From 8aacb59cf6e309433921f85d7a387dcbb4fe3993 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Thu, 27 May 2010 16:08:19 +0300
Subject: [PATCH 01/45] Bug 566280 - Text run prefixed by U+0000 shows only
 U+FFFD. r=sicking.

--HG--
extra : rebase_source : 86afd6adeba2231c526857a19e27e291296f60d1
---
 layout/reftests/bugs/228856-2-style-1.css     | Bin 0 -> 1019 bytes
 layout/reftests/bugs/228856-2.html            | Bin 7183 -> 6183 bytes
 layout/reftests/reftest.list                  |   3 +++
 parser/html/javasrc/Tokenizer.java            |   3 +--
 parser/html/nsHtml5Tokenizer.cpp              |   3 +--
 .../tests/reftest/bug566280-1-ref.html        |   2 ++
 .../htmlparser/tests/reftest/bug566280-1.html | Bin 0 -> 19 bytes
 parser/htmlparser/tests/reftest/reftest.list  |   2 ++
 8 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 layout/reftests/bugs/228856-2-style-1.css
 create mode 100644 parser/htmlparser/tests/reftest/bug566280-1-ref.html
 create mode 100644 parser/htmlparser/tests/reftest/bug566280-1.html
 create mode 100644 parser/htmlparser/tests/reftest/reftest.list

diff --git a/layout/reftests/bugs/228856-2-style-1.css b/layout/reftests/bugs/228856-2-style-1.css
new file mode 100644
index 0000000000000000000000000000000000000000..a6d6acf36a1f9e09007d24dfbf9d57b016d870c5
GIT binary patch
literal 1019
zcmZuw%Wi`(5agV%ScyZVNI0}<NJ38SH}uHG*jum)wq@K@Rn&j4c~fGJGdrHKXW0N~
zxYyJaLPoi=R@G^I1*R%x(!8SV^9mnI+UOfaQQ9<D6~Dso2EZD)!wroUj8+k?L?KhK
zO7|ppq^6t;SwyB&LQIZWJJxCUJILM9O*_8ZJAjLu6ZEc77)06IrjTe0wUVmQlws@K
z%il|E5E`tIS!Eh%O7&H7kjhO{%Sxc~$Cl2WK<^M{v3Qz24Dv2$D6;t32OqN70|(;8
zgNoqjLzBRVo&eUcyAsJ_=7~p`Hy&Z$cqCw+c!c@l5$20Wm_J@9&Mx6PH$W&Z#B)o+
z&hEV*#|gWH597;1wNbiVDg4)Hj&9qKTGttEU^}ddt8hEDtJ}xR;_jRIzGB@L+;iiK
zP4(+Tn{p6#OAj;GJ?0=>b5rAkHeKkF@#cee$(=?n9plb^=QX!D^D=X0upC!dzdmp<
Oac>I_`Jilnqs<>v_$Ool

literal 0
HcmV?d00001

diff --git a/layout/reftests/bugs/228856-2.html b/layout/reftests/bugs/228856-2.html
index 087a2a5e660d4d6b867544bf8fafe224efbab4bc..0bc8ebb5c525c30f0c3f586c223e2ac4b7054455 100644
GIT binary patch
delta 60
zcmeCTSZ=W4G?RW#W?r^JQEHBDaY<!PYH>ztYKcNdQEHm4l97>xg{hgYkuF$9*HACH
MxL9fPBQ{-80HQP$*8l(j

delta 1068
zcmZuxOHSl46pUETo;6QofrJ#dhfmX;hLPY5v&_bE9*IRdwrulhp;3;&F=jgw$Cw+j
z!uf~By{vlWs`p9%rEjZ${|{<ocO`<|DZDwh_+l5_nB!kR02I7#na)KOrP5ltjp+us
zETxXqlJSQP+{?;F&nWW3#;Gi`4g7I3tKk)%P+P%S8L?92RSZ_Dj?5gXSeA(@k94D~
zW1!>`w~lt=#VMrjZPV1BE*y}FC#UFaA=iji=NrRPS=h=-8pSv^)}8!!fd;`~iQGzU
zz!dVa%%GC4nps`|t9G_<_5@mo8p4E%pOcBktc@Cqgr51}^MrcfKwNlG5nTGvWiX;O
zOomqgBi_TVDUwj`$w#<1AK~77B;cNWga@@JAmOusV?M(D`9iUB5%+@wgknvmK4;IY
z+{DN7sei)P;kWwvQk9mfxhwp#)zlrYMrPgGn1Pf2RNPQc`VB*<n(-yH{Y`wg<ytjM
z?#SWJ#*L`+CTFi~Pk(G9RP8)_;XXGGwb#Zo-E!!?<!TCZ@@gRCA@CGtwa?8ST~D0u
gJ%>A1x8FDzxx1qoiCHggzNYI%`_J(HaS$DT0?GC}C;$Ke

diff --git a/layout/reftests/reftest.list b/layout/reftests/reftest.list
index 4bb547ae608..500deefe7c4 100644
--- a/layout/reftests/reftest.list
+++ b/layout/reftests/reftest.list
@@ -147,6 +147,9 @@ include object/reftest.list
 # ogg-video/
 include ogg-video/reftest.list
 
+# parser/
+include ../../parser/htmlparser/tests/reftest/reftest.list
+
 # percent-overflow-sizing/
 include percent-overflow-sizing/reftest.list
 
diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index a6c2aa993dd..b1111377da0 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -5858,10 +5858,9 @@ public class Tokenizer implements Locator {
 
     private void emitReplacementCharacter(@NoLength char[] buf, int pos)
             throws SAXException {
-        silentCarriageReturn();
         flushChars(buf, pos);
         tokenHandler.characters(Tokenizer.REPLACEMENT_CHARACTER, 0, 1);
-        cstart = Integer.MAX_VALUE;
+        cstart = pos + 1;
     }
 
     private void setAdditionalAndRememberAmpersandLocation(char add) {
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 0bd846cc034..523bb10d1ff 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -3338,10 +3338,9 @@ nsHtml5Tokenizer::emitCarriageReturn(PRUnichar* buf, PRInt32 pos)
 void 
 nsHtml5Tokenizer::emitReplacementCharacter(PRUnichar* buf, PRInt32 pos)
 {
-  silentCarriageReturn();
   flushChars(buf, pos);
   tokenHandler->characters(nsHtml5Tokenizer::REPLACEMENT_CHARACTER, 0, 1);
-  cstart = PR_INT32_MAX;
+  cstart = pos + 1;
 }
 
 void 
diff --git a/parser/htmlparser/tests/reftest/bug566280-1-ref.html b/parser/htmlparser/tests/reftest/bug566280-1-ref.html
new file mode 100644
index 00000000000..374fca014ab
--- /dev/null
+++ b/parser/htmlparser/tests/reftest/bug566280-1-ref.html
@@ -0,0 +1,2 @@
+<body>&#xFFFD;hello world
+
diff --git a/parser/htmlparser/tests/reftest/bug566280-1.html b/parser/htmlparser/tests/reftest/bug566280-1.html
new file mode 100644
index 0000000000000000000000000000000000000000..3aa60caf343f365c2d69988ce78564de20fcdb4e
GIT binary patch
literal 19
acmcCX%1^1ZW5`I&$;nqJ&o9bJ;Q|0b>jsYi

literal 0
HcmV?d00001

diff --git a/parser/htmlparser/tests/reftest/reftest.list b/parser/htmlparser/tests/reftest/reftest.list
new file mode 100644
index 00000000000..ffced6239bb
--- /dev/null
+++ b/parser/htmlparser/tests/reftest/reftest.list
@@ -0,0 +1,2 @@
+== bug566280-1.html bug566280-1-ref.html
+

From 8e9fa5d7611eed0bcf3f57eb4b28635e5fdb1502 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Wed, 2 Jun 2010 14:01:57 +0300
Subject: [PATCH 02/45] Bug 568800 - Make &foo= not expand in an attribute
 value. r=sicking.

--HG--
extra : rebase_source : ae54f51fba1896ac1545b003edf379c21e609d47
---
 parser/html/javasrc/Tokenizer.java | 11 ++++++-----
 parser/html/nsHtml5Tokenizer.cpp   |  4 ++--
 parser/html/nsHtml5Tokenizer.h     |  2 +-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index b1111377da0..a8adb7d9986 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 
@@ -26,9 +26,9 @@
 /*
  * The comments following this one that use the same comment syntax as this 
  * comment are quotes from the WHATWG HTML 5 spec as of 2 June 2007 
- * amended as of June 18 2008.
+ * amended as of June 18 2008 and May 31 2010.
  * That document came with this statement:
- * "© Copyright 2004-2008 Apple Computer, Inc., Mozilla Foundation, and 
+ * "© Copyright 2004-2010 Apple Computer, Inc., Mozilla Foundation, and 
  * Opera Software ASA. You are granted a license to use, reproduce and 
  * create derivative works of this document."
  */
@@ -4516,11 +4516,12 @@ public class Tokenizer implements Locator {
                                     ch = strBuf[strBufMark];
                                     // }
                                 }
-                                if ((ch >= '0' && ch <= '9')
+                                if (ch == '=' || (ch >= '0' && ch <= '9')
                                         || (ch >= 'A' && ch <= 'Z')
                                         || (ch >= 'a' && ch <= 'z')) {
                                     /*
-                                     * and the next character is in the range
+                                     * and the next character is either a U+003D
+                                     * EQUALS SIGN character (=) or in the range
                                      * U+0030 DIGIT ZERO to U+0039 DIGIT NINE,
                                      * U+0041 LATIN CAPITAL LETTER A to U+005A
                                      * LATIN CAPITAL LETTER Z, or U+0061 LATIN
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 523bb10d1ff..6acc66d16da 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 
@@ -2397,7 +2397,7 @@ nsHtml5Tokenizer::stateLoop(PRInt32 state, PRUnichar c, PRInt32 pos, PRUnichar*
               } else {
                 ch = strBuf[strBufMark];
               }
-              if ((ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z')) {
+              if (ch == '=' || (ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z')) {
 
                 appendStrBufToLongStrBuf();
                 state = returnState;
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index d1ef7885a1e..6b17914c2c6 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 

From 6bc64b5063be9a53be314ac9ae9501945b21f2ea Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Wed, 9 Jun 2010 09:44:25 +0300
Subject: [PATCH 03/45] Bug 563514 - Avoid leaking or misplacing attributes on
 stray <html> and <body> tokens in the innerHTML case. r=jonas.

--HG--
extra : rebase_source : 174666b3ec6c0a7e6251fe34b6bf23c499ad3575
---
 parser/html/javasrc/TreeBuilder.java          | 75 +++++++++++++------
 parser/html/nsHtml5TreeBuilder.cpp            | 69 +++++++++++------
 parser/html/nsHtml5TreeBuilder.h              |  2 +-
 .../htmlparser/tests/crashtests/563514-1.html | 10 +++
 .../tests/crashtests/crashtests.list          |  1 +
 5 files changed, 110 insertions(+), 47 deletions(-)
 create mode 100644 parser/htmlparser/tests/crashtests/563514-1.html

diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index 05cfd6253db..a272169c298 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -1793,8 +1793,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                         switch (group) {
                             case HTML:
                                 err("Stray \u201Chtml\u201D start tag.");
-                                addAttributesToHtml(attributes);
-                                attributes = null; // CPP
+                                if (!fragment) {
+                                    addAttributesToHtml(attributes);
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case BASE:
                             case LINK:
@@ -1807,8 +1809,9 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                                 break inbodyloop;
                             case BODY:
                                 err("\u201Cbody\u201D start tag found but the \u201Cbody\u201D element is already open.");
-                                addAttributesToBody(attributes);
-                                attributes = null; // CPP
+                                if (addAttributesToBody(attributes)) {
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case P:
                             case DIV_OR_BLOCKQUOTE_OR_CENTER_OR_MENU:
@@ -2302,8 +2305,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                         switch (group) {
                             case HTML:
                                 err("Stray \u201Chtml\u201D start tag.");
-                                addAttributesToHtml(attributes);
-                                attributes = null; // CPP
+                                if (!fragment) {
+                                    addAttributesToHtml(attributes);
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case BASE:
                             case COMMAND:
@@ -2386,8 +2391,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                             // XXX did Hixie really mean to omit "base"
                             // here?
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case LINK:
                             appendVoidElementToCurrentMayFoster(
@@ -2432,8 +2439,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case COL:
                             appendVoidElementToCurrentMayFoster(
@@ -2479,8 +2488,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case OPTION:
                             if (isCurrent("option")) {
@@ -2555,8 +2566,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         default:
                             err("Stray \u201C" + name + "\u201D start tag.");
@@ -2585,8 +2598,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case NOFRAMES:
                             appendToCurrentNodeAndPushElement(
@@ -2675,8 +2690,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case HEAD:
                             /*
@@ -2719,8 +2736,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case BODY:
                             if (attributes.getLength() == 0) {
@@ -2825,8 +2844,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         default:
                             err("Stray \u201C" + name + "\u201D start tag.");
@@ -4542,7 +4563,13 @@ public abstract class TreeBuilder<T> implements TokenHandler,
         return 0;
     }
 
-    private void addAttributesToBody(HtmlAttributes attributes)
+    /**
+     * Attempt to add attribute to the body element.
+     * @param attributes the attributes
+     * @return <code>true</code> iff the attributes were added
+     * @throws SAXException
+     */
+    private boolean addAttributesToBody(HtmlAttributes attributes)
             throws SAXException {
         // [NOCPP[
         checkAttributes(attributes, "http://www.w3.org/1999/xhtml");
@@ -4551,8 +4578,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
             StackNode<T> body = stack[1];
             if (body.group == TreeBuilder.BODY) {
                 addAttributesToElement(body.node, attributes);
+                return true;
             }
         }
+        return false;
     }
 
     private void addAttributesToHtml(HtmlAttributes attributes)
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index 8a3e5ba6ded..b0c96051311 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -888,8 +888,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
           switch(group) {
             case NS_HTML5TREE_BUILDER_HTML: {
 
-              addAttributesToHtml(attributes);
-              attributes = nsnull;
+              if (!fragment) {
+                addAttributesToHtml(attributes);
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_BASE:
@@ -903,8 +905,9 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
             }
             case NS_HTML5TREE_BUILDER_BODY: {
 
-              addAttributesToBody(attributes);
-              attributes = nsnull;
+              if (addAttributesToBody(attributes)) {
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_P:
@@ -1287,8 +1290,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
           switch(group) {
             case NS_HTML5TREE_BUILDER_HTML: {
 
-              addAttributesToHtml(attributes);
-              attributes = nsnull;
+              if (!fragment) {
+                addAttributesToHtml(attributes);
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_BASE:
@@ -1357,8 +1362,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_LINK: {
@@ -1403,8 +1410,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_COL: {
@@ -1452,8 +1461,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_OPTION: {
@@ -1523,8 +1534,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           default: {
@@ -1555,8 +1568,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_NOFRAMES: {
@@ -1601,8 +1616,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_HEAD: {
@@ -1622,8 +1639,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_BODY: {
@@ -1717,8 +1736,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           default: {
@@ -3305,15 +3326,17 @@ nsHtml5TreeBuilder::findLastOrRoot(PRInt32 group)
   return 0;
 }
 
-void 
+PRBool 
 nsHtml5TreeBuilder::addAttributesToBody(nsHtml5HtmlAttributes* attributes)
 {
   if (currentPtr >= 1) {
     nsHtml5StackNode* body = stack[1];
     if (body->group == NS_HTML5TREE_BUILDER_BODY) {
       addAttributesToElement(body->node, attributes);
+      return PR_TRUE;
     }
   }
+  return PR_FALSE;
 }
 
 void 
diff --git a/parser/html/nsHtml5TreeBuilder.h b/parser/html/nsHtml5TreeBuilder.h
index 69d5d262d2a..38eef183810 100644
--- a/parser/html/nsHtml5TreeBuilder.h
+++ b/parser/html/nsHtml5TreeBuilder.h
@@ -154,7 +154,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
     PRInt32 findInListOfActiveFormattingElementsContainsBetweenEndAndLastMarker(nsIAtom* name);
     PRInt32 findLastOrRoot(nsIAtom* name);
     PRInt32 findLastOrRoot(PRInt32 group);
-    void addAttributesToBody(nsHtml5HtmlAttributes* attributes);
+    PRBool addAttributesToBody(nsHtml5HtmlAttributes* attributes);
     void addAttributesToHtml(nsHtml5HtmlAttributes* attributes);
     void pushHeadPointerOntoStack();
     void reconstructTheActiveFormattingElements();
diff --git a/parser/htmlparser/tests/crashtests/563514-1.html b/parser/htmlparser/tests/crashtests/563514-1.html
new file mode 100644
index 00000000000..b96ce14661d
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/563514-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<head>
+<script>
+function boom()
+{
+  document.createElement("span").innerHTML = "<body a='b'>";
+}
+</script>
+</head>
+<body onload="boom();"></body>
\ No newline at end of file
diff --git a/parser/htmlparser/tests/crashtests/crashtests.list b/parser/htmlparser/tests/crashtests/crashtests.list
index 7227232ad93..b0bde587e9c 100644
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -41,3 +41,4 @@ load 515816-1.html
 load 525229-1.html
 load 522326-1.html
 load 536097-1.html
+load 563514-1.html

From ab3aebcd710b0d9acd87513719dafd901b0987ae Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Wed, 9 Jun 2010 11:23:25 +0300
Subject: [PATCH 04/45] Bustage fix for bad merge of bug 569538.

---
 content/html/content/public/nsHTMLMediaElement.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/html/content/public/nsHTMLMediaElement.h b/content/html/content/public/nsHTMLMediaElement.h
index 506225a8fe0..a872652f651 100644
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@@ -67,7 +67,7 @@ public:
     CANPLAY_YES
   };
 
-  nsHTMLMediaElement(nsINodeInfo *aNodeInfo, PRBool aFromParser = 0);
+  nsHTMLMediaElement(nsINodeInfo *aNodeInfo, PRUint32 aFromParser = 0);
   virtual ~nsHTMLMediaElement();
 
   /**

From 05f1de28918930d0af89bee329b7ae046829fd42 Mon Sep 17 00:00:00 2001
From: Mark Banner <bugzilla@standard8.plus.com>
Date: Wed, 9 Jun 2010 09:52:38 +0100
Subject: [PATCH 05/45] Disable TestWinDND.cpp due to permanent test failures
 on non-libxul apps - i.e. not Firefox, as it isn't run in those
 configurations. Bug 565392 will fix and re-enable.

---
 widget/src/windows/tests/TestWinDND.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/widget/src/windows/tests/TestWinDND.cpp b/widget/src/windows/tests/TestWinDND.cpp
index 549aeb22c99..0b660c93456 100644
--- a/widget/src/windows/tests/TestWinDND.cpp
+++ b/widget/src/windows/tests/TestWinDND.cpp
@@ -754,6 +754,9 @@ nsresult Do_Test3()
 
 int main(int argc, char** argv)
 {
+  printf("TestWinDND.cpp disabled due to failures after bug 565392 (and it doesn't run on normal FF tests).");
+  return 0;
+
   ScopedXPCOM xpcom("Test Windows Drag and Drop");
 
   nsCOMPtr<nsIFile> file;

From 9ced295f5a2d5a6e5f68c538912a068bc3528c57 Mon Sep 17 00:00:00 2001
From: Makoto Kato <m_kato@ga2.so-net.ne.jp>
Date: Wed, 9 Jun 2010 20:18:51 +0900
Subject: [PATCH 06/45] Bug 570882 - Need assembler optimization for VPX on
 Windows x64. r=cpearce

---
 configure.in                                 |  9 ++-
 media/libvpx/Makefile.in                     |  2 +
 media/libvpx/vpx_config.asm                  |  2 +
 media/libvpx/vpx_config.h                    |  4 ++
 media/libvpx/vpx_config_c.c                  |  3 +
 media/libvpx/vpx_config_x86_64-win64-vs8.asm | 61 ++++++++++++++++++
 media/libvpx/vpx_config_x86_64-win64-vs8.c   |  2 +
 media/libvpx/vpx_config_x86_64-win64-vs8.h   | 65 ++++++++++++++++++++
 8 files changed, 146 insertions(+), 2 deletions(-)
 create mode 100644 media/libvpx/vpx_config_x86_64-win64-vs8.asm
 create mode 100644 media/libvpx/vpx_config_x86_64-win64-vs8.c
 create mode 100644 media/libvpx/vpx_config_x86_64-win64-vs8.h

diff --git a/configure.in b/configure.in
index 9dba3e82f0e..91252ae5364 100644
--- a/configure.in
+++ b/configure.in
@@ -5915,7 +5915,8 @@ if test -n "$MOZ_WEBM"; then
         fi
     else 
 
-      dnl For Darwin x86, Darwin x86_64, and Linux x86 we can use YASM.
+      dnl For Darwin x86, Darwin x86_64, Linux x86, and WINNT x86_64
+      dhl we can use YASM.
       AC_MSG_CHECKING([for YASM assembler])
       AC_CHECK_PROGS(VPX_AS, yasm, "")
       if test -n "$VPX_AS"; then
@@ -5933,9 +5934,13 @@ if test -n "$MOZ_WEBM"; then
           VPX_ASFLAGS="-f macho64 -rnasm -pnasm -DPIC"
           VPX_X86_ASM=1
         ;;
+        WINNT:x86_64)
+          VPX_ASFLAGS="-f x64 -rnasm -pnasm"
+          VPX_X86_ASM=1
+        ;;
         esac
       fi # end have YASM
-    fi # end !WINNT
+    fi # end !WINNT_x86_MSVC
 
     if test -n "$VPX_X86_ASM"; then
       AC_DEFINE(VPX_X86_ASM)
diff --git a/media/libvpx/Makefile.in b/media/libvpx/Makefile.in
index f45a99f81c3..f73acfb2023 100644
--- a/media/libvpx/Makefile.in
+++ b/media/libvpx/Makefile.in
@@ -192,10 +192,12 @@ ASFILES += \
   $(NULL)
 
 ifeq ($(OS_ARCH),WINNT)
+ifneq ($(OS_TEST),x86_64)
 ASFILES += \
   safeseh.asm \
   $(NULL)
 endif
+endif
 
 endif
  
diff --git a/media/libvpx/vpx_config.asm b/media/libvpx/vpx_config.asm
index 6a9597ba977..53447025508 100644
--- a/media/libvpx/vpx_config.asm
+++ b/media/libvpx/vpx_config.asm
@@ -6,4 +6,6 @@
 %include "vpx_config_x86_64-darwin9-gcc.asm"
 %elifidn __OUTPUT_FORMAT__,win32
 %include "vpx_config_x86-win32-vs8.asm"
+%elifidn __OUTPUT_FORMAT__,x64
+%include "vpx_config_x86_64-win64-vs8.asm"
 %endif
diff --git a/media/libvpx/vpx_config.h b/media/libvpx/vpx_config.h
index 583486dce7b..25e9cdb930b 100644
--- a/media/libvpx/vpx_config.h
+++ b/media/libvpx/vpx_config.h
@@ -16,6 +16,10 @@
 /* 32 bit Linux. */
 #include "vpx_config_x86-linux-gcc.h"
 
+#elif defined(_MSC_VER) && defined(_M_X64)
+/* 64 bit Windows */
+#include "vpx_config_x86_64-win64-vs8.h"
+
 #else
 #error VPX_X86_ASM is defined, but assembly not supported on this platform!
 #endif
diff --git a/media/libvpx/vpx_config_c.c b/media/libvpx/vpx_config_c.c
index 3206380ce7d..9b023e87d47 100644
--- a/media/libvpx/vpx_config_c.c
+++ b/media/libvpx/vpx_config_c.c
@@ -16,6 +16,9 @@
 /* 32 bit Linux. */
 #include "vpx_config_x86-linux-gcc.c"
 
