Merge m-c to b2g-inbound.

accessible/src/atk/AccessibleWrap.cpp

@@ -691,6 +691,8 @@ getRoleCB(AtkObject *aAtkObj)
 
   if (aAtkObj->role == ATK_ROLE_LIST_BOX && !IsAtkVersionAtLeast(2, 1))
     aAtkObj->role = ATK_ROLE_LIST;
+  else if (aAtkObj->role == ATK_ROLE_TABLE_ROW && !IsAtkVersionAtLeast(2, 1))
+    aAtkObj->role = ATK_ROLE_LIST_ITEM;
 
   return aAtkObj->role;
 }

accessible/src/atk/nsMai.h

@@ -39,7 +39,8 @@ extern int atkMajorVersion, atkMinorVersion;
 static inline bool
 IsAtkVersionAtLeast(int aMajor, int aMinor)
 {
-  return aMajor < atkMajorVersion && aMinor < atkMinorVersion;
+  return aMajor < atkMajorVersion ||
+         (aMajor == atkMajorVersion && aMinor <= atkMinorVersion);
 }
 
 #endif /* __NS_MAI_H__ */

accessible/src/base/RoleMap.h

@@ -242,7 +242,7 @@ ROLE(COLUMN,
 
 ROLE(ROW,
      "row",
-     ATK_ROLE_LIST_ITEM,
+     ATK_ROLE_TABLE_ROW,
      NSAccessibilityRowRole,
      ROLE_SYSTEM_ROW,
      ROLE_SYSTEM_ROW,

build/autoconf/icu.m4

@@ -168,7 +168,7 @@ if test -z "$BUILDING_JS" -o -n "$JS_STANDALONE"; then
     	    WINNT)
     		ICU_TARGET=MSYS/MSVC
     		;;
-    	    *bsd*|dragonfly*)
+            DragonFly|FreeBSD|NetBSD|OpenBSD|GNU_kFreeBSD)
     		ICU_TARGET=BSD
     		;;
     	esac

configure.in

@@ -1023,6 +1023,24 @@ darwin*)
 linux*)
     HOST_OS_ARCH=Linux
     ;;
+kfreebsd*-gnu)
+    HOST_OS_ARCH=GNU_kFreeBSD
+    ;;
+gnu*)
+    HOST_OS_ARCH=GNU
+    ;;
+dragonfly*)
+    HOST_OS_ARCH=DragonFly
+    ;;
+freebsd*)
+    HOST_OS_ARCH=FreeBSD
+    ;;
+netbsd*)
+    HOST_OS_ARCH=NetBSD
+    ;;
+openbsd*)
+    HOST_OS_ARCH=OpenBSD
+    ;;
 solaris*)
     HOST_OS_ARCH=SunOS
     SOLARIS_SUNPRO_CC=

content/base/src/nsFrameMessageManager.cpp

@@ -457,7 +457,7 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, mPendingScripts.Length(), nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, mPendingScripts.Length()));
   NS_ENSURE_TRUE(array, NS_ERROR_OUT_OF_MEMORY);
 
   JS::Rooted<JSString*> url(aCx);
@@ -466,10 +466,11 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<
     url = JS_NewUCStringCopyN(aCx, mPendingScripts[i].get(), mPendingScripts[i].Length());
     NS_ENSURE_TRUE(url, NS_ERROR_OUT_OF_MEMORY);
 
-    JS::Value pairElts[] = { JS::StringValue(url),
-                             JS::BooleanValue(mPendingScriptsGlobalStates[i]) };
+    JS::AutoValueArray<2> pairElts(aCx);
+    pairElts[0].setString(url);
+    pairElts[1].setBoolean(mPendingScriptsGlobalStates[i]);
 
-    pair = JS_NewArrayObject(aCx, 2, pairElts);
+    pair = JS_NewArrayObject(aCx, pairElts);
     NS_ENSURE_TRUE(pair, NS_ERROR_OUT_OF_MEMORY);
 
     NS_ENSURE_TRUE(JS_SetElement(aCx, array, i, pair),
@@ -598,7 +599,7 @@ nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
   }
 
   uint32_t len = retval.Length();
-  JS::Rooted<JSObject*> dataArray(aCx, JS_NewArrayObject(aCx, len, nullptr));
+  JS::Rooted<JSObject*> dataArray(aCx, JS_NewArrayObject(aCx, len));
   NS_ENSURE_TRUE(dataArray, NS_ERROR_OUT_OF_MEMORY);
 
   for (uint32_t i = 0; i < len; ++i) {

content/canvas/src/CanvasRenderingContext2D.cpp

@@ -1245,14 +1245,13 @@ CanvasRenderingContext2D::SetTransform(double m11, double m12,
 JSObject*
 MatrixToJSObject(JSContext* cx, const Matrix& matrix, ErrorResult& error)
 {
-  JS::Value elts[] = {
-    DOUBLE_TO_JSVAL(matrix._11), DOUBLE_TO_JSVAL(matrix._12),
-    DOUBLE_TO_JSVAL(matrix._21), DOUBLE_TO_JSVAL(matrix._22),
-    DOUBLE_TO_JSVAL(matrix._31), DOUBLE_TO_JSVAL(matrix._32)
-  };
+  JS::AutoValueArray<6> elts(cx);
+  elts[0].setDouble(matrix._11); elts[1].setDouble(matrix._12);
+  elts[2].setDouble(matrix._21); elts[3].setDouble(matrix._22);
+  elts[4].setDouble(matrix._31); elts[5].setDouble(matrix._32);
 
   // XXX Should we enter GetWrapper()'s compartment?
-  JSObject* obj = JS_NewArrayObject(cx, 6, elts);
+  JSObject* obj = JS_NewArrayObject(cx, elts);
   if  (!obj) {
     error.Throw(NS_ERROR_OUT_OF_MEMORY);
   }

content/canvas/src/CanvasUtils.h

@@ -158,7 +158,7 @@ DashArrayToJSVal(FallibleTArray<T>& dashes,
         return JSVAL_NULL;
     }
     JS::Rooted<JSObject*> obj(cx,
-        JS_NewArrayObject(cx, dashes.Length(), nullptr));
+        JS_NewArrayObject(cx, dashes.Length()));
     if (!obj) {
         rv.Throw(NS_ERROR_OUT_OF_MEMORY);
         return JSVAL_NULL;

content/canvas/src/WebGLContextGL.cpp

@@ -1907,10 +1907,10 @@ WebGLContext::GetUniform(JSContext* cx, WebGLProgram *prog,
         if (unitSize == 1) {
             return JS::BooleanValue(iv[0] ? true : false);
         } else {
-            JS::Value uv[16];
+            JS::AutoValueArray<16> uv(cx);
             for (int k = 0; k < unitSize; k++)
-                uv[k] = JS::BooleanValue(iv[k] ? true : false);
-            JSObject* obj = JS_NewArrayObject(cx, unitSize, uv);
+                uv[k].setBoolean(iv[k]);
+            JSObject* obj = JS_NewArrayObject(cx, JS::HandleValueArray::subarray(uv, 0, unitSize));
             if (!obj) {
                 ErrorOutOfMemory("getUniform: out of memory");
                 return JS::NullValue();

content/canvas/src/WebGLContextState.cpp

@@ -423,11 +423,12 @@ WebGLContext::GetParameter(JSContext* cx, GLenum pname, ErrorResult& rv)
         {
             realGLboolean gl_bv[4] = { 0 };
             gl->fGetBooleanv(pname, gl_bv);
-            JS::Value vals[4] = { JS::BooleanValue(bool(gl_bv[0])),
-                JS::BooleanValue(bool(gl_bv[1])),
-                JS::BooleanValue(bool(gl_bv[2])),
-                JS::BooleanValue(bool(gl_bv[3])) };
-            JSObject* obj = JS_NewArrayObject(cx, 4, vals);
+            JS::AutoValueArray<4> vals(cx);
+            vals[0].setBoolean(gl_bv[0]);
+            vals[1].setBoolean(gl_bv[1]);
+            vals[2].setBoolean(gl_bv[2]);
+            vals[3].setBoolean(gl_bv[3]);
+            JSObject* obj = JS_NewArrayObject(cx, vals);
             if (!obj) {
                 rv = NS_ERROR_OUT_OF_MEMORY;
             }

content/media/directshow/AudioSinkInputPin.cpp

@@ -9,7 +9,6 @@
 #include "SampleSink.h"
 #include "prlog.h"
 
-#include <initguid.h>
 #include <wmsdkidl.h>
 
 using namespace mozilla::media;

content/media/directshow/moz.build

@@ -13,7 +13,6 @@ EXPORTS += [
 ]
 
 UNIFIED_SOURCES += [
-    'AudioSinkFilter.cpp',
     'AudioSinkInputPin.cpp',
     'DirectShowDecoder.cpp',
     'DirectShowReader.cpp',
@@ -22,6 +21,10 @@ UNIFIED_SOURCES += [
     'SourceFilter.cpp',
 ]
 
+SOURCES += [
+    'AudioSinkFilter.cpp',
+]
+
 # If WebRTC isn't being built, we need to compile the DirectShow base classes so that
 # they're available at link time.
 if not CONFIG['MOZ_WEBRTC']:

content/media/wmf/WMF.h

@@ -29,7 +29,6 @@ which makes Windows Media Foundation unavailable.
 #include <mferror.h>
 #include <propvarutil.h>
 #include <wmcodecdsp.h>
-#include <initguid.h>
 #include <d3d9.h>
 #include <dxva2api.h>
 #include <wmcodecdsp.h>

content/media/wmf/WMFUtils.cpp

@@ -14,6 +14,7 @@
 #include "nsWindowsHelpers.h"
 #include "mozilla/CheckedInt.h"
 #include "VideoUtils.h"
+#include <initguid.h>
 
 #ifdef WMF_MUST_DEFINE_AAC_MFT_CLSID
 // Some SDK versions don't define the AAC decoder CLSID.

content/media/wmf/moz.build

@@ -18,6 +18,9 @@ UNIFIED_SOURCES += [
     'WMFDecoder.cpp',
     'WMFReader.cpp',
     'WMFSourceReaderCallback.cpp',
+]
+
+SOURCES += [
     'WMFUtils.cpp',
 ]
 

dom/base/MessagePort.cpp

@@ -372,9 +372,15 @@ MessagePort::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
   if (aTransferable.WasPassed()) {
     const Sequence<JS::Value>& realTransferable = aTransferable.Value();
+
+    // The input sequence only comes from the generated bindings code, which
+    // ensures it is rooted.
+    JS::HandleValueArray elements =
+      JS::HandleValueArray::fromMarkedLocation(realTransferable.Length(),
+                                               realTransferable.Elements());
+
     JSObject* array =
-      JS_NewArrayObject(aCx, realTransferable.Length(),
-                        const_cast<JS::Value*>(realTransferable.Elements()));
+      JS_NewArrayObject(aCx, elements);
     if (!array) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return;

dom/base/nsGlobalWindow.cpp

@@ -7940,9 +7940,13 @@ nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
   JS::Rooted<JS::Value> transferArray(aCx, JS::UndefinedValue());
   if (aTransfer.WasPassed()) {
     const Sequence<JS::Value >& values = aTransfer.Value();
-    transferArray = JS::ObjectOrNullValue(JS_NewArrayObject(aCx,
-                                                            values.Length(),
-                                                            const_cast<JS::Value*>(values.Elements())));
+
+    // The input sequence only comes from the generated bindings code, which
+    // ensures it is rooted.
+    JS::HandleValueArray elements =
+      JS::HandleValueArray::fromMarkedLocation(values.Length(), values.Elements());
+
+    transferArray = JS::ObjectOrNullValue(JS_NewArrayObject(aCx, elements));
     if (transferArray.isNull()) {
       aError.Throw(NS_ERROR_OUT_OF_MEMORY);
       return;

dom/base/nsJSEnvironment.cpp

@@ -1169,7 +1169,7 @@ nsJSContext::SetProperty(JS::Handle<JSObject*> aTarget, const char* aPropName, n
     }
   }
 
-  JSObject* array = ::JS_NewArrayObject(mContext, args.length(), args.begin());
+  JSObject* array = ::JS_NewArrayObject(mContext, args);
   if (!array) {
     return NS_ERROR_FAILURE;
   }

dom/bindings/Codegen.py

@@ -4428,7 +4428,7 @@ if (%s.IsNull()) {
         innerTemplate = CGIndenter(CGGeneric(innerTemplate), 6).define()
         return (("""
 uint32_t length = %s.Length();
-JS::Rooted<JSObject*> returnArray(cx, JS_NewArrayObject(cx, length, nullptr));
+JS::Rooted<JSObject*> returnArray(cx, JS_NewArrayObject(cx, length));
 if (!returnArray) {
 %s
 }

dom/camera/CameraControlImpl.cpp

@@ -146,7 +146,7 @@ CameraControlImpl::Get(JSContext* aCx, uint32_t aKey, JS::Value* aValue)
 
   GetParameter(aKey, regionArray);
 
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0));
   if (!array) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

dom/camera/DOMCameraCapabilities.cpp

@@ -121,7 +121,7 @@ DOMCameraCapabilities::ParameterListToNewArray(JSContext* aCx,
     return NS_OK;
   }
 
-  aArray.set(JS_NewArrayObject(aCx, 0, nullptr));
+  aArray.set(JS_NewArrayObject(aCx, 0));
   if (!aArray) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -378,7 +378,7 @@ DOMCameraCapabilities::GetVideoSizes(JSContext* cx, JS::MutableHandle<JS::Value>
     return NS_OK;
   }
 
-  JS::Rooted<JSObject*> array(cx, JS_NewArrayObject(cx, 0, nullptr));
+  JS::Rooted<JSObject*> array(cx, JS_NewArrayObject(cx, 0));
   if (!array) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

dom/events/TextComposition.cpp

@@ -9,6 +9,7 @@
 #include "nsContentUtils.h"
 #include "nsEventDispatcher.h"
 #include "nsIContent.h"
+#include "nsIEditor.h"
 #include "nsIMEStateManager.h"
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
@@ -27,7 +28,8 @@ TextComposition::TextComposition(nsPresContext* aPresContext,
   mPresContext(aPresContext), mNode(aNode),
   mNativeContext(aEvent->widget->GetInputContext().mNativeIMEContext),
   mCompositionStartOffset(0), mCompositionTargetOffset(0),
-  mIsSynthesizedForTests(aEvent->mFlags.mIsSynthesizedForTests)
+  mIsSynthesizedForTests(aEvent->mFlags.mIsSynthesizedForTests),
+  mIsComposing(false)
 {
 }
 
@@ -49,6 +51,20 @@ TextComposition::DispatchEvent(WidgetGUIEvent* aEvent,
   nsEventDispatcher::Dispatch(mNode, mPresContext,
                               aEvent, nullptr, aStatus, aCallBack);
 
+  // Emulate editor behavior of text event handler if no editor handles
+  // composition/text events.
+  if (aEvent->message == NS_TEXT_TEXT && !HasEditor()) {
+    EditorWillHandleTextEvent(aEvent->AsTextEvent());
+    EditorDidHandleTextEvent();
+  }
+
+#ifdef DEBUG
+  else if (aEvent->message == NS_COMPOSITION_END) {
+    MOZ_ASSERT(!mIsComposing, "Why is the editor still composing?");
+    MOZ_ASSERT(!HasEditor(), "Why does the editor still keep to hold this?");
+  }
+#endif // #ifdef DEBUG
+
   // Notify composition update to widget if possible
   NotityUpdateComposition(aEvent);
 }
@@ -123,6 +139,53 @@ TextComposition::NotifyIME(widget::NotificationToIME aNotification)
   return nsIMEStateManager::NotifyIME(aNotification, mPresContext);
 }
 
+void
+TextComposition::EditorWillHandleTextEvent(const WidgetTextEvent* aTextEvent)
+{
+  mIsComposing = aTextEvent->IsComposing();
+
+  MOZ_ASSERT(mLastData == aTextEvent->theText,
+    "The text of a text event must be same as previous data attribute value "
+    "of the latest compositionupdate event");
+}
+
+void
+TextComposition::EditorDidHandleTextEvent()
+{
+  mString = mLastData;
+}
+
+void
+TextComposition::StartHandlingComposition(nsIEditor* aEditor)
+{
+  MOZ_ASSERT(!HasEditor(), "There is a handling editor already");
+  mEditorWeak = do_GetWeakReference(aEditor);
+}
+
+void
+TextComposition::EndHandlingComposition(nsIEditor* aEditor)
+{
+#ifdef DEBUG
+  nsCOMPtr<nsIEditor> editor = GetEditor();
+  MOZ_ASSERT(editor == aEditor, "Another editor handled the composition?");
+#endif // #ifdef DEBUG
+  mEditorWeak = nullptr;
+}
+
+already_AddRefed<nsIEditor>
+TextComposition::GetEditor() const
+{
+  nsCOMPtr<nsIEditor> editor = do_QueryReferent(mEditorWeak);
+  return editor.forget();
+}
+
+bool
+TextComposition::HasEditor() const
+{
+  nsCOMPtr<nsIEditor> editor = GetEditor();
+  return !!editor;
+}
+
 /******************************************************************************
  * TextComposition::CompositionEventDispatcher
  ******************************************************************************/

dom/events/TextComposition.h

@@ -9,6 +9,7 @@
 
 #include "nsCOMPtr.h"
 #include "nsINode.h"
+#include "nsIWeakReference.h"
 #include "nsIWidget.h"
 #include "nsTArray.h"
 #include "nsThreadUtils.h"
@@ -17,8 +18,8 @@
 #include "mozilla/EventForwards.h"
 
 class nsDispatchingCallback;
+class nsIEditor;
 class nsIMEStateManager;
-class nsIWidget;
 
 namespace mozilla {
 
@@ -47,7 +48,14 @@ public:
   nsPresContext* GetPresContext() const { return mPresContext; }
   nsINode* GetEventTargetNode() const { return mNode; }
   // The latest CompositionEvent.data value except compositionstart event.
-  const nsString& GetLastData() const { return mLastData; }
+  // This value is modified at dispatching compositionupdate.
+  const nsString& LastData() const { return mLastData; }
+  // The composition string which is already handled by the focused editor.
+  // I.e., this value must be same as the composition string on the focused
+  // editor.  This value is modified at a call of EditorDidHandleTextEvent().
+  // Note that mString and mLastData are different between dispatcing
+  // compositionupdate and text event handled by focused editor.
+  const nsString& String() const { return mString; }
   // Returns true if the composition is started with synthesized event which
   // came from nsDOMWindowUtils.
   bool IsSynthesizedForTests() const { return mIsSynthesizedForTests; }
@@ -73,6 +81,45 @@ public:
    */
   uint32_t OffsetOfTargetClause() const { return mCompositionTargetOffset; }
 
