merge mozilla-central to fx-team

Makefile.in

@@ -166,7 +166,11 @@ SYMBOL_INDEX_NAME = \
 buildsymbols:
 ifdef MOZ_CRASHREPORTER
 ifdef USE_ELF_HACK
-	$(MAKE) -C $(MOZ_BUILD_APP)/installer elfhack
+    ifeq (mobile,$(MOZ_BUILD_APP))
+		$(MAKE) -C mobile/xul/installer elfhack
+    else
+		$(MAKE) -C $(MOZ_BUILD_APP)/installer elfhack
+    endif
 endif
 	echo building symbol store
 	$(RM) -r $(DIST)/crashreporter-symbols

accessible/src/base/AccGroupInfo.cpp

@@ -50,6 +50,12 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
     return;
 
   PRInt32 indexInParent = aItem->IndexInParent();
+  PRInt32 siblingCount = parent->GetChildCount();
+  if (siblingCount < indexInParent) {
+    NS_ERROR("Wrong index in parent! Tree invalidation problem.");
+    return;
+  }
+
   PRInt32 level = nsAccUtils::GetARIAOrDefaultLevel(aItem);
 
   // Compute position in set.
@@ -95,7 +101,6 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
   // Compute set size.
   mSetSize = mPosInSet;
 
-  PRInt32 siblingCount = parent->GetChildCount();
   for (PRInt32 idx = indexInParent + 1; idx < siblingCount; idx++) {
     nsAccessible* sibling = parent->GetChildAt(idx);
 

accessible/src/base/NotificationController.cpp

@@ -592,8 +592,8 @@ NotificationController::CoalesceSelChangeEvents(AccSelChangeEvent* aTailEvent,
     if (aThisEvent->mPackedEvent) {
       aThisEvent->mPackedEvent->mEventType =
         aThisEvent->mPackedEvent->mSelChangeType == AccSelChangeEvent::eSelectionAdd ?
-          nsIAccessibleEvent::EVENT_SELECTION_ADD :
+          static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_ADD) :
-          nsIAccessibleEvent::EVENT_SELECTION_REMOVE;
+          static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_REMOVE);
 
       aThisEvent->mPackedEvent->mEventRule =
         AccEvent::eCoalesceSelectionChange;
@@ -603,8 +603,8 @@ NotificationController::CoalesceSelChangeEvents(AccSelChangeEvent* aTailEvent,
 
     aThisEvent->mEventType =
       aThisEvent->mSelChangeType == AccSelChangeEvent::eSelectionAdd ?
-        nsIAccessibleEvent::EVENT_SELECTION_ADD :
+        static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_ADD) :
-        nsIAccessibleEvent::EVENT_SELECTION_REMOVE;
+        static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_REMOVE);
 
     return;
   }

accessible/src/msaa/nsAccessibleWrap.cpp

@@ -289,15 +289,12 @@ __try {
   nsresult rv = xpAccessible->GetName(name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
-    
+
-  if (name.IsVoid()) {
+  // The name was not provided, e.g. no alt attribute for an image. A screen
-    // Valid return value for the name:
+  // reader may choose to invent its own accessible name, e.g. from an image src
-    // The name was not provided, e.g. no alt attribute for an image.
+  // attribute. Refer to NS_OK_EMPTY_NAME return value.
-    // A screen reader may choose to invent its own accessible name, e.g. from
+  if (name.IsVoid())
-    // an image src attribute.
+    return S_FALSE;
-    // See nsHTMLImageAccessible::GetName()
-    return S_OK;
-  }
 
   *pszName = ::SysAllocStringLen(name.get(), name.Length());
   if (!*pszName)

browser/base/content/aboutSyncTabs.js

@@ -137,7 +137,6 @@ let RemoteTabViewer = {
                                      , title: title
                                      , hiddenRows: [ "description"
                                                    , "location"
-                                                   , "folderPicker"
                                                    , "loadInSidebar"
                                                    , "keyword" ]
                                      }, window.top);

browser/base/content/browser-places.js

@@ -386,7 +386,6 @@ var PlacesCommandHook = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
     }

browser/base/content/browser.js

@@ -3173,7 +3173,6 @@ var bookmarksButtonObserver = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
     } catch(ex) { }
@@ -5802,7 +5801,6 @@ function contentAreaClick(event, isPanelClick)
                                        , loadBookmarkInSidebar: true
                                        , hiddenRows: [ "description"
                                                      , "location"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
       event.preventDefault();
@@ -6849,8 +6847,9 @@ function AddKeywordForSearchField() {
                                    , postData: postData
                                    , charSet: charset
                                    , hiddenRows: [ "location"
-                                                 , "loadInSidebar"
+                                                 , "description"
-                                                 , "folderPicker" ]
+                                                 , "tags"
+                                                 , "loadInSidebar" ]
                                    }, window);
 }
 

browser/base/content/nsContextMenu.js

@@ -1406,7 +1406,6 @@ nsContextMenu.prototype = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window.top);
     }

browser/components/places/content/bookmarkProperties.js

@@ -264,8 +264,6 @@ var BookmarkPropertiesPanel = {
       NS_ASSERT("itemId" in dialogInfo);
       this._itemId = dialogInfo.itemId;
       this._title = PlacesUtils.bookmarks.getItemTitle(this._itemId);
-      // Don't show folderPicker when editing
-      this._hiddenRows.push("folderPicker");
       this._readOnly = !!dialogInfo.readOnly;
 
       switch (dialogInfo.type) {

browser/components/places/content/controller.js

@@ -309,7 +309,6 @@ PlacesController.prototype = {
                                        , hiddenRows: [ "description"
                                                      , "keyword"
                                                      , "location"
-                                                     , "folderPicker"
                                                      , "loadInSidebar" ]
                                        , uri: NetUtil.newURI(node.uri)
                                        , title: node.title
@@ -721,6 +720,7 @@ PlacesController.prototype = {
                                      , type: itemType
                                      , itemId: itemId
                                      , readOnly: isRootItem
+                                     , hiddenRows: [ "folderPicker" ]
                                      }, window.top);
   },
 

browser/components/places/src/PlacesUIUtils.jsm

@@ -340,29 +340,36 @@ var PlacesUIUtils = {
    *        See documentation at the top of bookmarkProperties.js
    * @param aWindow
    *        Owner window for the new dialog.
-   * @param aMinimalUI [optional]
+   * @param aResizable [optional]
-   *        Whether to open the dialog in "minimal ui" mode. Do not pass this
+   *        Whether the dialog is allowed to resize.  Do not pass this for new
-   *        for new callers.  It'll be removed in a future release.
+   *        callers since it's deprecated.  It'll be removed in future releases.
    *
    * @see documentation at the top of bookmarkProperties.js
    * @return true if any transaction has been performed, false otherwise.
    */
   showBookmarkDialog:
-  function PUIU_showBookmarkDialog(aInfo, aParentWindow, aMinimalUI) {
+  function PUIU_showBookmarkDialog(aInfo, aParentWindow, aResizable) {
+    // This is a compatibility shim for add-ons.  It will warn in the Error
+    // Console when used.
     if (!aParentWindow) {
       aParentWindow = this._getWindow(null);
     }
 
     // Preserve size attributes differently based on the fact the dialog has
-    // a folder picker or not.
+    // a folder picker or not.  If the picker is visible, the dialog should
-    let minimalUI = "hiddenRows" in aInfo &&
+    // be resizable since it may not show enough content for the folders
-                    aInfo.hiddenRows.indexOf("folderPicker") != -1;
+    // hierarchy.
-    let dialogURL = aMinimalUI ?
+    let hasFolderPicker = !("hiddenRows" in aInfo) ||
+                          aInfo.hiddenRows.indexOf("folderPicker") == -1;
+    let resizable = aResizable !== undefined ? aResizable : hasFolderPicker;
+    // Use a different chrome url, since this allows to persist different sizes,
+    // based on resizability of the dialog.
+    let dialogURL = resizable ?
                     "chrome://browser/content/places/bookmarkProperties2.xul" :
                     "chrome://browser/content/places/bookmarkProperties.xul";
 
     let features =
-      "centerscreen,chrome,modal,resizable=" + (aMinimalUI ? "yes" : "no");
+      "centerscreen,chrome,modal,resizable=" + (resizable ? "yes" : "no");
 
     aParentWindow.openDialog(dialogURL, "",  features, aInfo);
     return ("performed" in aInfo && aInfo.performed);

browser/components/sidebar/src/nsSidebar.js

@@ -110,9 +110,7 @@ function (aTitle, aContentURL, aCustomizeURL, aPersist)
                                          , type: "bookmark"
                                          , hiddenRows: [ "description"
                                                        , "keyword"
-                                                       , "location"
+                                                       , "location" ]
-                                                       , "folderPicker"
-                                                       , "loadInSidebar" ]
                                          , uri: uri
                                          , title: aTitle
                                          , loadBookmarkInSidebar: true

configure.in

@@ -4750,6 +4750,10 @@ if test -z "$MOZ_BUILD_APP"; then
   AC_MSG_RESULT([browser])
   MOZ_BUILD_APP=browser
 else
+  # default mobile to be mobile/xul
+  if test "$MOZ_BUILD_APP" = "mobile" ; then
+    MOZ_BUILD_APP=mobile/xul
+  fi
   # We have a valid application only if it has a build.mk file in its top
   # directory.
   if test ! -f "${srcdir}/${MOZ_BUILD_APP}/build.mk" ; then
@@ -7114,6 +7118,21 @@ elif test -z "$_ENABLE_LOGREFCNT"; then
     AC_DEFINE(NO_BUILD_REFCNT_LOGGING)
 fi
 
+dnl ========================================================
+dnl moz_dump_painting
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(dump-painting,
+[  --enable-dump-painting          Enable paint debugging.],
+    MOZ_DUMP_PAINTING=1,
+    MOZ_DUMP_PAINTING= )
+if test -n "$MOZ_DUMP_PAINTING"; then
+    AC_DEFINE(MOZ_DUMP_PAINTING)
+    AC_DEFINE(MOZ_LAYERS_HAVE_LOG)
+fi
+if test -n "$MOZ_DEBUG"; then
+    AC_DEFINE(MOZ_DUMP_PAINTING)
+fi
+
 dnl ========================================================
 dnl = Enable trace malloc
 dnl ========================================================

content/base/public/nsContentCreatorFunctions.h

@@ -58,7 +58,7 @@ class nsNodeInfoManager;
 class nsGenericHTMLElement;
 
 nsresult
-NS_NewElement(nsIContent** aResult, PRInt32 aElementType,
+NS_NewElement(nsIContent** aResult,
               already_AddRefed<nsINodeInfo> aNodeInfo,
               mozilla::dom::FromParser aFromParser);
 

content/base/public/nsContentErrors.h

@@ -45,10 +45,6 @@
 #define NS_HTML_STYLE_PROPERTY_NOT_THERE \
   NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_CONTENT, 2)
 
-/** Error codes for nsScriptLoader */
-#define NS_CONTENT_SCRIPT_IS_EVENTHANDLER \
-  NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_CONTENT, 3)
-
 /** Error codes for image loading */
 #define NS_ERROR_IMAGE_SRC_CHANGED \
   NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_CONTENT, 4)

content/base/public/nsContentUtils.h

@@ -76,13 +76,15 @@ static fp_except_t oldmask = fpsetmask(~allmask);
 #include "nsTArray.h"
 #include "nsTextFragment.h"
 #include "nsReadableUtils.h"
-#include "mozilla/AutoRestore.h"
 #include "nsINode.h"
 #include "nsHashtable.h"
 #include "nsIDOMNode.h"
 #include "nsHtml5Parser.h"
 #include "nsIFragmentContentSink.h"
 #include "nsMathUtils.h"
+
+#include "mozilla/AutoRestore.h"
+#include "mozilla/GuardObjects.h"
 #include "mozilla/TimeStamp.h"
 
 struct nsNativeKeyEvent; // Don't include nsINativeKeyBindings.h here: it will force strange compilation error!
@@ -1720,10 +1722,10 @@ public:
   static bool IsFullScreenKeyInputRestricted();
 
   /**
-   * Returns true if the doctree rooted at aDoc contains any plugins which
+   * Returns true if the doc tree branch which contains aDoc contains any
-   * we don't control event dispatch for, i.e. do any plugins in this doc tree
+   * plugins which we don't control event dispatch for, i.e. do any plugins
-   * receive key events outside of our control? This always returns false
+   * in the same tab as this document receive key events outside of our
-   * on MacOSX.
+   * control? This always returns false on MacOSX.
    */
   static bool HasPluginWithUncontrolledEventDispatch(nsIDocument* aDoc);
 

content/base/public/nsDOMFile.h

@@ -49,12 +49,13 @@
 #include "nsIMutable.h"
 #include "nsCOMArray.h"
 #include "nsCOMPtr.h"
-#include "mozilla/AutoRestore.h"
 #include "nsString.h"
 #include "nsIXMLHttpRequest.h"
 #include "prmem.h"
 #include "nsAutoPtr.h"
 
+#include "mozilla/GuardObjects.h"
+
 #ifndef PR_UINT64_MAX
 #define PR_UINT64_MAX (~(PRUint64)(0))
 #endif

content/base/public/nsIContent.h

@@ -74,9 +74,9 @@ enum nsLinkState {
 };
 
 // IID for the nsIContent interface
-#define NS_ICONTENT_IID       \
+#define NS_ICONTENT_IID \
-{ 0xdec4b381, 0xa3fc, 0x402b, \
+{ 0xb651e0a7, 0x1471, 0x49cc, \
- { 0x83, 0x96, 0x0a, 0x7b, 0x37, 0x52, 0xcf, 0x70 } }
+  { 0xb4, 0xe1, 0xc2, 0xca, 0x01, 0xfe, 0xb7, 0x80 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -753,22 +753,12 @@ public:
    * have the parser pass true.  See nsHTMLInputElement.cpp and
    * nsHTMLContentSink::MakeContentObject().
    *
-   * It is ok to ignore an error returned from this function. However the
-   * following errors may be of interest to some callers:
-   *
-   *   NS_ERROR_HTMLPARSER_BLOCK  Returned by script elements to indicate
-   *                              that a script will be loaded asynchronously
-   *
-   * This means that implementations will have to deal with returned error
-   * codes being ignored.
-   *
    * @param aHaveNotified Whether there has been a
    *        ContentInserted/ContentAppended notification for this content node
    *        yet.
    */
-  virtual nsresult DoneAddingChildren(bool aHaveNotified)
+  virtual void DoneAddingChildren(bool aHaveNotified)
   {
-    return NS_OK;
   }
 
   /**

content/base/public/nsIScriptElement.h

@@ -49,8 +49,8 @@
 #include "nsIDOMHTMLScriptElement.h"
 
 #define NS_ISCRIPTELEMENT_IID \
-{ 0x6d625b30, 0xfac4, 0x11de, \
+{ 0x5bb3b905, 0x5988, 0x476f, \
-{ 0x8a, 0x39, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66 } }
+  { 0x95, 0x4f, 0x99, 0x02, 0x59, 0x82, 0x24, 0x67 } }
 
 /**
  * Internal interface implemented by script elements
@@ -217,7 +217,44 @@ public:
     return parser.forget();
   }
 
+  /**
+   * This method is called when the parser finishes creating the script
+   * element's children, if any are present.
+   *
+   * @return whether the parser will be blocked while this script is being
+   *         loaded
+   */
+  bool AttemptToExecute()
+  {
+    mDoneAddingChildren = true;
+    bool block = MaybeProcessScript();
+    if (!mAlreadyStarted) {
+      // Need to lose parser-insertedness here to allow another script to cause
+      // execution later.
+      LoseParserInsertedness();
+    }
+    return block;
+  }
+
 protected:
+  /**
+   * Processes the script if it's in the document-tree and links to or
+   * contains a script. Once it has been evaluated there is no way to make it
+   * reevaluate the script, you'll have to create a new element. This also means
+   * that when adding a src attribute to an element that already contains an
+   * inline script, the script referenced by the src attribute will not be
+   * loaded.
+   *
+   * In order to be able to use multiple childNodes, or to use the
+   * fallback mechanism of using both inline script and linked script you have
+   * to add all attributes and childNodes before adding the element to the
+   * document-tree.
+   *
+   * @return whether the parser will be blocked while this script is being
+   *         loaded
+   */
+  virtual bool MaybeProcessScript() = 0;
+
   /**
    * The start line number of the script.
    */

content/base/src/nsContentUtils.cpp

@@ -5876,7 +5876,15 @@ nsContentUtils::HasPluginWithUncontrolledEventDispatch(nsIDocument* aDoc)
   return false;
 #endif
   bool result = false;
-  DocTreeContainsWindowedPlugins(aDoc, &result);
+  
+  // Find the top of the document's branch, the child of the chrome document.
+  nsIDocument* doc = aDoc;
+  nsIDocument* parent = nsnull;
+  while (doc && (parent = doc->GetParentDocument()) && !IsChromeDoc(parent)) {
+    doc = parent;
+  }
+
+  DocTreeContainsWindowedPlugins(doc, &result);
   return result;
 }
 

content/base/src/nsDocument.cpp

@@ -4421,9 +4421,7 @@ nsDocument::CreateElementNS(const nsAString& aNamespaceURI,
                                                      getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  PRInt32 ns = nodeInfo->NamespaceID();
+  return NS_NewElement(aReturn, nodeInfo.forget(), NOT_FROM_PARSER);
-  return NS_NewElement(aReturn, ns,
-                       nodeInfo.forget(), NOT_FROM_PARSER);
 }
 
 NS_IMETHODIMP
@@ -6754,8 +6752,7 @@ nsDocument::CreateElem(const nsAString& aName, nsIAtom *aPrefix, PRInt32 aNamesp
                                 getter_AddRefs(nodeInfo));
   NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
 
-  return NS_NewElement(aResult, aNamespaceID, nodeInfo.forget(),
+  return NS_NewElement(aResult, nodeInfo.forget(), NOT_FROM_PARSER);
-                       NOT_FROM_PARSER);
 }
 
 bool

content/base/src/nsFrameLoader.cpp

@@ -105,16 +105,16 @@
 
 #include "nsIDOMChromeWindow.h"
 #include "nsInProcessTabChildGlobal.h"
-#include "mozilla/AutoRestore.h"
-#include "mozilla/unused.h"
 
 #include "Layers.h"
 
 #include "ContentParent.h"
 #include "TabParent.h"
-#include "mozilla/layout/RenderFrameParent.h"
+#include "mozilla/GuardObjects.h"
-#include "mozilla/dom/Element.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/unused.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/layout/RenderFrameParent.h"
 
 #include "jsapi.h"
 

content/base/src/nsGkAtomList.h

@@ -499,6 +499,7 @@ GK_ATOM(keyup, "keyup")
 GK_ATOM(kind, "kind")
 GK_ATOM(label, "label")
 GK_ATOM(lang, "lang")
+GK_ATOM(language, "language")
 GK_ATOM(last, "last")
 GK_ATOM(layer, "layer")
 GK_ATOM(layout, "layout")
@@ -1986,7 +1987,6 @@ GK_ATOM(InlineBlockFrame, "InlineBlockFrame")
 GK_ATOM(invalid, "invalid")
 GK_ATOM(item, "item")
 GK_ATOM(itemset, "itemset")
-GK_ATOM(language, "language")
 GK_ATOM(lineNumber, "line-number")
 GK_ATOM(linkedPanel, "linkedpanel")
 GK_ATOM(live, "live")

content/base/src/nsNameSpaceManager.cpp

@@ -224,28 +224,29 @@ NameSpaceManagerImpl::GetNameSpaceID(const nsAString& aURI)
 }
 
 nsresult
-NS_NewElement(nsIContent** aResult, PRInt32 aElementType,
+NS_NewElement(nsIContent** aResult,
               already_AddRefed<nsINodeInfo> aNodeInfo, FromParser aFromParser)
 {
-  if (aElementType == kNameSpaceID_XHTML) {
+  PRInt32 ns = aNodeInfo.get()->NamespaceID();
+  if (ns == kNameSpaceID_XHTML) {
     return NS_NewHTMLElement(aResult, aNodeInfo, aFromParser);
   }
 #ifdef MOZ_XUL
-  if (aElementType == kNameSpaceID_XUL) {
+  if (ns == kNameSpaceID_XUL) {
     return NS_NewXULElement(aResult, aNodeInfo);
   }
 #endif
-  if (aElementType == kNameSpaceID_MathML) {
+  if (ns == kNameSpaceID_MathML) {
     return NS_NewMathMLElement(aResult, aNodeInfo);
   }
-  if (aElementType == kNameSpaceID_SVG) {
+  if (ns == kNameSpaceID_SVG) {
     return NS_NewSVGElement(aResult, aNodeInfo, aFromParser);
   }
-  if (aElementType == kNameSpaceID_XMLEvents) {
+  if (ns == kNameSpaceID_XMLEvents) {
     return NS_NewXMLEventsElement(aResult, aNodeInfo);
   }
 #ifdef MOZ_XTF
-  if (aElementType > kNameSpaceID_LastBuiltin) {
+  if (ns > kNameSpaceID_LastBuiltin) {
     nsIXTFService* xtfService = nsContentUtils::GetXTFService();
     NS_ASSERTION(xtfService, "could not get xtf service");
     if (xtfService &&

content/base/src/nsScriptElement.cpp

@@ -147,7 +147,7 @@ nsScriptElement::ContentInserted(nsIDocument *aDocument,
   MaybeProcessScript();
 }
 
-nsresult
+bool
 nsScriptElement::MaybeProcessScript()
 {
   nsCOMPtr<nsIContent> cont =
@@ -158,7 +158,7 @@ nsScriptElement::MaybeProcessScript()
 
   if (mAlreadyStarted || !mDoneAddingChildren || !cont->IsInDoc() ||
       mMalformed || !HasScriptContent()) {
-    return NS_OK;
+    return false;
   }
 
   FreezeUriAsyncDefer();
@@ -173,21 +173,11 @@ nsScriptElement::MaybeProcessScript()
       nsCOMPtr<nsIDocument> parserDoc = do_QueryInterface(sink->GetTarget());
       if (ownerDoc != parserDoc) {
         // Willful violation of HTML5 as of 2010-12-01
-        return NS_OK;
+        return false;
       }
     }
   }
 
   nsRefPtr<nsScriptLoader> loader = ownerDoc->ScriptLoader();
-  nsresult scriptresult = loader->ProcessScriptElement(this);
+  return loader->ProcessScriptElement(this);
-
-  // The only error we don't ignore is NS_ERROR_HTMLPARSER_BLOCK
-  // However we don't want to override other success values
-  // (such as NS_CONTENT_SCRIPT_IS_EVENTHANDLER)
-  if (NS_FAILED(scriptresult) &&
-      scriptresult != NS_ERROR_HTMLPARSER_BLOCK) {
-    scriptresult = NS_OK;
-  }
-
-  return scriptresult;
 }

content/base/src/nsScriptElement.h

@@ -72,18 +72,5 @@ protected:
    */
   virtual bool HasScriptContent() = 0;
 
-  /**
+  virtual bool MaybeProcessScript();
-   * Processes the script if it's in the document-tree and links to or
-   * contains a script. Once it has been evaluated there is no way to make it
-   * reevaluate the script, you'll have to create a new element. This also means
-   * that when adding a src attribute to an element that already contains an
-   * inline script, the script referenced by the src attribute will not be
-   * loaded.
-   *
-   * In order to be able to use multiple childNodes, or to use the
-   * fallback mechanism of using both inline script and linked script you have
-   * to add all attributes and childNodes before adding the element to the
-   * document-tree.
-   */
-  virtual nsresult MaybeProcessScript();
 };

content/base/src/nsScriptLoader.cpp

@@ -43,7 +43,6 @@
 
 #include "jscntxt.h"
 #include "nsScriptLoader.h"
-#include "nsIDOMCharacterData.h"
 #include "nsParserUtils.h"
 #include "nsICharsetConverterManager.h"
 #include "nsIUnicodeDecoder.h"
@@ -57,7 +56,6 @@
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
 #include "nsContentPolicyUtils.h"
-#include "nsIDOMWindow.h"
 #include "nsIHttpChannel.h"
 #include "nsIScriptElement.h"
 #include "nsIDOMHTMLScriptElement.h"
@@ -191,14 +189,15 @@ NS_IMPL_ISUPPORTS1(nsScriptLoader, nsIStreamLoaderObserver)
 // <script for=... event=...> element.
 
 static bool
-IsScriptEventHandler(nsIScriptElement *aScriptElement)
+IsScriptEventHandler(nsIContent* aScriptElement)
 {
-  nsCOMPtr<nsIContent> contElement = do_QueryInterface(aScriptElement);
+  if (!aScriptElement->IsHTML()) {
-  NS_ASSERTION(contElement, "nsIScriptElement isn't nsIContent");
+    return false;
+  }
 
   nsAutoString forAttr, eventAttr;
-  if (!contElement->GetAttr(kNameSpaceID_None, nsGkAtoms::_for, forAttr) ||
+  if (!aScriptElement->GetAttr(kNameSpaceID_None, nsGkAtoms::_for, forAttr) ||
-      !contElement->GetAttr(kNameSpaceID_None, nsGkAtoms::event, eventAttr)) {
+      !aScriptElement->GetAttr(kNameSpaceID_None, nsGkAtoms::event, eventAttr)) {
     return false;
   }
 
@@ -368,22 +367,24 @@ public:
   }
 };
 
-nsresult
+bool
 nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 {
   // We need a document to evaluate scripts.
-  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mDocument, false);
 
   // Check to see if scripts has been turned off.
   if (!mEnabled || !mDocument->IsScriptEnabled()) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
   NS_ASSERTION(!aElement->IsMalformed(), "Executing malformed script");
 
