+  add_task_if_omta_enabled(function* compositable_script_animation_on_display_none_element() {
+    var div = addDiv(null);
+    var animation = div.animate({ opacity: [ 0, 1 ] }, 100 * MS_PER_SEC);
+
+    yield animation.ready;
+
+    div.style.display = 'none';
+
+    // We need to wait a frame to apply display:none style.
+    yield waitForFrame();
+
+    is(animation.playState, 'running',
+       'Opacity script animations keep running even when the target element ' +
+       'has "display: none" style');
+
+    todo(!animation.isRunningOnCompositor,
+         'Opacity script animations on "display:none" element should not ' +
+         'run on the compositor');
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'Opacity script animations on "display: none" element should not ' +
+       'update styles');
+
+    div.style.display = '';
+
+    // We need to wait a frame to unapply display:none style.
+    yield waitForFrame();
+
+    ok(animation.isRunningOnCompositor,
+       'Opacity script animations restored from "display: none" should be ' +
+       'run on the compositor');
+
+    yield ensureElementRemoval(div);
+  });
+
 });
 
 </script>

dom/base/Attr.cpp

@@ -218,7 +218,6 @@ Attr::GetSpecified(bool* aSpecified)
 Element*
 Attr::GetOwnerElement(ErrorResult& aRv)
 {
-  OwnerDoc()->WarnOnceAbout(nsIDocument::eOwnerElement);
   return GetElement();
 }
 
@@ -226,7 +225,6 @@ NS_IMETHODIMP
 Attr::GetOwnerElement(nsIDOMElement** aOwnerElement)
 {
   NS_ENSURE_ARG_POINTER(aOwnerElement);
-  OwnerDoc()->WarnOnceAbout(nsIDocument::eOwnerElement);
 
   Element* element = GetElement();
   if (element) {

dom/base/DOMParser.cpp

@@ -352,7 +352,6 @@ DOMParser::Init(nsIPrincipal* principal, nsIURI* documentURI,
       // Don't give DOMParsers the system principal.  Use a null
       // principal instead.
       mPrincipal = nsNullPrincipal::Create();
-      NS_ENSURE_TRUE(mPrincipal, NS_ERROR_FAILURE);
 
       if (!mDocumentURI) {
         rv = mPrincipal->GetURI(getter_AddRefs(mDocumentURI));
@@ -468,8 +467,6 @@ DOMParser::SetUpDocument(DocumentFlavor aFlavor, nsIDOMDocument** aResult)
     AttemptedInitMarker marker(&mAttemptedInit);
 
     nsCOMPtr<nsIPrincipal> prin = nsNullPrincipal::Create();
-    NS_ENSURE_TRUE(prin, NS_ERROR_FAILURE);
-
     rv = Init(prin, nullptr, nullptr, scriptHandlingObject);
     NS_ENSURE_SUCCESS(rv, rv);
   }

dom/base/URLSearchParams.cpp

@@ -337,7 +337,14 @@ URLSearchParams::Constructor(const GlobalObject& aGlobal,
 {
   RefPtr<URLSearchParams> sp =
     new URLSearchParams(aGlobal.GetAsSupports(), nullptr);
-  sp->ParseInput(NS_ConvertUTF16toUTF8(aInit));
+
+  NS_ConvertUTF16toUTF8 input(aInit);
+
+  if (StringBeginsWith(input, NS_LITERAL_CSTRING("?"))) {
+    sp->ParseInput(Substring(input, 1, input.Length() - 1));
+  } else {
+    sp->ParseInput(input);
+  }
 
   return sp.forget();
 }

dom/base/WindowNamedPropertiesHandler.h

@@ -36,6 +36,11 @@ public:
   virtual bool
   delete_(JSContext* aCx, JS::Handle<JSObject*> aProxy, JS::Handle<jsid> aId,
           JS::ObjectOpResult &aResult) const override;
+
+  // No need for getPrototypeIfOrdinary here: this object shouldn't have a
+  // lazy prototype, so this trap would never be called (and the inherited
+  // version, from BaseProxyHandler, just crashes).
+
   virtual bool
   preventExtensions(JSContext* aCx, JS::Handle<JSObject*> aProxy,
                     JS::ObjectOpResult& aResult) const override

dom/base/contentAreaDropListener.js

@@ -83,7 +83,7 @@ ContentAreaDropListener.prototype =
 
     // Use file:/// as the default uri so that drops of file URIs are always allowed
     let principal = sourceNode ? sourceNode.nodePrincipal
-                               : secMan.getSimpleCodebasePrincipal(ioService.newURI("file:///", null, null));
+                               : secMan.createCodebasePrincipal(ioService.newURI("file:///", null, null), {});
 
     secMan.checkLoadURIStrWithPrincipal(principal, uriString, flags);
 

dom/base/nsContentUtils.cpp

@@ -4506,8 +4506,7 @@ nsContentUtils::ConvertToPlainText(const nsAString& aSourceBuffer,
 {
   nsCOMPtr<nsIURI> uri;
   NS_NewURI(getter_AddRefs(uri), "about:blank");
-  nsCOMPtr<nsIPrincipal> principal =
-    do_CreateInstance(NS_NULLPRINCIPAL_CONTRACTID);
+  nsCOMPtr<nsIPrincipal> principal = nsNullPrincipal::Create();
   nsCOMPtr<nsIDOMDocument> domDocument;
   nsresult rv = NS_NewDOMDocument(getter_AddRefs(domDocument),
                                   EmptyString(),

dom/base/nsDOMTokenList.cpp

@@ -74,7 +74,7 @@ nsDOMTokenList::IndexedGetter(uint32_t aIndex, bool& aFound, nsAString& aResult)
 }
 
 void
-nsDOMTokenList::SetValue(const nsAString& aValue, mozilla::ErrorResult& rv)
+nsDOMTokenList::SetValue(const nsAString& aValue, ErrorResult& rv)
 {
   if (!mElement) {
     return;
@@ -182,7 +182,7 @@ nsDOMTokenList::Add(const nsTArray<nsString>& aTokens, ErrorResult& aError)
 }
 
 void
-nsDOMTokenList::Add(const nsAString& aToken, mozilla::ErrorResult& aError)
+nsDOMTokenList::Add(const nsAString& aToken, ErrorResult& aError)
 {
   AutoTArray<nsString, 1> tokens;
   tokens.AppendElement(aToken);
@@ -268,7 +268,7 @@ nsDOMTokenList::Remove(const nsTArray<nsString>& aTokens, ErrorResult& aError)
 }
 
 void
-nsDOMTokenList::Remove(const nsAString& aToken, mozilla::ErrorResult& aError)
+nsDOMTokenList::Remove(const nsAString& aToken, ErrorResult& aError)
 {
   AutoTArray<nsString, 1> tokens;
   tokens.AppendElement(aToken);
@@ -308,6 +308,43 @@ nsDOMTokenList::Toggle(const nsAString& aToken,
   return isPresent;
 }
 
+void
+nsDOMTokenList::Replace(const nsAString& aToken,
+                        const nsAString& aNewToken,
+                        ErrorResult& aError)
+{
+  // Doing this here instead of using `CheckToken` because if aToken had invalid
+  // characters, and aNewToken is empty, the returned error should be a
+  // SyntaxError, not an InvalidCharacterError.
+  if (aNewToken.IsEmpty()) {
+    aError.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return;
+  }
+
+  aError = CheckToken(aToken);
+  if (aError.Failed()) {
+    return;
+  }
+
+  aError = CheckToken(aNewToken);
+  if (aError.Failed()) {
+    return;
+  }
+
+  const nsAttrValue* attr = GetParsedAttr();
+  if (!attr || !attr->Contains(aToken)) {
+    return;
+  }
+
+  AutoTArray<nsString, 1> tokens;
+
+  tokens.AppendElement(aToken);
+  RemoveInternal(attr, tokens);
+
+  tokens[0] = aNewToken;
+  AddInternal(attr, tokens);
+}
+
 void
 nsDOMTokenList::Stringify(nsAString& aResult)
 {

dom/base/nsDOMTokenList.h

@@ -63,6 +63,9 @@ public:
   void Remove(const nsAString& aToken, mozilla::ErrorResult& aError);
   void Remove(const nsTArray<nsString>& aTokens,
               mozilla::ErrorResult& aError);
+  void Replace(const nsAString& aToken,
+               const nsAString& aNewToken,
+               mozilla::ErrorResult& aError);
   bool Toggle(const nsAString& aToken,
               const mozilla::dom::Optional<bool>& force,
               mozilla::ErrorResult& aError);

dom/base/nsDOMWindowUtils.cpp

@@ -380,11 +380,12 @@ nsDOMWindowUtils::SetDisplayPortForElement(float aXPx, float aYPx,
         LayerManager* manager = widget->GetLayerManager(&isRetainingManager);
         if (isRetainingManager) {
           manager->BeginTransaction();
+          using PaintFrameFlags = nsLayoutUtils::PaintFrameFlags;
           nsLayoutUtils::PaintFrame(nullptr, rootFrame, nsRegion(),
                                     NS_RGB(255, 255, 255),
                                     nsDisplayListBuilderMode::PAINTING,
-                                    nsLayoutUtils::PAINT_WIDGET_LAYERS |
-                                    nsLayoutUtils::PAINT_EXISTING_TRANSACTION);
+                                    PaintFrameFlags::PAINT_WIDGET_LAYERS |
+                                    PaintFrameFlags::PAINT_EXISTING_TRANSACTION);
         }
       }
     }

dom/base/nsDeprecatedOperationList.h

@@ -17,7 +17,6 @@ DEPRECATED_OPERATION(SetAttributeNodeNS)
 DEPRECATED_OPERATION(RemoveAttributeNode)
 DEPRECATED_OPERATION(CreateAttribute)
 DEPRECATED_OPERATION(CreateAttributeNS)
-DEPRECATED_OPERATION(OwnerElement)
 DEPRECATED_OPERATION(NodeValue)
 DEPRECATED_OPERATION(TextContent)
 DEPRECATED_OPERATION(EnablePrivilege)

dom/base/nsFrameLoader.cpp

@@ -905,8 +905,25 @@ nsFrameLoader::SwapWithOtherRemoteLoader(nsFrameLoader* aOther,
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  if (mRemoteBrowser->OriginAttributesRef() !=
-      aOther->mRemoteBrowser->OriginAttributesRef()) {
+  // When we swap docShells, maybe we have to deal with a new page created just
+  // for this operation. In this case, the browser code should already have set
+  // the correct userContextId attribute value in the owning XULElement, but our
+  // docShell, that has been created way before) doesn't know that that
+  // happened.
+  // This is the reason why now we must retrieve the correct value from the
+  // usercontextid attribute before comparing our originAttributes with the
+  // other one.
+  DocShellOriginAttributes ourOriginAttributes =
+    mRemoteBrowser->OriginAttributesRef();
+  rv = PopulateUserContextIdFromAttribute(ourOriginAttributes);
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  DocShellOriginAttributes otherOriginAttributes =
+    aOther->mRemoteBrowser->OriginAttributesRef();
+  rv = aOther->PopulateUserContextIdFromAttribute(otherOriginAttributes);
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  if (ourOriginAttributes != otherOriginAttributes) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
@@ -1268,8 +1285,25 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  if (ourDocshell->GetOriginAttributes() !=
-      otherDocshell->GetOriginAttributes()) {
+  // When we swap docShells, maybe we have to deal with a new page created just
+  // for this operation. In this case, the browser code should already have set
+  // the correct userContextId attribute value in the owning XULElement, but our
+  // docShell, that has been created way before) doesn't know that that
+  // happened.
+  // This is the reason why now we must retrieve the correct value from the
+  // usercontextid attribute before comparing our originAttributes with the
+  // other one.
+  DocShellOriginAttributes ourOriginAttributes =
+    ourDocshell->GetOriginAttributes();
+  rv = PopulateUserContextIdFromAttribute(ourOriginAttributes);
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  DocShellOriginAttributes otherOriginAttributes =
+    otherDocshell->GetOriginAttributes();
+  rv = aOther->PopulateUserContextIdFromAttribute(otherOriginAttributes);
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  if (ourOriginAttributes != otherOriginAttributes) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
@@ -2025,13 +2059,9 @@ nsFrameLoader::MaybeCreateDocShell()
   }
 