+#elif defined(_MSC_VER) && defined(_M_X64)
+#include "vpx_config_x86_64-win64-vs8.c"
+
 #else
 #error VPX_X86_ASM is defined, but assembly not supported on this platform!
 #endif
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.asm b/media/libvpx/vpx_config_x86_64-win64-vs8.asm
new file mode 100644
index 00000000000..b1c381e0037
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.asm
@@ -0,0 +1,61 @@
+ARCH_ARM equ 0
+ARCH_MIPS equ 0
+ARCH_X86 equ 0
+ARCH_X86_64 equ 1
+ARCH_PPC32 equ 0
+ARCH_PPC64 equ 0
+HAVE_ARMV5TE equ 0
+HAVE_ARMV6 equ 0
+HAVE_ARMV7 equ 0
+HAVE_IWMMXT equ 0
+HAVE_IWMMXT2 equ 0
+HAVE_MIPS32 equ 0
+HAVE_MMX equ 1
+HAVE_SSE equ 1
+HAVE_SSE2 equ 1
+HAVE_SSE3 equ 1
+HAVE_SSSE3 equ 1
+HAVE_ALTIVEC equ 0
+HAVE_VPX_PORTS equ 1
+HAVE_STDINT_H equ 0
+HAVE_ALT_TREE_LAYOUT equ 0
+HAVE_PTHREAD_H equ 0
+HAVE_SYS_MMAN_H equ 0
+CONFIG_EXTERNAL_BUILD equ 1
+CONFIG_INSTALL_DOCS equ 0
+CONFIG_INSTALL_BINS equ 1
+CONFIG_INSTALL_LIBS equ 1
+CONFIG_INSTALL_SRCS equ 0
+CONFIG_DEBUG equ 0
+CONFIG_GPROF equ 0
+CONFIG_GCOV equ 0
+CONFIG_RVCT equ 0
+CONFIG_GCC equ 0
+CONFIG_MSVS equ 1
+CONFIG_PIC equ 0
+CONFIG_BIG_ENDIAN equ 0
+CONFIG_CODEC_SRCS equ 0
+CONFIG_DEBUG_LIBS equ 0
+CONFIG_FAST_UNALIGNED equ 1
+CONFIG_MEM_MANAGER equ 0
+CONFIG_MEM_TRACKER equ 0
+CONFIG_MEM_CHECKS equ 0
+CONFIG_MD5 equ 1
+CONFIG_DEQUANT_TOKENS equ 0
+CONFIG_DC_RECON equ 0
+CONFIG_NEW_TOKENS equ 0
+CONFIG_EVAL_LIMIT equ 0
+CONFIG_RUNTIME_CPU_DETECT equ 1
+CONFIG_POSTPROC equ 1
+CONFIG_POSTPROC_GENERIC equ 0
+CONFIG_MULTITHREAD equ 1
+CONFIG_PSNR equ 0
+CONFIG_VP8_ENCODER equ 0
+CONFIG_VP8_DECODER equ 1
+CONFIG_VP8 equ 1
+CONFIG_ENCODERS equ 0
+CONFIG_DECODERS equ 1
+CONFIG_STATIC_MSVCRT equ 0
+CONFIG_SPATIAL_RESAMPLING equ 1
+CONFIG_REALTIME_ONLY equ 0
+CONFIG_SHARED equ 0
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.c b/media/libvpx/vpx_config_x86_64-win64-vs8.c
new file mode 100644
index 00000000000..a13c649a91c
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.c
@@ -0,0 +1,2 @@
+static const char* const cfg = "--target=x86_64-win64-vs8 --disable-vp8-encoder --disable-examples --disable-install-docs";
+const char *vpx_codec_build_config(void) {return cfg;}
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.h b/media/libvpx/vpx_config_x86_64-win64-vs8.h
new file mode 100644
index 00000000000..06b32fb875f
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.h
@@ -0,0 +1,65 @@
+/* This file automatically generated by configure. Do not edit! */
+#define INLINE      __inline
+#define FORCEINLINE __forceinline
+#define RESTRICT    
+#define ARCH_ARM 0
+#define ARCH_MIPS 0
+#define ARCH_X86 0
+#define ARCH_X86_64 1
+#define ARCH_PPC32 0
+#define ARCH_PPC64 0
+#define HAVE_ARMV5TE 0
+#define HAVE_ARMV6 0
+#define HAVE_ARMV7 0
+#define HAVE_IWMMXT 0
+#define HAVE_IWMMXT2 0
+#define HAVE_MIPS32 0
+#define HAVE_MMX 1
+#define HAVE_SSE 1
+#define HAVE_SSE2 1
+#define HAVE_SSE3 1
+#define HAVE_SSSE3 1
+#define HAVE_ALTIVEC 0
+#define HAVE_VPX_PORTS 1
+#define HAVE_STDINT_H 0
+#define HAVE_ALT_TREE_LAYOUT 0
+#define HAVE_PTHREAD_H 0
+#define HAVE_SYS_MMAN_H 0
+#define CONFIG_EXTERNAL_BUILD 1
+#define CONFIG_INSTALL_DOCS 0
+#define CONFIG_INSTALL_BINS 1
+#define CONFIG_INSTALL_LIBS 1
+#define CONFIG_INSTALL_SRCS 0
+#define CONFIG_DEBUG 0
+#define CONFIG_GPROF 0
+#define CONFIG_GCOV 0
+#define CONFIG_RVCT 0
+#define CONFIG_GCC 0
+#define CONFIG_MSVS 1
+#define CONFIG_PIC 0
+#define CONFIG_BIG_ENDIAN 0
+#define CONFIG_CODEC_SRCS 0
+#define CONFIG_DEBUG_LIBS 0
+#define CONFIG_FAST_UNALIGNED 1
+#define CONFIG_MEM_MANAGER 0
+#define CONFIG_MEM_TRACKER 0
+#define CONFIG_MEM_CHECKS 0
+#define CONFIG_MD5 1
+#define CONFIG_DEQUANT_TOKENS 0
+#define CONFIG_DC_RECON 0
+#define CONFIG_NEW_TOKENS 0
+#define CONFIG_EVAL_LIMIT 0
+#define CONFIG_RUNTIME_CPU_DETECT 1
+#define CONFIG_POSTPROC 1
+#define CONFIG_POSTPROC_GENERIC 0
+#define CONFIG_MULTITHREAD 1
+#define CONFIG_PSNR 0
+#define CONFIG_VP8_ENCODER 0
+#define CONFIG_VP8_DECODER 1
+#define CONFIG_VP8 1
+#define CONFIG_ENCODERS 0
+#define CONFIG_DECODERS 1
+#define CONFIG_STATIC_MSVCRT 0
+#define CONFIG_SPATIAL_RESAMPLING 1
+#define CONFIG_REALTIME_ONLY 0
+#define CONFIG_SHARED 0

From 2a5eb9533441d7189d1271fc1eb3e98168a03839 Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Mon, 31 May 2010 23:02:10 +0200
Subject: [PATCH 07/45] Fix for bug 560462 (Use fast unwrapping for more
 quickstubs), part 3k - use wildcards. r=jst.

---
 js/src/xpconnect/src/dom_quickstubs.qsconf | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/js/src/xpconnect/src/dom_quickstubs.qsconf b/js/src/xpconnect/src/dom_quickstubs.qsconf
index efdac2af73a..fa8e418d8d2 100644
--- a/js/src/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/src/xpconnect/src/dom_quickstubs.qsconf
@@ -149,9 +149,7 @@ members = [
     'nsIDOM3Document.adoptNode',
     'nsIDOM3Document.renameNode',
     'nsIDOM3Node.*',
-    'nsIDOMDOMStringList.item',
-    'nsIDOMDOMStringList.length',
-    'nsIDOMDOMStringList.contains',
+    'nsIDOMDOMStringList.*',
     'nsIDOMDOMTokenList.*',
     'nsIDOMDOMSettableTokenList.*',
     'nsIDOMNameList.getName',
@@ -182,20 +180,17 @@ members = [
     'nsIDOMNSElement.mozMatchesSelector',
 
     # dom/interfaces/css
-    'nsIDOMElementCSSInlineStyle.style',
+    'nsIDOMElementCSSInlineStyle.*',
     'nsIDOMCSS2Properties.*',
     'nsIDOMNSCSS2Properties.*',
-    'nsIDOMRect.top',
-    'nsIDOMRect.right',
-    'nsIDOMRect.left',
-    'nsIDOMRect.bottom',
+    'nsIDOMRect.*',
     'nsIDOMViewCSS.getComputedStyle',
 
     # dom/interfaces/events
     'nsIDOMEventTarget.dispatchEvent',
     'nsIDOMEventTarget.removeEventListener',
     'nsIDOMNSEventTarget.addEventListener',
-    'nsIDOMDocumentEvent.createEvent',
+    'nsIDOMDocumentEvent.*',
 
     'nsIDOMEvent.*',
     'nsIDOMMouseEvent.*',

From 9a7968d97fc4d4f48e97e95472b2ce82d23c4976 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Wed, 9 Jun 2010 17:50:01 +0200
Subject: [PATCH 08/45] Bug 555353: Clear D2D surface before starting draw
 operations. r=jmathies

---
 widget/src/windows/nsWindowGfx.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/widget/src/windows/nsWindowGfx.cpp b/widget/src/windows/nsWindowGfx.cpp
index 35467c5a641..1c409c7e3cf 100644
--- a/widget/src/windows/nsWindowGfx.cpp
+++ b/widget/src/windows/nsWindowGfx.cpp
@@ -506,6 +506,9 @@ DDRAW_FAILED:
               thebesContext->Rectangle(gfxRect(r->x, r->y, r->width, r->height), PR_TRUE);
             }
             thebesContext->Clip();
+            thebesContext->SetOperator(gfxContext::OPERATOR_CLEAR);
+            thebesContext->Paint();
+            thebesContext->SetOperator(gfxContext::OPERATOR_OVER);
           }
 #ifdef WINCE
           thebesContext->SetFlag(gfxContext::FLAG_SIMPLIFY_OPERATORS);

From 97dcee673ec82767fef2f505e3834844fde3ffda Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Wed, 9 Jun 2010 17:50:03 +0200
Subject: [PATCH 09/45] Bug 568495: Do not push cleartype for transparent
 window surfaces. r=jrmuizel

---
 gfx/cairo/cairo/src/cairo-d2d-surface.cpp | 11 ++++++++---
 gfx/cairo/cairo/src/cairo-win32.h         |  3 ++-
 gfx/thebes/public/gfxD2DSurface.h         |  3 ++-
 gfx/thebes/src/gfxD2DSurface.cpp          |  4 ++--
 widget/src/windows/nsWindow.cpp           |  8 +++++++-
 widget/src/windows/nsWindowGfx.cpp        |  8 +++++++-
 6 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
index 510be3e376c..debcbf9d220 100644
--- a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
+++ b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
@@ -451,13 +451,17 @@ _cairo_d2d_surface_push_clip(cairo_d2d_surface_t *d2dsurf)
 	    }
 	    D2D1_RECT_F bounds;
 	    d2dsurf->clipMask->GetBounds(D2D1::IdentityMatrix(), &bounds);
+            D2D1_LAYER_OPTIONS options = D2D1_LAYER_OPTIONS_NONE;
+	    if (d2dsurf->base.content == CAIRO_CONTENT_COLOR) {
+		options = D2D1_LAYER_OPTIONS_INITIALIZE_FOR_CLEARTYPE;
+	    }
 	    d2dsurf->rt->PushLayer(D2D1::LayerParameters(bounds,
 							 d2dsurf->clipMask,
 							 D2D1_ANTIALIAS_MODE_ALIASED,
 							 D2D1::IdentityMatrix(),
 							 1.0,
 							 0,
-							 D2D1_LAYER_OPTIONS_INITIALIZE_FOR_CLEARTYPE),
+							 options),
 				   d2dsurf->clipLayer);
 	}
 	if (d2dsurf->clipRect) {
@@ -2132,7 +2136,8 @@ _cairo_d2d_getextents(void		       *surface,
 /** Helper functions. */
 
 cairo_surface_t*
-cairo_d2d_surface_create_for_hwnd(HWND wnd)
+cairo_d2d_surface_create_for_hwnd(HWND wnd,
+				  cairo_content_t content)
 {
     if (!D3D10Factory::Device() || !D2DSurfFactory::Instance()) {
 	/**
@@ -2145,7 +2150,7 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd)
     cairo_d2d_surface_t *newSurf = static_cast<cairo_d2d_surface_t*>(malloc(sizeof(cairo_d2d_surface_t)));
     new (newSurf) cairo_d2d_surface_t();
 
-    _cairo_surface_init(&newSurf->base, &cairo_d2d_surface_backend, CAIRO_CONTENT_COLOR);
+    _cairo_surface_init(&newSurf->base, &cairo_d2d_surface_backend, content);
     _cairo_surface_clipper_init(&newSurf->clipper, _cairo_d2d_surface_clipper_intersect_clip_path);
 
     RECT rc;
diff --git a/gfx/cairo/cairo/src/cairo-win32.h b/gfx/cairo/cairo/src/cairo-win32.h
index c304f924344..5d6e4c4f045 100644
--- a/gfx/cairo/cairo/src/cairo-win32.h
+++ b/gfx/cairo/cairo/src/cairo-win32.h
@@ -128,10 +128,11 @@ cairo_dwrite_font_face_create_for_dwrite_fontface(void *dwrite_font, void *dwrit
  * Create a D2D surface for an HWND
  *
  * \param wnd Handle for the window
+ * \param content Content of the window, should be COLOR_ALPHA for transparent windows
  * \return New cairo surface
  */
 cairo_public cairo_surface_t *
-cairo_d2d_surface_create_for_hwnd(HWND wnd);
+cairo_d2d_surface_create_for_hwnd(HWND wnd, cairo_content_t content);
 
 /**
  * Create a D2D surface of a certain size.
diff --git a/gfx/thebes/public/gfxD2DSurface.h b/gfx/thebes/public/gfxD2DSurface.h
index 66d46d82292..cc34cf4e8ec 100644
--- a/gfx/thebes/public/gfxD2DSurface.h
+++ b/gfx/thebes/public/gfxD2DSurface.h
@@ -45,7 +45,8 @@
 class THEBES_API gfxD2DSurface : public gfxASurface {
 public:
 
-    gfxD2DSurface(HWND wnd);
+    gfxD2DSurface(HWND wnd,
+                  gfxContentType aContent);
 
     gfxD2DSurface(const gfxIntSize& size,
                   gfxImageFormat imageFormat = ImageFormatRGB24);
diff --git a/gfx/thebes/src/gfxD2DSurface.cpp b/gfx/thebes/src/gfxD2DSurface.cpp
index cd807b5b9fb..851c6bba4e8 100644
--- a/gfx/thebes/src/gfxD2DSurface.cpp
+++ b/gfx/thebes/src/gfxD2DSurface.cpp
@@ -37,9 +37,9 @@
 #include "cairo.h"
 #include "cairo-win32.h"
 
-gfxD2DSurface::gfxD2DSurface(HWND aWnd)
+gfxD2DSurface::gfxD2DSurface(HWND aWnd, gfxContentType aContent)
 {
-    Init(cairo_d2d_surface_create_for_hwnd(aWnd));
+    Init(cairo_d2d_surface_create_for_hwnd(aWnd, (cairo_content_t)aContent));
 }
 
 gfxD2DSurface::gfxD2DSurface(cairo_surface_t *csurf)
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index b30ee272952..ee4547ce894 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -2991,7 +2991,13 @@ gfxASurface *nsWindow::GetThebesSurface()
 #ifdef CAIRO_HAS_D2D_SURFACE
   if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
       gfxWindowsPlatform::RENDER_DIRECT2D) {
-    return (new gfxD2DSurface(mWnd));
+    gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR;
+#if defined(MOZ_XUL)
+    if (mTransparencyMode != eTransparencyOpaque) {
+      content = gfxASurface::CONTENT_COLOR_ALPHA;
+    }
+#endif
+    return (new gfxD2DSurface(mWnd, content));
   } else {
 #endif
     return (new gfxWindowsSurface(mWnd));
diff --git a/widget/src/windows/nsWindowGfx.cpp b/widget/src/windows/nsWindowGfx.cpp
index 1c409c7e3cf..9f605bfb303 100644
--- a/widget/src/windows/nsWindowGfx.cpp
+++ b/widget/src/windows/nsWindowGfx.cpp
@@ -435,7 +435,13 @@ PRBool nsWindow::OnPaint(HDC aDC)
               IsRenderMode(gfxWindowsPlatform::RENDER_DIRECT2D))
           {
             if (!mD2DWindowSurface) {
-              mD2DWindowSurface = new gfxD2DSurface(mWnd);
+              gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR;
+#if defined(MOZ_XUL)
+              if (mTransparencyMode != eTransparencyOpaque) {
+                content = gfxASurface::CONTENT_COLOR_ALPHA;
+              }
+#endif
+              mD2DWindowSurface = new gfxD2DSurface(mWnd, content);
             }
             targetSurface = mD2DWindowSurface;
           }

From 8f00a1ec1ed5fbb8d39ee2988501aec761481984 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Wed, 9 Jun 2010 17:50:05 +0200
Subject: [PATCH 10/45] Some whitespace fixes.

---
 gfx/cairo/cairo/src/cairo-d2d-surface.cpp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
index debcbf9d220..a43fa41d58f 100644
--- a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
+++ b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
@@ -2234,10 +2234,10 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd,
     size.height = sizePixels.height * dpiY;
 
     props = D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT,
-								       D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, D2D1_ALPHA_MODE_PREMULTIPLIED),
-								       dpiX,
-								       dpiY,
-								       D2D1_RENDER_TARGET_USAGE_NONE);
+					 D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, D2D1_ALPHA_MODE_PREMULTIPLIED),
+					 dpiX,
+					 dpiY,
+					 D2D1_RENDER_TARGET_USAGE_NONE);
     hr = D2DSurfFactory::Instance()->CreateDxgiSurfaceRenderTarget(newSurf->backBuf,
 								   props,
 								   &newSurf->rt);
@@ -2246,7 +2246,7 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd,
     }
 
     bitProps = D2D1::BitmapProperties(D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, 
-									       D2D1_ALPHA_MODE_PREMULTIPLIED));
+				      D2D1_ALPHA_MODE_PREMULTIPLIED));
     
     newSurf->rt->CreateSolidColorBrush(D2D1::ColorF(0, 1.0), &newSurf->solidColorBrush);
 
@@ -2326,7 +2326,7 @@ cairo_d2d_surface_create(cairo_format_t format,
     }
 
     props = D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT,
-								       D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, alpha));
+					 D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, alpha));
     hr = D2DSurfFactory::Instance()->CreateDxgiSurfaceRenderTarget(dxgiSurface,
 								   props,
 								   &newSurf->rt);
@@ -2336,7 +2336,7 @@ cairo_d2d_surface_create(cairo_format_t format,
     }
 
     bitProps = D2D1::BitmapProperties(D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, 
-									       alpha));
+				      alpha));
     hr = newSurf->rt->CreateSharedBitmap(IID_IDXGISurface,
 					 dxgiSurface,
 					 &bitProps,

From 58c2a42e8e566d117ce280e8ad9d5cd5d89ca135 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Wed, 9 Jun 2010 19:10:49 +0300
Subject: [PATCH 11/45] Bug 538195, null check JSObject when creating
 XULProtos, r=peterv

---
 content/xul/content/src/nsXULElement.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
index dbbb4a21ae7..9eafcfd793f 100644
--- a/content/xul/content/src/nsXULElement.h
+++ b/content/xul/content/src/nsXULElement.h
@@ -353,6 +353,9 @@ public:
     void Set(void *aObject)
     {
         NS_ASSERTION(!mScriptObject.mObject, "Leaking script object.");
+        if (!aObject) {
+          return;
+        }
 
         nsresult rv = nsContentUtils::HoldScriptObject(mScriptObject.mLangID,
                                                        this,

From a9a4adc8d60583c2981d195e1292b2a303ed7d01 Mon Sep 17 00:00:00 2001
From: Brandon Sterne <bsterne@mozilla.com>
Date: Wed, 9 Jun 2010 09:48:21 -0700
Subject: [PATCH 12/45] Bug 569610 - fix CSP report Content-Type, r=sstamm

---
 content/base/src/contentSecurityPolicy.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/base/src/contentSecurityPolicy.js b/content/base/src/contentSecurityPolicy.js
index a8fc9d09d2c..3269847bba0 100644
--- a/content/base/src/contentSecurityPolicy.js
+++ b/content/base/src/contentSecurityPolicy.js
@@ -287,7 +287,7 @@ ContentSecurityPolicy.prototype = {
 
         try {
           req.open("POST", uris[i], true);
-          req.setRequestHeader('Content-Type', 'application/xml');
+          req.setRequestHeader('Content-Type', 'application/json');
           req.upload.addEventListener("error", failure, false);
           req.upload.addEventListener("abort", failure, false);
           //req.channel.loadFlags |= Ci.nsIRequest.LOAD_BYPASS_CACHE;

From d680a597e41574c2d4609fa27c8b55c94e54b499 Mon Sep 17 00:00:00 2001
From: Sid Stamm <sstamm@mozilla.com>
Date: Wed, 9 Jun 2010 09:48:39 -0700
Subject: [PATCH 13/45] Bug 570017 - allow report-uri with dotless host,
 r=dveditz

---
 content/base/src/CSPUtils.jsm | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/content/base/src/CSPUtils.jsm b/content/base/src/CSPUtils.jsm
index 9cf09bcac1a..17d3fc8d45e 100644
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@@ -178,7 +178,7 @@ CSPRep.fromString = function(aStr, self) {
         try {
           var uri = gIoService.newURI(uriStrings[i],null,null);
           if (self) {
-            if (gETLDService.getBaseDomain(uri) === 
+            if (gETLDService.getBaseDomain(uri) ===
                 gETLDService.getBaseDomain(selfUri)) {
               okUriStrings.push(uriStrings[i]);
             } else {
@@ -187,7 +187,20 @@ CSPRep.fromString = function(aStr, self) {
             }
           }
         } catch(e) {
-          CSPWarning("couldn't parse report URI: " + dirvalue);
+          switch (e.result) {
+            case Components.results.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS:
+            case Components.results.NS_ERROR_HOST_IS_IP_ADDRESS:
+              if (uri.host === selfUri.host) {
+                okUriStrings.push(uriStrings[i]);
+              } else {
+                CSPWarning("page on " + selfUri.host + " cannot send reports to " + uri.host);
+              }
+              break;
+
+            default:
+              CSPWarning("couldn't parse report URI: " + uriStrings[i]);
+              break;
+          }
         }
       }
       aCSPR._directives[UD.REPORT_URI] = okUriStrings.join(' ');

From f103d00e0dbc26349467d7c104810661b14fafb8 Mon Sep 17 00:00:00 2001
From: Sid Stamm <sstamm@mozilla.com>
Date: Wed, 9 Jun 2010 09:48:42 -0700
Subject: [PATCH 14/45] Bug 555068 - make CSP frame-ancestors be explictly
 opt-in, r=dveditz

---
 content/base/src/CSPUtils.jsm           |  8 +++++--
 content/base/test/unit/test_csputils.js | 31 ++++++++++++++++++++++---
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/content/base/src/CSPUtils.jsm b/content/base/src/CSPUtils.jsm
index 17d3fc8d45e..328f08c6d15 100644
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@@ -416,8 +416,12 @@ CSPRep.prototype = {
       var dirv = SD[dir];
       if (dirv === SD.ALLOW) continue;
       if (!this._directives[dirv]) {
-        // implicit directive, make explicit
-        this._directives[dirv] = allowDir.clone();
+        // implicit directive, make explicit.
+        // All but frame-ancestors directive inherit from 'allow' (bug 555068)
+        if (dirv === SD.FRAME_ANCESTORS)
+          this._directives[dirv] = CSPSourceList.fromString("*");
+        else
+          this._directives[dirv] = allowDir.clone();
         this._directives[dirv]._isImplicit = true;
       }
     }
diff --git a/content/base/test/unit/test_csputils.js b/content/base/test/unit/test_csputils.js
index 021c5b3611f..a238eecd3ae 100644
--- a/content/base/test/unit/test_csputils.js
+++ b/content/base/test/unit/test_csputils.js
@@ -350,8 +350,7 @@ test(
 
       var cspr;
       var SD = CSPRep.SRC_DIRECTIVES;
-      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.IMG_SRC,
-                      SD.FRAME_ANCESTORS, SD.FRAME_SRC];
+      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.IMG_SRC, SD.FRAME_SRC];
 
       // check one-directive policies
       cspr = CSPRep.fromString("allow bar.com; script-src https://foo.com", 
@@ -377,7 +376,7 @@ test(
     function test_CSPRep_fromString_twodir() {
       var cspr;
       var SD = CSPRep.SRC_DIRECTIVES;
-      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.FRAME_ANCESTORS, SD.FRAME_SRC];
+      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.FRAME_SRC];
 
       // check two-directive policies
       var polstr = "allow allow.com; "
@@ -448,6 +447,32 @@ test(function test_CSPRep_fromPolicyURI() {
                               cspr_static._directives[SD[i]]);
         }
     });
+
+//////////////// TEST FRAME ANCESTOR DEFAULTS /////////////////
+// (see bug 555068)
+test(function test_FrameAncestor_defaults() {
+      var cspr;
+      var SD = CSPRep.SRC_DIRECTIVES;
+      var self = "http://self.com:34";
+
+      cspr = CSPRep.fromString("allow 'none'", self);
+
+      //"frame-ancestors should default to * not 'allow' value"
+      do_check_true(cspr.permits("https://foo.com:400", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("https://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://self.com", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://subd.self.com:34", SD.FRAME_ANCESTORS));
+
+      cspr = CSPRep.fromString("allow 'none'; frame-ancestors 'self'", self);
+
+      //"frame-ancestors should only allow self"
+      do_check_true(cspr.permits("http://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("https://foo.com:400", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("https://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("http://self.com", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("http://subd.self.com:34", SD.FRAME_ANCESTORS));
+     });
 /*
 
 test(function test_CSPRep_fromPolicyURI_failswhenmixed() {

From f0cfadfb43efbe865d28ae8cf3f79c6d1026f3cf Mon Sep 17 00:00:00 2001
From: Sid Stamm <sstamm@mozilla.com>
Date: Wed, 9 Jun 2010 09:48:44 -0700
Subject: [PATCH 15/45] Bug 553180 - remove Try Again button from CSP
 frame-ancestors error page, r=jst, ui-review=johnath

---
 docshell/resources/content/netError.xhtml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docshell/resources/content/netError.xhtml b/docshell/resources/content/netError.xhtml
index 5a3d26a48e2..83a665ecb62 100644
--- a/docshell/resources/content/netError.xhtml
+++ b/docshell/resources/content/netError.xhtml
@@ -183,7 +183,13 @@
         if (className == "expertBadCert") {
           showSecuritySection();
         }
-        
+
+        if (err == "cspFrameAncestorBlocked") {
+          // Remove the "Try again" button for CSP frame ancestors violation, since it's
+          // almost certainly useless. (Bug 553180)
+          document.getElementById("errorTryAgain").style.display = "none";
+        }
+
         if (err == "nssBadCert") {
           // Remove the "Try again" button for security exceptions, since it's
           // almost certainly useless.