-  // Check that the script is not an eventhandler
+  nsCOMPtr<nsIContent> scriptContent = do_QueryInterface(aElement);
-  if (IsScriptEventHandler(aElement)) {
+
-    return NS_CONTENT_SCRIPT_IS_EVENTHANDLER;
+  // Step 12. Check that the script is not an eventhandler
+  if (IsScriptEventHandler(scriptContent)) {
+    return false;
   }
 
   // Script evaluation can also be disabled in the current script
@@ -396,7 +397,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // XXX is this different from the mDocument->IsScriptEnabled() call?
   nsIScriptGlobalObject *globalObject = mDocument->GetScriptGlobalObject();
   if (!globalObject) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
   
   nsIScriptContext *context = globalObject->GetScriptContext(
@@ -405,7 +406,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // If scripts aren't enabled in the current context, there's no
   // point in going on.
   if (!context || !context->GetScriptsEnabled()) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
   // Default script language is whatever the root element specifies
@@ -426,7 +427,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
     nsAutoString mimeType;
     rv = parser.GetType(mimeType);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, false);
 
     // Javascript keeps the fast path, optimized for most-likely type
     // Table ordered from most to least likely JS MIME types.
@@ -468,13 +469,13 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       if (NS_FAILED(rv)) {
         // no version attribute - version remains 0.
         if (rv != NS_ERROR_INVALID_ARG)
-          return rv;
+          return false;
       } else {
         nsCOMPtr<nsIScriptRuntime> runtime;
         rv = NS_GetScriptRuntimeByID(typeID, getter_AddRefs(runtime));
         if (NS_FAILED(rv)) {
           NS_ERROR("Failed to locate the language with this ID");
-          return rv;
+          return false;
         }
         rv = runtime->ParseVersion(versionName, &version);
         if (NS_FAILED(rv)) {
@@ -490,7 +491,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       rv = parser.GetParameter("e4x", value);
       if (NS_FAILED(rv)) {
         if (rv != NS_ERROR_INVALID_ARG)
-          return rv;
+          return false;
       } else {
         if (value.Length() == 1 && value[0] == '1')
           // This means that we need to set JSOPTION_XML in the JS options.
@@ -504,10 +505,8 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     // no 'type=' element
     // "language" is a deprecated attribute of HTML, so we check it only for
     // HTML script elements.
-    nsCOMPtr<nsIDOMHTMLScriptElement> htmlScriptElement =
+    if (scriptContent->IsHTML()) {
-      do_QueryInterface(aElement);
+      scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::language, language);
-    if (htmlScriptElement) {
-      htmlScriptElement->GetAttribute(NS_LITERAL_STRING("language"), language);
       if (!language.IsEmpty()) {
         if (nsParserUtils::IsJavaScriptLanguage(language, &version))
           typeID = nsIProgrammingLanguage::JAVASCRIPT;
@@ -528,7 +527,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
   // If we don't know the language, we don't know how to evaluate
   if (typeID == nsIProgrammingLanguage::UNKNOWN) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
   // If not from a chrome document (which is always trusted), we need some way 
   // of checking the language is "safe".  Currently the only other language 
@@ -538,20 +537,19 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   if (typeID != nsIProgrammingLanguage::JAVASCRIPT &&
       !nsContentUtils::IsChromeDoc(mDocument)) {
     NS_WARNING("Untrusted language called from non-chrome - ignored");
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
-  nsCOMPtr<nsIContent> eltContent(do_QueryInterface(aElement));
+  scriptContent->SetScriptTypeID(typeID);
-  eltContent->SetScriptTypeID(typeID);
 
-  // Step 9. in the HTML5 spec
+  // Step 14. in the HTML5 spec
 
   nsRefPtr<nsScriptLoadRequest> request;
   if (aElement->GetScriptExternal()) {
     // external script
     nsCOMPtr<nsIURI> scriptURI = aElement->GetScriptURI();
     if (!scriptURI) {
-      return NS_ERROR_NOT_AVAILABLE;
+      return false;
     }
     nsTArray<PreloadInfo>::index_type i =
       mPreloads.IndexOf(scriptURI.get(), 0, PreloadURIComparator());
@@ -569,7 +567,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       aElement->GetScriptCharset(elementCharset);
       if (elementCharset.Equals(preloadCharset)) {
         rv = CheckContentPolicy(mDocument, aElement, request->mURI, type);
-        NS_ENSURE_SUCCESS(rv, rv);
+        NS_ENSURE_SUCCESS(rv, false);
       } else {
         // Drop the preload
         request = nsnull;
@@ -579,12 +577,11 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     if (!request) {
       // no usable preload
       request = new nsScriptLoadRequest(aElement, version);
-      NS_ENSURE_TRUE(request, NS_ERROR_OUT_OF_MEMORY);
       request->mURI = scriptURI;
       request->mIsInline = false;
       request->mLoading = true;
       rv = StartLoad(request, type);
-      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_SUCCESS(rv, false);
     }
 
     request->mJSVersion = version;
@@ -596,7 +593,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_OK;
+      return false;
     }
     if (!aElement->GetParserCreated()) {
       // Violate the HTML5 spec in order to make LABjs and the "order" plug-in
@@ -608,7 +605,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_OK;
+      return false;
     }
     // we now have a parser-inserted request that may or may not be still
     // loading
@@ -623,7 +620,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                    aElement->GetParserCreated() == FROM_PARSER_XSLT,
           "Non-XSLT Defer script on a document without an active parser; bug 592366.");
       mDeferRequests.AppendElement(request);
-      return NS_OK;
+      return false;
     }
 
     if (aElement->GetParserCreated() == FROM_PARSER_XSLT) {
@@ -636,14 +633,14 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_ERROR_HTMLPARSER_BLOCK;
+      return true;
     }
     if (!request->mLoading && ReadyToExecuteScripts()) {
       // The request has already been loaded and there are no pending style
       // sheets. If the script comes from the network stream, cheat for
       // performance reasons and avoid a trip through the event loop.
       if (aElement->GetParserCreated() == FROM_PARSER_NETWORK) {
-        return ProcessRequest(request);
+        return ProcessRequest(request) == NS_ERROR_HTMLPARSER_BLOCK;
       }
       // Otherwise, we've got a document.written script, make a trip through
       // the event loop to hide the preload effects from the scripts on the
@@ -654,7 +651,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
           "Parser-blocking scripts and XSLT scripts in the same doc!");
       mParserBlockingRequest = request;
       ProcessPendingRequestsAsync();
-      return NS_ERROR_HTMLPARSER_BLOCK;
+      return true;
     }
     // The script hasn't loaded yet or there's a style sheet blocking it.
     // The script will be run when it loads or the style sheet loads.
@@ -663,19 +660,19 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     NS_ASSERTION(mXSLTRequests.IsEmpty(),
         "Parser-blocking scripts and XSLT scripts in the same doc!");
     mParserBlockingRequest = request;
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
 
   // inline script
   nsCOMPtr<nsIContentSecurityPolicy> csp;
   rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, false);
 
   if (csp) {
     PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader i ****with CSP****"));
     bool inlineOK;
     rv = csp->GetAllowsInlineScript(&inlineOK);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, false);
 
     if (!inlineOK) {
       PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("CSP blocked inline scripts (2)"));
@@ -696,12 +693,11 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                                NS_ConvertUTF8toUTF16(asciiSpec),
                                scriptText,
                                aElement->GetScriptLineNumber());
-      return NS_ERROR_FAILURE;
+      return false;
     }
   }
 
   request = new nsScriptLoadRequest(aElement, version);
-  NS_ENSURE_TRUE(request, NS_ERROR_OUT_OF_MEMORY);
   request->mJSVersion = version;
   request->mLoading = false;
   request->mIsInline = true;
@@ -714,14 +710,14 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     NS_ASSERTION(!mParserBlockingRequest,
         "Parser-blocking scripts and XSLT scripts in the same doc!");
     mXSLTRequests.AppendElement(request);
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
   if (aElement->GetParserCreated() == NOT_FROM_PARSER) {
     NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
         "A script-inserted script is inserted without an update batch?");
     nsContentUtils::AddScriptRunner(new nsScriptRequestProcessor(this,
                                                                  request));
-    return NS_OK;
+    return false;
   }
   if (aElement->GetParserCreated() == FROM_PARSER_NETWORK &&
       !ReadyToExecuteScripts()) {
@@ -730,7 +726,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     mParserBlockingRequest = request;
     NS_ASSERTION(mXSLTRequests.IsEmpty(),
         "Parser-blocking scripts and XSLT scripts in the same doc!");
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
   // We now have a document.written inline script or we have an inline script
   // from the network but there is no style sheet that is blocking scripts.
@@ -742,7 +738,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // is on the call stack.
   NS_ASSERTION(nsContentUtils::IsSafeToRunScript(),
       "Not safe to run a parser-inserted script?");
-  return ProcessRequest(request);
+  return ProcessRequest(request) == NS_ERROR_HTMLPARSER_BLOCK;
 }
 
 nsresult

content/base/src/nsScriptLoader.h

@@ -108,14 +108,14 @@ public:
    * (i.e. there are no other scripts pending) then ScriptAvailable
    * and ScriptEvaluated will be called before the function returns.
    *
-   * If NS_ERROR_HTMLPARSER_BLOCK is returned the script could not be
+   * If true is returned the script could not be executed immediately.
-   * executed immediately. In this case ScriptAvailable is guaranteed
+   * In this case ScriptAvailable is guaranteed to be called at a later
-   * to be called at a later point (as well as possibly ScriptEvaluated).
+   * point (as well as possibly ScriptEvaluated).
    *
    * @param aElement The element representing the script to be loaded and
    *        evaluated.
    */
-  nsresult ProcessScriptElement(nsIScriptElement* aElement);
+  bool ProcessScriptElement(nsIScriptElement* aElement);
 
   /**
    * Gets the currently executing script. This is useful if you want to
@@ -134,9 +134,8 @@ public:
   /**
    * Whether the loader is enabled or not.
    * When disabled, processing of new script elements is disabled. 
-   * Any call to ProcessScriptElement() will fail with a return code of
+   * Any call to ProcessScriptElement() will return false. Note that
-   * NS_ERROR_NOT_AVAILABLE. Note that this DOES NOT disable
+   * this DOES NOT disable currently loading or executing scripts.
-   * currently loading or executing scripts.
    */
   bool GetEnabled()
   {

content/base/src/nsXMLHttpRequest.cpp

@@ -71,6 +71,7 @@
 #include "nsIVariant.h"
 #include "xpcprivate.h"
 #include "nsIParser.h"
+#include "XPCQuickStubs.h"
 #include "nsStringStream.h"
 #include "nsIStreamConverterService.h"
 #include "nsICachingChannel.h"
@@ -1030,15 +1031,8 @@ NS_IMETHODIMP nsXMLHttpRequest::GetResponse(JSContext *aCx, jsval *aResult)
       nsString str;
       rv = GetResponseText(str);
       if (NS_FAILED(rv)) return rv;
-      if (str.IsVoid()) {
+      NS_ENSURE_TRUE(xpc_qsStringToJsval(aCx, str, aResult),
-        *aResult = JSVAL_NULL;
+                     NS_ERROR_OUT_OF_MEMORY);
-      } else {
-        nsStringBuffer* buf;
-        *aResult = XPCStringConvert::ReadableToJSVal(aCx, str, &buf);
-        if (buf) {
-          str.ForgetSharedBuffer();
-        }
-      }
     }
     break;
 

content/html/content/src/nsGenericHTMLElement.cpp

@@ -474,13 +474,6 @@ nsGenericHTMLElement::GetAccessKeyLabel(nsAString& aLabel)
   return NS_OK;
 }
 
-static bool
-IsBody(nsIContent *aContent)
-{
-  return aContent->NodeInfo()->Equals(nsGkAtoms::body) &&
-         aContent->IsHTML();
-}
-
 static bool IS_TABLE_CELL(nsIAtom* frameType) {
   return nsGkAtoms::tableCellFrame == frameType ||
     nsGkAtoms::bcTableCellFrame == frameType;
@@ -516,7 +509,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect, nsIContent** aOffsetParent)
   Element* docElement = GetCurrentDoc()->GetRootElement();
   nsIContent* content = frame->GetContent();
 
-  if (content && (IsBody(content) || content == docElement)) {
+  if (content && (content->IsHTML(nsGkAtoms::body) || content == docElement)) {
     parent = frame;
   }
   else {
@@ -550,7 +543,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect, nsIContent** aOffsetParent)
 
         // Break if the ancestor frame type makes it suitable as offset parent
         // and this element is *not* positioned or if we found the body element.
-        if (isOffsetParent || IsBody(content)) {
+        if (isOffsetParent || content->IsHTML(nsGkAtoms::body)) {
           *aOffsetParent = content;
           NS_ADDREF(*aOffsetParent);
           break;
@@ -1090,8 +1083,8 @@ NS_IMETHODIMP
 nsGenericHTMLElement::SetDraggable(bool aDraggable)
 {
   return SetAttrHelper(nsGkAtoms::draggable,
-                       aDraggable ? NS_LITERAL_STRING("true") :
+                       aDraggable ? NS_LITERAL_STRING("true")
-                                    NS_LITERAL_STRING("false"));
+                                  : NS_LITERAL_STRING("false"));
 }
 
 bool
@@ -1172,8 +1165,7 @@ nsGenericHTMLElement::FindAncestorForm(nsHTMLFormElement* aCurrentForm)
   nsIContent* content = this;
   while (content != bindingParent && content) {
     // If the current ancestor is a form, return it as our form
-    if (content->Tag() == nsGkAtoms::form &&
+    if (content->IsHTML(nsGkAtoms::form)) {
-        content->IsHTML()) {
 #ifdef DEBUG
       if (!nsContentUtils::IsInSameAnonymousTree(this, content)) {
         // It's possible that we started unbinding at |content| or
@@ -1565,10 +1557,6 @@ nsGenericHTMLElement::GetPrimaryPresState(nsGenericHTMLElement* aContent,
     result = history->GetState(key, aPresState);
     if (!*aPresState) {
       *aPresState = new nsPresState();
-      if (!*aPresState) {
-        return NS_ERROR_OUT_OF_MEMORY;
-      }
-        
       result = history->AddState(key, *aPresState);
     }
   }
@@ -1659,7 +1647,7 @@ nsGenericHTMLElement::GetPresContext()
   // Get the document
   nsIDocument* doc = GetDocument();
   if (doc) {
-    // Get presentation shell 0
+    // Get presentation shell.
     nsIPresShell *presShell = doc->GetShell();
     if (presShell) {
       return presShell->GetPresContext();
@@ -1794,9 +1782,9 @@ nsGenericHTMLElement::ParseImageAttribute(nsIAtom* aAttribute,
       (aAttribute == nsGkAtoms::height)) {
     return aResult.ParseSpecialIntValue(aString);
   }
-  else if ((aAttribute == nsGkAtoms::hspace) ||
+  if ((aAttribute == nsGkAtoms::hspace) ||
-           (aAttribute == nsGkAtoms::vspace) ||
+      (aAttribute == nsGkAtoms::vspace) ||
-           (aAttribute == nsGkAtoms::border)) {
+      (aAttribute == nsGkAtoms::border)) {
     return aResult.ParseIntWithBounds(aString, 0);
   }
   return false;
@@ -3137,8 +3125,7 @@ nsGenericHTMLFormElement::UpdateFormOwner(bool aBindToTree,
                      "element should be equals to the current element "
                      "associated with the id in @form!");
 
-        if (element && element->Tag() == nsGkAtoms::form &&
+        if (element && element->IsHTML(nsGkAtoms::form)) {
-            element->IsHTML()) {
           mForm = static_cast<nsHTMLFormElement*>(element);
         }
       }
@@ -3316,9 +3303,8 @@ nsGenericHTMLFrameElement::GetFrameLoader(nsIFrameLoader **aFrameLoader)
 NS_IMETHODIMP_(already_AddRefed<nsFrameLoader>)
 nsGenericHTMLFrameElement::GetFrameLoader()
 {
-  nsFrameLoader* loader = mFrameLoader;
+  nsRefPtr<nsFrameLoader> loader = mFrameLoader;
-  NS_IF_ADDREF(loader);
+  return loader.forget();
-  return loader;
 }
 
 NS_IMETHODIMP
@@ -3398,8 +3384,7 @@ nsGenericHTMLFrameElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                               aValue, aNotify);
   NS_ENSURE_SUCCESS(rv, rv);
   
-  if (aNameSpaceID == kNameSpaceID_None &&
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
-      aName == nsGkAtoms::src) {
     // Don't propagate error here. The attribute was successfully set, that's
     // what we should reflect.
     LoadSrc();
@@ -3453,18 +3438,18 @@ nsGenericHTMLFrameElement::SizeOf() const
 nsresult
 nsGenericHTMLElement::Blur()
 {
-  if (!ShouldBlur(this))
+  if (!ShouldBlur(this)) {
     return NS_OK;
+  }
 
   nsIDocument* doc = GetCurrentDoc();
-  if (!doc)
+  if (!doc) {
     return NS_OK;
+  }
 
   nsIDOMWindow* win = doc->GetWindow();
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
   return (win && fm) ? fm->ClearFocus(win) : NS_OK;
-
-  return NS_OK;
 }
 
 nsresult
@@ -3505,8 +3490,8 @@ nsresult nsGenericHTMLElement::Click()
   // Strong in case the event kills it
   nsCOMPtr<nsIDocument> doc = GetCurrentDoc();
 
-  nsCOMPtr<nsIPresShell> shell = nsnull;
+  nsCOMPtr<nsIPresShell> shell;
-  nsRefPtr<nsPresContext> context = nsnull;
+  nsRefPtr<nsPresContext> context;
   if (doc) {
     shell = doc->GetShell();
     if (shell) {
@@ -3653,8 +3638,9 @@ nsGenericHTMLElement::GetEditor(nsIEditor** aEditor)
 {
   *aEditor = nsnull;
 
-  if (!nsContentUtils::IsCallerTrustedForWrite())
+  if (!nsContentUtils::IsCallerTrustedForWrite()) {
     return NS_ERROR_DOM_SECURITY_ERR;
+  }
 
   return GetEditorInternal(aEditor);
 }
@@ -3686,6 +3672,8 @@ nsGenericHTMLElement::GetAssociatedEditor()
 bool
 nsGenericHTMLElement::IsCurrentBodyElement()
 {
+  // TODO Bug 698498: Should this handle the case where GetBody returns a
+  //                  frameset?
   nsCOMPtr<nsIDOMHTMLBodyElement> bodyElement = do_QueryInterface(this);
   if (!bodyElement) {
     return false;

content/html/content/src/nsHTMLButtonElement.cpp

@@ -551,8 +551,6 @@ nsHTMLButtonElement::Reset()
 NS_IMETHODIMP
 nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   //
   // We only submit if we were the button pressed
   //
@@ -578,7 +576,7 @@ nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   // Get the value
   //
   nsAutoString value;
-  rv = GetValue(value);
+  nsresult rv = GetValue(value);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -586,9 +584,7 @@ nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   //
   // Submit
   //
-  rv = aFormSubmission->AddNameValuePair(name, value);
+  return aFormSubmission->AddNameValuePair(name, value);
-
-  return rv;
 }
 
 void
@@ -670,4 +666,3 @@ nsHTMLButtonElement::IntrinsicState() const
 
   return state;
 }
-

content/html/content/src/nsHTMLCanvasElement.cpp

@@ -277,7 +277,7 @@ nsHTMLCanvasElement::ExtractData(const nsAString& aType,
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return CallQueryInterface(imgStream, aStream);
+  imgStream.forget(aStream);
   return NS_OK;
 }
 
@@ -406,7 +406,8 @@ nsHTMLCanvasElement::MozGetAsFileImpl(const nsAString& aName,
   nsRefPtr<nsDOMMemoryFile> file =
     new nsDOMMemoryFile(imgData, imgSize, aName, type);
 
-  return CallQueryInterface(file, aResult);
+  file.forget(aResult);
+  return NS_OK;
 }
 
 nsresult
@@ -457,7 +458,7 @@ nsHTMLCanvasElement::GetContextHelper(const nsAString& aContextId,
     return rv;
   }
 
-  *aContext = ctx.forget().get();
+  ctx.forget(aContext);
 
   return rv;
 }
@@ -572,10 +573,8 @@ nsHTMLCanvasElement::MozGetIPCContext(const nsAString& aContextId,
   if (!aContextId.Equals(NS_LITERAL_STRING("2d")))
     return NS_ERROR_INVALID_ARG;
 
-  nsresult rv;
-
   if (mCurrentContextId.IsEmpty()) {
-    rv = GetContextHelper(aContextId, false, getter_AddRefs(mCurrentContext));
+    nsresult rv = GetContextHelper(aContextId, false, getter_AddRefs(mCurrentContext));
     NS_ENSURE_SUCCESS(rv, rv);
     if (!mCurrentContext) {
       return NS_OK;
@@ -602,27 +601,26 @@ nsHTMLCanvasElement::UpdateContext(nsIPropertyBag *aNewContextOptions)
   if (!mCurrentContext)
     return NS_OK;
 
-  nsresult rv = NS_OK;
   nsIntSize sz = GetWidthHeight();
 
-  rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
+  nsresult rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
   rv = mCurrentContext->SetContextOptions(aNewContextOptions);
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
   rv = mCurrentContext->SetDimensions(sz.width, sz.height);
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
@@ -715,10 +713,10 @@ nsHTMLCanvasElement::CountContexts()
 }
 
 nsICanvasRenderingContextInternal *
-nsHTMLCanvasElement::GetContextAtIndex (PRInt32 index)
+nsHTMLCanvasElement::GetContextAtIndex(PRInt32 index)
 {
   if (mCurrentContext && index == 0)
-    return mCurrentContext.get();
+    return mCurrentContext;
 
   return NULL;
 }

content/html/content/src/nsHTMLFieldSetElement.cpp

@@ -63,7 +63,7 @@ nsHTMLFieldSetElement::nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNode
 nsHTMLFieldSetElement::~nsHTMLFieldSetElement()
 {
   PRUint32 length = mDependentElements.Length();
-  for (PRUint32 i=0; i<length; ++i) {
+  for (PRUint32 i = 0; i < length; ++i) {
     mDependentElements[i]->ForgetFieldSet(this);
   }
 }
@@ -264,7 +264,7 @@ nsHTMLFieldSetElement::NotifyElementsForFirstLegendChange(bool aNotify)
   }
 
   PRUint32 length = mElements->Length(true);
-  for (PRUint32 i=0; i<length; ++i) {
+  for (PRUint32 i = 0; i < length; ++i) {
     static_cast<nsGenericHTMLFormElement*>(mElements->GetNodeAt(i))
       ->FieldSetFirstLegendChanged(aNotify);
   }

content/html/content/src/nsHTMLFontElement.cpp

@@ -47,6 +47,7 @@
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"
 #include "nsIDocument.h"
+#include "nsAlgorithm.h"
 
 using namespace mozilla;
 
@@ -217,7 +218,7 @@ MapAttributesIntoRule(const nsMappedAttributes* aAttributes,
             else
               size = value->GetIntegerValue();
 
-            size = ((0 < size) ? ((size < 8) ? size : 7) : 1); 
+            size = clamped(size, 1, 7);
             fontSize->SetIntValue(size, eCSSUnit_Enumerated);
           }
         }

content/html/content/src/nsHTMLFormElement.cpp

@@ -1998,8 +1998,6 @@ nsHTMLFormElement::WalkRadioGroup(const nsAString& aName,
                                   nsIRadioVisitor* aVisitor,
                                   bool aFlushContent)
 {
-  nsresult rv = NS_OK;
-
   if (aName.IsEmpty()) {
     //
     // XXX If the name is empty, it's not stored in the control list.  There
@@ -2007,60 +2005,52 @@ nsHTMLFormElement::WalkRadioGroup(const nsAString& aName,
     //
     nsCOMPtr<nsIFormControl> control;
     PRUint32 len = GetElementCount();
-    for (PRUint32 i=0; i<len; i++) {
+    for (PRUint32 i = 0; i < len; i++) {
       control = GetElementAt(i);
       if (control->GetType() == NS_FORM_INPUT_RADIO) {
-        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
+        nsCOMPtr<nsIContent> controlContent = do_QueryInterface(control);
-        if (controlContent) {
+        if (controlContent &&
-          if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
+            controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
-                                          EmptyString(), eCaseMatters)) {
+                                        EmptyString(), eCaseMatters) &&
-            if (!aVisitor->Visit(control)) {
+            !aVisitor->Visit(control)) {
-              break;
+          break;
-            }
-          }
-        }
-      }
-    }
-  } else {
-    //
-    // Get the control / list of controls from the form using form["name"]
-    //
-    nsCOMPtr<nsISupports> item;
-    item = DoResolveName(aName, aFlushContent);
-    rv = item ? NS_OK : NS_ERROR_FAILURE;
-
-    if (item) {
-      //
-      // If it's just a lone radio button, then select it.
-      //
-      nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(item));
-      if (formControl) {
-        if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
-          aVisitor->Visit(formControl);
-        }
-      } else {
-        nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(item));
-        if (nodeList) {
-          PRUint32 length = 0;
-          nodeList->GetLength(&length);
-          for (PRUint32 i=0; i<length; i++) {
-            nsCOMPtr<nsIDOMNode> node;
-            nodeList->Item(i, getter_AddRefs(node));
-            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
-            if (formControl) {
-              if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
-                if (!aVisitor->Visit(formControl)) {
-                  break;
-                }
-              }
-            }
-          }
         }
       }
     }
+    return NS_OK;
   }
 
