Merge m-c to b2g-inbound.

accessible/src/base/nsAccessibilityService.cpp

@@ -1022,8 +1022,11 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
       } else if (content->Tag() == nsGkAtoms::svg) {
         newAcc = new EnumRoleAccessible(content, document, roles::DIAGRAM);
       }
-    } else if (content->IsMathML(nsGkAtoms::math)) {
-      newAcc = new EnumRoleAccessible(content, document, roles::EQUATION);
+    } else if (content->IsMathML()){
+      if (content->Tag() == nsGkAtoms::math)
+        newAcc = new EnumRoleAccessible(content, document, roles::EQUATION);
+      else
+        newAcc = new HyperTextAccessible(content, document);
     }
   }
 

accessible/src/jsat/OutputGenerator.jsm

@@ -285,7 +285,7 @@ this.OutputGenerator = {
     'calendar': INCLUDE_DESC | INCLUDE_NAME,
     'combobox list': INCLUDE_DESC,
     'combobox option': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
-    'listbox option': NAME_FROM_SUBTREE_RULE,
+    'listbox option': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
     'listbox rich option': NAME_FROM_SUBTREE_RULE,
     'gridcell': NAME_FROM_SUBTREE_RULE,
     'check rich option': NAME_FROM_SUBTREE_RULE,

accessible/src/jsat/TraversalRules.jsm

@@ -38,6 +38,7 @@ const ROLE_DEFINITION_LIST = Ci.nsIAccessibleRole.ROLE_DEFINITION_LIST;
 const ROLE_LISTITEM = Ci.nsIAccessibleRole.ROLE_LISTITEM;
 const ROLE_BUTTONDROPDOWNGRID = Ci.nsIAccessibleRole.ROLE_BUTTONDROPDOWNGRID;
 const ROLE_LISTBOX = Ci.nsIAccessibleRole.ROLE_LISTBOX;
+const ROLE_OPTION = Ci.nsIAccessibleRole.ROLE_OPTION;
 const ROLE_SLIDER = Ci.nsIAccessibleRole.ROLE_SLIDER;
 const ROLE_HEADING = Ci.nsIAccessibleRole.ROLE_HEADING;
 const ROLE_HEADER = Ci.nsIAccessibleRole.ROLE_HEADER;
@@ -110,6 +111,7 @@ var gSimpleTraversalRoles =
    ROLE_HEADING,
    ROLE_SLIDER,
    ROLE_SPINBUTTON,
+   ROLE_OPTION,
    // Used for traversing in to child OOP frames.
    ROLE_INTERNAL_FRAME];
 

accessible/tests/crashtests/471493.xul

@@ -9,10 +9,8 @@
   <![CDATA[
     function doTest()
     {
-      netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
-      var accRetrieval = Components.classes["@mozilla.org/accessibleRetrieval;1"].
-        getService(Components.interfaces.nsIAccessibleRetrieval);
+      var accRetrieval = SpecialPowers.Cc["@mozilla.org/accessibleRetrieval;1"].
+        getService(SpecialPowers.Ci.nsIAccessibleRetrieval);
 
       var treecol = document.getElementById("col");
       var x = treecol.boxObject.screenX;

accessible/tests/crashtests/crashtests.list

@@ -1 +1,2 @@
-load 471493.xul
+# Disabled because it causes assertions/crashes in later crashtests, see bug 918246
+skip load 471493.xul

b2g/app/b2g.js

@@ -330,9 +330,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// The list of tables that use the gethash request to confirm partial results.
-pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
-
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.

browser/app/profile/firefox.js

@@ -803,9 +803,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// The list of tables that use the gethash request to confirm partial results.
-pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
-
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.

browser/base/content/browser-plugins.js

@@ -804,7 +804,9 @@ var gPluginHandler = {
     let contentDoc = aBrowser.contentDocument;
     let cwu = contentWindow.QueryInterface(Ci.nsIInterfaceRequestor)
                            .getInterface(Ci.nsIDOMWindowUtils);
-    let plugins = cwu.plugins;
+    // cwu.plugins may contain non-plugin <object>s, filter them out
+    let plugins = cwu.plugins.filter((plugin) =>
+      plugin.getContentTypeForMIMEType(plugin.actualType) == Ci.nsIObjectLoadingContent.TYPE_PLUGIN);
     if (plugins.length == 0) {
       if (notification) {
         PopupNotifications.remove(notification);

browser/base/content/browser-social.js

@@ -874,18 +874,27 @@ SocialToolbar = {
     let toggleNotificationsCommand = document.getElementById("Social:ToggleNotifications");
     toggleNotificationsCommand.setAttribute("hidden", !socialEnabled);
 
-    let parent = document.getElementById("social-notification-panel");
-    while (parent.hasChildNodes()) {
-      let frame = parent.firstChild;
-      SharedFrame.forgetGroup(frame.id);
-      parent.removeChild(frame);
-    }
-
+    // we need to remove buttons and frames if !socialEnabled or the provider
+    // has changed (frame origin does not match current provider). We only
+    // remove frames that are "attached" to buttons in this toolbar button since
+    // other buttons may also be using grouped frames.
     let tbi = document.getElementById("social-provider-button");
     if (tbi) {
       // buttons after social-provider-button are ambient icons
-      while (tbi.nextSibling) {
-        tbi.parentNode.removeChild(tbi.nextSibling);
+      let next = tbi.nextSibling;
+      let currentOrigin = Social.provider ? Social.provider.origin : null;
+
+      while (next) {
+        let button = next;
+        next = next.nextSibling;
+        // get the frame for this button
+        let frameId = button.getAttribute("notificationFrameId");
+        let frame = document.getElementById(frameId);
+        if (!socialEnabled || frame.getAttribute("origin") != currentOrigin) {
+          SharedFrame.forgetGroup(frame.id);
+          frame.parentNode.removeChild(frame);
+          button.parentNode.removeChild(button);
+        }
       }
     }
   },

browser/base/content/browser.css

@@ -259,7 +259,7 @@ panel[noactions] > richlistbox > richlistitem[type~="action"] > .ac-url-box > .a
 
 #wrapper-urlbar-container > #urlbar-container > #urlbar {
   -moz-user-input: disabled;
-  cursor: -moz-grab;
+  cursor: grab;
 }
 
 #PopupAutoComplete {

browser/base/content/sanitizeDialog.css

@@ -11,7 +11,7 @@
 #placesTreechildren::-moz-tree-cell(grippyRow),
 #placesTreechildren::-moz-tree-cell-text(grippyRow),
 #placesTreechildren::-moz-tree-image(grippyRow) {
-  cursor: -moz-grab;
+  cursor: grab;
 }
 
 

browser/base/content/test/general/Makefile.in

@@ -192,6 +192,7 @@ MOCHITEST_BROWSER_FILES = \
                  browser_contextSearchTabPosition.js \
                  browser_CTP_drag_drop.js \
                  browser_CTP_data_urls.js \
+                 browser_CTP_nonplugins.js \
                  browser_CTP_resize.js \
                  browser_ctrlTab.js \
                  browser_customize_popupNotification.js \