From 379bc3a7ccd42eb4821069e99a3e6b5bb6afe758 Mon Sep 17 00:00:00 2001
From: Ben Hearsum <bhearsum@mozilla.com>
Date: Wed, 9 Jun 2010 12:56:30 -0400
Subject: [PATCH 16/45] Added tag UPDATE_PACKAGING_R11 for changeset
 138f593553b6

---
 .hgtags | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.hgtags b/.hgtags
index 32c5e085d21..75cb27deebf 100644
--- a/.hgtags
+++ b/.hgtags
@@ -37,3 +37,4 @@ fe9cc55b8db7f56f7e68a246acba363743854979 UPDATE_PACKAGING_R8
 376b78fc72230aaf2ca4e279a8f4ef1efd4a1d9f GECKO_1_9_2_BASE
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R9
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R10
+138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R11

From c5d40e9e3881a2e8b3a2b03029cb050d56d23562 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Tue, 8 Jun 2010 12:45:00 +1000
Subject: [PATCH 17/45] Bug 570440 - disable-javaxpcom not recognized after
 configure.in change. r=bsmedberg

---
 configure.in | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/configure.in b/configure.in
index 91252ae5364..2fc1d074fe5 100644
--- a/configure.in
+++ b/configure.in
@@ -5742,14 +5742,16 @@ dnl = Disable plugin support
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(plugins,
 [  --disable-plugins       Disable plugins support],
-    MOZ_PLUGINS=,)
+    MOZ_PLUGINS=,
+    MOZ_PLUGINS=1)
 
 dnl ========================================================
 dnl = Disable building dbm
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(dbm,
 [  --disable-dbm       Disable building dbm],
-    NSS_DISABLE_DBM=1,)
+    NSS_DISABLE_DBM=1,
+    NSS_DISABLE_DBM=)
 
 dnl bi-directional support always on
 IBMBIDI=1
@@ -5799,7 +5801,8 @@ dnl Disable printing
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(printing,
 [  --disable-printing      Disable printing support],
-    NS_PRINTING=,)
+    NS_PRINTING=,
+    NS_PRINTING=1)
 
 if test "$MOZ_WIDGET_TOOLKIT" = "qt"; then
     AC_MSG_WARN([Printing does not work with Qt at this time. Omitting printing support.])
@@ -5858,7 +5861,8 @@ dnl = Disable Ogg Codecs
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(ogg,
 [  --disable-ogg           Disable support for OGG media (Theora video and Vorbis audio)],
-    MOZ_OGG=,)
+    MOZ_OGG=,
+    MOZ_OGG=1)
 
 if test -n "$MOZ_OGG"; then
     AC_DEFINE(MOZ_OGG)
@@ -5954,7 +5958,8 @@ dnl = Disable Wave decoder support
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(wave,
 [  --disable-wave          Disable Wave decoder support],
-    MOZ_WAVE=,)
+    MOZ_WAVE=,
+    MOZ_WAVE=1)
 
 if test -n "$MOZ_WAVE"; then
     AC_DEFINE(MOZ_WAVE)
@@ -6064,7 +6069,8 @@ esac
 MOZ_ARG_ENABLE_BOOL(javaxpcom,
 [  --enable-javaxpcom
                           Enable Java-XPCOM bridge],
-    MOZ_JAVAXPCOM=1,)
+    MOZ_JAVAXPCOM=1,
+    MOZ_JAVAXPCOM=)
 
 case "$host_os" in
   cygwin*|msvc*|mks*)
@@ -6141,7 +6147,8 @@ esac
 
 MOZ_ARG_DISABLE_BOOL(crashreporter,
 [  --disable-crashreporter Disable breakpad crash reporting],
-    MOZ_CRASHREPORTER=,)
+    MOZ_CRASHREPORTER=,
+    MOZ_CRASHREPORTER=1)
 
 if test -n "$MOZ_CRASHREPORTER"; then
    AC_DEFINE(MOZ_CRASHREPORTER)
@@ -6418,7 +6425,8 @@ esac
 
 MOZ_ARG_DISABLE_BOOL(installer,
 [  --disable-installer     Disable building of installer],
-    MOZ_INSTALLER=,)
+    MOZ_INSTALLER=,
+    MOZ_INSTALLER=1)
 if test -n "$MOZ_INSTALLER" -a "$OS_ARCH" = "WINNT"; then
     # Disable installer for Windows builds that use the new toolkit if NSIS
     # isn't in the path.
@@ -8469,7 +8477,8 @@ dnl option to disable necko's wifi scanner
 dnl
 MOZ_ARG_DISABLE_BOOL(necko-wifi,
 [  --disable-necko-wifi    Disable necko wifi scanner],
-    NECKO_WIFI=,)
+    NECKO_WIFI=,
+    NECKO_WIFI=1)
 
 if test "$OS_ARCH" = "OS2"; then
   dnl OS/2 implementation of Necko-WiFi support will be added in bug 506566

From 95053c7e0123b3dddb85dd86d985aa3091068160 Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Wed, 9 Jun 2010 19:53:40 +0100
Subject: [PATCH 18/45] Bug 570354 - CSS mapping missing for link elements.
 r=jwatt

---
 content/svg/content/src/nsSVGAElement.cpp   | 18 ++++++++++++++++++
 content/svg/content/src/nsSVGAElement.h     |  1 +
 layout/reftests/svg/reftest.list            |  1 +
 layout/reftests/svg/text-in-link-03-ref.svg | 11 +++++++++++
 layout/reftests/svg/text-in-link-03.svg     | 11 +++++++++++
 5 files changed, 42 insertions(+)
 create mode 100644 layout/reftests/svg/text-in-link-03-ref.svg
 create mode 100644 layout/reftests/svg/text-in-link-03.svg

diff --git a/content/svg/content/src/nsSVGAElement.cpp b/content/svg/content/src/nsSVGAElement.cpp
index 6e2a77d9639..6611b9dfbfb 100644
--- a/content/svg/content/src/nsSVGAElement.cpp
+++ b/content/svg/content/src/nsSVGAElement.cpp
@@ -167,6 +167,24 @@ nsSVGAElement::GetHrefURI() const
 }
 
 
+NS_IMETHODIMP_(PRBool)
+nsSVGAElement::IsAttributeMapped(const nsIAtom* name) const
+{
+  static const MappedAttributeEntry* const map[] = {
+    sFEFloodMap,
+    sFiltersMap,
+    sFontSpecificationMap,
+    sGradientStopMap,
+    sLightingEffectsMap,
+    sMarkersMap,
+    sTextContentElementsMap,
+    sViewportsMap
+  };
+
+  return FindAttributeDependence(name, map, NS_ARRAY_LENGTH(map)) ||
+    nsSVGAElementBase::IsAttributeMapped(name);
+}
+
 PRBool
 nsSVGAElement::IsFocusable(PRInt32 *aTabIndex, PRBool aWithMouse)
 {
diff --git a/content/svg/content/src/nsSVGAElement.h b/content/svg/content/src/nsSVGAElement.h
index ba6c4460505..7d86ef261a0 100644
--- a/content/svg/content/src/nsSVGAElement.h
+++ b/content/svg/content/src/nsSVGAElement.h
@@ -86,6 +86,7 @@ public:
                               PRBool aCompileEventHandlers);
   virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
                               PRBool aNullParent = PR_TRUE);
+  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
   virtual PRBool IsFocusable(PRInt32 *aTabIndex = nsnull, PRBool aWithMouse = PR_FALSE);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index b5b4e619ccf..08667fdbbb8 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -148,6 +148,7 @@ random-if(MOZ_WIDGET_TOOLKIT=="gtk2") == text-font-weight-01.svg text-font-weigh
 == text-gradient-01.svg text-gradient-01-ref.svg
 == text-in-link-01.svg text-in-link-01-ref.svg
 == text-in-link-02.svg text-in-link-02-ref.svg
+== text-in-link-03.svg text-in-link-03-ref.svg
 # Tests for bug 546813: sanity-check using HTML text, then test SVG behavior.
 != text-language-00.xhtml text-language-00-ref.xhtml
 random-if(MOZ_WIDGET_TOOLKIT=="gtk2") != text-language-01.xhtml text-language-01-ref.xhtml # Fails on Linux tryserver due to lack of CJK fonts.
diff --git a/layout/reftests/svg/text-in-link-03-ref.svg b/layout/reftests/svg/text-in-link-03-ref.svg
new file mode 100644
index 00000000000..6012674181c
--- /dev/null
+++ b/layout/reftests/svg/text-in-link-03-ref.svg
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="300" height="50">
+  <title>Reference to check that CSS works for links</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=570354 -->
+
+  <text x="0" y="25"><tspan font-size="15">AAAAA</tspan></text>
+</svg>
diff --git a/layout/reftests/svg/text-in-link-03.svg b/layout/reftests/svg/text-in-link-03.svg
new file mode 100644
index 00000000000..4c56c7099ca
--- /dev/null
+++ b/layout/reftests/svg/text-in-link-03.svg
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="300" height="50">
+  <title>Testcase to check that CSS works for links</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=570354 -->
+
+  <text x="0" y="25"><a font-size="15"><tspan>AAAAA</tspan></a></text>
+</svg>

From e45a50729fc94695bea59f12b17144b2b1448c0e Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Wed, 9 Jun 2010 21:07:41 +0200
Subject: [PATCH 19/45] Null-check frame (which is needed when bounds
 width/height is zero) and clamp negative values to zero.  b=570884 r=josh

---
 modules/plugin/test/crashtests/570884.html      | 8 ++++++++
 modules/plugin/test/crashtests/crashtests.list  | 1 +
 modules/plugin/test/testplugin/nptest_macosx.mm | 9 ++++++---
 3 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 modules/plugin/test/crashtests/570884.html

diff --git a/modules/plugin/test/crashtests/570884.html b/modules/plugin/test/crashtests/570884.html
new file mode 100644
index 00000000000..7af5cdba533
--- /dev/null
+++ b/modules/plugin/test/crashtests/570884.html
@@ -0,0 +1,8 @@
+<body>
+<embed type="application/x-test" width="20"></embed>
+<embed type="application/x-test" width="10"></embed>
+<embed type="application/x-test" width="0"></embed>
+<embed type="application/x-test" width="20" height="20"></embed>
+<embed type="application/x-test" width="10" height="10"></embed>
+<embed type="application/x-test" width="0" height="0"></embed>
+</body>
diff --git a/modules/plugin/test/crashtests/crashtests.list b/modules/plugin/test/crashtests/crashtests.list
index 4f528770c82..6e27139a181 100644
--- a/modules/plugin/test/crashtests/crashtests.list
+++ b/modules/plugin/test/crashtests/crashtests.list
@@ -4,3 +4,4 @@ load 48856-1.html
 load 110650-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="cocoa") script 539897-1.html
 script 540114-1.html
+load 570884.html
diff --git a/modules/plugin/test/testplugin/nptest_macosx.mm b/modules/plugin/test/testplugin/nptest_macosx.mm
index 60ed16fb6e8..448134f6bea 100644
--- a/modules/plugin/test/testplugin/nptest_macosx.mm
+++ b/modules/plugin/test/testplugin/nptest_macosx.mm
@@ -189,7 +189,8 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
 
     // Initialize a rectangular path.
     CGMutablePathRef path = CGPathCreateMutable();
-    CGRect bounds = CGRectMake(10.0, 10.0, windowWidth - 20.0, windowHeight - 20.0);
+    CGRect bounds = CGRectMake(10.0, 10.0, PR_MAX(0.0, windowWidth - 20.0),
+                               PR_MAX(0.0, windowHeight - 20.0));
     CGPathAddRect(path, NULL, bounds);
 
     // Initialize an attributed string.
@@ -210,8 +211,10 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
     // Create the frame and draw it into the graphics context
     CTFrameRef frame = CTFramesetterCreateFrame(framesetter, CFRangeMake(0, 0), path, NULL);
     CFRelease(framesetter);
-    CTFrameDraw(frame, cgContext);
-    CFRelease(frame);
+    if (frame) {
+      CTFrameDraw(frame, cgContext);
+      CFRelease(frame);
+    }
 
     // restore the cgcontext gstate
     CGContextRestoreGState(cgContext);

From 2b11c7ac0cde1c959344811918e174818a83a0f0 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Wed, 9 Jun 2010 21:08:09 +0200
Subject: [PATCH 20/45] Make nsTransferable::GetTransferData assign the out
 params even when it returns an error since some callers depend on it
 (regression fix).  b=565392 r=dbaron

---
 widget/src/xpwidgets/nsTransferable.cpp |  9 ++++
 widget/tests/Makefile.in                |  3 ++
 widget/tests/test_bug565392.html        | 63 +++++++++++++++++++++++++
 3 files changed, 75 insertions(+)
 create mode 100644 widget/tests/test_bug565392.html

diff --git a/widget/src/xpwidgets/nsTransferable.cpp b/widget/src/xpwidgets/nsTransferable.cpp
index b2f07b0990f..15ff17d7a5d 100644
--- a/widget/src/xpwidgets/nsTransferable.cpp
+++ b/widget/src/xpwidgets/nsTransferable.cpp
@@ -310,6 +310,7 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
   NS_ENSURE_ARG_POINTER(aFlavor && aData && aDataLen);
 
   nsresult rv = NS_OK;
+  nsCOMPtr<nsISupports> savedData;
   
   // first look and see if the data is present in one of the intrinsic flavors
   PRUint32 i;
@@ -334,6 +335,7 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
         dataBytes.forget(aData);
         return NS_OK;
       }
+      savedData = dataBytes;  // return this if format converter fails
       break;
     }
   }
@@ -366,6 +368,13 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
       }
     }
   }
+
+  // for backward compatibility
+  if (!found) {
+    savedData.forget(aData);
+    *aDataLen = 0;
+  }
+
   return found ? NS_OK : NS_ERROR_FAILURE;
 }
 
diff --git a/widget/tests/Makefile.in b/widget/tests/Makefile.in
index 93c555288b7..3f774c8a7d2 100644
--- a/widget/tests/Makefile.in
+++ b/widget/tests/Makefile.in
@@ -97,6 +97,9 @@ _CHROME_FILES  += taskbar_previews.xul \
 		window_state_windows.xul \
 		taskbar_progress.xul \
 		$(NULL)
+
+_TEST_FILES +=	test_bug565392.html \
+		$(NULL)
 endif
 endif
 
diff --git a/widget/tests/test_bug565392.html b/widget/tests/test_bug565392.html
new file mode 100644
index 00000000000..8a303220cd6
--- /dev/null
+++ b/widget/tests/test_bug565392.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=565392
+-->
+<head>
+  <title>Test for Bug 565392</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=565392">Mozilla Bug 565392</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 565392 **/
+
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  const Cc = Components.classes;
+  const Ci = Components.interfaces;
+  var ds = Cc["@mozilla.org/file/directory_service;1"]
+             .getService(Ci.nsIProperties);
+  var dir1 = ds.get("ProfD", Ci.nsIFile);
+  var clipboard = Cc["@mozilla.org/widget/clipboard;1"]
+                    .getService(Ci.nsIClipboard);
+  
+  function getTransferableFile(file) {
+    var transferable = Cc['@mozilla.org/widget/transferable;1']
+                         .createInstance(Ci.nsITransferable);
+    transferable.setTransferData("application/x-moz-file", file, 0);
+    return transferable;
+  }
+
+  function setClipboardData(transferable) {
+    clipboard.setData(transferable, null, 1);
+  }
+  
+  function getClipboardData(mime) {
+    var transferable = Cc['@mozilla.org/widget/transferable;1']
+                         .createInstance(Ci.nsITransferable);
+    transferable.addDataFlavor(mime);
+    clipboard.getData(transferable, 1);
+    var data = {};
+    transferable.getTransferData(mime, data, {}) ;
+    return data;
+  }
+
+setClipboardData(getTransferableFile(dir1))
+is(clipboard.hasDataMatchingFlavors(["application/x-moz-file"], 1,1), true);
+var data = getClipboardData("application/x-moz-file");
+var file = data.value.QueryInterface(Ci.nsIFile);
+ok(file.isDirectory(), true);
+is(file.target, dir1.target, true);
+
+</script>
+</pre>
+</body>
+</html>

From e8f2660f26f085f0f3428271c2ad1708a64891d3 Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Wed, 9 Jun 2010 20:13:03 +0100
Subject: [PATCH 21/45] Bug 569463 - Stop coverity complaining about
 GetParsedAttr call in RebuildPathAndVerticesFromMpathElem. r=jwatt

---
 content/svg/content/src/SVGMotionSMILAnimationFunction.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp b/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
index ee8ddb5e31b..6708fe66f03 100644
--- a/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
+++ b/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
@@ -253,9 +253,9 @@ SVGMotionSMILAnimationFunction::
   // Use the path that's the target of our chosen <mpath> child.
   nsSVGPathElement* pathElem = aMpathElem->GetReferencedPath();
   if (pathElem) {
-    if (pathElem->HasAttr(kNameSpaceID_None, nsGkAtoms::d)) {
-      const nsAString& pathSpec =
-        pathElem->GetParsedAttr(nsGkAtoms::d)->GetStringValue();
+    const nsAttrValue* value = pathElem->GetParsedAttr(nsGkAtoms::d);
+    if (value) {
+      const nsAString& pathSpec = value->GetStringValue();
       nsresult rv = SetPathVerticesFromPathString(pathSpec);
       if (NS_SUCCEEDED(rv)) {
         mPath = pathElem->GetFlattenedPath(

From ae5ba8462340dc48e88e90a2d09bde2470458131 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 9 Jun 2010 14:13:16 -0400
Subject: [PATCH 22/45] Bug 570657 - Make the order of releasing objects and
 removing them in nsCOMArray's consistent; r=shaver

--HG--
extra : rebase_source : 16f05bbfbd31bc01e0545af111dc4e4adbac8e33
---
 xpcom/glue/nsCOMArray.cpp    |  28 ++++----
 xpcom/glue/nsVoidArray.h     |   6 ++
 xpcom/tests/TestCOMArray.cpp | 120 +++++++++++++++++++++++++++++++++++
 3 files changed, 142 insertions(+), 12 deletions(-)

diff --git a/xpcom/glue/nsCOMArray.cpp b/xpcom/glue/nsCOMArray.cpp
index 53fbec3f562..cbc1998513a 100644
--- a/xpcom/glue/nsCOMArray.cpp
+++ b/xpcom/glue/nsCOMArray.cpp
@@ -55,11 +55,7 @@ nsCOMArray_base::nsCOMArray_base(const nsCOMArray_base& aOther)
 
 nsCOMArray_base::~nsCOMArray_base()
 {
-    PRInt32 count = Count(), i;
-    for (i = 0; i < count; ++i) {
-        nsISupports* obj = ObjectAt(i);
-        NS_IF_RELEASE(obj);
-    }                        
+  Clear();
 }
 
 PRInt32
@@ -135,9 +131,10 @@ nsCOMArray_base::RemoveObjectAt(PRInt32 aIndex)
 {
     if (PRUint32(aIndex) < PRUint32(Count())) {
         nsISupports* element = ObjectAt(aIndex);
-        NS_IF_RELEASE(element);
 
-        return mArray.RemoveElementAt(aIndex);
+        PRBool result = mArray.RemoveElementAt(aIndex);
+        NS_IF_RELEASE(element);
+        return result;
     }
 
     return PR_FALSE;
@@ -155,8 +152,10 @@ ReleaseObjects(void* aElement, void*)
 void
 nsCOMArray_base::Clear()
 {
-    mArray.EnumerateForwards(ReleaseObjects, nsnull);
+    nsAutoVoidArray objects;
+    objects = mArray;
     mArray.Clear();
+    objects.EnumerateForwards(ReleaseObjects, nsnull);
 }
 
 PRBool
@@ -167,10 +166,15 @@ nsCOMArray_base::SetCount(PRInt32 aNewCount)
       return PR_FALSE;
 
     PRInt32 count = Count(), i;
-    for (i = aNewCount; i < count; ++i) {
-        nsISupports* obj = ObjectAt(i);
-        NS_IF_RELEASE(obj);
+    nsAutoVoidArray objects;
+    if (count > aNewCount) {
+        objects.SetCount(count - aNewCount);
+        for (i = aNewCount; i < count; ++i) {
+            objects.ReplaceElementAt(ObjectAt(i), i - aNewCount);
+        }
     }
-    return mArray.SetCount(aNewCount);
+    PRBool result = mArray.SetCount(aNewCount);
+    objects.EnumerateForwards(ReleaseObjects, nsnull);
+    return result;
 }
 
diff --git a/xpcom/glue/nsVoidArray.h b/xpcom/glue/nsVoidArray.h
index db90853a5b3..c54b3641f93 100644
--- a/xpcom/glue/nsVoidArray.h
+++ b/xpcom/glue/nsVoidArray.h
@@ -195,6 +195,12 @@ public:
     SetArray(reinterpret_cast<Impl*>(mAutoBuf), kAutoBufSize, 0, PR_FALSE,
              PR_TRUE);
   }
+
+  nsAutoVoidArray& operator=(const nsVoidArray& other)
+  {
+    nsVoidArray::operator=(other);
+    return *this;
+  }
   
 protected:
   // The internal storage
diff --git a/xpcom/tests/TestCOMArray.cpp b/xpcom/tests/TestCOMArray.cpp
index 77ea8a93f98..8df7c2411eb 100644
--- a/xpcom/tests/TestCOMArray.cpp
+++ b/xpcom/tests/TestCOMArray.cpp
@@ -91,6 +91,72 @@ NS_IMPL_ISUPPORTS1(Foo, IFoo)
 typedef nsCOMArray<IFoo> Array;
 
 
+// {0e70a320-be02-11d1-8031-006008159b5a}
+#define NS_IBAR_IID \
+  {0x0e70a320, 0xbe02, 0x11d1,    \
+    {0x80, 0x31, 0x00, 0x60, 0x08, 0x15, 0x9b, 0x5a}}
+
+class IBar : public nsISupports {
+public:
+
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IBAR_IID)
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(IBar, NS_IBAR_IID)
+
+class Bar : public IBar {
+public:
+
+  Bar(nsCOMArray<IBar>& aArray, PRInt32 aIndex);
+  ~Bar();
+
+  // nsISupports implementation
+  NS_DECL_ISUPPORTS
+
+  static PRInt32 sReleaseCalled;
+
+private:
+  nsCOMArray<IBar>& mArray;
+  PRInt32 mIndex;
+};
+
+PRInt32 Bar::sReleaseCalled = 0;
+
+typedef nsCOMArray<IBar> Array2;
+
+Bar::Bar(Array2& aArray, PRInt32 aIndex)
+  : mArray(aArray)
+  , mIndex(aIndex)
+{
+}
+
+Bar::~Bar()
+{
+  if (mArray.RemoveObjectAt(mIndex)) {
+    fail("We should never manage to remove the object here");
+  }
+}
+
+NS_IMPL_ADDREF(Bar)
+NS_IMPL_QUERY_INTERFACE1(Bar, IBar)
+
+NS_IMETHODIMP_(nsrefcnt)
+Bar::Release(void)
+{
+  ++Bar::sReleaseCalled;
+  NS_PRECONDITION(0 != mRefCnt, "dup release");
+  NS_ASSERT_OWNINGTHREAD(_class);
+  --mRefCnt;
+  NS_LOG_RELEASE(this, mRefCnt, "Bar");
+  if (mRefCnt == 0) {
+    mRefCnt = 1; /* stabilize */
+    NS_DELETEXPCOM(this);
+    return 0;
+  }
+  return mRefCnt;
+}
+
+
 int main(int argc, char **argv)
 {
   ScopedXPCOM xpcom("nsCOMArrayTests");
@@ -142,5 +208,59 @@ int main(int argc, char **argv)
     }
   }
 
+  PRInt32 base;
+  {
+    Array2 arr2;
+
+    IBar *ninthObject;
+    for (PRInt32 i = 0; i < 20; ++i) {
+      nsCOMPtr<IBar> bar = new Bar(arr2, i);
+      if (i == 8) {
+        ninthObject = bar;
+      }
+      arr2.AppendObject(bar);
+    }
+
+    base = Bar::sReleaseCalled;
+
+    arr2.SetCount(10);
+    if (Bar::sReleaseCalled != base + 10) {
+      fail("Release called multiple times for SetCount");
+    }
+
+    arr2.RemoveObjectAt(9);
+    if (Bar::sReleaseCalled != base + 11) {
+      fail("Release called multiple times for RemoveObjectAt");
+    }
+
+    arr2.RemoveObject(ninthObject);
+    if (Bar::sReleaseCalled != base + 12) {
+      fail("Release called multiple times for RemoveObject");
+    }
+
+    arr2.Clear();
+    if (Bar::sReleaseCalled != base + 20) {
+      fail("Release called multiple times for Clear");
+    }
+  }
+
+  Bar::sReleaseCalled = 0;
+
+  {
+    Array2 arr2;
+
+    for (PRInt32 i = 0; i < 20; ++i) {
+      nsCOMPtr<IBar> bar  = new Bar(arr2, i);
+      arr2.AppendObject(bar);
+    }
+
+    base = Bar::sReleaseCalled;
+
+    // Let arr2 be destroyed
+  }
+  if (Bar::sReleaseCalled != base + 20) {
+    fail("Release called multiple times for nsCOMArray::~nsCOMArray");
+  }
+
   return rv;
 }

From c2ce8ef50e4eff266d95e13cb372e06dbaf890fb Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 8 Jun 2010 00:31:44 -0400
Subject: [PATCH 23/45] Bug 570417 - All content iterators need to take part in
 cycle collection; r=jst