+  /**
+   * Returns true if there is non-empty composition string and it's not fixed.
+   * Otherwise, false.
+   */
+  bool IsComposing() const { return mIsComposing; }
+
+  /**
+   * StartHandlingComposition() and EndHandlingComposition() are called by
+   * editor when it holds a TextComposition instance and release it.
+   */
+  void StartHandlingComposition(nsIEditor* aEditor);
+  void EndHandlingComposition(nsIEditor* aEditor);
+
+  /**
+   * TextEventHandlingMarker class should be created at starting to handle text
+   * event in focused editor.  This calls EditorWillHandleTextEvent() and
+   * EditorDidHandleTextEvent() automatically.
+   */
+  class MOZ_STACK_CLASS TextEventHandlingMarker
+  {
+  public:
+    TextEventHandlingMarker(TextComposition* aComposition,
+                            const WidgetTextEvent* aTextEvent)
+      : mComposition(aComposition)
+    {
+      mComposition->EditorWillHandleTextEvent(aTextEvent);
+    }
+
+    ~TextEventHandlingMarker()
+    {
+      mComposition->EditorDidHandleTextEvent();
+    }
+
+  private:
+    nsRefPtr<TextComposition> mComposition;
+    TextEventHandlingMarker();
+    TextEventHandlingMarker(const TextEventHandlingMarker& aOther);
+  };
+
 private:
   // This class holds nsPresContext weak.  This instance shouldn't block
   // destroying it.  When the presContext is being destroyed, it's notified to
@@ -85,10 +132,17 @@ private:
   // composition.  Don't access the instance, it may not be available.
   void* mNativeContext;
 
+  // mEditorWeak is a weak reference to the focused editor handling composition.
+  nsWeakPtr mEditorWeak;
+
   // mLastData stores the data attribute of the latest composition event (except
   // the compositionstart event).
   nsString mLastData;
 
+  // mString stores the composition text which has been handled by the focused
+  // editor.
+  nsString mString;
+
   // Offset of the composition string from start of the editor
   uint32_t mCompositionStartOffset;
   // Offset of the selected clause of the composition string from start of the
@@ -98,10 +152,35 @@ private:
   // See the comment for IsSynthesizedForTests().
   bool mIsSynthesizedForTests;
 
+  // See the comment for IsComposing().
+  bool mIsComposing;
+
   // Hide the default constructor and copy constructor.
   TextComposition() {}
   TextComposition(const TextComposition& aOther);
 
+  /**
+   * GetEditor() returns nsIEditor pointer of mEditorWeak.
+   */
+  already_AddRefed<nsIEditor> GetEditor() const;
+
+  /**
+   * HasEditor() returns true if mEditorWeak holds nsIEditor instance which is
+   * alive.  Otherwise, false.
+   */
+  bool HasEditor() const;
+
+  /**
+   * EditorWillHandleTextEvent() must be called before the focused editor
+   * handles the text event.
+   */
+  void EditorWillHandleTextEvent(const WidgetTextEvent* aTextEvent);
+
+  /**
+   * EditorDidHandleTextEvent() must be called after the focused editor handles
+   * a text event.
+   */
+  void EditorDidHandleTextEvent();
 
   /**
    * DispatchEvent() dispatches the aEvent to the mContent synchronously.

dom/events/nsIMEStateManager.cpp

@@ -617,9 +617,9 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
     case REQUEST_TO_COMMIT_COMPOSITION: {
       nsCOMPtr<nsIWidget> widget(aWidget);
       nsEventStatus status = nsEventStatus_eIgnore;
-      if (!composition->GetLastData().IsEmpty()) {
+      if (!composition->LastData().IsEmpty()) {
         WidgetTextEvent textEvent(true, NS_TEXT_TEXT, widget);
-        textEvent.theText = composition->GetLastData();
+        textEvent.theText = composition->LastData();
         textEvent.mFlags.mIsSynthesizedForTests = true;
         widget->DispatchEvent(&textEvent, status);
         if (widget->Destroyed()) {
@@ -629,7 +629,7 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
 
       status = nsEventStatus_eIgnore;
       WidgetCompositionEvent endEvent(true, NS_COMPOSITION_END, widget);
-      endEvent.data = composition->GetLastData();
+      endEvent.data = composition->LastData();
       endEvent.mFlags.mIsSynthesizedForTests = true;
       widget->DispatchEvent(&endEvent, status);
 
@@ -638,9 +638,9 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
     case REQUEST_TO_CANCEL_COMPOSITION: {
       nsCOMPtr<nsIWidget> widget(aWidget);
       nsEventStatus status = nsEventStatus_eIgnore;
-      if (!composition->GetLastData().IsEmpty()) {
+      if (!composition->LastData().IsEmpty()) {
         WidgetCompositionEvent updateEvent(true, NS_COMPOSITION_UPDATE, widget);
-        updateEvent.data = composition->GetLastData();
+        updateEvent.data = composition->LastData();
         updateEvent.mFlags.mIsSynthesizedForTests = true;
         widget->DispatchEvent(&updateEvent, status);
         if (widget->Destroyed()) {
@@ -649,7 +649,7 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
 
         status = nsEventStatus_eIgnore;
         WidgetTextEvent textEvent(true, NS_TEXT_TEXT, widget);
-        textEvent.theText = composition->GetLastData();
+        textEvent.theText = composition->LastData();
         textEvent.mFlags.mIsSynthesizedForTests = true;
         widget->DispatchEvent(&textEvent, status);
         if (widget->Destroyed()) {
@@ -659,7 +659,7 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
 
       status = nsEventStatus_eIgnore;
       WidgetCompositionEvent endEvent(true, NS_COMPOSITION_END, widget);
-      endEvent.data = composition->GetLastData();
+      endEvent.data = composition->LastData();
       endEvent.mFlags.mIsSynthesizedForTests = true;
       widget->DispatchEvent(&endEvent, status);
 
@@ -1126,9 +1126,23 @@ nsIMEStateManager::GetFocusSelectionAndRoot(nsISelection** aSel,
   return NS_OK;
 }
 
-TextComposition*
+// static
+already_AddRefed<TextComposition>
 nsIMEStateManager::GetTextCompositionFor(nsIWidget* aWidget)
 {
-  return sTextCompositions ?
-    sTextCompositions->GetCompositionFor(aWidget) : nullptr;
+  if (!sTextCompositions) {
+    return nullptr;
+  }
+  nsRefPtr<TextComposition> textComposition =
+    sTextCompositions->GetCompositionFor(aWidget);
+  return textComposition.forget();
+}
+
+// static
+already_AddRefed<TextComposition>
+nsIMEStateManager::GetTextCompositionFor(WidgetGUIEvent* aEvent)
+{
+  MOZ_ASSERT(aEvent->AsCompositionEvent() || aEvent->AsTextEvent(),
+             "aEvent has to be WidgetCompositionEvent or WidgetTextEvent");
+  return GetTextCompositionFor(aEvent->widget);
 }

dom/events/nsIMEStateManager.h

@@ -98,7 +98,17 @@ public:
   /**
    * Get TextComposition from widget.
    */
-  static mozilla::TextComposition* GetTextCompositionFor(nsIWidget* aWidget);
+  static already_AddRefed<mozilla::TextComposition>
+    GetTextCompositionFor(nsIWidget* aWidget);
+
+  /**
+   * Returns TextComposition instance for the event.
+   *
+   * @param aEvent      Should be a composition event or a text event which is
+   *                    being dispatched.
+   */
+  static already_AddRefed<mozilla::TextComposition>
+    GetTextCompositionFor(mozilla::WidgetGUIEvent* aEvent);
 
   /**
    * Send a notification to IME.  It depends on the IME or platform spec what

dom/file/ArchiveRequest.cpp

@@ -174,7 +174,7 @@ ArchiveRequest::GetFilenamesResult(JSContext* aCx,
                                    JS::Value* aValue,
                                    nsTArray<nsCOMPtr<nsIDOMFile> >& aFileList)
 {
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aFileList.Length(), nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aFileList.Length()));
   nsresult rv;
 
   if (!array) {
@@ -232,7 +232,7 @@ ArchiveRequest::GetFilesResult(JSContext* aCx,
                                JS::MutableHandle<JS::Value> aValue,
                                nsTArray<nsCOMPtr<nsIDOMFile> >& aFileList)
 {
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aFileList.Length(), nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aFileList.Length()));
   if (!array) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

dom/indexedDB/AsyncConnectionHelper.cpp

@@ -58,7 +58,7 @@ ConvertCloneReadInfosToArrayInternal(
                                 nsTArray<StructuredCloneReadInfo>& aReadInfos,
                                 JS::MutableHandle<JS::Value> aResult)
 {
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0));
   if (!array) {
     IDB_WARNING("Failed to make array!");
     return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

dom/indexedDB/IDBIndex.cpp

@@ -1447,7 +1447,7 @@ GetAllKeysHelper::GetSuccessResult(JSContext* aCx,
   nsTArray<Key> keys;
   mKeys.SwapElements(keys);
 
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0));
   if (!array) {
     IDB_WARNING("Failed to make array!");
     return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

dom/indexedDB/IDBObjectStore.cpp

@@ -4931,7 +4931,7 @@ GetAllKeysHelper::GetSuccessResult(JSContext* aCx,
   nsTArray<Key> keys;
   mKeys.SwapElements(keys);
 
-  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0));
   if (!array) {
     IDB_WARNING("Failed to make array!");
     return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

dom/indexedDB/Key.cpp

@@ -191,7 +191,7 @@ Key::DecodeJSValInternal(const unsigned char*& aPos, const unsigned char* aEnd,
   NS_ENSURE_TRUE(aRecursionDepth < MaxRecursionDepth, NS_ERROR_DOM_INDEXEDDB_DATA_ERR);
 
   if (*aPos - aTypeOffset >= eArray) {
-    JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+    JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, 0));
     if (!array) {
       NS_WARNING("Failed to make array!");
       IDB_REPORT_INTERNAL_ERR();

dom/indexedDB/KeyPath.cpp

@@ -389,7 +389,7 @@ KeyPath::ExtractKeyAsJSVal(JSContext* aCx, const JS::Value& aValue,
   }
 
   const uint32_t len = mStrings.Length();
-  JS::Rooted<JSObject*> arrayObj(aCx, JS_NewArrayObject(aCx, len, nullptr));
+  JS::Rooted<JSObject*> arrayObj(aCx, JS_NewArrayObject(aCx, len));
   if (!arrayObj) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -501,7 +501,7 @@ KeyPath::ToJSVal(JSContext* aCx, JS::MutableHandle<JS::Value> aValue) const
 {
   if (IsArray()) {
     uint32_t len = mStrings.Length();
-    JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, len, nullptr));
+    JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, len));
     if (!array) {
       IDB_WARNING("Failed to make array!");
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

dom/mobilemessage/src/MmsMessage.cpp

@@ -483,7 +483,7 @@ MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::MutableHandle<JS::Value> aDelive
   }
 
   JS::Rooted<JSObject*> deliveryInfo(
-    aCx, JS_NewArrayObject(aCx, length, nullptr));
+    aCx, JS_NewArrayObject(aCx, length));
   NS_ENSURE_TRUE(deliveryInfo, NS_ERROR_OUT_OF_MEMORY);
 
   for (uint32_t i = 0; i < length; ++i) {
@@ -614,7 +614,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::MutableHandle<JS::Value> aAttachm
   uint32_t length = mAttachments.Length();
 
   JS::Rooted<JSObject*> attachments(
-    aCx, JS_NewArrayObject(aCx, length, nullptr));
+    aCx, JS_NewArrayObject(aCx, length));
   NS_ENSURE_TRUE(attachments, NS_ERROR_OUT_OF_MEMORY);
 
   for (uint32_t i = 0; i < length; ++i) {

dom/mobilemessage/src/MobileMessageCallback.cpp

@@ -167,7 +167,7 @@ MobileMessageCallback::NotifyMessageDeleted(bool *aDeleted, uint32_t aSize)
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
   JS::Rooted<JSObject*> deleteArrayObj(cx,
-                                       JS_NewArrayObject(cx, aSize, nullptr));
+                                       JS_NewArrayObject(cx, aSize));
   for (uint32_t i = 0; i < aSize; i++) {
     JS_SetElement(cx, deleteArrayObj, i, aDeleted[i]);
   }

dom/mobilemessage/src/MobileMessageManager.cpp

@@ -241,7 +241,7 @@ MobileMessageManager::Send(JS::Handle<JS::Value> aNumber,
   }
 
   JS::Rooted<JSObject*> obj(aCx);
-  obj = JS_NewArrayObject(aCx, requests.length(), requests.begin());
+  obj = JS_NewArrayObject(aCx, requests);
   if (!obj) {
     return NS_ERROR_FAILURE;
   }

dom/mobilemessage/src/SmsFilter.cpp

@@ -145,7 +145,7 @@ SmsFilter::GetNumbers(JSContext* aCx, JS::MutableHandle<JS::Value> aNumbers)
     numbers[i].setString(str);
   }
 
-  JSObject* obj = JS_NewArrayObject(aCx, numbers.length(), numbers.begin());
+  JSObject* obj = JS_NewArrayObject(aCx, numbers);
   if (!obj) {
     return NS_ERROR_FAILURE;
   }

dom/mobilemessage/src/ipc/SmsParent.cpp

@@ -115,8 +115,7 @@ GetParamsFromSendMmsMessageRequest(JSContext* aCx,
 
   // attachments
   JS::Rooted<JSObject*> attachmentArray(aCx, JS_NewArrayObject(aCx,
-                                                               aRequest.attachments().Length(),
-                                                               nullptr));
+                                                               aRequest.attachments().Length()));
   for (uint32_t i = 0; i < aRequest.attachments().Length(); i++) {
     JS::Rooted<JSObject*> obj(aCx,
       MmsAttachmentDataToJSObject(aCx, aRequest.attachments().ElementAt(i)));

dom/promise/Promise.cpp

@@ -608,7 +608,7 @@ public:
     MOZ_ASSERT(aCountdown != 0);
     JSContext* cx = aGlobal.GetContext();
     JSAutoCompartment ac(cx, aGlobal.Get());
-    mValues = JS_NewArrayObject(cx, aCountdown, nullptr);
+    mValues = JS_NewArrayObject(cx, aCountdown);
     mozilla::HoldJSObjects(this);
   }
 
@@ -731,7 +731,7 @@ Promise::All(const GlobalObject& aGlobal, JSContext* aCx,
   }
 
   if (aIterable.Length() == 0) {
-    JS::Rooted<JSObject*> empty(aCx, JS_NewArrayObject(aCx, 0, nullptr));
+    JS::Rooted<JSObject*> empty(aCx, JS_NewArrayObject(aCx, 0));
     if (!empty) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return nullptr;

dom/src/notification/Notification.cpp

@@ -48,7 +48,7 @@ public:
     MOZ_ASSERT(aPromise);
     JSContext* cx = aGlobal.GetContext();
     JSAutoCompartment ac(cx, mGlobal);
-    mNotifications = JS_NewArrayObject(cx, 0, nullptr);
+    mNotifications = JS_NewArrayObject(cx, 0);
     HoldData();
   }
 

dom/workers/Console.cpp

@@ -292,7 +292,7 @@ private:
     JS::Rooted<JS::Value> stackValue(cx);
     {
       JS::Rooted<JSObject*> stackObj(cx,
-        JS_NewArrayObject(cx, mStackData.Length(), nullptr));
+        JS_NewArrayObject(cx, mStackData.Length()));
       if (!stackObj) {
         return;
       }
@@ -447,8 +447,7 @@ WorkerConsole::Method(JSContext* aCx, const char* aMethodName,
     stack.swap(caller);
   }
 
-  JS::Rooted<JSObject*> arguments(aCx,
-    JS_NewArrayObject(aCx, aData.Length(), nullptr));
+  JS::Rooted<JSObject*> arguments(aCx, JS_NewArrayObject(aCx, aData.Length()));
   if (!arguments) {
     return;
   }

dom/workers/WorkerPrivate.cpp

@@ -2707,9 +2707,15 @@ WorkerPrivateParent<Derived>::PostMessageInternal(
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
   if (aTransferable.WasPassed()) {
     const Sequence<JS::Value>& realTransferable = aTransferable.Value();
+
+    // The input sequence only comes from the generated bindings code, which
+    // ensures it is rooted.
+    JS::HandleValueArray elements =
+      JS::HandleValueArray::fromMarkedLocation(realTransferable.Length(),
+                                               realTransferable.Elements());
+
     JSObject* array =
-      JS_NewArrayObject(aCx, realTransferable.Length(),
-                        const_cast<JS::Value*>(realTransferable.Elements()));
+      JS_NewArrayObject(aCx, elements);
     if (!array) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return;
@@ -4923,9 +4929,14 @@ WorkerPrivate::PostMessageToParentInternal(
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
   if (aTransferable.WasPassed()) {
     const Sequence<JS::Value>& realTransferable = aTransferable.Value();
-    JSObject* array =
-      JS_NewArrayObject(aCx, realTransferable.Length(),
-                        const_cast<jsval*>(realTransferable.Elements()));
+
+    // The input sequence only comes from the generated bindings code, which
+    // ensures it is rooted.
+    JS::HandleValueArray elements =
+      JS::HandleValueArray::fromMarkedLocation(realTransferable.Length(),
+                                               realTransferable.Elements());
+
+    JSObject* array = JS_NewArrayObject(aCx, elements);
     if (!array) {
       aRv = NS_ERROR_OUT_OF_MEMORY;
       return;

editor/libeditor/base/nsEditor.cpp

@@ -21,6 +21,7 @@
 #include "JoinElementTxn.h"             // for JoinElementTxn
 #include "PlaceholderTxn.h"             // for PlaceholderTxn
 #include "SplitElementTxn.h"            // for SplitElementTxn
+#include "TextComposition.h"            // for TextComposition
 #include "mozFlushType.h"               // for mozFlushType::Flush_Frames
 #include "mozISpellCheckingEngine.h"
 #include "mozInlineSpellChecker.h"      // for mozInlineSpellChecker
@@ -139,12 +140,9 @@ nsEditor::nsEditor()
 ,  mPlaceHolderBatch(0)
 ,  mAction(EditAction::none)
 ,  mIMETextOffset(0)
-,  mIMEBufferLength(0)
 ,  mDirection(eNone)
 ,  mDocDirtyState(-1)
 ,  mSpellcheckCheckboxState(eTriUnset)
-,  mInIMEMode(false)
-,  mIsIMEComposing(false)
 ,  mShouldTxnSetSelection(true)
 ,  mDidPreDestroy(false)
 ,  mDidPostCreate(false)
@@ -248,8 +246,6 @@ nsEditor::Init(nsIDOMDocument *aDoc, nsIContent *aRoot, nsISelectionController *
   /* initialize IME stuff */
   mIMETextNode = nullptr;
   mIMETextOffset = 0;
-  mIMEBufferLength = 0;
-  
   /* Show the caret */
   selCon->SetCaretReadOnly(false);
   selCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
@@ -361,6 +357,10 @@ nsEditor::RemoveEventListeners()
     return;
   }
   reinterpret_cast<nsEditorEventListener*>(mEventListener.get())->Disconnect();
+  if (mComposition) {
+    mComposition->EndHandlingComposition(this);
+    mComposition = nullptr;
+  }
   mEventTarget = nullptr;
 }
 