   // Grab the userContextId from owner if XUL
-  nsAutoString userContextIdStr;
-  if ((namespaceID == kNameSpaceID_XUL) &&
-      mOwnerContent->GetAttr(kNameSpaceID_None, nsGkAtoms::usercontextid, userContextIdStr) &&
-      !userContextIdStr.IsEmpty()) {
-    nsresult rv;
-    attrs.mUserContextId = userContextIdStr.ToInteger(&rv);
-    NS_ENSURE_SUCCESS(rv, rv);
+  nsresult rv = PopulateUserContextIdFromAttribute(attrs);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
   }
 
   nsDocShell::Cast(mDocShell)->SetOriginAttributes(attrs);
@@ -3244,3 +3274,24 @@ nsFrameLoader::GetNewTabContext(MutableTabContext* aTabContext,
 
   return NS_OK;
 }
+
+nsresult
+nsFrameLoader::PopulateUserContextIdFromAttribute(DocShellOriginAttributes& aAttr)
+{
+  if (aAttr.mUserContextId ==
+        nsIScriptSecurityManager::DEFAULT_USER_CONTEXT_ID)  {
+    // Grab the userContextId from owner if XUL
+    nsAutoString userContextIdStr;
+    int32_t namespaceID = mOwnerContent->GetNameSpaceID();
+    if ((namespaceID == kNameSpaceID_XUL) &&
+        mOwnerContent->GetAttr(kNameSpaceID_None, nsGkAtoms::usercontextid,
+                               userContextIdStr) &&
+        !userContextIdStr.IsEmpty()) {
+      nsresult rv;
+      aAttr.mUserContextId = userContextIdStr.ToInteger(&rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+  }
+
+  return NS_OK;
+}

dom/base/nsFrameLoader.h

@@ -38,6 +38,9 @@ class nsIDocShellTreeOwner;
 class mozIApplication;
 
 namespace mozilla {
+
+class DocShellOriginAttributes;
+
 namespace dom {
 class ContentParent;
 class PBrowserParent;
@@ -339,6 +342,9 @@ private:
   };
   void MaybeUpdatePrimaryTabParent(TabParentChange aChange);
 
+  nsresult
+  PopulateUserContextIdFromAttribute(mozilla::DocShellOriginAttributes& aAttr);
+
   nsCOMPtr<nsIDocShell> mDocShell;
   nsCOMPtr<nsIURI> mURIToLoad;
   mozilla::dom::Element* mOwnerContent; // WEAK

dom/base/nsGlobalWindow.cpp

@@ -682,6 +682,12 @@ public:
   virtual bool delete_(JSContext *cx, JS::Handle<JSObject*> proxy,
                        JS::Handle<jsid> id,
                        JS::ObjectOpResult &result) const override;
+
+  virtual bool getPrototypeIfOrdinary(JSContext* cx,
+                                      JS::Handle<JSObject*> proxy,
+                                      bool* isOrdinary,
+                                      JS::MutableHandle<JSObject*> protop) const override;
+
   virtual bool enumerate(JSContext *cx, JS::Handle<JSObject*> proxy,
                          JS::MutableHandle<JSObject*> vp) const override;
   virtual bool preventExtensions(JSContext* cx,
@@ -908,6 +914,27 @@ nsOuterWindowProxy::delete_(JSContext *cx, JS::Handle<JSObject*> proxy,
   return js::Wrapper::delete_(cx, proxy, id, result);
 }
 
+bool
+nsOuterWindowProxy::getPrototypeIfOrdinary(JSContext* cx,
+                                           JS::Handle<JSObject*> proxy,
+                                           bool* isOrdinary,
+                                           JS::MutableHandle<JSObject*> protop) const
+{
+  // Window's [[GetPrototypeOf]] trap isn't the ordinary definition:
+  //
+  //   https://html.spec.whatwg.org/multipage/browsers.html#windowproxy-getprototypeof
+  //
+  // We nonetheless can implement it here using a non-"lazy" [[Prototype]],
+  // because wrapper-class handlers (particularly, XOW in FilteringWrapper.cpp)
+  // supply all the non-ordinary behavior.
+  //
+  // But from a spec point of view, it's the exact same object in both cases --
+  // only the observer's changed.  So both cases *must* report non-ordinary,
+  // even if non-"lazy" [[Prototype]] usually means ordinary.
+  *isOrdinary = false;
+  return true;
+}
+
 bool
 nsOuterWindowProxy::preventExtensions(JSContext* cx,
                                       JS::Handle<JSObject*> proxy,

dom/base/nsNodeInfoManager.cpp

@@ -182,7 +182,6 @@ nsNodeInfoManager::Init(nsIDocument *aDocument)
                   "Being inited when we already have a principal?");
 
   mPrincipal = nsNullPrincipal::Create();
-  NS_ENSURE_TRUE(mPrincipal, NS_ERROR_FAILURE);
 
   if (aDocument) {
     mBindingManager = new nsBindingManager(aDocument);

dom/base/nsTreeSanitizer.cpp

@@ -1517,8 +1517,7 @@ nsTreeSanitizer::InitializeStatics()
     sAttributesMathML->PutEntry(*kAttributesMathML[i]);
   }
 
-  nsCOMPtr<nsIPrincipal> principal =
-      do_CreateInstance(NS_NULLPRINCIPAL_CONTRACTID);
+  nsCOMPtr<nsIPrincipal> principal = nsNullPrincipal::Create();
   principal.forget(&sNullPrincipal);
 }
 

dom/base/test/test_urlSearchParams.html

@@ -89,6 +89,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=887836
       { input: '%a_=a', data: { '%a_' : ['a'] } },
       { input: '%61=a', data: { 'a' : ['a'] } },
       { input: '%61+%4d%4D=', data: { 'a MM' : [''] } },
+      { input: '?a=1', data: { 'a' : ['1'] } },
+      { input: '?', data: {} },
+      { input: '?=b', data: { '' : ['b'] } },
     ];
 
     for (var i = 0; i < checks.length; ++i) {

dom/bindings/SimpleGlobalObject.cpp

@@ -99,9 +99,6 @@ SimpleGlobalObject::Create(GlobalType globalType, JS::Handle<JS::Value> proto)
   nsCOMPtr<nsIPrincipal> principal;
   if (NS_IsMainThread()) {
     principal = nsNullPrincipal::Create();
-    if (!principal) {
-      return nullptr;
-    }
   }
 
   JS::Rooted<JSObject*> global(cx,

dom/bluetooth/bluedroid/BluetoothA2dpManager.cpp

@@ -129,7 +129,7 @@ private:
 };
 
 class BluetoothA2dpManager::InitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   InitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -171,7 +171,7 @@ BluetoothA2dpManager::InitA2dpInterface(BluetoothProfileResultHandler* aRes)
 
   if (sBtA2dpInterface) {
     BT_LOGR("Bluetooth A2DP interface is already initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP Init runnable");
@@ -184,7 +184,7 @@ BluetoothA2dpManager::InitA2dpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no Bluetooth interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP OnError runnable");
@@ -197,7 +197,7 @@ BluetoothA2dpManager::InitA2dpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP OnError runnable");
@@ -210,7 +210,7 @@ BluetoothA2dpManager::InitA2dpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!a2dpInterface)) {
     // If there's no A2DP interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP OnError runnable");
@@ -329,7 +329,7 @@ private:
 };
 
 class BluetoothA2dpManager::DeinitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   DeinitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -365,7 +365,7 @@ BluetoothA2dpManager::DeinitA2dpInterface(BluetoothProfileResultHandler* aRes)
 
   if (!sBtA2dpInterface) {
     BT_LOGR("Bluetooth A2DP interface has not been initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP Deinit runnable");
@@ -378,7 +378,7 @@ BluetoothA2dpManager::DeinitA2dpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP OnError runnable");
@@ -391,7 +391,7 @@ BluetoothA2dpManager::DeinitA2dpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch A2DP OnError runnable");

dom/bluetooth/bluedroid/BluetoothAvrcpManager.cpp

@@ -172,7 +172,7 @@ private:
 };
 
 class BluetoothAvrcpManager::InitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   InitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -211,7 +211,7 @@ BluetoothAvrcpManager::InitAvrcpInterface(BluetoothProfileResultHandler* aRes)
 
   if (sBtAvrcpInterface) {
     BT_LOGR("Bluetooth AVRCP interface is already initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP Init runnable");
@@ -224,7 +224,7 @@ BluetoothAvrcpManager::InitAvrcpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no Bluetooth interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP OnError runnable");
@@ -237,7 +237,7 @@ BluetoothAvrcpManager::InitAvrcpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP OnError runnable");
@@ -250,7 +250,7 @@ BluetoothAvrcpManager::InitAvrcpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!avrcpInterface)) {
     // If there's no AVRCP interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP OnError runnable");
@@ -350,7 +350,7 @@ private:
 };
 
 class BluetoothAvrcpManager::DeinitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   DeinitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -386,7 +386,7 @@ BluetoothAvrcpManager::DeinitAvrcpInterface(BluetoothProfileResultHandler* aRes)
 
   if (!sBtAvrcpInterface) {
     BT_LOGR("Bluetooth AVRCP interface has not been initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP Deinit runnable");
@@ -399,7 +399,7 @@ BluetoothAvrcpManager::DeinitAvrcpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP OnError runnable");
@@ -412,7 +412,7 @@ BluetoothAvrcpManager::DeinitAvrcpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch AVRCP OnError runnable");
@@ -434,7 +434,7 @@ BluetoothAvrcpManager::HandleShutdown()
   sBluetoothAvrcpManager = nullptr;
 }
 
-class BluetoothAvrcpManager::ConnectRunnable final : public nsRunnable
+class BluetoothAvrcpManager::ConnectRunnable final : public Runnable
 {
 public:
   ConnectRunnable(BluetoothAvrcpManager* aManager)
@@ -467,7 +467,7 @@ BluetoothAvrcpManager::Connect(const BluetoothAddress& aDeviceAddress,
   NS_DispatchToMainThread(new ConnectRunnable(this));
 }
 
-class BluetoothAvrcpManager::DisconnectRunnable final : public nsRunnable
+class BluetoothAvrcpManager::DisconnectRunnable final : public Runnable
 {
 public:
   DisconnectRunnable(BluetoothAvrcpManager* aManager)

dom/bluetooth/bluedroid/BluetoothGattManager.cpp

@@ -465,7 +465,7 @@ private:
 };
 
 class BluetoothGattManager::InitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   InitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -501,7 +501,7 @@ BluetoothGattManager::InitGattInterface(BluetoothProfileResultHandler* aRes)
 
   if (sBluetoothGattInterface) {
     BT_LOGR("Bluetooth GATT interface is already initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT Init runnable");
@@ -514,7 +514,7 @@ BluetoothGattManager::InitGattInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no Bluetooth interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT OnError runnable");
@@ -527,7 +527,7 @@ BluetoothGattManager::InitGattInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT OnError runnable");
@@ -540,7 +540,7 @@ BluetoothGattManager::InitGattInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!gattInterface)) {
     // If there's no GATT interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT OnError runnable");
@@ -615,7 +615,7 @@ private:
 };
 
 class BluetoothGattManager::DeinitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   DeinitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -651,7 +651,7 @@ BluetoothGattManager::DeinitGattInterface(BluetoothProfileResultHandler* aRes)
 
   if (!sBluetoothGattInterface) {
     BT_LOGR("Bluetooth GATT interface has not been initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT Deinit runnable");
@@ -664,7 +664,7 @@ BluetoothGattManager::DeinitGattInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT OnError runnable");
@@ -677,7 +677,7 @@ BluetoothGattManager::DeinitGattInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch GATT OnError runnable");

dom/bluetooth/bluedroid/BluetoothHidManager.cpp

@@ -94,7 +94,7 @@ private:
 };
 
 class BluetoothHidManager::InitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   InitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -130,7 +130,7 @@ BluetoothHidManager::InitHidInterface(BluetoothProfileResultHandler* aRes)
 
   if (sBluetoothHidInterface) {
     BT_LOGR("Bluetooth HID interface is already initialized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID Init runnable");
@@ -143,7 +143,7 @@ BluetoothHidManager::InitHidInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID OnError runnable");
@@ -156,7 +156,7 @@ BluetoothHidManager::InitHidInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID OnError runnable");
@@ -169,7 +169,7 @@ BluetoothHidManager::InitHidInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!hidinterface)) {
     // If there's no HID interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID OnError runnable");
@@ -246,7 +246,7 @@ private:
 };
 
 class BluetoothHidManager::DeinitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   DeinitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -282,7 +282,7 @@ BluetoothHidManager::DeinitHidInterface(BluetoothProfileResultHandler* aRes)
 
   if (!sBluetoothHidInterface) {
     BT_LOGR("Bluetooth Hid interface has not been initialized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID Deinit runnable");
@@ -295,7 +295,7 @@ BluetoothHidManager::DeinitHidInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID OnError runnable");
@@ -308,7 +308,7 @@ BluetoothHidManager::DeinitHidInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HID OnError runnable");

dom/bluetooth/bluedroid/BluetoothOppManager.cpp

@@ -102,7 +102,7 @@ BluetoothOppManager::Observe(nsISupports* aSubject,
   return NS_ERROR_UNEXPECTED;
 }
 