--HG--
extra : rebase_source : 9681fd61ea2fbaf376390ce85b8cb3c3d040c098
---
 content/base/src/nsContentIterator.cpp | 41 +++++++++++++++-----------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
index 2f2dd2e8f84..8d6d9a57a19 100644
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -122,7 +122,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS(nsContentIterator)
 
-  nsContentIterator();
+  explicit nsContentIterator(PRBool aPre);
   virtual ~nsContentIterator();
 
   // nsIContentIterator interface methods ------------------------------
@@ -208,25 +208,13 @@ private:
 };
 
 
-/*
- *  A simple iterator class for traversing the content in "open tag" order
- */
-
-class nsPreContentIterator : public nsContentIterator
-{
-public:
-  nsPreContentIterator() { mPre = PR_TRUE; }
-};
-
-
-
 /******************************************************
  * repository cruft
  ******************************************************/
 
 nsresult NS_NewContentIterator(nsIContentIterator** aInstancePtrResult)
 {
-  nsContentIterator * iter = new nsContentIterator();
+  nsContentIterator * iter = new nsContentIterator(PR_FALSE);
   if (!iter) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -239,7 +227,7 @@ nsresult NS_NewContentIterator(nsIContentIterator** aInstancePtrResult)
 
 nsresult NS_NewPreContentIterator(nsIContentIterator** aInstancePtrResult)
 {
-  nsContentIterator * iter = new nsPreContentIterator();
+  nsContentIterator * iter = new nsContentIterator(PR_TRUE);
   if (!iter) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -273,9 +261,9 @@ NS_IMPL_CYCLE_COLLECTION_4(nsContentIterator,
  * constructor/destructor
  ******************************************************/
 
-nsContentIterator::nsContentIterator() :
+nsContentIterator::nsContentIterator(PRBool aPre) :
   // don't need to explicitly initialize |nsCOMPtr|s, they will automatically be NULL
-  mCachedIndex(0), mIsDone(PR_FALSE), mPre(PR_FALSE)
+  mCachedIndex(0), mIsDone(PR_FALSE), mPre(aPre)
 {
 }
 
@@ -1182,9 +1170,12 @@ nsContentIterator::GetCurrentNode()
 class nsContentSubtreeIterator : public nsContentIterator 
 {
 public:
-  nsContentSubtreeIterator() {}
+  nsContentSubtreeIterator() : nsContentIterator(PR_FALSE) {}
   virtual ~nsContentSubtreeIterator() {}
 
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+
   // nsContentIterator overrides ------------------------------
 
   virtual nsresult Init(nsINode* aRoot);
@@ -1224,6 +1215,20 @@ protected:
   nsAutoTArray<PRInt32, 8>     mEndOffsets;
 };
 
+NS_IMPL_ADDREF_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+NS_IMPL_RELEASE_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsContentSubtreeIterator)
+NS_INTERFACE_MAP_END_INHERITING(nsContentIterator)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsContentSubtreeIterator)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mRange)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mRange)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
 nsresult NS_NewContentSubtreeIterator(nsIContentIterator** aInstancePtrResult);
 
 

From 09f89152a9bb770e3ee0f7c1610ba7038fbbb6d7 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 9 Jun 2010 14:14:42 -0400
Subject: [PATCH 24/45] Bug 570624 - "ASSERTION: called
 nsGenericElement::SetText"; r=roc

--HG--
extra : rebase_source : 24d41a8eccef1c6d8b3adc6a04ca1a20912263ef
---
 layout/forms/crashtests/570624-1.html   | 15 +++++++++++++++
 layout/forms/crashtests/crashtests.list |  1 +
 layout/forms/nsTextControlFrame.cpp     |  9 ++++-----
 3 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 layout/forms/crashtests/570624-1.html

diff --git a/layout/forms/crashtests/570624-1.html b/layout/forms/crashtests/570624-1.html
new file mode 100644
index 00000000000..47a2777282c
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+  document.body.appendChild(xt);
+  xt.setAttribute('disabled', "true");
+  xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
index d47a5e17133..df644c5817f 100644
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -38,4 +38,5 @@ load 455451-1.html
 load 457537-1.html
 load 457537-2.html
 load 478219-1.xhtml
+load 570624-1.html
 load 498698-1.html
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 13ab357c49d..0247e419634 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -822,9 +822,8 @@ nsTextControlFrame::GetRootNodeAndInitializeEditor(nsIDOMElement **aRootElement)
 {
   NS_ENSURE_ARG_POINTER(aRootElement);
 
-  nsCOMPtr<nsITextControlElement> txtCtrl = do_QueryInterface(GetContent());
-  NS_ASSERTION(txtCtrl, "Content not a text control element");
-  nsIEditor* editor = txtCtrl->GetTextEditor();
+  nsCOMPtr<nsIEditor> editor;
+  GetEditor(getter_AddRefs(editor));
   if (!editor)
     return NS_OK;
 
@@ -1216,9 +1215,9 @@ nsTextControlFrame::AttributeChanged(PRInt32         aNameSpaceID,
   const PRBool needEditor = nsGkAtoms::maxlength == aAttribute ||
                             nsGkAtoms::readonly == aAttribute ||
                             nsGkAtoms::disabled == aAttribute;
-  nsIEditor *editor = nsnull;
+  nsCOMPtr<nsIEditor> editor;
   if (needEditor) {
-    editor = txtCtrl->GetTextEditor();
+    GetEditor(getter_AddRefs(editor));
   }
   if ((needEditor && !editor) || !selCon)
     return nsBoxFrame::AttributeChanged(aNameSpaceID, aAttribute, aModType);;

From 3eccaa0c22855f67099d3a11ee66bc315bb595d4 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 9 Jun 2010 14:26:44 -0400
Subject: [PATCH 25/45] Bug 571018 - Intermittent failure in
 docshell/base/crashtests/432114-2.html | assertion count 2 is more than
 expected 0 to 1 assertions; r=jruderman

--HG--
extra : rebase_source : 2b11ede67bd47e7ebe71116ae6e00eac600d3baa
---
 docshell/base/crashtests/crashtests.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docshell/base/crashtests/crashtests.list b/docshell/base/crashtests/crashtests.list
index adbaed33a99..c19d2d47196 100644
--- a/docshell/base/crashtests/crashtests.list
+++ b/docshell/base/crashtests/crashtests.list
@@ -4,7 +4,7 @@ load 403574-1.xhtml
 load 430124-1.html
 load 430628-1.html
 asserts(1-4) load 432114-1.html # bug 570215
-asserts(0-1) load 432114-2.html # bug 492165
+asserts(0-2) load 432114-2.html # bug 570215, bug 571020
 load 436900-1.html
 asserts(0-2) load 436900-2.html # bug 566159
 load 500328-1.html

From 4f4acdbc5200e5e2b344c38d7723e8ab2f127861 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 3 Jun 2010 21:31:07 -0400
Subject: [PATCH 26/45] Bug 529922 - Make sure that delayedStartup has run,
 therefore the test is valid; r=gavin

---
 browser/base/content/browser.js               |  2 ++
 ...owser_privatebrowsing_newwindow_stopcmd.js | 23 +++++++++----------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 0cd483672d8..376225d9cd4 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1403,6 +1403,8 @@ function delayedStartup(isLoadingBlank, mustLoadSidebar) {
     Win7Features.onOpenWindow();
 
   TabsOnTop.syncCommand();
+
+  Services.obs.notifyObservers(window, "browser-delayed-startup-finished", "");
 }
 
 function BrowserShutdown()
diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
index bb3843d7f86..5110e20663b 100644
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
@@ -47,17 +47,16 @@ function test() {
   pb.privateBrowsingEnabled = true;
 
   let win = OpenBrowserWindow();
-  win.addEventListener("load", function() {
-    executeSoon(function() {
-      executeSoon(function() {
-        let cmd = win.document.getElementById("Tools:PrivateBrowsing");
-        ok(!cmd.hasAttribute("disabled"),
-           "The Private Browsing command in a new window should be enabled");
+  Services.obs.addObserver(function(subject, topic, data) {
+    Services.obs.removeObserver(arguments.callee, "browser-delayed-startup-finished");
+    var win = subject.QueryInterface(Ci.nsIDOMWindow);
 
-        win.close();
-        pb.privateBrowsingEnabled = false;
-        finish();
-      });
-    });
-  }, false);
+    let cmd = win.document.getElementById("Tools:PrivateBrowsing");
+    ok(!cmd.hasAttribute("disabled"),
+       "The Private Browsing command in a new window should be enabled");
+
+    win.close();
+    pb.privateBrowsingEnabled = false;
+    finish();
+  }, "browser-delayed-startup-finished", false);
 }

From c1d61191da723e4bef053c3d1de91279e1f01563 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 9 Jun 2010 15:26:41 -0400
Subject: [PATCH 27/45] Bug 529922 - review comment

---
 .../test/browser/browser_privatebrowsing_newwindow_stopcmd.js  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
index 5110e20663b..c1c7b4e4447 100644
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
@@ -49,7 +49,8 @@ function test() {
   let win = OpenBrowserWindow();
   Services.obs.addObserver(function(subject, topic, data) {
     Services.obs.removeObserver(arguments.callee, "browser-delayed-startup-finished");
-    var win = subject.QueryInterface(Ci.nsIDOMWindow);
+    var notifiedWin = subject.QueryInterface(Ci.nsIDOMWindow);
+    is(win, notifiedWin, "sanity check");
 
     let cmd = win.document.getElementById("Tools:PrivateBrowsing");
     ok(!cmd.hasAttribute("disabled"),

From b11b045647132645ed5c0c420882a97fb7b36c49 Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Wed, 9 Jun 2010 20:51:31 +0100
Subject: [PATCH 28/45] Bug 570555 - CSS animation on font-size should not
 require units. r=dholbert,sr=roc

---
 content/smil/nsSMILCSSProperty.cpp              |  7 +++----
 content/smil/nsSMILCSSValueType.cpp             |  6 ++----
 content/smil/nsSMILCSSValueType.h               |  3 ---
 content/smil/nsSMILMappedAttribute.cpp          |  7 +++----
 .../style/anim-css-fontsize-1-from-to-no-no.svg | 17 +++++++++++++++++
 .../style/anim-css-fontsize-1-from-to-no-px.svg | 17 +++++++++++++++++
 .../style/anim-css-fontsize-1-from-to-px-no.svg | 17 +++++++++++++++++
 layout/reftests/svg/smil/style/reftest.list     |  5 +++++
 8 files changed, 64 insertions(+), 15 deletions(-)
 create mode 100644 layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg
 create mode 100644 layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg
 create mode 100644 layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg

diff --git a/content/smil/nsSMILCSSProperty.cpp b/content/smil/nsSMILCSSProperty.cpp
index 56818420386..b93a5ac9b40 100644
--- a/content/smil/nsSMILCSSProperty.cpp
+++ b/content/smil/nsSMILCSSProperty.cpp
@@ -145,8 +145,8 @@ nsSMILCSSProperty::GetBaseValue() const
 
   // (4) Populate our nsSMILValue from the computed style
   if (didGetComputedVal) {
-    nsSMILCSSValueType::ValueFromString(mPropID, mElement, computedStyleVal,
-                                        PR_FALSE, baseValue);
+    nsSMILCSSValueType::ValueFromString(mPropID, mElement,
+                                        computedStyleVal, baseValue);
   }
   return baseValue;
 }
@@ -159,8 +159,7 @@ nsSMILCSSProperty::ValueFromString(const nsAString& aStr,
 {
   NS_ENSURE_TRUE(IsPropertyAnimatable(mPropID), NS_ERROR_FAILURE);
 
-  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr,
-                                      PR_FALSE, aValue);
+  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr, aValue);
   if (aValue.IsNull()) {
     return NS_ERROR_FAILURE;
   }
diff --git a/content/smil/nsSMILCSSValueType.cpp b/content/smil/nsSMILCSSValueType.cpp
index bbc1667a2f8..ebbb3bbce86 100644
--- a/content/smil/nsSMILCSSValueType.cpp
+++ b/content/smil/nsSMILCSSValueType.cpp
@@ -337,7 +337,6 @@ ValueFromStringHelper(nsCSSProperty aPropID,
                       nsIContent* aTargetElement,
                       nsPresContext* aPresContext,
                       const nsAString& aString,
-                      PRBool aUseSVGMode,
                       nsStyleAnimation::Value& aStyleAnimValue)
 {
   // If value is negative, we'll strip off the "-" so the CSS parser won't
@@ -353,7 +352,7 @@ ValueFromStringHelper(nsCSSProperty aPropID,
   }
   nsDependentSubstring subString(aString, subStringBegin);
   if (!nsStyleAnimation::ComputeValue(aPropID, aTargetElement, subString,
-                                      aUseSVGMode, aStyleAnimValue)) {
+                                      PR_TRUE, aStyleAnimValue)) {
     return PR_FALSE;
   }
   if (isNegative) {
@@ -376,7 +375,6 @@ void
 nsSMILCSSValueType::ValueFromString(nsCSSProperty aPropID,
                                     nsIContent* aTargetElement,
                                     const nsAString& aString,
-                                    PRBool aUseSVGMode,
                                     nsSMILValue& aValue)
 {
   // XXXbz aTargetElement should be an Element
@@ -389,7 +387,7 @@ nsSMILCSSValueType::ValueFromString(nsCSSProperty aPropID,
 
   nsStyleAnimation::Value parsedValue;
   if (ValueFromStringHelper(aPropID, aTargetElement, presContext,
-                            aString, aUseSVGMode, parsedValue)) {
+                            aString, parsedValue)) {
     sSingleton.Init(aValue);
     aValue.mU.mPtr = new ValueWrapper(aPropID, parsedValue, presContext);
     if (!aValue.mU.mPtr) {
diff --git a/content/smil/nsSMILCSSValueType.h b/content/smil/nsSMILCSSValueType.h
index 5b83864a8e9..8a2037a5540 100644
--- a/content/smil/nsSMILCSSValueType.h
+++ b/content/smil/nsSMILCSSValueType.h
@@ -91,8 +91,6 @@ public:
    * @param       aTargetElement  The target element to whom the property/value
    *                              setting applies.
    * @param       aString         The string to be parsed as a CSS value.
-   * @param       aUseSVGMode     A flag to indicate whether we should parse
-   *                              |aString| in SVG mode.
    * @param [out] aValue          The nsSMILValue to be populated. Should
    *                              initially be null-typed.
    * @pre  aValue.IsNull()
@@ -101,7 +99,6 @@ public:
   static void ValueFromString(nsCSSProperty aPropID,
                               nsIContent* aTargetElement,
                               const nsAString& aString,
-                              PRBool aUseSVGMode,
                               nsSMILValue& aValue);
 
   /**
diff --git a/content/smil/nsSMILMappedAttribute.cpp b/content/smil/nsSMILMappedAttribute.cpp
index 03bb5094222..0e38e8accdf 100644
--- a/content/smil/nsSMILMappedAttribute.cpp
+++ b/content/smil/nsSMILMappedAttribute.cpp
@@ -66,8 +66,7 @@ nsSMILMappedAttribute::ValueFromString(const nsAString& aStr,
 {
   NS_ENSURE_TRUE(IsPropertyAnimatable(mPropID), NS_ERROR_FAILURE);
 
-  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr,
-                                      PR_TRUE, aValue);
+  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr, aValue);
   if (aValue.IsNull()) {
     return NS_ERROR_FAILURE;
   }
@@ -87,8 +86,8 @@ nsSMILMappedAttribute::GetBaseValue() const
                                      baseStringValue);
   nsSMILValue baseValue;
   if (success) {
-    nsSMILCSSValueType::ValueFromString(mPropID, mElement, baseStringValue,
-                                        PR_TRUE, baseValue);
+    nsSMILCSSValueType::ValueFromString(mPropID, mElement,
+                                        baseStringValue, baseValue);
   } else {
     // Attribute is unset -- use computed value.
     // FIRST: Temporarily clear animated value, to make sure it doesn't pollute
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg
new file mode 100644
index 00000000000..2b4e18030e2
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10",
+                           "to"            : "30" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg
new file mode 100644
index 00000000000..7ced25e9af9
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10",
+                           "to"            : "30px" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg
new file mode 100644
index 00000000000..56e51eeab72
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10px",
+                           "to"            : "30" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/reftest.list b/layout/reftests/svg/smil/style/reftest.list
index 80db15d193b..fec6a68b193 100644
--- a/layout/reftests/svg/smil/style/reftest.list
+++ b/layout/reftests/svg/smil/style/reftest.list
@@ -72,6 +72,11 @@ fails == anim-css-fillopacity-3-clamp-big.svg     anim-css-fillopacity-3-ref.svg
 == anim-css-fontsize-1-from-by-px-px.svg    anim-css-fontsize-1-ref.svg
 == anim-css-fontsize-1-from-to-px-px.svg    anim-css-fontsize-1-ref.svg
 
+# 'font-size' property (accepts unitless values)
+== anim-css-fontsize-1-from-to-no-no.svg    anim-css-fontsize-1-ref.svg
+== anim-css-fontsize-1-from-to-no-px.svg    anim-css-fontsize-1-ref.svg
+== anim-css-fontsize-1-from-to-px-no.svg    anim-css-fontsize-1-ref.svg
+
 # 'font-size' mapped attribute (accepts unitless values)
 == anim-mapped-fontsize-1-from-to-no-no.svg anim-css-fontsize-1-ref.svg
 == anim-mapped-fontsize-1-from-to-no-px.svg anim-css-fontsize-1-ref.svg

From 7556e72ac814a92ded3dd935ecd7ebccb2819e2d Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Wed, 9 Jun 2010 13:26:24 -0700
Subject: [PATCH 29/45] Bug 571036: Add reftest-wait to reftest
 dynamic-use-nested-01.svg to hopefully fix randomorange. r=dholbert

---
 layout/reftests/svg/dynamic-use-nested-01.svg | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/layout/reftests/svg/dynamic-use-nested-01.svg b/layout/reftests/svg/dynamic-use-nested-01.svg
index 40fc7078425..437324658c4 100644
--- a/layout/reftests/svg/dynamic-use-nested-01.svg
+++ b/layout/reftests/svg/dynamic-use-nested-01.svg
@@ -1,7 +1,7 @@
 <svg xmlns="http://www.w3.org/2000/svg" version="1.1"
-     xmlns:xlink="http://www.w3.org/1999/xlink" 
-     onload="boom();">
-     
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait" onload="boom();">
+
 <script><![CDATA[
 
 // reftest for bug 467498
@@ -10,19 +10,20 @@ function boom()
 {
   var rect = document.getElementById("rect");
   rect.setAttribute("height", "100%");
+  document.documentElement.removeAttribute('class');
 }
 
 ]]></script>
 
   <!-- change to lime for automated testing -->
-  <rect width="100%" height="100%" fill="white"/>  
+  <rect width="100%" height="100%" fill="white"/>
 
   <g style="fill: blue;">
     <g id="g1">
       <rect id="rect" x="20%" width="4%" height="20%"/>
     </g>
   </g>
-  
+
   <g style="fill: green;">
     <g id="g2">
       <use x="20%" xlink:href="#g1"/>

From 7e43f7cdb2c70f17bf62c159fe0c20a21eb4440e Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Wed, 9 Jun 2010 13:28:29 -0700
Subject: [PATCH 30/45] Bug 570257: fix unsigned/signed comparison build
 warning in WebGLContextValidate.cpp. r=vlad

---
 content/canvas/src/WebGLContextValidate.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp
index 5108a6e3c00..0b732ab06c4 100644
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -63,8 +63,8 @@ WebGLContext::ValidateBuffers(PRUint32 count)
         return PR_FALSE;
     }
 
-    if (currentProgram != mCurrentProgram->GLName()) {
-        LogMessage("WebGL internal error: current program (%d) doesn't agree with GL current program (%d)", mCurrentProgram->GLName(), currentProgram);
+    if (WebGLuint(currentProgram) != mCurrentProgram->GLName()) {
+        LogMessage("WebGL internal error: current program (%u) doesn't agree with GL current program (%d)", mCurrentProgram->GLName(), currentProgram);
         return PR_FALSE;
     }
 

From 39123e7e3db4a4bdf89a93792b88bda0c4eca8b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20O=E2=80=99Shannessy?= <paul@oshannessy.com>
Date: Wed, 9 Jun 2010 13:55:45 -0700
Subject: [PATCH 31/45] Bug 387859 - sessionstore should use native json to
 parse session data [r=zeniko]

---
 .../content/aboutSessionRestore.js            |  7 ++-
 .../sessionstore/nsISessionStore.idl          |  4 +-
 .../sessionstore/src/nsSessionStartup.js      | 22 +++++++---
 .../sessionstore/src/nsSessionStore.js        | 44 ++++++++-----------
 .../test/browser/browser_248970_b.js          |  4 +-
 .../test/browser/browser_345898.js            |  2 +-
 .../test/browser/browser_367052.js            |  2 +-
 .../test/browser/browser_393716.js            |  4 +-
 .../test/browser/browser_394759.js            |  2 +-
 .../browser/browser_394759_privatebrowsing.js |  4 +-
 .../test/browser/browser_447951.js            |  4 +-
 .../test/browser/browser_448741.js            |  4 +-
 .../test/browser/browser_456342.js            |  2 +-
 .../test/browser/browser_461634.js            |  4 +-
 .../test/browser/browser_464199.js            |  4 +-
 .../test/browser/browser_485563.js            |  4 +-
 16 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/browser/components/sessionstore/content/aboutSessionRestore.js b/browser/components/sessionstore/content/aboutSessionRestore.js
index e8f2e2a7cff..aa02af0a715 100644
--- a/browser/components/sessionstore/content/aboutSessionRestore.js
+++ b/browser/components/sessionstore/content/aboutSessionRestore.js
@@ -59,8 +59,7 @@ window.onload = function() {
   event.initUIEvent("input", true, true, window, 0);
   sessionData.dispatchEvent(event);
   
-  var s = new Components.utils.Sandbox("about:blank");
-  gStateObject = Components.utils.evalInSandbox("(" + sessionData.value + ")", s);
+  gStateObject = JSON.parse(sessionData.value);
   
   initTreeView();
   
@@ -121,7 +120,7 @@ function restoreSession() {
       ix--;
     }
   }
-  var stateString = gStateObject.toSource();
+  var stateString = JSON.stringify(gStateObject);
   
   var ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
   var top = getBrowserWindow();
@@ -238,7 +237,7 @@ function restoreSingleTab(aIx, aShifted) {
   var ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
   var tabState = gStateObject.windows[item.parent.ix]
                              .tabs[aIx - gTreeData.indexOf(item.parent) - 1];
-  ss.setTabState(newTab, tabState.toSource());
+  ss.setTabState(newTab, JSON.stringify(tabState));
   
   // respect the preference as to whether to select the tab (the Shift key inverses)
   var prefBranch = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
diff --git a/browser/components/sessionstore/nsISessionStore.idl b/browser/components/sessionstore/nsISessionStore.idl
index e9d2fe8484c..79a96319055 100644
--- a/browser/components/sessionstore/nsISessionStore.idl
+++ b/browser/components/sessionstore/nsISessionStore.idl
@@ -182,7 +182,7 @@ interface nsISessionStore : nsISupports
   /**
    * @param aWindow      is the browser window to set the value for.
    * @param aKey         is the value's name.
-   * @param aStringValue is the value itself (use toSource/eval before setting JS objects).
+   * @param aStringValue is the value itself (use JSON.stringify/parse before setting JS objects).
    */
   void setWindowValue(in nsIDOMWindow aWindow, in AString aKey, in AString aStringValue);
   
@@ -203,7 +203,7 @@ interface nsISessionStore : nsISupports
   /**
    * @param aTab         is the tabbrowser tab to set the value for.
    * @param aKey         is the value's name.
-   * @param aStringValue is the value itself (use toSource/eval before setting JS objects).
+   * @param aStringValue is the value itself (use JSON.stringify/parse before setting JS objects).
    */
   void setTabValue(in nsIDOMNode aTab, in AString aKey, in AString aStringValue);
 
diff --git a/browser/components/sessionstore/src/nsSessionStartup.js b/browser/components/sessionstore/src/nsSessionStartup.js
index b07896fa3c1..4760b068f9b 100644
--- a/browser/components/sessionstore/src/nsSessionStartup.js
+++ b/browser/components/sessionstore/src/nsSessionStartup.js
@@ -125,14 +125,24 @@ SessionStartup.prototype = {
     this._iniString = this._readStateFile(sessionFile);
     if (!this._iniString)
       return;
-    
+
+    // parse the session state into a JS object
+    let initialState;
     try {
-      // parse the session state into JS objects
-      var s = new Cu.Sandbox("about:blank");
-      var initialState = Cu.evalInSandbox("(" + this._iniString + ")", s);
+      // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
+      if (this._iniString.charAt(0) == '(')
+        this._iniString = this._iniString.slice(1, -1);
+      try {
+        initialState = JSON.parse(this._iniString);
+      }
+      catch (exJSON) {
+        var s = new Cu.Sandbox("about:blank");
+        initialState = Cu.evalInSandbox("(" + this._iniString + ")", s);
+        this._iniString = JSON.stringify(initialState);
+      }
     }
-    catch (ex) { debug("The session file is invalid: " + ex); } 
-    
+    catch (ex) { debug("The session file is invalid: " + ex); }
+
     let lastSessionCrashed =
       initialState && initialState.session && initialState.session.state &&
       initialState.session.state == STATE_RUNNING_STR;
diff --git a/browser/components/sessionstore/src/nsSessionStore.js b/browser/components/sessionstore/src/nsSessionStore.js
index e59fd7e9cd8..833ecccadd6 100644
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -110,6 +110,10 @@ const CAPABILITIES = [
   "DNSPrefetch", "Auth"
 ];
 