@@ -966,7 +966,9 @@ nsEditor::EndPlaceHolderTransaction()
       }
       // notify editor observers of action but if composing, it's done by
       // text event handler.
-      if (!mInIMEMode) NotifyEditorObservers();
+      if (!mComposition) {
+        NotifyEditorObservers();
+      }
     }
   }
   mPlaceHolderBatch--;
@@ -2010,11 +2012,26 @@ nsEditor::StopPreservingSelection()
   mSavedSel.MakeEmpty();
 }
 
+void
+nsEditor::EnsureComposition(mozilla::WidgetGUIEvent* aEvent)
+{
+  if (mComposition) {
+    return;
+  }
+  // The compositionstart event must cause creating new TextComposition
+  // instance at being dispatched by nsIMEStateManager.
+  mComposition = nsIMEStateManager::GetTextCompositionFor(aEvent);
+  if (!mComposition) {
+    MOZ_CRASH("nsIMEStateManager doesn't return proper composition");
+  }
+  mComposition->StartHandlingComposition(this);
+}
 
 nsresult
-nsEditor::BeginIMEComposition()
+nsEditor::BeginIMEComposition(WidgetCompositionEvent* aCompositionEvent)
 {
-  mInIMEMode = true;
+  MOZ_ASSERT(!mComposition, "There is composition already");
+  EnsureComposition(aCompositionEvent);
   if (mPhonetic) {
     mPhonetic->Truncate(0);
   }
@@ -2024,7 +2041,7 @@ nsEditor::BeginIMEComposition()
 void
 nsEditor::EndIMEComposition()
 {
-  NS_ENSURE_TRUE_VOID(mInIMEMode); // nothing to do
+  NS_ENSURE_TRUE_VOID(mComposition); // nothing to do
 
   // commit the IME transaction..we can get at it via the transaction mgr.
   // Note that this means IME won't work without an undo stack!
@@ -2041,9 +2058,8 @@ nsEditor::EndIMEComposition()
   /* reset the data we need to construct a transaction */
   mIMETextNode = nullptr;
   mIMETextOffset = 0;
-  mIMEBufferLength = 0;
-  mInIMEMode = false;
-  mIsIMEComposing = false;
+  mComposition->EndHandlingComposition(this);
+  mComposition = nullptr;
 
   // notify editor observers of action
   NotifyEditorObservers();
@@ -2073,7 +2089,7 @@ nsEditor::ForceCompositionEnd()
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (!mInIMEMode) {
+  if (!mComposition) {
     // XXXmnakano see bug 558976, ResetInputState() has two meaning which are
     // "commit the composition" and "cursor is moved".  This method name is
     // "ForceCompositionEnd", so, ResetInputState() should be used only for the
@@ -2312,7 +2328,7 @@ nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
 
   NS_ENSURE_TRUE(aInOutNode && *aInOutNode && aInOutOffset && aDoc,
                  NS_ERROR_NULL_POINTER);
-  if (!mInIMEMode && aStringToInsert.IsEmpty()) {
+  if (!mComposition && aStringToInsert.IsEmpty()) {
     return NS_OK;
   }
 
@@ -2352,7 +2368,7 @@ nsEditor::InsertTextImpl(const nsAString& aStringToInsert,
   }
 
   nsresult res;
-  if (mInIMEMode) {
+  if (mComposition) {
     if (!node->IsNodeOfType(nsINode::eTEXT)) {
       // create a text node
       nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
@@ -2407,7 +2423,7 @@ nsresult nsEditor::InsertTextIntoTextNodeImpl(const nsAString& aStringToInsert,
   bool isIMETransaction = false;
   // aSuppressIME is used when editor must insert text, yet this text is not
   // part of current ime operation.  example: adjusting whitespace around an ime insertion.
-  if (mIMETextRangeList && mInIMEMode && !aSuppressIME)
+  if (mIMETextRangeList && mComposition && !aSuppressIME)
   {
     if (!mIMETextNode)
     {
@@ -4179,45 +4195,16 @@ nsEditor::DeleteSelectionAndCreateNode(const nsAString& aTag,
 
 /* Non-interface, protected methods */
 
-int32_t
-nsEditor::GetIMEBufferLength()
+TextComposition*
+nsEditor::GetComposition() const
 {
-  return mIMEBufferLength;
-}
-
-void
-nsEditor::SetIsIMEComposing(){  
-  // We set mIsIMEComposing according to mIMETextRangeList.
-  nsCOMPtr<nsIPrivateTextRange> rangePtr;
-  uint16_t listlen, type;
-
-  mIsIMEComposing = false;
-  listlen = mIMETextRangeList->GetLength();
-
-  for (uint16_t i = 0; i < listlen; i++)
-  {
-      rangePtr = mIMETextRangeList->Item(i);
-      if (!rangePtr) continue;
-      nsresult result = rangePtr->GetRangeType(&type);
-      if (NS_FAILED(result)) continue;
-      if ( type == nsIPrivateTextRange::TEXTRANGE_RAWINPUT ||
-           type == nsIPrivateTextRange::TEXTRANGE_CONVERTEDTEXT ||
-           type == nsIPrivateTextRange::TEXTRANGE_SELECTEDRAWTEXT ||
-           type == nsIPrivateTextRange::TEXTRANGE_SELECTEDCONVERTEDTEXT )
-      {
-        mIsIMEComposing = true;
-#ifdef DEBUG_IME
-        printf("nsEditor::mIsIMEComposing = true\n");
-#endif
-        break;
-      }
-  }
-  return;
+  return mComposition;
 }
 
 bool
-nsEditor::IsIMEComposing() {
-  return mIsIMEComposing;
+nsEditor::IsIMEComposing() const
+{
+  return mComposition && mComposition->IsComposing();
 }
 
 nsresult
@@ -4414,7 +4401,9 @@ nsEditor::CreateTxnForIMEText(const nsAString& aStringToInsert,
      
   nsRefPtr<IMETextTxn> txn = new IMETextTxn();
 
-  nsresult rv = txn->Init(mIMETextNode, mIMETextOffset, mIMEBufferLength,
+  // During handling IME composition, mComposition must have been initialized.
+  nsresult rv = txn->Init(mIMETextNode, mIMETextOffset,
+                          mComposition->String().Length(),
                           mIMETextRangeList, aStringToInsert, this);
   if (NS_SUCCEEDED(rv))
   {
@@ -5225,6 +5214,23 @@ nsEditor::IsAcceptableInputEvent(nsIDOMEvent* aEvent)
     if (!focusedContent) {
       return false;
     }
+  } else {
+    nsAutoString eventType;
+    aEvent->GetType(eventType);
+    // If composition event or text event isn't dispatched via widget,
+    // we need to ignore them since they cannot be managed by TextComposition.
+    // E.g., the event was created by chrome JS.
+    // Note that if we allow to handle such events, editor may be confused by
+    // strange event order.
+    if (eventType.EqualsLiteral("text") ||
+        eventType.EqualsLiteral("compositionstart") ||
+        eventType.EqualsLiteral("compositionend")) {
+      WidgetGUIEvent* widgetGUIEvent =
+        aEvent->GetInternalNSEvent()->AsGUIEvent();
+      if (!widgetGUIEvent || !widgetGUIEvent->widget) {
+        return false;
+      }
+    }
   }
 
   bool isTrusted;

editor/libeditor/base/nsEditor.h

@@ -69,6 +69,7 @@ class nsTransactionManager;
 
 namespace mozilla {
 class Selection;
+class TextComposition;
 
 namespace dom {
 class Element;
@@ -242,9 +243,8 @@ public:
                              mozilla::dom::Element** aContent);
 
   // IME event handlers
-  virtual nsresult BeginIMEComposition();
-  virtual nsresult UpdateIMEComposition(const nsAString &aCompositionString,
-                                        nsIPrivateTextRangeList *aTextRange)=0;
+  virtual nsresult BeginIMEComposition(mozilla::WidgetCompositionEvent* aEvent);
+  virtual nsresult UpdateIMEComposition(nsIDOMEvent* aDOMTextEvent) = 0;
   void EndIMEComposition();
 
   void SwitchTextDirectionTo(uint32_t aDirection);
@@ -413,6 +413,13 @@ protected:
     return !IsPasswordEditor() && !IsReadonly() && !IsDisabled() && !ShouldSkipSpellCheck();
   }
 
+  /**
+   * EnsureComposition() should be composition event handlers or text event
+   * handler.  This tries to get the composition for the event and set it to
+   * mComposition.
+   */
+  void EnsureComposition(mozilla::WidgetGUIEvent* aEvent);
+
 public:
 
   /** All editor operations which alter the doc should be prefaced
@@ -592,9 +599,14 @@ public:
   /** Find the deep first and last children. */
   nsINode* GetFirstEditableNode(nsINode* aRoot);
 
-  int32_t GetIMEBufferLength();
-  bool IsIMEComposing();    /* test if IME is in composition state */
-  void SetIsIMEComposing(); /* call this before |IsIMEComposing()| */
+  /**
+   * Returns current composition.
+   */
+  mozilla::TextComposition* GetComposition() const;
+  /**
+   * Returns true if there is composition string and not fixed.
+   */
+  bool IsIMEComposing() const;
 
   /** from html rules code - migration in progress */
   static nsresult GetTagString(nsIDOMNode *aNode, nsAString& outString);
@@ -830,6 +842,9 @@ protected:
   nsIAtom          *mPlaceHolderName;    // name of placeholder transaction
   nsSelectionState *mSelState;           // saved selection state for placeholder txn batching
   nsString         *mPhonetic;
+  // IME composition this is not null between compositionstart and
+  // compositionend.
+  nsRefPtr<mozilla::TextComposition> mComposition;
 
   // various listeners
   nsCOMArray<nsIEditActionListener> mActionListeners;  // listens to all low level actions on the doc
@@ -848,16 +863,11 @@ protected:
   EditAction        mAction;             // the current editor action
 
   uint32_t          mIMETextOffset;    // offset in text node where IME comp string begins
-  uint32_t          mIMEBufferLength;  // current length of IME comp string
 
   EDirection        mDirection;          // the current direction of editor action
   int8_t            mDocDirtyState;      // -1 = not initialized
   uint8_t           mSpellcheckCheckboxState; // a Tristate value
 
-  bool mInIMEMode;        // are we inside an IME composition?
-  bool mIsIMEComposing;   // is IME in composition state?
-                                                       // This is different from mInIMEMode. see Bug 98434.
-
   bool mShouldTxnSetSelection;  // turn off for conservative selection adjustment by txns
   bool mDidPreDestroy;    // whether PreDestroy has been called
   bool mDidPostCreate;    // whether PostCreate has been called

editor/libeditor/base/nsEditorEventListener.cpp

@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Preferences.h"        // for Preferences
+#include "mozilla/TextEvents.h"         // for WidgetCompositionEvent
 #include "mozilla/dom/Element.h"        // for Element
 #include "mozilla/dom/EventTarget.h"    // for EventTarget
 #include "nsAString.h"
@@ -42,8 +43,6 @@
 #include "nsINode.h"                    // for nsINode, ::NODE_IS_EDITABLE, etc
 #include "nsIPlaintextEditor.h"         // for nsIPlaintextEditor, etc
 #include "nsIPresShell.h"               // for nsIPresShell
-#include "nsIPrivateTextEvent.h"        // for nsIPrivateTextEvent
-#include "nsIPrivateTextRange.h"        // for nsIPrivateTextRangeList
 #include "nsISelection.h"               // for nsISelection
 #include "nsISelectionController.h"     // for nsISelectionController, etc
 #include "nsISelectionPrivate.h"        // for nsISelectionPrivate
@@ -661,24 +660,12 @@ nsEditorEventListener::HandleText(nsIDOMEvent* aTextEvent)
     return NS_OK;
   }
 
-  nsCOMPtr<nsIPrivateTextEvent> textEvent = do_QueryInterface(aTextEvent);
-  if (!textEvent) {
-     //non-ui event passed in.  bad things.
-     return NS_OK;
-  }
-
-  nsAutoString                      composedText;
-  nsCOMPtr<nsIPrivateTextRangeList> textRangeList;
-
-  textEvent->GetText(composedText);
-  textRangeList = textEvent->GetInputRange();
-
   // if we are readonly or disabled, then do nothing.
   if (mEditor->IsReadonly() || mEditor->IsDisabled()) {
     return NS_OK;
   }
 
-  return mEditor->UpdateIMEComposition(composedText, textRangeList);
+  return mEditor->UpdateIMEComposition(aTextEvent);
 }
 
 /**
@@ -905,7 +892,9 @@ nsEditorEventListener::HandleStartComposition(nsIDOMEvent* aCompositionEvent)
   if (!mEditor->IsAcceptableInputEvent(aCompositionEvent)) {
     return NS_OK;
   }
-  return mEditor->BeginIMEComposition();
+  WidgetCompositionEvent* compositionStart =
+    aCompositionEvent->GetInternalNSEvent()->AsCompositionEvent();
+  return mEditor->BeginIMEComposition(compositionStart);
 }
 
 void

editor/libeditor/text/moz.build

@@ -20,6 +20,7 @@ FAIL_ON_WARNINGS = True
 LOCAL_INCLUDES += [
     '../base',
     '/content/base/src',
+    '/dom/events',
     '/editor/txmgr/src',
 ]
 

editor/libeditor/text/nsPlaintextEditor.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
+#include "TextComposition.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Selection.h"
@@ -39,6 +40,7 @@
 #include "nsINameSpaceManager.h"
 #include "nsINode.h"
 #include "nsIPresShell.h"
+#include "nsIPrivateTextEvent.h"
 #include "nsIPrivateTextRange.h"
 #include "nsISelection.h"
 #include "nsISelectionController.h"
@@ -695,8 +697,7 @@ NS_IMETHODIMP nsPlaintextEditor::InsertText(const nsAString &aStringToInsert)
   nsCOMPtr<nsIEditRules> kungFuDeathGrip(mRules);
 
   EditAction opID = EditAction::insertText;
-  if (mInIMEMode) 
-  {
+  if (mComposition) {
     opID = EditAction::insertIMEText;
   }
   nsAutoPlaceHolderBatch batch(this, nullptr); 
@@ -811,9 +812,9 @@ NS_IMETHODIMP nsPlaintextEditor::InsertLineBreak()
 }
 
 nsresult
-nsPlaintextEditor::BeginIMEComposition()
+nsPlaintextEditor::BeginIMEComposition(WidgetCompositionEvent* aEvent)
 {
-  NS_ENSURE_TRUE(!mInIMEMode, NS_OK);
+  NS_ENSURE_TRUE(!mComposition, NS_OK);
 
   if (IsPasswordEditor()) {
     NS_ENSURE_TRUE(mRules, NS_ERROR_NULL_POINTER);
@@ -825,14 +826,19 @@ nsPlaintextEditor::BeginIMEComposition()
     textEditRules->ResetIMETextPWBuf();
   }
 
-  return nsEditor::BeginIMEComposition();
+  return nsEditor::BeginIMEComposition(aEvent);
 }
 
 nsresult
-nsPlaintextEditor::UpdateIMEComposition(const nsAString& aCompositionString,
-                                        nsIPrivateTextRangeList* aTextRangeList)
+nsPlaintextEditor::UpdateIMEComposition(nsIDOMEvent* aDOMTextEvent)
 {
-  NS_ABORT_IF_FALSE(aTextRangeList, "aTextRangeList must not be nullptr");
+  NS_ABORT_IF_FALSE(aDOMTextEvent, "aDOMTextEvent must not be nullptr");
+
+  WidgetTextEvent* widgetTextEvent =
+    aDOMTextEvent->GetInternalNSEvent()->AsTextEvent();
+  NS_ENSURE_TRUE(widgetTextEvent, NS_ERROR_INVALID_ARG);
+
+  EnsureComposition(widgetTextEvent);
 
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   NS_ENSURE_TRUE(ps, NS_ERROR_NOT_INITIALIZED);
@@ -843,19 +849,23 @@ nsPlaintextEditor::UpdateIMEComposition(const nsAString& aCompositionString,
 
   nsRefPtr<nsCaret> caretP = ps->GetCaret();
 
-  // Update information of clauses in the new composition string.
-  // This will be refered by followed methods.
-  mIMETextRangeList = aTextRangeList;
-
-  // We set mIsIMEComposing properly.
-  SetIsIMEComposing();
+  nsCOMPtr<nsIPrivateTextEvent> privateTextEvent =
+    do_QueryInterface(aDOMTextEvent);
+  NS_ENSURE_TRUE(privateTextEvent, NS_ERROR_INVALID_ARG);
 
   {
+    TextComposition::TextEventHandlingMarker
+      textEventHandlingMarker(mComposition, widgetTextEvent);
+
+    // Update information of clauses in the new composition string.
+    // This will be refered by followed methods.
+    mIMETextRangeList = privateTextEvent->GetInputRange();
+    NS_ABORT_IF_FALSE(mIMETextRangeList,
+                      "mIMETextRangeList must not be nullptr");
+
     nsAutoPlaceHolderBatch batch(this, nsGkAtoms::IMETxnName);
 
-    rv = InsertText(aCompositionString);
-
-    mIMEBufferLength = aCompositionString.Length();
+    rv = InsertText(widgetTextEvent->theText);
 
     if (caretP) {
       caretP->SetCaretDOMSelection(selection);
@@ -866,7 +876,7 @@ nsPlaintextEditor::UpdateIMEComposition(const nsAString& aCompositionString,
   // Note that if committed, we don't need to notify it since it will be
   // notified at followed compositionend event.
   // NOTE: We must notify after the auto batch will be gone.
-  if (mIsIMEComposing) {
+  if (IsIMEComposing()) {
     NotifyEditorObservers();
   }
 

editor/libeditor/text/nsPlaintextEditor.h

@@ -122,9 +122,8 @@ public:
 
   virtual already_AddRefed<mozilla::dom::EventTarget> GetDOMEventTarget();
 
-  virtual nsresult BeginIMEComposition();
-  virtual nsresult UpdateIMEComposition(const nsAString &aCompositionString,
-                                        nsIPrivateTextRangeList *aTextRange);
+  virtual nsresult BeginIMEComposition(mozilla::WidgetCompositionEvent* aEvent);
+  virtual nsresult UpdateIMEComposition(nsIDOMEvent* aTextEvent) MOZ_OVERRIDE;
 
   virtual already_AddRefed<nsIContent> GetInputEventTargetContent();
 

editor/libeditor/text/nsTextEditRules.cpp

@@ -3,6 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "TextComposition.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/LookAndFeel.h"
 #include "mozilla/Preferences.h"
@@ -1208,7 +1209,8 @@ nsTextEditRules::TruncateInsertionIfNeeded(Selection* aSelection,
     nsContentUtils::GetSelectionInTextControl(aSelection, mEditor->GetRoot(),
                                               start, end);
 