browser/base/content/test/general/browser_CTP_nonplugins.js

@@ -0,0 +1,160 @@
+var rootDir = getRootDirectory(gTestPath);
+const gTestRoot = rootDir;
+const gHttpTestRoot = rootDir.replace("chrome://mochitests/content/", "http://127.0.0.1:8888/");
+
+var gTestBrowser = null;
+var gNextTest = null;
+var gPluginHost = Components.classes["@mozilla.org/plugin/host;1"].getService(Components.interfaces.nsIPluginHost);
+var gRunNextTestAfterPluginRemoved = false;
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+// This listens for the next opened tab and checks it is of the right url.
+// opencallback is called when the new tab is fully loaded
+// closecallback is called when the tab is closed
+function TabOpenListener(url, opencallback, closecallback) {
+  this.url = url;
+  this.opencallback = opencallback;
+  this.closecallback = closecallback;
+
+  gBrowser.tabContainer.addEventListener("TabOpen", this, false);
+}
+
+TabOpenListener.prototype = {
+  url: null,
+  opencallback: null,
+  closecallback: null,
+  tab: null,
+  browser: null,
+
+  handleEvent: function(event) {
+    if (event.type == "TabOpen") {
+      gBrowser.tabContainer.removeEventListener("TabOpen", this, false);
+      this.tab = event.originalTarget;
+      this.browser = this.tab.linkedBrowser;
+      gBrowser.addEventListener("pageshow", this, false);
+    } else if (event.type == "pageshow") {
+      if (event.target.location.href != this.url)
+        return;
+      gBrowser.removeEventListener("pageshow", this, false);
+      this.tab.addEventListener("TabClose", this, false);
+      var url = this.browser.contentDocument.location.href;
+      is(url, this.url, "Should have opened the correct tab");
+      this.opencallback(this.tab, this.browser.contentWindow);
+    } else if (event.type == "TabClose") {
+      if (event.originalTarget != this.tab)
+        return;
+      this.tab.removeEventListener("TabClose", this, false);
+      this.opencallback = null;
+      this.tab = null;
+      this.browser = null;
+      // Let the window close complete
+      executeSoon(this.closecallback);
+      this.closecallback = null;
+    }
+  }
+};
+
+function test() {
+  waitForExplicitFinish();
+  registerCleanupFunction(function() {
+    clearAllPluginPermissions();
+    Services.prefs.clearUserPref("extensions.blocklist.suppressUI");
+    gTestBrowser.removeEventListener("PluginRemoved", handlePluginRemoved, true, true);
+  });
+  Services.prefs.setBoolPref("extensions.blocklist.suppressUI", true);
+
+  var newTab = gBrowser.addTab();
+  gBrowser.selectedTab = newTab;
+  gTestBrowser = gBrowser.selectedBrowser;
+  gTestBrowser.addEventListener("load", pageLoad, true);
+  gTestBrowser.addEventListener("PluginRemoved", handlePluginRemoved, true, true);
+
+  Services.prefs.setBoolPref("plugins.click_to_play", true);
+  setTestPluginEnabledState(Ci.nsIPluginTag.STATE_CLICKTOPLAY);
+
+  prepareTest(runAfterPluginBindingAttached(test1), gHttpTestRoot + "plugin_two_types.html");
+}
+
+function finishTest() {
+  clearAllPluginPermissions();
+  gTestBrowser.removeEventListener("load", pageLoad, true);
+  gBrowser.removeCurrentTab();
+  window.focus();
+  finish();
+}
+
+function pageLoad() {
+  // The plugin events are async dispatched and can come after the load event
+  // This just allows the events to fire before we then go on to test the states
+  executeSoon(gNextTest);
+}
+
+function prepareTest(nextTest, url) {
+  gNextTest = nextTest;
+  gTestBrowser.contentWindow.location = url;
+}
+
+// Due to layout being async, "PluginBindAttached" may trigger later.
+// This wraps a function to force a layout flush, thus triggering it,
+// and schedules the function execution so they're definitely executed
+// afterwards.
+function runAfterPluginBindingAttached(func) {
+  return function() {
+    let doc = gTestBrowser.contentDocument;
+    let elems = doc.getElementsByTagName('embed');
+    if (elems.length < 1) {
+      elems = doc.getElementsByTagName('object');
+    }
+    elems[0].clientTop;
+    executeSoon(func);
+  };
+}
+
+function handlePluginRemoved() {
+  if (gRunNextTestAfterPluginRemoved) {
+    executeSoon(gNextTest);
+    gRunNextTestAfterPluginRemoved = false;
+  }
+}
+
+function runAfterPluginRemoved(func) {
+  gNextTest = func;
+  gRunNextTestAfterPluginRemoved = true;
+}
+
+// Test that the click-to-play notification is not shown for non-plugin object elements
+
+function test1() {
+  let popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
+  ok(popupNotification, "Test 1, Should have a click-to-play notification");
+
+  let plugin = gTestBrowser.contentDocument.getElementById("secondtestA");
+  plugin.parentNode.removeChild(plugin);
+  plugin = gTestBrowser.contentDocument.getElementById("secondtestB");
+  plugin.parentNode.removeChild(plugin);
+
+  let image = gTestBrowser.contentDocument.createElement("object");
+  image.type = "image/png";
+  image.data = "moz.png";
+  gTestBrowser.contentDocument.body.appendChild(image);
+
+  runAfterPluginRemoved(test2);
+}
+
+function test2() {
+  let popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
+  ok(popupNotification, "Test 2, Should have a click-to-play notification");
+
+  let plugin = gTestBrowser.contentDocument.getElementById("test");
+  plugin.parentNode.removeChild(plugin);
+
+  runAfterPluginRemoved(() => executeSoon(test3));
+}
+
+function test3() {
+  let popupNotification = PopupNotifications.getNotification("click-to-play-plugins", gTestBrowser);
+  ok(!popupNotification, "Test 3, Should not have a click-to-play notification");
+
+  finishTest();
+}

browser/base/content/urlbarBindings.xml

@@ -1499,7 +1499,7 @@
   </binding>
 
   <binding id="click-to-play-plugins-notification" extends="chrome://global/content/bindings/notification.xml#popup-notification">
-    <content align="start" class="click-to-play-plugins-notification-content">
+    <content align="start" style="width: &pluginNotification.width;;">
       <xul:vbox flex="1" align="stretch" class="popup-notification-main-box"
                 xbl:inherits="popupid">
         <xul:hbox class="click-to-play-plugins-notification-description-box" flex="1" align="start">

browser/branding/aurora/branding.nsi

@@ -19,7 +19,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "Thawte Code Signing CA - G2"
+!define CertIssuerDownload "DigiCert Assured ID Code Signing CA-1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.

browser/branding/nightly/branding.nsi

@@ -19,7 +19,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "Thawte Code Signing CA - G2"
+!define CertIssuerDownload "DigiCert Assured ID Code Signing CA-1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.

browser/branding/official/branding.nsi

@@ -23,7 +23,7 @@
 
 # The installer's certificate name and issuer expected by the stub installer
 !define CertNameDownload   "Mozilla Corporation"
-!define CertIssuerDownload "Thawte Code Signing CA - G2"
+!define CertIssuerDownload "DigiCert Assured ID Code Signing CA-1"
 
 # Dialog units are used so the UI displays correctly with the system's DPI
 # settings.

browser/devtools/app-manager/app-projects.js

@@ -68,6 +68,23 @@ const IDB = {
     return deferred.promise;
   },
 
+  update: function(project) {
+    let deferred = promise.defer();
+
+    var transaction = IDB._db.transaction(["projects"], "readwrite");
+    var objectStore = transaction.objectStore("projects");
+    var request = objectStore.put(project);
+    request.onerror = function(event) {
+      deferred.reject("Unable to update project to the AppProjects indexedDB: " +
+                      this.error.name + " - " + this.error.message );
+    };
+    request.onsuccess = function() {
+      deferred.resolve();
+    };
+
+    return deferred.promise;
+  },
+
   remove: function(location) {
     let deferred = promise.defer();
 
@@ -110,6 +127,8 @@ const AppProjects = {
       // The packaged app local path is a valid id, but only on the client.
       // This origin will be used to generate the true id of an app:
       // its manifest URL.
+      // If the app ends up specifying an explicit origin in its manifest,
+      // we will override this random UUID on app install.
       packagedAppOrigin: generateUUID().toString().slice(1, -1)
     };
     return IDB.add(project).then(function () {
@@ -131,6 +150,14 @@ const AppProjects = {
     });
   },
 