-class BluetoothOppManager::SendSocketDataTask final : public nsRunnable
+class BluetoothOppManager::SendSocketDataTask final : public Runnable
 {
 public:
   SendSocketDataTask(UniquePtr<uint8_t[]> aStream, uint32_t aSize)
@@ -126,7 +126,7 @@ private:
   uint32_t mSize;
 };
 
-class BluetoothOppManager::ReadFileTask final : public nsRunnable
+class BluetoothOppManager::ReadFileTask final : public Runnable
 {
 public:
   ReadFileTask(nsIInputStream* aInputStream,

dom/bluetooth/bluedroid/hfp/BluetoothHfpManager.cpp

@@ -118,7 +118,7 @@ private:
   }
 };
 
-class BluetoothHfpManager::CloseScoRunnable : public nsRunnable
+class BluetoothHfpManager::CloseScoRunnable : public Runnable
 {
 public:
   NS_IMETHOD Run() override
@@ -319,7 +319,7 @@ private:
 };
 
 class BluetoothHfpManager::InitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   InitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -355,7 +355,7 @@ BluetoothHfpManager::InitHfpInterface(BluetoothProfileResultHandler* aRes)
 
   if (sBluetoothHfpInterface) {
     BT_LOGR("Bluetooth Handsfree interface is already initalized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP Init runnable");
@@ -368,7 +368,7 @@ BluetoothHfpManager::InitHfpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP OnError runnable");
@@ -381,7 +381,7 @@ BluetoothHfpManager::InitHfpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP OnError runnable");
@@ -394,7 +394,7 @@ BluetoothHfpManager::InitHfpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!interface)) {
     // If there's no HFP interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new InitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP OnError runnable");
@@ -471,7 +471,7 @@ private:
 };
 
 class BluetoothHfpManager::DeinitProfileResultHandlerRunnable final
-  : public nsRunnable
+  : public Runnable
 {
 public:
   DeinitProfileResultHandlerRunnable(BluetoothProfileResultHandler* aRes,
@@ -507,7 +507,7 @@ BluetoothHfpManager::DeinitHfpInterface(BluetoothProfileResultHandler* aRes)
 
   if (!sBluetoothHfpInterface) {
     BT_LOGR("Bluetooth Handsfree interface has not been initialized.");
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_OK);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP Deinit runnable");
@@ -520,7 +520,7 @@ BluetoothHfpManager::DeinitHfpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!btInf)) {
     // If there's no backend interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP OnError runnable");
@@ -533,7 +533,7 @@ BluetoothHfpManager::DeinitHfpInterface(BluetoothProfileResultHandler* aRes)
   if (NS_WARN_IF(!setupInterface)) {
     // If there's no Setup interface, we dispatch a runnable
     // that calls the profile result handler.
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new DeinitProfileResultHandlerRunnable(aRes, NS_ERROR_FAILURE);
     if (NS_FAILED(NS_DispatchToMainThread(r))) {
       BT_LOGR("Failed to dispatch HFP OnError runnable");

dom/bluetooth/bluez/BluetoothDBusService.cpp

@@ -513,7 +513,7 @@ GetPairedDevicesFilter(const BluetoothValue& aValue)
   return false;
 }
 
-class DistributeBluetoothSignalTask : public nsRunnable
+class DistributeBluetoothSignalTask : public Runnable
 {
 public:
   DistributeBluetoothSignalTask(const BluetoothSignal& aSignal)
@@ -536,7 +536,7 @@ private:
   BluetoothSignal mSignal;
 };
 
-class ControlPropertyChangedHandler : public nsRunnable
+class ControlPropertyChangedHandler : public Runnable
 {
 public:
   ControlPropertyChangedHandler(const BluetoothSignal& aSignal)
@@ -568,7 +568,7 @@ private:
   BluetoothSignal mSignal;
 };
 
-class SinkPropertyChangedHandler : public nsRunnable
+class SinkPropertyChangedHandler : public Runnable
 {
 public:
   SinkPropertyChangedHandler(const BluetoothSignal& aSignal)
@@ -598,7 +598,7 @@ private:
   BluetoothSignal mSignal;
 };
 
-class InputPropertyChangedHandler : public nsRunnable
+class InputPropertyChangedHandler : public Runnable
 {
 public:
   InputPropertyChangedHandler(const BluetoothSignal& aSignal)
@@ -637,7 +637,7 @@ public:
   }
 };
 
-class TryFiringAdapterAddedRunnable : public nsRunnable
+class TryFiringAdapterAddedRunnable : public Runnable
 {
 public:
   TryFiringAdapterAddedRunnable(bool aDelay)
@@ -719,7 +719,7 @@ UnpackObjectPathMessage(DBusMessage* aMsg, DBusError* aErr,
   }
 }
 
-class PrepareProfileManagersRunnable : public nsRunnable
+class PrepareProfileManagersRunnable : public Runnable
 {
 public:
   nsresult Run()
@@ -808,7 +808,7 @@ GetVoidCallback(DBusMessage* aMsg, void* aBluetoothReplyRunnable)
                   UnpackVoidMessage);
 }
 
-class ReplyErrorToProfileManager : public nsRunnable
+class ReplyErrorToProfileManager : public Runnable
 {
 public:
   ReplyErrorToProfileManager(BluetoothServiceClass aServiceClass,
@@ -1726,7 +1726,7 @@ public:
   }
 };
 
-class PrepareAdapterRunnable : public nsRunnable
+class PrepareAdapterRunnable : public Runnable
 {
 public:
   PrepareAdapterRunnable()
@@ -1743,7 +1743,7 @@ public:
   }
 };
 
-class RequestPlayStatusTask : public nsRunnable
+class RequestPlayStatusTask : public Runnable
 {
 public:
   RequestPlayStatusTask()
@@ -2016,7 +2016,7 @@ EventFilter(DBusConnection* aConn, DBusMessage* aMsg, void* aData)
   }
 
   BluetoothSignal signal(signalName, signalPath, v);
-  RefPtr<nsRunnable> task;
+  RefPtr<Runnable> task;
   if (signalInterface.EqualsLiteral(DBUS_SINK_IFACE)) {
     task = new SinkPropertyChangedHandler(signal);
   } else if (signalInterface.EqualsLiteral(DBUS_CTL_IFACE)) {
@@ -2086,7 +2086,7 @@ public:
 
     if (sDBusConnection) {
       BT_WARNING("DBus connection has already been established.");
-      RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(true);
+      RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(true);
       if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
         BT_WARNING("Failed to dispatch to main thread!");
       }
@@ -2097,7 +2097,7 @@ public:
     if (!dbus_connection_add_filter(mConnection->GetConnection(),
                                     EventFilter, nullptr, nullptr)) {
       BT_WARNING("Cannot create DBus Event Filter for DBus Thread!");
-      RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(false);
+      RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(false);
       if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
         BT_WARNING("Failed to dispatch to main thread!");
       }
@@ -2112,7 +2112,7 @@ public:
 
     sDBusConnection = mConnection.release();
 
-    RefPtr<nsRunnable> runnable =
+    RefPtr<Runnable> runnable =
       new BluetoothService::ToggleBtAck(true);
     if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
       BT_WARNING("Failed to dispatch to main thread!");
@@ -2142,7 +2142,7 @@ private:
   UniquePtr<RawDBusConnection> mConnection;
 };
 
-class StartBluetoothRunnable final : public nsRunnable
+class StartBluetoothRunnable final : public Runnable
 {
 public:
   NS_IMETHOD Run()
@@ -2153,7 +2153,7 @@ public:
 #ifdef MOZ_WIDGET_GONK
     if (!sBluedroid.Enable()) {
       BT_WARNING("Bluetooth not available.");
-      RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(false);
+      RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(false);
       if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
         BT_WARNING("Failed to dispatch to main thread!");
       }
@@ -2165,7 +2165,7 @@ public:
     nsresult rv = connection->EstablishDBusConnection();
     if (NS_FAILED(rv)) {
       BT_WARNING("Failed to establish connection to BlueZ daemon");
-      RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(false);
+      RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(false);
       if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
         BT_WARNING("Failed to dispatch to main thread!");
       }
@@ -2202,7 +2202,7 @@ BluetoothDBusService::StartInternal(BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(!aRunnable);
 
-  RefPtr<nsRunnable> runnable = new StartBluetoothRunnable();
+  RefPtr<Runnable> runnable = new StartBluetoothRunnable();
   nsresult rv = DispatchToBtThread(runnable);
   if (NS_FAILED(rv)) {
     BT_WARNING("Failed to dispatch to BT thread!");
@@ -2210,7 +2210,7 @@ BluetoothDBusService::StartInternal(BluetoothReplyRunnable* aRunnable)
   return rv;
 }
 
-class DisableBluetoothRunnable final : public nsRunnable
+class DisableBluetoothRunnable final : public Runnable
 {
 public:
   NS_IMETHOD Run()
@@ -2230,7 +2230,7 @@ public:
     bool isEnabled = false;
 #endif
 
-    RefPtr<nsRunnable> runnable =
+    RefPtr<Runnable> runnable =
       new BluetoothService::ToggleBtAck(isEnabled);
     nsresult rv = NS_DispatchToMainThread(runnable);
     if (NS_FAILED(rv)) {
@@ -2252,7 +2252,7 @@ public:
 
     if (!sDBusConnection) {
       BT_WARNING("DBus connection has not been established.");
-      RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(false);
+      RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(false);
       if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
         BT_WARNING("Failed to dispatch to main thread!");
       }
@@ -2295,14 +2295,14 @@ public:
     // We can only dispatch to the BT thread if we're on the main
     // thread. Thus we dispatch our runnable to the main thread
     // from where it will forward itself to the BT thread.
-    RefPtr<nsRunnable> runnable = new DisableBluetoothRunnable();
+    RefPtr<Runnable> runnable = new DisableBluetoothRunnable();
     if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
       BT_WARNING("Failed to dispatch to BT thread!");
     }
   }
 };
 
-class StopBluetoothRunnable final : public nsRunnable
+class StopBluetoothRunnable final : public Runnable
 {
 public:
   NS_IMETHOD Run()
@@ -2326,7 +2326,7 @@ BluetoothDBusService::StopInternal(BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(!aRunnable);
 
-  RefPtr<nsRunnable> runnable = new StopBluetoothRunnable();
+  RefPtr<Runnable> runnable = new StopBluetoothRunnable();
   nsresult rv = DispatchToBtThread(runnable);
   if (NS_FAILED(rv)) {
     BT_WARNING("Failed to dispatch to BT thread!");
@@ -3514,7 +3514,7 @@ BluetoothDBusService::ToggleCalls(BluetoothReplyRunnable* aRunnable)
 }
 #endif // MOZ_B2G_RIL
 
-class OnUpdateSdpRecordsRunnable : public nsRunnable
+class OnUpdateSdpRecordsRunnable : public Runnable
 {
 public:
   OnUpdateSdpRecordsRunnable(const BluetoothAddress& aDeviceAddress,
@@ -3541,7 +3541,7 @@ private:
   BluetoothProfileManagerBase* mManager;
 };
 