+// These keys are for internal use only - they shouldn't be part of the JSON
+// that gets saved to disk nor part of the strings returned by the API.
+const INTERNAL_KEYS = ["_tabStillLoading", "_hosts", "_formDataSaved"];
+
 #ifndef XP_WIN
 #define BROKEN_WM_Z_ORDER
 #endif
@@ -261,7 +265,7 @@ SessionStoreService.prototype = {
     if (iniString) {
       try {
         // parse the session state into JS objects
-        this._initialState = this._safeEval("(" + iniString + ")");
+        this._initialState = JSON.parse(iniString);
         
         let lastSessionCrashed =
           this._initialState.session && this._initialState.session.state &&
@@ -519,7 +523,10 @@ SessionStoreService.prototype = {
     case "private-browsing-change-granted":
       if (aData == "enter") {
         this.saveState(true);
-        this._stateBackup = this._safeEval(this._getCurrentState(true).toSource());
+        // We stringify & parse the current state so that we have have an object
+        // that won't change. _getCurrentState returns an object with references
+        // to objects that can change (specifically this._windows[x]).
+        this._stateBackup = JSON.parse(this._toJSONString(this._getCurrentState(true)));
       }
       break;
     }
@@ -888,7 +895,7 @@ SessionStoreService.prototype = {
     this._handleClosedWindows();
 
     try {
-      var state = this._safeEval("(" + aState + ")");
+      var state = JSON.parse(aState);
     }
     catch (ex) { /* invalid state object - don't restore anything */ }
     if (!state || !state.windows)
@@ -934,7 +941,7 @@ SessionStoreService.prototype = {
     if (!aWindow.__SSi)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
     
-    this.restoreWindow(aWindow, "(" + aState + ")", aOverwrite);
+    this.restoreWindow(aWindow, aState, aOverwrite);
   },
 
   getTabState: function sss_getTabState(aTab) {
@@ -950,7 +957,7 @@ SessionStoreService.prototype = {
   },
 
   setTabState: function sss_setTabState(aTab, aState) {
-    var tabState = this._safeEval("(" + aState + ")");
+    var tabState = JSON.parse(aState);
     if (!tabState.entries || !aTab.ownerDocument || !aTab.ownerDocument.defaultView.__SSi)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
     
@@ -1870,7 +1877,7 @@ SessionStoreService.prototype = {
       this.onLoad(aWindow);
 
     try {
-      var root = typeof aState == "string" ? this._safeEval(aState) : aState;
+      var root = typeof aState == "string" ? JSON.parse(aState) : aState;
       if (!root.windows[0]) {
         this._sendRestoreCompletedNotifications();
         return; // nothing to restore
@@ -2585,8 +2592,7 @@ SessionStoreService.prototype = {
   _saveStateObject: function sss_saveStateObject(aStateObj) {
     var stateString = Cc["@mozilla.org/supports-string;1"].
                         createInstance(Ci.nsISupportsString);
-    // parentheses are for backwards compatibility with Firefox 2.0 and 3.0
-    stateString.data = "(" + this._toJSONString(aStateObj) + ")";
+    stateString.data = this._toJSONString(aStateObj);
 
     Services.obs.notifyObservers(stateString, "sessionstore-state-write", "");
 
@@ -2863,13 +2869,6 @@ SessionStoreService.prototype = {
             sessionAge && sessionAge >= SIX_HOURS_IN_MS);
   },
 
-  /**
-   * safe eval'ing
-   */
-  _safeEval: function sss_safeEval(aStr) {
-    return Cu.evalInSandbox(aStr, new Cu.Sandbox("about:blank"));
-  },
-
   /**
    * Converts a JavaScript object into a JSON string
    * (see http://www.json.org/ for more information).
@@ -2880,18 +2879,11 @@ SessionStoreService.prototype = {
    * @returns the object's JSON representation
    */
   _toJSONString: function sss_toJSONString(aJSObject) {
-    // XXXzeniko drop the following keys used only for internal bookkeeping:
-    //           _tabStillLoading, _hosts, _formDataSaved
-    let jsonString = JSON.stringify(aJSObject);
-    
-    if (/[\u2028\u2029]/.test(jsonString)) {
-      // work-around for bug 485563 until we can use JSON.parse
-      // instead of evalInSandbox everywhere
-      jsonString = jsonString.replace(/[\u2028\u2029]/g,
-                                      function($0) "\\u" + $0.charCodeAt(0).toString(16));
+    function exclude(key, value) {
+      // returning undefined results in the exclusion of that key
+      return INTERNAL_KEYS.indexOf(key) == -1 ? value : undefined;
     }
-    
-    return jsonString;
+    return JSON.stringify(aJSObject, exclude);
   },
 
   _sendRestoreCompletedNotifications: function sss_sendRestoreCompletedNotifications() {
diff --git a/browser/components/sessionstore/test/browser/browser_248970_b.js b/browser/components/sessionstore/test/browser/browser_248970_b.js
index 1246ad6f814..458d7104a6f 100644
--- a/browser/components/sessionstore/test/browser/browser_248970_b.js
+++ b/browser/components/sessionstore/test/browser/browser_248970_b.js
@@ -130,7 +130,7 @@ function test() {
 
   // public session, add new tab: (A)
   let tab_A = gBrowser.addTab(testURL);
-  ss.setTabState(tab_A, state.toSource());
+  ss.setTabState(tab_A, JSON.stringify(state));
   tab_A.linkedBrowser.addEventListener("load", function(aEvent) {
     this.removeEventListener("load", arguments.callee, true);
 
@@ -167,7 +167,7 @@ function test() {
 
       // private browsing session, new tab: (B)
       let tab_B = gBrowser.addTab(testURL2);
-      ss.setTabState(tab_B, state1.toSource());
+      ss.setTabState(tab_B, JSON.stringify(state1));
       tab_B.linkedBrowser.addEventListener("load", function(aEvent) {
         this.removeEventListener("load", arguments.callee, true);
 
diff --git a/browser/components/sessionstore/test/browser/browser_345898.js b/browser/components/sessionstore/test/browser/browser_345898.js
index 10b5b8343cb..9b4a6534dc4 100644
--- a/browser/components/sessionstore/test/browser/browser_345898.js
+++ b/browser/components/sessionstore/test/browser/browser_345898.js
@@ -58,7 +58,7 @@ function test() {
      "Invalid tab for getTabState throws");
   ok(test(function() ss.setTabState({}, "{}")),
      "Invalid tab state for setTabState throws");
-  ok(test(function() ss.setTabState({}, "{ entries: [] }")),
+  ok(test(function() ss.setTabState({}, JSON.stringify({ entries: [] }))),
      "Invalid tab for setTabState throws");
   ok(test(function() ss.duplicateTab({}, {})),
      "Invalid tab for duplicateTab throws");
diff --git a/browser/components/sessionstore/test/browser/browser_367052.js b/browser/components/sessionstore/test/browser/browser_367052.js
index 1bbffefcd61..d205fbf943c 100644
--- a/browser/components/sessionstore/test/browser/browser_367052.js
+++ b/browser/components/sessionstore/test/browser/browser_367052.js
@@ -55,7 +55,7 @@ function test() {
     let history = tab.linkedBrowser.webNavigation.sessionHistory;
     ok(history.count >= 1, "the new tab does have at least one history entry");
     
-    ss.setTabState(tab, "{ entries: [] }");
+    ss.setTabState(tab, JSON.stringify({ entries: [] }));
     tab.linkedBrowser.addEventListener("load", function(aEvent) {
       this.removeEventListener("load", arguments.callee, true);
       ok(history.count == 0, "the tab was restored without any history whatsoever");
diff --git a/browser/components/sessionstore/test/browser/browser_393716.js b/browser/components/sessionstore/test/browser/browser_393716.js
index 08758f34272..e00d5b48c71 100644
--- a/browser/components/sessionstore/test/browser/browser_393716.js
+++ b/browser/components/sessionstore/test/browser/browser_393716.js
@@ -27,7 +27,7 @@ function test() {
     ok(state, "get the tab's state");
     
     // verify the tab state's integrity
-    state = eval("(" + state + ")");
+    state = JSON.parse(state);
     ok(state instanceof Object && state.entries instanceof Array && state.entries.length > 0,
        "state object seems valid");
     ok(state.entries.length == 1 && state.entries[0].url == testURL,
@@ -50,7 +50,7 @@ function test() {
   // create a new tab
   let tab2 = tabbrowser.addTab();
   // set the tab's state
-  ss.setTabState(tab2, state.toSource());
+  ss.setTabState(tab2, JSON.stringify(state));
   tab2.linkedBrowser.addEventListener("load", function(aEvent) {
     this.removeEventListener("load", arguments.callee, true);
     // verify the correctness of the restored tab
diff --git a/browser/components/sessionstore/test/browser/browser_394759.js b/browser/components/sessionstore/test/browser/browser_394759.js
index 9c7ed76da23..ba28c195d3c 100644
--- a/browser/components/sessionstore/test/browser/browser_394759.js
+++ b/browser/components/sessionstore/test/browser/browser_394759.js
@@ -87,7 +87,7 @@ function test() {
             is(ss.getClosedWindowCount(), closedWindowCount + 1,
                "The closed window was added to Recently Closed Windows");
             let data = JSON.parse(ss.getClosedWindowData())[0];
-            ok(data.title == testURL && data.toSource().indexOf(uniqueText) > -1,
+            ok(data.title == testURL && JSON.stringify(data).indexOf(uniqueText) > -1,
                "The closed window data was stored correctly");
 
             // reopen the closed window and ensure its integrity
diff --git a/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js b/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
index ef42f42c414..6ea99ed00b6 100644
--- a/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
+++ b/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
@@ -139,7 +139,7 @@ function continue_test() {
 
                   // Ensure we added window to undo list.
                   let data = JSON.parse(ss.getClosedWindowData())[0];
-                  ok(data.toSource().indexOf(TESTS[aTestIndex].value) > -1,
+                  ok(JSON.stringify(data).indexOf(TESTS[aTestIndex].value) > -1,
                      "The closed window data was stored correctly");
 
                   if (aRunNextTestInPBMode) {
@@ -164,7 +164,7 @@ function continue_test() {
                        "when exiting PB mode");
 
                     let data = JSON.parse(ss.getClosedWindowData())[0];
-                    ok(data.toSource().indexOf(TESTS[aTestIndex - 1].value) > -1,
+                    ok(JSON.stringify(data).indexOf(TESTS[aTestIndex - 1].value) > -1,
                        "The data associated with the recently closed window was " +
                        "restored when exiting PB mode");
                   }
diff --git a/browser/components/sessionstore/test/browser/browser_447951.js b/browser/components/sessionstore/test/browser/browser_447951.js
index 32b78dcff9c..255d9740f07 100644
--- a/browser/components/sessionstore/test/browser/browser_447951.js
+++ b/browser/components/sessionstore/test/browser/browser_447951.js
@@ -55,7 +55,7 @@ function test() {
     ss.setTabState(tab, JSON.stringify(tabState));
     tab.addEventListener("SSTabRestored", function(aEvent) {
       tab.removeEventListener("SSTabRestored", arguments.callee, false);
-      tabState = eval("(" + ss.getTabState(tab) + ")");
+      tabState = JSON.parse(ss.getTabState(tab));
       is(tabState.entries.length, max_entries, "session history filled to the limit");
       is(tabState.entries[0].url, baseURL + 0, "... but not more");
       
@@ -67,7 +67,7 @@ function test() {
       doc.querySelector("a").dispatchEvent(event);
       
       executeSoon(function() {
-        tabState = eval("(" + ss.getTabState(tab) + ")");
+        tabState = JSON.parse(ss.getTabState(tab));
         is(tab.linkedBrowser.currentURI.spec, baseURL + "end",
            "the new anchor was loaded");
         is(tabState.entries[tabState.entries.length - 1].url, baseURL + "end",
diff --git a/browser/components/sessionstore/test/browser/browser_448741.js b/browser/components/sessionstore/test/browser/browser_448741.js
index 5d254822275..b6c098e8f50 100644
--- a/browser/components/sessionstore/test/browser/browser_448741.js
+++ b/browser/components/sessionstore/test/browser/browser_448741.js
@@ -57,7 +57,7 @@ function test() {
     ok(aSubject.data.indexOf(uniqueValue) > -1, "data contains our value?");
 
     // find the data for the newly added tab and delete it
-    let state = eval(aSubject.data);
+    let state = JSON.parse(aSubject.data);
     state.windows.forEach(function (winData) {
       winData.tabs.forEach(function (tabData) {
         if (tabData.extData && uniqueName in tabData.extData &&
@@ -69,7 +69,7 @@ function test() {
     });
 
     ok(valueWasCleaned, "found and removed the specific tab value");
-    aSubject.data = uneval(state);
+    aSubject.data = JSON.stringify(state);
     Services.obs.removeObserver(cleaningObserver, aTopic, false);
   }
 
diff --git a/browser/components/sessionstore/test/browser/browser_456342.js b/browser/components/sessionstore/test/browser/browser_456342.js
index 4f1f4b429e9..8314af245e6 100644
--- a/browser/components/sessionstore/test/browser/browser_456342.js
+++ b/browser/components/sessionstore/test/browser/browser_456342.js
@@ -59,7 +59,7 @@ function test() {
     
     let ss = Cc["@mozilla.org/browser/sessionstore;1"]
                .getService(Ci.nsISessionStore);
-    let undoItems = eval("(" + ss.getClosedTabData(window) + ")");
+    let undoItems = JSON.parse(ss.getClosedTabData(window));
     let savedFormData = undoItems[0].state.entries[0].formdata;
     
     let countGood = 0, countBad = 0;
diff --git a/browser/components/sessionstore/test/browser/browser_461634.js b/browser/components/sessionstore/test/browser/browser_461634.js
index 0e2f15db818..946d8fb9ec4 100644
--- a/browser/components/sessionstore/test/browser/browser_461634.js
+++ b/browser/components/sessionstore/test/browser/browser_461634.js
@@ -82,7 +82,7 @@ function test() {
                             test_state.windows[0]._closedTabs.length);
     ss.setWindowState(newWin, JSON.stringify(test_state), true);
     
-    let closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    let closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, test_state.windows[0]._closedTabs.length,
        "Closed tab list has the expected length");
     is(countByTitle(closedTabs, FORGET),
@@ -103,7 +103,7 @@ function test() {
     ss.forgetClosedTab(newWin, 2);
     ss.forgetClosedTab(newWin, null);
     
-    closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, remember_count,
        "The correct amout of tabs was removed");
     is(countByTitle(closedTabs, FORGET), 0,
diff --git a/browser/components/sessionstore/test/browser/browser_464199.js b/browser/components/sessionstore/test/browser/browser_464199.js
index 60575c448c2..f76ad7c464f 100644
--- a/browser/components/sessionstore/test/browser/browser_464199.js
+++ b/browser/components/sessionstore/test/browser/browser_464199.js
@@ -90,7 +90,7 @@ function test() {
                             test_state.windows[0]._closedTabs.length);
     ss.setWindowState(newWin, JSON.stringify(test_state), true);
     
-    let closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    let closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, test_state.windows[0]._closedTabs.length,
        "Closed tab list has the expected length");
     is(countByTitle(closedTabs, FORGET),
@@ -103,7 +103,7 @@ function test() {
              getService(Ci.nsIPrivateBrowsingService);
     pb.removeDataFromDomain("example.net");
     
-    closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, remember_count,
        "The correct amout of tabs was removed");
     is(countByTitle(closedTabs, FORGET), 0,
diff --git a/browser/components/sessionstore/test/browser/browser_485563.js b/browser/components/sessionstore/test/browser/browser_485563.js
index 15c656e42c9..de19ee24efe 100644
--- a/browser/components/sessionstore/test/browser/browser_485563.js
+++ b/browser/components/sessionstore/test/browser/browser_485563.js
@@ -46,11 +46,11 @@ function test() {
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
     tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
     ss.setTabValue(tab, "bug485563", uniqueValue);
-    let tabState = eval("(" + ss.getTabState(tab) + ")");
+    let tabState = JSON.parse(ss.getTabState(tab));
     is(tabState.extData["bug485563"], uniqueValue,
        "unicode line separator wasn't over-encoded");
     ss.deleteTabValue(tab, "bug485563");
-    ss.setTabState(tab, tabState.toSource());
+    ss.setTabState(tab, JSON.stringify(tabState));
     is(ss.getTabValue(tab, "bug485563"), uniqueValue,
        "unicode line separator was correctly preserved");
     

From 31d080258d707c47a7e7bd88a5d2b7ca1e7ed58e Mon Sep 17 00:00:00 2001
From: Frank Yan <fyan@mozilla.com>
Date: Wed, 9 Jun 2010 13:55:46 -0700
Subject: [PATCH 32/45] Bug 568287 - Expand test for 'Copy Password' context
 menu item in Password Manager [r=dolske]

---
 .../passwordmgr/content/passwordManager.xul   |  4 +--
 .../browser/browser_passwordmgrcopypwd.js     | 26 ++++++++++++++-----
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/toolkit/components/passwordmgr/content/passwordManager.xul b/toolkit/components/passwordmgr/content/passwordManager.xul
index 0efd79122c0..f9e8177d44f 100644
--- a/toolkit/components/passwordmgr/content/passwordManager.xul
+++ b/toolkit/components/passwordmgr/content/passwordManager.xul
@@ -65,13 +65,13 @@
   </keyset>
 
   <popupset id="signonsTreeContextSet">
-    <popup id="signonsTreeContextMenu"
+    <menupopup id="signonsTreeContextMenu"
            onpopupshowing="UpdateCopyPassword()">
       <menuitem id="context-copypassword"
                 label="&copyPasswordCmd.label;"
                 accesskey="&copyPasswordCmd.accesskey;"
                 oncommand="CopyPassword()"/>
-    </popup>
+    </menupopup>
   </popupset>
 
   <!-- saved signons -->
diff --git a/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js b/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
index 8bd1f6cff46..1fec129a7c2 100644
--- a/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
+++ b/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
@@ -71,14 +71,28 @@ function test() {
 
     // Test if "Copy Password" works
     function doTest() {
-        let clip = Cc["@mozilla.org/widget/clipboard;1"].getService(Ci.nsIClipboard);
-        let data = "";
-        let polls = 0;
+        let doc = pwmgrdlg.document;
+        let selection = doc.getElementById("signonsTree").view.selection;
+        let menuitem = doc.getElementById("context-copypassword");
 
         function copyPassword() {
-            let doc = pwmgrdlg.document;
-            doc.getElementById("signonsTree").currentIndex = 2;
-            doc.getElementById("context-copypassword").doCommand();
+            selection.selectAll();
+            is(isMenuitemEnabled(), false, "Copy Password should be disabled");
+
+            selection.select(0);
+            is(isMenuitemEnabled(), true, "Copy Password should be enabled");
+
+            selection.clearSelection();
+            is(isMenuitemEnabled(), false, "Copy Password should be disabled");
+
+            selection.select(2);
+            is(isMenuitemEnabled(), true, "Copy Password should be enabled");
+            menuitem.doCommand();
+        }
+
+        function isMenuitemEnabled() {
+            doc.defaultView.UpdateCopyPassword();
+            return !menuitem.getAttribute("disabled");
         }
 
         function cleanUp() {

From 3516debb72076cd1f30376b9cdec625008a3a199 Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Wed, 9 Jun 2010 14:08:11 -0700
Subject: [PATCH 33/45] Bug 570720 - Intermittent failure in
 browser_library_search.js when default livemark feed includes "dummy". r=mak

---
 .../components/places/tests/browser/Makefile.in  |  4 +---
 .../tests/browser/browser_library_search.js      | 16 ++++++++++------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/browser/components/places/tests/browser/Makefile.in b/browser/components/places/tests/browser/Makefile.in
index 09740d89d89..6b757ece288 100644
--- a/browser/components/places/tests/browser/Makefile.in
+++ b/browser/components/places/tests/browser/Makefile.in
@@ -54,6 +54,7 @@ _BROWSER_TEST_FILES = \
 	browser_sort_in_library.js \
 	browser_library_open_leak.js \
 	browser_library_panel_leak.js \
+	browser_library_search.js \
 	browser_history_sidebar_search.js \
 	browser_bookmarksProperties.js \
 	browser_forgetthissite_single.js \
@@ -66,8 +67,5 @@ _BROWSER_TEST_FILES = \
 	browser_library_infoBox.js \
 	$(NULL)
 
-# Test disabled because it's failing every time!  See bug 570720.
-#	browser_library_search.js \
-
 libs:: $(_BROWSER_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/browser/$(relativesrcdir)
diff --git a/browser/components/places/tests/browser/browser_library_search.js b/browser/components/places/tests/browser/browser_library_search.js
index 96656b57601..855f8de9f21 100644
--- a/browser/components/places/tests/browser/browser_library_search.js
+++ b/browser/components/places/tests/browser/browser_library_search.js
@@ -59,7 +59,7 @@
  *   6. if folder scope was clicked, searches again and ensures folder scope
  *      remains selected.
  */
- 
+
 const TEST_URL = "http://dummy.mozilla.org/";
 
 // Add your tests here.  Each is a function that's called by testHelper().
@@ -224,11 +224,15 @@ function search(aFolderId, aSearchStr, aExpectedScopeButtonId) {
     if (getSelectedScopeButtonId() == "scopeBarHistory" ||
         getSelectedScopeButtonId() == "scopeBarAll" ||
         aFolderId == PlacesUtils.bookmarks.unfiledBookmarksFolder) {
-      // Check that search has returned a valid result.
-      contentTree.view.selection.select(0);
-      var foundNode = contentTree.selectedNode;
-      isnot(foundNode, null, "Found a valid node");
-      is(foundNode.uri, TEST_URL);
+      // Check that the target node exists in the tree's search results.
+      var node = null;
+      for (var i = 0; i < contentTree.view.rowCount; i++) {
+        node = contentTree.view.nodeForTreeIndex(i);
+        if (node.uri === TEST_URL)
+          break;
+      }
+      isnot(node, null, "At least the target node should be in the tree");
+      is(node.uri, TEST_URL, "URI of node should match target URL");
     }
   }
   else {

From 45ffeefc3af0470fbcdfec9482472e94827b7246 Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Wed, 9 Jun 2010 14:08:14 -0700
Subject: [PATCH 34/45] Bug 570291 - dump() inside sandbox truncates string's
 high bytes. r=bzbarsky

---
 js/src/xpconnect/src/xpccomponents.cpp | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp
index db0a2900e05..e3f1a9a6594 100644
--- a/js/src/xpconnect/src/xpccomponents.cpp
+++ b/js/src/xpconnect/src/xpccomponents.cpp
@@ -3031,11 +3031,28 @@ SandboxDump(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
     if (!str)
         return JS_FALSE;
 
-    char *bytes = JS_GetStringBytes(str);
-    if (!bytes)
+    jschar *chars = JS_GetStringChars(str);
+    if (!chars)
         return JS_FALSE;
 
-    fputs(bytes, stderr);
+    nsDependentString wstr(reinterpret_cast<PRUnichar *>(chars),
+                           JS_GetStringLength(str));
+    char *cstr = ToNewUTF8String(wstr);
+    if (!cstr)
+        return JS_FALSE;
+
+#if defined(XP_MAC) || defined(XP_MACOSX)
+    // Be nice and convert all \r to \n.
+    char *c = cstr, *cEnd = cstr + strlen(cstr);
+    while (c < cEnd) {
+        if (*c == '\r')
+            *c = '\n';
+        c++;
+    }
+#endif
+
+    fputs(cstr, stderr);
+    NS_Free(cstr);
     return JS_TRUE;
 }
 

From f0356c38f3f3baed0ee533599362b00c31029fb1 Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Wed, 9 Jun 2010 14:08:17 -0700
Subject: [PATCH 35/45] Bug 570986 - nsGlobalWindow::Dump should check all
 bytes, not chars, when replacing \r with \n. r=bzbarsky

---
 dom/base/nsGlobalWindow.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index b477f6b7458..3c95097bef8 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4103,7 +4103,7 @@ nsGlobalWindow::Dump(const nsAString& aStr)
 
 #if defined(XP_MAC) || defined(XP_MACOSX)
   // have to convert \r to \n so that printing to the console works
-  char *c = cstr, *cEnd = cstr + aStr.Length();
+  char *c = cstr, *cEnd = cstr + strlen(cstr);
   while (c < cEnd) {
     if (*c == '\r')
       *c = '\n';

From dfdc5361fd5a0be4b6ed3820b0b1eb7ebbf5153d Mon Sep 17 00:00:00 2001
From: Robert Kaiser <kairo@kairo.at>
Date: Wed, 9 Jun 2010 23:50:38 +0200
Subject: [PATCH 36/45] bug 570788 - Incorporate improvements from SeaMonkey
 places review into Firefox code - round 1, r=sdwilsh

---
 .../components/places/content/controller.js   | 40 ++++++++--------
 browser/components/places/src/Makefile.in     |  2 +-
 .../components/places/src/PlacesUIUtils.jsm   | 48 ++++++++-----------
 3 files changed, 42 insertions(+), 48 deletions(-)

diff --git a/browser/components/places/content/controller.js b/browser/components/places/content/controller.js
index 8e6ba29edb8..afdd501447b 100644
--- a/browser/components/places/content/controller.js
+++ b/browser/components/places/content/controller.js
@@ -125,6 +125,26 @@ PlacesController.prototype = {
    */
   _view: null,
 