-  return rv;
+  // Get the control / list of controls from the form using form["name"]
+  nsCOMPtr<nsISupports> item = DoResolveName(aName, aFlushContent);
+  if (!item) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // If it's just a lone radio button, then select it.
+  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(item);
+  if (formControl) {
+    if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
+      aVisitor->Visit(formControl);
+    }
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(item);
+  if (!nodeList) {
+    return NS_OK;
+  }
+  PRUint32 length = 0;
+  nodeList->GetLength(&length);
+  for (PRUint32 i = 0; i < length; i++) {
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->Item(i, getter_AddRefs(node));
+    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(node);
+    if (formControl && formControl->GetType() == NS_FORM_INPUT_RADIO &&
+        !aVisitor->Visit(formControl)) {
+      break;
+    }
+  }
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -2181,13 +2171,12 @@ void
 nsFormControlList::Clear()
 {
   // Null out childrens' pointer to me.  No refcounting here
-  PRInt32 i;
+  for (PRInt32 i = mElements.Length() - 1; i >= 0; i--) {
-  for (i = mElements.Length()-1; i >= 0; i--) {
     mElements[i]->ClearForm(false);
   }
   mElements.Clear();
 
-  for (i = mNotInElements.Length()-1; i >= 0; i--) {
+  for (PRInt32 i = mNotInElements.Length() - 1; i >= 0; i--) {
     mNotInElements[i]->ClearForm(false);
   }
   mNotInElements.Clear();
@@ -2277,31 +2266,33 @@ nsFormControlList::NamedItem(const nsAString& aName,
 
   *aReturn = nsnull;
 
-  nsresult rv = NS_OK;
-
   nsCOMPtr<nsISupports> supports;
   
-  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
+  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) {
-     return rv;
+    // key not found
-
+    return NS_OK;
-  if (supports) {
-    // We found something, check if it's a node
-    CallQueryInterface(supports, aReturn);
-
-    if (!*aReturn) {
-      // If not, we check if it's a node list.
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
-      NS_ASSERTION(nodeList, "Huh, what's going one here?");
-
-      if (nodeList) {
-        // And since we're only asking for one node here, we return the first
-        // one from the list.
-        rv = nodeList->Item(0, aReturn);
-      }
-    }
   }
 
-  return rv;
+  if (!supports) {
+    return NS_OK;
+  }
+
+  // We found something, check if it's a node
+  CallQueryInterface(supports, aReturn);
+  if (*aReturn) {
+    return NS_OK;
+  }
+
+  // If not, we check if it's a node list.
+  nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
+  NS_ASSERTION(nodeList, "Huh, what's going one here?");
+  if (!nodeList) {
+    return NS_OK;
+  }
+
+  // And since we're only asking for one node here, we return the first
+  // one from the list.
+  return nodeList->Item(0, aReturn);
 }
 
 nsISupports*
@@ -2328,12 +2319,12 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
 
   if (!supports) {
     // No entry found, add the form control
-    NS_ENSURE_TRUE( mNameLookupTable.Put(aName,
+    NS_ENSURE_TRUE(mNameLookupTable.Put(aName,
-                                         NS_ISUPPORTS_CAST(nsIContent*, aChild)),
+                                        NS_ISUPPORTS_CAST(nsIContent*, aChild)),
-                    NS_ERROR_FAILURE );
+                   NS_ERROR_FAILURE);
   } else {
     // Found something in the hash, check its type
-    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
+    nsCOMPtr<nsIContent> content = do_QueryInterface(supports);
 
     if (content) {
       // Check if the new content is the same as the one we found in the
@@ -2347,7 +2338,6 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
       // Found an element, create a list, add the element to the list and put
       // the list in the hash
       nsSimpleContentList *list = new nsSimpleContentList(mForm);
-      NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
 
       NS_ASSERTION(content->GetParent(), "Item in list without parent");
 
@@ -2365,12 +2355,12 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
                      NS_ERROR_FAILURE);
     } else {
       // There's already a list in the hash, add the child to the list
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+      nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
       NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
       // Upcast, uggly, but it works!
-      nsSimpleContentList *list = static_cast<nsSimpleContentList *>
+      nsSimpleContentList *list =
-                                           ((nsIDOMNodeList *)nodeList.get());
+        static_cast<nsSimpleContentList*>(nodeList.get());
 
       NS_ASSERTION(list->Length() > 1,
                    "List should have been converted back to a single element");
@@ -2379,7 +2369,7 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
       // already in the list, since if it tests true the child would
       // have come at the end of the list, and the PositionIsBefore
       // will test false.
-      if(nsContentUtils::PositionIsBefore(list->GetNodeAt(list->Length() - 1), aChild)) {
+      if (nsContentUtils::PositionIsBefore(list->GetNodeAt(list->Length() - 1), aChild)) {
         list->AppendElement(aChild);
         return NS_OK;
       }
@@ -2455,8 +2445,7 @@ nsFormControlList::RemoveElementFromTable(nsGenericHTMLFormElement* aChild,
   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
   // Upcast, uggly, but it works!
-  nsBaseContentList *list = static_cast<nsBaseContentList *>
+  nsBaseContentList *list = static_cast<nsBaseContentList*>(nodeList.get());
-                                       ((nsIDOMNodeList *)nodeList.get());
 
   list->RemoveElement(aChild);
 

content/html/content/src/nsHTMLFormElement.h

@@ -74,7 +74,7 @@ public:
   KeyType GetKey() const { return mStr; }
   bool KeyEquals(const KeyTypePointer aKey) const
   {
-    return mStr.Equals(*aKey,nsCaseInsensitiveStringComparator());
+    return mStr.Equals(*aKey, nsCaseInsensitiveStringComparator());
   }
 
   static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }

content/html/content/src/nsHTMLImageElement.cpp

@@ -678,7 +678,7 @@ nsHTMLImageElement::GetCORSMode()
   if (value) {
     NS_ASSERTION(value->Type() == nsAttrValue::eEnum,
                  "Why is this not an enum value?");
-    ret = (nsImageLoadingContent::CORSMode) value->GetEnumValue();
+    ret = nsImageLoadingContent::CORSMode(value->GetEnumValue());
   }
 
   return ret;

content/html/content/src/nsHTMLInputElement.cpp

@@ -119,6 +119,7 @@
 #include "nsRadioVisitor.h"
 
 #include "mozilla/LookAndFeel.h"
+#include "mozilla/Util.h" // DebugOnly
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -257,8 +258,6 @@ protected:
 NS_IMETHODIMP
 AsyncClickHandler::Run()
 {
-  nsresult rv;
-
   // Get parent nsPIDOMWindow object.
   nsCOMPtr<nsIDocument> doc = mInput->OwnerDoc();
 
@@ -296,9 +295,10 @@ AsyncClickHandler::Run()
 
   bool multi = mInput->HasAttr(kNameSpaceID_None, nsGkAtoms::multiple);
 
-  rv = filePicker->Init(win, title, multi ?
+  nsresult rv = filePicker->Init(win, title,
-                        (PRInt16)nsIFilePicker::modeOpenMultiple :
+                                 multi
-                        (PRInt16)nsIFilePicker::modeOpen);
+                                  ? static_cast<PRInt16>(nsIFilePicker::modeOpenMultiple)
+                                  : static_cast<PRInt16>(nsIFilePicker::modeOpen));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (mInput->HasAttr(kNameSpaceID_None, nsGkAtoms::accept)) {
@@ -485,9 +485,7 @@ UploadLastDir::FetchLastUsedDirectory(nsIURI* aURI, nsILocalFile** aFile)
     if (!localFile)
       return NS_ERROR_OUT_OF_MEMORY;
     localFile->InitWithPath(prefStr);
-
+    localFile.forget(aFile);
-    *aFile = localFile;
-    NS_ADDREF(*aFile);
   }
   return NS_OK;
 }
@@ -553,15 +551,22 @@ NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(Input)
 
 nsHTMLInputElement::nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                                        FromParser aFromParser)
-  : nsGenericHTMLFormElement(aNodeInfo),
+  : nsGenericHTMLFormElement(aNodeInfo)
-    mType(kInputDefaultType->value),
+  , mType(kInputDefaultType->value)
-    mBitField(0)
+  , mDisabledChanged(false)
+  , mValueChanged(false)
+  , mCheckedChanged(false)
+  , mChecked(false)
+  , mHandlingSelectEvent(false)
+  , mShouldInitChecked(false)
+  , mParserCreating(aFromParser != NOT_FROM_PARSER)
+  , mInInternalActivate(false)
+  , mCheckedIsToggled(false)
+  , mIndeterminate(false)
+  , mInhibitRestoration(aFromParser & FROM_PARSER_FRAGMENT)
+  , mCanShowValidUI(true)
+  , mCanShowInvalidUI(true)
 {
-  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, aFromParser);
-  SET_BOOLBIT(mBitField, BF_INHIBIT_RESTORATION,
-      aFromParser & mozilla::dom::FROM_PARSER_FRAGMENT);
-  SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI, true);
-  SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, true);
   mInputData.mState = new nsTextEditorState(this);
   NS_ADDREF(mInputData.mState);
   
@@ -663,9 +668,9 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
   *aResult = nsnull;
 
   nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
-  nsHTMLInputElement *it = new nsHTMLInputElement(ni.forget(), NOT_FROM_PARSER);
+  nsRefPtr<nsHTMLInputElement> it =
+    new nsHTMLInputElement(ni.forget(), NOT_FROM_PARSER);
 
-  nsCOMPtr<nsINode> kungFuDeathGrip = it;
   nsresult rv = CopyInnerTo(it);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -676,7 +681,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
     case NS_FORM_INPUT_PASSWORD:
     case NS_FORM_INPUT_TEL:
     case NS_FORM_INPUT_URL:
-      if (GetValueChanged()) {
+      if (mValueChanged) {
         // We don't have our default value anymore.  Set our value on
         // the clone.
         nsAutoString value;
@@ -697,10 +702,10 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
-      if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
+      if (mCheckedChanged) {
         // We no longer have our original checked state.  Set our
         // checked state on the clone.
-        it->DoSetChecked(GetChecked(), false, true);
+        it->DoSetChecked(mChecked, false, true);
       }
       break;
     case NS_FORM_INPUT_IMAGE:
@@ -712,8 +717,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       break;
   }
 
-  kungFuDeathGrip.swap(*aResult);
+  it.forget(aResult);
-
   return NS_OK;
 }
 
@@ -731,7 +735,7 @@ nsHTMLInputElement::BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     if ((aName == nsGkAtoms::name ||
          (aName == nsGkAtoms::type && !mForm)) &&
         mType == NS_FORM_INPUT_RADIO &&
-        (mForm || !(GET_BOOLBIT(mBitField, BF_PARSER_CREATING)))) {
+        (mForm || !mParserCreating)) {
       WillRemoveFromRadioGroup();
     } else if (aNotify && aName == nsGkAtoms::src &&
                mType == NS_FORM_INPUT_IMAGE) {
@@ -742,7 +746,7 @@ nsHTMLInputElement::BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
         CancelImageRequests(aNotify);
       }
     } else if (aNotify && aName == nsGkAtoms::disabled) {
-      SET_BOOLBIT(mBitField, BF_DISABLED_CHANGED, true);
+      mDisabledChanged = true;
     }
   }
 
@@ -764,7 +768,7 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     if ((aName == nsGkAtoms::name ||
          (aName == nsGkAtoms::type && !mForm)) &&
         mType == NS_FORM_INPUT_RADIO &&
-        (mForm || !(GET_BOOLBIT(mBitField, BF_PARSER_CREATING)))) {
+        (mForm || !mParserCreating)) {
       AddedToRadioGroup();
       UpdateValueMissingValidityStateForRadio(false);
     }
@@ -774,23 +778,20 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     // we have to re-set it. This is only the case when GetValueMode() returns
     // VALUE_MODE_VALUE.
     if (aName == nsGkAtoms::value &&
-        !GetValueChanged() && GetValueMode() == VALUE_MODE_VALUE) {
+        !mValueChanged && GetValueMode() == VALUE_MODE_VALUE) {
       SetDefaultValueAsValue();
     }
 
     //
     // Checked must be set no matter what type of control it is, since
-    // GetChecked() must reflect the new value
+    // mChecked must reflect the new value
-    if (aName == nsGkAtoms::checked &&
+    if (aName == nsGkAtoms::checked && !mCheckedChanged) {
-        !GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
       // Delay setting checked if the parser is creating this element (wait
       // until everything is set)
-      if (GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+      if (mParserCreating) {
-        SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, true);
+        mShouldInitChecked = true;
       } else {
-        bool defaultChecked;
+        DoSetChecked(DefaultChecked(), true, true);
-        GetDefaultChecked(&defaultChecked);
-        DoSetChecked(defaultChecked, true, true);
         SetCheckedChanged(false);
       }
     }
@@ -897,7 +898,7 @@ NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(nsHTMLInputElement, Type, type,
 NS_IMETHODIMP
 nsHTMLInputElement::GetIndeterminate(bool* aValue)
 {
-  *aValue = GET_BOOLBIT(mBitField, BF_INDETERMINATE);
+  *aValue = mIndeterminate;
   return NS_OK;
 }
 
@@ -905,7 +906,7 @@ nsresult
 nsHTMLInputElement::SetIndeterminateInternal(bool aValue,
                                              bool aShouldInvalidate)
 {
-  SET_BOOLBIT(mBitField, BF_INDETERMINATE, aValue);
+  mIndeterminate = aValue;
 
   if (aShouldInvalidate) {
     // Repaint the frame
@@ -1011,22 +1012,25 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
 NS_IMETHODIMP
 nsHTMLInputElement::GetList(nsIDOMHTMLElement** aValue)
 {
+  *aValue = nsnull;
+
   nsAutoString dataListId;
   GetAttr(kNameSpaceID_None, nsGkAtoms::list, dataListId);
-  if (!dataListId.IsEmpty()) {
+  if (dataListId.IsEmpty()) {
-    nsIDocument* doc = GetCurrentDoc();
+    return NS_OK;
-
-    if (doc) {
-      Element* elem = doc->GetElementById(dataListId);
-
-      if (elem && elem->IsHTML(nsGkAtoms::datalist)) {
-        CallQueryInterface(elem, aValue);
-        return NS_OK;
-      }
-    }
   }
 
-  *aValue = nsnull;
+  nsIDocument* doc = GetCurrentDoc();
+  if (!doc) {
+    return NS_OK;
+  }
+
+  Element* element = doc->GetElementById(dataListId);
+  if (!element || !element->IsHTML(nsGkAtoms::datalist)) {
+    return NS_OK;
+  }
+
+  CallQueryInterface(element, aValue);
   return NS_OK;
 }
 
@@ -1042,8 +1046,11 @@ nsHTMLInputElement::MozGetFileNameArray(PRUint32 *aLength, PRUnichar ***aFileNam
   *aLength = mFiles.Count();
   PRUnichar **ret =
     static_cast<PRUnichar **>(NS_Alloc(mFiles.Count() * sizeof(PRUnichar*)));
-  
+  if (!ret) {
-  for (PRInt32 i = 0; i <  mFiles.Count(); i++) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  for (PRInt32 i = 0; i < mFiles.Count(); i++) {
     nsString str;
     mFiles[i]->GetMozFullPathInternal(str);
     ret[i] = NS_strdup(str.get());
@@ -1243,7 +1250,7 @@ nsHTMLInputElement::GetDisplayFileName(nsAString& aValue) const
   }
 
   aValue.Truncate();
-  for (PRUint32 i = 0; i < (PRUint32)mFiles.Count(); ++i) {
+  for (PRInt32 i = 0; i < mFiles.Count(); ++i) {
     nsString str;
     mFiles[i]->GetMozFullPathInternal(str);
     if (i == 0) {
@@ -1319,7 +1326,7 @@ nsHTMLInputElement::UpdateFileList()
     mFileList->Clear();
 
     const nsCOMArray<nsIDOMFile>& files = GetFiles();
-    for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
+    for (PRInt32 i = 0; i < files.Count(); ++i) {
       if (!mFileList->Append(files[i])) {
         return NS_ERROR_FAILURE;
       }
@@ -1345,7 +1352,7 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
       // it if it's useless.
       nsAutoString value(aValue);
 
-      if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+      if (!mParserCreating) {
         SanitizeValue(value);
       }
 
@@ -1394,9 +1401,9 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
 NS_IMETHODIMP
 nsHTMLInputElement::SetValueChanged(bool aValueChanged)
 {
-  bool valueChangedBefore = GetValueChanged();
+  bool valueChangedBefore = mValueChanged;
 
-  SET_BOOLBIT(mBitField, BF_VALUE_CHANGED, aValueChanged);
+  mValueChanged = aValueChanged;
 
   if (valueChangedBefore != aValueChanged) {
     UpdateState(true);
@@ -1408,7 +1415,7 @@ nsHTMLInputElement::SetValueChanged(bool aValueChanged)
 NS_IMETHODIMP 
 nsHTMLInputElement::GetChecked(bool* aChecked)
 {
-  *aChecked = GetChecked();
+  *aChecked = mChecked;
   return NS_OK;
 }
 
@@ -1423,7 +1430,7 @@ nsHTMLInputElement::DoSetCheckedChanged(bool aCheckedChanged,
                                         bool aNotify)
 {
   if (mType == NS_FORM_INPUT_RADIO) {
-    if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED) != aCheckedChanged) {
+    if (mCheckedChanged != aCheckedChanged) {
       nsCOMPtr<nsIRadioVisitor> visitor =
         new nsRadioSetCheckedChangedVisitor(aCheckedChanged);
       VisitGroup(visitor, aNotify);
@@ -1436,9 +1443,9 @@ nsHTMLInputElement::DoSetCheckedChanged(bool aCheckedChanged,
 void
 nsHTMLInputElement::SetCheckedChangedInternal(bool aCheckedChanged)
 {
-  bool checkedChangedBefore = GetCheckedChanged();
+  bool checkedChangedBefore = mCheckedChanged;
 
-  SET_BOOLBIT(mBitField, BF_CHECKED_CHANGED, aCheckedChanged);
+  mCheckedChanged = aCheckedChanged;
 
   // This method can't be called when we are not authorized to notify
   // so we do not need a aNotify parameter.
@@ -1457,8 +1464,6 @@ nsresult
 nsHTMLInputElement::DoSetChecked(bool aChecked, bool aNotify,
                                  bool aSetValueChanged)
 {
-  nsresult rv = NS_OK;
-
   // If the user or JS attempts to set checked, whether it actually changes the
   // value or not, we say the value was changed so that defaultValue don't
   // affect it no more.
@@ -1466,66 +1471,53 @@ nsHTMLInputElement::DoSetChecked(bool aChecked, bool aNotify,
     DoSetCheckedChanged(true, aNotify);
   }
 
-  //
   // Don't do anything if we're not changing whether it's checked (it would
   // screw up state actually, especially when you are setting radio button to
   // false)
-  //
+  if (mChecked == aChecked) {
-  if (GetChecked() == aChecked) {
     return NS_OK;
   }
 
-  //
   // Set checked
-  //
+  if (mType != NS_FORM_INPUT_RADIO) {
-  if (mType == NS_FORM_INPUT_RADIO) {
-    //
-    // For radio button, we need to do some extra fun stuff
-    //
-    if (aChecked) {
-      rv = RadioSetChecked(aNotify);
-    } else {
-      nsIRadioGroupContainer* container = GetRadioGroupContainer();
-      if (container) {
-        nsAutoString name;
-        GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
-        container->SetCurrentRadioButton(name, nsnull);
-      }
-      // SetCheckedInternal is going to ask all radios to update their
-      // validity state. We have to be sure the radio group container knows
-      // the currently selected radio.
-      SetCheckedInternal(false, aNotify);
-    }
-  } else {
     SetCheckedInternal(aChecked, aNotify);
+    return NS_OK;
   }
 
-  return rv;
+  // For radio button, we need to do some extra fun stuff
+  if (aChecked) {
+    return RadioSetChecked(aNotify);
+  }
+
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
+  if (container) {
+    nsAutoString name;
+    GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
+    container->SetCurrentRadioButton(name, nsnull);
+  }
+  // SetCheckedInternal is going to ask all radios to update their
+  // validity state. We have to be sure the radio group container knows
+  // the currently selected radio.
+  SetCheckedInternal(false, aNotify);
+  return NS_OK;
 }
 
 nsresult
 nsHTMLInputElement::RadioSetChecked(bool aNotify)
 {
-  nsresult rv = NS_OK;
-
-  //
   // Find the selected radio button so we can deselect it
-  //
   nsCOMPtr<nsIDOMHTMLInputElement> currentlySelected = GetSelectedRadioButton();
 
-  //
   // Deselect the currently selected radio button
-  //
   if (currentlySelected) {
     // Pass true for the aNotify parameter since the currently selected
     // button is already in the document.
-    static_cast<nsHTMLInputElement*>
+    static_cast<nsHTMLInputElement*>(currentlySelected.get())
-               (static_cast<nsIDOMHTMLInputElement*>(currentlySelected))->SetCheckedInternal(false, true);
+      ->SetCheckedInternal(false, true);
   }
 
-  //
   // Let the group know that we are now the One True Radio Button
-  //
+  nsresult rv = NS_OK;
   nsIRadioGroupContainer* container = GetRadioGroupContainer();
   if (container) {
     nsAutoString name;
@@ -1566,9 +1558,7 @@ nsHTMLInputElement::GetRadioGroupContainer() const
 already_AddRefed<nsIDOMHTMLInputElement>
 nsHTMLInputElement::GetSelectedRadioButton()
 {
-  nsIDOMHTMLInputElement* selected;
   nsIRadioGroupContainer* container = GetRadioGroupContainer();
-
   if (!container) {
     return nsnull;
   }
@@ -1576,8 +1566,9 @@ nsHTMLInputElement::GetSelectedRadioButton()
   nsAutoString name;
   GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
 
-  container->GetCurrentRadioButton(name, &selected);
+  nsCOMPtr<nsIDOMHTMLInputElement> selected;
-  return selected;
+  container->GetCurrentRadioButton(name, getter_AddRefs(selected));
+  return selected.forget();
 }
 
 nsresult
@@ -1596,7 +1587,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
   // Get the default submit element
   nsIFormControl* submitControl = mForm->GetDefaultSubmitElement();
   if (submitControl) {
-    nsCOMPtr<nsIContent> submitContent(do_QueryInterface(submitControl));
+    nsCOMPtr<nsIContent> submitContent = do_QueryInterface(submitControl);
     NS_ASSERTION(submitContent, "Form control not implementing nsIContent?!");
     // Fire the button's onclick handler and let the button handle
     // submitting the form.
@@ -1610,9 +1601,9 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
     // bug 592124.
     // If there's only one text control, just submit the form
     // Hold strong ref across the event
-    nsRefPtr<nsHTMLFormElement> form(mForm);
+    nsRefPtr<nsHTMLFormElement> form = mForm;
     nsFormEvent event(true, NS_FORM_SUBMIT);
-    nsEventStatus status  = nsEventStatus_eIgnore;
+    nsEventStatus status = nsEventStatus_eIgnore;
     shell->HandleDOMEventWithTarget(mForm, &event, &status);
   }
 
@@ -1622,14 +1613,10 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
 void
 nsHTMLInputElement::SetCheckedInternal(bool aChecked, bool aNotify)
 {
-  //
   // Set the value
-  //
+  mChecked = aChecked;
-  SET_BOOLBIT(mBitField, BF_CHECKED, aChecked);
 
-  //
   // Notify the frame
-  //
   if (mType == NS_FORM_INPUT_CHECKBOX || mType == NS_FORM_INPUT_RADIO) {
     nsIFrame* frame = GetPrimaryFrame();
     if (frame) {
@@ -1647,31 +1634,31 @@ nsHTMLInputElement::SetCheckedInternal(bool aChecked, bool aNotify)
 NS_IMETHODIMP
 nsHTMLInputElement::Focus()
 {
-  if (mType == NS_FORM_INPUT_FILE) {
+  if (mType != NS_FORM_INPUT_FILE) {
-    // for file inputs, focus the button instead
+    return nsGenericHTMLElement::Focus();
-    nsIFrame* frame = GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* childFrame = frame->GetFirstPrincipalChild();
-      while (childFrame) {
-        // see if the child is a button control
-        nsCOMPtr<nsIFormControl> formCtrl =
-          do_QueryInterface(childFrame->GetContent());
-        if (formCtrl && formCtrl->GetType() == NS_FORM_INPUT_BUTTON) {
-          nsCOMPtr<nsIDOMElement> element(do_QueryInterface(formCtrl));
-          nsIFocusManager* fm = nsFocusManager::GetFocusManager();
-          if (fm && element)
-            fm->SetFocus(element, 0);
-          break;
-        }
-
-        childFrame = childFrame->GetNextSibling();
-      }
-    }
-
-    return NS_OK;
   }
 
-  return nsGenericHTMLElement::Focus();
+  // For file inputs, focus the button instead.
+  nsIFrame* frame = GetPrimaryFrame();
+  if (frame) {
+    for (nsIFrame* childFrame = frame->GetFirstPrincipalChild();
+         childFrame;
+         childFrame = childFrame->GetNextSibling()) {
+      // See if the child is a button control.
+      nsCOMPtr<nsIFormControl> formCtrl =
+        do_QueryInterface(childFrame->GetContent());
+      if (formCtrl && formCtrl->GetType() == NS_FORM_INPUT_BUTTON) {
+        nsCOMPtr<nsIDOMElement> element = do_QueryInterface(formCtrl);
+        nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+        if (fm && element) {
+          fm->SetFocus(element, 0);
+        }
+        break;
+      }
+    }
+  }
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -1720,13 +1707,13 @@ nsHTMLInputElement::DispatchSelectEvent(nsPresContext* aPresContext)
   nsEventStatus status = nsEventStatus_eIgnore;
 