+  update: function (project) {
+    return IDB.update({
+      type: project.type,
+      location: project.location,
+      packagedAppOrigin: project.packagedAppOrigin
+    }).then(() => project);
+  },
+
   remove: function(location) {
     return IDB.remove(location).then(function () {
       let projects = store.object.projects;

browser/devtools/app-manager/content/projects.js

@@ -208,9 +208,15 @@ let UI = {
   },
 
   install: function(project) {
-    let install;
     if (project.type == "packaged") {
-      install = installPackaged(this.connection.client, this.listTabsResponse.webappsActor, project.location, project.packagedAppOrigin);
+      return installPackaged(this.connection.client, this.listTabsResponse.webappsActor, project.location, project.packagedAppOrigin)
+        .then(({ appId }) => {
+          // If the packaged app specified a custom origin override,
+          // we need to update the local project origin
+          project.packagedAppOrigin = appId;
+          // And ensure the indexed db on disk is also updated
+          AppProjects.update(project);
+        });
     } else {
       let manifestURLObject = Services.io.newURI(project.location, null, null);
       let origin = Services.io.newURI(manifestURLObject.prePath, null, null);
@@ -219,9 +225,8 @@ let UI = {
         origin: origin.spec,
         manifestURL: project.location
       };
-      install = installHosted(this.connection.client, this.listTabsResponse.webappsActor, appId, metadata, project.manifest);
+      return installHosted(this.connection.client, this.listTabsResponse.webappsActor, appId, metadata, project.manifest);
     }
-    return install;
   },
 
   start: function(project) {

browser/devtools/responsivedesign/responsivedesign.jsm

@@ -116,6 +116,7 @@ function ResponsiveUI(aWindow, aTab)
   this.container = aWindow.gBrowser.getBrowserContainer(this.browser);
   this.stack = this.container.querySelector(".browserStack");
   this._telemetry = new Telemetry();
+  this._floatingScrollbars = !this.mainWindow.matchMedia("(-moz-overlay-scrollbars)").matches;
 
 
   // Try to load presets from prefs
@@ -210,7 +211,6 @@ function ResponsiveUI(aWindow, aTab)
 
 ResponsiveUI.prototype = {
   _transitionsEnabled: true,
-  _floatingScrollbars: Services.appinfo.OS != "Darwin",
   get transitionsEnabled() this._transitionsEnabled,
   set transitionsEnabled(aValue) {
     this._transitionsEnabled = aValue;

browser/devtools/shared/theme-switching.js

@@ -35,7 +35,7 @@
     winUtils.loadSheet(newThemeUrl, winUtils.AUTHOR_SHEET);
 
     // Floating scrollbars à la osx
-    if (Services.appinfo.OS != "Darwin") {
+    if (!window.matchMedia("(-moz-overlay-scrollbars)").matches) {
       let scrollbarsUrl = Services.io.newURI(
         DEVTOOLS_SKIN_URL + "floating-scrollbars-light.css", null, null);
 

browser/devtools/styleinspector/test/Makefile.in

@@ -52,8 +52,12 @@ MOCHITEST_BROWSER_FILES += \
   browser_bug705707_is_content_stylesheet_xul.css \
   browser_bug722196_identify_media_queries.html \
   browser_styleinspector_bug_677930_urls_clickable.html \
-  browser_styleinspector_bug_677930_urls_clickable \
-  browser_styleinspector_bug_677930_urls_clickable/browser_styleinspector_bug_677930_urls_clickable.css \
   test-image.png \
   browser_ruleview_pseudoelement.html \
   $(NULL)
+
+MOCHITEST_BUG_677940_DATA_FILES = \
+  browser_styleinspector_bug_677930_urls_clickable/browser_styleinspector_bug_677930_urls_clickable.css \
+  $(NULL)
+MOCHITEST_BUG_677940_DATA_DEST = $(MOCHITEST_BROWSER_DEST)/browser_styleinspector_bug_677930_urls_clickable
+INSTALL_TARGETS += MOCHITEST_BUG_677940_DATA

browser/devtools/webconsole/webconsole.js

@@ -4522,6 +4522,7 @@ var Utils = {
       case "CSP":
       case "Invalid HSTS Headers":
       case "Insecure Password Field":
+      case "SSL":
         return CATEGORY_SECURITY;
 
       default:

browser/installer/windows/nsis/defines.nsi.in

@@ -21,7 +21,7 @@
 !define NO_UNINSTALL_SURVEY
 
 !define CERTIFICATE_NAME      "Mozilla Corporation"
-!define CERTIFICATE_ISSUER    "Thawte Code Signing CA - G2"
+!define CERTIFICATE_ISSUER    "DigiCert Assured ID Code Signing CA-1"
 
 # LSP_CATEGORIES is the permitted LSP categories for the application. Each LSP
 # category value is ANDed together to set multiple permitted categories.

browser/installer/windows/nsis/installer.nsi

@@ -341,7 +341,7 @@ Section "-Application" APP_IDX
   ${AddDisabledDDEHandlerValues} "FirefoxHTML" "$2" "$8,1" \
                                  "${AppRegName} Document" ""
   ${AddDisabledDDEHandlerValues} "FirefoxURL" "$2" "$8,1" "${AppRegName} URL" \
-                                 "delete"
+                                 "true"
 
   ; For pre win8, the following keys should only be set if we can write to HKLM.
   ; For post win8, the keys below get set in both HKLM and HKCU.

browser/installer/windows/nsis/maintenanceservice_installer.nsi

@@ -212,7 +212,7 @@ Section "MaintenanceService"
   ; These keys are used to bypass the installation dir is a valid installation
   ; check from the service so that tests can be run.
   ; WriteRegStr HKLM "${FallbackKey}\0" "name" "Mozilla Corporation"
-  ; WriteRegStr HKLM "${FallbackKey}\0" "issuer" "Thawte Code Signing CA - G2"
+  ; WriteRegStr HKLM "${FallbackKey}\0" "issuer" "DigiCert Assured ID Code Signing CA-1"
   ${If} ${RunningX64}
     SetRegView lastused
   ${EndIf}

browser/installer/windows/nsis/shared.nsh

@@ -415,7 +415,7 @@ FunctionEnd
                                  "${AppRegName} HTML Document" ""
 
   ${AddDisabledDDEHandlerValues} "FirefoxURL" "$2" "$8,1" "${AppRegName} URL" \
-                                 "delete"
+                                 "true"
   Call RegisterCEH
 
   ; An empty string is used for the 4th & 5th params because the following
@@ -653,7 +653,7 @@ FunctionEnd
   ${IsHandlerForInstallDir} "FirefoxURL" $R9
   ${If} "$R9" == "true"
     ${AddDisabledDDEHandlerValues} "FirefoxURL" "$2" "$8,1" \
-                                   "${AppRegName} URL" "delete"
+                                   "${AppRegName} URL" "true"
   ${EndIf}
 
   ; An empty string is used for the 4th & 5th params because the following

browser/locales/en-US/chrome/browser/browser.dtd

@@ -672,6 +672,13 @@ just addresses the organization to follow, e.g. "This site is run by " -->
 <!ENTITY pluginActivateAlways.label "Allow and Remember">
 <!ENTITY pluginBlockNow.label "Block Plugin">
 
+<!-- LOCALIZATION NOTE: (pluginNotification.width): This is used to determine the
+     width of the plugin popup notification that can appear if a plugin has been
+     blocked on a page. Should be wide enough to fit the pluginActivateNow.label
+     and pluginActivateAlways.label strings above on a single line. This must be
+     a CSS length value. -->
+<!ENTITY pluginNotification.width "28em">
+
 <!ENTITY tabCrashed.header "Tab crashed">
 <!ENTITY tabCrashed.message "Well, this is embarrassing. We tried to display this Web page, but it's not responding.">
 <!ENTITY tabCrashed.checkSendReport "Tell &vendorShortName; about this crash so they can fix it.">

browser/metro/profile/metro.js

@@ -607,9 +607,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// The list of tables that use the gethash request to confirm partial results.
-pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
-
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.

browser/themes/osx/devtools/floating-scrollbars-light.css

@@ -0,0 +1,10 @@
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+@import url("floating-scrollbars.css");
+
+scrollbar thumb {
+  background-color: rgba(170,170,170,0.2) !important;
+}

browser/themes/osx/devtools/floating-scrollbars.css

@@ -0,0 +1,30 @@
+@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+
+scrollbar {
+  -moz-appearance: none;
+  position: relative;
+  background-color: transparent;
+  background-image: none;
+  border: 0px solid transparent;
+  z-index: 2147483647;
+  -moz-box-align: start;
+  padding: 2px;
+}
+
+scrollbar[orient="vertical"] {
+  -moz-margin-start: -8px;
+  min-width: 8px;
+  max-width: 8px;
+}
+
+scrollbar[orient="horizontal"] {
+  margin-top: -8px;
+  min-height: 8px;
+  max-height: 8px;
+}
+
+thumb {
+  -moz-appearance: none !important;
+  background-color: rgba(0,0,0,0.2);
+  border-radius: 3px;
+}