-class OnGetServiceChannelRunnable : public nsRunnable
+class OnGetServiceChannelRunnable : public Runnable
 {
 public:
   OnGetServiceChannelRunnable(const BluetoothAddress& aDeviceAddress,
@@ -3603,7 +3603,7 @@ public:
       channel = dbus_returns_int32(aReply);
     }
 
-    RefPtr<nsRunnable> r =
+    RefPtr<Runnable> r =
       new OnGetServiceChannelRunnable(mDeviceAddress, mServiceUUID, channel,
                                       mBluetoothProfileManager);
     nsresult rv = NS_DispatchToMainThread(r);
@@ -3696,7 +3696,7 @@ BluetoothDBusService::GetServiceChannel(const BluetoothAddress& aDeviceAddress,
   // Even though we are on the main thread already, we need to dispatch a
   // runnable here. OnGetServiceChannel needs mRunnable to be set, which
   // happens after GetServiceChannel returns.
-  RefPtr<nsRunnable> r = new OnGetServiceChannelRunnable(aDeviceAddress,
+  RefPtr<Runnable> r = new OnGetServiceChannelRunnable(aDeviceAddress,
                                                          aServiceUUID,
                                                          1,
                                                          aManager);

dom/bluetooth/bluez/BluetoothHfpManager.cpp

@@ -1490,7 +1490,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
   }
   mCurrentCallArray[aCallIndex].mNumber = aNumber;
 
-  RefPtr<nsRunnable> sendRingTask;
+  RefPtr<Runnable> sendRingTask;
   nsString address;
 
   switch (aCallState) {

dom/bluetooth/bluez/BluetoothOppManager.cpp

@@ -97,7 +97,7 @@ BluetoothOppManager::Observe(nsISupports* aSubject,
   return NS_ERROR_UNEXPECTED;
 }
 
-class SendSocketDataTask : public nsRunnable
+class SendSocketDataTask : public Runnable
 {
 public:
   SendSocketDataTask(UniquePtr<uint8_t[]> aStream, uint32_t aSize)
@@ -121,7 +121,7 @@ private:
   uint32_t mSize;
 };
 
-class ReadFileTask : public nsRunnable
+class ReadFileTask : public Runnable
 {
 public:
   ReadFileTask(nsIInputStream* aInputStream,

dom/bluetooth/common/BluetoothReplyRunnable.h

@@ -25,7 +25,7 @@ BEGIN_BLUETOOTH_NAMESPACE
 
 class BluetoothReply;
 
-class BluetoothReplyRunnable : public nsRunnable
+class BluetoothReplyRunnable : public Runnable
 {
 public:
   NS_DECL_NSIRUNNABLE
@@ -96,7 +96,7 @@ protected:
   }
 };
 
-class BluetoothReplyTaskQueue : public nsRunnable
+class BluetoothReplyTaskQueue : public Runnable
 {
 public:
   NS_DECL_NSIRUNNABLE

dom/bluetooth/common/BluetoothService.cpp

@@ -434,7 +434,7 @@ BluetoothService::StartBluetooth(bool aIsStartup,
     }
   } else {
     BT_WARNING("Bluetooth has already been enabled before.");
-    RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(true);
+    RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(true);
     if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
       BT_WARNING("Failed to dispatch to main thread!");
     }
@@ -465,7 +465,7 @@ BluetoothService::StopBluetooth(bool aIsStartup,
     }
   } else {
     BT_WARNING("Bluetooth has already been enabled/disabled before.");
-    RefPtr<nsRunnable> runnable = new BluetoothService::ToggleBtAck(false);
+    RefPtr<Runnable> runnable = new BluetoothService::ToggleBtAck(false);
     if (NS_FAILED(NS_DispatchToMainThread(runnable))) {
       BT_WARNING("Failed to dispatch to main thread!");
     }

dom/bluetooth/common/BluetoothService.h

@@ -41,7 +41,7 @@ class BluetoothService : public nsIObserver
   friend class StartupTask;
 
 public:
-  class ToggleBtAck : public nsRunnable
+  class ToggleBtAck : public Runnable
   {
   public:
     ToggleBtAck(bool aEnabled);

dom/bluetooth/common/webapi/BluetoothGattServer.cpp

@@ -897,7 +897,7 @@ private:
   {
     mService->AssignAppUuid(mServer->mAppUuid);
 
-    RefPtr<nsRunnable> runnable = new AddServiceTaskQueue(mServer,
+    RefPtr<Runnable> runnable = new AddServiceTaskQueue(mServer,
                                                           mService,
                                                           mPromise);
     nsresult rv = NS_DispatchToMainThread(runnable.forget());

dom/camera/TestGonkCameraHardware.cpp

@@ -153,7 +153,7 @@ TestGonkCameraHardwareListener::HandleEvent(nsIDOMEvent* aEvent)
         OnTakePictureError(mTarget);
       } else if (errorType.EqualsLiteral("system")) {
         if (!NS_WARN_IF(!mCameraThread)) {
-          class DeferredSystemFailure : public nsRunnable
+          class DeferredSystemFailure : public Runnable
           {
           public:
             DeferredSystemFailure(nsGonkCameraControl* aTarget)
@@ -228,7 +228,7 @@ TestGonkCameraHardwareListener::HandleEvent(nsIDOMEvent* aEvent)
 
 NS_IMPL_ISUPPORTS(TestGonkCameraHardwareListener, nsIDOMEventListener)
 
-class TestGonkCameraHardware::ControlMessage : public nsRunnable
+class TestGonkCameraHardware::ControlMessage : public Runnable
 {
 public:
   ControlMessage(TestGonkCameraHardware* aTestHw)

dom/canvas/WebGLContextGL.cpp

@@ -746,6 +746,8 @@ WebGLContext::GetFramebufferAttachmentParameter(JSContext* cx,
         MOZ_CRASH("Bad target.");
     }
 
+    MakeContextCurrent();
+
     if (fb)
         return fb->GetAttachmentParameter(funcName, cx, target, attachment, pname, &rv);
 

dom/canvas/test/webgl-mochitest/test_fuzzing_bugs.html

@@ -53,9 +53,39 @@ function webGL2ClearBufferXXX_bug1252414() {
   ok(true, 'WebGL2 clearBufferXXX call during loseContext');
 }
 
+// Test gl function for multiple gl contexts switch.
+function getFramebufferAttachmentParameter_bug1267100()
+{
+  var canvas1 = document.createElement('canvas');
+  var canvas2 = document.createElement('canvas');
+
+  var gl1 = null;
+  gl1 = canvas1.getContext('webgl') || canvas1.getContext('experimental-webgl');
+  if (!gl1) {
+    todo(false, 'WebGL getFramebufferAttachmentParameter test, webgl is unavailable.');
+    return;
+  }
+  var gl2 = null;
+  gl2 = canvas2.getContext('webgl') || canvas2.getContext('experimental-webgl');
+  if (!gl2) {
+    todo(false, 'WebGL getFramebufferAttachmentParameter test, webgl is unavailable.');
+    return;
+  }
+
+  gl1.bindFramebuffer(gl1.FRAMEBUFFER, gl1.createFramebuffer());
+  gl2.scissor(0, 1, 2, 3);
+  // The gl call should still work even though we use another gl context before.
+  gl1.getFramebufferAttachmentParameter(gl1.FRAMEBUFFER,
+                                        gl1.COLOR_ATTACHMENT0,
+                                        gl1.FRAMEBUFFER_ATTACHMENT_OBJECT_NAME);
+
+  ok(true, 'WebGL test getFramebufferAttachmentParameter');
+}
+
 function run() {
   webGL2ClearBufferXXX_bug1252414();
   framebufferTexture2D_bug1257593();
+  getFramebufferAttachmentParameter_bug1267100();
 
   SimpleTest.finish();
 }

dom/datastore/DataStoreDB.cpp

@@ -105,9 +105,6 @@ DataStoreDB::CreateFactoryIfNeeded()
   if (!mFactory) {
     nsresult rv;
     nsCOMPtr<nsIPrincipal> principal = nsNullPrincipal::Create();
-    if (!principal) {
-      return NS_ERROR_FAILURE;
-    }
 
     nsIXPConnect* xpc = nsContentUtils::XPConnect();
     MOZ_ASSERT(xpc);

dom/events/DataTransfer.cpp

@@ -1032,7 +1032,8 @@ DataTransfer::GetTransferable(uint32_t aIndex, nsILoadContext* aLoadContext)
     kTextMime, kHTMLMime, kNativeHTMLMime, kRTFMime,
     kURLMime, kURLDataMime, kURLDescriptionMime, kURLPrivateMime,
     kPNGImageMime, kJPEGImageMime, kGIFImageMime, kNativeImageMime,
-    kFileMime, kFilePromiseMime, kFilePromiseDirectoryMime,
+    kFileMime, kFilePromiseMime, kFilePromiseURLMime,
+    kFilePromiseDestFilename, kFilePromiseDirectoryMime,
     kMozTextInternal, kHTMLContext, kHTMLInfo };
 
   /*

dom/fmradio/FMRadioService.h

@@ -20,7 +20,7 @@
 
 BEGIN_FMRADIO_NAMESPACE
 
-class FMRadioReplyRunnable : public nsRunnable
+class FMRadioReplyRunnable : public Runnable
 {
 public:
   FMRadioReplyRunnable() : mResponseType(SuccessResponse()) {}

dom/html/HTMLInputElement.cpp

@@ -537,10 +537,20 @@ HTMLInputElement::nsFilePickerShownCallback::Done(int16_t aResult)
   // event because it will think this is done by a script.
   // So, we can safely send one by ourself.
   mInput->SetFilesOrDirectories(newFilesOrDirectories, true);
-  return nsContentUtils::DispatchTrustedEvent(mInput->OwnerDoc(),
+
+  nsresult rv = NS_OK;
+  rv = nsContentUtils::DispatchTrustedEvent(mInput->OwnerDoc(),
+                                            static_cast<nsIDOMHTMLInputElement*>(mInput.get()),
+                                            NS_LITERAL_STRING("input"), true,
+                                            false);
+  NS_WARN_IF(NS_FAILED(rv));
+
+  rv = nsContentUtils::DispatchTrustedEvent(mInput->OwnerDoc(),
                                             static_cast<nsIDOMHTMLInputElement*>(mInput.get()),
                                             NS_LITERAL_STRING("change"), true,
                                             false);
+
+  return rv;
 }
 
 NS_IMPL_ISUPPORTS(HTMLInputElement::nsFilePickerShownCallback,
@@ -3849,6 +3859,12 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
         DoSetChecked(originalCheckedValue, true, true);
       }
     } else {
+      // Fire input event and then change event.
+      nsContentUtils::DispatchTrustedEvent(OwnerDoc(),
+                                           static_cast<nsIDOMHTMLInputElement*>(this),
+                                           NS_LITERAL_STRING("input"), true,
+                                           false);
+
       nsContentUtils::DispatchTrustedEvent(OwnerDoc(),
                                            static_cast<nsIDOMHTMLInputElement*>(this),
                                            NS_LITERAL_STRING("change"), true,

dom/html/test/forms/test_change_event.html

@@ -166,6 +166,15 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=722599
         is(NonTextInputChange[i], 1, NonTextInputTypes[i] + " input element should have dispatched change event.");
         input.blur();
         is(NonTextInputChange[i], 1, "Change event shouldn't be dispatched on " + NonTextInputTypes[i] + " input element");
+
+        // Test that change event is not dispatched if click event is cancelled.
+        function preventDefault(e) {
+          e.preventDefault();
+        }
+        input.addEventListener("click", preventDefault, false);
+        input.click();
+        is(NonTextInputChange[i], 1, "Change event shouldn't be dispatched if click event is cancelled");
+        input.removeEventListener("click", preventDefault, false);
       }
     }
 

dom/html/test/forms/test_input_event.html

@@ -65,7 +65,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=851780
     input.focus();
 
     input.addEventListener("input", function (aEvent) {
-      ok(false, "input event doesn't apply to type='file'");
+      ok(true, "input event should have been dispatched on file input.");
     }, false);
 
     input.click();
@@ -135,8 +135,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=851780
     textarea.blur();
     is(textareaInput, 3, "input event should not have been dispatched");
 