-    int32_t oldCompStrLength = mEditor->GetIMEBufferLength();
+    TextComposition* composition = mEditor->GetComposition();
+    int32_t oldCompStrLength = composition ? composition->String().Length() : 0;
 
     const int32_t selectionLength = end - start;
     const int32_t resultingDocLength = docLength - selectionLength - oldCompStrLength;

gfx/2d/DrawTargetD2D1.cpp

@@ -3,6 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <initguid.h>
 #include "DrawTargetD2D1.h"
 #include "DrawTargetD2D.h"
 #include "FilterNodeSoftware.h"

gfx/2d/RadialGradientEffectD2D1.cpp

@@ -50,11 +50,11 @@ static const PCWSTR kXmlDescription =
         );
 
 // {FB947CDA-718E-40CC-AE7B-D255830D7D14}
-DEFINE_GUID(GUID_SampleRadialGradientPS, 
-0xfb947cda, 0x718e, 0x40cc, 0xae, 0x7b, 0xd2, 0x55, 0x83, 0xd, 0x7d, 0x14);
+static const GUID GUID_SampleRadialGradientPS =
+  {0xfb947cda, 0x718e, 0x40cc, {0xae, 0x7b, 0xd2, 0x55, 0x83, 0xd, 0x7d, 0x14}};
 // {2C468128-6546-453C-8E25-F2DF0DE10A0F}
-DEFINE_GUID(GUID_SampleRadialGradientA0PS, 
-0x2c468128, 0x6546, 0x453c, 0x8e, 0x25, 0xf2, 0xdf, 0xd, 0xe1, 0xa, 0xf);
+static const GUID GUID_SampleRadialGradientA0PS =
+  {0x2c468128, 0x6546, 0x453c, {0x8e, 0x25, 0xf2, 0xdf, 0xd, 0xe1, 0xa, 0xf}};
 
 namespace mozilla {
 namespace gfx {

gfx/2d/gfx2d.vcxproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
@@ -42,7 +42,7 @@
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
-      <PreprocessorDefinitions>INITGUID;USE_SSE2;WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions);GFX_LOG_DEBUG;GFX_LOG_WARNING;MFBT_STAND_ALONE;XP_WIN</PreprocessorDefinitions>
+      <PreprocessorDefinitions>USE_SSE2;WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions);GFX_LOG_DEBUG;GFX_LOG_WARNING;MFBT_STAND_ALONE;XP_WIN</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
       <WarningLevel>Level3</WarningLevel>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
@@ -62,7 +62,7 @@
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
-      <PreprocessorDefinitions>INITGUID;USE_SSE2;WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>USE_SSE2;WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
       <WarningLevel>Level3</WarningLevel>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>

gfx/2d/moz.build

@@ -52,7 +52,6 @@ elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
         'SourceSurfaceD2DTarget.cpp',
     ]
     DEFINES['WIN32'] = True
-    DEFINES['INITGUID'] = True
     # For Direct2D 1.1 we require WINSDK_MAXVER 0x06020000 or higher.
     if CONFIG['MOZ_ENABLE_DIRECT2D1_1']:
         SOURCES += [

gfx/gl/GLContext.cpp

@@ -76,6 +76,7 @@ static const char *sExtensionNames[] = {
     "GL_IMG_read_format",
     "GL_EXT_read_format_bgra",
     "GL_APPLE_client_storage",
+    "GL_APPLE_texture_range",
     "GL_ARB_texture_non_power_of_two",
     "GL_ARB_pixel_buffer_object",
     "GL_ARB_ES2_compatibility",
@@ -756,6 +757,17 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             }
         }
 
+        if (IsExtensionSupported(APPLE_texture_range)) {
+            SymLoadStruct vaoSymbols[] = {
+                { (PRFuncPtr*) &mSymbols.fTextureRangeAPPLE, { "TextureRangeAPPLE", nullptr } },
+                { nullptr, { nullptr } },
+            };
+
+            if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
+                mSymbols.fTextureRangeAPPLE = nullptr;
+            }
+        }
+
         if (IsExtensionSupported(ARB_vertex_array_object) ||
             IsExtensionSupported(OES_vertex_array_object)) {
             SymLoadStruct vaoSymbols[] = {

gfx/gl/GLContext.h

@@ -352,6 +352,7 @@ public:
         IMG_read_format,
         EXT_read_format_bgra,
         APPLE_client_storage,
+        APPLE_texture_range,
         ARB_texture_non_power_of_two,
         ARB_pixel_buffer_object,
         ARB_ES2_compatibility,
@@ -1344,6 +1345,12 @@ public:
         AFTER_GL_CALL;
     }
 
+    void fTextureRangeAPPLE(GLenum target, GLsizei length, GLvoid *pointer) {
+        BEFORE_GL_CALL;
+        mSymbols.fTextureRangeAPPLE(target, length, pointer);
+        AFTER_GL_CALL;
+    }
+
     void fPointParameterf(GLenum pname, GLfloat param) {
         BEFORE_GL_CALL;
         mSymbols.fPointParameterf(pname, param);

gfx/gl/GLContextSymbols.h

@@ -211,6 +211,8 @@ struct GLContextSymbols
     PFNGLTEXIMAGE2DPROC fTexImage2D;
     typedef void (GLAPIENTRY * PFNGLTEXSUBIMAGE2DPROC) (GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, const void* pixels);
     PFNGLTEXSUBIMAGE2DPROC fTexSubImage2D;
+    typedef void (GLAPIENTRY * PFNGLTEXTURERANGEAPPLEPROC) (GLenum target, GLsizei length, GLvoid *pointer);
+    PFNGLTEXTURERANGEAPPLEPROC fTextureRangeAPPLE;
     typedef void (GLAPIENTRY * PFNGLUNIFORM1FPROC) (GLint location, GLfloat v0);
     PFNGLUNIFORM1FPROC fUniform1f;
     typedef void (GLAPIENTRY * PFNGLUNIFORM1FVPROC) (GLint location, GLsizei count, const GLfloat* value);

gfx/gl/GLScreenBuffer.cpp

@@ -20,6 +20,7 @@
 #include "SharedSurfaceIO.h"
 #endif
 #include "ScopedGLHelpers.h"
+#include "gfx2DGlue.h"
 
 using namespace mozilla::gfx;
 
@@ -478,9 +479,22 @@ GLScreenBuffer::CreateRead(SharedSurface_GL* surf)
     return ReadBuffer::Create(gl, caps, formats, surf);
 }
 
+void
+GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest)
+{
+  MOZ_ASSERT(src && dest);
+  DataSourceSurface::MappedSurface ms;
+  dest->Map(DataSourceSurface::MapType::READ, &ms);
+  nsRefPtr<gfxImageSurface> wrappedDest =
+    new gfxImageSurface(ms.mData,
+                        ThebesIntSize(dest->GetSize()),
+                        ms.mStride,
+                        SurfaceFormatToImageFormat(dest->GetFormat()));
+  DeprecatedReadback(src, wrappedDest);
+}
 
 void
-GLScreenBuffer::Readback(SharedSurface_GL* src, gfxImageSurface* dest)
+GLScreenBuffer::DeprecatedReadback(SharedSurface_GL* src, gfxImageSurface* dest)
 {
     MOZ_ASSERT(src && dest);
     MOZ_ASSERT(ToIntSize(dest->GetSize()) == src->Size());
@@ -509,8 +523,6 @@ GLScreenBuffer::Readback(SharedSurface_GL* src, gfxImageSurface* dest)
     }
 }
 
-
-
 DrawBuffer*
 DrawBuffer::Create(GLContext* const gl,
                    const SurfaceCaps& caps,

gfx/gl/GLScreenBuffer.h

@@ -18,6 +18,7 @@
 #include "SurfaceTypes.h"
 #include "GLContextTypes.h"
 #include "GLDefs.h"
+#include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Point.h"
 
 // Forwards:
@@ -277,7 +278,8 @@ public:
 
     bool Resize(const gfx::IntSize& size);
 
-    void Readback(SharedSurface_GL* src, gfxImageSurface* dest);
+    void Readback(SharedSurface_GL* src, gfx::DataSourceSurface* dest);
+    void DeprecatedReadback(SharedSurface_GL* src, gfxImageSurface* dest);
 
 protected:
     void Attach(SharedSurface* surface, const gfx::IntSize& size);

gfx/layers/CopyableCanvasLayer.cpp

@@ -22,6 +22,7 @@
 #include "nsISupportsImpl.h"            // for gfxContext::AddRef, etc
 #include "nsRect.h"                     // for nsIntRect
 #include "nsSize.h"                     // for nsIntSize
+#include "LayerUtils.h"
 
 using namespace mozilla::gfx;
 using namespace mozilla::gl;
@@ -56,7 +57,8 @@ CopyableCanvasLayer::Initialize(const Data& aData)
     // `GLScreenBuffer::Morph`ing is only needed in BasicShadowableCanvasLayer.
   } else if (aData.mDrawTarget) {
     mDrawTarget = aData.mDrawTarget;
-    mSurface =
+    mSurface = mDrawTarget->Snapshot();
+    mDeprecatedSurface =
       gfxPlatform::GetPlatform()->CreateThebesSurfaceAliasForDrawTarget_hack(mDrawTarget);
     mNeedsYFlip = false;
   } else {
@@ -73,7 +75,8 @@ CopyableCanvasLayer::IsDataValid(const Data& aData)
 }
 
 void
-CopyableCanvasLayer::UpdateSurface(gfxASurface* aDestSurface, Layer* aMaskLayer)
+CopyableCanvasLayer::UpdateTarget(DrawTarget* aDestTarget,
+                                  SourceSurface* aMaskSurface)
 {
   if (!IsDirty())
     return;
@@ -81,14 +84,105 @@ CopyableCanvasLayer::UpdateSurface(gfxASurface* aDestSurface, Layer* aMaskLayer)
 
   if (mDrawTarget) {
     mDrawTarget->Flush();
-    mSurface =
+    mSurface = mDrawTarget->Snapshot();
+  }
+
+  if (!mGLContext && aDestTarget) {
+    PaintWithOpacity(aDestTarget, 1.0f, aMaskSurface);
+    return;
+  }
+
+  if (mGLContext) {
+    RefPtr<DataSourceSurface> readSurf;
+    RefPtr<SourceSurface> resultSurf;
+
+    SharedSurface* sharedSurf = mGLContext->RequestFrame();
+    if (!sharedSurf) {
+      NS_WARNING("Null frame received.");
+      return;
+    }
+
+    IntSize readSize(sharedSurf->Size());
+    SurfaceFormat format = (GetContentFlags() & CONTENT_OPAQUE)
+                            ? SurfaceFormat::B8G8R8X8
+                            : SurfaceFormat::B8G8R8A8;
+
+    if (aDestTarget) {
+      resultSurf = aDestTarget->Snapshot();
+      if (!resultSurf) {
+        resultSurf = GetTempSurface(readSize, format);
+      }
+    } else {
+      resultSurf = GetTempSurface(readSize, format);
+    }
+    MOZ_ASSERT(resultSurf);
+    MOZ_ASSERT(sharedSurf->APIType() == APITypeT::OpenGL);
+    SharedSurface_GL* surfGL = SharedSurface_GL::Cast(sharedSurf);
+
+    if (surfGL->Type() == SharedSurfaceType::Basic) {
+      // sharedSurf_Basic->mData must outlive readSurf. Alas, readSurf may not
+      // leave the scope it was declared in.
+      SharedSurface_Basic* sharedSurf_Basic = SharedSurface_Basic::Cast(surfGL);
+      readSurf = sharedSurf_Basic->GetData();
+    } else {
+      if (resultSurf->GetSize() != readSize ||
+          !(readSurf = resultSurf->GetDataSurface()) ||
+          readSurf->GetFormat() != format)
+      {
+        readSurf = GetTempSurface(readSize, format);
+      }
+
+      // Readback handles Flush/MarkDirty.
+      mGLContext->Screen()->Readback(surfGL, readSurf);
+    }
+    MOZ_ASSERT(readSurf);
+
+    bool needsPremult = surfGL->HasAlpha() && !mIsGLAlphaPremult;
+    if (needsPremult) {
+      PremultiplySurface(readSurf);
+    }
+
+    if (readSurf != resultSurf) {
+      RefPtr<DataSourceSurface> resultDataSurface =
+        resultSurf->GetDataSurface();
+      RefPtr<DrawTarget> dt =
+        Factory::CreateDrawTargetForData(BackendType::CAIRO,
+                                         resultDataSurface->GetData(),
+                                         resultDataSurface->GetSize(),
+                                         resultDataSurface->Stride(),
+                                         resultDataSurface->GetFormat());
+      IntSize readSize = readSurf->GetSize();
+      Rect r(0, 0, readSize.width, readSize.height);
+      DrawOptions opts(1.0f, CompositionOp::OP_SOURCE, AntialiasMode::DEFAULT);
+      dt->DrawSurface(readSurf, r, r, DrawSurfaceOptions(), opts);
+    }
+
+    // If !aDestSurface then we will end up painting using mSurface, so
+    // stick our surface into mSurface, so that the Paint() path is the same.
+    if (!aDestTarget) {
+      mSurface = resultSurf;
+    }
+  }
+}
+
+void
+CopyableCanvasLayer::DeprecatedUpdateSurface(gfxASurface* aDestSurface,
+                                             Layer* aMaskLayer)
+{
+  if (!IsDirty())
+    return;
+  Painted();
+
+  if (mDrawTarget) {
+    mDrawTarget->Flush();
+    mDeprecatedSurface =
       gfxPlatform::GetPlatform()->CreateThebesSurfaceAliasForDrawTarget_hack(mDrawTarget);
   }
 
   if (!mGLContext && aDestSurface) {
     nsRefPtr<gfxContext> tmpCtx = new gfxContext(aDestSurface);
     tmpCtx->SetOperator(gfxContext::OPERATOR_SOURCE);
-    CopyableCanvasLayer::PaintWithOpacity(tmpCtx, 1.0f, aMaskLayer);
+    DeprecatedPaintWithOpacity(tmpCtx, 1.0f, aMaskLayer);
     return;
   }
 
@@ -111,7 +205,7 @@ CopyableCanvasLayer::UpdateSurface(gfxASurface* aDestSurface, Layer* aMaskLayer)
     if (aDestSurface) {
       resultSurf = aDestSurface;
     } else {
-      resultSurf = GetTempSurface(readSize, format);
+      resultSurf = DeprecatedGetTempSurface(readSize, format);
     }
     MOZ_ASSERT(resultSurf);
     if (resultSurf->CairoStatus() != 0) {
@@ -136,11 +230,11 @@ CopyableCanvasLayer::UpdateSurface(gfxASurface* aDestSurface, Layer* aMaskLayer)
           !(readSurf = resultSurf->GetAsImageSurface()) ||
           readSurf->Format() != format)
       {
-        readSurf = GetTempSurface(readSize, format);
+        readSurf = DeprecatedGetTempSurface(readSize, format);
       }
 
       // Readback handles Flush/MarkDirty.
-      mGLContext->Screen()->Readback(surfGL, readSurf);
+      mGLContext->Screen()->DeprecatedReadback(surfGL, readSurf);
     }
     MOZ_ASSERT(readSurf);
 
@@ -162,23 +256,69 @@ CopyableCanvasLayer::UpdateSurface(gfxASurface* aDestSurface, Layer* aMaskLayer)
     // If !aDestSurface then we will end up painting using mSurface, so
     // stick our surface into mSurface, so that the Paint() path is the same.
     if (!aDestSurface) {
-      mSurface = resultSurf;
+      mDeprecatedSurface = resultSurf;
     }
   }
 }
 
 void
-CopyableCanvasLayer::PaintWithOpacity(gfxContext* aContext,
+CopyableCanvasLayer::PaintWithOpacity(gfx::DrawTarget* aTarget,
                                       float aOpacity,
-                                      Layer* aMaskLayer,
-                                      gfxContext::GraphicsOperator aOperator)
+                                      SourceSurface* aMaskSurface,
+                                      gfx::CompositionOp aOperator)
 {
   if (!mSurface) {
     NS_WARNING("No valid surface to draw!");
     return;
   }
 
-  nsRefPtr<gfxPattern> pat = new gfxPattern(mSurface);
+  SurfacePattern pat(mSurface, ExtendMode::CLAMP, Matrix(), ToFilter(mFilter));
+
+  Matrix oldTransform;
+  if (mNeedsYFlip) {
+    oldTransform = aTarget->GetTransform();
+    Matrix flipped = oldTransform;
+    flipped.Translate(0, mBounds.height);
+    flipped.Scale(1.0, -1.0);
+    aTarget->SetTransform(flipped);
+  }
+
+  DrawOptions options = DrawOptions(aOpacity, CompositionOp::OP_SOURCE);
+
+  // If content opaque, then save off current operator and set to source.
+  // This ensures that alpha is not applied even if the source surface
+  // has an alpha channel
+  if (GetContentFlags() & CONTENT_OPAQUE) {
+    options.mCompositionOp = CompositionOp::OP_SOURCE;
+  }
+
+  if (aOperator != CompositionOp::OP_OVER) {
+    options.mCompositionOp = aOperator;
+  }
+
+  Rect rect = Rect(0, 0, mBounds.width, mBounds.height);
+  aTarget->FillRect(rect, pat, options);
+  if (aMaskSurface) {
+    aTarget->MaskSurface(pat, aMaskSurface, Point(0, 0), options);
+  }
+
+  if (mNeedsYFlip) {
+    aTarget->SetTransform(oldTransform);
+  }
+}
+
+void
+CopyableCanvasLayer::DeprecatedPaintWithOpacity(gfxContext* aContext,
+                                                float aOpacity,
+                                                Layer* aMaskLayer,
+                                                gfxContext::GraphicsOperator aOperator)
+{
+  if (!mDeprecatedSurface) {
+    NS_WARNING("No valid surface to draw!");
+    return;
+  }
+
+  nsRefPtr<gfxPattern> pat = new gfxPattern(mDeprecatedSurface);
 
   pat->SetFilter(mFilter);
   pat->SetExtend(gfxPattern::EXTEND_PAD);
@@ -216,27 +356,50 @@ CopyableCanvasLayer::PaintWithOpacity(gfxContext* aContext,
   }
 }
 
-gfxImageSurface*
-CopyableCanvasLayer::GetTempSurface(const IntSize& aSize, const gfxImageFormat aFormat)
+DataSourceSurface*
+CopyableCanvasLayer::GetTempSurface(const IntSize& aSize,
+                                    const SurfaceFormat aFormat)
 {
   if (!mCachedTempSurface ||
       aSize.width != mCachedSize.width ||
       aSize.height != mCachedSize.height ||
       aFormat != mCachedFormat)
   {
-    mCachedTempSurface = new gfxImageSurface(ThebesIntSize(aSize), aFormat);
+    mCachedTempSurface = Factory::CreateDataSourceSurface(aSize, aFormat);
     mCachedSize = aSize;
     mCachedFormat = aFormat;
   }
 
-  MOZ_ASSERT(mCachedTempSurface->Stride() == mCachedTempSurface->Width() * 4);
+  MOZ_ASSERT(mCachedTempSurface->Stride() ==
+             mCachedTempSurface->GetSize().width * 4);
   return mCachedTempSurface;
 }
 