browser/themes/osx/jar.mn

@@ -288,6 +288,8 @@ browser.jar:
   skin/classic/browser/devtools/debugger-step-in.png        (devtools/debugger-step-in.png)
   skin/classic/browser/devtools/debugger-step-out.png       (devtools/debugger-step-out.png)
   skin/classic/browser/devtools/debugger-step-over.png      (devtools/debugger-step-over.png)
+  skin/classic/browser/devtools/floating-scrollbars.css     (devtools/floating-scrollbars.css)
+  skin/classic/browser/devtools/floating-scrollbars-light.css (devtools/floating-scrollbars-light.css)
   skin/classic/browser/devtools/responsive-se-resizer.png   (devtools/responsive-se-resizer.png)
   skin/classic/browser/devtools/responsive-vertical-resizer.png (devtools/responsive-vertical-resizer.png)
   skin/classic/browser/devtools/responsive-horizontal-resizer.png (devtools/responsive-horizontal-resizer.png)

browser/themes/shared/plugin-doorhanger.inc.css

@@ -2,10 +2,6 @@
   padding: 0px;
 }
 
-.click-to-play-plugins-notification-content {
-  width: 28em;
-}
-
 .click-to-play-plugins-notification-center-box {
   border: 1px solid ThreeDShadow;
   margin: 10px;

build/autoconf/python-virtualenv.m4

@@ -74,5 +74,12 @@ if test "$?" != 0; then
     AC_MSG_ERROR([Python environment does not appear to be sane.])
 fi
 AC_MSG_RESULT([yes])
+
+PYTHON_SITE_PACKAGES=`$PYTHON -c "import distutils.sysconfig; print distutils.sysconfig.get_python_lib()"`
+if test -z "$PYTHON_SITE_PACKAGES"; then
+    AC_MSG_ERROR([Could not determine python site packages directory.])
+fi
+AC_SUBST([PYTHON_SITE_PACKAGES])
+
 ])
 

build/docs/Vagrantfile

@@ -7,4 +7,7 @@ Vagrant::Config.run do |config|
   config.vm.box = "precise64"
   config.vm.box_url = "http://files.vagrantup.com/precise64.box"
   config.vm.share_folder("gecko", "/gecko", "../..")
+  # Doxygen needs more than the default memory or it will swap and be
+  # extremely slow.
+  config.vm.customize ["modifyvm", :id, "--memory", 1024]
 end

build/docs/conf.py

@@ -26,7 +26,7 @@ source_suffix = '.rst'
 master_doc = 'index'
 project = u'Mozilla Build System'
 year = datetime.now().year
-copyright = u'%s, Mozilla Foundation, CC BY-SA 3.0' % year
+copyright = u'%s, Mozilla Foundation, CC BY-SA 3.0 or any later version' % year
 
 # Grab the version from the source tree's milestone.
 with open(os.path.join(mozilla_dir, 'config', 'milestone.txt'), 'rt') as fh:

build/link.py

@@ -10,12 +10,20 @@ def measure_vsize_threadfunc(proc, output_file):
     """
     Measure the virtual memory usage of |proc| at regular intervals
     until it exits, then print the maximum value and write it to
-    |output_file|.
+    |output_file|.  Also, print something to the console every
+    half an hour to prevent the build job from getting killed when
+    linking a large PGOed binary.
     """
     maxvsize = 0
+    idleTime = 0
     while proc.returncode is None:
         maxvsize, vsize = procmem.get_vmsize(proc._handle)
         time.sleep(0.5)
+        idleTime += 0.5
+        if idleTime > 30 * 60:
+          print "Still linking, 30 minutes passed..."
+          sys.stdout.flush()
+          idleTime = 0
     print "TinderboxPrint: linker max vsize: %d" % maxvsize
     with open(output_file, "w") as f:
         f.write("%d\n" % maxvsize)

build/pymake/make.py

@@ -19,8 +19,10 @@ if __name__ == '__main__':
 
   # This is meant as a temporary workaround until issues with many targets
   # and prerequisites is addressed. Bug 874210 tracks.
+  #
+  # The default recursion limit for CPython is 1000.
   try:
-      sys.setrecursionlimit(2 * sys.getrecursionlimit())
+      sys.setrecursionlimit(10000)
   except Exception:
       print >>sys.stderr, 'Unable to increase Python recursion limit.'
 

build/pymake/pymake/parserdata.py

@@ -171,8 +171,8 @@ class Rule(Statement):
         # Skip targets with no rules and no dependencies
         if not deps:
             return
-        targets = self.targetexp.resolvesplit(makefile, makefile.variables)
-        rule = data.Rule(deps, self.doublecolon, loc=self.targetexp.loc, weakdeps=True)
+        targets = data.stripdotslashes(self.targetexp.resolvesplit(makefile, makefile.variables))
+        rule = data.Rule(list(data.stripdotslashes(deps)), self.doublecolon, loc=self.targetexp.loc, weakdeps=True)
         for target in targets:
             makefile.gettarget(target).addrule(rule)
             makefile.foundtarget(target)

build/pymake/pymake/process.py

@@ -6,6 +6,7 @@ parsing command lines into argv and making sure that no shell magic is being use
 #TODO: ship pyprocessing?
 import multiprocessing
 import subprocess, shlex, re, logging, sys, traceback, os, imp, glob
+import site
 from collections import deque
 # XXXkhuey Work around http://bugs.python.org/issue1731717
 subprocess._cleanup = lambda: None
@@ -347,28 +348,19 @@ class PythonException(Exception):
 
 def load_module_recursive(module, path):
     """
-    Emulate the behavior of __import__, but allow
-    passing a custom path to search for modules.
+    Like __import__, but allow passing a custom path to search for modules.
     """
-    bits = module.split('.')
     oldsyspath = sys.path
-    for i, bit in enumerate(bits):
-        dotname = '.'.join(bits[:i+1])
-        try:
-          f, path, desc = imp.find_module(bit, path)
-          # Add the directory the module was found in to sys.path
-          if path != '':
-              abspath = os.path.abspath(path)
-              if not os.path.isdir(abspath):
-                  abspath = os.path.dirname(path)
-              sys.path = [abspath] + sys.path
-          m = imp.load_module(dotname, f, path, desc)
-          if f is None:
-              path = m.__path__
-        except ImportError:
-            return
-        finally:
-            sys.path = oldsyspath
+    sys.path = []
+    for p in path:
+        site.addsitedir(p)
+    sys.path.extend(oldsyspath)
+    try:
+        __import__(module)
+    except ImportError:
+        return
+    finally:
+        sys.path = oldsyspath
 
 class PythonJob(Job):
     """

build/pymake/tests/includedeps-stripdotslash.deps

@@ -0,0 +1 @@
+./test: TEST-PASS

build/pymake/tests/includedeps-stripdotslash.mk

@@ -0,0 +1,8 @@
+#T gmake skip
+
+test:
+	@echo $<
+
+includedeps $(TESTPATH)/includedeps-stripdotslash.deps
+
+TEST-PASS:

config/config.mk

@@ -132,7 +132,7 @@ SLEEP ?= sleep
 TOUCH ?= touch
 
 ifdef .PYMAKE
-PYCOMMANDPATH += $(topsrcdir)/config
+PYCOMMANDPATH += $(PYTHON_SITE_PACKAGES)
 endif
 
 PYTHON_PATH = $(PYTHON) $(topsrcdir)/config/pythonpath.py

config/expandlibs_exec.py

@@ -318,7 +318,11 @@ def main():
 
         if options.verbose:
             print_command(sys.stderr, args)
-        proc = subprocess.Popen(args, stdout = subprocess.PIPE, stderr = subprocess.STDOUT)
+        try:
+            proc = subprocess.Popen(args, stdout = subprocess.PIPE, stderr = subprocess.STDOUT)
+        except Exception, e:
+            print >>sys.stderr, 'error: Launching', args, ':', e
+            raise e
         (stdout, stderr) = proc.communicate()
         if proc.returncode and not options.verbose:
             print_command(sys.stderr, args)

config/rules.mk

@@ -1254,9 +1254,6 @@ $(DEPTH)/config/autoconf.mk: $(topsrcdir)/config/autoconf.mk.in
 # Bunch of things that extend the 'export' rule (in order):
 ###############################################################################
 
-################################################################################
-# Copy each element of EXPORTS to $(DIST)/include
-
 ifneq ($(XPI_NAME),)
 $(FINAL_TARGET):
 	$(NSINSTALL) -D $@
@@ -1264,26 +1261,6 @@ $(FINAL_TARGET):
 export:: $(FINAL_TARGET)
 endif
 