-    // Some dummy tests for types that do not support the input event.
+    // Non-text input tests:
     for (var i = 0; i < NonTextTypes.length; ++i) {
+      // Button, submit, image and reset input type tests.
+      if (i < 4) {
         input = document.getElementById("input_" + NonTextTypes[i]);
         input.focus();
         input.click();
@@ -144,6 +146,25 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=851780
         input.blur();
         is(NonTextInput[i], 0, "input event doesn't apply");
       }
+      // For radio and checkboxes, input event should be dispatched.
+      else {
+        input = document.getElementById("input_" + NonTextTypes[i]);
+        input.focus();
+        input.click();
+        is(NonTextInput[i], 1, "input event should have been dispatched");
+        input.blur();
+        is(NonTextInput[i], 1, "input event should not have been dispatched");
+
+        // Test that input event is not dispatched if click event is cancelled.
+        function preventDefault(e) {
+          e.preventDefault();
+        }
+        input.addEventListener("click", preventDefault, false);
+        input.click();
+        is(NonTextInput[i], 1, "input event shouldn't be dispatched if click event is cancelled");
+        input.removeEventListener("click", preventDefault, false);
+      }
+    }
 
     // Type changes.
     var input = document.createElement('input');

dom/ipc/ContentBridgeChild.cpp

@@ -27,14 +27,14 @@ ContentBridgeChild::ContentBridgeChild(Transport* aTransport)
 
 ContentBridgeChild::~ContentBridgeChild()
 {
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new DeleteTask<Transport>(mTransport));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(mTransport);
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 void
 ContentBridgeChild::ActorDestroy(ActorDestroyReason aWhy)
 {
   MessageLoop::current()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this, &ContentBridgeChild::DeferredDestroy));
 }
 

dom/ipc/ContentBridgeParent.cpp

@@ -26,7 +26,8 @@ ContentBridgeParent::ContentBridgeParent(Transport* aTransport)
 
 ContentBridgeParent::~ContentBridgeParent()
 {
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new DeleteTask<Transport>(mTransport));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(mTransport);
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 void
@@ -37,7 +38,6 @@ ContentBridgeParent::ActorDestroy(ActorDestroyReason aWhy)
     os->RemoveObserver(this, "content-child-shutdown");
   }
   MessageLoop::current()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this, &ContentBridgeParent::DeferredDestroy));
 }
 
@@ -169,7 +169,6 @@ ContentBridgeParent::NotifyTabDestroyed()
   int32_t numLiveTabs = ManagedPBrowserParent().Count();
   if (numLiveTabs == 1) {
     MessageLoop::current()->PostTask(
-      FROM_HERE,
       NewRunnableMethod(this, &ContentBridgeParent::Close));
   }
 }

dom/ipc/ContentChild.cpp

@@ -1518,7 +1518,7 @@ ContentChild::RecvBidiKeyboardNotify(const bool& aIsLangRTL)
   return true;
 }
 
-static CancelableTask* sFirstIdleTask;
+static CancelableRunnable* sFirstIdleTask;
 
 static void FirstIdle(void)
 {
@@ -1599,8 +1599,9 @@ ContentChild::RecvPBrowserConstructor(PBrowserChild* aActor,
       hasRunOnce = true;
 
     MOZ_ASSERT(!sFirstIdleTask);
-    sFirstIdleTask = NewRunnableFunction(FirstIdle);
-    MessageLoop::current()->PostIdleTask(FROM_HERE, sFirstIdleTask);
+    RefPtr<CancelableRunnable> firstIdleTask = NewRunnableFunction(FirstIdle);
+    sFirstIdleTask = firstIdleTask;
+    MessageLoop::current()->PostIdleTask(firstIdleTask.forget());
 
     // Redo InitProcessAttributes() when the app or browser is really
     // launching so the attributes will be correct.
@@ -1709,7 +1710,7 @@ ContentChild::RecvNotifyPresentationReceiverCleanUp(const nsString& aSessionId)
     do_GetService(PRESENTATION_SERVICE_CONTRACTID);
   NS_WARN_IF(!service);
 
-  NS_WARN_IF(NS_FAILED(service->UntrackSessionInfo(aSessionId)));
+  NS_WARN_IF(NS_FAILED(service->UntrackSessionInfo(aSessionId, nsIPresentationService::ROLE_RECEIVER)));
 
   return true;
 }
@@ -2626,8 +2627,7 @@ ContentChild::RecvAppInit()
 #ifdef MOZ_NUWA_PROCESS
   if (IsNuwaProcess()) {
     ContentChild::GetSingleton()->RecvGarbageCollect();
-    MessageLoop::current()->PostTask(
-      FROM_HERE, NewRunnableFunction(OnFinishNuwaPreparation));
+    MessageLoop::current()->PostTask(NewRunnableFunction(OnFinishNuwaPreparation));
   }
 #endif
 

dom/ipc/ContentParent.cpp

@@ -800,8 +800,7 @@ ContentParent::JoinAllSubprocesses()
 
   bool done = false;
   Monitor monitor("mozilla.dom.ContentParent.JoinAllSubprocesses");
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   NewRunnableFunction(
+  XRE_GetIOMessageLoop()->PostTask(NewRunnableFunction(
                                      &ContentParent::JoinProcessesIOThread,
                                      &processes, &monitor, &done));
   {
@@ -2180,7 +2179,6 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
   for(uint32_t i = 0; i < childIDArray.Length(); i++) {
     ContentParent* cp = cpm->GetContentProcessById(childIDArray[i]);
     MessageLoop::current()->PostTask(
-      FROM_HERE,
       NewRunnableMethod(cp, &ContentParent::ShutDownProcess,
                         SEND_SHUTDOWN_MESSAGE));
   }
@@ -2264,7 +2262,6 @@ ContentParent::NotifyTabDestroyed(const TabId& aTabId,
     // In the case of normal shutdown, send a shutdown message to child to
     // allow it to perform shutdown tasks.
     MessageLoop::current()->PostTask(
-      FROM_HERE,
       NewRunnableMethod(this, &ContentParent::ShutDownProcess,
                         SEND_SHUTDOWN_MESSAGE));
   }
@@ -3629,7 +3626,6 @@ ContentParent::KillHard(const char* aReason)
 
   // EnsureProcessTerminated has responsibilty for closing otherProcessHandle.
   XRE_GetIOMessageLoop()->PostTask(
-    FROM_HERE,
     NewRunnableFunction(&ProcessWatcher::EnsureProcessTerminated,
                         otherProcessHandle, /*force=*/true));
 }

dom/ipc/NuwaChild.cpp

@@ -35,7 +35,7 @@ namespace dom {
 
 namespace {
 
-class CallNuwaSpawn: public nsRunnable
+class CallNuwaSpawn: public Runnable
 {
 public:
   NS_IMETHOD Run()
@@ -185,7 +185,7 @@ GetProtoFdInfos(NuwaProtoFdInfo* aInfoList,
   *aInfoSize = i;
 }
 
-class RunAddNewIPCProcess : public nsRunnable
+class RunAddNewIPCProcess : public mozilla::Runnable
 {
 public:
   RunAddNewIPCProcess(pid_t aPid,

dom/ipc/PreallocatedProcessManager.cpp

@@ -205,7 +205,6 @@ PreallocatedProcessManagerImpl::AllocateAfterDelay()
   }
 
   MessageLoop::current()->PostDelayedTask(
-    FROM_HERE,
     NewRunnableMethod(this, &PreallocatedProcessManagerImpl::AllocateOnIdle),
     Preferences::GetUint("dom.ipc.processPrelaunch.delayMs",
                          DEFAULT_ALLOCATE_DELAY));
@@ -219,7 +218,6 @@ PreallocatedProcessManagerImpl::AllocateOnIdle()
   }
 
   MessageLoop::current()->PostIdleTask(
-    FROM_HERE,
     NewRunnableMethod(this, &PreallocatedProcessManagerImpl::AllocateNow));
 }
 
@@ -245,10 +243,10 @@ PreallocatedProcessManagerImpl::ScheduleDelayedNuwaFork()
     return;
   }
 
-  mPreallocateAppProcessTask = NewRunnableMethod(
+  RefPtr<CancelableTask> task = NewRunnableMethod(
     this, &PreallocatedProcessManagerImpl::DelayedNuwaFork);
-  MessageLoop::current()->PostDelayedTask(
-    FROM_HERE, mPreallocateAppProcessTask,
+  mPreallocateAppProcessTask = task;
+  MessageLoop::current()->PostDelayedTask(task.forget(),
     Preferences::GetUint("dom.ipc.processPrelaunch.delayMs",
                          DEFAULT_ALLOCATE_DELAY));
 }

dom/ipc/ProcessHangMonitor.cpp

@@ -265,7 +265,8 @@ HangMonitorChild::~HangMonitorChild()
 {
   // For some reason IPDL doesn't automatically delete the channel for a
   // bridged protocol (bug 1090570). So we have to do it ourselves.
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 
   MOZ_RELEASE_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(sInstance == this);
@@ -303,7 +304,6 @@ HangMonitorChild::ActorDestroy(ActorDestroyReason aWhy)
   // We use a task here to ensure that IPDL is finished with this
   // HangMonitorChild before it gets deleted on the main thread.
   MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this, &HangMonitorChild::ShutdownOnThread));
 }
 
@@ -391,7 +391,6 @@ HangMonitorChild::NotifySlowScript(nsITabChild* aTabChild,
   nsAutoCString filename(aFileName);
 
   MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this, &HangMonitorChild::NotifySlowScriptAsync,
                       id, filename, aLineNo));
   return SlowScriptAction::Continue;
@@ -422,7 +421,6 @@ HangMonitorChild::NotifyPluginHang(uint32_t aPluginId)
 
   // bounce to background thread
   MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this,
                       &HangMonitorChild::NotifyPluginHangAsync,
                       aPluginId));
@@ -448,7 +446,6 @@ HangMonitorChild::ClearHang()
   if (mSentReport) {
     // bounce to background thread
     MonitorLoop()->PostTask(
-      FROM_HERE,
       NewRunnableMethod(this, &HangMonitorChild::ClearHangAsync));
 
     MonitorAutoLock lock(mMonitor);
@@ -487,7 +484,8 @@ HangMonitorParent::~HangMonitorParent()
 {
   // For some reason IPDL doesn't automatically delete the channel for a
   // bridged protocol (bug 1090570). So we have to do it ourselves.
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 
 #ifdef MOZ_CRASHREPORTER
   MutexAutoLock lock(mBrowserCrashDumpHashLock);
@@ -514,7 +512,6 @@ HangMonitorParent::Shutdown()
   }
 
   MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(this, &HangMonitorParent::ShutdownOnThread));
 
   while (!mShutdownDone) {
@@ -836,7 +833,6 @@ HangMonitoredProcess::TerminateScript()
   }
 
   ProcessHangMonitor::Get()->MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(mActor, &HangMonitorParent::TerminateScript));
   return NS_OK;
 }
@@ -854,7 +850,6 @@ HangMonitoredProcess::BeginStartingDebugger()
   }
 
   ProcessHangMonitor::Get()->MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(mActor, &HangMonitorParent::BeginStartingDebugger));
   return NS_OK;
 }
@@ -872,7 +867,6 @@ HangMonitoredProcess::EndStartingDebugger()
   }
 
   ProcessHangMonitor::Get()->MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(mActor, &HangMonitorParent::EndStartingDebugger));
   return NS_OK;
 }
@@ -1052,7 +1046,6 @@ mozilla::CreateHangMonitorParent(ContentParent* aContentParent,
   parent->SetProcess(process);
 
   monitor->MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(parent, &HangMonitorParent::Open,
                       aTransport, aOtherPid, XRE_GetIOMessageLoop()));
 
@@ -1069,7 +1062,6 @@ mozilla::CreateHangMonitorChild(mozilla::ipc::Transport* aTransport,
   HangMonitorChild* child = new HangMonitorChild(monitor);
 
   monitor->MonitorLoop()->PostTask(
-    FROM_HERE,
     NewRunnableMethod(child, &HangMonitorChild::Open,
                       aTransport, aOtherPid, XRE_GetIOMessageLoop()));
 

dom/json/nsJSON.cpp

@@ -412,7 +412,6 @@ nsJSON::DecodeInternal(JSContext* cx,
 
   nsresult rv;
   nsCOMPtr<nsIPrincipal> nullPrincipal = nsNullPrincipal::Create();
-  NS_ENSURE_TRUE(nullPrincipal, NS_ERROR_FAILURE);
 