   // If already handling select event, don't dispatch a second.
-  if (!GET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT)) {
+  if (!mHandlingSelectEvent) {
     nsEvent event(nsContentUtils::IsCallerChrome(), NS_FORM_SELECTED);
 
-    SET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT, true);
+    mHandlingSelectEvent = true;
     nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this),
                                 aPresContext, &event, nsnull, &status);
-    SET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT, false);
+    mHandlingSelectEvent = false;
   }
 
   // If the DOM event was not canceled (e.g. by a JS event handler
@@ -1768,21 +1755,21 @@ nsHTMLInputElement::NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisi
   // certain types of events, because we know that those events are safe to be
   // handled without the editor being initialized.  These events include:
   // mousein/move/out, and DOM mutation events.
-  if (IsSingleLineTextControl(false) &&
+  if (!IsSingleLineTextControl(false) ||
-      aVisitor.mEvent->eventStructType != NS_MUTATION_EVENT) {
+      aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT) {
+    return false;
+  }
 
-    switch (aVisitor.mEvent->message) {
+  switch (aVisitor.mEvent->message) {
-    case NS_MOUSE_MOVE:
+  case NS_MOUSE_MOVE:
-    case NS_MOUSE_ENTER:
+  case NS_MOUSE_ENTER:
-    case NS_MOUSE_EXIT:
+  case NS_MOUSE_EXIT:
-    case NS_MOUSE_ENTER_SYNTH:
+  case NS_MOUSE_ENTER_SYNTH:
-    case NS_MOUSE_EXIT_SYNTH:
+  case NS_MOUSE_EXIT_SYNTH:
-      return false;
+    return false;
-      break;
+  default:
-    }
     return true;
   }
-  return false;
 }
 
 nsresult
@@ -1827,8 +1814,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   // a DOMActivate dispatched from click handling, it will not be set.
   bool outerActivateEvent =
     (NS_IS_MOUSE_LEFT_CLICK(aVisitor.mEvent) ||
-     (aVisitor.mEvent->message == NS_UI_ACTIVATE &&
+     (aVisitor.mEvent->message == NS_UI_ACTIVATE && !mInInternalActivate));
-      !GET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE)));
 
   if (outerActivateEvent) {
     aVisitor.mItemFlags |= NS_OUTER_ACTIVATE_EVENT;
@@ -1837,12 +1823,12 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   bool originalCheckedValue = false;
 
   if (outerActivateEvent) {
-    SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, false);
+    mCheckedIsToggled = false;
 
     switch(mType) {
       case NS_FORM_INPUT_CHECKBOX:
         {
-          if (GET_BOOLBIT(mBitField, BF_INDETERMINATE)) {
+          if (mIndeterminate) {
             // indeterminate is always set to FALSE when the checkbox is toggled
             SetIndeterminateInternal(false, false);
             aVisitor.mItemFlags |= NS_ORIGINAL_INDETERMINATE_VALUE;
@@ -1850,7 +1836,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 
           GetChecked(&originalCheckedValue);
           DoSetChecked(!originalCheckedValue, true, true);
-          SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, true);
+          mCheckedIsToggled = true;
         }
         break;
 
@@ -1859,10 +1845,10 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
           nsCOMPtr<nsIDOMHTMLInputElement> selectedRadioButton = GetSelectedRadioButton();
           aVisitor.mItemData = selectedRadioButton;
 
-          originalCheckedValue = GetChecked();
+          originalCheckedValue = mChecked;
           if (!originalCheckedValue) {
             DoSetChecked(true, true, true);
-            SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, true);
+            mCheckedIsToggled = true;
           }
         }
         break;
@@ -1879,7 +1865,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 
       default:
         break;
-    } //switch
+    }
   }
 
   if (originalCheckedValue) {
@@ -1986,9 +1972,9 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
     nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
     if (shell) {
       nsEventStatus status = nsEventStatus_eIgnore;
-      SET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE, true);
+      mInInternalActivate = true;
       rv = shell->HandleDOMEventWithTarget(this, &actEvent, &status);
-      SET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE, false);
+      mInInternalActivate = false;
 
       // If activate is cancelled, we must do the same as when click is
       // cancelled (revert the checkbox to its original value).
@@ -2009,7 +1995,7 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
           mForm->OnSubmitClickEnd();
         }
         break;
-    } //switch
+    }
   }
 
   // Reset the flag for other content besides this text field
@@ -2017,7 +2003,7 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
     noContentDispatch ? NS_EVENT_FLAG_NO_CONTENT_DISPATCH : NS_EVENT_FLAG_NONE;
 
   // now check to see if the event was "cancelled"
-  if (GET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED) && outerActivateEvent) {
+  if (mCheckedIsToggled && outerActivateEvent) {
     if (aVisitor.mEventStatus == nsEventStatus_eConsumeNoDefault) {
       // if it was cancelled and a radio button, then set the old
       // selected btn to TRUE. if it is a checkbox then set it to its
@@ -2382,7 +2368,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
   ValueModeType aOldValueMode = GetValueMode();
   nsAutoString aOldValue;
 
-  if (aOldValueMode == VALUE_MODE_VALUE && !GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+  if (aOldValueMode == VALUE_MODE_VALUE && !mParserCreating) {
     GetValue(aOldValue);
   }
 
@@ -2400,7 +2386,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
 
   mType = aNewType;
 
-  if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+  if (!mParserCreating) {
     /**
      * The following code is trying to reproduce the algorithm described here:
      * http://www.whatwg.org/specs/web-apps/current-work/complete.html#input-type-change
@@ -2445,8 +2431,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
 void
 nsHTMLInputElement::SanitizeValue(nsAString& aValue)
 {
-  NS_ASSERTION(!GET_BOOLBIT(mBitField, BF_PARSER_CREATING),
+  NS_ASSERTION(!mParserCreating, "The element parsing should be finished!");
-               "The element parsing should be finished!");
 
   switch (mType) {
     case NS_FORM_INPUT_TEXT:
@@ -2873,7 +2858,7 @@ nsHTMLInputElement::SetSelectionDirection(const nsAString& aDirection) {
 NS_IMETHODIMP
 nsHTMLInputElement::GetPhonetic(nsAString& aPhonetic)
 {
-  aPhonetic.Truncate(0);
+  aPhonetic.Truncate();
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
 
   if (formControlFrame) {
@@ -2935,9 +2920,7 @@ nsHTMLInputElement::Reset()
     case VALUE_MODE_VALUE:
       return SetDefaultValueAsValue();
     case VALUE_MODE_DEFAULT_ON:
-      bool resetVal;
+      return DoSetChecked(DefaultChecked(), true, false);
-      GetDefaultChecked(&resetVal);
-      return DoSetChecked(resetVal, true, false);
     case VALUE_MODE_FILENAME:
       ClearFiles(false);
       return NS_OK;
@@ -2950,8 +2933,6 @@ nsHTMLInputElement::Reset()
 NS_IMETHODIMP
 nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   // For type=reset, and type=button, we just never submit, period.
   // For type=image and type=button, we only submit if we were the button
@@ -2962,7 +2943,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
       ((mType == NS_FORM_INPUT_SUBMIT || mType == NS_FORM_INPUT_IMAGE) &&
        aFormSubmission->GetOriginatingElement() != this) ||
       ((mType == NS_FORM_INPUT_RADIO || mType == NS_FORM_INPUT_CHECKBOX) &&
-       !GetChecked())) {
+       !mChecked)) {
     return NS_OK;
   }
 
@@ -3012,7 +2993,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 
   // Get the value
   nsAutoString value;
-  rv = GetValue(value);
+  nsresult rv = GetValue(value);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -3034,7 +3015,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 
     const nsCOMArray<nsIDOMFile>& files = GetFiles();
 
-    for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
+    for (PRInt32 i = 0; i < files.Count(); ++i) {
       aFormSubmission->AddNameFilePair(name, files[i]);
     }
 
@@ -3051,40 +3032,29 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   if (mType == NS_FORM_INPUT_HIDDEN && name.EqualsLiteral("_charset_")) {
     nsCString charset;
     aFormSubmission->GetCharset(charset);
-    rv = aFormSubmission->AddNameValuePair(name,
+    return aFormSubmission->AddNameValuePair(name,
-                                           NS_ConvertASCIItoUTF16(charset));
+                                             NS_ConvertASCIItoUTF16(charset));
   }
-  else if (IsSingleLineTextControl(true) &&
+  if (IsSingleLineTextControl(true) &&
-           name.EqualsLiteral("isindex") &&
+      name.EqualsLiteral("isindex") &&
-           aFormSubmission->SupportsIsindexSubmission()) {
+      aFormSubmission->SupportsIsindexSubmission()) {
-    rv = aFormSubmission->AddIsindex(value);
+    return aFormSubmission->AddIsindex(value);
   }
-  else {
+  return aFormSubmission->AddNameValuePair(name, value);
-    rv = aFormSubmission->AddNameValuePair(name, value);
-  }
-
-  return rv;
 }
 
 
 NS_IMETHODIMP
 nsHTMLInputElement::SaveState()
 {
-  nsresult rv = NS_OK;
+  nsRefPtr<nsHTMLInputElementState> inputState;
-
-  nsRefPtr<nsHTMLInputElementState> inputState = nsnull;
-
   switch (mType) {
     case NS_FORM_INPUT_CHECKBOX:
     case NS_FORM_INPUT_RADIO:
       {
-        if (GetCheckedChanged()) {
+        if (mCheckedChanged) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
+          inputState->SetChecked(mChecked);
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
-          inputState->SetChecked(GetChecked());
         }
         break;
       }
@@ -3099,15 +3069,12 @@ nsHTMLInputElement::SaveState()
     case NS_FORM_INPUT_URL:
     case NS_FORM_INPUT_HIDDEN:
       {
-        if (GetValueChanged()) {
+        if (mValueChanged) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
           nsAutoString value;
           GetValue(value);
-          rv = nsLinebreakConverter::ConvertStringLineBreaks(
+          DebugOnly<nsresult> rv =
+            nsLinebreakConverter::ConvertStringLineBreaks(
                  value,
                  nsLinebreakConverter::eLinebreakPlatform,
                  nsLinebreakConverter::eLinebreakContent);
@@ -3120,16 +3087,13 @@ nsHTMLInputElement::SaveState()
       {
         if (mFiles.Count()) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
           inputState->SetFiles(mFiles);
         }
         break;
       }
   }
   
+  nsresult rv = NS_OK;
   nsPresState* state = nsnull;
   if (inputState) {
     rv = GetPrimaryPresState(this, &state);
@@ -3138,7 +3102,7 @@ nsHTMLInputElement::SaveState()
     }
   }
 
-  if (GET_BOOLBIT(mBitField, BF_DISABLED_CHANGED)) {
+  if (mDisabledChanged) {
     rv |= GetPrimaryPresState(this, &state);
     if (state) {
       // We do not want to save the real disabled state but the disabled
@@ -3153,26 +3117,21 @@ nsHTMLInputElement::SaveState()
 void
 nsHTMLInputElement::DoneCreatingElement()
 {
-  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, false);
+  mParserCreating = false;
 
   //
   // Restore state as needed.  Note that disabled state applies to all control
   // types.
   //
   bool restoredCheckedState =
-      GET_BOOLBIT(mBitField, BF_INHIBIT_RESTORATION) ?
+    !mInhibitRestoration && RestoreFormControlState(this, this);
-      false :
-      RestoreFormControlState(this, this);
 
   //
   // If restore does not occur, we initialize .checked using the CHECKED
   // property.
   //
-  if (!restoredCheckedState &&
+  if (!restoredCheckedState && mShouldInitChecked) {
-      GET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED)) {
+    DoSetChecked(DefaultChecked(), false, true);
-    bool resetVal;
-    GetDefaultChecked(&resetVal);
-    DoSetChecked(resetVal, false, true);
     DoSetCheckedChanged(false, false);
   }
 
@@ -3183,7 +3142,7 @@ nsHTMLInputElement::DoneCreatingElement()
     SetValueInternal(aValue, false, false);
   }
 
-  SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, false);
+  mShouldInitChecked = false;
 }
 
 nsEventStates
@@ -3195,21 +3154,17 @@ nsHTMLInputElement::IntrinsicState() const
   nsEventStates state = nsGenericHTMLFormElement::IntrinsicState();
   if (mType == NS_FORM_INPUT_CHECKBOX || mType == NS_FORM_INPUT_RADIO) {
     // Check current checked state (:checked)
-    if (GET_BOOLBIT(mBitField, BF_CHECKED)) {
+    if (mChecked) {
       state |= NS_EVENT_STATE_CHECKED;
     }
 
     // Check current indeterminate state (:indeterminate)
-    if (mType == NS_FORM_INPUT_CHECKBOX && GET_BOOLBIT(mBitField, BF_INDETERMINATE)) {
+    if (mType == NS_FORM_INPUT_CHECKBOX && mIndeterminate) {
       state |= NS_EVENT_STATE_INDETERMINATE;
     }
 
     // Check whether we are the default checked element (:default)
-    // The call is to an interface function, which makes it non-const, so we
+    if (DefaultChecked()) {
-    // use a nasty hack :(
-    bool defaultState = false;
-    const_cast<nsHTMLInputElement*>(this)->GetDefaultChecked(&defaultState);
-    if (defaultState) {
       state |= NS_EVENT_STATE_DEFAULT;
     }
   } else if (mType == NS_FORM_INPUT_IMAGE) {
@@ -3230,8 +3185,7 @@ nsHTMLInputElement::IntrinsicState() const
 
       if ((!mForm || !mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) &&
           (GetValidityState(VALIDITY_STATE_CUSTOM_ERROR) ||
-           (GET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI) &&
+           (mCanShowInvalidUI && ShouldShowValidityUI()))) {
-            ShouldShowValidityUI()))) {
         state |= NS_EVENT_STATE_MOZ_UI_INVALID;
       }
     }
@@ -3246,9 +3200,9 @@ nsHTMLInputElement::IntrinsicState() const
     // 4. The element has already been modified or the user tried to submit the
     //    form owner while invalid.
     if ((!mForm || !mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) &&
-        (GET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI) && ShouldShowValidityUI() &&
+        (mCanShowValidUI && ShouldShowValidityUI() &&
          (IsValid() || (!state.HasState(NS_EVENT_STATE_MOZ_UI_INVALID) &&
-                        !GET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI))))) {
+                        !mCanShowInvalidUI)))) {
       state |= NS_EVENT_STATE_MOZ_UI_VALID;
     }
   }
@@ -3328,7 +3282,7 @@ void
 nsHTMLInputElement::AddedToRadioGroup()
 {
   // Make sure not to notify if we're still being created by the parser
-  bool notify = !GET_BOOLBIT(mBitField, BF_PARSER_CREATING);
+  bool notify = !mParserCreating;
 
   //
   //  If the input element is not in a form and
@@ -3342,7 +3296,7 @@ nsHTMLInputElement::AddedToRadioGroup()
   // If the input element is checked, and we add it to the group, it will
   // deselect whatever is currently selected in that group
   //
-  if (GetChecked()) {
+  if (mChecked) {
     //
     // If it is checked, call "RadioSetChecked" to perform the selection/
     // deselection ritual.  This has the side effect of repainting the
@@ -3357,7 +3311,7 @@ nsHTMLInputElement::AddedToRadioGroup()
   // For integrity purposes, we have to ensure that "checkedChanged" is
   // the same for this new element as for all the others in the group
   //
-  bool checkedChanged = GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED);
+  bool checkedChanged = mCheckedChanged;
 
   nsCOMPtr<nsIRadioVisitor> visitor =
     new nsRadioGetCheckedChangedVisitor(&checkedChanged, this);
@@ -3394,7 +3348,7 @@ nsHTMLInputElement::WillRemoveFromRadioGroup()
 
   // If this button was checked, we need to notify the group that there is no
   // longer a selected radio button
-  if (GetChecked()) {
+  if (mChecked) {
     container->SetCurrentRadioButton(name, nsnull);
   }
 
@@ -3455,7 +3409,7 @@ nsHTMLInputElement::IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32
     return false;
   }
 
-  if (GetChecked()) {
+  if (mChecked) {
     // Selected radio buttons are tabbable
     *aIsFocusable = defaultFocusable;
     return false;
@@ -3630,7 +3584,7 @@ nsHTMLInputElement::IsTooLong()
 {
   if (!MaxLengthApplies() ||
       !HasAttr(kNameSpaceID_None, nsGkAtoms::maxlength) ||
-      !GetValueChanged()) {
+      !mValueChanged) {
     return false;
   }
 
@@ -3667,7 +3621,7 @@ nsHTMLInputElement::IsValueMissing() const
   switch (mType)
   {
     case NS_FORM_INPUT_CHECKBOX:
-      return !GetChecked();
+      return !mChecked;
     case NS_FORM_INPUT_FILE:
       {
         const nsCOMArray<nsIDOMFile>& files = GetFiles();
@@ -3750,15 +3704,13 @@ nsHTMLInputElement::UpdateTooLongValidityState()
 void
 nsHTMLInputElement::UpdateValueMissingValidityStateForRadio(bool aIgnoreSelf)
 {
-  bool notify = !GET_BOOLBIT(mBitField, BF_PARSER_CREATING);
+  bool notify = !mParserCreating;
   nsCOMPtr<nsIDOMHTMLInputElement> selection = GetSelectedRadioButton();
 
   // If there is no selection, that might mean the radio is not in a group.
   // In that case, we can look for the checked state of the radio.
-  bool selected = selection ? true
+  bool selected = selection || (!aIgnoreSelf && mChecked);
-                            : aIgnoreSelf ? false : GetChecked();
+  bool required = !aIgnoreSelf && HasAttr(kNameSpaceID_None, nsGkAtoms::required);
-  bool required = aIgnoreSelf ? false
-                              : HasAttr(kNameSpaceID_None, nsGkAtoms::required);
   bool valueMissing = false;
 
   nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
@@ -4072,7 +4024,7 @@ nsHTMLInputElement::GetDefaultValueFromContent(nsAString& aValue)
     GetDefaultValue(aValue);
     // This is called by the frame to show the value.
     // We have to sanitize it when needed.
-    if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+    if (!mParserCreating) {
       SanitizeValue(aValue);
     }
   }
@@ -4081,7 +4033,7 @@ nsHTMLInputElement::GetDefaultValueFromContent(nsAString& aValue)
 NS_IMETHODIMP_(bool)
 nsHTMLInputElement::ValueChanged() const
 {
-  return GetValueChanged();
+  return mValueChanged;
 }
 
 NS_IMETHODIMP_(void)
@@ -4120,9 +4072,9 @@ nsHTMLInputElement::OnValueChanged(bool aNotify)
 
   // :-moz-placeholder pseudo-class may change when the value changes.
   // However, we don't want to waste cycles if the state doesn't apply.
-  if (PlaceholderApplies()
+  if (PlaceholderApplies() &&
-      && HasAttr(kNameSpaceID_None, nsGkAtoms::placeholder)
+      HasAttr(kNameSpaceID_None, nsGkAtoms::placeholder) &&
-      && !nsContentUtils::IsFocusedContent((nsIContent*)(this))) {
+      !nsContentUtils::IsFocusedContent(this)) {
     UpdateState(aNotify);
   }
 }
@@ -4197,15 +4149,14 @@ nsHTMLInputElement::UpdateValidityUIBits(bool aIsFocused)
   if (aIsFocused) {
     // If the invalid UI is shown, we should show it while focusing (and
     // update). Otherwise, we should not.
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI,
+    mCanShowInvalidUI = !IsValid() && ShouldShowValidityUI();
-                !IsValid() && ShouldShowValidityUI());
 
     // If neither invalid UI nor valid UI is shown, we shouldn't show the valid
     // UI while typing.
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, ShouldShowValidityUI());
+    mCanShowValidUI = ShouldShowValidityUI();
   } else {
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI, true);
+    mCanShowInvalidUI = true;
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, true);
+    mCanShowValidUI = true;
   }
 }
 

content/html/content/src/nsHTMLInputElement.h

@@ -52,29 +52,6 @@
 #include "nsHTMLFormElement.h" // for ShouldShowInvalidUI()
 #include "nsIFile.h"
 
-//
-// Accessors for mBitField
-//
-#define BF_DISABLED_CHANGED 0
-#define BF_VALUE_CHANGED 1
-#define BF_CHECKED_CHANGED 2
-#define BF_CHECKED 3
-#define BF_HANDLING_SELECT_EVENT 4
-#define BF_SHOULD_INIT_CHECKED 5
-#define BF_PARSER_CREATING 6
-#define BF_IN_INTERNAL_ACTIVATE 7
-#define BF_CHECKED_IS_TOGGLED 8
-#define BF_INDETERMINATE 9
-#define BF_INHIBIT_RESTORATION 10
-#define BF_CAN_SHOW_INVALID_UI 11
-#define BF_CAN_SHOW_VALID_UI 12
-
-#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
-                                        ? true : false)
-#define SET_BOOLBIT(bitfield, field, b) ((b) \
-                                        ? ((bitfield) |=  (0x01 << (field))) \
-                                        : ((bitfield) &= ~(0x01 << (field))))
-
 class nsDOMFileList;
 class nsIRadioGroupContainer;
 class nsIRadioGroupVisitor;
@@ -228,7 +205,7 @@ public:
 
   void SetCheckedChangedInternal(bool aCheckedChanged);
   bool GetCheckedChanged() const {
-    return GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED);
+    return mCheckedChanged;
   }
   void AddedToRadioGroup();
   void WillRemoveFromRadioGroup();
@@ -320,6 +297,10 @@ public:
    */
   void UpdateValidityUIBits(bool aIsFocused);
 
+  bool DefaultChecked() const {
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::checked);
+  }
+
 protected:
   // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
   // by the nsITextControlElement version.
@@ -442,14 +423,6 @@ protected:
    */
   void SetCheckedInternal(bool aValue, bool aNotify);
 
-  /**
-   * Syntax sugar to make it easier to check for checked
-   */
-  bool GetChecked() const
-  {
-    return GET_BOOLBIT(mBitField, BF_CHECKED);
-  }
-
   nsresult RadioSetChecked(bool aNotify);
   void SetCheckedChanged(bool aCheckedChanged);
 
@@ -535,14 +508,6 @@ protected:
    */
   nsresult SetDefaultValueAsValue();
 
-  /**
-   * Returns whether the value has been changed since the element has been created.
-   * @return Whether the value has been changed since the element has been created.
-   */
-  bool GetValueChanged() const {
-    return GET_BOOLBIT(mBitField, BF_VALUE_CHANGED);
-  }
-
   /**
    * Return if an element should have a specific validity UI
    * (with :-moz-ui-invalid and :-moz-ui-valid pseudo-classes).
@@ -567,7 +532,7 @@ protected:
         return GetCheckedChanged();
       case VALUE_MODE_VALUE:
       case VALUE_MODE_FILENAME:
-        return GetValueChanged();
+        return mValueChanged;
       default:
         NS_NOTREACHED("We should not be there: there are no other modes.");
         return false;
@@ -584,16 +549,6 @@ protected:
 
   nsCOMPtr<nsIControllers> mControllers;
 
-  /**
-   * The type of this input (<input type=...>) as an integer.
-   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
-   */
-  PRUint8                  mType;
-  /**
-   * A bitfield containing our booleans
-   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
-   */
-  PRInt16                  mBitField;
   /*
    * In mInputData, the mState field is used if IsSingleLineTextControl returns
    * true and mValue is used otherwise.  We have to be careful when handling it
@@ -627,6 +582,25 @@ protected:
   nsRefPtr<nsDOMFileList>  mFileList;
 
   nsString mStaticDocFileList;
+
+  /**
+   * The type of this input (<input type=...>) as an integer.
+   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
+   */
+  PRUint8                  mType;
+  bool                     mDisabledChanged     : 1;
+  bool                     mValueChanged        : 1;
+  bool                     mCheckedChanged      : 1;
+  bool                     mChecked             : 1;
+  bool                     mHandlingSelectEvent : 1;
+  bool                     mShouldInitChecked   : 1;
+  bool                     mParserCreating      : 1;
+  bool                     mInInternalActivate  : 1;
+  bool                     mCheckedIsToggled    : 1;
+  bool                     mIndeterminate       : 1;
+  bool                     mInhibitRestoration  : 1;
+  bool                     mCanShowValidUI      : 1;
+  bool                     mCanShowInvalidUI    : 1;
 };
 
 #endif

content/html/content/src/nsHTMLLabelElement.cpp

@@ -104,11 +104,8 @@ nsHTMLLabelElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLLabelElement::GetControl(nsIDOMHTMLElement** aElement)
 {
-  *aElement = nsnull;
-
   nsCOMPtr<nsIDOMHTMLElement> element = do_QueryInterface(GetLabeledElement());
-
+  element.forget(aElement);
-  element.swap(*aElement);
   return NS_OK;
 }
 
@@ -170,7 +167,7 @@ DestroyMouseDownPoint(void *    /*aObject*/,
                       void *    aPropertyValue,
                       void *    /*aData*/)
 {
-  nsIntPoint *pt = (nsIntPoint *)aPropertyValue;
+  nsIntPoint* pt = static_cast<nsIntPoint*>(aPropertyValue);
   delete pt;
 }
 

content/html/content/src/nsHTMLLegendElement.cpp

@@ -83,7 +83,7 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLLegendElement)
 NS_IMETHODIMP
 nsHTMLLegendElement::GetForm(nsIDOMHTMLFormElement** aForm)
 {
-  Element *form = GetFormElement();
+  Element* form = GetFormElement();
 
   return form ? CallQueryInterface(form, aForm) : NS_OK;
 }
@@ -106,7 +106,7 @@ nsHTMLLegendElement::GetFieldSet()
 {
   nsIContent* parent = GetParent();
 