+gfxImageSurface*
+CopyableCanvasLayer::DeprecatedGetTempSurface(const IntSize& aSize,
+                                              const gfxImageFormat aFormat)
+{
+  if (!mDeprecatedCachedTempSurface ||
+      aSize.width != mCachedSize.width ||
+      aSize.height != mCachedSize.height ||
+      aFormat != mDeprecatedCachedFormat)
+  {
+    mDeprecatedCachedTempSurface =
+      new gfxImageSurface(ThebesIntSize(aSize), aFormat);
+    mCachedSize = aSize;
+    mDeprecatedCachedFormat = aFormat;
+  }
+
+  MOZ_ASSERT(mDeprecatedCachedTempSurface->Stride() ==
+             mDeprecatedCachedTempSurface->Width() * 4);
+  return mDeprecatedCachedTempSurface;
+}
+
 void
 CopyableCanvasLayer::DiscardTempSurface()
 {
   mCachedTempSurface = nullptr;
+  mDeprecatedCachedTempSurface = nullptr;
 }
 
 }

gfx/layers/CopyableCanvasLayer.h

@@ -41,15 +41,16 @@ public:
   virtual bool IsDataValid(const Data& aData);
 
 protected:
-  void PaintWithOpacity(gfxContext* aContext,
+  void PaintWithOpacity(gfx::DrawTarget* aTarget,
                         float aOpacity,
-                        Layer* aMaskLayer,
-                        gfxContext::GraphicsOperator aOperator = gfxContext::OPERATOR_OVER);
+                        gfx::SourceSurface* aMaskSurface,
+                        gfx::CompositionOp aOperator = gfx::CompositionOp::OP_OVER);
 
-  void UpdateSurface(gfxASurface* aDestSurface = nullptr,
-                     Layer* aMaskLayer = nullptr);
+  void UpdateTarget(gfx::DrawTarget* aDestTarget = nullptr,
+                    gfx::SourceSurface* aMaskSurface = nullptr);
 
-  nsRefPtr<gfxASurface> mSurface;
+  RefPtr<gfx::SourceSurface> mSurface;
+  nsRefPtr<gfxASurface> mDeprecatedSurface;
   nsRefPtr<mozilla::gl::GLContext> mGLContext;
   mozilla::RefPtr<mozilla::gfx::DrawTarget> mDrawTarget;
 
@@ -59,13 +60,30 @@ protected:
   bool mNeedsYFlip;
   bool mForceReadback;
 
-  nsRefPtr<gfxImageSurface> mCachedTempSurface;
+  RefPtr<gfx::DataSourceSurface> mCachedTempSurface;
+  nsRefPtr<gfxImageSurface> mDeprecatedCachedTempSurface;
   gfx::IntSize mCachedSize;
-  gfxImageFormat mCachedFormat;
+  gfx::SurfaceFormat mCachedFormat;
+  gfxImageFormat mDeprecatedCachedFormat;
 
-  gfxImageSurface* GetTempSurface(const gfx::IntSize& aSize, const gfxImageFormat aFormat);
+  gfx::DataSourceSurface* GetTempSurface(const gfx::IntSize& aSize,
+                                         const gfx::SurfaceFormat aFormat);
 
   void DiscardTempSurface();
+
+  /* Deprecated thebes methods */
+protected:
+  void DeprecatedPaintWithOpacity(gfxContext* aContext,
+                                  float aOpacity,
+                                  Layer* aMaskLayer,
+                                  gfxContext::GraphicsOperator aOperator = gfxContext::OPERATOR_OVER);
+
+  void DeprecatedUpdateSurface(gfxASurface* aDestSurface = nullptr,
+                               Layer* aMaskLayer = nullptr);
+
+  gfxImageSurface* DeprecatedGetTempSurface(const gfx::IntSize& aSize,
+                                            const gfxImageFormat aFormat);
+
 };
 
 }

gfx/layers/ImageContainer.h

@@ -710,8 +710,8 @@ class AutoLockImage
 {
 public:
   AutoLockImage(ImageContainer *aContainer) : mContainer(aContainer) { mImage = mContainer->LockCurrentImage(); }
-  AutoLockImage(ImageContainer *aContainer, gfxASurface **aSurface) : mContainer(aContainer) {
-    *aSurface = mContainer->DeprecatedLockCurrentAsSurface(&mSize, getter_AddRefs(mImage)).get();
+  AutoLockImage(ImageContainer *aContainer, RefPtr<gfx::SourceSurface> *aSurface) : mContainer(aContainer) {
+    *aSurface = mContainer->LockCurrentAsSourceSurface(&mSize, getter_AddRefs(mImage));
   }
   ~AutoLockImage() { if (mContainer) { mContainer->UnlockCurrentImage(); } }
 

gfx/layers/LayerUtils.cpp

@@ -0,0 +1,79 @@
+/* -*- Mode: c++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "LayerUtils.h"
+#include "PremultiplyTables.h"
+
+namespace mozilla {
+namespace layers {
+
+using namespace mozilla::gfx;
+
+static inline const uint8_t PremultiplyValue(uint8_t a, uint8_t v) {
+  return PremultiplyTable[a*256+v];
+}
+
+static inline const uint8_t UnpremultiplyValue(uint8_t a, uint8_t v) {
+  return UnpremultiplyTable[a*256+v];
+}
+
+void
+PremultiplySurface(DataSourceSurface* srcSurface,
+                   DataSourceSurface* destSurface)
+{
+  if (!destSurface)
+    destSurface = srcSurface;
+
+  IntSize srcSize = srcSurface->GetSize();
+  MOZ_ASSERT(srcSurface->GetFormat() == destSurface->GetFormat() &&
+             srcSize.width  == destSurface->GetSize().width &&
+             srcSize.height  == destSurface->GetSize().height &&
+             srcSurface->Stride() == destSurface->Stride(),
+             "Source and destination surfaces don't have identical characteristics");
+
+  MOZ_ASSERT(srcSurface->Stride() == srcSize.width * 4,
+             "Source surface stride isn't tightly packed");
+
+  // Only premultiply ARGB32
+  if (srcSurface->GetFormat() != SurfaceFormat::B8G8R8A8) {
+    if (destSurface != srcSurface) {
+      memcpy(destSurface->GetData(), srcSurface->GetData(),
+             srcSurface->Stride() * srcSize.height);
+    }
+    return;
+  }
+
+  uint8_t *src = srcSurface->GetData();
+  uint8_t *dst = destSurface->GetData();
+
+  uint32_t dim = srcSize.width * srcSize.height;
+  for (uint32_t i = 0; i < dim; ++i) {
+#ifdef IS_LITTLE_ENDIAN
+    uint8_t b = *src++;
+    uint8_t g = *src++;
+    uint8_t r = *src++;
+    uint8_t a = *src++;
+
+    *dst++ = PremultiplyValue(a, b);
+    *dst++ = PremultiplyValue(a, g);
+    *dst++ = PremultiplyValue(a, r);
+    *dst++ = a;
+#else
+    uint8_t a = *src++;
+    uint8_t r = *src++;
+    uint8_t g = *src++;
+    uint8_t b = *src++;
+
+    *dst++ = a;
+    *dst++ = PremultiplyValue(a, r);
+    *dst++ = PremultiplyValue(a, g);
+    *dst++ = PremultiplyValue(a, b);
+#endif
+  }
+}
+
+
+}
+}

gfx/layers/LayerUtils.h

@@ -0,0 +1,21 @@
+/* -*- Mode: c++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_LAYERS_LAYERUTILS_H_
+#define MOZILLA_LAYERS_LAYERUTILS_H_
+
+#include "mozilla/gfx/2D.h"
+
+namespace mozilla {
+namespace layers {
+
+void
+PremultiplySurface(gfx::DataSourceSurface* srcSurface,
+                   gfx::DataSourceSurface* destSurface = nullptr);
+
+}
+}
+
+#endif /* MOZILLA_LAYERS_LAYERUTILS_H_ */

gfx/layers/Layers.cpp

@@ -169,7 +169,7 @@ Layer::Layer(LayerManager* aManager, void* aImplData) :
   mPostXScale(1.0f),
   mPostYScale(1.0f),
   mOpacity(1.0),
-  mMixBlendMode(gfxContext::OPERATOR_OVER),
+  mMixBlendMode(CompositionOp::OP_OVER),
   mForceIsolatedGroup(false),
   mContentFlags(0),
   mUseClipRect(false),
@@ -670,20 +670,26 @@ Layer::GetEffectiveOpacity()
   return opacity;
 }
   
-gfxContext::GraphicsOperator
+CompositionOp
 Layer::GetEffectiveMixBlendMode()
 {
-  if(mMixBlendMode != gfxContext::OPERATOR_OVER)
+  if(mMixBlendMode != CompositionOp::OP_OVER)
     return mMixBlendMode;
   for (ContainerLayer* c = GetParent(); c && !c->UseIntermediateSurface();
     c = c->GetParent()) {
-    if(c->mMixBlendMode != gfxContext::OPERATOR_OVER)
+    if(c->mMixBlendMode != CompositionOp::OP_OVER)
       return c->mMixBlendMode;
   }
 
   return mMixBlendMode;
 }
 
+gfxContext::GraphicsOperator
+Layer::DeprecatedGetEffectiveMixBlendMode()
+{
+  return ThebesOp(GetEffectiveMixBlendMode());
+}
+
 void
 Layer::ComputeEffectiveTransformForMaskLayer(const Matrix4x4& aTransformToSurface)
 {

gfx/layers/Layers.h

@@ -18,6 +18,7 @@
 #include "GraphicsFilter.h"             // for GraphicsFilter
 #include "gfxPoint.h"                   // for gfxPoint
 #include "gfxRect.h"                    // for gfxRect
+#include "gfx2DGlue.h"
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT_HELPER2, etc
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "mozilla/EventForwards.h"      // for nsPaintEvent
@@ -786,7 +787,7 @@ public:
     }
   }
 
-  void SetMixBlendMode(gfxContext::GraphicsOperator aMixBlendMode)
+  void SetMixBlendMode(gfx::CompositionOp aMixBlendMode)
   {
     if (mMixBlendMode != aMixBlendMode) {
       MOZ_LAYERS_LOG_IF_SHADOWABLE(this, ("Layer::Mutated(%p) MixBlendMode", this));
@@ -795,6 +796,11 @@ public:
     }
   }
   
+  void DeprecatedSetMixBlendMode(gfxContext::GraphicsOperator aMixBlendMode)
+  {
+    SetMixBlendMode(gfx::CompositionOpForOp(aMixBlendMode));
+  }
+
   void SetForceIsolatedGroup(bool aForceIsolatedGroup)
   {
     if(mForceIsolatedGroup != aForceIsolatedGroup) {
@@ -1033,7 +1039,7 @@ public:
 
   // These getters can be used anytime.
   float GetOpacity() { return mOpacity; }
-  gfxContext::GraphicsOperator GetMixBlendMode() const { return mMixBlendMode; }
+  gfx::CompositionOp GetMixBlendMode() const { return mMixBlendMode; }
   const nsIntRect* GetClipRect() { return mUseClipRect ? &mClipRect : nullptr; }
   uint32_t GetContentFlags() { return mContentFlags; }
   const nsIntRegion& GetVisibleRegion() { return mVisibleRegion; }
@@ -1207,7 +1213,8 @@ public:
   /**
    * Returns the blendmode of this layer.
    */
-  gfxContext::GraphicsOperator GetEffectiveMixBlendMode();
+  gfx::CompositionOp GetEffectiveMixBlendMode();
+  gfxContext::GraphicsOperator DeprecatedGetEffectiveMixBlendMode();
   
   /**
    * This returns the effective transform computed by
@@ -1408,7 +1415,7 @@ protected:
   AnimationArray mAnimations;
   InfallibleTArray<AnimData> mAnimationData;
   float mOpacity;
-  gfxContext::GraphicsOperator mMixBlendMode;
+  gfx::CompositionOp mMixBlendMode;
   bool mForceIsolatedGroup;
   nsIntRect mClipRect;
   nsIntRect mTileSourceRect;

gfx/layers/Makefile.in

@@ -13,3 +13,6 @@ CXXFLAGS += \
         $(NULL)
 
 CXXFLAGS += $(MOZ_CAIRO_CFLAGS) $(TK_CFLAGS)
+
+PremultiplyTables.h: $(srcdir)/genTables.py
+	$(PYTHON) $(srcdir)/genTables.py

gfx/layers/RotatedBuffer.cpp

@@ -301,9 +301,17 @@ RotatedContentBuffer::BufferContentType()
 bool
 RotatedContentBuffer::BufferSizeOkFor(const nsIntSize& aSize)
 {
-  return (aSize == mBufferRect.Size() ||
-          (SizedToVisibleBounds != mBufferSizePolicy &&
-           aSize < mBufferRect.Size()));
+  if (aSize == mBufferRect.Size()) {
+    return true;
+  }
+
+  if (SizedToVisibleBounds != mBufferSizePolicy &&
+      aSize < mBufferRect.Size()) {
+    return (aSize.width * 2 > mBufferRect.width) &&
+           (aSize.height * 2 > mBufferRect.height);
+  }
+
+  return false;
 }
 
 bool
@@ -503,8 +511,9 @@ RotatedContentBuffer::BeginPaint(ThebesLayer* aLayer,
   // or call CreateBuffer before this call.
   FinalizeFrame(result.mRegionToDraw);
 
-  if (result.mRegionToDraw.IsEmpty())
+  if (result.mRegionToDraw.IsEmpty()) {
     return result;
+  }
 
   nsIntRect drawBounds = result.mRegionToDraw.GetBounds();
   RefPtr<DrawTarget> destDTBuffer;
@@ -614,7 +623,7 @@ RotatedContentBuffer::BeginPaint(ThebesLayer* aLayer,
       mBufferRotation = nsIntPoint(0,0);
     }
   } else {
-    // The buffer's not big enough, so allocate a new one
+    // The buffer's not big enough or the buffer needs to shrink, so allocate a new one
     CreateBuffer(result.mContentType, destBufferRect, bufferFlags,
                  &destDTBuffer, &destDTBufferOnWhite);
     if (!destDTBuffer) {

gfx/layers/basic/BasicCanvasLayer.cpp

@@ -9,6 +9,8 @@
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsISupportsImpl.h"            // for Layer::AddRef, etc
+#include "gfx2DGlue.h"
+
 class gfxContext;
 
 using namespace mozilla::gfx;
@@ -18,17 +20,39 @@ namespace mozilla {
 namespace layers {
 
 void
-BasicCanvasLayer::Paint(gfxContext* aContext, Layer* aMaskLayer)
+BasicCanvasLayer::Paint(DrawTarget* aTarget, SourceSurface* aMaskSurface)
 {
   if (IsHidden())
     return;
 
   FirePreTransactionCallback();
-  UpdateSurface();
+  UpdateTarget();
   FireDidTransactionCallback();
 
-  gfxContext::GraphicsOperator mixBlendMode = GetEffectiveMixBlendMode();
-  PaintWithOpacity(aContext, GetEffectiveOpacity(), aMaskLayer, mixBlendMode != gfxContext::OPERATOR_OVER ? mixBlendMode : GetOperator());
+  CompositionOp mixBlendMode = GetEffectiveMixBlendMode();
+  PaintWithOpacity(aTarget,
+                   GetEffectiveOpacity(),
+                   aMaskSurface,
+                   mixBlendMode != CompositionOp::OP_OVER ? mixBlendMode : GetOperator());
+}
+
+void
+BasicCanvasLayer::DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer)
+{
+  if (IsHidden())
+    return;
+
+  FirePreTransactionCallback();
+  DeprecatedUpdateSurface();
+  FireDidTransactionCallback();
+
+  gfxContext::GraphicsOperator mixBlendMode = DeprecatedGetEffectiveMixBlendMode();
+  DeprecatedPaintWithOpacity(aContext,
+                             GetEffectiveOpacity(),
+                             aMaskLayer,
+                             mixBlendMode != gfxContext::OPERATOR_OVER ?
+                               mixBlendMode :
+                               DeprecatedGetOperator());
 }
 
 already_AddRefed<CanvasLayer>

gfx/layers/basic/BasicCanvasLayer.h

@@ -34,7 +34,9 @@ public:
     CanvasLayer::SetVisibleRegion(aRegion);
   }
   
-  virtual void Paint(gfxContext* aContext, Layer* aMaskLayer);
+  virtual void Paint(gfx::DrawTarget* aTarget,
+                     gfx::SourceSurface* aMaskSurface);
+  virtual void DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer);
  
 protected:
   BasicLayerManager* BasicManager()

gfx/layers/basic/BasicColorLayer.cpp

@@ -9,6 +9,7 @@
 #include "BasicLayers.h"                // for BasicLayerManager
 #include "gfxContext.h"                 // for gfxContext, etc
 #include "gfxRect.h"                    // for gfxRect
+#include "gfx2DGlue.h"
 #include "mozilla/mozalloc.h"           // for operator new
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsCOMPtr.h"                   // for already_AddRefed
@@ -43,13 +44,35 @@ public:
     ColorLayer::SetVisibleRegion(aRegion);
   }
 
-  virtual void Paint(gfxContext* aContext, Layer* aMaskLayer)
+  virtual void Paint(DrawTarget* aTarget, SourceSurface* aMaskSurface)
   {
-    if (IsHidden())
+    if (IsHidden()) {
       return;
+    }
+    CompositionOp mixBlendMode = GetEffectiveMixBlendMode();
+    CompositionOp op =
+      mixBlendMode != CompositionOp::OP_OVER ? mixBlendMode : GetOperator();
+
+    DrawOptions opts = DrawOptions();
+    opts.mCompositionOp = op;
+    ColorPattern pattern(ToColor(mColor));
+    aTarget->MaskSurface(pattern,
+                         aMaskSurface,
+                         ToIntRect(GetBounds()).TopLeft(),
+                         opts);
+  }
+
+  virtual void DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer)
+  {
+    if (IsHidden()) {
+      return;
+    }
     gfxContextAutoSaveRestore contextSR(aContext);
-    gfxContext::GraphicsOperator mixBlendMode = GetEffectiveMixBlendMode();
-    AutoSetOperator setOptimizedOperator(aContext, mixBlendMode != gfxContext::OPERATOR_OVER ? mixBlendMode : GetOperator());
+    gfxContext::GraphicsOperator mixBlendMode = DeprecatedGetEffectiveMixBlendMode();
+    AutoSetOperator setOptimizedOperator(aContext,
+                                         mixBlendMode != gfxContext::OPERATOR_OVER ?
+                                           mixBlendMode :
+                                           DeprecatedGetOperator());
 
     aContext->SetColor(mColor);
 

gfx/layers/basic/BasicContainerLayer.cpp

@@ -59,7 +59,7 @@ BasicContainerLayer::ComputeEffectiveTransforms(const Matrix4x4& aTransformToSur
   Layer* child = GetFirstChild();
   bool hasSingleBlendingChild = false;
   if (!HasMultipleChildren() && child) {
-    hasSingleBlendingChild = child->GetMixBlendMode() != gfxContext::OPERATOR_OVER;
+    hasSingleBlendingChild = child->GetMixBlendMode() != CompositionOp::OP_OVER;
   }
 