   // The ::Decode function is deprecated [Bug 675797] and the following
   // channel is never openend, so it does not matter what securityFlags

dom/jsurl/nsJSProtocolHandler.cpp

@@ -418,7 +418,6 @@ nsresult nsJSChannel::Init(nsIURI *aURI)
     nsCOMPtr<nsIChannel> channel;
 
     nsCOMPtr<nsIPrincipal> nullPrincipal = nsNullPrincipal::Create();
-    NS_ENSURE_TRUE(nullPrincipal, NS_ERROR_FAILURE);
 
     // If the resultant script evaluation actually does return a value, we
     // treat it as html.

dom/locales/en-US/chrome/dom/dom.properties

@@ -57,7 +57,6 @@ SetAttributeNodeNSWarning=Use of setAttributeNodeNS() is deprecated. Use setAttr
 RemoveAttributeNodeWarning=Use of removeAttributeNode() is deprecated. Use removeAttribute() instead.
 CreateAttributeWarning=Use of document.createAttribute() is deprecated. Use element.setAttribute() instead.
 CreateAttributeNSWarning=Use of document.createAttributeNS() is deprecated. Use element.setAttributeNS() instead.
-OwnerElementWarning=Use of attributes' ownerElement attribute is deprecated.
 NodeValueWarning=Use of attributes' nodeValue attribute is deprecated. Use value instead.
 TextContentWarning=Use of attributes' textContent attribute is deprecated. Use value instead.
 EnablePrivilegeWarning=Use of enablePrivilege is deprecated.  Please use code that runs with the system principal (e.g. an extension) instead.

dom/media/DecoderDoctorDiagnostics.cpp

@@ -9,9 +9,11 @@
 #include "mozilla/dom/DecoderDoctorNotificationBinding.h"
 #include "mozilla/Logging.h"
 #include "mozilla/Preferences.h"
+#include "nsContentUtils.h"
 #include "nsGkAtoms.h"
 #include "nsIDocument.h"
 #include "nsIObserverService.h"
+#include "nsIScriptError.h"
 #include "nsITimer.h"
 #include "nsIWeakReference.h"
 #include "nsPluginHost.h"

dom/media/MediaDecoderStateMachine.cpp

@@ -258,8 +258,6 @@ MediaDecoderStateMachine::MediaDecoderStateMachine(MediaDecoder* aDecoder,
              "MediaDecoderStateMachine::mPlayState (Mirror)"),
   mNextPlayState(mTaskQueue, MediaDecoder::PLAY_STATE_PAUSED,
                  "MediaDecoderStateMachine::mNextPlayState (Mirror)"),
-  mLogicallySeeking(mTaskQueue, false,
-                    "MediaDecoderStateMachine::mLogicallySeeking (Mirror)"),
   mVolume(mTaskQueue, 1.0, "MediaDecoderStateMachine::mVolume (Mirror)"),
   mLogicalPlaybackRate(mTaskQueue, 1.0,
                        "MediaDecoderStateMachine::mLogicalPlaybackRate (Mirror)"),
@@ -331,7 +329,6 @@ MediaDecoderStateMachine::InitializationTask(MediaDecoder* aDecoder)
   mExplicitDuration.Connect(aDecoder->CanonicalExplicitDuration());
   mPlayState.Connect(aDecoder->CanonicalPlayState());
   mNextPlayState.Connect(aDecoder->CanonicalNextPlayState());
-  mLogicallySeeking.Connect(aDecoder->CanonicalLogicallySeeking());
   mVolume.Connect(aDecoder->CanonicalVolume());
   mLogicalPlaybackRate.Connect(aDecoder->CanonicalPlaybackRate());
   mPreservesPitch.Connect(aDecoder->CanonicalPreservesPitch());
@@ -355,7 +352,6 @@ MediaDecoderStateMachine::InitializationTask(MediaDecoder* aDecoder)
   mWatchManager.Watch(mExplicitDuration, &MediaDecoderStateMachine::RecomputeDuration);
   mWatchManager.Watch(mObservedDuration, &MediaDecoderStateMachine::RecomputeDuration);
   mWatchManager.Watch(mPlayState, &MediaDecoderStateMachine::PlayStateChanged);
-  mWatchManager.Watch(mLogicallySeeking, &MediaDecoderStateMachine::LogicallySeekingChanged);
 }
 
 media::MediaSink*
@@ -1309,12 +1305,6 @@ void MediaDecoderStateMachine::PlayStateChanged()
   ScheduleStateMachine();
 }
 
-void MediaDecoderStateMachine::LogicallySeekingChanged()
-{
-  MOZ_ASSERT(OnTaskQueue());
-  ScheduleStateMachine();
-}
-
 void MediaDecoderStateMachine::BufferedRangeUpdated()
 {
   MOZ_ASSERT(OnTaskQueue());
@@ -2074,7 +2064,6 @@ MediaDecoderStateMachine::FinishShutdown()
   mExplicitDuration.DisconnectIfConnected();
   mPlayState.DisconnectIfConnected();
   mNextPlayState.DisconnectIfConnected();
-  mLogicallySeeking.DisconnectIfConnected();
   mVolume.DisconnectIfConnected();
   mLogicalPlaybackRate.DisconnectIfConnected();
   mPreservesPitch.DisconnectIfConnected();
@@ -2138,7 +2127,6 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
 
       UpdatePlaybackPositionPeriodically();
       NS_ASSERTION(!IsPlaying() ||
-                   mLogicallySeeking ||
                    IsStateMachineScheduled(),
                    "Must have timer scheduled");
       return NS_OK;
@@ -2204,7 +2192,6 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
         MaybeStartPlayback();
         UpdatePlaybackPositionPeriodically();
         NS_ASSERTION(!IsPlaying() ||
-                     mLogicallySeeking ||
                      IsStateMachineScheduled(),
                      "Must have timer scheduled");
         return NS_OK;
@@ -2291,7 +2278,7 @@ MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically()
 {
   MOZ_ASSERT(OnTaskQueue());
 
-  if (!IsPlaying() || mLogicallySeeking) {
+  if (!IsPlaying()) {
     return;
   }
 

dom/media/MediaDecoderStateMachine.h

@@ -467,9 +467,6 @@ protected:
   // Notification method invoked when mPlayState changes.
   void PlayStateChanged();
 
-  // Notification method invoked when mLogicallySeeking changes.
-  void LogicallySeekingChanged();
-
   // Sets internal state which causes playback of media to pause.
   // The decoder monitor must be held.
   void StopPlayback();
@@ -980,7 +977,6 @@ private:
   // The current play state and next play state, mirrored from the main thread.
   Mirror<MediaDecoder::PlayState> mPlayState;
   Mirror<MediaDecoder::PlayState> mNextPlayState;
-  Mirror<bool> mLogicallySeeking;
 
   // Volume of playback. 0.0 = muted. 1.0 = full volume.
   Mirror<double> mVolume;

dom/media/MediaFormatReader.cpp

@@ -303,14 +303,21 @@ MediaFormatReader::OnDemuxerInitDone(nsresult)
       mMetadataPromise.Reject(ReadMetadataFailureReason::METADATA_ERROR, __func__);
       return;
     }
-    mInfo.mAudio = *mAudio.mTrackDemuxer->GetInfo()->GetAsAudioInfo();
-    UniquePtr<TrackInfo> info(mAudio.mTrackDemuxer->GetInfo());
-    for (const MetadataTag& tag : info->mTags) {
+    UniquePtr<TrackInfo> audioInfo = mAudio.mTrackDemuxer->GetInfo();
+    // We actively ignore audio tracks that we know we can't play.
+    audioActive = audioInfo && audioInfo->IsValid();
+    if (audioActive) {
+      mInfo.mAudio = *audioInfo->GetAsAudioInfo();
+      for (const MetadataTag& tag : audioInfo->mTags) {
         tags->Put(tag.mKey, tag.mValue);
       }
       mAudio.mCallback = new DecoderCallback(this, TrackInfo::kAudioTrack);
       mAudio.mTimeRanges = mAudio.mTrackDemuxer->GetBuffered();
       mTrackDemuxersMayBlock |= mAudio.mTrackDemuxer->GetSamplesMayBlock();
+    } else {
+      mAudio.mTrackDemuxer->BreakCycles();
+      mAudio.mTrackDemuxer = nullptr;
+    }
   }
 
   UniquePtr<EncryptionInfo> crypto = mDemuxer->GetCrypto();

dom/media/MediaInfo.h

@@ -34,6 +34,9 @@ public:
   nsCString mValue;
 };
 
+  // Maximum channel number we can currently handle (7.1)
+#define MAX_AUDIO_CHANNELS 8
+
 class TrackInfo {
 public:
   enum TrackType {
@@ -304,7 +307,7 @@ public:
 
   bool IsValid() const override
   {
-    return mChannels > 0 && mRate > 0;
+    return mChannels > 0 && mChannels <= MAX_AUDIO_CHANNELS && mRate > 0;
   }
 
   AudioInfo* GetAsAudioInfo() override
@@ -516,9 +519,6 @@ public:
   const nsCString& mMimeType;
 };
 
-// Maximum channel number we can currently handle (7.1)
-#define MAX_AUDIO_CHANNELS 8
-
 class AudioConfig {
 public:
   enum Channel {
@@ -658,6 +658,11 @@ public:
     return !(*this == aOther);
   }
 
+  bool IsValid() const
+  {
+    return mChannelLayout.IsValid() && Format() != FORMAT_NONE && Rate() > 0;
+  }
+
   static const char* FormatToString(SampleFormat aFormat);
   static uint32_t SampleSize(SampleFormat aFormat);
   static uint32_t FormatToBits(SampleFormat aFormat);

dom/media/MediaManager.cpp

@@ -246,7 +246,7 @@ HostHasPermission(nsIURI &docURI)
 // Generic class for running long media operations like Start off the main
 // thread, and then (because nsDOMMediaStreams aren't threadsafe),
 // ProxyReleases mStream since it's cycle collected.
-class MediaOperationTask : public Task
+class MediaOperationTask : public Runnable
 {
 public:
   // so we can send Stop without AddRef()ing from the MSG thread
@@ -280,14 +280,14 @@ public:
   void
   ReturnCallbackError(nsresult rv, const char* errorLog);
 
-  void
-  Run()
+  NS_IMETHOD
+  Run() override
   {
     SourceMediaStream *source = mListener->GetSourceStream();
     // No locking between these is required as all the callbacks for the
     // same MediaStream will occur on the same thread.
     if (!source) // means the stream was never Activated()
-      return;
+      return NS_OK;
 
     switch (mType) {
       case MEDIA_START:
@@ -300,7 +300,7 @@ public:
                                                   mListener->GetPrincipalHandle());
             if (NS_FAILED(rv)) {
               ReturnCallbackError(rv, "Starting audio failed");
-              return;
+              return NS_OK;
             }
           }
           if (mVideoDevice) {
@@ -308,7 +308,7 @@ public:
                                                   mListener->GetPrincipalHandle());
             if (NS_FAILED(rv)) {
               ReturnCallbackError(rv, "Starting video failed");
-              return;
+              return NS_OK;
             }
           }
           // Start() queued the tracks to be added synchronously to avoid races
@@ -377,6 +377,8 @@ public:
         MOZ_ASSERT(false,"invalid MediaManager operation");
         break;
     }
+
+    return NS_OK;
   }
 
 private:
@@ -910,7 +912,7 @@ public:
 
       nsCOMPtr<nsIPrincipal> principal;
       if (mPeerIdentity) {
-        principal = nsNullPrincipal::Create();
+        principal = nsNullPrincipal::CreateWithInheritedAttributes(window->GetExtantDoc()->NodePrincipal());
       } else {
         principal = window->GetExtantDoc()->NodePrincipal();
       }
@@ -974,11 +976,12 @@ public:
     // because that can take a while.
     // Pass ownership of domStream to the MediaOperationTask
     // to ensure it's kept alive until the MediaOperationTask runs (at least).
-    MediaManager::PostTask(FROM_HERE,
+    RefPtr<Runnable> mediaOperation =
         new MediaOperationTask(MEDIA_START, mListener, domStream,
                                tracksAvailableCallback,
                                mAudioDevice, mVideoDevice,
-                               false, mWindowID, mOnFailure.forget()));
+                               false, mWindowID, mOnFailure.forget());
+    MediaManager::PostTask(mediaOperation.forget());
     // We won't need mOnFailure now.
     mOnFailure = nullptr;
 
@@ -1068,8 +1071,7 @@ MediaManager::SelectSettings(
   // Algorithm accesses device capabilities code and must run on media thread.
   // Modifies passed-in aSources.
 