+  supportsCommand: function PC_supportsCommand(aCommand) {
+    //LOG("supportsCommand: " + command);
+    // Non-Places specific commands that we also support
+    switch (aCommand) {
+    case "cmd_undo":
+    case "cmd_redo":
+    case "cmd_cut":
+    case "cmd_copy":
+    case "cmd_paste":
+    case "cmd_delete":
+    case "cmd_selectAll":
+      return true;
+    }
+
+    // All other Places Commands are prefixed with "placesCmd_" ... this 
+    // filters out other commands that we do _not_ support (see 329587).
+    const CMD_PREFIX = "placesCmd_";
+    return (aCommand.substr(0, CMD_PREFIX.length) == CMD_PREFIX);
+  },
+
   isCommandEnabled: function PC_isCommandEnabled(aCommand) {
     switch (aCommand) {
     case "cmd_undo":
@@ -206,26 +226,6 @@ PlacesController.prototype = {
     }
   },
 
-  supportsCommand: function PC_supportsCommand(aCommand) {
-    //LOG("supportsCommand: " + command);
-    // Non-Places specific commands that we also support
-    switch (aCommand) {
-    case "cmd_undo":
-    case "cmd_redo":
-    case "cmd_cut":
-    case "cmd_copy":
-    case "cmd_paste":
-    case "cmd_delete":
-    case "cmd_selectAll":
-      return true;
-    }
-
-    // All other Places Commands are prefixed with "placesCmd_" ... this 
-    // filters out other commands that we do _not_ support (see 329587).
-    const CMD_PREFIX = "placesCmd_";
-    return (aCommand.substr(0, CMD_PREFIX.length) == CMD_PREFIX);
-  },
-
   doCommand: function PC_doCommand(aCommand) {
     switch (aCommand) {
     case "cmd_undo":
diff --git a/browser/components/places/src/Makefile.in b/browser/components/places/src/Makefile.in
index 9e5f53a467a..d2c2408010d 100644
--- a/browser/components/places/src/Makefile.in
+++ b/browser/components/places/src/Makefile.in
@@ -49,7 +49,7 @@ EXTRA_COMPONENTS = \
   PlacesProtocolHandler.js \
   $(NULL)
 
-EXTRA_PP_JS_MODULES = \
+EXTRA_JS_MODULES = \
   PlacesUIUtils.jsm \
   $(NULL)
 
diff --git a/browser/components/places/src/PlacesUIUtils.jsm b/browser/components/places/src/PlacesUIUtils.jsm
index 21851a5e265..2413724f404 100644
--- a/browser/components/places/src/PlacesUIUtils.jsm
+++ b/browser/components/places/src/PlacesUIUtils.jsm
@@ -48,11 +48,7 @@ var Cr = Components.results;
 var Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyGetter(this, "Services", function() {
-  Cu.import("resource://gre/modules/Services.jsm");
-  return Services;
-});
+Cu.import("resource://gre/modules/Services.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "PlacesUtils", function() {
   Cu.import("resource://gre/modules/PlacesUtils.jsm");
@@ -652,7 +648,7 @@ var PlacesUIUtils = {
 
     var features;
     if (aMinimalUI)
-      features = "centerscreen,chrome,dialog,resizable,modal";
+      features = "centerscreen,chrome,modal,resizable=yes";
     else
       features = "centerscreen,chrome,modal,resizable=no";
     this._getCurrentActiveWin().openDialog(dialogURL, "",  features, aInfo);
@@ -682,7 +678,6 @@ var PlacesUIUtils = {
         node.firstChild._placesView)
       return node.firstChild._placesView;
 
-    // XXXmano: somehow we reach the xul document here!
     while (node instanceof Ci.nsIDOMElement) {
       if (node._placesView)
         return node._placesView;
@@ -739,19 +734,20 @@ var PlacesUIUtils = {
    *
    */
   checkURLSecurity: function PUIU_checkURLSecurity(aURINode, aWindow) {
-    if (!PlacesUtils.nodeIsBookmark(aURINode)) {
-      var uri = PlacesUtils._uri(aURINode.uri);
-      if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
-        const BRANDING_BUNDLE_URI = "chrome://branding/locale/brand.properties";
-        var brandShortName = Cc["@mozilla.org/intl/stringbundle;1"].
-                             getService(Ci.nsIStringBundleService).
-                             createBundle(BRANDING_BUNDLE_URI).
-                             GetStringFromName("brandShortName");
+    if (PlacesUtils.nodeIsBookmark(aURINode))
+      return true;
 
-        var errorStr = this.getString("load-js-data-url-error");
-        Services.prompt.alert(aWindow, brandShortName, errorStr);
-        return false;
-      }
+    var uri = PlacesUtils._uri(aURINode.uri);
+    if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
+      const BRANDING_BUNDLE_URI = "chrome://branding/locale/brand.properties";
+      var brandShortName = Cc["@mozilla.org/intl/stringbundle;1"].
+                           getService(Ci.nsIStringBundleService).
+                           createBundle(BRANDING_BUNDLE_URI).
+                           GetStringFromName("brandShortName");
+
+      var errorStr = this.getString("load-js-data-url-error");
+      Services.prompt.alert(aWindow, brandShortName, errorStr);
+      return false;
     }
     return true;
   },
@@ -792,13 +788,11 @@ var PlacesUIUtils = {
    * Gives the user a chance to cancel loading lots of tabs at once
    */
   _confirmOpenInTabs: function PUIU__confirmOpenInTabs(numTabsToOpen) {
-    let pref = Services.prefs;
-    let prompt = Services.prompt;
     const WARN_ON_OPEN_PREF = "browser.tabs.warnOnOpen";
     var reallyOpen = true;
 
-    if (pref.getBoolPref(WARN_ON_OPEN_PREF)) {
-      if (numTabsToOpen >= pref.getIntPref("browser.tabs.maxOpenBeforeWarn")) {
+    if (Services.prefs.getBoolPref(WARN_ON_OPEN_PREF)) {
+      if (numTabsToOpen >= Services.prefs.getIntPref("browser.tabs.maxOpenBeforeWarn")) {
         // default to true: if it were false, we wouldn't get this far
         var warnOnOpen = { value: true };
 
@@ -810,12 +804,12 @@ var PlacesUIUtils = {
                              createBundle(BRANDING_BUNDLE_URI).
                              GetStringFromName("brandShortName");
 
-        var buttonPressed = prompt.confirmEx(
+        var buttonPressed = Services.prompt.confirmEx(
           this._getCurrentActiveWin(),
           this.getString("tabs.openWarningTitle"),
           this.getFormattedString(messageKey, [numTabsToOpen, brandShortName]),
-          (prompt.BUTTON_TITLE_IS_STRING * prompt.BUTTON_POS_0) +
-            (prompt.BUTTON_TITLE_CANCEL * prompt.BUTTON_POS_1),
+          (Services.prompt.BUTTON_TITLE_IS_STRING * Services.prompt.BUTTON_POS_0) +
+            (Services.prompt.BUTTON_TITLE_CANCEL * Services.prompt.BUTTON_POS_1),
           this.getString(openKey), null, null,
           this.getFormattedString("tabs.openWarningPromptMeBranded",
                                   [brandShortName]),
@@ -825,7 +819,7 @@ var PlacesUIUtils = {
         reallyOpen = (buttonPressed == 0);
         // don't set the pref unless they press OK and it's false
         if (reallyOpen && !warnOnOpen.value)
-          pref.setBoolPref(WARN_ON_OPEN_PREF, false);
+          Services.prefs.setBoolPref(WARN_ON_OPEN_PREF, false);
       }
     }
 

From 1e65ba0237a111687950a4a974e1e2f89e0eb4a7 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Wed, 9 Jun 2010 15:07:12 -0700
Subject: [PATCH 37/45] b=570660; add ability to resize pbuffer GL contexts;
 r=joe

---
 content/canvas/src/WebGLContext.cpp     | 16 ++++++++
 gfx/thebes/public/GLContext.h           | 35 ++++++++++++------
 gfx/thebes/src/GLContextProviderWGL.cpp | 49 +++++++++++++++++++++++--
 3 files changed, 85 insertions(+), 15 deletions(-)

diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 076bb2250ef..663380f21a9 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -152,6 +152,22 @@ WebGLContext::SetDimensions(PRInt32 width, PRInt32 height)
     if (mWidth == width && mHeight == height)
         return NS_OK;
 
+    if (gl) {
+        // hey we already have something
+        if (gl->Resize(gfxIntSize(width, height))) {
+
+            mWidth = width;
+            mHeight = height;
+
+            gl->fViewport(0, 0, mWidth, mHeight);
+            gl->fClearColor(0, 0, 0, 0);
+            gl->fClear(LOCAL_GL_COLOR_BUFFER_BIT | LOCAL_GL_DEPTH_BUFFER_BIT | LOCAL_GL_STENCIL_BUFFER_BIT);
+
+            // great success!
+            return NS_OK;
+        }
+    }
+
     LogMessage("Canvas 3D: creating PBuffer...");
 
     GLContextProvider::ContextFormat format(GLContextProvider::ContextFormat::BasicRGBA32);
diff --git a/gfx/thebes/public/GLContext.h b/gfx/thebes/public/GLContext.h
index f63f9a16c8c..5f8a93493f4 100644
--- a/gfx/thebes/public/GLContext.h
+++ b/gfx/thebes/public/GLContext.h
@@ -1,3 +1,4 @@
+/* -*- Mode: c++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40; -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -45,7 +46,7 @@
 #endif
 
 #include "GLDefs.h"
-#include "gfxTypes.h"
+#include "gfxRect.h"
 #include "nsISupportsImpl.h"
 #include "prlink.h"
 
@@ -84,19 +85,19 @@ public:
     } SymLoadStruct;
 
     PRBool LoadSymbols(SymLoadStruct *firstStruct,
-		       PRBool tryplatform = PR_FALSE,
-		       const char *prefix = nsnull);
+                       PRBool tryplatform = PR_FALSE,
+                       const char *prefix = nsnull);
 
     /*
      * Static version of the functions in this class
      */
     static PRFuncPtr LookupSymbol(PRLibrary *lib,
-				  const char *symname,
-				  PlatformLookupFunction lookupFunction = nsnull);
+                                  const char *symname,
+                                  PlatformLookupFunction lookupFunction = nsnull);
     static PRBool LoadSymbols(PRLibrary *lib,
-			      SymLoadStruct *firstStruct,
-			      PlatformLookupFunction lookupFunction = nsnull,
-			      const char *prefix = nsnull);
+                              SymLoadStruct *firstStruct,
+                              PlatformLookupFunction lookupFunction = nsnull,
+                              const char *prefix = nsnull);
 protected:
     LibrarySymbolLoader() {
         mLibrary = nsnull;
@@ -125,13 +126,13 @@ public:
     virtual PRBool SetupLookupFunction() = 0;
 
     void *GetUserData(void *aKey) {
-	void *result = nsnull;
-	mUserData.Get(aKey, &result);
-	return result;
+        void *result = nsnull;
+        mUserData.Get(aKey, &result);
+        return result;
     }
 
     void SetUserData(void *aKey, void *aValue) {
-	mUserData.Put(aKey, aValue);
+        mUserData.Put(aKey, aValue);
     }
 
     enum NativeDataType {
@@ -143,6 +144,16 @@ public:
     };
 
     virtual void *GetNativeData(NativeDataType aType) { return NULL; }
+
+    /* If this is a PBuffer context, resize the pbufer to the given dimensions,
+     * keping the same format and attributes.  If the resize succeeds, return
+     * PR_TRUE.  Otherwise, or if this is not a pbuffer, return PR_FALSE.
+     *
+     * On a successful resize, the previous contents of the pbuffer are cleared,
+     * and the new contents are undefined.
+     */
+    virtual PRBool Resize(const gfxIntSize& aNewSize) { return PR_FALSE; }
+
 protected:
 
     PRBool mInitialized;
diff --git a/gfx/thebes/src/GLContextProviderWGL.cpp b/gfx/thebes/src/GLContextProviderWGL.cpp
index 0010e679ec8..aacb79c7fbc 100644
--- a/gfx/thebes/src/GLContextProviderWGL.cpp
+++ b/gfx/thebes/src/GLContextProviderWGL.cpp
@@ -181,11 +181,12 @@ class GLContextWGL : public GLContext
 {
 public:
     GLContextWGL(HDC aDC, HGLRC aContext)
-        : mContext(aContext), mDC(aDC), mPBuffer(nsnull)
+        : mContext(aContext), mDC(aDC), mPBuffer(nsnull), mPixelFormat(-1)
     { }
 
-    GLContextWGL(HANDLE aPBuffer) {
+    GLContextWGL(HANDLE aPBuffer, int aPixelFormat) {
         mPBuffer = aPBuffer;
+        mPixelFormat = aPixelFormat;
         mDC = sWGLLibrary.fGetPbufferDC(mPBuffer);
         mContext = sWGLLibrary.fCreateContext(mDC);
     }
@@ -241,10 +242,52 @@ public:
         }
     }
 
+    PRBool Resize(const gfxIntSize& aNewSize) {
+        if (!mPBuffer)
+            return PR_FALSE;
+
+        nsTArray<int> pbattribs;
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_FORMAT_ARB);
+        // XXX fixme after bug 571092 lands and we have the format available
+        if (true /*aFormat.alpha > 0*/) {
+            pbattribs.AppendElement(LOCAL_WGL_TEXTURE_RGBA_ARB);
+        } else {
+            pbattribs.AppendElement(LOCAL_WGL_TEXTURE_RGB_ARB);
+        }
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_TARGET_ARB);
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_2D_ARB);
+
+        pbattribs.AppendElement(0);
+
+        HANDLE newbuf = sWGLLibrary.fCreatePbuffer(gDummyWindowDC, mPixelFormat,
+                                                   aNewSize.width, aNewSize.height,
+                                                   pbattribs.Elements());
+        if (!newbuf)
+            return PR_FALSE;
+
+        bool isCurrent = false;
+        if (sWGLLibrary.fGetCurrentContext() == mContext) {
+            sWGLLibrary.fMakeCurrent(NULL, NULL);
+            isCurrent = true;
+        }
+
+        // hey, it worked!
+        sWGLLibrary.fDestroyPbuffer(mPBuffer);
+
+        mPBuffer = newbuf;
+        mDC = sWGLLibrary.fGetPbufferDC(mPBuffer);
+
+        if (isCurrent)
+            MakeCurrent();
+
+        return PR_TRUE;
+    }
+
 private:
     HGLRC mContext;
     HDC mDC;
     HANDLE mPBuffer;
+    int mPixelFormat;
 };
 
 already_AddRefed<GLContext>
@@ -362,7 +405,7 @@ GLContextProvider::CreatePBuffer(const gfxIntSize& aSize, const ContextFormat& a
         return nsnull;
     }
 
-    nsRefPtr<GLContextWGL> glContext = new GLContextWGL(pbuffer);
+    nsRefPtr<GLContextWGL> glContext = new GLContextWGL(pbuffer, chosenFormat);
     glContext->Init();
 
     return glContext.forget().get();

From 1e1e10f15e684accbf36476e6cfaa2b8eed475f9 Mon Sep 17 00:00:00 2001
From: Vladimir Vukicevic <vladimir@pobox.com>
Date: Wed, 9 Jun 2010 15:27:29 -0700
Subject: [PATCH 38/45] b=562409; add GLContextProvider form EGL (patch from
 vlad/fred/romaxa); r=bas

---
 gfx/layers/basic/BasicLayers.cpp        |   6 +
 gfx/thebes/public/GLContext.h           |   4 +
 gfx/thebes/src/GLContext.cpp            |  12 +
 gfx/thebes/src/GLContextProviderEGL.cpp | 409 ++++++++++++++++++++++++
 gfx/thebes/src/Makefile.in              |  34 +-
 5 files changed, 458 insertions(+), 7 deletions(-)
 create mode 100644 gfx/thebes/src/GLContextProviderEGL.cpp

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 107010bf9da..f29e51e7386 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -461,9 +461,15 @@ BasicCanvasLayer::Updated(const nsIntRect& aRect)
     // For simplicity, we read the entire framebuffer for now -- in
     // the future we should use mUpdatedRect, though with WebGL we don't
     // have an easy way to generate one.
+#ifndef USE_GLES2
     mGLContext->fReadPixels(0, 0, mBounds.width, mBounds.height,
                             LOCAL_GL_BGRA, LOCAL_GL_UNSIGNED_INT_8_8_8_8_REV,
                             isurf->Data());
+#else
+    mGLContext->fReadPixels(0, 0, mBounds.width, mBounds.height,
+                            LOCAL_GL_RGBA, LOCAL_GL_UNSIGNED_BYTE,
+                            isurf->Data());
+#endif
 
     // If the underlying GLContext doesn't have a framebuffer into which
     // premultiplied values were written, we have to do this ourselves here.
diff --git a/gfx/thebes/public/GLContext.h b/gfx/thebes/public/GLContext.h
index 5f8a93493f4..6ff4d298148 100644
--- a/gfx/thebes/public/GLContext.h
+++ b/gfx/thebes/public/GLContext.h
@@ -62,6 +62,10 @@
 #define GLAPI
 #endif
 
+#if defined(MOZ_PLATFORM_MAEMO) || defined(ANDROID)
+#define USE_GLES2 1
+#endif
+
 typedef char realGLboolean;
 