   /* If we have a single childand it is not blending,, it can just inherit our opacity,
@@ -72,7 +72,7 @@ BasicContainerLayer::ComputeEffectiveTransforms(const Matrix4x4& aTransformToSur
   mUseIntermediateSurface =
     GetMaskLayer() ||
     GetForceIsolatedGroup() ||
-    (GetMixBlendMode() != gfxContext::OPERATOR_OVER && HasMultipleChildren()) ||
+    (GetMixBlendMode() != CompositionOp::OP_OVER && HasMultipleChildren()) ||
     (GetEffectiveOpacity() != 1.0 && (HasMultipleChildren() || hasSingleBlendingChild));
 }
 

gfx/layers/basic/BasicImageLayer.cpp

@@ -52,7 +52,8 @@ public:
     ImageLayer::SetVisibleRegion(aRegion);
   }
 
-  virtual void Paint(gfxContext* aContext, Layer* aMaskLayer);
+  virtual void Paint(DrawTarget* aTarget, SourceSurface* aMaskSurface);
+  virtual void DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer);
 
   virtual bool GetAsSurface(gfxASurface** aSurface,
                             SurfaceDescriptor* aDescriptor);
@@ -64,25 +65,86 @@ protected:
   }
 
   // only paints the image if aContext is non-null
+  void
+  GetAndPaintCurrentImage(DrawTarget* aTarget,
+                          float aOpacity,
+                          SourceSurface* aMaskSurface);
   already_AddRefed<gfxPattern>
-  GetAndPaintCurrentImage(gfxContext* aContext,
+  DeprecatedGetAndPaintCurrentImage(gfxContext* aContext,
                                     float aOpacity,
                                     Layer* aMaskLayer);
 
   gfx::IntSize mSize;
 };
 
+static void
+DeprecatedPaintContext(gfxPattern* aPattern,
+                       const nsIntRegion& aVisible,
+                       float aOpacity,
+                       gfxContext* aContext,
+                       Layer* aMaskLayer);
+
 void
-BasicImageLayer::Paint(gfxContext* aContext, Layer* aMaskLayer)
+BasicImageLayer::Paint(DrawTarget* aTarget, SourceSurface* aMaskSurface)
 {
-  if (IsHidden())
+  if (IsHidden()) {
     return;
+  }
+  GetAndPaintCurrentImage(aTarget, GetEffectiveOpacity(), aMaskSurface);
+}
+
+void
+BasicImageLayer::DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer)
+{
+  if (IsHidden()) {
+    return;
+  }
   nsRefPtr<gfxPattern> dontcare =
-    GetAndPaintCurrentImage(aContext, GetEffectiveOpacity(), aMaskLayer);
+    DeprecatedGetAndPaintCurrentImage(aContext,
+                                      GetEffectiveOpacity(),
+                                      aMaskLayer);
+}
+
+void
+BasicImageLayer::GetAndPaintCurrentImage(DrawTarget* aTarget,
+                                         float aOpacity,
+                                         SourceSurface* aMaskSurface)
+{
+  if (!mContainer) {
+    return;
+  }
+
+  mContainer->SetImageFactory(mManager->IsCompositingCheap() ?
+                              nullptr :
+                              BasicManager()->GetImageFactory());
+  IntSize size;
+  Image* image = nullptr;
+  RefPtr<SourceSurface> surf =
+    mContainer->LockCurrentAsSourceSurface(&size, &image);
+
+  if (!surf) {
+    return;
+  }
+
+  if (aTarget) {
+    // The visible region can extend outside the image, so just draw
+    // within the image bounds.
+    SurfacePattern pat(surf, ExtendMode::CLAMP, Matrix(), ToFilter(mFilter));
+    CompositionOp mixBlendMode = GetEffectiveMixBlendMode();
+    CompositionOp op =
+    mixBlendMode != CompositionOp::OP_OVER ? mixBlendMode : GetOperator();
+    DrawOptions opts(aOpacity, op);
+
+    aTarget->MaskSurface(pat, aMaskSurface, Point(0, 0), opts);
+
+    GetContainer()->NotifyPaintedImage(image);
+  }
+
+  mContainer->UnlockCurrentImage();
 }
 
 already_AddRefed<gfxPattern>
-BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
+BasicImageLayer::DeprecatedGetAndPaintCurrentImage(gfxContext* aContext,
                                                    float aOpacity,
                                                    Layer* aMaskLayer)
 {
@@ -91,16 +153,16 @@ BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
 
   mContainer->SetImageFactory(mManager->IsCompositingCheap() ? nullptr : BasicManager()->GetImageFactory());
 
-  nsRefPtr<gfxASurface> surface;
-  AutoLockImage autoLock(mContainer, getter_AddRefs(surface));
+  RefPtr<gfx::SourceSurface> surface;
+  AutoLockImage autoLock(mContainer, &surface);
   Image *image = autoLock.GetImage();
   gfx::IntSize size = mSize = autoLock.GetSize();
 
-  if (!surface || surface->CairoStatus()) {
+  if (!surface || !surface->IsValid()) {
     return nullptr;
   }
 
-  nsRefPtr<gfxPattern> pat = new gfxPattern(surface);
+  nsRefPtr<gfxPattern> pat = new gfxPattern(surface, gfx::Matrix());
   if (!pat) {
     return nullptr;
   }
@@ -110,10 +172,12 @@ BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
   // The visible region can extend outside the image, so just draw
   // within the image bounds.
   if (aContext) {
-    gfxContext::GraphicsOperator mixBlendMode = GetEffectiveMixBlendMode();
-    AutoSetOperator setOptimizedOperator(aContext, mixBlendMode != gfxContext::OPERATOR_OVER ? mixBlendMode : GetOperator());
+    CompositionOp mixBlendMode = GetEffectiveMixBlendMode();
+    CompositionOp op =
+      mixBlendMode != CompositionOp::OP_OVER ? mixBlendMode : GetOperator();
+    AutoSetOperator setOptimizedOperator(aContext, ThebesOp(op));
 
-    PaintContext(pat,
+    DeprecatedPaintContext(pat,
                  nsIntRegion(nsIntRect(0, 0, size.width, size.height)),
                  aOpacity, aContext, aMaskLayer);
 
@@ -123,8 +187,8 @@ BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
   return pat.forget();
 }
 
-void
-PaintContext(gfxPattern* aPattern,
+static void
+DeprecatedPaintContext(gfxPattern* aPattern,
                        const nsIntRegion& aVisible,
                        float aOpacity,
                        gfxContext* aContext,

gfx/layers/basic/BasicImplData.h

@@ -9,6 +9,8 @@
 #include "gfxContext.h"                 // for gfxContext, etc
 #include "nsDebug.h"                    // for NS_ASSERTION
 #include "nsTraceRefcnt.h"              // for MOZ_COUNT_CTOR, etc
+#include "mozilla/gfx/Types.h"
+
 class gfxASurface;
 
 namespace mozilla {
@@ -44,7 +46,7 @@ public:
   BasicImplData() : mHidden(false),
     mClipToVisibleRegion(false),
     mDrawAtomically(false),
-    mOperator(gfxContext::OPERATOR_OVER)
+    mOperator(gfx::CompositionOp::OP_OVER)
   {
     MOZ_COUNT_CTOR(BasicImplData);
   }
@@ -59,7 +61,9 @@ public:
    * set up to account for all the properties of the layer (transform,
    * opacity, etc).
    */
-  virtual void Paint(gfxContext* aContext, Layer* aMaskLayer) {}
+  virtual void Paint(gfx::DrawTarget* aTarget,
+                     gfx::SourceSurface* aMaskSurface) {}
+  virtual void DeprecatedPaint(gfxContext* aContext, Layer* aMaskLayer) {}
 
   /**
    * Like Paint() but called for ThebesLayers with the additional parameters
@@ -94,14 +98,19 @@ public:
    * the operator to be used when compositing the layer in this transaction. It must
    * be OVER or SOURCE.
    */
-  void SetOperator(gfxContext::GraphicsOperator aOperator)
+  void SetOperator(gfx::CompositionOp aOperator)
   {
-    NS_ASSERTION(aOperator == gfxContext::OPERATOR_OVER ||
-                 aOperator == gfxContext::OPERATOR_SOURCE,
+    NS_ASSERTION(aOperator == gfx::CompositionOp::OP_OVER ||
+                 aOperator == gfx::CompositionOp::OP_SOURCE,
                  "Bad composition operator");
     mOperator = aOperator;
   }
-  gfxContext::GraphicsOperator GetOperator() const { return mOperator; }
+
+  gfx::CompositionOp GetOperator() const { return mOperator; }
+  gfxContext::GraphicsOperator DeprecatedGetOperator() const
+  {
+    return gfx::ThebesOp(mOperator);
+  }
 
   /**
    * Return a surface for this layer. Will use an existing surface, if
@@ -123,7 +132,7 @@ protected:
   bool mHidden;
   bool mClipToVisibleRegion;
   bool mDrawAtomically;
-  gfxContext::GraphicsOperator mOperator;
+  gfx::CompositionOp mOperator;
 };
 
 } // layers

gfx/layers/basic/BasicLayerManager.cpp

@@ -415,7 +415,7 @@ MarkLayersHidden(Layer* aLayer, const nsIntRect& aClipRect,
   }
 
   BasicImplData* data = ToData(aLayer);
-  data->SetOperator(gfxContext::OPERATOR_OVER);
+  data->SetOperator(CompositionOp::OP_OVER);
   data->SetClipToVisibleRegion(false);
   data->SetDrawAtomically(false);
 
@@ -500,13 +500,13 @@ ApplyDoubleBuffering(Layer* aLayer, const nsIntRect& aVisibleRect)
   // using OPERATOR_SOURCE to ensure that alpha values in a transparent window
   // are cleared. This can also be faster than OPERATOR_OVER.
   if (!container) {
-    data->SetOperator(gfxContext::OPERATOR_SOURCE);
+    data->SetOperator(CompositionOp::OP_SOURCE);
     data->SetDrawAtomically(true);
   } else {
     if (container->UseIntermediateSurface() ||
         !container->ChildrenPartitionVisibleRegion(newVisibleRect)) {
       // We need to double-buffer this container.
-      data->SetOperator(gfxContext::OPERATOR_SOURCE);
+      data->SetOperator(CompositionOp::OP_SOURCE);
       container->ForceIntermediateSurface();
     } else {
       // Tell the children to clip to their visible regions so our assumption
@@ -824,7 +824,7 @@ BasicLayerManager::PaintSelfOrChildren(PaintLayerContext& aPaintContext,
           aPaintContext.mCallback, aPaintContext.mCallbackData,
           aPaintContext.mReadback);
     } else {
-      data->Paint(aGroupTarget, aPaintContext.mLayer->GetMaskLayer());
+      data->DeprecatedPaint(aGroupTarget, aPaintContext.mLayer->GetMaskLayer());
     }
   } else {
     ReadbackProcessor readback;
@@ -862,7 +862,8 @@ BasicLayerManager::FlushGroup(PaintLayerContext& aPaintContext, bool aNeedsClipT
                              aPaintContext.mLayer->GetEffectiveVisibleRegion());
     }
     BasicContainerLayer* container = static_cast<BasicContainerLayer*>(aPaintContext.mLayer);
-    AutoSetOperator setOperator(aPaintContext.mTarget, container->GetOperator());
+    AutoSetOperator setOperator(aPaintContext.mTarget,
+                                ThebesOp(container->GetOperator()));
     PaintWithMask(aPaintContext.mTarget, aPaintContext.mLayer->GetEffectiveOpacity(),
                   aPaintContext.mLayer->GetMaskLayer());
   }
@@ -896,7 +897,7 @@ BasicLayerManager::PaintLayer(gfxContext* aTarget,
   bool needsClipToVisibleRegion =
     data->GetClipToVisibleRegion() && !aLayer->AsThebesLayer();
   NS_ASSERTION(needsGroup || !aLayer->GetFirstChild() ||
-               container->GetOperator() == gfxContext::OPERATOR_OVER,
+               container->GetOperator() == CompositionOp::OP_OVER,
                "non-OVER operator should have forced UseIntermediateSurface");
   NS_ASSERTION(!aLayer->GetFirstChild() || !aLayer->GetMaskLayer() ||
                container->UseIntermediateSurface(),

gfx/layers/basic/BasicLayers.h

@@ -197,13 +197,6 @@ protected:
   bool mCompositorMightResample;
 };
 
-void
-PaintContext(gfxPattern* aPattern,
-             const nsIntRegion& aVisible,
-             float aOpacity,
-             gfxContext* aContext,
-             Layer* aMaskLayer);
-
 }
 }
 

gfx/layers/basic/BasicThebesLayer.cpp

@@ -62,7 +62,7 @@ BasicThebesLayer::PaintThebes(gfxContext* aContext,
   }
 
   float opacity = GetEffectiveOpacity();
-  gfxContext::GraphicsOperator mixBlendMode = GetEffectiveMixBlendMode();
+  CompositionOp mixBlendMode = GetEffectiveMixBlendMode();
 
   if (!BasicManager()->IsRetained()) {
     NS_ASSERTION(readbackUpdates.IsEmpty(), "Can't do readback for non-retained layer");
@@ -83,14 +83,17 @@ BasicThebesLayer::PaintThebes(gfxContext* aContext,
       aContext->Save();
 
       bool needsClipToVisibleRegion = GetClipToVisibleRegion();
-      bool needsGroup =
-          opacity != 1.0 || GetOperator() != gfxContext::OPERATOR_OVER || mixBlendMode != gfxContext::OPERATOR_OVER || aMaskLayer;
+      bool needsGroup = opacity != 1.0 ||
+                        GetOperator() != CompositionOp::OP_OVER ||
+                        mixBlendMode != CompositionOp::OP_OVER ||
+                        aMaskLayer;
       nsRefPtr<gfxContext> groupContext;
       if (needsGroup) {
         groupContext =
           BasicManager()->PushGroupForLayer(aContext, this, toDraw,
                                             &needsClipToVisibleRegion);
-        if (GetOperator() != gfxContext::OPERATOR_OVER || mixBlendMode != gfxContext::OPERATOR_OVER) {
+        if (GetOperator() != CompositionOp::OP_OVER ||
+            mixBlendMode != CompositionOp::OP_OVER) {
           needsClipToVisibleRegion = true;
         }
       } else {
@@ -103,7 +106,9 @@ BasicThebesLayer::PaintThebes(gfxContext* aContext,
         if (needsClipToVisibleRegion) {
           gfxUtils::ClipToRegion(aContext, toDraw);
         }
-        AutoSetOperator setOptimizedOperator(aContext, mixBlendMode != gfxContext::OPERATOR_OVER ? mixBlendMode : GetOperator());
+        CompositionOp op =
+          mixBlendMode != CompositionOp::OP_OVER ? mixBlendMode : GetOperator();
+        AutoSetOperator setOptimizedOperator(aContext, ThebesOp(op));
         PaintWithMask(aContext, opacity, aMaskLayer);
       }
 
@@ -132,7 +137,7 @@ BasicThebesLayer::PaintThebes(gfxContext* aContext,
 
   if (!IsHidden() && !clipExtents.IsEmpty()) {
     mContentClient->DrawTo(this, aContext->GetDrawTarget(), opacity,
-                           CompositionOpForOp(GetOperator()),
+                           GetOperator(),
                            maskSurface, &maskTransform);
   }
 

gfx/layers/client/CanvasClient.cpp

@@ -76,9 +76,10 @@ CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
     return;
   }
 
-  nsRefPtr<gfxASurface> surface = mBuffer->AsTextureClientSurface()->GetAsSurface();
-  if (surface) {
-    aLayer->UpdateSurface(surface);
+  RefPtr<DrawTarget> drawTarget =
+    mBuffer->AsTextureClientDrawTarget()->GetAsDrawTarget();
+  if (drawTarget) {
+    aLayer->UpdateTarget(drawTarget);
   }
 
   mBuffer->Unlock();
@@ -88,7 +89,7 @@ CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
     return;
   }
 
-  if (surface) {
+  if (drawTarget) {
     GetForwarder()->UpdatedTexture(this, mBuffer, nullptr);
     GetForwarder()->UseTexture(this, mBuffer);
   }
@@ -215,7 +216,7 @@ DeprecatedCanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
   }
 
   gfxASurface* surface = mDeprecatedTextureClient->LockSurface();
-  aLayer->UpdateSurface(surface);
+  aLayer->DeprecatedUpdateSurface(surface);
   mDeprecatedTextureClient->Unlock();
 }
 

gfx/layers/client/ClientImageLayer.cpp

@@ -105,8 +105,8 @@ protected:
       return mImageClientTypeContainer;
     }
 
-    nsRefPtr<gfxASurface> surface;
-    AutoLockImage autoLock(mContainer, getter_AddRefs(surface));
+    RefPtr<gfx::SourceSurface> surface;
+    AutoLockImage autoLock(mContainer, &surface);
 
     mImageClientTypeContainer = autoLock.GetImage() ?
                                   BUFFER_IMAGE_SINGLE : BUFFER_UNKNOWN;

gfx/layers/client/ImageClient.cpp

@@ -216,10 +216,10 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
 
     GetForwarder()->UseTexture(this, mFrontBuffer);
   } else {
-    nsRefPtr<gfxASurface> surface = image->DeprecatedGetAsSurface();
+    RefPtr<gfx::SourceSurface> surface = image->GetAsSourceSurface();
     MOZ_ASSERT(surface);
 
-    gfx::IntSize size = gfx::IntSize(image->GetSize().width, image->GetSize().height);
+    gfx::IntSize size = image->GetSize();
 
     if (mFrontBuffer &&
         (mFrontBuffer->IsImmutable() || mFrontBuffer->GetSize() != size)) {
@@ -230,7 +230,7 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
     bool bufferCreated = false;
     if (!mFrontBuffer) {
       gfxImageFormat format
-        = gfxPlatform::GetPlatform()->OptimalFormatForContent(surface->GetContentType());
+        = gfxPlatform::GetPlatform()->OptimalFormatForContent(gfx::ContentForFormat(surface->GetFormat()));
       mFrontBuffer = CreateTextureClientForDrawing(gfx::ImageFormatToSurfaceFormat(format),
                                                    mTextureFlags);
       MOZ_ASSERT(mFrontBuffer->AsTextureClientDrawTarget());
@@ -249,9 +249,8 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
     {
       // We must not keep a reference to the DrawTarget after it has been unlocked.
       RefPtr<DrawTarget> dt = mFrontBuffer->AsTextureClientDrawTarget()->GetAsDrawTarget();
-      RefPtr<SourceSurface> source = gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(dt, surface);
-      MOZ_ASSERT(source.get());
-      dt->CopySurface(source, IntRect(IntPoint(), source->GetSize()), IntPoint());
+      MOZ_ASSERT(surface.get());
+      dt->CopySurface(surface, IntRect(IntPoint(), surface->GetSize()), IntPoint());
     }
 
     mFrontBuffer->Unlock();

gfx/layers/d3d10/CanvasLayerD3D10.cpp

@@ -82,25 +82,12 @@ CanvasLayerD3D10::Initialize(const Data& aData)
     