-ifndef NO_DIST_INSTALL
-ifneq (,$(EXPORTS))
-EXPORTS_FILES := $(EXPORTS)
-EXPORTS_DEST := $(DIST)/include
-EXPORTS_TARGET := export
-INSTALL_TARGETS += EXPORTS
-endif
-endif # NO_DIST_INSTALL
-
-define EXPORT_NAMESPACE_RULE
-ifndef NO_DIST_INSTALL
-EXPORTS_$(namespace)_FILES := $$(EXPORTS_$(namespace))
-EXPORTS_$(namespace)_DEST := $$(DIST)/include/$(namespace)
-EXPORTS_$(namespace)_TARGET := export
-INSTALL_TARGETS += EXPORTS_$(namespace)
-endif # NO_DIST_INSTALL
-endef
-
-$(foreach namespace,$(EXPORTS_NAMESPACES),$(eval $(EXPORT_NAMESPACE_RULE)))
-
 ################################################################################
 # Copy each element of PREF_JS_EXPORTS
 

configure.in

@@ -51,7 +51,7 @@ _SUBDIR_CONFIG_ARGS="$ac_configure_args"
 dnl Set the version number of the libs included with mozilla
 dnl ========================================================
 MOZJPEG=62
-MOZPNG=10517
+MOZPNG=10606
 NSPR_VERSION=4
 NSS_VERSION=3
 
@@ -71,7 +71,7 @@ GCONF_VERSION=1.2.1
 GIO_VERSION=2.20
 STARTUP_NOTIFICATION_VERSION=0.8
 DBUS_VERSION=0.60
-SQLITE_VERSION=3.7.17
+SQLITE_VERSION=3.8.0.2
 
 MSMANIFEST_TOOL=
 
@@ -490,30 +490,14 @@ case "$target" in
 
         INCREMENTAL_LINKER=1
 
-        # Check midl version
-        _MIDL_FULL_VERSION=`"${MIDL}" -v 2>&1 | sed -nre "$_MSVC_VER_FILTER"`
-        _MIDL_MAJOR_VERSION=`echo ${_MIDL_FULL_VERSION} | $AWK -F\. '{ print $1 }'`
-        _MIDL_MINOR_VERSION=`echo ${_MIDL_FULL_VERSION} | $AWK -F\. '{ print $2 }'`
-        _MIDL_REV_VERSION=`echo ${_MIDL_FULL_VERSION} | $AWK -F\. '{ print $3 }'`
-        # Add flags if necessary
-        AC_MSG_CHECKING([for midl flags])
+        # Set midl environment
         case "$target" in
         i*86-*)
-            if test \( "$_MIDL_MAJOR_VERSION" = "7" -a "$_MIDL_MINOR_VERSION" = "00" -a "$_MIDL_REV_VERSION" = "0499" \); then
-                # MIDL version 7.00.0499 defaults /env win64 on x64 platforms.
-                # MIDL version 7.00.0500 or later has no problem.
-                MIDL_FLAGS="${MIDL_FLAGS} -env win32"
-                AC_MSG_RESULT([need -env win32])
-            else
-                AC_MSG_RESULT([none needed])
-            fi
+            MIDL_FLAGS="${MIDL_FLAGS} -env win32"
             ;;
         x86_64-*)
             MIDL_FLAGS="${MIDL_FLAGS} -env x64"
             ;;
-        *)
-            AC_MSG_RESULT([none needed])
-            ;;
         esac
 
         unset _MSVC_VER_FILTER

content/base/public/nsContentUtils.h

@@ -737,6 +737,14 @@ public:
     return sXPConnect;
   }
 
+  /**
+   * Report simple error message to the browser console
+   *   @param aErrorText the error message
+   *   @param classification Name of the module reporting error
+   */
+  static void LogSimpleConsoleError(const nsAString& aErrorText,
+                                    const char * classification);
+
   /**
    * Report a non-localized error message to the error console.
    *   @param aErrorText the error message

content/base/src/nsContentUtils.cpp

@@ -3014,6 +3014,24 @@ nsresult nsContentUtils::FormatLocalizedString(PropertiesFile aFile,
                                       getter_Copies(aResult));
 }
 
+/* static */ void
+nsContentUtils::LogSimpleConsoleError(const nsAString& aErrorText,
+                                      const char * classification)
+{
+  nsCOMPtr<nsIScriptError> scriptError =
+    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
+  if (scriptError) {
+    nsCOMPtr<nsIConsoleService> console =
+      do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+    if (console && NS_SUCCEEDED(scriptError->Init(aErrorText, EmptyString(),
+                                                  EmptyString(), 0, 0,
+                                                  nsIScriptError::errorFlag,
+                                                  classification))) {
+      console->LogMessage(scriptError);
+    }
+  }
+}
+
 /* static */ nsresult
 nsContentUtils::ReportToConsole(uint32_t aErrorFlags,
                                 const nsACString& aCategory,

content/events/src/nsEventListenerManager.cpp

@@ -900,7 +900,9 @@ nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerS
     JS::Rooted<JSObject*> boundHandler(cx);
     JS::Rooted<JSObject*> scope(cx, listener->GetEventScope());
     context->BindCompiledEventHandler(mTarget, scope, handler, &boundHandler);
-    if (listener->EventName() == nsGkAtoms::onerror && win) {
+    if (!boundHandler) {
+      listener->ForgetHandler();
+    } else if (listener->EventName() == nsGkAtoms::onerror && win) {
       nsRefPtr<OnErrorEventHandlerNonNull> handlerCallback =
         new OnErrorEventHandlerNonNull(boundHandler);
       listener->SetHandler(handlerCallback);

content/html/content/src/HTMLTemplateElement.cpp

@@ -65,9 +65,20 @@ HTMLTemplateElement::~HTMLTemplateElement()
 NS_IMPL_ADDREF_INHERITED(HTMLTemplateElement, Element)
 NS_IMPL_RELEASE_INHERITED(HTMLTemplateElement, Element)
 
-NS_IMPL_CYCLE_COLLECTION_INHERITED_1(HTMLTemplateElement,
-                                     nsGenericHTMLElement,
-                                     mContent)
+NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLTemplateElement)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLTemplateElement,
+                                                nsGenericHTMLElement)
+  if (tmp->mContent) {
+    tmp->mContent->SetHost(nullptr);
+    tmp->mContent = nullptr;
+  }
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLTemplateElement,
+                                                  nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContent)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 // QueryInterface implementation for HTMLTemplateElement
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(HTMLTemplateElement)

content/media/TextTrackCue.cpp

@@ -8,6 +8,7 @@
 #include "nsIFrame.h"
 #include "nsVideoFrame.h"
 #include "nsComponentManagerUtils.h"
+#include "mozilla/ClearOnShutdown.h"
 
 // Alternate value for the 'auto' keyword.
 #define WEBVTT_AUTO -1
@@ -162,6 +163,7 @@ TextTrackCue::GetCueAsHTML()
       return mDocument->CreateDocumentFragment();
     }
     sParserWrapper = parserWrapper;
+    ClearOnShutdown(&sParserWrapper);
   }
 
   nsPIDOMWindow* window = mDocument->GetWindow();

content/media/test/Makefile.in

@@ -64,10 +64,16 @@ MOCHITEST_FILES = \
 		test_audio1.html \
 		test_audio2.html \
 		test_autoplay.html \
+		test_bug448534.html \
+		test_bug463162.xhtml \
 		test_bug495145.html \
 		test_bug495300.html \
 		test_bug654550.html \
 		test_bug686942.html \
+		test_bug883173.html \
+		test_bug895305.html \
+		test_bug895091.html \
+		test_bug919265.html \
 		test_can_play_type.html \
 		test_can_play_type_mpeg.html \
 		test_closing_connections.html \
@@ -118,8 +124,6 @@ MOCHITEST_FILES = \
 		test_mozHasAudio.html \
 		test_source_media.html \
 		test_autoplay_contentEditable.html \
-		test_bug448534.html \
-		test_bug463162.xhtml \
 		test_decoder_disable.html \
 		test_mediarecorder_record_no_timeslice.html \
 		test_mediarecorder_reload_crash.html \
@@ -147,9 +151,6 @@ MOCHITEST_FILES = \
 		test_VideoPlaybackQuality.html \
 		test_VideoPlaybackQuality_disabled.html \
 		test_webvtt_disabled.html \
-		test_bug895305.html \
-		test_bug895091.html \
-		test_bug883173.html \
 		$(NULL)
 