-  MediaManager::PostTask(FROM_HERE, NewTaskFrom([id, aConstraints,
-                                                 aSources]() mutable {
+  MediaManager::PostTask(NewTaskFrom([id, aConstraints, aSources]() mutable {
     auto& sources = **aSources;
 
     // Since the advanced part of the constraints algorithm needs to know when
@@ -1105,14 +1107,14 @@ MediaManager::SelectSettings(
         sources.AppendElement(audio);
       }
     }
-    NS_DispatchToMainThread(do_AddRef(NewRunnableFrom([id, badConstraint]() mutable {
+    NS_DispatchToMainThread(NewRunnableFrom([id, badConstraint]() mutable {
       RefPtr<MediaManager> mgr = MediaManager_GetInstance();
       RefPtr<PledgeChar> p = mgr->mOutstandingCharPledges.Remove(id);
       if (p) {
         p->Resolve(badConstraint);
       }
       return NS_OK;
-    })));
+    }));
   }));
   return p.forget();
 }
@@ -1125,7 +1127,7 @@ MediaManager::SelectSettings(
  * Do not run this on the main thread. The success and error callbacks *MUST*
  * be dispatched on the main thread!
  */
-class GetUserMediaTask : public Task
+class GetUserMediaTask : public Runnable
 {
 public:
   GetUserMediaTask(
@@ -1168,8 +1170,8 @@ public:
     NS_DispatchToMainThread(do_AddRef(new GetUserMediaListenerRemove(mWindowID, mListener)));
   }
 
-  void
-  Run()
+  NS_IMETHOD
+  Run() override
   {
     MOZ_ASSERT(!NS_IsMainThread());
     MOZ_ASSERT(mOnSuccess);
@@ -1188,7 +1190,7 @@ public:
         LOG(("Failed to allocate audiosource %d",rv));
         Fail(NS_LITERAL_STRING("SourceUnavailableError"),
              NS_LITERAL_STRING("Failed to allocate audiosource"));
-        return;
+        return NS_OK;
       }
     }
     if (mVideoDevice) {
@@ -1201,7 +1203,7 @@ public:
         }
         Fail(NS_LITERAL_STRING("SourceUnavailableError"),
              NS_LITERAL_STRING("Failed to allocate videosource"));
-        return;
+        return NS_OK;
       }
     }
     PeerIdentity* peerIdentity = nullptr;
@@ -1215,6 +1217,7 @@ public:
                                        mVideoDevice, peerIdentity)));
     MOZ_ASSERT(!mOnSuccess);
     MOZ_ASSERT(!mOnFailure);
+    return NS_OK;
   }
 
   nsresult
@@ -1306,7 +1309,7 @@ public:
   ~GetUserMediaRunnableWrapper() {
   }
 
-  NS_IMETHOD Run() {
+  NS_IMETHOD Run() override {
     mTask->Run();
     return NS_OK;
   }
@@ -1351,7 +1354,7 @@ MediaManager::EnumerateRawDevices(uint64_t aWindowId,
     aFakeTracks = false;
   }
 
-  MediaManager::PostTask(FROM_HERE, NewTaskFrom([id, aWindowId, audioLoopDev,
+  MediaManager::PostTask(NewTaskFrom([id, aWindowId, audioLoopDev,
                                       videoLoopDev, aVideoType,
                                       aAudioType, aFake,
                                       aFakeTracks]() mutable {
@@ -1389,7 +1392,7 @@ MediaManager::EnumerateRawDevices(uint64_t aWindowId,
       }
     }
     SourceSet* handoff = result.release();
-    NS_DispatchToMainThread(do_AddRef(NewRunnableFrom([id, handoff]() mutable {
+    NS_DispatchToMainThread(NewRunnableFrom([id, handoff]() mutable {
       UniquePtr<SourceSet> result(handoff); // grab result
       RefPtr<MediaManager> mgr = MediaManager_GetInstance();
       if (!mgr) {
@@ -1400,7 +1403,7 @@ MediaManager::EnumerateRawDevices(uint64_t aWindowId,
         p->Resolve(result.release());
       }
       return NS_OK;
-    })));
+    }));
   }));
   return p.forget();
 }
@@ -1598,16 +1601,19 @@ MediaManager::StartupInit()
 
 /* static */
 void
-MediaManager::PostTask(const tracked_objects::Location& from_here, Task* task)
+MediaManager::PostTask(already_AddRefed<Runnable> task)
 {
   if (sInShutdown) {
     // Can't safely delete task here since it may have items with specific
     // thread-release requirements.
+    // XXXkhuey well then who is supposed to delete it?! We don't signal
+    // that we failed ...
+    MOZ_CRASH();
     return;
   }
   NS_ASSERTION(Get(), "MediaManager singleton?");
   NS_ASSERTION(Get()->mMediaThread, "No thread yet");
-  Get()->mMediaThread->message_loop()->PostTask(from_here, task);
+  Get()->mMediaThread->message_loop()->PostTask(Move(task));
 }
 
 /* static */ nsresult
@@ -2123,7 +2129,7 @@ MediaManager::GetUserMedia(nsPIDOMWindowInner* aWindow,
       }
 
       // Pass callbacks and MediaStreamListener along to GetUserMediaTask.
-      nsAutoPtr<GetUserMediaTask> task (new GetUserMediaTask(c, onSuccess.forget(),
+      RefPtr<GetUserMediaTask> task (new GetUserMediaTask(c, onSuccess.forget(),
                                                           onFailure.forget(),
                                                           windowID, listener,
                                                           prefs, origin,
@@ -2375,9 +2381,9 @@ MediaManager::GetUserMediaDevices(nsPIDOMWindowInner* aWindow,
   }
 
   for (auto& callID : *callIDs) {
-    GetUserMediaTask* task;
+    RefPtr<GetUserMediaTask> task;
     if (!aCallID.Length() || aCallID == callID) {
-      if (mActiveCallbacks.Get(callID, &task)) {
+      if (mActiveCallbacks.Get(callID, getter_AddRefs(task))) {
         nsCOMPtr<nsIWritableVariant> array = MediaManager_ToJSArray(*task->mSourceSet);
         onSuccess->OnSuccess(array);
         return NS_OK;
@@ -2616,15 +2622,15 @@ MediaManager::Shutdown()
   // Because mMediaThread is not an nsThread, we must dispatch to it so it can
   // clean up BackgroundChild. Continue stopping thread once this is done.
 
-  class ShutdownTask : public Task
+  class ShutdownTask : public Runnable
   {
   public:
     ShutdownTask(MediaManager* aManager,
-                 Runnable* aReply)
+                 already_AddRefed<Runnable> aReply)
       : mManager(aManager)
       , mReply(aReply) {}
   private:
-    void
+    NS_IMETHOD
     Run() override
     {
       LOG(("MediaManager Thread Shutdown"));
@@ -2642,6 +2648,8 @@ MediaManager::Shutdown()
       if (NS_FAILED(NS_DispatchToMainThread(mReply.forget()))) {
         LOG(("Will leak thread: DispatchToMainthread of reply runnable failed in MediaManager shutdown"));
       }
+
+      return NS_OK;
     }
     RefPtr<MediaManager> mManager;
     RefPtr<Runnable> mReply;
@@ -2658,7 +2666,7 @@ MediaManager::Shutdown()
   RefPtr<MediaManager> that(sSingleton);
   // Release the backend (and call Shutdown()) from within the MediaManager thread
   // Don't use MediaManager::PostTask() because we're sInShutdown=true here!
-  mMediaThread->message_loop()->PostTask(FROM_HERE, new ShutdownTask(this,
+  RefPtr<ShutdownTask> shutdown = new ShutdownTask(this,
       media::NewRunnableFrom([this, that]() mutable {
     LOG(("MediaManager shutdown lambda running, releasing MediaManager singleton and thread"));
     if (mMediaThread) {
@@ -2674,7 +2682,8 @@ MediaManager::Shutdown()
     sSingleton = nullptr;
 
     return NS_OK;
-  })));
+  }));
+  mMediaThread->message_loop()->PostTask(shutdown.forget());
 }
 
 nsresult
@@ -2697,8 +2706,8 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
   } else if (!strcmp(aTopic, "getUserMedia:privileged:allow") ||
              !strcmp(aTopic, "getUserMedia:response:allow")) {
     nsString key(aData);
-    nsAutoPtr<GetUserMediaTask> task;
-    mActiveCallbacks.RemoveAndForget(key, task);
+    RefPtr<GetUserMediaTask> task;
+    mActiveCallbacks.Remove(key, getter_AddRefs(task));
     if (!task) {
       return NS_OK;
     }
@@ -2745,7 +2754,7 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
       return task->Denied(NS_LITERAL_STRING("In shutdown"));
     }
     // Reuse the same thread to save memory.
-    MediaManager::PostTask(FROM_HERE, task.forget());
+    MediaManager::PostTask(task.forget());
     return NS_OK;
 
   } else if (!strcmp(aTopic, "getUserMedia:response:deny")) {
@@ -2760,8 +2769,8 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
     }
 
     nsString key(aData);
-    nsAutoPtr<GetUserMediaTask> task;
-    mActiveCallbacks.RemoveAndForget(key, task);
+    RefPtr<GetUserMediaTask> task;
+    mActiveCallbacks.Remove(key, getter_AddRefs(task));
     if (task) {
       task->Denied(errorMessage);
     }
@@ -3081,12 +3090,13 @@ GetUserMediaCallbackMediaStreamListener::Stop()
   // thread.
   // Pass a ref to us (which is threadsafe) so it can query us for the
   // source stream info.
-  MediaManager::PostTask(FROM_HERE,
+  RefPtr<MediaOperationTask> mediaOperation =
     new MediaOperationTask(MEDIA_STOP,
                            this, nullptr, nullptr,
                            !mAudioStopped ? mAudioDevice.get() : nullptr,
                            !mVideoStopped ? mVideoDevice.get() : nullptr,
-                           false, mWindowID, nullptr));
+                           false, mWindowID, nullptr);
+  MediaManager::PostTask(mediaOperation.forget());
   mStopped = mAudioStopped = mVideoStopped = true;
 }
 
@@ -3146,7 +3156,7 @@ GetUserMediaCallbackMediaStreamListener::ApplyConstraintsToTrack(
   uint32_t id = mgr->mOutstandingVoidPledges.Append(*p);
   uint64_t windowId = aWindow->WindowID();
 
-  MediaManager::PostTask(FROM_HERE, NewTaskFrom([id, windowId,
+  MediaManager::PostTask(NewTaskFrom([id, windowId,
                                       audioDevice, videoDevice,
                                       aConstraints]() mutable {
     MOZ_ASSERT(MediaManager::IsInMediaThread());
@@ -3171,7 +3181,7 @@ GetUserMediaCallbackMediaStreamListener::ApplyConstraintsToTrack(
                                                                videos);
       }
     }
-    NS_DispatchToMainThread(do_AddRef(NewRunnableFrom([id, windowId, rv,
+    NS_DispatchToMainThread(NewRunnableFrom([id, windowId, rv,
                                              badConstraint]() mutable {
       MOZ_ASSERT(NS_IsMainThread());
       RefPtr<MediaManager> mgr = MediaManager_GetInstance();
@@ -3204,7 +3214,7 @@ GetUserMediaCallbackMediaStreamListener::ApplyConstraintsToTrack(
         }
       }
       return NS_OK;
-    })));
+    }));
   }));
   return p.forget();
 }
@@ -3241,12 +3251,13 @@ GetUserMediaCallbackMediaStreamListener::StopTrack(TrackID aTrackID)
     return;
   }
 