 namespace mozilla {
diff --git a/gfx/thebes/src/GLContext.cpp b/gfx/thebes/src/GLContext.cpp
index 957d23005d0..cbe57a6b7cb 100644
--- a/gfx/thebes/src/GLContext.cpp
+++ b/gfx/thebes/src/GLContext.cpp
@@ -194,12 +194,16 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fDepthRange, { "DepthRange", NULL } },
 #endif
         { (PRFuncPtr*) &fDisable, { "Disable", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fDisableClientState, { "DisableClientState", NULL } },
+#endif
         { (PRFuncPtr*) &fDisableVertexAttribArray, { "DisableVertexAttribArray", "DisableVertexAttribArrayARB", NULL } },
         { (PRFuncPtr*) &fDrawArrays, { "DrawArrays", NULL } },
         { (PRFuncPtr*) &fDrawElements, { "DrawElements", NULL } },
         { (PRFuncPtr*) &fEnable, { "Enable", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fEnableClientState, { "EnableClientState", NULL } },
+#endif
         { (PRFuncPtr*) &fEnableVertexAttribArray, { "EnableVertexAttribArray", "EnableVertexAttribArrayARB", NULL } },
         { (PRFuncPtr*) &fFinish, { "Finish", NULL } },
         { (PRFuncPtr*) &fFlush, { "Flush", NULL } },
@@ -217,7 +221,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fGetError, { "GetError", NULL } },
         { (PRFuncPtr*) &fGetProgramiv, { "GetProgramiv", "GetProgramivARB", NULL } },
         { (PRFuncPtr*) &fGetProgramInfoLog, { "GetProgramInfoLog", "GetProgramInfoLogARB", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fTexCoordPointer, { "TexCoordPointer", NULL } },
+#endif
         { (PRFuncPtr*) &fTexParameteri, { "TexParameteri", NULL } },
         { (PRFuncPtr*) &fTexParameterf, { "TexParameterf", NULL } },
         { (PRFuncPtr*) &fGetString, { "GetString", NULL } },
@@ -238,7 +244,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fLinkProgram, { "LinkProgram", "LinkProgramARB", NULL } },
         { (PRFuncPtr*) &fPixelStorei, { "PixelStorei", NULL } },
         { (PRFuncPtr*) &fPolygonOffset, { "PolygonOffset", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fReadBuffer,  { "ReadBuffer", NULL } },
+#endif
         { (PRFuncPtr*) &fReadPixels, { "ReadPixels", NULL } },
         { (PRFuncPtr*) &fSampleCoverage, { "SampleCoverage", NULL } },
         { (PRFuncPtr*) &fScissor, { "Scissor", NULL } },
@@ -248,7 +256,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fStencilMaskSeparate, { "StencilMaskSeparate", "StencilMaskSeparateEXT", NULL } },
         { (PRFuncPtr*) &fStencilOp, { "StencilOp", NULL } },
         { (PRFuncPtr*) &fStencilOpSeparate, { "StencilOpSeparate", "StencilOpSeparateEXT", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fTexEnvf, { "TexEnvf",  NULL } },
+#endif
         { (PRFuncPtr*) &fTexImage2D, { "TexImage2D", NULL } },
         { (PRFuncPtr*) &fTexSubImage2D, { "TexSubImage2D", NULL } },
         { (PRFuncPtr*) &fUniform1f, { "Uniform1f", NULL } },
@@ -281,7 +291,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fVertexAttrib2fv, { "VertexAttrib2fv", NULL } },
         { (PRFuncPtr*) &fVertexAttrib3fv, { "VertexAttrib3fv", NULL } },
         { (PRFuncPtr*) &fVertexAttrib4fv, { "VertexAttrib4fv", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fVertexPointer, { "VertexPointer", NULL } },
+#endif
         { (PRFuncPtr*) &fViewport, { "Viewport", NULL } },
         { (PRFuncPtr*) &fCompileShader, { "CompileShader", NULL } },
         { (PRFuncPtr*) &fCopyTexImage2D, { "CopyTexImage2D", NULL } },
diff --git a/gfx/thebes/src/GLContextProviderEGL.cpp b/gfx/thebes/src/GLContextProviderEGL.cpp
new file mode 100644
index 00000000000..e6ff1f268bd
--- /dev/null
+++ b/gfx/thebes/src/GLContextProviderEGL.cpp
@@ -0,0 +1,409 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *   Mark Steele <mwsteele@gmail.com>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *   Frederic Plourde <frederic.plourde@collabora.co.uk>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#if defined(MOZ_X11)
+
+#ifdef MOZ_WIDGET_GTK2
+#include <gdk/gdkx.h>
+// we're using default display for now
+#define GET_NATIVE_WINDOW(aWidget) (EGLNativeWindowType)GDK_WINDOW_XID((GdkWindow *) aWidget->GetNativeData(NS_NATIVE_WINDOW))
+#elif defined(MOZ_WIDGET_QT)
+#include <QWidget>
+// we're using default display for now
+#define GET_NATIVE_WINDOW(aWidget) (EGLNativeWindowType)static_cast<QWidget*>(aWidget->GetNativeData(NS_NATIVE_SHELLWIDGET))->handle()
+#endif
+
+#include <X11/Xlib.h>
+#include <X11/Xutil.h>
+typedef Display *EGLNativeDisplayType;
+typedef Pixmap   EGLNativePixmapType;
+typedef Window   EGLNativeWindowType;
+
+#define EGL_LIB "/usr/lib/libEGL.so"
+#define GLES2_LIB "/usr/lib/libGLESv2.so"
+
+#elif defined(ANDROID)
+
+#define GET_NATIVE_WINDOW(aWidget)  (nsnull)
+
+typedef void *EGLNativeDisplayType;
+typedef void *EGLNativePixmapType;
+typedef void *EGLNativeWindowType;
+
+#define EGL_LIB "/system/lib/libEGL.so"
+#define GLES2_LIB "/system/lib/libGLESv2.so"
+
+#else
+
+#error "Platform not recognized"
+
+#endif
+
+#include "GLContextProvider.h"
+#include "nsDebug.h"
+
+#include "nsIWidget.h"
+
+namespace mozilla {
+namespace gl {
+
+typedef int EGLint;
+typedef unsigned int EGLBoolean;
+typedef unsigned int EGLenum;
+typedef void *EGLConfig;
+typedef void *EGLContext;
+typedef void *EGLDisplay;
+typedef void *EGLSurface;
+typedef void *EGLClientBuffer;
+typedef void *EGLCastToRelevantPtr;
+
+#define EGL_DEFAULT_DISPLAY  ((EGLNativeDisplayType)0)
+#define EGL_NO_CONTEXT       ((EGLContext)0)
+#define EGL_NO_DISPLAY       ((EGLDisplay)0)
+#define EGL_NO_SURFACE       ((EGLSurface)0)
+
+GLContextProvider sGLContextProvider;
+
+static class EGLLibrary
+{
+public:
+    EGLLibrary() : mInitialized(PR_FALSE) {}
+
+    typedef EGLDisplay (*pfnGetDisplay)(void *display_id);
+    pfnGetDisplay fGetDisplay;
+    typedef EGLContext (*pfnGetCurrentContext)(void);
+    pfnGetCurrentContext fGetCurrentContext;
+    typedef EGLBoolean (*pfnMakeCurrent)(EGLDisplay dpy, EGLSurface draw, EGLSurface read, EGLContext ctx);
+    pfnMakeCurrent fMakeCurrent;
+    typedef EGLBoolean (*pfnDestroyContext)(EGLDisplay dpy, EGLContext ctx);
+    pfnDestroyContext fDestroyContext;
+    typedef EGLContext (*pfnCreateContext)(EGLDisplay dpy, EGLConfig config, EGLContext share_context, const EGLint *attrib_list);
+    pfnCreateContext fCreateContext;
+    typedef EGLBoolean (*pfnDestroySurface)(EGLDisplay dpy, EGLSurface surface);
+    pfnDestroySurface fDestroySurface;
+    typedef EGLSurface (*pfnCreateWindowSurface)(EGLDisplay dpy, EGLConfig config, EGLNativeWindowType win, const EGLint *attrib_list);
+    pfnCreateWindowSurface fCreateWindowSurface;
+    typedef EGLSurface (*pfnCreatePbufferSurface)(EGLDisplay dpy, EGLConfig config, const EGLint *attrib_list);
+    pfnCreatePbufferSurface fCreatePbufferSurface;
+    typedef EGLSurface (*pfnCreatePixmapSurface)(EGLDisplay dpy, EGLConfig config, EGLNativePixmapType pixmap, const EGLint *attrib_list);
+    pfnCreatePixmapSurface fCreatePixmapSurface;
+    typedef EGLBoolean (*pfnBindAPI)(EGLenum api);
+    pfnBindAPI fBindAPI;
+    typedef EGLBoolean (*pfnInitialize)(EGLDisplay dpy, EGLint *major, EGLint *minor);
+    pfnInitialize fInitialize;
+    typedef EGLBoolean (*pfnChooseConfig)(EGLDisplay dpy, const EGLint *attrib_list, EGLConfig *configs, EGLint config_size, EGLint *num_config);
+    pfnChooseConfig fChooseConfig;
+    typedef EGLint (*pfnGetError)(void);
+    pfnGetError fGetError;
+    typedef EGLBoolean (*pfnGetConfigAttrib)(EGLDisplay dpy, EGLConfig config, EGLint attribute, EGLint *value);
+    pfnGetConfigAttrib fGetConfigAttrib;
+    typedef EGLBoolean (*pfnGetConfigs)(EGLDisplay dpy, EGLConfig *configs, EGLint config_size, EGLint *num_config);
+    pfnGetConfigs fGetConfigs;
+    typedef EGLBoolean (*pfnWaitNative)(EGLint engine);
+    pfnWaitNative fWaitNative;
+    typedef EGLCastToRelevantPtr (*pfnGetProcAddress)(const char *procname);
+    pfnGetProcAddress fGetProcAddress;
+
+    PRBool EnsureInitialized()
+    {
+        if (mInitialized) {
+            return PR_TRUE;
+        }
+
+        if (!mEGLLibrary) {
+            mEGLLibrary = PR_LoadLibrary(EGL_LIB);
+            if (!mEGLLibrary) {
+                NS_WARNING("Couldn't load EGL LIB.");
+                return PR_FALSE;
+            }
+        }
+#define SYMBOL(name) \
+	{ (PRFuncPtr*) &f##name, { "egl" #name, NULL } }
+
+	LibrarySymbolLoader::SymLoadStruct earlySymbols[] = {
+	    SYMBOL(GetDisplay),
+	    SYMBOL(GetCurrentContext),
+	    SYMBOL(MakeCurrent),
+	    SYMBOL(DestroyContext),
+	    SYMBOL(CreateContext),
+	    SYMBOL(DestroySurface),
+	    SYMBOL(CreateWindowSurface),
+	    SYMBOL(CreatePbufferSurface),
+	    SYMBOL(CreatePixmapSurface),
+	    SYMBOL(BindAPI),
+	    SYMBOL(Initialize),
+	    SYMBOL(ChooseConfig),
+	    SYMBOL(GetError),
+	    SYMBOL(GetConfigs),
+	    SYMBOL(GetConfigAttrib),
+	    SYMBOL(WaitNative),
+	    SYMBOL(GetProcAddress),
+	    { NULL, { NULL } }
+	};
+
+	if (!LibrarySymbolLoader::LoadSymbols(mEGLLibrary, &earlySymbols[0])) {
+	    NS_WARNING("Couldn't find required entry points in EGL library (early init)");
+	    return PR_FALSE;
+	}
+
+
+        mInitialized = PR_TRUE;
+        return PR_TRUE;
+    }
+
+private:
+    PRBool mInitialized;
+    PRLibrary *mEGLLibrary;
+} sEGLLibrary;
+
+class GLContextEGL : public GLContext
+{
+public:
+    GLContextEGL(EGLDisplay aDisplay, EGLConfig aConfig, 
+                 EGLSurface aSurface, EGLContext aContext)
+        : mDisplay(aDisplay), mConfig(aConfig), 
+          mSurface(aSurface), mContext(aContext){}
+
+    ~GLContextEGL()
+    {
+        sEGLLibrary.fDestroyContext(mDisplay, mContext);
+	sEGLLibrary.fDestroySurface(mDisplay, mSurface);
+    }
+
+    PRBool Init()
+    {
+        if (!OpenLibrary(GLES2_LIB)) {
+            NS_WARNING("Couldn't load EGL LIB.");
+            return PR_FALSE;
+        }
+
+        MakeCurrent();
+        return InitWithPrefix("gl", PR_TRUE);
+    }
+
+    PRBool MakeCurrent()
+    {
+	PRBool succeeded = PR_TRUE;
+
+	// Assume that EGL has the same problem as WGL does,
+	// where MakeCurrent with an already-current context is
+	// still expensive.
+	if (sEGLLibrary.fGetCurrentContext() != mContext) {
+	    succeeded = sEGLLibrary.fMakeCurrent(mDisplay, mSurface, mSurface, mContext);
+	    NS_ASSERTION(succeeded, "Failed to make GL context current!");
+	}
+
+        return succeeded;
+    }
+
+    PRBool SetupLookupFunction()
+    {
+        mLookupFunc = (PlatformLookupFunction)sEGLLibrary.fGetProcAddress;
+        return PR_TRUE;
+    }
+
+    void *GetNativeData(NativeDataType aType)
+    {
+        switch (aType) {
+        case NativeGLContext:
+            return mContext;
+
+        case NativePBuffer:
+	    return mSurface;
+
+        default:
+            return nsnull;
+        }
+    }
+
+private:
+    EGLDisplay mDisplay;
+    EGLConfig  mConfig;
+    EGLSurface mSurface;
+    EGLContext mContext;
+};
+
+already_AddRefed<GLContext>
+GLContextProvider::CreateForWindow(nsIWidget *aWidget)
+{
+    if (!sEGLLibrary.EnsureInitialized()) {
+        return nsnull;
+    }
+
+    EGLDisplay display;
+    EGLConfig  config;
+    EGLSurface surface;
+    EGLContext context;
+
+    display = sEGLLibrary.fGetDisplay(aWidget->GetNativeData(NS_NATIVE_DISPLAY));
+    if (!display) {
+        return nsnull;
+    }
+
+    if (!sEGLLibrary.fInitialize(display, NULL, NULL)) {
+        return nsnull;
+    }
+
+    if (!sEGLLibrary.fBindAPI(LOCAL_EGL_OPENGL_ES_API)) {
+        return nsnull;
+    }
+
+    EGLint attribs[] = {
+        LOCAL_EGL_SURFACE_TYPE,    LOCAL_EGL_WINDOW_BIT,
+        LOCAL_EGL_RENDERABLE_TYPE, LOCAL_EGL_OPENGL_ES2_BIT,
+        LOCAL_EGL_NONE
+    };
+
+    EGLint ncfg = 0;
+    if (!sEGLLibrary.fChooseConfig(display, attribs, &config, 1, &ncfg) ||
+        ncfg < 1)
+    {
+        return nsnull;
+    }
+
+    surface = sEGLLibrary.fCreateWindowSurface(display, config, GET_NATIVE_WINDOW(aWidget), 0);
+    if (!surface) {
+        return nsnull;
+    }
+
+    EGLint cxattribs[] = {
+        LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
+        LOCAL_EGL_NONE
+    };
+
+    context = sEGLLibrary.fCreateContext(display, config, 0, cxattribs);
+    if (!context) {
+	sEGLLibrary.fDestroySurface(display, surface);
+        return nsnull;
+    }
+
+    nsRefPtr<GLContextEGL> glContext = new GLContextEGL(display, config, surface, context);
+
+    if (!glContext->Init())
+	return nsnull;
+
+    return glContext.forget().get();
+}
+
+already_AddRefed<GLContext>
+GLContextProvider::CreatePBuffer(const gfxIntSize &aSize, const ContextFormat &aFormat)
+{
+    if (!sEGLLibrary.EnsureInitialized()) {
+        return nsnull;
+    }
+
+    EGLDisplay display;
+    EGLConfig config;
+    EGLSurface surface;
+    EGLContext context;
+
+    display = sEGLLibrary.fGetDisplay(EGL_DEFAULT_DISPLAY);
+    if (!sEGLLibrary.fInitialize(display, NULL, NULL))
+	return nsnull;
+
+    nsTArray<int> attribs;
+
+#define A1_(_x)  do { attribs.AppendElement(_x); } while(0)
+#define A2_(_x,_y)  do {                                                \
+        attribs.AppendElement(_x);                                      \
+        attribs.AppendElement(_y);                                      \
+    } while(0)
+
+    A2_(LOCAL_EGL_RENDERABLE_TYPE, LOCAL_EGL_OPENGL_ES2_BIT);
+    A2_(LOCAL_EGL_SURFACE_TYPE, LOCAL_EGL_PBUFFER_BIT);
+    /* fix this for mobile */
+    A2_(LOCAL_EGL_BUFFER_SIZE, 15 /*aFormat.colorBits()*/);
+    A2_(LOCAL_EGL_RED_SIZE, 4 /*aFormat.red*/);
+    A2_(LOCAL_EGL_GREEN_SIZE, 4 /*aFormat.green*/);
+    A2_(LOCAL_EGL_BLUE_SIZE, 4 /*aFormat.blue*/);
+    A2_(LOCAL_EGL_ALPHA_SIZE, aFormat.alpha ? 4 : 0);
+    A2_(LOCAL_EGL_DEPTH_SIZE, aFormat.depth ? 16 : 0);
+    A2_(LOCAL_EGL_STENCIL_SIZE, aFormat.stencil);
+    A1_(LOCAL_EGL_NONE);
+
+    EGLConfig configs[32];
+    int numConfigs = 32;
+
+    if (!sEGLLibrary.fChooseConfig(display, attribs.Elements(),
+				   configs, numConfigs,
+				   &numConfigs))
+	return nsnull;
+
+    if (numConfigs == 0)
+	return nsnull;
+
+    // shrug
+    config = configs[0];
+
+    EGLint pbattrs[] = {
+        LOCAL_EGL_WIDTH, aSize.width,
+        LOCAL_EGL_HEIGHT, aSize.height,
+        LOCAL_EGL_NONE
+    };
+
+    surface = sEGLLibrary.fCreatePbufferSurface(display, config, pbattrs);
+    if (!surface)
+	return nsnull;
+
+    sEGLLibrary.fBindAPI(LOCAL_EGL_OPENGL_ES_API);
+
+    EGLint cxattrs[] = {
+        LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
+        LOCAL_EGL_NONE
+    };
+
+    context = sEGLLibrary.fCreateContext(display, config, EGL_NO_CONTEXT, cxattrs);
+    if (!context) {
+	sEGLLibrary.fDestroySurface(display, surface);
+	return nsnull;
+    }
+
+    nsRefPtr<GLContextEGL> glContext = new GLContextEGL(display, config, surface, context);
+
+    if (!glContext->Init())
+	return nsnull;
+
+    return glContext.forget().get();
+}
+
+} /* namespace gl */
+} /* namespace mozilla */
+
diff --git a/gfx/thebes/src/Makefile.in b/gfx/thebes/src/Makefile.in
index 0c9f793ab3a..01965e9e3e1 100644
--- a/gfx/thebes/src/Makefile.in
+++ b/gfx/thebes/src/Makefile.in
@@ -220,18 +220,38 @@ CSRCS += woff.c
 
 EXTRA_DSO_LDOPTS += $(TK_LIBS)
 
+GL_PROVIDER = Null
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
 ifndef WINCE
-CPPSRCS += GLContextProviderWGL.cpp
-else
-CPPSRCS += GLContextProviderNull.cpp
+GL_PROVIDER = WGL
 endif
-else
+endif
+
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
-CMMSRCS += GLContextProviderCGL.mm
-else
-CPPSRCS += GLContextProviderNull.cpp
+GL_PROVIDER = CGL
 endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
+ifdef MOZ_PLATFORM_MAEMO
+GL_PROVIDER = EGL
+endif
+endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),qt)
+GL_PROVIDER = EGL
+endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+GL_PROVIDER = EGL
+endif
+
+# Mac is a special snowflake
+ifeq ($(GL_PROVIDER),CGL)
+CMMSRCS += GLContextProvider$(GL_PROVIDER).mm
+else
+CPPSRCS += GLContextProvider$(GL_PROVIDER).cpp
 endif
 
 DEFINES += -DIMPL_THEBES -DWOFF_MOZILLA_CLIENT

From 934720685c9c3bf38d01a47b04226e0d68a22b49 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Thu, 10 Jun 2010 00:57:37 +0200
Subject: [PATCH 39/45] Accept 0-1 assertions on gtk2 for this test.

---
 editor/composer/src/crashtests/crashtests.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/editor/composer/src/crashtests/crashtests.list b/editor/composer/src/crashtests/crashtests.list
index df9396992da..23fc44c6ecc 100644
--- a/editor/composer/src/crashtests/crashtests.list
+++ b/editor/composer/src/crashtests/crashtests.list
@@ -2,4 +2,4 @@ load 351236-1.html
 load 407062-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="windows") load 428844-1.html # bug 471185
 load 461049-1.html
-asserts(1) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",0-2) load removing-editable-xslt.html # bug 500847
+asserts(1) asserts-if(MOZ_WIDGET_TOOLKIT=="gtk2",0-1) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",0-2) load removing-editable-xslt.html # bug 500847

From d4546d6400aa91efb64acd7b45f1b4a87a0bed0f Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Thu, 10 Jun 2010 00:57:41 +0200
Subject: [PATCH 40/45] Re-enable the test now that the regression in bug
 565392 is fixed.

---
 widget/src/windows/tests/TestWinDND.cpp | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/widget/src/windows/tests/TestWinDND.cpp b/widget/src/windows/tests/TestWinDND.cpp
index 0b660c93456..549aeb22c99 100644
--- a/widget/src/windows/tests/TestWinDND.cpp
+++ b/widget/src/windows/tests/TestWinDND.cpp
@@ -754,9 +754,6 @@ nsresult Do_Test3()
 
 int main(int argc, char** argv)
 {
-  printf("TestWinDND.cpp disabled due to failures after bug 565392 (and it doesn't run on normal FF tests).");
-  return 0;
-
   ScopedXPCOM xpcom("Test Windows Drag and Drop");
 
   nsCOMPtr<nsIFile> file;

From c48d5eca8f7c3244995577082148ecc67081aacc Mon Sep 17 00:00:00 2001
From: Robert Strong <robert.bugzilla@gmail.com>
Date: Wed, 9 Jun 2010 16:01:46 -0700
Subject: [PATCH 41/45] Bug 569058 - Upgrade NSIS version to 2.45 or later (PCA
 complains when installer is cancelled on Windows 7). configure.in,
 autoconf.mk.in, and makensis.mk changes only. r=ted.mielczarek

---
 config/autoconf.mk.in                         |  2 ++
 configure.in                                  | 29 ++++++++++++++++---
 .../installer/windows/nsis/makensis.mk        |  6 ++--
 3 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index 9f361aaf0bc..b88ffcbbbac 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -177,6 +177,8 @@ JAR="@JAR@"
 
 TAR=@TAR@
 
+MAKENSIS=@MAKENSIS@
+
 RM = rm -f
 
 # The MOZ_UI_LOCALE var is used to build a particular locale. Do *not*
diff --git a/configure.in b/configure.in
index 2fc1d074fe5..81fe836e3e2 100644
--- a/configure.in
+++ b/configure.in
@@ -6428,12 +6428,32 @@ MOZ_ARG_DISABLE_BOOL(installer,
     MOZ_INSTALLER=,
     MOZ_INSTALLER=1)
 if test -n "$MOZ_INSTALLER" -a "$OS_ARCH" = "WINNT"; then
-    # Disable installer for Windows builds that use the new toolkit if NSIS
-    # isn't in the path.
-    MOZ_PATH_PROGS(MAKENSIS, makensis)
+    # Disable installer for Windows builds that use the new toolkit if the
+    # required major version and minimum minor version of Unicode NSIS isn't in
+    # the path.
+    REQ_NSIS_MAJOR_VER=2
+    MIN_NSIS_MINOR_VER=33
+    MOZ_PATH_PROGS(MAKENSIS, $MAKENSIS makensisu-2.46 makensisu makensis)
     if test -z "$MAKENSIS" || test "$MAKENSIS" = ":"; then
-        AC_MSG_ERROR([To build the installer makensis is required in your path. To build without the installer reconfigure using --disable-installer.])
+        AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
     fi
+    changequote(,)
+    MAKENSIS_VER=`"$MAKENSIS" -version 2>/dev/null | sed -e '/-Unicode/!s/.*//g' -e 's/^v\([0-9]\+\.[0-9]\+\)\-Unicode$/\1/g'`
+    changequote([,])
+    if test ! "$MAKENSIS_VER" == ""; then
+        MAKENSIS_MAJOR_VER=`echo $MAKENSIS_VER | $AWK -F\. '{ print $1 }'`
+        MAKENSIS_MINOR_VER=`echo $MAKENSIS_VER | $AWK -F\. '{ print $2 }'`
+    fi
+    AC_MSG_CHECKING([for Unicode NSIS with major version == $REQ_NSIS_MAJOR_VER and minor version >= $MIN_NSIS_MINOR_VER])
+    if test "$MAKENSIS_VER" == "" ||
+       test ! "$MAKENSIS_MAJOR_VER" == "$REQ_NSIS_MAJOR_VER" ||
+       test ! "$MAKENSIS_MINOR_VER" -ge $MIN_NSIS_MINOR_VER; then
+        AC_MSG_RESULT([no])
+        AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
+    fi
+    AC_MSG_RESULT([yes])
+    MAKENSIS="${CYGWIN_WRAPPER} $MAKENSIS"
+
     # The Windows build for NSIS requires the iconv command line utility to
     # convert the charset of the locale files.
     MOZ_PATH_PROGS(HOST_ICONV, $HOST_ICONV "iconv", "")
@@ -8693,6 +8713,7 @@ AC_SUBST(CYGWIN_WRAPPER)
 AC_SUBST(AS_PERL)
 AC_SUBST(WIN32_REDIST_DIR)
 AC_SUBST(PYTHON)
+AC_SUBST(MAKENSIS)
 
 AC_SUBST(WINCE)
 AC_SUBST(WINCE_SDK_DIR)
diff --git a/toolkit/mozapps/installer/windows/nsis/makensis.mk b/toolkit/mozapps/installer/windows/nsis/makensis.mk
index 643696f6a41..bc784cff8f1 100644
--- a/toolkit/mozapps/installer/windows/nsis/makensis.mk
+++ b/toolkit/mozapps/installer/windows/nsis/makensis.mk
@@ -68,10 +68,10 @@ $(CONFIG_DIR)/setup.exe::
 	done
 	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && makensisu.exe installer.nsi
+	cd $(CONFIG_DIR) && $(MAKENSIS) installer.nsi
 # Support for building the uninstaller when repackaging locales
 ifeq ($(CONFIG_DIR),l10ngen)
-	cd $(CONFIG_DIR) && makensisu.exe uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSIS) uninstaller.nsi
 endif
 
 $(CONFIG_DIR)/7zSD.sfx:
@@ -94,6 +94,6 @@ uninstaller::
 	done
 	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && makensisu.exe uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSIS) uninstaller.nsi
 	$(NSINSTALL) -D $(DIST)/bin/uninstall
 	cp $(CONFIG_DIR)/helper.exe $(DIST)/bin/uninstall

From 300684b05d6e6731eb9e9af9228ecd97b780b4b9 Mon Sep 17 00:00:00 2001
From: Robert Strong <robert.bugzilla@gmail.com>
Date: Wed, 9 Jun 2010 16:02:13 -0700
Subject: [PATCH 42/45] Bug 526333 - Having to create patches for each app's
 package manifest and removed-files and then get reviews from each app is a
 PITA. configure.in changes for MOZ_UPDATER only. r=ted.mielczarek

---
 browser/base/Makefile.in                   | 4 ----
 browser/components/preferences/Makefile.in | 4 ----
 browser/installer/Makefile.in              | 4 ----
 configure.in                               | 6 +++++-
 4 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/browser/base/Makefile.in b/browser/base/Makefile.in
index d0ebbef942f..8cd20e6aa31 100644
--- a/browser/base/Makefile.in
+++ b/browser/base/Makefile.in
@@ -73,10 +73,6 @@ ifneq (,$(filter windows gtk2 cocoa, $(MOZ_WIDGET_TOOLKIT)))
 DEFINES += -DHAVE_SHELL_SERVICE=1
 endif
 
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
-
 ifneq (,$(filter windows cocoa gtk2, $(MOZ_WIDGET_TOOLKIT)))
 ifneq ($(OS_ARCH),WINCE)
 DEFINES += -DCONTEXT_COPY_IMAGE_CONTENTS=1
diff --git a/browser/components/preferences/Makefile.in b/browser/components/preferences/Makefile.in
index c34dfa1ccff..54e5e322803 100644
--- a/browser/components/preferences/Makefile.in
+++ b/browser/components/preferences/Makefile.in
@@ -57,7 +57,3 @@ DEFINES += \
 ifneq (,$(filter windows gtk2 cocoa, $(MOZ_WIDGET_TOOLKIT)))
 DEFINES += -DHAVE_SHELL_SERVICE=1
 endif
-
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
diff --git a/browser/installer/Makefile.in b/browser/installer/Makefile.in
index 4e49ced3b2c..e36038691cb 100644
--- a/browser/installer/Makefile.in
+++ b/browser/installer/Makefile.in
@@ -82,10 +82,6 @@ ifdef NSS_DISABLE_DBM
 DEFINES += -DNSS_DISABLE_DBM=1
 endif
 
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
-
 ifdef _MSC_VER
 DEFINES += -D_MSC_VER=$(_MSC_VER)
 endif
diff --git a/configure.in b/configure.in
index 81fe836e3e2..6f55992f6c9 100644
--- a/configure.in
+++ b/configure.in
@@ -6485,7 +6485,10 @@ MOZ_ARG_DISABLE_BOOL(updater,
 [  --disable-updater       Disable building of updater],
     MOZ_UPDATER=,
     MOZ_UPDATER=1 )
-AC_SUBST(MOZ_UPDATER)
+
+if test -n "$MOZ_UPDATER"; then
+    AC_DEFINE(MOZ_UPDATER)
+fi
 
 # app update channel is 'default' when not supplied.
 MOZ_ARG_ENABLE_STRING([update-channel],
@@ -8670,6 +8673,7 @@ AC_SUBST(MOZ_VIEW_SOURCE)
 AC_SUBST(MOZ_SPELLCHECK)
 AC_SUBST(MOZ_USER_DIR)
 AC_SUBST(MOZ_CRASHREPORTER)
+AC_SUBST(MOZ_UPDATER)
 
 AC_SUBST(ENABLE_STRIP)
 AC_SUBST(PKG_SKIP_STRIP)

From f77d731a115211b4941c4b8321df9730a158db28 Mon Sep 17 00:00:00 2001
From: Robert Strong <robert.bugzilla@gmail.com>
Date: Wed, 9 Jun 2010 16:02:25 -0700
Subject: [PATCH 43/45] Bug 485114 - Add plugin for modifying file permissions
 and move NSIS plugins under other-licenses. r=bsmedberg