-  if (parent && parent->IsHTML() && parent->Tag() == nsGkAtoms::fieldset) {
+  if (parent && parent->IsHTML(nsGkAtoms::fieldset)) {
     return parent;
   }
 

content/html/content/src/nsHTMLLegendElement.h

@@ -50,8 +50,9 @@ public:
 
   static nsHTMLLegendElement* FromContent(nsIContent *aContent)
   {
-    if (aContent->IsHTML() && aContent->Tag() == nsGkAtoms::legend)
+    if (aContent->IsHTML(nsGkAtoms::legend)) {
       return static_cast<nsHTMLLegendElement*>(aContent);
+    }
     return nsnull;
   }
 

content/html/content/src/nsHTMLLinkElement.cpp

@@ -166,7 +166,7 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLLinkElement)
 NS_IMETHODIMP
 nsHTMLLinkElement::GetDisabled(bool* aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
   nsresult result = NS_OK;
 
   if (ss) {
@@ -181,7 +181,7 @@ nsHTMLLinkElement::GetDisabled(bool* aDisabled)
 NS_IMETHODIMP 
 nsHTMLLinkElement::SetDisabled(bool aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
   nsresult result = NS_OK;
 
   if (ss) {
@@ -281,11 +281,9 @@ nsHTMLLinkElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 
   nsRefPtr<nsPLDOMEvent> event = new nsPLDOMEvent(this, aEventName, true,
                                                   true);
-  if (event) {
+  // Always run async in order to avoid running script when the content
-    // Always run async in order to avoid running script when the content
+  // sink isn't expecting it.
-    // sink isn't expecting it.
+  event->PostDOMEvent();
-    event->PostDOMEvent();
-  }
 }
 
 nsresult

content/html/content/src/nsHTMLMapElement.cpp

@@ -116,7 +116,7 @@ nsHTMLMapElement::GetAreas(nsIDOMHTMLCollection** aAreas)
   if (!mAreas) {
     // Not using NS_GetContentList because this should not be cached
     mAreas = new nsContentList(this,
-                               mNodeInfo->NamespaceID(),
+                               kNameSpaceID_XHTML,
                                nsGkAtoms::area,
                                nsGkAtoms::area,
                                false);

content/html/content/src/nsHTMLMediaElement.cpp

@@ -298,9 +298,8 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStartRequest(nsIRequest*
   }
 
   // Don't continue to load if the request failed or has been canceled.
-  nsresult rv;
   nsresult status;
-  rv = aRequest->GetStatus(&status);
+  nsresult rv = aRequest->GetStatus(&status);
   NS_ENSURE_SUCCESS(rv, rv);
   if (NS_FAILED(status)) {
     if (element)
@@ -332,7 +331,7 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStartRequest(nsIRequest*
 }
 
 NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStopRequest(nsIRequest* aRequest, nsISupports* aContext,
-                                                                     nsresult aStatus)
+                                                                   nsresult aStatus)
 {
   if (mNextListener) {
     return mNextListener->OnStopRequest(aRequest, aContext, aStatus);
@@ -341,8 +340,8 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStopRequest(nsIRequest* a
 }
 
 NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext,
-                                                                       nsIInputStream* aStream, PRUint32 aOffset,
+                                                                     nsIInputStream* aStream, PRUint32 aOffset,
-                                                                       PRUint32 aCount)
+                                                                     PRUint32 aCount)
 {
   if (!mNextListener) {
     NS_ERROR("Must have a chained listener; OnStartRequest should have canceled this request");
@@ -635,11 +634,10 @@ void nsHTMLMediaElement::SelectResource()
   // AddRemoveSelfReference, since it must still be held
   DispatchAsyncEvent(NS_LITERAL_STRING("loadstart"));
 
-  nsAutoString src;
-  nsCOMPtr<nsIURI> uri;
-
   // If we have a 'src' attribute, use that exclusively.
+  nsAutoString src;
   if (GetAttr(kNameSpaceID_None, nsGkAtoms::src, src)) {
+    nsCOMPtr<nsIURI> uri;
     nsresult rv = NewURIFromString(src, getter_AddRefs(uri));
     if (NS_SUCCEEDED(rv)) {
       LOG(PR_LOG_DEBUG, ("%p Trying load from src=%s", this, NS_ConvertUTF16toUTF8(src).get()));
@@ -728,7 +726,6 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
   NS_ASSERTION(mIsLoadingFromSourceChildren,
                "Must remember we're loading from source children");
   while (true) {
-    nsresult rv;
     nsIContent* child = GetNextSource();
     if (!child) {
       // Exhausted candidates, wait for more candidates to be appended to
@@ -739,25 +736,24 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
       return;
     }
 
-    nsCOMPtr<nsIURI> uri;
-    nsAutoString src,type;
-
     // Must have src attribute.
+    nsAutoString src;
     if (!child->GetAttr(kNameSpaceID_None, nsGkAtoms::src, src)) {
       DispatchAsyncSourceError(child);
       continue;
     }
 
     // If we have a type attribute, it must be a supported type.
-    if (child->HasAttr(kNameSpaceID_None, nsGkAtoms::type) &&
+    nsAutoString type;
-        child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
+    if (child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
-        GetCanPlay(type) == CANPLAY_NO)
+        GetCanPlay(type) == CANPLAY_NO) {
-    {
       DispatchAsyncSourceError(child);
       continue;
     }
     LOG(PR_LOG_DEBUG, ("%p Trying load from <source>=%s type=%s", this,
       NS_ConvertUTF16toUTF8(src).get(), NS_ConvertUTF16toUTF8(type).get()));
+
+    nsCOMPtr<nsIURI> uri;
     NewURIFromString(src, getter_AddRefs(uri));
     if (!uri) {
       DispatchAsyncSourceError(child);
@@ -775,9 +771,9 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
       return;
     }
 
-    rv = LoadResource(uri);
+    if (NS_SUCCEEDED(LoadResource(uri))) {
-    if (NS_SUCCEEDED(rv))
       return;
+    }
 
     // If we fail to load, loop back and try loading the next resource.
     DispatchAsyncSourceError(child);
@@ -892,15 +888,12 @@ void nsHTMLMediaElement::UpdatePreloadAction()
       ResumeLoad(PRELOAD_METADATA);
     }
   }
-
-  return;
 }
 
 nsresult nsHTMLMediaElement::LoadResource(nsIURI* aURI)
 {
   NS_ASSERTION(mDelayingLoadEvent,
                "Should delay load event (if in document) during load");
-  nsresult rv;
 
   // If a previous call to mozSetup() was made, kill that media stream
   // in order to use this new src instead.
@@ -915,17 +908,19 @@ nsresult nsHTMLMediaElement::LoadResource(nsIURI* aURI)
   }
 
   PRInt16 shouldLoad = nsIContentPolicy::ACCEPT;
-  rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_MEDIA,
+  nsresult rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_MEDIA,
-                                 aURI,
+                                          aURI,
-                                 NodePrincipal(),
+                                          NodePrincipal(),
-                                 static_cast<nsGenericElement*>(this),
+                                          static_cast<nsGenericElement*>(this),
-                                 EmptyCString(), // mime type
+                                          EmptyCString(), // mime type
-                                 nsnull, // extra
+                                          nsnull, // extra
-                                 &shouldLoad,
+                                          &shouldLoad,
-                                 nsContentUtils::GetContentPolicy(),
+                                          nsContentUtils::GetContentPolicy(),
-                                 nsContentUtils::GetSecurityManager());
+                                          nsContentUtils::GetSecurityManager());
-  NS_ENSURE_SUCCESS(rv,rv);
+  NS_ENSURE_SUCCESS(rv, rv);
-  if (NS_CP_REJECTED(shouldLoad)) return NS_ERROR_FAILURE;
+  if (NS_CP_REJECTED(shouldLoad)) {
+    return NS_ERROR_FAILURE;
+  }
 
   nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
 
@@ -1122,12 +1117,11 @@ NS_IMETHODIMP nsHTMLMediaElement::GetDuration(double *aDuration)
 /* readonly attribute nsIDOMHTMLTimeRanges seekable; */
 NS_IMETHODIMP nsHTMLMediaElement::GetSeekable(nsIDOMTimeRanges** aSeekable)
 {
-  nsTimeRanges* ranges = new nsTimeRanges();
+  nsRefPtr<nsTimeRanges> ranges = new nsTimeRanges();
-  NS_ADDREF(*aSeekable = ranges);
-
   if (mDecoder && mReadyState > nsIDOMHTMLMediaElement::HAVE_NOTHING) {
     mDecoder->GetSeekable(ranges);
   }
+  ranges.forget(aSeekable);
   return NS_OK;
 }
 
@@ -1175,7 +1169,7 @@ NS_IMETHODIMP nsHTMLMediaElement::GetVolume(double *aVolume)
 
 NS_IMETHODIMP nsHTMLMediaElement::SetVolume(double aVolume)
 {
-  if (aVolume < 0.0f || aVolume > 1.0f)
+  if (aVolume < 0.0 || aVolume > 1.0)
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
 
   if (aVolume == mVolume)
@@ -1346,14 +1340,17 @@ void nsHTMLMediaElement::StopSuspendingAfterFirstFrame()
 
 void nsHTMLMediaElement::SetPlayedOrSeeked(bool aValue)
 {
-  if (aValue == mHasPlayedOrSeeked)
+  if (aValue == mHasPlayedOrSeeked) {
     return;
+  }
 
   mHasPlayedOrSeeked = aValue;
 
   // Force a reflow so that the poster frame hides or shows immediately.
   nsIFrame* frame = GetPrimaryFrame();
-  if (!frame) return;
+  if (!frame) {
+    return;
+  }
   frame->PresContext()->PresShell()->FrameNeedsReflow(frame,
                                                       nsIPresShell::eTreeChange,
                                                       NS_FRAME_IS_DIRTY);
@@ -1367,7 +1364,7 @@ NS_IMETHODIMP nsHTMLMediaElement::Play()
   if (mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY) {
     nsresult rv = Load();
     NS_ENSURE_SUCCESS(rv, rv);
-  }  else if (mLoadIsSuspended) {
+  } else if (mLoadIsSuspended) {
     ResumeLoad(PRELOAD_ENOUGH);
   } else if (mDecoder) {
     if (mDecoder->IsEnded()) {
@@ -1425,16 +1422,16 @@ bool nsHTMLMediaElement::ParseAttribute(PRInt32 aNamespaceID,
   };
 
   if (aNamespaceID == kNameSpaceID_None) {
-    if (aAttribute == nsGkAtoms::loopstart
+    if (aAttribute == nsGkAtoms::loopstart ||
-       || aAttribute == nsGkAtoms::loopend
+        aAttribute == nsGkAtoms::loopend ||
-       || aAttribute == nsGkAtoms::start
+        aAttribute == nsGkAtoms::start ||
-       || aAttribute == nsGkAtoms::end) {
+        aAttribute == nsGkAtoms::end) {
       return aResult.ParseDoubleValue(aValue);
     }
-    else if (ParseImageAttribute(aAttribute, aValue, aResult)) {
+    if (ParseImageAttribute(aAttribute, aValue, aResult)) {
       return true;
     }
-    else if (aAttribute == nsGkAtoms::preload) {
+    if (aAttribute == nsGkAtoms::preload) {
       return aResult.ParseEnumValue(aValue, kPreloadTable, false);
     }
   }
@@ -1449,7 +1446,7 @@ nsresult nsHTMLMediaElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 {
   nsresult rv =
     nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix, aValue,
-                                    aNotify);
+                                  aNotify);
   if (NS_FAILED(rv))
     return rv;
   if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
@@ -1536,12 +1533,16 @@ static bool IsRawEnabled()
 
 static bool IsRawType(const nsACString& aType)
 {
-  if (!IsRawEnabled())
+  if (!IsRawEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gRawTypes); ++i) {
-    if (aType.EqualsASCII(gRawTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gRawTypes); ++i) {
+    if (aType.EqualsASCII(gRawTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1569,12 +1570,16 @@ nsHTMLMediaElement::IsOggEnabled()
 bool
 nsHTMLMediaElement::IsOggType(const nsACString& aType)
 {
-  if (!IsOggEnabled())
+  if (!IsOggEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gOggTypes); ++i) {
-    if (aType.EqualsASCII(gOggTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gOggTypes); ++i) {
+    if (aType.EqualsASCII(gOggTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1604,12 +1609,16 @@ nsHTMLMediaElement::IsWaveEnabled()
 bool
 nsHTMLMediaElement::IsWaveType(const nsACString& aType)
 {
-  if (!IsWaveEnabled())
+  if (!IsWaveEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gWaveTypes); ++i) {
-    if (aType.EqualsASCII(gWaveTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gWaveTypes); ++i) {
+    if (aType.EqualsASCII(gWaveTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1636,12 +1645,16 @@ nsHTMLMediaElement::IsWebMEnabled()
 bool
 nsHTMLMediaElement::IsWebMType(const nsACString& aType)
 {
-  if (!IsWebMEnabled())
+  if (!IsWebMEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gWebMTypes); ++i) {
-    if (aType.EqualsASCII(gWebMTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gWebMTypes); ++i) {
+    if (aType.EqualsASCII(gWebMTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1760,10 +1773,16 @@ NS_IMETHODIMP
 nsHTMLMediaElement::CanPlayType(const nsAString& aType, nsAString& aResult)
 {
   switch (GetCanPlay(aType)) {
-  case CANPLAY_NO: aResult.AssignLiteral(""); break;
+  case CANPLAY_NO:
-  case CANPLAY_YES: aResult.AssignLiteral("probably"); break;
+    aResult.Truncate();
+    break;
+  case CANPLAY_YES:
+    aResult.AssignLiteral("probably");
+    break;
   default:
-  case CANPLAY_MAYBE: aResult.AssignLiteral("maybe"); break;
+  case CANPLAY_MAYBE:
+    aResult.AssignLiteral("maybe");
+    break;
   }
   return NS_OK;
 }
@@ -1774,32 +1793,32 @@ nsHTMLMediaElement::CreateDecoder(const nsACString& aType)
 #ifdef MOZ_RAW
   if (IsRawType(aType)) {
     nsRefPtr<nsRawDecoder> decoder = new nsRawDecoder();
-    if (decoder && decoder->Init(this)) {
+    if (decoder->Init(this)) {
-      return decoder.forget().get();
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_OGG
   if (IsOggType(aType)) {
     nsRefPtr<nsOggDecoder> decoder = new nsOggDecoder();
-    if (decoder && decoder->Init(this)) {
+    if (decoder->Init(this)) {
-      return decoder.forget().get();
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_WAVE
   if (IsWaveType(aType)) {
     nsRefPtr<nsWaveDecoder> decoder = new nsWaveDecoder();
-    if (decoder && decoder->Init(this)) {
+    if (decoder->Init(this)) {
-      return decoder.forget().get();
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_WEBM
   if (IsWebMType(aType)) {
     nsRefPtr<nsWebMDecoder> decoder = new nsWebMDecoder();
-    if (decoder && decoder->Init(this)) {
+    if (decoder->Init(this)) {
-      return decoder.forget().get();
+      return decoder.forget();
     }
   }
 #endif
@@ -1913,7 +1932,8 @@ nsresult nsHTMLMediaElement::NewURIFromString(const nsAutoString& aURISpec, nsIU
   nsCOMPtr<nsIDocument> doc = OwnerDoc();
 
   nsCOMPtr<nsIURI> baseURI = GetBaseURI();
-  nsresult rv = nsContentUtils::NewURIWithDocumentCharset(aURI,
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(uri),
                                                           aURISpec,
                                                           doc,
                                                           baseURI);
@@ -1922,16 +1942,16 @@ nsresult nsHTMLMediaElement::NewURIFromString(const nsAutoString& aURISpec, nsIU
   bool equal;
   if (aURISpec.IsEmpty() &&
       doc->GetDocumentURI() &&
-      NS_SUCCEEDED(doc->GetDocumentURI()->Equals(*aURI, &equal)) &&
+      NS_SUCCEEDED(doc->GetDocumentURI()->Equals(uri, &equal)) &&
       equal) {
     // It's not possible for a media resource to be embedded in the current
     // document we extracted aURISpec from, so there's no point returning
     // the current document URI just to let the caller attempt and fail to
     // decode it.
-    NS_RELEASE(*aURI);
     return NS_ERROR_DOM_INVALID_STATE_ERR;
   }
 
+  uri.forget(aURI);
   return NS_OK;
 }
 
@@ -2485,11 +2505,11 @@ void nsHTMLMediaElement::NotifyAddedSource()
 
 nsIContent* nsHTMLMediaElement::GetNextSource()
 {
-  nsresult rv = NS_OK;
   nsCOMPtr<nsIDOMNode> thisDomNode = do_QueryObject(this);
 
   mSourceLoadCandidate = nsnull;
 
+  nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
     mSourcePointer = do_CreateInstance("@mozilla.org/content/range;1");
@@ -2518,14 +2538,13 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
       return nsnull; // No more children.
 
     // Advance the range to the next child.
-    rv = mSourcePointer->SetStart(thisDomNode, startOffset+1);
+    rv = mSourcePointer->SetStart(thisDomNode, startOffset + 1);
     NS_ENSURE_SUCCESS(rv, nsnull);
 
     nsIContent* child = GetChildAt(startOffset);
 
     // If child is a <source> element, it is the next candidate.
-    if (child && child->IsHTML(nsGkAtoms::source))
+    if (child && child->IsHTML(nsGkAtoms::source)) {
-    {
       mSourceLoadCandidate = child;
       return child;
     }
@@ -2534,7 +2553,8 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
   return nsnull;
 }
 
-void nsHTMLMediaElement::ChangeDelayLoadStatus(bool aDelay) {
+void nsHTMLMediaElement::ChangeDelayLoadStatus(bool aDelay)
+{
   if (mDelayingLoadEvent == aDelay)
     return;
 
@@ -2599,13 +2619,13 @@ nsHTMLMediaElement::CopyInnerTo(nsGenericElement* aDest) const
 
 nsresult nsHTMLMediaElement::GetBuffered(nsIDOMTimeRanges** aBuffered)
 {
-  nsTimeRanges* ranges = new nsTimeRanges();
+  nsRefPtr<nsTimeRanges> ranges = new nsTimeRanges();
-  NS_ADDREF(*aBuffered = ranges);
   if (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA && mDecoder) {
     // If GetBuffered fails we ignore the error result and just return the
     // time ranges we found up till the error.
     mDecoder->GetBuffered(ranges);
   }
+  ranges.forget(aBuffered);
   return NS_OK;
 }
 
@@ -2620,7 +2640,7 @@ void nsHTMLMediaElement::SetRequestHeaders(nsIHttpChannel* aChannel)
   // So, disable the standard "Accept-Encoding: gzip,deflate" that we usually send.
   // See bug 614760.
   aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept-Encoding"),
-                             NS_LITERAL_CSTRING(""), false);
+                             EmptyCString(), false);
 
   // Set the Referer header
   aChannel->SetReferrer(OwnerDoc()->GetDocumentURI());

content/html/content/src/nsHTMLMetaElement.cpp

@@ -150,7 +150,5 @@ nsHTMLMetaElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 
   nsRefPtr<nsPLDOMEvent> event = new nsPLDOMEvent(this, aEventName, true,
                                                   true);
-  if (event) {
+  event->PostDOMEvent();
-    event->PostDOMEvent();
-  }
 }

content/html/content/src/nsHTMLObjectElement.cpp

@@ -129,7 +129,7 @@ public:
 
   virtual bool IsDisabled() const { return false; }
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual bool ParseAttribute(PRInt32 aNamespaceID,
@@ -200,7 +200,7 @@ nsHTMLObjectElement::IsDoneAddingChildren()
   return mIsDoneAddingChildren;
 }
 
-nsresult
+void
 nsHTMLObjectElement::DoneAddingChildren(bool aHaveNotified)
 {
   mIsDoneAddingChildren = true;
@@ -210,7 +210,6 @@ nsHTMLObjectElement::DoneAddingChildren(bool aHaveNotified)
   if (IsInDoc()) {
     StartObjectLoad(aHaveNotified);
   }
-  return NS_OK;
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLObjectElement)

content/html/content/src/nsHTMLOutputElement.cpp

@@ -173,9 +173,7 @@ NS_IMETHODIMP
 nsHTMLOutputElement::Reset()
 {
   mValueModeFlag = eModeDefault;
-  nsresult rv = nsContentUtils::SetNodeTextContent(this, mDefaultValue,
+  return nsContentUtils::SetNodeTextContent(this, mDefaultValue, true);
-                                                   true);
-  return rv;
 }
 
 NS_IMETHODIMP

content/html/content/src/nsHTMLScriptElement.cpp

@@ -114,9 +114,6 @@ public:
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
-  virtual bool IsDoneAddingChildren();
-
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
   // nsGenericElement
@@ -125,11 +122,8 @@ public:
 
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  bool IsOnloadEventForWindow();
-
   // nsScriptElement
   virtual bool HasScriptContent();
-  virtual nsresult MaybeProcessScript();
 };
 
 
@@ -269,25 +263,6 @@ nsHTMLScriptElement::SetInnerHTML(const nsAString& aInnerHTML)
   return nsContentUtils::SetNodeTextContent(this, aInnerHTML, true);
 }
 
-nsresult
-nsHTMLScriptElement::DoneAddingChildren(bool aHaveNotified)
-{
-  mDoneAddingChildren = true;
-  nsresult rv = MaybeProcessScript();
-  if (!mAlreadyStarted) {
-    // Need to lose parser-insertedness here to allow another script to cause
-    // execution later.
-    LoseParserInsertedness();
-  }
-  return rv;
-}
-
-bool
-nsHTMLScriptElement::IsDoneAddingChildren()
-{
-  return mDoneAddingChildren;
-}
-
 // variation of this code in nsSVGScriptElement - check if changes
 // need to be transfered when modifying
 
@@ -342,14 +317,3 @@ nsHTMLScriptElement::HasScriptContent()
   return (mFrozen ? mExternal : HasAttr(kNameSpaceID_None, nsGkAtoms::src)) ||
          nsContentUtils::HasNonEmptyTextContent(this);
 }
-
-nsresult
-nsHTMLScriptElement::MaybeProcessScript()
-{
-  nsresult rv = nsScriptElement::MaybeProcessScript();
-  if (rv == NS_CONTENT_SCRIPT_IS_EVENTHANDLER)
-    // Don't return NS_CONTENT_SCRIPT_IS_EVENTHANDLER since callers can't deal
-    rv = NS_OK;
-
-  return rv;
-}

content/html/content/src/nsHTMLSelectElement.cpp

@@ -273,7 +273,7 @@ nsHTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
     // Actually select the options if the added options warrant it
     nsCOMPtr<nsIDOMNode> optionNode;
     nsCOMPtr<nsIDOMHTMLOptionElement> option;
-    for (PRInt32 i=aListIndex;i<insertIndex;i++) {
+    for (PRInt32 i = aListIndex; i < insertIndex; i++) {
       // Notify the frame that the option is added
       if (!didGetFrame || (selectFrame && !weakSelectFrame.IsAlive())) {
         selectFrame = GetSelectFrame();
@@ -326,7 +326,7 @@ nsHTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
     nsISelectControlFrame* selectFrame = GetSelectFrame();
     if (selectFrame) {
       nsAutoScriptBlocker scriptBlocker;
-      for (int i = aListIndex; i < aListIndex + numRemoved; ++i) {
+      for (PRInt32 i = aListIndex; i < aListIndex + numRemoved; ++i) {
         selectFrame->RemoveOption(i);
       }
     }
@@ -394,7 +394,7 @@ nsHTMLSelectElement::InsertOptionsIntoListRecurse(nsIContent* aOptions,
          child;
          child = child->GetNextSibling()) {
       nsresult rv = InsertOptionsIntoListRecurse(child,
-                                                 aInsertIndex, aDepth+1);
+                                                 aInsertIndex, aDepth + 1);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
@@ -438,7 +438,6 @@ nsHTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
     for (nsIContent* child = aOptions->GetFirstChild();
          child;
          child = child->GetNextSibling()) {
-
       nsresult rv = RemoveOptionsFromListRecurse(child,
                                                  aRemoveIndex,
                                                  aNumRemoved,
@@ -765,19 +764,15 @@ nsHTMLSelectElement::GetLength(PRUint32* aLength)
 NS_IMETHODIMP
 nsHTMLSelectElement::SetLength(PRUint32 aLength)
 {
-  nsresult rv=NS_OK;
-
   PRUint32 curlen;
-  PRUint32 i;
+  nsresult rv = GetLength(&curlen);
-
-  rv = GetLength(&curlen);
   if (NS_FAILED(rv)) {
     curlen = 0;
   }
 
   if (curlen > aLength) { // Remove extra options
-    for (i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
+    for (PRUint32 i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
-      rv = Remove(i-1);
+      rv = Remove(i - 1);
     }
   } else if (aLength > curlen) {
     if (aLength > MAX_DYNAMIC_SELECT_LENGTH) {
@@ -804,7 +799,7 @@ nsHTMLSelectElement::SetLength(PRUint32 aLength)
 
     nsCOMPtr<nsIDOMNode> node(do_QueryInterface(element));
 