 # Don't run in suite

content/media/test/crashtests/882549.html

@@ -2,8 +2,8 @@
 <html>
     <head>
         <script>
-            var o0 = new TextTrackCue(0.000, 1.000, 'Bug882549');
-            var o1 = o0.getCueAsHTML(0);
+            var o0 = new VTTCue(0.000, 1.000, 'Bug882549');
+            var o1 = o0.getCueAsHTML();
         </script>
     </head>
     <body>

content/media/test/crashtests/894104.html

@@ -8,9 +8,9 @@ function boom()
 {
   var frame = document.getElementById("f");
   var frameWin = frame.contentWindow;
-  frameWin.TextTrackCue;
+  frameWin.VTTCue;
   document.body.removeChild(frame);
-  frameWin.TextTrackCue(0, 1, "Bug 894104").getCueAsHTML();
+  frameWin.VTTCue(0, 1, "Bug 894104").getCueAsHTML();
 }
 
 </script>

content/media/test/test_bug919265.html

@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=919265
+-->
+<head>
+  <meta charset='utf-8'>
+  <title>Regression test for bug 919265 - Leak on VTTCue::GetCueAsHTML()</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({"set": [["media.webvtt.enabled", true]]},
+  function() {
+    // We shouldn't leak upon shutdown.
+    (new VTTCue(0, 0, "")).getCueAsHTML();
+    // We need to assert something for Mochitest to be happy.
+    ok(true);
+    SimpleTest.finish();
+  }
+);
+</script>
+</pre>
+</body>
+</html>

content/svg/content/test/bbox-helper.svg

@@ -21,6 +21,8 @@
   <g id="e">
     <!-- empty container should not affect parent's bbox -->
     <g/>
+    <!-- nor should an empty text element -->
+    <text x="185" y="25"/>
     <circle cx="100" cy="100" r="5"/>
     <g/>
     <circle cx="100" cy="100" r="5"/>

content/svg/content/test/bounds-helper.svg

@@ -27,5 +27,10 @@ text { font: 20px monospace; }
     <rect id="rect4" x="150" y="50" width="50" height="50" fill="yellow"/>
     <rect id="rect4a" x="150" y="50" width="50" height="50" fill="none" stroke-width="4" stroke="blue"/>
   </g>
+  <text id="text4" x="185" y="25"/>
+  <g id="g2">
+    <rect x="100" y="100" width="50" height="50" fill="pink"/>
+    <text x="200" y="200"/>
+  </g>
 </g>
 </svg>

content/svg/content/test/test_bounds.html

@@ -141,6 +141,18 @@ function runTest()
   is(iBounds.width, 200, "i.getBoundingClientRect().width");
   is(iBounds.height, 200, "i.getBoundingClientRect().height");
 
+  var text4Bounds = doc.getElementById("text4").getBoundingClientRect();
+  is(text4Bounds.left, 0, "text4.getBoundingClientRect().left");
+  is(text4Bounds.top, 0, "text4.getBoundingClientRect().top");
+  is(text4Bounds.width, 0, "text4.getBoundingClientRect().width");
+  is(text4Bounds.height, 0, "text4.getBoundingClientRect().height");
+
+  var gBounds = doc.getElementById("g2").getBoundingClientRect();
+  is(gBounds.left, 100, "g2.getBoundingClientRect().left");
+  is(gBounds.top, 100, "g2.getBoundingClientRect().top");
+  is(gBounds.width, 50, "g2.getBoundingClientRect().width");
+  is(gBounds.height, 50, "g2.getBoundingClientRect().height");
+
   SimpleTest.finish();
 }
 

db/sqlite3/README.MOZILLA

@@ -1,6 +1,6 @@
-This is sqlite 3.7.17
+This is sqlite 3.8.0.2
 
--- Ryan VanderMeulen <ryanvm@gmail.com>, 05/2013
+-- Ryan VanderMeulen <ryanvm@gmail.com>, 09/2013
 
 See http://www.sqlite.org/ for more info.
 

db/sqlite3/src/sqlite3.h

@@ -107,9 +107,9 @@ extern "C" {
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.7.17"
-#define SQLITE_VERSION_NUMBER 3007017
-#define SQLITE_SOURCE_ID      "2013-05-20 00:56:22 118a3b35693b134d56ebd780123b7fd6f1497668"
+#define SQLITE_VERSION        "3.8.0.2"
+#define SQLITE_VERSION_NUMBER 3008000
+#define SQLITE_SOURCE_ID      "2013-09-03 17:11:13 7dd4968f235d6e1ca9547cda9cf3bd570e1609ef"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -478,8 +478,10 @@ SQLITE_API int sqlite3_exec(
 #define SQLITE_IOERR_SEEK              (SQLITE_IOERR | (22<<8))
 #define SQLITE_IOERR_DELETE_NOENT      (SQLITE_IOERR | (23<<8))
 #define SQLITE_IOERR_MMAP              (SQLITE_IOERR | (24<<8))
+#define SQLITE_IOERR_GETTEMPPATH       (SQLITE_IOERR | (25<<8))
 #define SQLITE_LOCKED_SHAREDCACHE      (SQLITE_LOCKED |  (1<<8))
 #define SQLITE_BUSY_RECOVERY           (SQLITE_BUSY   |  (1<<8))
+#define SQLITE_BUSY_SNAPSHOT           (SQLITE_BUSY   |  (2<<8))
 #define SQLITE_CANTOPEN_NOTEMPDIR      (SQLITE_CANTOPEN | (1<<8))
 #define SQLITE_CANTOPEN_ISDIR          (SQLITE_CANTOPEN | (2<<8))
 #define SQLITE_CANTOPEN_FULLPATH       (SQLITE_CANTOPEN | (3<<8))
@@ -499,6 +501,7 @@ SQLITE_API int sqlite3_exec(
 #define SQLITE_CONSTRAINT_VTAB         (SQLITE_CONSTRAINT | (9<<8))
 #define SQLITE_NOTICE_RECOVER_WAL      (SQLITE_NOTICE | (1<<8))
 #define SQLITE_NOTICE_RECOVER_ROLLBACK (SQLITE_NOTICE | (2<<8))
+#define SQLITE_WARNING_AUTOINDEX       (SQLITE_WARNING | (1<<8))
 