-  MediaManager::PostTask(FROM_HERE,
+  RefPtr<MediaOperationTask> mediaOperation =
     new MediaOperationTask(MEDIA_STOP_TRACK,
                            this, nullptr, nullptr,
                            stopAudio ? mAudioDevice.get() : nullptr,
                            stopVideo ? mVideoDevice.get() : nullptr,
-                           false , mWindowID, nullptr));
+                           false , mWindowID, nullptr);
+  MediaManager::PostTask(mediaOperation.forget());
   mAudioStopped |= stopAudio;
   mVideoStopped |= stopVideo;
 }
@@ -3271,11 +3282,12 @@ void
 GetUserMediaCallbackMediaStreamListener::NotifyDirectListeners(MediaStreamGraph* aGraph,
                                                                bool aHasListeners)
 {
-  MediaManager::PostTask(FROM_HERE,
+  RefPtr<MediaOperationTask> mediaOperation =
     new MediaOperationTask(MEDIA_DIRECT_LISTENERS,
                            this, nullptr, nullptr,
                            mAudioDevice, mVideoDevice,
-                           aHasListeners, mWindowID, nullptr));
+                           aHasListeners, mWindowID, nullptr);
+  MediaManager::PostTask(mediaOperation.forget());
 }
 
 // this can be in response to our own RemoveListener() (via ::Remove()), or

dom/media/MediaManager.h

@@ -424,7 +424,7 @@ public:
   static MediaManager* Get();
   static MediaManager* GetIfExists();
   static void StartupInit();
-  static void PostTask(const tracked_objects::Location& from_here, Task* task);
+  static void PostTask(already_AddRefed<Runnable> task);
 #ifdef DEBUG
   static bool IsInMediaThread();
 #endif
@@ -536,7 +536,7 @@ private:
 
   // ONLY access from MainThread so we don't need to lock
   WindowTable mActiveWindows;
-  nsClassHashtable<nsStringHashKey, GetUserMediaTask> mActiveCallbacks;
+  nsRefPtrHashtable<nsStringHashKey, GetUserMediaTask> mActiveCallbacks;
   nsClassHashtable<nsUint64HashKey, nsTArray<nsString>> mCallIds;
 
   // Always exists

dom/media/gmp/GMPChild.cpp

@@ -625,8 +625,9 @@ GMPChild::GMPContentChildActorDestroy(GMPContentChild* aGMPContentChild)
     UniquePtr<GMPContentChild>& toDestroy = mGMPContentChildren[i - 1];
     if (toDestroy.get() == aGMPContentChild) {
       SendPGMPContentChildDestroyed();
-      MessageLoop::current()->PostTask(FROM_HERE,
-                                       new DeleteTask<GMPContentChild>(toDestroy.release()));
+      RefPtr<DeleteTask<GMPContentChild>> task =
+        new DeleteTask<GMPContentChild>(toDestroy.release());
+      MessageLoop::current()->PostTask(task.forget());
       mGMPContentChildren.RemoveElementAt(i - 1);
       break;
     }

dom/media/gmp/GMPContentChild.cpp

@@ -22,8 +22,8 @@ GMPContentChild::GMPContentChild(GMPChild* aChild)
 GMPContentChild::~GMPContentChild()
 {
   MOZ_COUNT_DTOR(GMPContentChild);
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 MessageLoop*

dom/media/gmp/GMPContentParent.cpp

@@ -43,8 +43,8 @@ GMPContentParent::GMPContentParent(GMPParent* aParent)
 
 GMPContentParent::~GMPContentParent()
 {
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 class ReleaseGMPContentParent : public Runnable

dom/media/gmp/GMPDecryptorChild.cpp

@@ -61,8 +61,8 @@ GMPDecryptorChild::CallOnGMPThread(MethodType aMethod, ParamType&&... aParams)
     // Use const reference when we have to.
     auto m = &GMPDecryptorChild::CallMethod<
         decltype(aMethod), typename AddConstReference<ParamType>::Type...>;
-    auto t = NewRunnableMethod(this, m, aMethod, Forward<ParamType>(aParams)...);
-    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
+    RefPtr<mozilla::Runnable> t = NewRunnableMethod(this, m, aMethod, Forward<ParamType>(aParams)...);
+    mPlugin->GMPMessageLoop()->PostTask(t.forget());
   }
 }
 
@@ -170,8 +170,8 @@ GMPDecryptorChild::Decrypted(GMPBuffer* aBuffer, GMPErr aResult)
   if (!ON_GMP_THREAD()) {
     // We should run this whole method on the GMP thread since the buffer needs
     // to be deleted after the SendDecrypted call.
-    auto t = NewRunnableMethod(this, &GMPDecryptorChild::Decrypted, aBuffer, aResult);
-    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
+    RefPtr<Runnable> t = NewRunnableMethod(this, &GMPDecryptorChild::Decrypted, aBuffer, aResult);
+    mPlugin->GMPMessageLoop()->PostTask(t.forget());
     return;
   }
 

dom/media/gmp/GMPPlatform.cpp

@@ -73,7 +73,7 @@ public:
     //    main thread tries to do a sync call back to the calling thread.
     MOZ_ASSERT(!IsOnChildMainThread());
 
-    mMessageLoop->PostTask(FROM_HERE, NewRunnableMethod(this, &SyncRunnable::Run));
+    mMessageLoop->PostTask(NewRunnableMethod(this, &SyncRunnable::Run));
     MonitorAutoLock lock(mMonitor);
     while (!mDone) {
       lock.Wait();
@@ -121,7 +121,7 @@ RunOnMainThread(GMPTask* aTask)
   }
 
   RefPtr<Runnable> r = new Runnable(aTask);
-  sMainLoop->PostTask(FROM_HERE, NewRunnableMethod(r.get(), &Runnable::Run));
+  sMainLoop->PostTask(NewRunnableMethod(r.get(), &Runnable::Run));
 
   return GMPNoErr;
 }
@@ -254,7 +254,7 @@ GMPThreadImpl::Post(GMPTask* aTask)
 
   RefPtr<Runnable> r = new Runnable(aTask);
 
-  mThread.message_loop()->PostTask(FROM_HERE, NewRunnableMethod(r.get(), &Runnable::Run));
+  mThread.message_loop()->PostTask(NewRunnableMethod(r.get(), &Runnable::Run));
 }
 
 void

dom/media/gmp/GMPProcessParent.cpp

@@ -85,7 +85,7 @@ void
 GMPProcessParent::Delete(nsCOMPtr<nsIRunnable> aCallback)
 {
   mDeletedCallback = aCallback;
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, NewRunnableMethod(this, &GMPProcessParent::DoDelete));
+  XRE_GetIOMessageLoop()->PostTask(NewRunnableMethod(this, &GMPProcessParent::DoDelete));
 }
 
 void

dom/media/gmp/GMPServiceChild.cpp

@@ -252,8 +252,8 @@ GMPServiceChild::GMPServiceChild()
 
 GMPServiceChild::~GMPServiceChild()
 {
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 PGMPContentParent*

dom/media/gmp/GMPServiceParent.cpp

@@ -1781,8 +1781,8 @@ GeckoMediaPluginServiceParent::ClearStorage()
 
 GMPServiceParent::~GMPServiceParent()
 {
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new DeleteTask<Transport>(GetTransport()));
+  RefPtr<DeleteTask<Transport>> task = new DeleteTask<Transport>(GetTransport());
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
 }
 
 bool

dom/media/gmp/GMPStorageChild.cpp

@@ -15,7 +15,7 @@
       _func(__VA_ARGS__); \
     } else { \
       mPlugin->GMPMessageLoop()->PostTask( \
-        FROM_HERE, NewRunnableMethod(this, &GMPStorageChild::_func, ##__VA_ARGS__) \
+        NewRunnableMethod(this, &GMPStorageChild::_func, ##__VA_ARGS__) \
       ); \
     } \
   } while(false)

dom/media/gmp/GMPVideoDecoderChild.cpp

@@ -226,8 +226,7 @@ GMPVideoDecoderChild::Alloc(size_t aSize,
   rv = CallNeedShmem(aSize, aMem);
   --mNeedShmemIntrCount;
   if (mPendingDecodeComplete) {
-    auto t = NewRunnableMethod(this, &GMPVideoDecoderChild::RecvDecodingComplete);
-    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
+    mPlugin->GMPMessageLoop()->PostTask(NewRunnableMethod(this, &GMPVideoDecoderChild::RecvDecodingComplete));
   }
 #else
 #ifdef GMP_SAFE_SHMEM

dom/media/gmp/GMPVideoEncoderChild.cpp

@@ -207,8 +207,7 @@ GMPVideoEncoderChild::Alloc(size_t aSize,
   rv = CallNeedShmem(aSize, aMem);
   --mNeedShmemIntrCount;
   if (mPendingEncodeComplete) {
-    auto t = NewRunnableMethod(this, &GMPVideoEncoderChild::RecvEncodingComplete);
-    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
+    mPlugin->GMPMessageLoop()->PostTask(NewRunnableMethod(this, &GMPVideoEncoderChild::RecvEncodingComplete));
   }
 #else
 #ifdef GMP_SAFE_SHMEM

dom/media/mediasink/DecodedAudioDataSink.h

@@ -9,6 +9,7 @@
 #include "AudioSink.h"
 #include "AudioStream.h"
 #include "MediaEventSource.h"
+#include "MediaQueue.h"
 #include "MediaInfo.h"
 #include "mozilla/RefPtr.h"
 #include "nsISupportsImpl.h"

dom/media/omx/MediaOmxReader.cpp

@@ -31,7 +31,7 @@ namespace mozilla {
 extern LazyLogModule gMediaDecoderLog;
 #define DECODER_LOG(type, msg) MOZ_LOG(gMediaDecoderLog, type, msg)
 
-class MediaOmxReader::ProcessCachedDataTask : public Task
+class MediaOmxReader::ProcessCachedDataTask : public Runnable
 {
 public:
   ProcessCachedDataTask(MediaOmxReader* aOmxReader, int64_t aOffset)
@@ -39,11 +39,12 @@ public:
     mOffset(aOffset)
   { }
 
-  void Run()
+  NS_IMETHOD Run() override
   {
     MOZ_ASSERT(!NS_IsMainThread());
     MOZ_ASSERT(mOmxReader.get());
     mOmxReader->ProcessCachedData(mOffset);
+    return NS_OK;
   }
 
 private:
@@ -105,8 +106,8 @@ private:
       // We cannot read data in the main thread because it
       // might block for too long. Instead we post an IO task
       // to the IO thread if there is more data available.
-      XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-          new ProcessCachedDataTask(mOmxReader.get(), mOffset));
+      RefPtr<Runnable> task = new ProcessCachedDataTask(mOmxReader.get(), mOffset);
+      XRE_GetIOMessageLoop()->PostTask(task.forget());
     }
   }
 

dom/media/platforms/agnostic/OpusDecoder.cpp

@@ -103,10 +103,10 @@ OpusDataDecoder::DecodeHeader(const unsigned char* aData, size_t aLength)
     return NS_ERROR_FAILURE;
   }
   int channels = mOpusParser->mChannels;
-  // No channel mapping for more than 8 channels.
-  if (channels > 8) {
-    OPUS_DEBUG("No channel mapping for more than 8 channels. Source is %d channels",
-               channels);
+
+  AudioConfig::ChannelLayout layout(channels);
+  if (!layout.IsValid()) {
+    OPUS_DEBUG("Invalid channel mapping. Source is %d channels", channels);
     return NS_ERROR_FAILURE;
   }
 

dom/media/platforms/agnostic/VorbisDecoder.cpp

@@ -105,6 +105,11 @@ VorbisDataDecoder::Init()
         ("Invalid Vorbis header: container and codec channels do not match!"));
   }
 
+  AudioConfig::ChannelLayout layout(mVorbisDsp.vi->channels);
+  if (!layout.IsValid()) {
+    return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
+  }
+
   return InitPromise::CreateAndResolve(TrackInfo::kAudioTrack, __func__);
 }
 
@@ -223,6 +228,9 @@ VorbisDataDecoder::DoDecode(MediaRawData* aSample)
       AudioConfig in(AudioConfig::ChannelLayout(channels, VorbisLayout(channels)),
                      rate);
       AudioConfig out(channels, rate);
+      if (!in.IsValid() || !out.IsValid()) {
+       return -1;
+      }
       mAudioConverter = MakeUnique<AudioConverter>(in, out);
     }
     MOZ_ASSERT(mAudioConverter->CanWorkInPlace());