-    for (i = curlen; i < aLength; i++) {
+    for (PRUint32 i = curlen; i < aLength; i++) {
       nsCOMPtr<nsIDOMNode> tmpNode;
 
       rv = AppendChild(node, getter_AddRefs(tmpNode));
@@ -892,7 +887,7 @@ nsHTMLSelectElement::OnOptionSelected(nsISelectControlFrame* aSelectFrame,
     mSelectedIndex = aIndex;
     SetSelectionChanged(true, aNotify);
   } else if (!aSelected && aIndex == mSelectedIndex) {
-    FindSelectedIndex(aIndex+1, aNotify);
+    FindSelectedIndex(aIndex + 1, aNotify);
   }
 
   if (aChangeOptionState) {
@@ -922,7 +917,7 @@ nsHTMLSelectElement::FindSelectedIndex(PRInt32 aStartIndex, bool aNotify)
   SetSelectionChanged(true, aNotify);
   PRUint32 len;
   GetLength(&len);
-  for (PRInt32 i=aStartIndex; i<(PRInt32)len; i++) {
+  for (PRInt32 i = aStartIndex; i < PRInt32(len); i++) {
     if (IsOptionSelectedByIndex(i)) {
       mSelectedIndex = i;
       SetSelectionChanged(true, aNotify);
@@ -1070,7 +1065,7 @@ nsHTMLSelectElement::SetOptionsSelectedByIndex(PRInt32 aStartIndex,
        || aStartIndex == -1)
        && previousSelectedIndex != -1) {
       for (PRInt32 optIndex = previousSelectedIndex;
-           optIndex < (PRInt32)numItems;
+           optIndex < PRInt32(numItems);
            optIndex++) {
         if (optIndex < aStartIndex || optIndex > aEndIndex) {
           nsIDOMHTMLOptionElement *option = mOptions->ItemAsOption(optIndex);
@@ -1232,42 +1227,35 @@ nsHTMLSelectElement::GetValue(nsAString& aValue)
     }
   }
 
-  aValue.Truncate(0);
+  aValue.Truncate();
   return rv;
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElement::SetValue(const nsAString& aValue)
 {
-  nsresult rv = NS_OK;
-
   PRUint32 length;
-  rv = GetLength(&length);
+  nsresult rv = GetLength(&length);
-  if (NS_SUCCEEDED(rv)) {
+  NS_ENSURE_SUCCESS(rv, rv);
-    PRUint32 i;
-    for (i = 0; i < length; i++) {
-      nsCOMPtr<nsIDOMNode> node;
 
-      rv = Item(i, getter_AddRefs(node));
+  for (PRUint32 i = 0; i < length; i++) {
+    nsCOMPtr<nsIDOMNode> node;
+    rv = Item(i, getter_AddRefs(node));
+    if (NS_FAILED(rv) || !node) {
+      continue;
+    }
 
-      if (NS_SUCCEEDED(rv) && node) {
+    nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
-        nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
+    if (!option) {
-
+      continue;
-        if (option) {
+    }
-          nsAutoString optionVal;
+    nsAutoString optionVal;
-
+    option->GetValue(optionVal);
-          option->GetValue(optionVal);
+    if (optionVal.Equals(aValue)) {
-
+      SetSelectedIndexInternal(PRInt32(i), true);
-          if (optionVal.Equals(aValue)) {
+      break;
-            SetSelectedIndexInternal((PRInt32)i, true);
-
-            break;
-          }
-        }
-      }
     }
   }
-
   return rv;
 }
 
@@ -1327,7 +1315,7 @@ nsHTMLSelectElement::SelectSomething(bool aNotify)
 
   PRUint32 count;
   GetLength(&count);
-  for (PRUint32 i=0; i<count; i++) {
+  for (PRUint32 i = 0; i < count; i++) {
     bool disabled;
     nsresult rv = IsOptionDisabled(i, &disabled);
 
@@ -1443,7 +1431,7 @@ nsHTMLSelectElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
   return rv;
 }
 
-nsresult
+void
 nsHTMLSelectElement::DoneAddingChildren(bool aHaveNotified)
 {
   mIsDoneAddingChildren = true;
@@ -1480,8 +1468,6 @@ nsHTMLSelectElement::DoneAddingChildren(bool aHaveNotified)
   }
 
   mDefaultSelectionSet = true;
-
-  return NS_OK;
 }
 
 bool
@@ -1627,9 +1613,6 @@ NS_IMETHODIMP
 nsHTMLSelectElement::SaveState()
 {
   nsRefPtr<nsSelectState> state = new nsSelectState();
-  if (!state) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
 
   PRUint32 len;
   GetLength(&len);
@@ -1699,7 +1682,7 @@ nsHTMLSelectElement::RestoreStateTo(nsSelectState* aNewSelected)
   SetOptionsSelectedByIndex(-1, -1, true, true, true, true, nsnull);
 
   // Next set the proper ones
-  for (PRInt32 i = 0; i < (PRInt32)len; i++) {
+  for (PRInt32 i = 0; i < PRInt32(len); i++) {
     nsIDOMHTMLOptionElement *option = mOptions->ItemAsOption(i);
     if (option) {
       nsAutoString value;
@@ -1709,8 +1692,6 @@ nsHTMLSelectElement::RestoreStateTo(nsSelectState* aNewSelected)
       }
     }
   }
-
-  //CheckSelectSomething();
 }
 
 NS_IMETHODIMP
@@ -1772,8 +1753,6 @@ static NS_DEFINE_CID(kFormProcessorCID, NS_FORMPROCESSOR_CID);
 NS_IMETHODIMP
 nsHTMLSelectElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   if (IsDisabled()) {
     return NS_OK;
@@ -1798,13 +1777,13 @@ nsHTMLSelectElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   nsCOMPtr<nsIFormProcessor> keyGenProcessor;
   if (GetAttr(kNameSpaceID_None, nsGkAtoms::_moz_type, mozType) &&
       mozType.EqualsLiteral("-mozilla-keygen")) {
-    keyGenProcessor = do_GetService(kFormProcessorCID, &rv);
+    keyGenProcessor = do_GetService(kFormProcessorCID);
   }
 
   for (PRUint32 optIndex = 0; optIndex < len; optIndex++) {
     // Don't send disabled options
     bool disabled;
-    rv = IsOptionDisabled(optIndex, &disabled);
+    nsresult rv = IsOptionDisabled(optIndex, &disabled);
     if (NS_FAILED(rv) || disabled) {
       continue;
     }
@@ -1847,7 +1826,9 @@ nsHTMLSelectElement::GetHasOptGroups(bool* aHasGroups)
   return NS_OK;
 }
 
-void nsHTMLSelectElement::DispatchContentReset() {
+void
+nsHTMLSelectElement::DispatchContentReset()
+{
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(false);
   if (formControlFrame) {
     // Only dispatch content reset notification if this is a list control
@@ -1898,20 +1879,18 @@ nsHTMLSelectElement::IsValueMissing()
   }
 
   PRUint32 length;
-  nsIDOMHTMLOptionElement* option = nsnull;
-  bool disabled;
-  bool selected;
-
   mOptions->GetLength(&length);
 
-  for (PRUint32 i=0; i<length; ++i) {
+  for (PRUint32 i = 0; i < length; ++i) {
-    option = mOptions->ItemAsOption(i);
+    nsIDOMHTMLOptionElement* option = mOptions->ItemAsOption(i);
+    bool selected;
     NS_ENSURE_SUCCESS(option->GetSelected(&selected), false);
 
     if (!selected) {
       continue;
     }
 
+    bool disabled;
     IsOptionDisabled(i, &disabled);
     if (disabled) {
       continue;
@@ -1935,28 +1914,21 @@ nsHTMLSelectElement::UpdateValueMissingValidityState()
 
 nsresult
 nsHTMLSelectElement::GetValidationMessage(nsAString& aValidationMessage,
-                                            ValidityStateType aType)
+                                          ValidityStateType aType)
 {
-  nsresult rv = NS_OK;
+  switch (aType) {
-
+    case VALIDITY_STATE_VALUE_MISSING: {
-  switch (aType)
+      nsXPIDLString message;
-  {
+      nsresult rv = nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-    case VALIDITY_STATE_VALUE_MISSING:
+                                                       "FormValidationSelectMissing",
-      {
+                                                       message);
-        nsXPIDLString message;
+      aValidationMessage = message;
-
+      return rv;
-        rv = nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
+    }
-                                                "FormValidationSelectMissing",
+    default: {
-                                                message);
+      return nsIConstraintValidation::GetValidationMessage(aValidationMessage, aType);
-
+    }
-        aValidationMessage = message;
-      }
-      break;
-    default:
-      rv = nsIConstraintValidation::GetValidationMessage(aValidationMessage, aType);
   }
-
-  return rv;
 }
 
 #ifdef DEBUG
@@ -2302,4 +2274,3 @@ nsHTMLSelectElement::SetSelectionChanged(bool aValue, bool aNotify)
     UpdateState(aNotify);
   }
 }
-

content/html/content/src/nsHTMLSelectElement.h

@@ -398,7 +398,7 @@ public:
   virtual nsresult UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                              bool aNotify);
   
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren() {
     return mIsDoneAddingChildren;
   }

content/html/content/src/nsHTMLSharedElement.cpp

@@ -382,8 +382,8 @@ nsHTMLSharedElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                              nsIAtom* aPrefix, const nsAString& aValue,
                              bool aNotify)
 {
-  nsresult rv =  nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
+  nsresult rv = nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
-                                               aValue, aNotify);
+                                              aValue, aNotify);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If the href attribute of a <base> tag is changing, we may need to update

content/html/content/src/nsHTMLSharedObjectElement.cpp

@@ -50,13 +50,6 @@
 #include "nsIDOMGetSVGDocument.h"
 #include "nsIDOMSVGDocument.h"
 
-// XXX this is to get around conflicts with windows.h defines
-// introduced through jni.h
-#ifdef XP_WIN
-#undef GetClassName
-#undef GetObject
-#endif
-
 using namespace mozilla;
 using namespace mozilla::dom;
 
@@ -127,7 +120,7 @@ public:
   virtual bool IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32 *aTabIndex);
   virtual PRUint32 GetDesiredIMEState();
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual bool ParseAttribute(PRInt32 aNamespaceID,
@@ -215,7 +208,7 @@ nsHTMLSharedObjectElement::IsDoneAddingChildren()
   return mIsDoneAddingChildren;
 }
 
-nsresult
+void
 nsHTMLSharedObjectElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!mIsDoneAddingChildren) {
@@ -227,8 +220,6 @@ nsHTMLSharedObjectElement::DoneAddingChildren(bool aHaveNotified)
       StartObjectLoad(aHaveNotified);
     }
   }
-
-  return NS_OK;
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLSharedObjectElement)

content/html/content/src/nsHTMLStyleElement.cpp

@@ -170,36 +170,24 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLStyleElement)
 NS_IMETHODIMP
 nsHTMLStyleElement::GetDisabled(bool* aDisabled)
 {
-  nsresult result = NS_OK;
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
-  
+  if (!ss) {
-  if (GetStyleSheet()) {
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
-
-    if (ss) {
-      result = ss->GetDisabled(aDisabled);
-    }
-  }
-  else {
     *aDisabled = false;
+    return NS_OK;
   }
 
-  return result;
+  return ss->GetDisabled(aDisabled);
 }
 
 NS_IMETHODIMP 
 nsHTMLStyleElement::SetDisabled(bool aDisabled)
 {
-  nsresult result = NS_OK;
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
-  
+  if (!ss) {
-  if (GetStyleSheet()) {
+    return NS_OK;
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
-
-    if (ss) {
-      result = ss->SetDisabled(aDisabled);
-    }
   }
 
-  return result;
+  return ss->SetDisabled(aDisabled);
 }
 
 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Media, media)
@@ -367,6 +355,4 @@ nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
   // If we get here we assume that we're loading a css file, so set the
   // type to 'text/css'
   aType.AssignLiteral("text/css");
-
-  return;
 }

content/html/content/src/nsHTMLTableCellElement.cpp

@@ -88,10 +88,9 @@ public:
 
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  // This does not return a nsresult since all we care about is if we
+  nsHTMLTableElement* GetTable() const;
-  // found the row element that this cell is in or not.
+
-  void GetRow(nsIDOMHTMLTableRowElement** aRow);
+  already_AddRefed<nsIDOMHTMLTableRowElement> GetRow() const;
-  nsIContent * GetTable();
 };
 
 
@@ -127,40 +126,40 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLTableCellElement)
 
 
 // protected method
-void
+already_AddRefed<nsIDOMHTMLTableRowElement>
-nsHTMLTableCellElement::GetRow(nsIDOMHTMLTableRowElement** aRow)
+nsHTMLTableCellElement::GetRow() const
 {
-  *aRow = nsnull;
+  nsCOMPtr<nsIDOMHTMLTableRowElement> row = do_QueryInterface(GetParent());
-
+  return row.forget();
-  nsCOMPtr<nsIDOMNode> rowNode;
-  GetParentNode(getter_AddRefs(rowNode));
-
-  if (rowNode) {
-    CallQueryInterface(rowNode, aRow);
-  }
 }
 
 // protected method
-nsIContent*
+nsHTMLTableElement*
-nsHTMLTableCellElement::GetTable()
+nsHTMLTableCellElement::GetTable() const
 {
-  nsIContent *result = nsnull;
-
   nsIContent *parent = GetParent();
-  if (parent) {  // GetParent() should be a row
+  if (!parent) {
-    nsIContent* section = parent->GetParent();
+    return nsnull;
-    if (section) {
-      if (section->IsHTML() &&
-          section->NodeInfo()->Equals(nsGkAtoms::table)) {
-        // XHTML, without a row group
-        result = section;
-      } else {
-        // we have a row group.
-        result = section->GetParent();
-      }
-    }
   }
-  return result;
+
+  // parent should be a row.
+  nsIContent* section = parent->GetParent();
+  if (!section) {
+    return nsnull;
+  }
+
+  if (section->IsHTML(nsGkAtoms::table)) {
+    // XHTML, without a row group.
+    return static_cast<nsHTMLTableElement*>(section);
+  }
+
+  // We have a row group.
+  nsIContent* result = section->GetParent();
+  if (result && result->IsHTML(nsGkAtoms::table)) {
+    return static_cast<nsHTMLTableElement*>(result);
+  }
+
+  return nsnull;
 }
 
 NS_IMETHODIMP
@@ -168,10 +167,7 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
 {
   *aCellIndex = -1;
 
-  nsCOMPtr<nsIDOMHTMLTableRowElement> row;
+  nsCOMPtr<nsIDOMHTMLTableRowElement> row = GetRow();
-
-  GetRow(getter_AddRefs(row));
-
   if (!row) {
     return NS_OK;
   }
@@ -187,16 +183,13 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
   PRUint32 numCells;
   cells->GetLength(&numCells);
 
-  bool found = false;
+  for (PRUint32 i = 0; i < numCells; i++) {
-  PRUint32 i;
-
-  for (i = 0; (i < numCells) && !found; i++) {
     nsCOMPtr<nsIDOMNode> node;
     cells->Item(i, getter_AddRefs(node));
 
     if (node.get() == static_cast<nsIDOMNode *>(this)) {
       *aCellIndex = i;
-      found = true;
+      break;
     }
   }
 
@@ -210,13 +203,12 @@ nsHTMLTableCellElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
   nsresult rv = nsGenericHTMLElement::WalkContentStyleRules(aRuleWalker);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsIContent* node = GetTable();
+  if (nsHTMLTableElement* table = GetTable()) {
-  if (node && node->IsHTML(nsGkAtoms::table)) {
-    nsHTMLTableElement* table = static_cast<nsHTMLTableElement*>(node);
     nsMappedAttributes* tableInheritedAttributes =
       table->GetAttributesMappedForCell();
-    if (tableInheritedAttributes)
+    if (tableInheritedAttributes) {
       aRuleWalker->Forward(tableInheritedAttributes);
+    }
   }
   return NS_OK;
 }
@@ -242,10 +234,7 @@ nsHTMLTableCellElement::GetAlign(nsAString& aValue)
 {
   if (!GetAttr(kNameSpaceID_None, nsGkAtoms::align, aValue)) {
     // There's no align attribute, ask the row for the alignment.
-
+    nsCOMPtr<nsIDOMHTMLTableRowElement> row = GetRow();
-    nsCOMPtr<nsIDOMHTMLTableRowElement> row;
-    GetRow(getter_AddRefs(row));
-
     if (row) {
       return row->GetAlign(aValue);
     }

content/html/content/src/nsHTMLTableElement.cpp

@@ -103,7 +103,7 @@ protected:
 TableRowsCollection::TableRowsCollection(nsHTMLTableElement *aParent)
   : mParent(aParent)
   , mOrphanRows(new nsContentList(mParent,
-                                  mParent->NodeInfo()->NamespaceID(),
+                                  kNameSpaceID_XHTML,
                                   nsGkAtoms::tr,
                                   nsGkAtoms::tr,
                                   false))
@@ -383,27 +383,23 @@ NS_IMPL_STRING_ATTR(nsHTMLTableElement, Summary, summary)
 NS_IMPL_STRING_ATTR(nsHTMLTableElement, Width, width)
 
 
+already_AddRefed<nsIDOMHTMLTableCaptionElement>
+nsHTMLTableElement::GetCaption()
+{
+  for (nsIContent* cur = nsINode::GetFirstChild(); cur; cur = cur->GetNextSibling()) {
+    nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption = do_QueryInterface(cur);
+    if (caption) {
+      return caption.forget();
+    }
+  }
+  return nsnull;
+}
+
 NS_IMETHODIMP
 nsHTMLTableElement::GetCaption(nsIDOMHTMLTableCaptionElement** aValue)
 {
-  *aValue = nsnull;
+  nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption = GetCaption();
-  nsCOMPtr<nsIDOMNode> child;
+  caption.forget(aValue);
-  GetFirstChild(getter_AddRefs(child));
-
-  while (child) {
-    nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption(do_QueryInterface(child));
-
-    if (caption) {
-      *aValue = caption;
-      NS_ADDREF(*aValue);
-
-      break;
-    }
-
-    nsIDOMNode *temp = child.get();
-    temp->GetNextSibling(getter_AddRefs(child));
-  }
-
   return NS_OK;
 }
 
@@ -425,22 +421,14 @@ nsHTMLTableElement::SetCaption(nsIDOMHTMLTableCaptionElement* aValue)
 already_AddRefed<nsIDOMHTMLTableSectionElement>
 nsHTMLTableElement::GetSection(nsIAtom *aTag)
 {
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
-
   for (nsIContent* child = nsINode::GetFirstChild();
        child;
        child = child->GetNextSibling()) {
-
+    nsCOMPtr<nsIDOMHTMLTableSectionElement> section = do_QueryInterface(child);
-    section = do_QueryInterface(child);
-
     if (section && child->NodeInfo()->Equals(aTag)) {
-      nsIDOMHTMLTableSectionElement *result = section;
+      return section.forget();
-      NS_ADDREF(result);
-
-      return result;
     }
   }
-
   return nsnull;
 }
 
@@ -536,7 +524,7 @@ nsHTMLTableElement::TBodies()
   if (!mTBodies) {
     // Not using NS_GetContentList because this should not be cached
     mTBodies = new nsContentList(this,
-                                 mNodeInfo->NamespaceID(),
+                                 kNameSpaceID_XHTML,
                                  nsGkAtoms::tbody,
                                  nsGkAtoms::tbody,
                                  false);
@@ -549,41 +537,34 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateTHead(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> head;
 
-  GetTHead(getter_AddRefs(head));
+  nsRefPtr<nsIDOMHTMLTableSectionElement> head = GetTHead();
-
+  if (head) {
-  if (head) { // return the existing thead
+    // return the existing thead
-    CallQueryInterface(head, aValue);
+    head.forget(aValue);
-
+    return NS_OK;
-    NS_ASSERTION(*aValue, "head must be a DOMHTMLElement");
-  }
-  else
-  { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::thead,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newHead = NS_NewHTMLTableSectionElement(nodeInfo.forget());
-
-    if (newHead) {
-      nsCOMPtr<nsIDOMNode> child;
-
-      rv = GetFirstChild(getter_AddRefs(child));
-
-      if (NS_FAILED(rv)) {
-        return rv;
-      }
-
-      CallQueryInterface(newHead, aValue);
-
-      nsCOMPtr<nsIDOMNode> resultChild;
-      rv = InsertBefore(*aValue, child, getter_AddRefs(resultChild));
-    }
   }
 
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::thead,
+                              getter_AddRefs(nodeInfo));
+
+  nsCOMPtr<nsIContent> newHead =
+    NS_NewHTMLTableSectionElement(nodeInfo.forget());
+
+  if (!newHead) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNode> child;
+  nsresult rv = GetFirstChild(getter_AddRefs(child));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIDOMHTMLElement> newHeadAsDOMElement = do_QueryInterface(newHead);
+
+  nsCOMPtr<nsIDOMNode> resultChild;
+  InsertBefore(newHeadAsDOMElement, child, getter_AddRefs(resultChild));
+  newHeadAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -606,30 +587,26 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateTFoot(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> foot;
 
-  GetTFoot(getter_AddRefs(foot));
+  nsRefPtr<nsIDOMHTMLTableSectionElement> foot = GetTFoot();
-
+  if (foot) {
-  if (foot) { // return the existing tfoot
+    // return the existing tfoot
-    CallQueryInterface(foot, aValue);
+    foot.forget(aValue);
-
+    return NS_OK;
-    NS_ASSERTION(*aValue, "foot must be a DOMHTMLElement");
   }
-  else
+  // create a new foot rowgroup
-  { // create a new foot rowgroup
+  nsCOMPtr<nsINodeInfo> nodeInfo;
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tfoot,
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tfoot,
+                              getter_AddRefs(nodeInfo));
-                                getter_AddRefs(nodeInfo));
 
-    nsCOMPtr<nsIContent> newFoot = NS_NewHTMLTableSectionElement(nodeInfo.forget());
+  nsCOMPtr<nsIContent> newFoot = NS_NewHTMLTableSectionElement(nodeInfo.forget());
 
-    if (newFoot) {
+  if (!newFoot) {
-      rv = AppendChildTo(newFoot, true);
+    return NS_OK;
-      CallQueryInterface(newFoot, aValue);
-    }
   }
-
+  AppendChildTo(newFoot, true);
+  nsCOMPtr<nsIDOMHTMLElement> newFootAsDOMElement = do_QueryInterface(newFoot);
+  newFootAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -652,30 +629,28 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateCaption(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption;
 
-  GetCaption(getter_AddRefs(caption));
+  if (nsRefPtr<nsIDOMHTMLTableCaptionElement> caption = GetCaption()) {
-
+    // return the existing caption
-  if (caption) { // return the existing thead
+    caption.forget(aValue);
-    CallQueryInterface(caption, aValue);
+    return NS_OK;
-
-    NS_ASSERTION(*aValue, "caption must be a DOMHTMLElement");
-  }
-  else
-  { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::caption,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newCaption = NS_NewHTMLTableCaptionElement(nodeInfo.forget());
-
-    if (newCaption) {
-      rv = AppendChildTo(newCaption, true);
-      CallQueryInterface(newCaption, aValue);
-    }
   }
 
+  // create a new head rowgroup
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::caption,
+                              getter_AddRefs(nodeInfo));
+
+  nsCOMPtr<nsIContent> newCaption = NS_NewHTMLTableCaptionElement(nodeInfo.forget());
+
+  if (!newCaption) {
+    return NS_OK;
+  }
+
+  AppendChildTo(newCaption, true);
+  nsCOMPtr<nsIDOMHTMLElement> captionAsDOMElement =
+    do_QueryInterface(newCaption);
+  captionAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -710,8 +685,6 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsresult rv;
-
   nsCOMPtr<nsIDOMHTMLCollection> rows;
   GetRows(getter_AddRefs(rows));
 
@@ -725,6 +698,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
   // use local variable refIndex so we can remember original aIndex
   PRUint32 refIndex = (PRUint32)aIndex;
 
+  nsresult rv;
   if (rowCount > 0) {
     if (refIndex == rowCount || aIndex == -1) {
       // we set refIndex to the last row so we can get the last row's
@@ -766,19 +740,17 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
         CallQueryInterface(retChild, aValue);
       }
     }
-  }
+  } else {
-  else
+    // the row count was 0, so 
-  { // the row count was 0, so 
     // find the first row group and insert there as first child
     nsCOMPtr<nsIDOMNode> rowGroup;
 
-    PRInt32 namespaceID = mNodeInfo->NamespaceID();
     for (nsIContent* child = nsINode::GetFirstChild();
          child;
          child = child->GetNextSibling()) {
       nsINodeInfo *childInfo = child->NodeInfo();
       nsIAtom *localName = childInfo->NameAtom();
-      if (childInfo->NamespaceID() == namespaceID &&
+      if (childInfo->NamespaceID() == kNameSpaceID_XHTML &&
           (localName == nsGkAtoms::thead ||
            localName == nsGkAtoms::tbody ||
            localName == nsGkAtoms::tfoot)) {

content/html/content/src/nsHTMLTableElement.h

@@ -100,6 +100,7 @@ public:
   already_AddRefed<nsIDOMHTMLTableSectionElement> GetTFoot() {
     return GetSection(nsGkAtoms::tfoot);
   }
+  already_AddRefed<nsIDOMHTMLTableCaptionElement> GetCaption();
   nsContentList* TBodies();
 protected:
   already_AddRefed<nsIDOMHTMLTableSectionElement> GetSection(nsIAtom *aTag);

content/html/content/src/nsHTMLTableRowElement.cpp

@@ -134,15 +134,10 @@ nsresult
 nsHTMLTableRowElement::GetSection(nsIDOMHTMLTableSectionElement** aSection)
 {
   NS_ENSURE_ARG_POINTER(aSection);
-  *aSection = nsnull;
+  nsCOMPtr<nsIDOMHTMLTableSectionElement> section =
-
+    do_QueryInterface(GetParent());
-  nsCOMPtr<nsIDOMNode> sectionNode;
+  section.forget(aSection);
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
+  return NS_OK;
-  if (NS_SUCCEEDED(rv) && sectionNode) {
-    rv = CallQueryInterface(sectionNode, aSection);
-  }
-
-  return rv;
 }
 