 /*
 ** CAPI3REF: Flags For File Open Operations
@@ -2557,9 +2560,10 @@ SQLITE_API SQLITE_EXPERIMENTAL void *sqlite3_profile(sqlite3*,
 ** interface is to keep a GUI updated during a large query.
 **
 ** ^The parameter P is passed through as the only parameter to the 
-** callback function X.  ^The parameter N is the number of 
+** callback function X.  ^The parameter N is the approximate number of 
 ** [virtual machine instructions] that are evaluated between successive
-** invocations of the callback X.
+** invocations of the callback X.  ^If N is less than one then the progress
+** handler is disabled.
 **
 ** ^Only a single progress handler may be defined at one time per
 ** [database connection]; setting a new progress handler cancels the
@@ -4179,41 +4183,49 @@ SQLITE_API sqlite3 *sqlite3_context_db_handle(sqlite3_context*);
 /*
 ** CAPI3REF: Function Auxiliary Data
 **
-** The following two functions may be used by scalar SQL functions to
+** These functions may be used by (non-aggregate) SQL functions to
 ** associate metadata with argument values. If the same value is passed to
 ** multiple invocations of the same SQL function during query execution, under
-** some circumstances the associated metadata may be preserved. This may
-** be used, for example, to add a regular-expression matching scalar
-** function. The compiled version of the regular expression is stored as
-** metadata associated with the SQL value passed as the regular expression
-** pattern.  The compiled regular expression can be reused on multiple
-** invocations of the same function so that the original pattern string
-** does not need to be recompiled on each invocation.
+** some circumstances the associated metadata may be preserved.  An example
+** of where this might be useful is in a regular-expression matching
+** function. The compiled version of the regular expression can be stored as
+** metadata associated with the pattern string.  
+** Then as long as the pattern string remains the same,
+** the compiled regular expression can be reused on multiple
+** invocations of the same function.
 **
 ** ^The sqlite3_get_auxdata() interface returns a pointer to the metadata
 ** associated by the sqlite3_set_auxdata() function with the Nth argument
-** value to the application-defined function. ^If no metadata has been ever
-** been set for the Nth argument of the function, or if the corresponding
-** function parameter has changed since the meta-data was set,
-** then sqlite3_get_auxdata() returns a NULL pointer.
+** value to the application-defined function. ^If there is no metadata
+** associated with the function argument, this sqlite3_get_auxdata() interface
+** returns a NULL pointer.
 **
-** ^The sqlite3_set_auxdata() interface saves the metadata
-** pointed to by its 3rd parameter as the metadata for the N-th
-** argument of the application-defined function.  Subsequent
-** calls to sqlite3_get_auxdata() might return this data, if it has
-** not been destroyed.
-** ^If it is not NULL, SQLite will invoke the destructor
-** function given by the 4th parameter to sqlite3_set_auxdata() on
-** the metadata when the corresponding function parameter changes
-** or when the SQL statement completes, whichever comes first.
+** ^The sqlite3_set_auxdata(C,N,P,X) interface saves P as metadata for the N-th
+** argument of the application-defined function.  ^Subsequent
+** calls to sqlite3_get_auxdata(C,N) return P from the most recent
+** sqlite3_set_auxdata(C,N,P,X) call if the metadata is still valid or
+** NULL if the metadata has been discarded.
+** ^After each call to sqlite3_set_auxdata(C,N,P,X) where X is not NULL,
+** SQLite will invoke the destructor function X with parameter P exactly
+** once, when the metadata is discarded.
+** SQLite is free to discard the metadata at any time, including: <ul>
+** <li> when the corresponding function parameter changes, or
+** <li> when [sqlite3_reset()] or [sqlite3_finalize()] is called for the
+**      SQL statement, or
+** <li> when sqlite3_set_auxdata() is invoked again on the same parameter, or
+** <li> during the original sqlite3_set_auxdata() call when a memory 
+**      allocation error occurs. </ul>)^
 **
-** SQLite is free to call the destructor and drop metadata on any
-** parameter of any function at any time.  ^The only guarantee is that
-** the destructor will be called before the metadata is dropped.
+** Note the last bullet in particular.  The destructor X in 
+** sqlite3_set_auxdata(C,N,P,X) might be called immediately, before the
+** sqlite3_set_auxdata() interface even returns.  Hence sqlite3_set_auxdata()
+** should be called near the end of the function implementation and the
+** function implementation should not make any use of P after
+** sqlite3_set_auxdata() has been called.
 **
 ** ^(In practice, metadata is preserved between function calls for
-** expressions that are constant at compile time. This includes literal
-** values and [parameters].)^
+** function parameters that are compile-time constants, including literal
+** values and [parameters] and expressions composed from the same.)^
 **
 ** These routines must be called from the same thread in which
 ** the SQL function is running.
@@ -4518,6 +4530,11 @@ SQLITE_API int sqlite3_key(
   sqlite3 *db,                   /* Database to be rekeyed */
   const void *pKey, int nKey     /* The key */
 );
+SQLITE_API int sqlite3_key_v2(
+  sqlite3 *db,                   /* Database to be rekeyed */
+  const char *zDbName,           /* Name of the database */
+  const void *pKey, int nKey     /* The key */
+);
 
 /*
 ** Change the key on an open database.  If the current database is not
@@ -4531,6 +4548,11 @@ SQLITE_API int sqlite3_rekey(
   sqlite3 *db,                   /* Database to be rekeyed */
   const void *pKey, int nKey     /* The new key */
 );
+SQLITE_API int sqlite3_rekey_v2(
+  sqlite3 *db,                   /* Database to be rekeyed */
+  const char *zDbName,           /* Name of the database */
+  const void *pKey, int nKey     /* The new key */
+);
 
 /*
 ** Specify the activation key for a SEE database.  Unless 
@@ -5116,10 +5138,23 @@ SQLITE_API int sqlite3_enable_load_extension(sqlite3 *db, int onoff);
 ** on the list of automatic extensions is a harmless no-op. ^No entry point
 ** will be called more than once for each database connection that is opened.
 **
-** See also: [sqlite3_reset_auto_extension()].
+** See also: [sqlite3_reset_auto_extension()]
+** and [sqlite3_cancel_auto_extension()]
 */
 SQLITE_API int sqlite3_auto_extension(void (*xEntryPoint)(void));
 
+/*
+** CAPI3REF: Cancel Automatic Extension Loading
+**
+** ^The [sqlite3_cancel_auto_extension(X)] interface unregisters the
+** initialization routine X that was registered using a prior call to
+** [sqlite3_auto_extension(X)].  ^The [sqlite3_cancel_auto_extension(X)]
+** routine returns 1 if initialization routine X was successfully 
+** unregistered and it returns 0 if X was not on the list of initialization
+** routines.
+*/
+SQLITE_API int sqlite3_cancel_auto_extension(void (*xEntryPoint)(void));
+
 /*
 ** CAPI3REF: Reset Automatic Extension Loading
 **
@@ -6232,6 +6267,12 @@ SQLITE_API int sqlite3_db_status(sqlite3*, int op, int *pCur, int *pHiwtr, int r
 ** on subsequent SQLITE_DBSTATUS_CACHE_WRITE requests is undefined.)^ ^The
 ** highwater mark associated with SQLITE_DBSTATUS_CACHE_WRITE is always 0.
 ** </dd>
+**
+** [[SQLITE_DBSTATUS_DEFERRED_FKS]] ^(<dt>SQLITE_DBSTATUS_DEFERRED_FKS</dt>
+** <dd>This parameter returns zero for the current value if and only if
+** all foreign key constraints (deferred or immediate) have been
+** resolved.)^  ^The highwater mark is always 0.
+** </dd>
 ** </dl>
 */
 #define SQLITE_DBSTATUS_LOOKASIDE_USED       0
@@ -6244,7 +6285,8 @@ SQLITE_API int sqlite3_db_status(sqlite3*, int op, int *pCur, int *pHiwtr, int r
 #define SQLITE_DBSTATUS_CACHE_HIT            7
 #define SQLITE_DBSTATUS_CACHE_MISS           8
 #define SQLITE_DBSTATUS_CACHE_WRITE          9
-#define SQLITE_DBSTATUS_MAX                  9   /* Largest defined DBSTATUS */
+#define SQLITE_DBSTATUS_DEFERRED_FKS        10
+#define SQLITE_DBSTATUS_MAX                 10   /* Largest defined DBSTATUS */
 
 
 /*
@@ -6298,11 +6340,21 @@ SQLITE_API int sqlite3_stmt_status(sqlite3_stmt*, int op,int resetFlg);
 ** A non-zero value in this counter may indicate an opportunity to
 ** improvement performance by adding permanent indices that do not
 ** need to be reinitialized each time the statement is run.</dd>
+**
+** [[SQLITE_STMTSTATUS_VM_STEP]] <dt>SQLITE_STMTSTATUS_VM_STEP</dt>
+** <dd>^This is the number of virtual machine operations executed
+** by the prepared statement if that number is less than or equal
+** to 2147483647.  The number of virtual machine operations can be 
+** used as a proxy for the total work done by the prepared statement.
+** If the number of virtual machine operations exceeds 2147483647
+** then the value returned by this statement status code is undefined.
+** </dd>
 ** </dl>
 */
 #define SQLITE_STMTSTATUS_FULLSCAN_STEP     1
 #define SQLITE_STMTSTATUS_SORT              2
 #define SQLITE_STMTSTATUS_AUTOINDEX         3
+#define SQLITE_STMTSTATUS_VM_STEP           4
 
 /*
 ** CAPI3REF: Custom Page Cache Object
@@ -7181,7 +7233,7 @@ SQLITE_API int sqlite3_vtab_on_conflict(sqlite3 *);
 #ifdef __cplusplus
 }  /* End of the 'extern "C"' block */
 #endif
-#endif
+#endif /* _SQLITE3_H_ */
 