     // XXX we should store mDrawTarget and use it directly in UpdateSurface,
     // bypassing Thebes
-    mSurface = gfxPlatform::GetPlatform()->GetThebesSurfaceForDrawTarget(mDrawTarget);
+    mSurface = mDrawTarget->Snapshot();
   } else {
     NS_ERROR("CanvasLayer created without mSurface, mDrawTarget or mGLContext?");
   }
 
   mBounds.SetRect(0, 0, aData.mSize.width, aData.mSize.height);
-
-  if (mSurface && mSurface->GetType() == gfxSurfaceType::D2D) {
-    void *data = mSurface->GetData(&gKeyD3D10Texture);
-    if (data) {
-      mTexture = static_cast<ID3D10Texture2D*>(data);
-      mIsD2DTexture = true;
-      device()->CreateShaderResourceView(mTexture, nullptr, getter_AddRefs(mSRView));
-      mHasAlpha =
-        mSurface->GetContentType() == gfxContentType::COLOR_ALPHA;
-      return;
-    }
-  }
-
   mIsD2DTexture = false;
 
   // Create a texture in case we need to readback.
@@ -127,7 +114,6 @@ CanvasLayerD3D10::UpdateSurface()
   if (mDrawTarget) {
     mDrawTarget->Flush();
   } else if (mIsD2DTexture) {
-    mSurface->Flush();
     return;
   }
 
@@ -179,12 +165,6 @@ CanvasLayerD3D10::UpdateSurface()
         MOZ_CRASH("Unhandled SharedSurfaceType.");
     }
   } else if (mSurface) {
-    RECT r;
-    r.left = 0;
-    r.top = 0;
-    r.right = mBounds.width;
-    r.bottom = mBounds.height;
-
     D3D10_MAPPED_TEXTURE2D map;
     HRESULT hr = mTexture->Map(0, D3D10_MAP_WRITE_DISCARD, 0, &map);
 
@@ -193,16 +173,12 @@ CanvasLayerD3D10::UpdateSurface()
       return;
     }
 
-    nsRefPtr<gfxImageSurface> dstSurface;
-
-    dstSurface = new gfxImageSurface((unsigned char*)map.pData,
-                                     gfxIntSize(mBounds.width, mBounds.height),
-                                     map.RowPitch,
-                                     gfxImageFormat::ARGB32);
-    nsRefPtr<gfxContext> ctx = new gfxContext(dstSurface);
-    ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
-    ctx->SetSource(mSurface);
-    ctx->Paint();
+    RefPtr<DrawTarget> destTarget =
+      Factory::CreateDrawTargetForD3D10Texture(mTexture,
+                                               SurfaceFormat::R8G8B8A8);
+    Rect r(Point(0, 0), ToRect(mBounds).Size());
+    destTarget->DrawSurface(mSurface, r, r, DrawSurfaceOptions(),
+                            DrawOptions(1.0F, CompositionOp::OP_SOURCE));
 
     mTexture->Unmap(0);
     mSRView = mUploadSRView;

gfx/layers/d3d10/CanvasLayerD3D10.h

@@ -39,7 +39,7 @@ private:
 
   void UpdateSurface();
 
-  nsRefPtr<gfxASurface> mSurface;
+  RefPtr<gfx::SourceSurface> mSurface;
   mozilla::RefPtr<mozilla::gfx::DrawTarget> mDrawTarget;
   nsRefPtr<GLContext> mGLContext;
   nsRefPtr<ID3D10Texture2D> mTexture;

gfx/layers/d3d9/CanvasLayerD3D9.cpp

@@ -42,11 +42,10 @@ CanvasLayerD3D9::~CanvasLayerD3D9()
 void
 CanvasLayerD3D9::Initialize(const Data& aData)
 {
-  NS_ASSERTION(mSurface == nullptr, "BasicCanvasLayer::Initialize called twice!");
+  NS_ASSERTION(mDrawTarget == nullptr, "BasicCanvasLayer::Initialize called twice!");
 
   if (aData.mDrawTarget) {
     mDrawTarget = aData.mDrawTarget;
-    mSurface = gfxPlatform::GetPlatform()->GetThebesSurfaceForDrawTarget(mDrawTarget);
     mNeedsYFlip = false;
     mDataIsPremultiplied = true;
   } else if (aData.mGLContext) {
@@ -55,7 +54,7 @@ CanvasLayerD3D9::Initialize(const Data& aData)
     mDataIsPremultiplied = aData.mIsGLAlphaPremult;
     mNeedsYFlip = true;
   } else {
-    NS_ERROR("CanvasLayer created without mSurface, mGLContext or mDrawTarget?");
+    NS_ERROR("CanvasLayer created without mGLContext or mDrawTarget?");
   }
 
   mBounds.SetRect(0, 0, aData.mSize.width, aData.mSize.height);
@@ -79,12 +78,18 @@ CanvasLayerD3D9::UpdateSurface()
     }
   }
 
+  RefPtr<SourceSurface> surface;
+
   if (mGLContext) {
     SharedSurface* surf = mGLContext->RequestFrame();
     if (!surf)
         return;
 
     SharedSurface_Basic* shareSurf = SharedSurface_Basic::Cast(surf);
+    surface = shareSurf->GetData();
+  } else {
+    surface = mDrawTarget->Snapshot();
+  }
 
   // WebGL reads entire surface.
   LockTextureRectD3D9 textureLock(mTexture);
@@ -94,73 +99,17 @@ CanvasLayerD3D9::UpdateSurface()
   }
 
   D3DLOCKED_RECT rect = textureLock.GetLockRect();
-    
-    DataSourceSurface* frameData = shareSurf->GetData();
-    // Scope for DrawTarget, so it's destroyed early.
-    {
   RefPtr<DrawTarget> rectDt = Factory::CreateDrawTargetForData(BackendType::CAIRO,
                                                                (uint8_t*)rect.pBits,
-                                                                   frameData->GetSize(),
+                                                               surface->GetSize(),
                                                                rect.Pitch,
                                                                SurfaceFormat::B8G8R8A8);
 
-      Rect drawRect(0, 0, frameData->GetSize().width, frameData->GetSize().height);
-      rectDt->DrawSurface(frameData, drawRect, drawRect,
+  Rect drawRect(0, 0, surface->GetSize().width, surface->GetSize().height);
+  rectDt->DrawSurface(surface, drawRect, drawRect,
                       DrawSurfaceOptions(),  DrawOptions(1.0F, CompositionOp::OP_SOURCE));
   rectDt->Flush();
 }
-  } else {
-    RECT r;
-    r.left = mBounds.x;
-    r.top = mBounds.y;
-    r.right = mBounds.XMost();
-    r.bottom = mBounds.YMost();
-
-    LockTextureRectD3D9 textureLock(mTexture);
-    if (!textureLock.HasLock()) {
-      NS_WARNING("Failed to lock CanvasLayer texture.");
-      return;
-    }
-
-    D3DLOCKED_RECT lockedRect = textureLock.GetLockRect();
-
-    nsRefPtr<gfxImageSurface> sourceSurface;
-
-    if (mSurface->GetType() == gfxSurfaceType::Win32) {
-      sourceSurface = mSurface->GetAsImageSurface();
-    } else if (mSurface->GetType() == gfxSurfaceType::Image) {
-      sourceSurface = static_cast<gfxImageSurface*>(mSurface.get());
-      if (sourceSurface->Format() != gfxImageFormat::ARGB32 &&
-          sourceSurface->Format() != gfxImageFormat::RGB24)
-      {
-        return;
-      }
-    } else {
-      sourceSurface = new gfxImageSurface(gfxIntSize(mBounds.width, mBounds.height),
-                                          gfxImageFormat::ARGB32);
-      nsRefPtr<gfxContext> ctx = new gfxContext(sourceSurface);
-      ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
-      ctx->SetSource(mSurface);
-      ctx->Paint();
-    }
-
-    uint8_t *startBits = sourceSurface->Data();
-    uint32_t sourceStride = sourceSurface->Stride();
-
-    if (sourceSurface->Format() != gfxImageFormat::ARGB32) {
-      mHasAlpha = false;
-    } else {
-      mHasAlpha = true;
-    }
-
-    for (int y = 0; y < mBounds.height; y++) {
-      memcpy((uint8_t*)lockedRect.pBits + lockedRect.Pitch * y,
-             startBits + sourceStride * y,
-             mBounds.width * 4);
-    }
-
-  }
-}
 
 Layer*
 CanvasLayerD3D9::GetLayer()

gfx/layers/d3d9/CanvasLayerD3D9.h

@@ -39,7 +39,6 @@ protected:
 
   void UpdateSurface();
 
-  nsRefPtr<gfxASurface> mSurface;
   nsRefPtr<GLContext> mGLContext;
   nsRefPtr<IDirect3DTexture9> mTexture;
   RefPtr<gfx::DrawTarget> mDrawTarget;

gfx/layers/genTables.py

@@ -0,0 +1,12 @@
+#!/usr/bin/python
+
+def table_generator(f):
+  return ",\n".join([", ".join(["0x%2.2x" % h for h in [f(i) for i in range(r,r+16)]]) for r in range(0, 65536, 16)])
+
+with open("PremultiplyTables.h", "w") as f:
+  f.write("const uint8_t PremultiplyTable[256*256] = {\n");
+  f.write(table_generator(lambda i: ((i / 256) * (i % 256) + 254) / 255) + "\n")
+  f.write("};\n");
+  f.write("const uint8_t UnpremultiplyTable[256*256] = {\n");
+  f.write(table_generator(lambda i: (i % 256) * 255 / ((i / 256) if (i / 256) > 0 else 255) % 256) + "\n")
+  f.write("};\n");

gfx/layers/ipc/AsyncPanZoomController.cpp

@@ -1705,6 +1705,12 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
       // scroll offset updates from APZ until we acknowledge the update it sent.
       // This prevents APZ updates from clobbering scroll updates from other
       // more "legitimate" sources like content scripts.
+      // Furthermore, any inflight paint requests we have already dispatched are
+      // going to be ignored by layout, and so mLastDispatchedPaintMetrics
+      // becomes incorrect for the purposes of calculating the LD transform. To
+      // correct this we need to update mLastDispatchedPaintMetrics to be the
+      // last thing we know was painted by Gecko.
+      mLastDispatchedPaintMetrics = aLayerMetrics;
       nsRefPtr<GeckoContentController> controller = GetGeckoContentController();
       if (controller) {
         controller->AcknowledgeScrollUpdate(aLayerMetrics.mScrollId,

gfx/layers/moz.build

@@ -60,13 +60,13 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
             'd3d9/ContainerLayerD3D9.cpp',
             'd3d9/ImageLayerD3D9.cpp',
             'd3d9/LayerManagerD3D9.cpp',
-            'd3d9/Nv3DVUtils.cpp',
             'd3d9/TextureD3D9.cpp',
             'd3d9/ThebesLayerD3D9.cpp',
         ]
         SOURCES += [
             'd3d9/CompositorD3D9.cpp',
             'd3d9/DeviceManagerD3D9.cpp',
+            'd3d9/Nv3DVUtils.cpp',
         ]
     if CONFIG['MOZ_ENABLE_D3D10_LAYER']:
         EXPORTS += [
@@ -261,6 +261,7 @@ UNIFIED_SOURCES += [
     'LayerScope.cpp',
     'LayersLogging.cpp',
     'LayerSorter.cpp',
+    'LayerUtils.cpp',
     'opengl/CompositingRenderTargetOGL.cpp',
     'opengl/CompositorOGL.cpp',
     'opengl/OGLShaderProgram.cpp',
@@ -324,3 +325,7 @@ if CONFIG['MOZ_DEBUG']:
 
 if CONFIG['MOZ_ENABLE_D3D10_LAYER']:
     DEFINES['MOZ_ENABLE_D3D10_LAYER'] = True
+
+GENERATED_FILES = [
+    'PremultiplyTables.h',
+]

gfx/src/nsScriptableRegion.cpp

@@ -136,7 +136,7 @@ NS_IMETHODIMP nsScriptableRegion::GetRects(JSContext* aCx, JS::MutableHandle<JS:
     return NS_OK;
   }
 
-  JS::Rooted<JSObject*> destArray(aCx, JS_NewArrayObject(aCx, numRects * 4, nullptr));
+  JS::Rooted<JSObject*> destArray(aCx, JS_NewArrayObject(aCx, numRects * 4));
   if (!destArray) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

gfx/thebes/Makefile.in

@@ -41,5 +41,5 @@ gfxAlphaRecoverySSE2.$(OBJ_SUFFIX): OS_CXXFLAGS += -xarch=sse2 -xO4
 endif
 endif
 
-PremultiplyTables.h: $(srcdir)/genTables.py
+DeprecatedPremultiplyTables.h: $(srcdir)/genTables.py
 	$(PYTHON) $(srcdir)/genTables.py

gfx/thebes/genTables.py

@@ -3,7 +3,7 @@
 def table_generator(f):
     return ",\n".join([", ".join(["0x%2.2x" % h for h in [f(i) for i in range(r,r+16)]]) for r in range(0, 65536, 16)])
 
-with open("PremultiplyTables.h", "w") as f:
+with open("DeprecatedPremultiplyTables.h", "w") as f:
   f.write("const uint8_t gfxUtils::sPremultiplyTable[256*256] = {\n");
   f.write(table_generator(lambda i: ((i / 256) * (i % 256) + 254) / 255) + "\n")
   f.write("};\n");

gfx/thebes/gfxUtils.cpp

@@ -22,7 +22,7 @@ using namespace mozilla;
 using namespace mozilla::layers;
 using namespace mozilla::gfx;
 
-#include "PremultiplyTables.h"
+#include "DeprecatedPremultiplyTables.h"
 
 static const uint8_t PremultiplyValue(uint8_t a, uint8_t v) {
     return gfxUtils::sPremultiplyTable[a*256+v];

gfx/thebes/gfxWindowsPlatform.cpp

@@ -628,7 +628,7 @@ gfxWindowsPlatform::CreatePlatformFontList()
 #ifdef CAIRO_HAS_DWRITE_FONT
     // bug 630201 - older pre-RTM versions of Direct2D/DirectWrite cause odd
     // crashers so blacklist them altogether
-    if (IsWin7RTMOrLater() && GetDWriteFactory()) {
+    if (IsNotWin7PreRTM() && GetDWriteFactory()) {
         pfl = new gfxDWriteFontList();
         if (NS_SUCCEEDED(pfl->InitFontList())) {
             return pfl;

gfx/thebes/moz.build

@@ -268,7 +268,7 @@ include('/ipc/chromium/chromium-config.mozbuild')
 FINAL_LIBRARY = 'xul'
 
 GENERATED_FILES = [
-    'PremultiplyTables.h',
+    'DeprecatedPremultiplyTables.h',
 ]
 
 LOCAL_INCLUDES += [

ipc/chromium/src/third_party/libevent-use-non-deprecated-syscalls.patch

@@ -0,0 +1,43 @@
+---
+ ipc/chromium/src/third_party/libevent/epoll_sub.c |   13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- mozilla-central.orig/ipc/chromium/src/third_party/libevent/epoll_sub.c
++++ mozilla-central/ipc/chromium/src/third_party/libevent/epoll_sub.c
+@@ -29,15 +29,24 @@
+ #include <sys/param.h>
+ #include <sys/types.h>
+ #include <sys/syscall.h>
+ #include <sys/epoll.h>
+ #include <unistd.h>
++#include <errno.h>
+
+ int
+ epoll_create(int size)
+ {
++#if !defined(__NR_epoll_create) && defined(__NR_epoll_create1)
++	if (size <= 0) {
++		errno = EINVAL;
++		return -1;
++	}
++	return (syscall(__NR_epoll_create1, 0));
++#else
+ 	return (syscall(__NR_epoll_create, size));
++#endif
+ }
+
+ int
+ epoll_ctl(int epfd, int op, int fd, struct epoll_event *event)
+ {
+@@ -46,7 +55,11 @@ epoll_ctl(int epfd, int op, int fd, stru
+ }
+
+ int
+ epoll_wait(int epfd, struct epoll_event *events, int maxevents, int timeout)
+ {
++#if !defined(__NR_epoll_wait) && defined(__NR_epoll_pwait)
++	return (syscall(__NR_epoll_pwait, epfd, events, maxevents, timeout, NULL, 0));
++#else
+ 	return (syscall(__NR_epoll_wait, epfd, events, maxevents, timeout));
++#endif
+ }

ipc/chromium/src/third_party/libevent/README.mozilla

@@ -13,3 +13,5 @@ These files are taken from libevent-2.0.21-stable built on the development envir
 3. Apply "add mac-arc4random-buf.patch", which removes some bad OS X compatibility code. This will allow libevent to compile on all supported versions of OS X.
 