 // protected method
@@ -152,25 +147,25 @@ nsHTMLTableRowElement::GetTable(nsIDOMHTMLTableElement** aTable)
   NS_ENSURE_ARG_POINTER(aTable);
   *aTable = nsnull;
 
-  nsCOMPtr<nsIDOMNode> sectionNode;
+  nsIContent* parent = GetParent();
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
+  if (!parent) {
-  if (!sectionNode) {
+    return NS_OK;
-    return rv;
   }
 
   // We may not be in a section
-  rv = CallQueryInterface(sectionNode, aTable);
+  nsCOMPtr<nsIDOMHTMLTableElement> table = do_QueryInterface(parent);
-  if (NS_SUCCEEDED(rv)) {
+  if (table) {
-    return rv;
+    table.forget(aTable);
+    return NS_OK;
   }
 
-  nsCOMPtr<nsIDOMNode> tableNode;
+  parent = parent->GetParent();
-  rv = sectionNode->GetParentNode(getter_AddRefs(tableNode));
+  if (!parent) {
-  if (!tableNode) {
+    return NS_OK;
-    return rv;
   }
-  
+  table = do_QueryInterface(parent);
-  return CallQueryInterface(tableNode, aTable);
+  table.forget(aTable);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -178,62 +173,46 @@ nsHTMLTableRowElement::GetRowIndex(PRInt32* aValue)
 {
   *aValue = -1;
   nsCOMPtr<nsIDOMHTMLTableElement> table;
-
+  nsresult rv = GetTable(getter_AddRefs(table));
-  nsresult result = GetTable(getter_AddRefs(table));
+  if (NS_FAILED(rv) || !table) {
-
+    return rv;
-  if (NS_SUCCEEDED(result) && table) {
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
-
-    table->GetRows(getter_AddRefs(rows));
-
-    PRUint32 numRows;
-    rows->GetLength(&numRows);
-
-    bool found = false;
-
-    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
-        *aValue = i;
-        found = true;
-      }
-    }
   }
 
-  return result;
+  nsCOMPtr<nsIDOMHTMLCollection> rows;
+  table->GetRows(getter_AddRefs(rows));
+
+  PRUint32 numRows;
+  rows->GetLength(&numRows);
+
+  for (PRUint32 i = 0; i < numRows; i++) {
+    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
+      *aValue = i;
+      break;
+    }
+  }
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLTableRowElement::GetSectionRowIndex(PRInt32* aValue)
 {
   *aValue = -1;
-
   nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
+  nsresult rv = GetSection(getter_AddRefs(section));
+  if (NS_FAILED(rv) || !section) {
+    return rv;
+  }
 
-  nsresult result = GetSection(getter_AddRefs(section));
+  nsCOMPtr<nsIDOMHTMLCollection> rows;
+  section->GetRows(getter_AddRefs(rows));
 
-  if (NS_SUCCEEDED(result) && section) {
+  PRUint32 numRows;
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
+  rows->GetLength(&numRows);
-
+  for (PRUint32 i = 0; i < numRows; i++) {
-    section->GetRows(getter_AddRefs(rows));
+    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
-
+      *aValue = i;
-    bool found = false;
+      break;
-    PRUint32 numRows;
+    }
-
-    rows->GetLength(&numRows);
-
-    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
-        *aValue = i;
-        found = true;
-      }
-    } 
   }
 
   return NS_OK;
@@ -261,8 +240,6 @@ nsHTMLTableRowElement::GetCells(nsIDOMHTMLCollection** aValue)
                                nsnull,
                                kNameSpaceID_XHTML,
                                false);
-
-    NS_ENSURE_TRUE(mCells, NS_ERROR_OUT_OF_MEMORY);
   }
 
   NS_ADDREF(*aValue = mCells);
@@ -470,4 +447,3 @@ nsHTMLTableRowElement::GetAttributeMappingFunction() const
 {
   return &MapAttributesIntoRule;
 }
-

content/html/content/src/nsHTMLTableSectionElement.cpp

@@ -135,16 +135,12 @@ NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, ChOff, charoff)
 NS_IMETHODIMP
 nsHTMLTableSectionElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
-  *aValue = nsnull;
-
   if (!mRows) {
     mRows = new nsContentList(this,
                               mNodeInfo->NamespaceID(),
                               nsGkAtoms::tr,
                               nsGkAtoms::tr,
                               false);
-
-    NS_ENSURE_TRUE(mRows, NS_ERROR_OUT_OF_MEMORY);
   }
 
   NS_ADDREF(*aValue = mRows);

content/html/content/src/nsHTMLTextAreaElement.cpp

@@ -201,7 +201,7 @@ public:
 
   virtual bool IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32 *aTabIndex);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
@@ -775,7 +775,7 @@ nsHTMLTextAreaElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
   return NS_OK;
 }
 
-nsresult
+void
 nsHTMLTextAreaElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!mValueChanged) {
@@ -790,8 +790,6 @@ nsHTMLTextAreaElement::DoneAddingChildren(bool aHaveNotified)
   }
 
   mDoneAddingChildren = true;
-
-  return NS_OK;
 }
 
 bool
@@ -1037,8 +1035,6 @@ nsHTMLTextAreaElement::Reset()
 NS_IMETHODIMP
 nsHTMLTextAreaElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   if (IsDisabled()) {
     return NS_OK;
@@ -1062,9 +1058,7 @@ nsHTMLTextAreaElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   //
   // Submit
   //
-  rv = aFormSubmission->AddNameValuePair(name, value);
+  return aFormSubmission->AddNameValuePair(name, value);
-
-  return rv;
 }
 
 NS_IMETHODIMP
@@ -1086,8 +1080,8 @@ nsHTMLTextAreaElement::SaveState()
                nsLinebreakConverter::eLinebreakContent);
       NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
 
-      nsCOMPtr<nsISupportsString> pState
+      nsCOMPtr<nsISupportsString> pState =
-        (do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+        do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID);
       if (!pState) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
@@ -1309,7 +1303,7 @@ nsHTMLTextAreaElement::CopyInnerTo(nsGenericElement* aDest) const
 
   if (aDest->OwnerDoc()->IsStaticDocument()) {
     nsAutoString value;
-    const_cast<nsHTMLTextAreaElement*>(this)->GetValue(value);
+    GetValueInternal(value, true);
     static_cast<nsHTMLTextAreaElement*>(aDest)->SetValue(value);
   }
   return NS_OK;
@@ -1569,4 +1563,3 @@ nsHTMLTextAreaElement::FieldSetDisabledChanged(bool aNotify)
 
   nsGenericHTMLFormElement::FieldSetDisabledChanged(aNotify);
 }
-

content/html/content/src/nsHTMLTitleElement.cpp

@@ -84,7 +84,7 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsXPCClassInfo* GetClassInfo();
 private:
@@ -200,13 +200,12 @@ nsHTMLTitleElement::UnbindFromTree(bool aDeep, bool aNullParent)
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 }
 
-nsresult
+void
 nsHTMLTitleElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!aHaveNotified) {
     SendTitleChangeEvent(false);
   }
-  return NS_OK;
 }
 
 void

content/html/content/src/nsHTMLVideoElement.cpp

@@ -165,22 +165,22 @@ nsHTMLVideoElement::GetAttributeMappingFunction() const
 
 nsresult nsHTMLVideoElement::SetAcceptHeader(nsIHttpChannel* aChannel)
 {
-    nsCAutoString value(
+  nsCAutoString value(
 #ifdef MOZ_WEBM
-        "video/webm,"
+      "video/webm,"
 #endif
 #ifdef MOZ_OGG
-        "video/ogg,"
+      "video/ogg,"
 #endif
-        "video/*;q=0.9,"
+      "video/*;q=0.9,"
 #ifdef MOZ_OGG
-        "application/ogg;q=0.7,"
+      "application/ogg;q=0.7,"
 #endif
-        "audio/*;q=0.6,*/*;q=0.5");
+      "audio/*;q=0.6,*/*;q=0.5");
 
-    return aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept"),
+  return aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept"),
-                                      value,
+                                    value,
-                                      false);
+                                    false);
 }
 
 NS_IMPL_URI_ATTR(nsHTMLVideoElement, Poster, poster)

content/html/content/test/Makefile.in

@@ -270,6 +270,7 @@ _TEST_FILES = \
 		test_bug664299.html \
 		test_bug666200.html \
 		test_bug666666.html \
+		test_bug669012.html \
 		test_bug674558.html \
 		test_bug583533.html \
 		test_restore_from_parser_fragment.html \

content/html/content/test/test_bug669012.html

@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=669012
+-->
+<head>
+  <title>Test for Bug 669012</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=669012">Mozilla Bug 669012</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<script>
+var run = 0;
+</script>
+<svg>
+<script>
+run++;
+ok(true, "Should run SVG script without attributes")
+</script>
+<script for=window event=onload>
+run++;
+ok(true, "Should run SVG script with for=window event=onload")
+</script>
+<script for=window event=foo>
+run++;
+ok(true, "Should run SVG script with for=window event=foo")
+</script>
+<script for=foo event=onload>
+run++;
+ok(true, "Should run SVG script with for=foo event=onload")
+</script>
+</svg>
+</div>
+<pre id="test">
+<script type="application/javascript">
+/** Test for Bug 669012 **/
+is(run, 4, "Should have run all tests")
+</script>
+</pre>
+</body>
+</html>

content/html/document/src/nsHTMLContentSink.cpp

@@ -2800,20 +2800,18 @@ HTMLContentSink::ProcessSCRIPTEndTag(nsGenericHTMLElement *content,
   mHTMLDocument->ScriptLoading(sele);
 
   // Now tell the script that it's ready to go. This may execute the script
-  // or return NS_ERROR_HTMLPARSER_BLOCK. Or neither if the script doesn't
+  // or return true, or neither if the script doesn't need executing.
-  // need executing.
+  bool block = sele->AttemptToExecute();
-  nsresult rv = content->DoneAddingChildren(true);
 
   // If the act of insertion evaluated the script, we're fine.
   // Else, block the parser till the script has loaded.
-  if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
+  if (block) {
     // If this append fails we'll never unblock the parser, but the UI will
     // still remain responsive. There are other ways to deal with this, but
     // the end result is always that the page gets botched, so there is no
     // real point in making it more complicated.
     mScriptElements.AppendObject(sele);
-  }
+  } else {
-  else {
     // This may have already happened if the script executed, but in case
     // it didn't then remove the element so that it doesn't get stuck forever.
     mHTMLDocument->ScriptExecuted(sele);
@@ -2822,10 +2820,10 @@ HTMLContentSink::ProcessSCRIPTEndTag(nsGenericHTMLElement *content,
   // If the parser got blocked, make sure to return the appropriate rv.
   // I'm not sure if this is actually needed or not.
   if (mParser && !mParser->IsParserEnabled()) {
-    rv = NS_ERROR_HTMLPARSER_BLOCK;
+    block = true;
   }
 
-  return rv;
+  return block ? NS_ERROR_HTMLPARSER_BLOCK : NS_OK;
 }
 
 // 3 ways to load a style sheet: inline, style src=, link tag

content/html/document/src/nsHTMLDocument.cpp

@@ -950,10 +950,8 @@ nsHTMLDocument::StartDocumentLoad(const char* aCommand,
 
   // Set the parser as the stream listener for the document loader...
   if (mParser) {
-    rv = mParser->GetStreamListener(aDocListener);
+    nsCOMPtr<nsIStreamListener> listener = mParser->GetStreamListener();
-    if (NS_FAILED(rv)) {
+    listener.forget(aDocListener);
-      return rv;
-    }
 
 #ifdef DEBUG_charset
     printf(" charset = %s source %d\n",

content/smil/crashtests/691337-1.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill"
+      begin="999999999999999999999999999999999999999999999999999999999999999999999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>

content/smil/crashtests/691337-2.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill" id="a"
+      begin="4999999999999999" dur="5s" from="blue" to="red"
+      repeatCount="indefinite" additive="sum"/>
+    <animate attributeName="fill"
+      begin="a.begin+4999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>

content/smil/crashtests/crashtests.list

@@ -43,5 +43,7 @@ load 678822-1.svg
 load 678847-1.svg
 load 678938-1.svg
 load 690994-1.svg
+load 691337-1.svg
+load 691337-2.svg
 load 697640-1.svg
 load 699325-1.svg

content/smil/nsSMILParserUtils.cpp

@@ -730,7 +730,6 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
   PRUint8 colonCount = 0;
 
   bool started = false;
-  bool isValid = true;
 
   PRInt32 metricMultiplicand = MSEC_PER_SEC;
 
@@ -759,16 +758,14 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
 
     } else if ((aFlags & kClockValueAllowSign)
                && (*start == '+' || *start == '-')) {
+      // check sign has not already been set
       if (sign != 0) {
-        // sign has already been set
+        return NS_ERROR_FAILURE;
-        isValid = false;
-        break;
       }
 
+      // check sign is not in middle of string
       if (started) {
-        // sign appears in the middle of the string
+        return NS_ERROR_FAILURE;
-        isValid = false;
-        break;
       }
 
       sign = (*start == '+') ? 1 : -1;
@@ -778,10 +775,8 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
       prevNumCouldBeMin = numCouldBeMin;
 
       if (!ParseClockComponent(start, end, component, numIsReal, numCouldBeMin,
-                               numCouldBeSec)) {
+                               numCouldBeSec))
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
-      }
 
       started = true;
     } else if (*start == ':') {
@@ -789,31 +784,27 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
 
       // Neither minutes nor hours can be reals
       if (numIsReal) {
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
       }
 
       // Clock value can't start with a ':'
       if (!started) {
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
       }
 
       // Can't have more than two colons
       if (colonCount > 2) {
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
       }
 
       // Multiply the offset by 60 and add the last accumulated component
-      offset = offset * 60 + PRInt64(component);
+      offset = offset * 60 + nsSMILTime(component);
 
       component = 0.0;
       ++start;
     } else if (NS_IS_ALPHA(*start)) {
       if (colonCount > 0) {
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
       }
 
       if ((aFlags & kClockValueAllowIndefinite)
@@ -828,68 +819,68 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
       } else if (aIsMedia && ConsumeSubstring(start, end, "media")) {
         *aIsMedia = true;
       } else if (!ParseMetricMultiplicand(start, end, metricMultiplicand)) {
-        isValid = false;
+        return NS_ERROR_FAILURE;
-        break;
       }
 
       // Nothing must come after the string except whitespace
       break;
     } else {
-      isValid = false;
+      return NS_ERROR_FAILURE;
-      break;
     }
   }
 
   if (!started) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
   // Process remainder of string (if any) to ensure it is only trailing
   // whitespace (embedded whitespace is not allowed)
   SkipBeginWsp(start, end);
   if (start != end) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
   // No more processing required if the value was "indefinite" or "media".
-  if (isIndefinite || (aIsMedia && *aIsMedia))
+  if (isIndefinite || (aIsMedia && *aIsMedia)) {
     return NS_OK;
+  }
 
   // If there is more than one colon then the previous component must be a
   // correctly formatted minute (i.e. two digits between 00 and 59) and the
   // latest component must be a correctly formatted second (i.e. two digits
   // before the .)
   if (colonCount > 0 && (!prevNumCouldBeMin || !numCouldBeSec)) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
-  if (isValid) {
+  // Tack on the last component
-    // Tack on the last component
+  if (colonCount > 0) {
-    if (colonCount > 0) {
+    offset = offset * 60 * 1000;
-      offset = offset * 60 * 1000;
+    component *= 1000;
-      component *= 1000;
+    // rounding
-      // rounding
+    component = (component >= 0) ? component + 0.5 : component - 0.5;
-      component = (component >= 0) ? component + 0.5 : component - 0.5;
+    offset += nsSMILTime(component);
-      offset += PRInt64(component);
+  } else {
-    } else {
+    component *= metricMultiplicand;
-      component *= metricMultiplicand;
+    // rounding
-      // rounding
+    component = (component >= 0) ? component + 0.5 : component - 0.5;
-      component = (component >= 0) ? component + 0.5 : component - 0.5;
+    offset = nsSMILTime(component);
-      offset = PRInt64(component);
-    }
-
-    if (aResult) {
-      nsSMILTime millis = offset;
-
-      if (sign == -1) {
-        millis = -offset;
-      }
-
-      aResult->SetMillis(millis);
-    }
   }
 
-  return (isValid) ? NS_OK : NS_ERROR_FAILURE;
+  // we haven't applied the sign yet so if the result is negative we must have
+  // overflowed
+  if (offset < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (aResult) {
+    if (sign == -1) {
+      offset = -offset;
+    }
+    aResult->SetMillis(offset);
+  }
+
+  return NS_OK;
 }
 
 PRInt32

content/smil/nsSMILTimeValueSpec.cpp

@@ -48,6 +48,7 @@
 #include "nsGUIEvent.h"
 #include "nsIDOMTimeEvent.h"
 #include "nsString.h"
+#include <limits>
 
 using namespace mozilla::dom;
 
@@ -182,8 +183,9 @@ nsSMILTimeValueSpec::HandleNewInterval(nsSMILInterval& aInterval,
     ConvertBetweenTimeContainers(baseInstance.Time(), aSrcContainer);
 
   // Apply offset
-  if (newTime.IsDefinite()) {
+  if (!ApplyOffset(newTime)) {
-    newTime.SetMillis(newTime.GetMillis() + mParams.mOffset.GetMillis());
+    NS_WARNING("New time overflows nsSMILTime, ignoring");
+    return;
   }
 
   // Create the instance time and register it with the interval
@@ -218,9 +220,9 @@ nsSMILTimeValueSpec::HandleChangedInstanceTime(
     ConvertBetweenTimeContainers(aBaseTime.Time(), aSrcContainer);
 
   // Apply offset
-  if (updatedTime.IsDefinite()) {
+  if (!ApplyOffset(updatedTime)) {
-    updatedTime.SetMillis(updatedTime.GetMillis() +
+    NS_WARNING("Updated time overflows nsSMILTime, ignoring");
-                          mParams.mOffset.GetMillis());
+    return;
   }
 
   // The timed element that owns the instance time does the updating so it can
@@ -339,7 +341,7 @@ nsSMILTimeValueSpec::RegisterEventListener(Element* aTarget)
   nsEventListenerManager* elm = GetEventListenerManager(aTarget);
   if (!elm)
     return;
-  
+
   elm->AddEventListenerByType(mEventListener,
                               nsDependentAtomString(mParams.mEventSymbol),
                               NS_EVENT_FLAG_BUBBLE |
@@ -407,7 +409,11 @@ nsSMILTimeValueSpec::HandleEvent(nsIDOMEvent* aEvent)
     return;
 
   nsSMILTime currentTime = container->GetCurrentTime();
-  nsSMILTimeValue newTime(currentTime + mParams.mOffset.GetMillis());
+  nsSMILTimeValue newTime(currentTime);
+  if (!ApplyOffset(newTime)) {
+    NS_WARNING("New time generated from event overflows nsSMILTime, ignoring");
+    return;
+  }
 
   nsRefPtr<nsSMILInstanceTime> newInstance =
     new nsSMILInstanceTime(newTime, nsSMILInstanceTime::SOURCE_EVENT);
@@ -535,3 +541,21 @@ nsSMILTimeValueSpec::ConvertBetweenTimeContainers(
 
   return dstContainer->ParentToContainerTime(docTime.GetMillis());
 }
+
+bool
+nsSMILTimeValueSpec::ApplyOffset(nsSMILTimeValue& aTime) const
+{
+  // indefinite + offset = indefinite. Likewise for unresolved times.
+  if (!aTime.IsDefinite()) {
+    return true;
+  }
+
+  double resultAsDouble =
+    (double)aTime.GetMillis() + mParams.mOffset.GetMillis();
+  if (resultAsDouble > std::numeric_limits<nsSMILTime>::max() ||
+      resultAsDouble < std::numeric_limits<nsSMILTime>::min()) {
+    return false;
+  }
+  aTime.SetMillis(aTime.GetMillis() + mParams.mOffset.GetMillis());
+  return true;
+}

content/smil/nsSMILTimeValueSpec.h

@@ -102,6 +102,7 @@ protected:
   bool CheckAccessKeyEventDetail(nsIDOMEvent* aEvent);
   nsSMILTimeValue ConvertBetweenTimeContainers(const nsSMILTimeValue& aSrcTime,
                                       const nsSMILTimeContainer* aSrcContainer);
+  bool ApplyOffset(nsSMILTimeValue& aTime) const;
 
   nsSMILTimedElement*           mOwner;
   bool                          mIsBegin; // Indicates if *we* are a begin spec,

content/smil/nsSMILTimedElement.cpp

@@ -1888,9 +1888,9 @@ nsSMILTimedElement::ActiveTimeToSimpleTime(nsSMILTime aActiveTime,
 {
   nsSMILTime result;
 
-  NS_ASSERTION(mSimpleDur.IsResolved(),
+  NS_ABORT_IF_FALSE(mSimpleDur.IsResolved(),
       "Unresolved simple duration in ActiveTimeToSimpleTime");
-  NS_ASSERTION(aActiveTime >= 0, "Expecting non-negative active time");
+  NS_ABORT_IF_FALSE(aActiveTime >= 0, "Expecting non-negative active time");
   // Note that a negative aActiveTime will give us a negative value for
   // aRepeatIteration, which is bad because aRepeatIteration is unsigned
 

content/smil/test/test_smilDynamicDelayedBeginElement.xhtml

@@ -28,7 +28,15 @@ const INITIAL_VAL = "500px"
 const FROM_VAL = "20px";
 const TO_VAL   = "80px";
 
-// Helper function
+// Helper functions
+
+// This function allows 10ms to pass
+function allowTimeToPass() {
+  var initialDate = new Date();
+  while (new Date() - initialDate < 10) {}
+}
+
+// This function returns a newly created <animate> element for use in this test
 function createAnim() {
   var a = document.createElementNS('http://www.w3.org/2000/svg', 'animate');
   a.setAttribute('attributeName', 'width');
@@ -50,13 +58,18 @@ function main() {
 
   // In unpatched Firefox builds, we'll only trigger Bug 699143 if we insert
   // an animation and call beginElement() **after** the document start-time.
-  // Hence, we use executeSoon here to allow some time to pass.
+  // Hence, we use executeSoon here to allow some time to pass.  (And then
+  // we'll use a short busy-loop, for good measure.)
   SimpleTest.executeSoon(runTest);
 }
 
 function runTest() {
   var svg = SMILUtil.getSVGRoot();
 
+  // In case our executeSoon fired immediately, we force a very small amount
+  // of time to pass here, using a 10ms busy-loop.
+  allowTimeToPass();
+
   is(svg.getCurrentTime(), 0,
      "even though we've allowed time to pass, we shouldn't have bothered " +
      "updating the current time, since there aren't any animation elements");

content/svg/content/src/nsSVGScriptElement.cpp

@@ -94,8 +94,6 @@ public:
   virtual void DidChangeString(PRUint8 aAttrEnum);
 
   // nsIContent specializations:
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
-  virtual bool IsDoneAddingChildren();
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers);
@@ -274,25 +272,6 @@ nsSVGScriptElement::GetStringInfo()
 //----------------------------------------------------------------------
 // nsIContent methods
 
-nsresult
-nsSVGScriptElement::DoneAddingChildren(bool aHaveNotified)
-{
-  mDoneAddingChildren = true;
-  nsresult rv = MaybeProcessScript();
-  if (!mAlreadyStarted) {
-    // Need to lose parser-insertedness here to allow another script to cause
-    // execution later.
-    LoseParserInsertedness();
-  }
-  return rv;
-}
-
-bool
-nsSVGScriptElement::IsDoneAddingChildren()
-{
-  return mDoneAddingChildren;
-}
-
 nsresult
 nsSVGScriptElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                nsIContent* aBindingParent,

content/svg/content/src/nsSVGTitleElement.cpp

@@ -77,7 +77,7 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsXPCClassInfo* GetClassInfo();
 private:
@@ -180,13 +180,12 @@ nsSVGTitleElement::UnbindFromTree(bool aDeep, bool aNullParent)
   nsSVGTitleElementBase::UnbindFromTree(aDeep, aNullParent);
 }
 
-nsresult
+void
 nsSVGTitleElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!aHaveNotified) {
     SendTitleChangeEvent(false);
   }
-  return NS_OK;
 }
 
 void

content/xbl/src/nsXBLBinding.cpp

@@ -1208,19 +1208,17 @@ nsresult
 nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                             const nsAFlatCString& aClassName,
                             nsXBLPrototypeBinding* aProtoBinding,
-                            void **aClassObject)
+                            JSObject** aClassObject)
 {
   // First ensure our JS class is initialized.
-  jsval val;
-  JSObject* proto = NULL;
-
   nsCAutoString className(aClassName);
   JSObject* parent_proto = nsnull;  // If we have an "obj" we can set this
   JSAutoRequest ar(cx);
 
   JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, global))
+  if (!ac.enter(cx, global)) {
-      return NS_ERROR_FAILURE;
+    return NS_ERROR_FAILURE;
+  }
 
   if (obj) {
     // Retrieve the current prototype of obj.
@@ -1246,6 +1244,8 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
     }
   }
 