--HG--
rename : toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll => other-licenses/nsis/Plugins/AppAssocReg.dll
rename : toolkit/mozapps/installer/windows/nsis/ApplicationID.dll => other-licenses/nsis/Plugins/ApplicationID.dll
rename : toolkit/mozapps/installer/windows/nsis/ShellLink.dll => other-licenses/nsis/Plugins/ShellLink.dll
rename : toolkit/mozapps/installer/windows/nsis/UAC.dll => other-licenses/nsis/Plugins/UAC.dll
rename : toolkit/mozapps/installer/windows/nsis/nsProcess.dll => other-licenses/nsis/Plugins/nsProcess.dll
---
 other-licenses/nsis/Plugins/AccessControl.dll   | Bin 0 -> 11776 bytes
 .../nsis/Plugins}/AppAssocReg.dll               | Bin
 .../nsis/Plugins}/ApplicationID.dll             | Bin
 .../nsis/Plugins}/ShellLink.dll                 | Bin
 .../nsis/Plugins}/UAC.dll                       | Bin
 .../nsis/Plugins}/nsProcess.dll                 | Bin
 .../mozapps/installer/windows/nsis/makensis.mk  |   9 +++++----
 7 files changed, 5 insertions(+), 4 deletions(-)
 create mode 100644 other-licenses/nsis/Plugins/AccessControl.dll
 rename {toolkit/mozapps/installer/windows/nsis => other-licenses/nsis/Plugins}/AppAssocReg.dll (100%)
 rename {toolkit/mozapps/installer/windows/nsis => other-licenses/nsis/Plugins}/ApplicationID.dll (100%)
 rename {toolkit/mozapps/installer/windows/nsis => other-licenses/nsis/Plugins}/ShellLink.dll (100%)
 rename {toolkit/mozapps/installer/windows/nsis => other-licenses/nsis/Plugins}/UAC.dll (100%)
 rename {toolkit/mozapps/installer/windows/nsis => other-licenses/nsis/Plugins}/nsProcess.dll (100%)

diff --git a/other-licenses/nsis/Plugins/AccessControl.dll b/other-licenses/nsis/Plugins/AccessControl.dll
new file mode 100644
index 0000000000000000000000000000000000000000..d9642d4e86c17540c9b568287ef46ddcaf9b87a2
GIT binary patch
literal 11776
zcmeHN4RloHnf?-jM4XU85*sV(fI&eN?=YGC%})}@4T&T$$%Gjq5*U&RGjW)SlY0?d
z(n1G3POn)#r)sUWyISh5M{&!#7P0HrXfP3fT6e3Ev)UDZPJ1n^O>4xlO}YEL-<?SY
zlTkd|vp?r}Iq$vSeZTj8zxV(9?vSP%?qV|-V>tj#W9%@VbXD{F=if#!J?HYD&S6iU
z|LTInS&gqQXbl8=O+C@b)~IirslyizM<ml0zbPt*O~J6KcCFjAEz;><mX|lXI4SxU
zkA3`G<)!aGor3xohMvBIzu*7#ckw)6`1t8>^XEIs=X?Cw66^>NPbLjrB4dqNIjrNU
zqYWvV6D)hd1zEX_T?kB(j(yySCxO7<jeMM~`-3p#7k>5No_x`#!9;v?<IkiRCu2{7
zK(I09;*1$?n;9Db-Iu-u#&&%U(=y4wL&E$Mb8#cR$kquXFvewKZ1b{cr%&=R_CC=-
zCa1dy&$O!=X|PNuW9zdp;R2A(ivej@HB4C+^@k!Ij9o;@v>8BaUJXdQsu^36_WITE
z|9}S`s&8h-eFGk8i6ZPfEnU%Hm*di;VuMy#Eij{Uo{~odo_Lm4Xa~YFaB_xapt}9}
z92RrX43n%6H4;UCEz5OvS8Ij!Ak(abQ$|S=msnT}EMH5>jn9b-B*3Ftkx@qCaS;z_
zbq<eKC;<^WV(_T<YMO@kM!dHVDz(Kq`&%IyDm-ss`v!K+wgJ_bgZDwpz+kM3d6ZA2
zBCS+6p%q;F2Bf^$P)^LrWHt7p1|dUBho4Jiw-2sUPBnYH%I`f&LMvPk(yo|uaer;y
z8F^_}tbB>Qs4He-G5<L07sp+(p=_vuN`XLm#sYCXb`?{^@sp<ESyUNko1!E<-lPME
zH?<$7m13s~uvTBL<+L|0kEhnF!g{OD$XD_87Iei0zSM9wxb>y-_bHGLjt^pZx|K_F
zph3TQ%GEC>T%LY$%;oWV;__HrPQ>L=?UzvQ0<G{y5XBO=%JrI@P#ol3IQh73C@zjl
zC7L{zdK;In>~A{N+~1UF*5uLtrm<$1Cg*y%7=uP?lHW;R$mZh>usLZ_v)l4!S4B~L
z<G2*^cu(eb#XdFNGP}Au|Eb(A+spDO=9E!se*RN)XlDC7+;>TNxG$Av)zx)XTqeJd
zn>4d4epy|eOA&LG9R{`XjHcNJ+jh-WnsRM51%2l$4Mrtr&-vmwXq6%Phnw1=!G@$u
zOWg1?Pa<VBl}5^lMRUhDo{IO44U3}`n|NO$-Z!pZ_-9Q+GRz9tOPTTHb^YR~^0Jx$
z(l#6y$J}y$pa>Ic7cd_@2R8Mcan6t*c*_cW9^oGY-lGhve}<aMi0$n*dA25>3OoXW
zlP`F^6cn$wJ4f4|13zko1@NA2Sju$;>WLzlf2b}O9yauguebxXK)JL+BWNo6jEXoK
z7f&eSSX@-48S%c?DH9Mrkh;22e1-{8BP9@ZnHS+nUn*Ch&vOL=m{%W!?rm)qedCIi
zLMY9oXdbKROVB8x9YYe(?UZ(GQ@id>l!8U`dX-UHm`m=>f!n6DL!iY!`HxFZd-wbr
z4tdbKX9$nov7hI7v|iovG<C?SbGbSb88uN8MdUF!q?>7l^Pwlw7qxtJP!SVx@f0GB
zj8#PACnMeLl7Vg(JCWUOM6mir)ddzgcUV+;^%WLzW@%8*ealft!A!>T?|DvnE}1HZ
ziBy?Llu?UDrDJ&$38IeuF+DqWdDMESY#VNqjUGKO*8B<a?}wdAlX2-Uq{0RXp*IGK
z$`K8zJG(tDCQi<@oUT(w$bsF9wZcy5gaDg#yXNSsxdH=a;8@X}6}TG%xJ3N}k_o*I
zwi^P~z^OlkE+?--MR?)pgxjO_z^UlSlTKC1sn39{t<5_j=TTh__wr^eN-^d|n+h>{
z&_mR5JzkgPbayrC8f{}(9K(r-!QFZrRuY^>cl^>J>B9OnLw()Z>-h%Y@p!0f^f!$+
zQ|YEO<Ox4S34f6MvK$e#4aqYQPHHawO{2|TYB-u);6gVo);%*X<(bXkQGfj@w<@K1
zGJL|+LbqtHI1(hi%++OJo~-fZO4B&XT%89;*@od4q)w{LzX{3@z7NCIKPJ-4{7S;_
zqcDr(9<>lbrzAkA$Mq^7%0ILwx4App#p}0Ud~KqH4ZMWk=OuiKN*IZNc0eQ<3OJFW
zfGN0dLn|ua#AE?amMuz|O314^x$biHg7X5qE0_`6hQ8&=2Ji5BR2k}gPyii(t78dG
z%74UoxCk4leDPt1$6%luY$s<140xzlgBH6e?Tg8_I#DZ$eVTNI+tZJ9y$w6EGP3VY
zX*Ol3`W#%;h86e@y<roN*R<@5X)EOtY9V3YK)aMrsVYOpbqEkDASvZ@WGv+TIZ6IJ
zVs@$XQK@HfH+vK-ZF-YN98<`E74CHt`}8s8TGE&svZ!AwHmd)C@<Hwtx^Z@x53w(E
zu|~H#?-NaPYj1e9H#TnA)ZWJZGto`-ji;X63-go_xBBR5k|Xa*#>71t6L&Huw}Zm{
zY>o>qzaFx?bCgk4z#w)cci(_po)bt=G=2rDwziW_wT%nJ#&v{ZwFHNVE*w6zlAnx1
zf?^F}ZLfCB4Hy>3Dd;C>2ks*YH_$rzxeeKz>H^K5Id>_eIQLzNv&6W%kUO?bnv2M~
zJ^w5qL)3Su9yg?pV0w6`ldzaeIKiFRCe7pR`7lZFs4nCc9p;irl39kX#REwha}i!o
zfGbg<C&<|n&=~c-p9dSMdW=VNb$ZwxJji6B;3f;Jld=mv5boB6zsrRiJtza(lhrFe
zrX%NZw|1PnOld4O;^3JZ=O<yj8M?Ff)A2T*=fZtIbyW35+TaGKA!SoYe~^iEs?>kX
zM4CNC>TQ`wXG|g8kcl*B3aOBZbgEemnMkLaby+6TsZ!0ENT*6YkCUQ#DWXAXD)1)b
z)nvq1$!85qZFOi0#WBBu+LA$i9C<)(=>lxFUUeVkeX6l-+BjWor|OU~wo@&Op1Wo7
zOr%rOpgj}m)HJYUBAuEBxtU0(nzbMk=~QQ(rk!ItzfP5!ckWW(<x(foz;h01K<#0P
zo(7^py_Baxn}qX|A=$uoqB*y<rMk~Xz5_HXVu9PEAXW4)to`&gjI*i-2P^*dyPvv4
zoOdYgIIzkHf5gQC`k*@QR`A7URCkSPTEA#;p-<BnpXDgFjv4VLLq(H8vd{sdUo_Go
zf<6Wcpi%S0v8nK^W7Cfz2fM`_P^num_Nq7Ht{)z-GZ6DJ_vC3G%5&X6S8M)RuHX~I
z;KD~M4xo!^t5Ii=_|*A~J0o@qho1tsveA&*c~f%T@W!RoEOl>OO3hL`mO8o_;(f+=
zUx9kd@A%d`J8-a)89(?GTbOQn0a*_7aZbR3^yv%l<m-0h`!;{yFF^{^sQ2@)xct5J
z<%V-P-wm+m=kGn3CJiUzlsx+4&;@$sOLSvW{;Y=*>L#cJf67{636{-2#Ok3&p@8w8
z@-b|(GQJ~0hdrZ&$ba`Cwpv;=F5>GB{?ZDs0WCka(@zUZlcB${=FG`i_|4+{hKBmC
zSjDySM_sW6EU*~-h$?O4AXguTq*$MUVegU7=lryV(MgFPv5pSHp1<HVj^8OSvNLuK
zpcb$mumf-x;1R$8;B|lsNB}N$;O9R8T`oM^0o{P@fW3gb0Dl8`6mSSI1b7{w0?q*F
zD#CB1scRi`Gm*96ej`UUu^P6L)w2e+26!E}lC1+p3*OhTR<;RmIuFgRWR2i(bBr5v
zEo?3RwQ|mSwi>hy(pH12iOZ)k$)igjxA5^w7G-|sV-oI-EXcy_CXQdjBESV%7u(6-
zMa;--8>pg5YB%1uK&l@Uy;EeR&(fqDbQ1G`Hv~REr*Gz?DEQCD*J3`z>HW|-04+kS
z6CAC4?d_O}Vntm>4Q4taopk90C0Wyfl_D6C=K6dcmq8q4V=v}wr=eX1-Y}OQgbb1G
z;Id>;>ua4o@5Kti40A2u@Nu2%pjin2Y9O%#*xsbC+|VuzOaM|M7zNp_e3eP5YuPPH
zZOB=Z_*$MRgiEcml1q@dq!94w{v*0c-WupjbU}Daw~Hc|k~94*o8pN{c_MU~<k#QG
z=RNpGzU+i9lv_ShBTbJ<Y-;UE3@2r1HT)-c`Z=Ax)9L4W6JR%hPfkOjWnIqV_(A`o
ztP9zLcxIBJ3!oqLC#7GE)y@OZvx?<s<gEtRZos+fuoAY1@sFy>gfV$0gxH&SY;WPX
z$;>bzBPbhEu{42J&(~$36cIVfmMF$V*9jk2V!ViF8YxA6A$>iHvR*y^GwVg65#>Eu
z`j@e4MN%H+QxyG&ywQt0dC7$C6vF&gU`+VWnMHUmfe&0?Nb7?vKX@kPg&~Em)Or*F
z8S<$1iE>i9-iOlXNT=y!k-W3xLG@1Y*~(>}n~zMeHVi(ppZX2)QztpMj5vG!>GCf!
z(Pw&jukAS}$?Kqn4_$=%v<X^8aNi33s5_hZu0(s1h*2x{B^qtQE>?rxNW^>(w`Du%
ziJ!c&48Ed0g8Bh@owD4INRrLzbmUXI&bBL(>^HjP2=@==iLTjAkQ6>At0?|5^r5OE
z3w!ZK6-(MsCQxRd9m8#y`{FtbfhvNX)x_nQFi!RMbBp3<?In*<Kk0xx>Iq~Yy-&*h
zGO<kUj=kthdd6>qtRBQyLPkuV*$r56J1D3>kypBsu{>89*MUC*p7hM7xV8YR_ezSI
z-Y0$h+%Z)T$`#5v(wTO96FmGyJgNGoKALHr^jg1`S@C^B|541i#`N5YRrC`N#U+9m
z(D@|HuHrFB#hNl_YJ{k7P$g48*6qra0eWAjOr)!c+ew{|x(DUaXXQ}D=xnu>UCXKT
z2-0bdPHmLEQC?+iB32}Kx-%2yQ@US?Za2=$scQwDXW^1((r~kJw#9#xvavK=F>sRZ
zx)kfg^MCXFy`HU%gtz;nl3R)f!&}|K&ejNSUYv}x8Y7XL<er+2j))wV*7&yhfi2B;
z`}w%j?eCDIL1|}0xGUmiO9?NAA;jO?5U%M6fwq{fkb|L4aYs)m*b$T<$lu%R4N8He
ztQlFWrj<3H)pT~ty;5uBCV$u!4Q>yH{9FCK%$3w=0_E|AWGHnYYi$n^Mo2zqV(j{}
zwdW=+qV?AG`lHG9T@$u*t5Xhu=0!va9=E)uMwS8*vXilkr@^iy->{lmPmQa=vV2)*
z2!~EBYgH(+#TTlJ`f*quo)PMmq8&XuA@`-!IP7JKBvnm_{%GRH?8Zn(l4ZR<)+g8z
zoo8E5(92%s<B%Wh>}JxY(bp@9(P$*fSP5GhiuC&Hec{fKpRJ(Tm2x!d4@*hUFdyOS
z;LI8cwr-Ine=p?xOqcJIFkUUTtPvYic8p}-(%XZqkh;8Vom*^4;VE%be^b*^r62z;
z2997o^86Wq3HaCMGj{wk#(sVYV{crFy2Y~<&xLp{!E@|##vTUEt$+id+XL8vxo=`_
zg^96GF=oK6#e6YfKi(h3oCmn204w-Au}%-*8-O_AUclpkA;4RJF~F>9#tHxn00N*2
zuo}<?=mGQr?f`rb@OOZNfM)<N1O6RA7G~owq;l9yoQr4S41PYF%`RXDmdEDcd~9TM
zal)R*3Roe#h<y!zR-~soDoct+LOdx}hWx(h+Aw(^apL0^|JK$1ovhX$-kF@xhberp
z*S96)Cys`2z>gI4g**JLR!8eZ=@VjjI&vL5m3lHeQU$@1$+0RLk$X}vYi|krqx7On
zn3&UFle1A@SV~&3N+0Xftf7~Lw+8$*o!f%pAj-feAyr%a+fms`j?_z%1zm(J))z{?
z=*!?G$-+mI^!jLmLw`;3P+?QGQxLzpGI;=>e&hIoX%z52;4J`=-fqEP4FGNgGy?2^
zYXAnospX&p9042z+y~eV2moAw5<mff<Rr}abqw$#ASLHXj2{4eSy?1+FZg-@tpEXF
z0^|aw(<faQ(vA2BVBe1bcL8<-#_{W07Vrc`E@pfX_R*it<=S-o42(AeZ^B<yT!`^}
z;OT3bzM2mL|32vRG5&vh!7Ha=e3tNaVWF^8unV<9i?Ch@2-}2j2)7B}75-j$Lim-C
zYhGq<FgKewn0J`JXFh0t!~CB4^5sjH4=#Uo`A5qQmST%&*=X5nxz)1A@`&XL%ZrwO
zv%G6rRB~O3x5QU+bIG?$hD-jn<inEFC3CIC)@thp>lSOs8nynF^-k*n>mlo)^|<wf
zb<~<yT2Q*AbWQ2{(p{yumEKW$f9ZkJL#4+{KPtVTY-w3#S#4RcthX#)_MNi*Wk<_i
zEBj5^M`eF3W975Tzh1tuyrI0U+*f{Q`47q;E`POrr2Osj-<SWX++I;vv9Y4F;?|0L
zDh^aUQ}KMo@rw5<PFI|%m|uByWqD<FWqW0~a#!Wv%7-csRz6$#Lglf_6P0Hw=h&{X
zmDwD&6*jMJi!ET=X8V?{-}W8beYVGKhiyNz4cbO*@7X@EeQ29upJOkuUu<7yudr9y
zYwd0JPJ6dKV&7}O(|(Wre*2H@KeZ3oU$DPr|Bd}W?SHT*><b+hhtpB(XmGSUf{uto
za>N~XJMMS<t>a0@vyK-WFFD?J{MIq*_}DSqS?IjPX>wYf)y_KSYUgI>P0pL0+ntK@
zUgrbOhn$C;&pC&kuQ=axe&`%?e(Kbmmsc&T605GS@>Ff8@>MBS|5WuaRfAP0s&HJ!
z?@+h|gD_Y4nsBLbtx(CM-6;fxi163KW5Q2_abcD@&pgk(5D~YTSD0@wcbLCrj+^(J
z517I0!f(8I<OsQtVibym`GQF(78VQF2!c=|lp}+xkwf)Dqu>%+kx83{PGnO^=n*7g
zhp<c7E$kI;7w!=567Cl66CMyA6n-Qe6rL0g3(p7x!V%#`;T7RE;dNm|cuP1Tyf3K2
hs4ylZpcgY6%tmvOx!AneEST-)YSQPc>%ZlJ{{n58C;k8c

literal 0
HcmV?d00001

diff --git a/toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll b/other-licenses/nsis/Plugins/AppAssocReg.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll
rename to other-licenses/nsis/Plugins/AppAssocReg.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/ApplicationID.dll b/other-licenses/nsis/Plugins/ApplicationID.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/ApplicationID.dll
rename to other-licenses/nsis/Plugins/ApplicationID.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/ShellLink.dll b/other-licenses/nsis/Plugins/ShellLink.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/ShellLink.dll
rename to other-licenses/nsis/Plugins/ShellLink.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/UAC.dll b/other-licenses/nsis/Plugins/UAC.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/UAC.dll
rename to other-licenses/nsis/Plugins/UAC.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/nsProcess.dll b/other-licenses/nsis/Plugins/nsProcess.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/nsProcess.dll
rename to other-licenses/nsis/Plugins/nsProcess.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/makensis.mk b/toolkit/mozapps/installer/windows/nsis/makensis.mk
index bc784cff8f1..ced3f64f796 100644
--- a/toolkit/mozapps/installer/windows/nsis/makensis.mk
+++ b/toolkit/mozapps/installer/windows/nsis/makensis.mk
@@ -53,12 +53,13 @@ TOOLKIT_NSIS_FILES_CONV = \
 	version.nsh \
 	$(NULL)
 
-TOOLKIT_NSIS_FILES = \
+CUSTOM_NSIS_PLUGINS = \
+	AccessControl.dll \
 	AppAssocReg.dll \
+	ApplicationID.dll \
 	nsProcess.dll \
 	ShellLink.dll \
 	UAC.dll \
-	ApplicationID.dll \
 	$(NULL)
 
 $(CONFIG_DIR)/setup.exe::
@@ -66,7 +67,7 @@ $(CONFIG_DIR)/setup.exe::
 	  iconv -f UTF-8 -t UTF-16LE $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/$$i | \
 	    cat $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/utf16-le-bom.bin - > $(CONFIG_DIR)/$$i; \
 	done
-	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
+	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
 	cd $(CONFIG_DIR) && $(MAKENSIS) installer.nsi
 # Support for building the uninstaller when repackaging locales
@@ -92,7 +93,7 @@ uninstaller::
 	  iconv -f UTF-8 -t UTF-16LE $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/$$i | \
 	    cat $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/utf16-le-bom.bin - > $(CONFIG_DIR)/$$i; \
 	done
-	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
+	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
 	cd $(CONFIG_DIR) && $(MAKENSIS) uninstaller.nsi
 	$(NSINSTALL) -D $(DIST)/bin/uninstall

From 88dcafa57df803baf59aa2a38c1f2b5b9d3ab379 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Wed, 9 Jun 2010 16:03:50 -0700
Subject: [PATCH 44/45] Bug 571036: revert addition of reftest-wait, since it
 didn't help this randomorange. (Also remove unnecessary full-page white
 background). [test-only change]

---
 layout/reftests/svg/dynamic-use-nested-01.svg | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/layout/reftests/svg/dynamic-use-nested-01.svg b/layout/reftests/svg/dynamic-use-nested-01.svg
index 437324658c4..2e145086640 100644
--- a/layout/reftests/svg/dynamic-use-nested-01.svg
+++ b/layout/reftests/svg/dynamic-use-nested-01.svg
@@ -1,6 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" version="1.1"
      xmlns:xlink="http://www.w3.org/1999/xlink"
-     class="reftest-wait" onload="boom();">
+     onload="boom();">
 
 <script><![CDATA[
 
@@ -10,14 +10,10 @@ function boom()
 {
   var rect = document.getElementById("rect");
   rect.setAttribute("height", "100%");
-  document.documentElement.removeAttribute('class');
 }
 
 ]]></script>
 
-  <!-- change to lime for automated testing -->
-  <rect width="100%" height="100%" fill="white"/>
-
   <g style="fill: blue;">
     <g id="g1">
       <rect id="rect" x="20%" width="4%" height="20%"/>

From 59a8dfd6fd5064b71981cbe4dcdf47d832cbb155 Mon Sep 17 00:00:00 2001
From: Robert Strong <robert.bugzilla@gmail.com>
Date: Wed, 9 Jun 2010 16:23:00 -0700
Subject: [PATCH 45/45] Followup bustage fix for Bug 569058 - don't use a
 cached var.

---
 config/autoconf.mk.in                         |  2 +-
 configure.in                                  | 22 +++++++++----------
 .../installer/windows/nsis/makensis.mk        |  6 ++---
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index b88ffcbbbac..ee16b1b9b63 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -177,7 +177,7 @@ JAR="@JAR@"
 
 TAR=@TAR@
 
-MAKENSIS=@MAKENSIS@
+MAKENSISU=@MAKENSISU@
 
 RM = rm -f
 
diff --git a/configure.in b/configure.in
index 6f55992f6c9..ef4b5aaf086 100644
--- a/configure.in
+++ b/configure.in
@@ -6433,26 +6433,26 @@ if test -n "$MOZ_INSTALLER" -a "$OS_ARCH" = "WINNT"; then
     # the path.
     REQ_NSIS_MAJOR_VER=2
     MIN_NSIS_MINOR_VER=33
-    MOZ_PATH_PROGS(MAKENSIS, $MAKENSIS makensisu-2.46 makensisu makensis)
-    if test -z "$MAKENSIS" || test "$MAKENSIS" = ":"; then
+    MOZ_PATH_PROGS(MAKENSISU, $MAKENSISU makensisu-2.46 makensisu makensis)
+    if test -z "$MAKENSISU" || test "$MAKENSISU" = ":"; then
         AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
     fi
     changequote(,)
-    MAKENSIS_VER=`"$MAKENSIS" -version 2>/dev/null | sed -e '/-Unicode/!s/.*//g' -e 's/^v\([0-9]\+\.[0-9]\+\)\-Unicode$/\1/g'`
+    MAKENSISU_VER=`"$MAKENSISU" -version 2>/dev/null | sed -e '/-Unicode/!s/.*//g' -e 's/^v\([0-9]\+\.[0-9]\+\)\-Unicode$/\1/g'`
     changequote([,])
-    if test ! "$MAKENSIS_VER" == ""; then
-        MAKENSIS_MAJOR_VER=`echo $MAKENSIS_VER | $AWK -F\. '{ print $1 }'`
-        MAKENSIS_MINOR_VER=`echo $MAKENSIS_VER | $AWK -F\. '{ print $2 }'`
+    if test ! "$MAKENSISU_VER" == ""; then
+        MAKENSISU_MAJOR_VER=`echo $MAKENSISU_VER | $AWK -F\. '{ print $1 }'`
+        MAKENSISU_MINOR_VER=`echo $MAKENSISU_VER | $AWK -F\. '{ print $2 }'`
     fi
     AC_MSG_CHECKING([for Unicode NSIS with major version == $REQ_NSIS_MAJOR_VER and minor version >= $MIN_NSIS_MINOR_VER])
-    if test "$MAKENSIS_VER" == "" ||
-       test ! "$MAKENSIS_MAJOR_VER" == "$REQ_NSIS_MAJOR_VER" ||
-       test ! "$MAKENSIS_MINOR_VER" -ge $MIN_NSIS_MINOR_VER; then
+    if test "$MAKENSISU_VER" == "" ||
+       test ! "$MAKENSISU_MAJOR_VER" == "$REQ_NSIS_MAJOR_VER" ||
+       test ! "$MAKENSISU_MINOR_VER" -ge $MIN_NSIS_MINOR_VER; then
         AC_MSG_RESULT([no])
         AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
     fi
     AC_MSG_RESULT([yes])
-    MAKENSIS="${CYGWIN_WRAPPER} $MAKENSIS"
+    MAKENSISU="${CYGWIN_WRAPPER} $MAKENSISU"
 
     # The Windows build for NSIS requires the iconv command line utility to
     # convert the charset of the locale files.
@@ -8717,7 +8717,7 @@ AC_SUBST(CYGWIN_WRAPPER)
 AC_SUBST(AS_PERL)
 AC_SUBST(WIN32_REDIST_DIR)
 AC_SUBST(PYTHON)
-AC_SUBST(MAKENSIS)
+AC_SUBST(MAKENSISU)
 
 AC_SUBST(WINCE)
 AC_SUBST(WINCE_SDK_DIR)
diff --git a/toolkit/mozapps/installer/windows/nsis/makensis.mk b/toolkit/mozapps/installer/windows/nsis/makensis.mk
index ced3f64f796..07acedba7fa 100644
--- a/toolkit/mozapps/installer/windows/nsis/makensis.mk
+++ b/toolkit/mozapps/installer/windows/nsis/makensis.mk
@@ -69,10 +69,10 @@ $(CONFIG_DIR)/setup.exe::
 	done
 	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && $(MAKENSIS) installer.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) installer.nsi
 # Support for building the uninstaller when repackaging locales
 ifeq ($(CONFIG_DIR),l10ngen)
-	cd $(CONFIG_DIR) && $(MAKENSIS) uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) uninstaller.nsi
 endif
 
 $(CONFIG_DIR)/7zSD.sfx:
@@ -95,6 +95,6 @@ uninstaller::
 	done
 	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && $(MAKENSIS) uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) uninstaller.nsi
 	$(NSINSTALL) -D $(DIST)/bin/uninstall
 	cp $(CONFIG_DIR)/helper.exe $(DIST)/bin/uninstall