 4. Apply "openbsd-no-arc4random_addrandom.patch", which fixes the build on OpenBSD (which doesnt provide arc4random_addrandom anymore, see #931354)
+
+5. Apply "libevent-use-non-deprecated-syscalls.patch", which fixes the build on AArch64 architecture (which does not provide deprecated syscalls)

ipc/chromium/src/third_party/libevent/epoll_sub.c

@@ -31,11 +31,20 @@
 #include <sys/syscall.h>
 #include <sys/epoll.h>
 #include <unistd.h>
+#include <errno.h>
 
 int
 epoll_create(int size)
 {
+#if !defined(__NR_epoll_create) && defined(__NR_epoll_create1)
+	if (size <= 0) {
+		errno = EINVAL;
+		return -1;
+	}
+	return (syscall(__NR_epoll_create1, 0));
+#else
 	return (syscall(__NR_epoll_create, size));
+#endif
 }
 
 int
@@ -48,5 +57,9 @@ epoll_ctl(int epfd, int op, int fd, struct epoll_event *event)
 int
 epoll_wait(int epfd, struct epoll_event *events, int maxevents, int timeout)
 {
+#if !defined(__NR_epoll_wait) && defined(__NR_epoll_pwait)
+	return (syscall(__NR_epoll_pwait, epfd, events, maxevents, timeout, NULL, 0));
+#else
 	return (syscall(__NR_epoll_wait, epfd, events, maxevents, timeout));
+#endif
 }

js/src/builtin/SIMD.cpp

@@ -138,7 +138,6 @@ class Float32x4Defn {
 
 const JSFunctionSpec js::Float32x4Defn::TypeDescriptorMethods[] = {
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
-    JS_SELF_HOSTED_FN("handle", "HandleCreate", 2, 0),
     JS_SELF_HOSTED_FN("array", "ArrayShorthand", 1, 0),
     JS_SELF_HOSTED_FN("equivalent", "TypeDescrEquivalent", 1, 0),
     JS_FS_END
@@ -160,7 +159,6 @@ const JSFunctionSpec js::Float32x4Defn::TypedDatumMethods[] = {
 
 const JSFunctionSpec js::Int32x4Defn::TypeDescriptorMethods[] = {
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
-    JS_SELF_HOSTED_FN("handle", "HandleCreate", 2, 0),
     JS_SELF_HOSTED_FN("array", "ArrayShorthand", 1, 0),
     JS_SELF_HOSTED_FN("equivalent", "TypeDescrEquivalent", 1, 0),
     JS_FS_END,

js/src/builtin/TypedObject.cpp

@@ -216,7 +216,6 @@ const Class js::ScalarTypeDescr::class_ = {
 
 const JSFunctionSpec js::ScalarTypeDescr::typeObjectMethods[] = {
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
-    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_FS_END
@@ -317,7 +316,6 @@ const Class js::ReferenceTypeDescr::class_ = {
 
 const JSFunctionSpec js::ReferenceTypeDescr::typeObjectMethods[] = {
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
-    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_FS_END
@@ -467,7 +465,6 @@ const JSPropertySpec ArrayMetaTypeDescr::typeObjectProperties[] = {
 };
 
 const JSFunctionSpec ArrayMetaTypeDescr::typeObjectMethods[] = {
-    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     JS_FN("dimension", UnsizedArrayTypeDescr::dimension, 1, 0),
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
@@ -756,7 +753,6 @@ const JSPropertySpec StructMetaTypeDescr::typeObjectProperties[] = {
 };
 
 const JSFunctionSpec StructMetaTypeDescr::typeObjectMethods[] = {
-    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
@@ -1250,24 +1246,6 @@ GlobalObject::initTypedObjectModule(JSContext *cx, Handle<GlobalObject*> global)
                                   JSPROP_READONLY | JSPROP_PERMANENT))
         return nullptr;
 
-    //  Handle
-
-    RootedObject handle(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
-    if (!module)
-        return nullptr;
-
-    if (!JS_DefineFunctions(cx, handle, TypedHandle::handleStaticMethods))
-        return nullptr;
-
-    RootedValue handleValue(cx, ObjectValue(*handle));
-    if (!JSObject::defineProperty(cx, module, cx->names().Handle,
-                                  handleValue,
-                                  nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-    {
-        return nullptr;
-    }
-
     // Everything is setup, install module on the global object:
     RootedValue moduleValue(cx, ObjectValue(*module));
     global->setConstructor(JSProto_TypedObject, moduleValue);

js/src/builtin/TypedObject.js

@@ -181,6 +181,12 @@ TypedObjectPointer.prototype.reset = function(inPtr) {
   return this;
 };
 
+TypedObjectPointer.prototype.bump = function(size) {
+  assert(TO_INT32(this.offset) === this.offset, "current offset not int");
+  assert(TO_INT32(size) === size, "size not int");
+  this.offset += size;
+}
+
 TypedObjectPointer.prototype.kind = function() {
   return DESCR_KIND(this.descr);
 }
@@ -312,8 +318,7 @@ TypedObjectPointer.prototype.moveToFieldIndex = function(index) {
 // Reifies the value referenced by the pointer, meaning that it
 // returns a new object pointing at the value. If the value is
 // a scalar, it will return a JS number, but otherwise the reified
-// result will be a typed object or handle, depending on the type
-// of the ptr's datum.
+// result will be a datum of the same class as the ptr's datum.
 TypedObjectPointer.prototype.get = function() {
   assert(ObjectIsAttached(this.datum), "get() called with unattached datum");
 
@@ -328,10 +333,8 @@ TypedObjectPointer.prototype.get = function() {
     return this.getX4();
 
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
-    return NewDerivedTypedDatum(this.descr, this.datum, this.offset);
-
   case JS_TYPEREPR_STRUCT_KIND:
-    return NewDerivedTypedDatum(this.descr, this.datum, this.offset);
+    return this.getDerived();
 
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
     assert(false, "Unhandled repr kind: " + this.kind());
@@ -341,6 +344,12 @@ TypedObjectPointer.prototype.get = function() {
   return undefined;
 }
 
+TypedObjectPointer.prototype.getDerived = function() {
+  assert(!TypeDescrIsSimpleType(this.descr),
+         "getDerived() used with simple type");
+  return NewDerivedTypedDatum(this.descr, this.datum, this.offset);
+}
+
 TypedObjectPointer.prototype.getScalar = function() {
   var type = DESCR_TYPE(this.descr);
   switch (type) {
@@ -726,99 +735,6 @@ function TypedArrayRedimension(newArrayType) {
   return NewDerivedTypedDatum(newArrayType, this, 0);
 }
 
-///////////////////////////////////////////////////////////////////////////
-// Handles
-//
-// Note: these methods are directly invokable by users and so must be
-// defensive.
-
-// This is the `handle([obj, [...path]])` method on type objects.
-// User exposed!
-//
-// FIXME bug 929656 -- label algorithms with steps from the spec
-function HandleCreate(obj, ...path) {
-  if (!IsObject(this) || !ObjectIsTypeDescr(this))
-    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Type", "handle", "value");
-
-  switch (DESCR_KIND(this)) {
-  case JS_TYPEREPR_SCALAR_KIND:
-  case JS_TYPEREPR_REFERENCE_KIND:
-  case JS_TYPEREPR_X4_KIND:
-  case JS_TYPEREPR_SIZED_ARRAY_KIND:
-  case JS_TYPEREPR_STRUCT_KIND:
-    break;
-
-  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    ThrowError(JSMSG_TYPEDOBJECT_HANDLE_TO_UNSIZED);
-  }
-
-  var handle = NewTypedHandle(this);
-
-  if (obj !== undefined)
-    HandleMoveInternal(handle, obj, path);
-
-  return handle;
-}
-
-// Handle.move: user exposed!
-// FIXME bug 929656 -- label algorithms with steps from the spec
-function HandleMove(handle, obj, ...path) {
-  if (!IsObject(handle) || !ObjectIsTypedHandle(handle))
-    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", typeof value);
-
-  HandleMoveInternal(handle, obj, path);
-}
-
-function HandleMoveInternal(handle, obj, path) {
-  assert(IsObject(handle) && ObjectIsTypedHandle(handle),
-         "HandleMoveInternal: not typed handle");
-
-  if (!IsObject(obj) || !ObjectIsTypedDatum(obj))
-    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", "value");
-
-  var ptr = TypedObjectPointer.fromTypedDatum(obj);
-  for (var i = 0; i < path.length; i++)
-    ptr.moveTo(path[i]);
-
-  // Check that the new destination is equivalent to the handle type.
-  if (DESCR_TYPE_REPR(ptr.descr) !== DATUM_TYPE_REPR(handle))
-    ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_TYPE);
-
-  AttachHandle(handle, ptr.datum, ptr.offset)
-}
-
-// Handle.get: user exposed!
-// FIXME bug 929656 -- label algorithms with steps from the spec
-function HandleGet(handle) {
-  if (!IsObject(handle) || !ObjectIsTypedHandle(handle))
-    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", typeof value);
-
-  if (!ObjectIsAttached(handle))
-    ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
-
-  var ptr = TypedObjectPointer.fromTypedDatum(handle);
-  return ptr.get();
-}
-
-// Handle.set: user exposed!
-// FIXME bug 929656 -- label algorithms with steps from the spec
-function HandleSet(handle, value) {
-  if (!IsObject(handle) || !ObjectIsTypedHandle(handle))
-    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", typeof value);
-
-  if (!ObjectIsAttached(handle))
-    ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
-
-  var ptr = TypedObjectPointer.fromTypedDatum(handle);
-  ptr.set(value);
-}
-
-// Handle.isHandle: user exposed!
-// FIXME bug 929656 -- label algorithms with steps from the spec
-function HandleTest(obj) {
-  return IsObject(obj) && ObjectIsTypedHandle(obj);
-}
-
 ///////////////////////////////////////////////////////////////////////////
 // X4
 
@@ -953,7 +869,6 @@ function TypedObjectArrayTypeFrom(a, b, c) {
   // supporting an explicit depth of 1; while for typed input array,
   // the expectation is explicit depth.
 
-
   if (untypedInput) {
     var explicitDepth = (b === 1);
     if (explicitDepth && IsCallable(c))
@@ -1168,25 +1083,25 @@ function BuildTypedSeqImpl(arrayType, len, depth, func) {
     indices[i] = 0;
   }
 
-  var handle = callFunction(HandleCreate, grainType);
-  var offset = 0;
+  var grainTypeIsSimple = TypeDescrIsSimpleType(grainType);
+  var size = DESCR_SIZE(grainType);
+  var outPointer = new TypedObjectPointer(grainType, result, 0);
   for (i = 0; i < totalLength; i++) {
-    // Position handle to point at &result[...indices]
-    AttachHandle(handle, result, offset);
+    // Position out-pointer to point at &result[...indices], if appropriate.
+    var userOutPointer = (grainTypeIsSimple
+                          ? undefined
+                          : outPointer.getDerived());
 
-    // Invoke func(...indices, out)
-    callFunction(std_Array_push, indices, handle);
-    var r = callFunction(std_Function_apply, func, void 0, indices);
+    // Invoke func(...indices, userOutPointer) and store the result
+    callFunction(std_Array_push, indices, userOutPointer);
+    var r = callFunction(std_Function_apply, func, undefined, indices);
     callFunction(std_Array_pop, indices);
+    if (r !== undefined)
+      outPointer.set(r); // result[...indices] = r;
 
-    if (r !== undefined) {
-      // result[...indices] = r;
-      AttachHandle(handle, result, offset); // (func might have moved handle)
-      HandleSet(handle, r);                 // *handle = r
-    }
     // Increment indices.
-    offset += DESCR_SIZE(grainType);
     IncrementIterationSpace(indices, iterationSpace);
+    outPointer.bump(size);
   }
 
   return result;
@@ -1261,35 +1176,32 @@ function MapUntypedSeqImpl(inArray, outputType, maybeFunc) {
   // Create a zeroed instance with no data
   var result = outputType.variable ? new outputType(inArray.length) : new outputType();
 
-  var outHandle = callFunction(HandleCreate, outGrainType);
   var outUnitSize = DESCR_SIZE(outGrainType);
+  var outGrainTypeIsSimple = TypeDescrIsSimpleType(outGrainType);
+  var outPointer = new TypedObjectPointer(outGrainType, result, 0);
 
   // Core of map computation starts here (comparable to
   // DoMapTypedSeqDepth1 and DoMapTypedSeqDepthN below).
 
-  var offset = 0;
   for (var i = 0; i < outLength; i++) {
     // In this loop, since depth is 1, "indices" denotes singleton array [i].
 
-    // Adjust handle to point at &array[...indices] for result array.
-    AttachHandle(outHandle, result, offset);
-
     if (i in inArray) { // Check for holes (only needed for untyped case).
-
-      // Extract element value (no input handles for untyped case).
+      // Extract element value.
       var element = inArray[i];
 
-      // Invoke: var r = func(element, ...indices, collection, out);
-      var r = func(element, i, inArray, outHandle);
+      // Create out pointer to point at &array[...indices] for result array.
+      var out = (outGrainTypeIsSimple ? undefined : outPointer.getDerived());
 
-      if (r !== undefined) {
-        AttachHandle(outHandle, result, offset); // (func could move handle)
-        HandleSet(outHandle, r); // *handle = r; (i.e. result[i] = r).
-      }
+      // Invoke: var r = func(element, ...indices, collection, out);
+      var r = func(element, i, inArray, out);
+
+      if (r !== undefined)
+        outPointer.set(r); // result[i] = r
     }
 
     // Update offset and (implicitly) increment indices.
-    offset += outUnitSize;
+    outPointer.bump(outUnitSize);
   }
 
   return result;
@@ -1320,40 +1232,33 @@ function MapTypedSeqImpl(inArray, depth, outputType, func) {
   // Create a zeroed instance with no data
   var result = outputType.variable ? new outputType(inArray.length) : new outputType();
 
-  var inHandle = callFunction(HandleCreate, inGrainType);
-  var outHandle = callFunction(HandleCreate, outGrainType);
+  var inGrainTypeIsSimple = TypeDescrIsSimpleType(inGrainType);
+  var outGrainTypeIsSimple = TypeDescrIsSimpleType(outGrainType);
+
+  var inPointer = new TypedObjectPointer(inGrainType, inArray, 0);
+  var outPointer = new TypedObjectPointer(outGrainType, result, 0);
+
   var inUnitSize = DESCR_SIZE(inGrainType);
   var outUnitSize = DESCR_SIZE(outGrainType);
 
-  var inGrainTypeIsSimple = TypeDescrIsSimpleType(inGrainType);
-
   // Bug 956914: add additional variants for depth = 2, 3, etc.
 
   function DoMapTypedSeqDepth1() {
-    var inOffset = 0;
-    var outOffset = 0;
-
     for (var i = 0; i < totalLength; i++) {
       // In this loop, since depth is 1, "indices" denotes singleton array [i].
 
-      // Adjust handles to point at &array[...indices] for in and out array.
-      AttachHandle(inHandle, inArray, inOffset);
-      AttachHandle(outHandle, result, outOffset);
-
-      // Extract element value if simple; if not, handle acts as array element.
-      var element = (inGrainTypeIsSimple ? HandleGet(inHandle) : inHandle);
+      // Prepare input element/handle and out pointer
+      var element = inPointer.get();
+      var out = (outGrainTypeIsSimple ? undefined : outPointer.getDerived());
 
       // Invoke: var r = func(element, ...indices, collection, out);
-      var r = func(element, i, inArray, outHandle);
-
-      if (r !== undefined) {
-        AttachHandle(outHandle, result, outOffset); // (func could move handle)
-        HandleSet(outHandle, r); // *handle = r; (i.e. result[i] = r).
-      }
+      var r = func(element, i, inArray, out);
+      if (r !== undefined)
+        outPointer.set(r); // result[i] = r
 
       // Update offsets and (implicitly) increment indices.
-      inOffset += inUnitSize;
-      outOffset += outUnitSize;
+      inPointer.bump(inUnitSize);
+      outPointer.bump(outUnitSize);
     }
 
     return result;
@@ -1362,30 +1267,22 @@ function MapTypedSeqImpl(inArray, depth, outputType, func) {
   function DoMapTypedSeqDepthN() {
     var indices = new Uint32Array(depth);
 
-    var inOffset = 0;
-    var outOffset = 0;
     for (var i = 0; i < totalLength; i++) {
-      // Adjust handles to point at &array[...indices] for in and out array.
-      AttachHandle(inHandle, inArray, inOffset);
-      AttachHandle(outHandle, result, outOffset);
-
-      // Extract element value if simple; if not, handle acts as array element.
-      var element = (inGrainTypeIsSimple ? HandleGet(inHandle) : inHandle);
+      // Prepare input element and out pointer
+      var element = inPointer.get();
+      var out = (outGrainTypeIsSimple ? undefined : outPointer.getDerived());
 
       // Invoke: var r = func(element, ...indices, collection, out);
       var args = [element];
       callFunction(std_Function_apply, std_Array_push, args, indices);
-      callFunction(std_Array_push, args, inArray, outHandle);
+      callFunction(std_Array_push, args, inArray, out);
       var r = callFunction(std_Function_apply, func, void 0, args);
-
-      if (r !== undefined) {
-        AttachHandle(outHandle, result, outOffset); // (func could move handle)
-        HandleSet(outHandle, r);                    // *handle = r
-      }
+      if (r !== undefined)
+        outPointer.set(r); // result[...indices] = r
 
       // Update offsets and explicitly increment indices.
-      inOffset += inUnitSize;
-      outOffset += outUnitSize;
+      inPointer.bump(inUnitSize);
+      outPointer.bump(outUnitSize);
       IncrementIterationSpace(indices, iterationSpace);
     }
 
@@ -1481,14 +1378,15 @@ function FilterTypedSeqImpl(array, func) {
 
   var elementType = arrayType.elementType;
   var flags = new Uint8Array(NUM_BYTES(array.length));
-  var handle = callFunction(HandleCreate, elementType);
   var count = 0;
+  var size = DESCR_SIZE(elementType);
+  var inPointer = new TypedObjectPointer(elementType, array, 0);
   for (var i = 0; i < array.length; i++) {
-    HandleMove(handle, array, i);
-    if (func(HandleGet(handle), i, array)) {
+    if (func(inPointer.get(), i, array)) {
       SET_BIT(flags, i);
       count++;
     }
+    inPointer.bump(size);
   }
 
   var resultType = (arrayType.variable ? arrayType : arrayType.unsized);

js/src/configure.in

@@ -826,6 +826,24 @@ darwin*)
 linux*)
     HOST_OS_ARCH=Linux
     ;;
+kfreebsd*-gnu)
+    HOST_OS_ARCH=GNU_kFreeBSD
+    ;;
+gnu*)
+    HOST_OS_ARCH=GNU
+    ;;
+dragonfly*)
+    HOST_OS_ARCH=DragonFly
+    ;;
+freebsd*)
+    HOST_OS_ARCH=FreeBSD
+    ;;
+netbsd*)
+    HOST_OS_ARCH=NetBSD
+    ;;
+openbsd*)
+    HOST_OS_ARCH=OpenBSD
+    ;;
 solaris*)
     HOST_OS_ARCH=SunOS
     SOLARIS_SUNPRO_CC=

js/src/ctypes/CTypes.cpp

@@ -5138,7 +5138,7 @@ StructType::BuildFieldsArray(JSContext* cx, JSObject* obj)
       return nullptr;
   }
 
-  RootedObject fieldsProp(cx, JS_NewArrayObject(cx, len, fieldsVec.begin()));
+  RootedObject fieldsProp(cx, JS_NewArrayObject(cx, fieldsVec));
   if (!fieldsProp)
     return nullptr;
 
@@ -5946,7 +5946,7 @@ FunctionType::ArgTypesGetter(JSContext* cx, JS::CallArgs args)
       for (size_t i = 0; i < len; ++i)
         vec[i] = JS::ObjectValue(*fninfo->mArgTypes[i]);
 
-      argTypes = JS_NewArrayObject(cx, len, vec.begin());
+      argTypes = JS_NewArrayObject(cx, vec);
       if (!argTypes)
         return false;
   }

js/src/gdb/tests/test-Root.cpp

@@ -25,7 +25,7 @@ FRAGMENT(Root, handle) {
 
 FRAGMENT(Root, HeapSlot) {
   JS::Rooted<jsval> plinth(cx, STRING_TO_JSVAL(JS_NewStringCopyZ(cx, "plinth")));
-  JS::Rooted<JSObject *> array(cx, JS_NewArrayObject(cx, 1, plinth.address()));
+  JS::Rooted<JSObject *> array(cx, JS_NewArrayObject(cx, plinth));
 
   breakpoint();
 

js/src/jit-test/tests/TypedObject/gcunattachedhandle.js

@@ -1,13 +0,0 @@
-// Test that we can trace a unattached handle.
-
-/*
- * Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/licenses/publicdomain/
- */
-
-if (!this.hasOwnProperty("TypedObject"))
-  quit();
-
-var Object = TypedObject.Object;
-var handle0 = Object.handle();
-gc();