+  jsval val;
+  JSObject* proto = NULL;
   if ((!::JS_LookupPropertyWithFlags(cx, global, className.get(),
                                      JSRESOLVE_CLASSNAME,
                                      &val)) ||
@@ -1336,7 +1336,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
-    *aClassObject = (void*)proto;
+    *aClassObject = proto;
   }
   else {
     proto = JSVAL_TO_OBJECT(val);

content/xbl/src/nsXBLBinding.h

@@ -146,7 +146,7 @@ public:
   static nsresult DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                                 const nsAFlatCString& aClassName,
                                 nsXBLPrototypeBinding* aProtoBinding,
-                                void **aClassObject);
+                                JSObject** aClassObject);
 
   bool AllowScripts();  // XXX make const
 

content/xbl/src/nsXBLDocumentInfo.cpp

@@ -311,9 +311,7 @@ nsXBLDocGlobalObject::EnsureScriptEnvironment(PRUint32 aLangID)
   nsCOMPtr<nsIScriptRuntime> scriptRuntime;
   rv = NS_GetScriptRuntimeByID(aLangID, getter_AddRefs(scriptRuntime));
   NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIScriptContext> newCtx;
+  nsCOMPtr<nsIScriptContext> newCtx = scriptRuntime->CreateContext();
-  rv = scriptRuntime->CreateContext(getter_AddRefs(newCtx));
-  NS_ENSURE_SUCCESS(rv, rv);
   rv = SetScriptContext(aLangID, newCtx);
 
   JSContext *cx = mScriptContext->GetNativeContext();

content/xbl/src/nsXBLProtoImpl.cpp

@@ -95,7 +95,7 @@ nsXBLProtoImpl::InstallImplementation(nsXBLPrototypeBinding* aBinding, nsIConten
   // This function also has the side effect of building up the prototype implementation if it has
   // not been built already.
   nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-  void * targetClassObject = nsnull;
+  JSObject* targetClassObject = nsnull;
   nsresult rv = InitTargetObjects(aBinding, context, aBoundElement,
                                   getter_AddRefs(holder), &targetClassObject);
   NS_ENSURE_SUCCESS(rv, rv); // kick out if we were unable to properly intialize our target objects
@@ -122,7 +122,7 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
                                   nsIScriptContext* aContext, 
                                   nsIContent* aBoundElement, 
                                   nsIXPConnectJSObjectHolder** aScriptObjectHolder, 
-                                  void** aTargetClassObject)
+                                  JSObject** aTargetClassObject)
 {
   nsresult rv = NS_OK;
   *aScriptObjectHolder = nsnull;
@@ -161,8 +161,9 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
   // object's old base class becomes the new class' base class.
   rv = aBinding->InitClass(mClassName, jscontext, global, JSVAL_TO_OBJECT(v),
                            aTargetClassObject);
-  if (NS_FAILED(rv))
+  if (NS_FAILED(rv)) {
     return rv;
+  }
 
   nsContentUtils::PreserveWrapper(aBoundElement, aBoundElement);
 
@@ -189,13 +190,13 @@ nsXBLProtoImpl::CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding)
   JSObject *global = globalObject->GetGlobalJSObject();
   
 
-  void* classObject;
+  JSObject* classObject;
   nsresult rv = aBinding->InitClass(mClassName, cx, global, global,
                                     &classObject);
   if (NS_FAILED(rv))
     return rv;
 
-  mClassObject = (JSObject*) classObject;
+  mClassObject = classObject;
   if (!mClassObject)
     return NS_ERROR_FAILURE;
 
@@ -307,15 +308,15 @@ nsXBLProtoImpl::Read(nsIScriptContext* aContext,
                      nsIScriptGlobalObject* aGlobal)
 {
   // Set up a class object first so that deserialization is possible
-  JSContext *cx = static_cast<JSContext *>(aContext->GetNativeContext());
+  JSContext *cx = aContext->GetNativeContext();
   JSObject *global = aGlobal->GetGlobalJSObject();
 
-  void* classObject;
+  JSObject* classObject;
   nsresult rv = aBinding->InitClass(mClassName, cx, global, global, &classObject);
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(classObject, NS_ERROR_FAILURE);
 
-  mClassObject = (JSObject*) classObject;
+  mClassObject = classObject;
 
   nsXBLProtoImplField* previousField = nsnull;
   nsXBLProtoImplMember* previousMember = nsnull;

content/xbl/src/nsXBLProtoImpl.h

@@ -73,7 +73,7 @@ public:
   nsresult InitTargetObjects(nsXBLPrototypeBinding* aBinding, nsIScriptContext* aContext, 
                              nsIContent* aBoundElement, 
                              nsIXPConnectJSObjectHolder** aScriptObjectHolder,
-                             void** aTargetClassObject);
+                             JSObject** aTargetClassObject);
   nsresult CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding);
 
   void SetMemberList(nsXBLProtoImplMember* aMemberList)
@@ -131,8 +131,8 @@ public:
   nsCString mClassName; // The name of the class. 
 
 protected:
-  void* mClassObject;   // The class object for the binding. We'll use this to pre-compile properties 
+  JSObject* mClassObject; // The class object for the binding. We'll use this to pre-compile properties
-                        // and methods for the binding.
+                          // and methods for the binding.
 
   nsXBLProtoImplMember* mMembers; // The members of an implementation are chained in this singly-linked list.
 

content/xbl/src/nsXBLProtoImplField.cpp

@@ -148,9 +148,10 @@ nsXBLProtoImplField::InstallField(nsIScriptContext* aContext,
                                         aBoundNode,
                                         aPrincipal, uriSpec.get(),
                                         mLineNumber, JSVERSION_LATEST,
-                                        (void*) &result, &undefined);
+                                        &result, &undefined);
-  if (NS_FAILED(rv))
+  if (NS_FAILED(rv)) {
     return rv;
+  }
 
   if (undefined) {
     result = JSVAL_VOID;

content/xbl/src/nsXBLProtoImplMethod.cpp

@@ -272,9 +272,7 @@ nsresult
 nsXBLProtoImplMethod::Read(nsIScriptContext* aContext,
                            nsIObjectInputStream* aStream)
 {
-  void* methodCode;
+  nsresult rv = XBL_DeserializeFunction(aContext, aStream, &mJSMethodObject);
-  nsresult rv = XBL_DeserializeFunction(aContext, aStream, this, &methodCode);
-  mJSMethodObject = (JSObject *)methodCode;
   if (NS_FAILED(rv)) {
     SetUncompiledMethod(nsnull);
     return rv;

content/xbl/src/nsXBLProtoImplMethod.h

@@ -180,6 +180,7 @@ public:
     return NS_OK;
   }
 
+  using nsXBLProtoImplMethod::Write;
   nsresult Write(nsIScriptContext* aContext,
                  nsIObjectOutputStream* aStream,
                  XBLBindingSerializeDetails aType);

content/xbl/src/nsXBLProtoImplProperty.cpp

@@ -360,24 +360,23 @@ nsXBLProtoImplProperty::Read(nsIScriptContext* aContext,
                              nsIObjectInputStream* aStream,
                              XBLBindingSerializeDetails aType)
 {
-  nsresult rv;
-  void* scriptObject;
-
   if (aType == XBLBinding_Serialize_GetterProperty ||
       aType == XBLBinding_Serialize_GetterSetterProperty) {
-    rv = XBL_DeserializeFunction(aContext, aStream, this, &scriptObject);
+    JSObject* getterObject;
+    nsresult rv = XBL_DeserializeFunction(aContext, aStream, &getterObject);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    mJSGetterObject = (JSObject *)scriptObject;
+    mJSGetterObject = getterObject;
     mJSAttributes |= JSPROP_GETTER | JSPROP_SHARED;
   }
 
   if (aType == XBLBinding_Serialize_SetterProperty ||
       aType == XBLBinding_Serialize_GetterSetterProperty) {
-    rv = XBL_DeserializeFunction(aContext, aStream, this, &scriptObject);
+    JSObject* setterObject;
+    nsresult rv = XBL_DeserializeFunction(aContext, aStream, &setterObject);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    mJSSetterObject = (JSObject *)scriptObject;
+    mJSSetterObject = setterObject;
     mJSAttributes |= JSPROP_SETTER | JSPROP_SHARED;
   }
 

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -78,12 +78,11 @@
 #include "nsXBLResourceLoader.h"
 #include "mozilla/dom/Element.h"
 
-using namespace mozilla;
-
 #ifdef MOZ_XUL
 #include "nsXULElement.h"
 #endif
 
+using namespace mozilla;
 using namespace mozilla::dom;
 
 // Helper Classes =====================================================================
@@ -869,7 +868,7 @@ nsresult
 nsXBLPrototypeBinding::InitClass(const nsCString& aClassName,
                                  JSContext * aContext, JSObject * aGlobal,
                                  JSObject * aScriptObject,
-                                 void ** aClassObject)
+                                 JSObject** aClassObject)
 {
   NS_ENSURE_ARG_POINTER(aClassObject); 
 
@@ -1904,9 +1903,7 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
   }
   else {
 #endif
-    nsCOMPtr<nsINodeInfo> ni = nodeInfo;
+    NS_NewElement(getter_AddRefs(content), nodeInfo.forget(), NOT_FROM_PARSER);
-    NS_NewElement(getter_AddRefs(content), nodeInfo->NamespaceID(),
-                  ni.forget(), mozilla::dom::NOT_FROM_PARSER);
 
     for (PRUint32 i = 0; i < attrCount; i++) {
       rv = ReadNamespace(aStream, namespaceID);

content/xbl/src/nsXBLPrototypeBinding.h

@@ -155,7 +155,7 @@ public:
 
   nsresult InitClass(const nsCString& aClassName, JSContext * aContext,
                      JSObject * aGlobal, JSObject * aScriptObject,
-                     void ** aClassObject);
+                     JSObject** aClassObject);
 
   nsresult ConstructInterfaceTable(const nsAString& aImpls);
   

content/xbl/src/nsXBLSerialize.cpp

@@ -15,7 +15,7 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- *   Mozilla Corporation.
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
@@ -45,23 +45,20 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
                       nsIObjectOutputStream* aStream,
                       JSObject* aFunctionObject)
 {
-  nsresult rv;
+  JSContext* cx = aContext->GetNativeContext();
-
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
   JSXDRState *xdr = ::JS_XDRNewMem(cx, JSXDR_ENCODE);
   if (!xdr)
     return NS_ERROR_OUT_OF_MEMORY;
-  xdr->userdata = (void*) aStream;
+  xdr->userdata = static_cast<void*>(aStream);
-
-  jsval funval = OBJECT_TO_JSVAL(aFunctionObject);
 
   JSAutoRequest ar(cx);
-  if (! ::JS_XDRFunctionObject(xdr, &aFunctionObject)) {
+  nsresult rv;
+  if (!JS_XDRFunctionObject(xdr, &aFunctionObject)) {
     rv = NS_ERROR_FAILURE;
   } else {
     uint32 size;
     const char* data = reinterpret_cast<const char*>
-                                         (::JS_XDRMemGetData(xdr, &size));
+                                       (JS_XDRMemGetData(xdr, &size));
     NS_ASSERTION(data, "no decoded JSXDRState data!");
 
     rv = aStream->Write32(size);
@@ -69,7 +66,7 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
       rv = aStream->WriteBytes(data, size);
   }
 
-  ::JS_XDRDestroy(xdr);
+  JS_XDRDestroy(xdr);
 
   return rv;
 }
@@ -78,12 +75,9 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
 nsresult
 XBL_DeserializeFunction(nsIScriptContext* aContext,
                         nsIObjectInputStream* aStream,
-                        void* aHolder,
+                        JSObject** aFunctionObject)
-                        void **aScriptObject)
 {
-  *aScriptObject = nsnull;
+  *aFunctionObject = nsnull;
-
-  JSObject* functionObject = nsnull;
 
   PRUint32 size;
   nsresult rv = aStream->Read32(&size);
@@ -95,29 +89,26 @@ XBL_DeserializeFunction(nsIScriptContext* aContext,
   if (NS_FAILED(rv))
     return rv;
 
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
+  JSContext* cx = aContext->GetNativeContext();
-  JSXDRState *xdr = ::JS_XDRNewMem(cx, JSXDR_DECODE);
+  JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_DECODE);
   if (!xdr) {
     rv = NS_ERROR_OUT_OF_MEMORY;
   } else {
-    xdr->userdata = (void*) aStream;
+    xdr->userdata = static_cast<void*>(aStream);
     JSAutoRequest ar(cx);
-    ::JS_XDRMemSetData(xdr, data, size);
+    JS_XDRMemSetData(xdr, data, size);
 
-    if (! ::JS_XDRFunctionObject(xdr, &functionObject)) {
+    if (!JS_XDRFunctionObject(xdr, aFunctionObject)) {
       rv = NS_ERROR_FAILURE;
     }
 
     uint32 junk;
-    data = (char*) ::JS_XDRMemGetData(xdr, &junk);
+    data = static_cast<char*>(JS_XDRMemGetData(xdr, &junk));
-    ::JS_XDRMemSetData(xdr, NULL, 0);
+    JS_XDRMemSetData(xdr, NULL, 0);
-    ::JS_XDRDestroy(xdr);
+    JS_XDRDestroy(xdr);
   }
 
   nsMemory::Free(data);
   NS_ENSURE_SUCCESS(rv, rv);
-
-  *aScriptObject = functionObject;
-
   return rv;
 }

content/xbl/src/nsXBLSerialize.h

@@ -15,7 +15,7 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- *   Mozilla Corporation.
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
@@ -113,7 +113,6 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
 nsresult
 XBL_DeserializeFunction(nsIScriptContext* aContext,
                         nsIObjectInputStream* aStream,
-                        void* aHolder,
+                        JSObject** aFunctionObject);
-                        void **aScriptObject);
 
 #endif // nsXBLSerialize_h__

content/xml/document/src/nsXMLContentSink.cpp

@@ -497,8 +497,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
 
   nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
   nsCOMPtr<nsIContent> content;
-  rv = NS_NewElement(getter_AddRefs(content), aNodeInfo->NamespaceID(),
+  rv = NS_NewElement(getter_AddRefs(content), ni.forget(), aFromParser);
-                     ni.forget(), aFromParser);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aNodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_XHTML)
@@ -586,29 +585,24 @@ nsXMLContentSink::CloseElement(nsIContent* aContent)
     return NS_OK;
   }
 
-  nsresult rv = NS_OK;
-
   if (nodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_XHTML)
       || nodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_SVG)
     ) {
     mConstrainSize = true; 
+    nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
 
     if (mPreventScriptExecution) {
-      nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
-      NS_ASSERTION(sele, "script did QI correctly!");
       sele->PreventExecution();
-      return rv;
+      return NS_OK;
     }
 
     // Now tell the script that it's ready to go. This may execute the script
-    // or return NS_ERROR_HTMLPARSER_BLOCK. Or neither if the script doesn't
+    // or return true, or neither if the script doesn't need executing.
-    // need executing.
+    bool block = sele->AttemptToExecute();
-    rv = aContent->DoneAddingChildren(true);
 
     // If the act of insertion evaluated the script, we're fine.
     // Else, block the parser till the script has loaded.
-    if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
+    if (block) {
-      nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
       mScriptElements.AppendObject(sele);
     }
 
@@ -617,12 +611,13 @@ nsXMLContentSink::CloseElement(nsIContent* aContent)
     if (mParser && !mParser->IsParserEnabled()) {
       // XXX The HTML sink doesn't call BlockParser here, why do we?
       mParser->BlockParser();
-      rv = NS_ERROR_HTMLPARSER_BLOCK;
+      block = true;
     }
 
-    return rv;
+    return block ? NS_ERROR_HTMLPARSER_BLOCK : NS_OK;
   }
   
+  nsresult rv = NS_OK;
   if (nodeInfo->Equals(nsGkAtoms::meta, kNameSpaceID_XHTML) &&
            // Need to check here to make sure this meta tag does not set
            // mPrettyPrintXML to false when we have a special root!

content/xslt/src/xslt/txMozillaXMLOutput.cpp

@@ -63,6 +63,7 @@
 #include "nsIStyleSheetLinkingElement.h"
 #include "nsIDocumentTransformer.h"
 #include "mozilla/css/Loader.h"
+#include "mozilla/dom/Element.h"
 #include "nsICharsetAlias.h"
 #include "nsIHTMLContentSink.h"
 #include "nsContentUtils.h"
@@ -303,9 +304,7 @@ txMozillaXMLOutput::endElement()
     NS_ASSERTION(mCurrentNode->IsElement(), "borked mCurrentNode");
     NS_ENSURE_TRUE(mCurrentNode->IsElement(), NS_ERROR_UNEXPECTED);
 
-    nsIContent* element = static_cast<nsIContent*>
+    Element* element = mCurrentNode->AsElement();
-                                     (static_cast<nsINode*>
-                                                 (mCurrentNode));
 
     // Handle html-elements
     if (!mNoFixup) {
@@ -318,21 +317,21 @@ txMozillaXMLOutput::endElement()
         PRInt32 ns = element->GetNameSpaceID();
         nsIAtom* localName = element->Tag();
 
-        if ((ns == kNameSpaceID_XHTML && (localName == nsGkAtoms::script ||
+        if ((ns == kNameSpaceID_XHTML && (localName == nsGkAtoms::title ||
-                                          localName == nsGkAtoms::title ||
                                           localName == nsGkAtoms::object ||
                                           localName == nsGkAtoms::applet ||
                                           localName == nsGkAtoms::select ||
                                           localName == nsGkAtoms::textarea)) ||
-            (ns == kNameSpaceID_SVG && (localName == nsGkAtoms::script ||
+            (ns == kNameSpaceID_SVG && localName == nsGkAtoms::title)) {
-                                        localName == nsGkAtoms::title))) {
+            element->DoneAddingChildren(true);
-
+        } else if ((ns == kNameSpaceID_XHTML || ns == kNameSpaceID_SVG) &&
-            rv = element->DoneAddingChildren(true);
+                   localName == nsGkAtoms::script) {
-
+            nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(element);
+            NS_ABORT_IF_FALSE(sele, "script elements need to implement nsIScriptElement");
+            bool block = sele->AttemptToExecute();
             // If the act of insertion evaluated the script, we're fine.
             // Else, add this script element to the array of loading scripts.
-            if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
+            if (block) {
-                nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(element);
                 rv = mNotifier->AddScriptElement(sele);
                 NS_ENSURE_SUCCESS(rv, rv);
             }
@@ -556,12 +555,12 @@ txMozillaXMLOutput::startElementInternal(nsIAtom* aPrefix,
     mOpenedElementIsHTML = false;
 
     // Create the element
-    nsCOMPtr<nsINodeInfo> ni;
+    nsCOMPtr<nsINodeInfo> ni =
-    ni = mNodeInfoManager->GetNodeInfo(aLocalName, aPrefix, aNsID,
+        mNodeInfoManager->GetNodeInfo(aLocalName, aPrefix, aNsID,
-                                       nsIDOMNode::ELEMENT_NODE);
+                                      nsIDOMNode::ELEMENT_NODE);
     NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
 
-    NS_NewElement(getter_AddRefs(mOpenedElement), aNsID, ni.forget(),
+    NS_NewElement(getter_AddRefs(mOpenedElement), ni.forget(),
                   mCreatingNewDocument ?
                   FROM_PARSER_XSLT : FROM_PARSER_FRAGMENT);
 

content/xtf/src/nsXTFElementWrapper.cpp

@@ -518,13 +518,11 @@ nsXTFElementWrapper::BeginAddingChildren()
     GetXTFElement()->BeginAddingChildren();
 }
 
-nsresult
+void
 nsXTFElementWrapper::DoneAddingChildren(bool aHaveNotified)
 {
   if (mNotificationMask & nsIXTFElement::NOTIFY_DONE_ADDING_CHILDREN)
     GetXTFElement()->DoneAddingChildren();
-
-  return NS_OK;
 }
 
 already_AddRefed<nsINodeInfo>

content/xtf/src/nsXTFElementWrapper.h

@@ -111,7 +111,7 @@ public:
   virtual nsEventStates IntrinsicState() const;
 
   virtual void BeginAddingChildren();
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsIAtom *GetClassAttributeName() const;
   virtual const nsAttrValue* DoGetClasses() const;

content/xul/content/src/nsXULContextMenuBuilder.cpp

@@ -39,6 +39,8 @@
 #include "nsIDOMHTMLMenuItemElement.h"
 #include "nsXULContextMenuBuilder.h"
 
+using namespace mozilla;
+using namespace mozilla::dom;
 
 nsXULContextMenuBuilder::nsXULContextMenuBuilder()
   : mCurrentGeneratedItemId(0)
@@ -247,8 +249,7 @@ nsXULContextMenuBuilder::CreateElement(nsIAtom* aTag,
     aTag, nsnull, kNameSpaceID_XUL, nsIDOMNode::ELEMENT_NODE);
   NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
 
-  nsresult rv = NS_NewElement(aResult, kNameSpaceID_XUL, nodeInfo.forget(),
+  nsresult rv = NS_NewElement(aResult, nodeInfo.forget(), NOT_FROM_PARSER);
-                              mozilla::dom::NOT_FROM_PARSER);
   if (NS_FAILED(rv)) {
     return rv;
   }

content/xul/content/src/nsXULElement.cpp

@@ -3141,7 +3141,6 @@ nsXULPrototypeScript::Compile(const PRUnichar* aText,
     nsScriptObjectHolder newScriptObject(context);
     rv = context->CompileScript(aText,
                                 aTextLength,
-                                nsnull,
                                 // Use the enclosing document's principal
                                 // XXX is this right? or should we use the
                                 // protodoc's?

content/xul/document/src/nsXULDocument.cpp

@@ -3703,9 +3703,8 @@ nsXULDocument::CreateElementFromPrototype(nsXULPrototypeElement* aPrototype,
                                                     nsIDOMNode::ELEMENT_NODE);
         if (!newNodeInfo) return NS_ERROR_OUT_OF_MEMORY;
         nsCOMPtr<nsIContent> content;
-        PRInt32 ns = newNodeInfo->NamespaceID();
         nsCOMPtr<nsINodeInfo> xtfNi = newNodeInfo;
-        rv = NS_NewElement(getter_AddRefs(content), ns, newNodeInfo.forget(),
+        rv = NS_NewElement(getter_AddRefs(content), newNodeInfo.forget(),
                            NOT_FROM_PARSER);
         if (NS_FAILED(rv))
             return rv;

content/xul/document/src/nsXULPrototypeDocument.cpp

@@ -723,8 +723,7 @@ nsXULPDGlobalObject::EnsureScriptEnvironment(PRUint32 lang_id)
                                         getter_AddRefs(languageRuntime));
   NS_ENSURE_SUCCESS(rv, NS_OK);
 
-  nsCOMPtr<nsIScriptContext> ctxNew;
+  nsCOMPtr<nsIScriptContext> ctxNew = languageRuntime->CreateContext();
-  rv = languageRuntime->CreateContext(getter_AddRefs(ctxNew));
   // We have to setup a special global object.  We do this then
   // attach it as the global for this context.  Then, ::SetScriptContext
   // will re-fetch the global and set it up in our language globals array.

content/xul/templates/src/nsXULContentBuilder.cpp

@@ -1399,20 +1399,17 @@ nsXULContentBuilder::CreateElement(PRInt32 aNameSpaceID,
     if (! doc)
         return NS_ERROR_NOT_INITIALIZED;
 
-    nsresult rv;
     nsCOMPtr<nsIContent> result;
+    nsCOMPtr<nsINodeInfo> nodeInfo =
+        doc->NodeInfoManager()->GetNodeInfo(aTag, nsnull, aNameSpaceID,
+                                            nsIDOMNode::ELEMENT_NODE);
 
-    nsCOMPtr<nsINodeInfo> nodeInfo;
+    nsresult rv = NS_NewElement(getter_AddRefs(result), nodeInfo.forget(),
-    nodeInfo = doc->NodeInfoManager()->GetNodeInfo(aTag, nsnull, aNameSpaceID,
+                                NOT_FROM_PARSER);
-                                                   nsIDOMNode::ELEMENT_NODE);
-
-    rv = NS_NewElement(getter_AddRefs(result), aNameSpaceID, nodeInfo.forget(),
-                       NOT_FROM_PARSER);
     if (NS_FAILED(rv))
         return rv;
 
-    *aResult = result;
+    result.forget(aResult);
-    NS_ADDREF(*aResult);
     return NS_OK;
 }
 

docshell/base/Makefile.in

@@ -119,6 +119,5 @@ LOCAL_INCLUDES += \
   -I$(srcdir)/../shistory/src \
   -I$(topsrcdir)/dom/base \
   -I$(topsrcdir)/layout/base \
-  -I$(topsrcdir)/js/xpconnect/src \
   -I$(topsrcdir)/xpcom/ds \
   $(NULL)

docshell/base/nsDocShell.cpp

@@ -665,6 +665,11 @@ DispatchPings(nsIContent *content, nsIURI *referrer)
 static nsDOMPerformanceNavigationType
 ConvertLoadTypeToNavigationType(PRUint32 aLoadType)
 {
+  // Not initialized, assume it's normal load.
+  if (aLoadType == 0) {
+    aLoadType = LOAD_NORMAL;
+  }
+
   nsDOMPerformanceNavigationType result = nsIDOMPerformanceNavigation::TYPE_RESERVED;
   switch (aLoadType) {
     case LOAD_NORMAL:
@@ -5874,12 +5879,7 @@ nsDocShell::OnStateChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
         channel->GetURI(getter_AddRefs(uri));
         nsCAutoString aURI;
         uri->GetAsciiSpec(aURI);
-        // If load type is not set, this is not a 'normal' load.
+        if (this == aProgress){
-        // No need to collect timing.
-        if (mLoadType == 0) {
-            mTiming = nsnull;
-        }
-        else if (this == aProgress){
             rv = MaybeInitTiming();
             if (mTiming) {
                 mTiming->NotifyFetchStart(uri, ConvertLoadTypeToNavigationType(mLoadType));