 /*
 ** 2010 August 30

dom/base/nsGlobalWindow.cpp

@@ -5999,7 +5999,7 @@ nsGlobalWindow::ResizeTo(int32_t aWidth, int32_t aHeight)
    * If caller is a browser-element then dispatch a resize event to
    * the embedder.
    */
-  if (mDocShell->GetIsBrowserOrApp()) {
+  if (mDocShell && mDocShell->GetIsBrowserOrApp()) {
     nsIntSize size(aWidth, aHeight);
     if (!DispatchResizeEvent(size)) {
       // The embedder chose to prevent the default action for this
@@ -6039,7 +6039,7 @@ nsGlobalWindow::ResizeBy(int32_t aWidthDif, int32_t aHeightDif)
    * If caller is a browser-element then dispatch a resize event to
    * parent.
    */
-  if (mDocShell->GetIsBrowserOrApp()) {
+  if (mDocShell && mDocShell->GetIsBrowserOrApp()) {
     CSSIntSize size;
     nsresult rv = GetInnerSize(size);
     NS_ENSURE_SUCCESS(rv, NS_OK);

dom/base/nsIJSEventListener.h

@@ -214,6 +214,11 @@ public:
     return mHandler;
   }
 
+  void ForgetHandler()
+  {
+    mHandler.ForgetHandler();
+  }
+
   nsIAtom* EventName() const
   {
     return mEventName;

dom/bindings/BindingUtils.cpp

@@ -1019,13 +1019,21 @@ XrayResolveProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
         for ( ; methodIds[i] != JSID_VOID; ++i) {
           if (id == methodIds[i]) {
             const JSFunctionSpec& methodSpec = methodsSpecs[i];
-            JSFunction *fun = JS_NewFunctionById(cx, methodSpec.call.op,
-                                                 methodSpec.nargs, 0,
-                                                 wrapper, id);
-            if (!fun) {
-              return false;
+            JSFunction *fun;
+            if (methodSpec.selfHostedName) {
+              fun = JS::GetSelfHostedFunction(cx, methodSpec.selfHostedName, id, methodSpec.nargs);
+              if (!fun) {
+                return false;
+              }
+              MOZ_ASSERT(!methodSpec.call.op, "Bad FunctionSpec declaration: non-null native");
+              MOZ_ASSERT(!methodSpec.call.info, "Bad FunctionSpec declaration: non-null jitinfo");
+            } else {
+              fun = JS_NewFunctionById(cx, methodSpec.call.op, methodSpec.nargs, 0, wrapper, id);
+              if (!fun) {
+                return false;
+              }
+              SET_JITINFO(fun, methodSpec.call.info);
             }
-            SET_JITINFO(fun, methodSpec.call.info);
             JSObject *funobj = JS_GetFunctionObject(fun);
             desc.value().setObject(*funobj);
             desc.setAttributes(methodSpec.flags);

dom/bindings/Codegen.py

@@ -1571,17 +1571,25 @@ class MethodDefiner(PropertyDefiner):
             return m["condition"]
 
         def specData(m):
-            accessor = m.get("nativeName", m["name"])
-            if m.get("methodInfo", True):
-                jitinfo = ("&%s_methodinfo" % accessor)
-                accessor = "genericMethod"
-            else:
+            if "selfHostedName" in m:
+                selfHostedName = '"%s"' % m["selfHostedName"]
+                assert not m.get("methodInfo", True)
+                accessor = "nullptr"
                 jitinfo = "nullptr"
-            return (m["name"], accessor, jitinfo, m["length"], m["flags"])
+            else:
+                selfHostedName = "nullptr";
+                accessor = m.get("nativeName", m["name"])
+                if m.get("methodInfo", True):
+                    jitinfo = ("&%s_methodinfo" % accessor)
+                    accessor = "genericMethod"
+                else:
+                    jitinfo = "nullptr"
+
+            return (m["name"], accessor, jitinfo, m["length"], m["flags"], selfHostedName)
 
         return self.generatePrefableArray(
             array, name,
-            '  JS_FNINFO("%s", %s, %s, %s, %s)',
+            '  JS_FNSPEC("%s", %s, %s, %s, %s, %s)',
             '  JS_FS_END',
             'JSFunctionSpec',
             condition, specData, doIdArrays)

dom/bindings/Makefile.in

@@ -60,7 +60,7 @@ globalgen_targets := \
 # would break |make FooBinding.o(bj)|.  Ah, well.
 ifneq (export TestExampleInterface-example TestExampleProxyInterface-example,$(MAKECMDGOALS))
 CPPSRCS = \
-  $(linked_binding_cpp_files) \
+  $(unified_binding_cpp_files) \
   $(linked_generated_events_cpp_files) \
   $(filter %.cpp, $(globalgen_targets)) \
   BindingUtils.cpp \
@@ -258,6 +258,7 @@ GARBAGE += \
   parser.out \
   $(wildcard *-example.h) \
   $(wildcard *-example.cpp) \
+  $(unified_binding_cpp_files) \
   .BindingGen \
   .all-webidl-file-list \
   .generated-events-webidl-files \

extensions/spellcheck/hunspell/src/mozHunspellDirProvider.h

@@ -37,6 +37,7 @@
 #define mozHunspellDirProvider_h__
 
 #include "nsIDirectoryService.h"
+#include "nsIFile.h"
 #include "nsISimpleEnumerator.h"
 #include "mozilla/Attributes.h"
 

image/decoders/nsGIFDecoder2.cpp

@@ -665,6 +665,12 @@ nsGIFDecoder2::WriteInternal(const char *aBuffer, uint32_t aCount)
       mGIFStruct.screen_height = GETINT16(q + 2);
       mGIFStruct.global_colormap_depth = (q[4]&0x07) + 1;
 
+      if (IsSizeDecode()) {
+        MOZ_ASSERT(!mGIFOpen, "Gif should not be open at this point");
+        PostSize(mGIFStruct.screen_width, mGIFStruct.screen_height);
+        return;
+      }
+
       // screen_bgcolor is not used
       //mGIFStruct.screen_bgcolor = q[5];
       // q[6] = Pixel Aspect Ratio

image/test/crashtests/crashtests.list

@@ -41,3 +41,7 @@ load truncated-second-frame.png # bug 863975
 # This icon's size is such that it leads to multiple writes to the PNG decoder
 # after we've gotten our size.
 load multiple-png-hassize.ico
+
+# Bug 856615
+# Asserts in the debug build
+load 856616.gif

js/jsd/jsd_stak.cpp

@@ -544,11 +544,10 @@ JSDValue*
 jsd_GetException(JSDContext* jsdc, JSDThreadState* jsdthreadstate)
 {
     JSContext* cx;
-    JS::RootedValue val(cx);
-
     if(!(cx = _getContextForThreadState(jsdc, jsdthreadstate)))
         return nullptr;
 
+    JS::RootedValue val(cx);
     if(JS_GetPendingException(cx, &val))
         return jsd_NewValue(jsdc, val);
     return nullptr;

js/src/build/autoconf/python-virtualenv.m4

@@ -74,5 +74,12 @@ if test "$?" != 0; then
     AC_MSG_ERROR([Python environment does not appear to be sane.])
 fi
 AC_MSG_RESULT([yes])
+
+PYTHON_SITE_PACKAGES=`$PYTHON -c "import distutils.sysconfig; print distutils.sysconfig.get_python_lib()"`
+if test -z "$PYTHON_SITE_PACKAGES"; then
+    AC_MSG_ERROR([Could not determine python site packages directory.])
+fi
+AC_SUBST([PYTHON_SITE_PACKAGES])
+
 ])
 

js/src/builtin/Intl.cpp

@@ -570,12 +570,12 @@ collator_toSource(JSContext *cx, unsigned argc, Value *vp)
 #endif
 
 static const JSFunctionSpec collator_static_methods[] = {
-    {"supportedLocalesOf", JSOP_NULLWRAPPER, 1, JSFunction::INTERPRETED, "Intl_Collator_supportedLocalesOf"},
+    JS_SELF_HOSTED_FN("supportedLocalesOf", "Intl_Collator_supportedLocalesOf", 1, 0),
     JS_FS_END
 };
 
 static const JSFunctionSpec collator_methods[] = {
-    {"resolvedOptions", JSOP_NULLWRAPPER, 0, JSFunction::INTERPRETED, "Intl_Collator_resolvedOptions"},
+    JS_SELF_HOSTED_FN("resolvedOptions", "Intl_Collator_resolvedOptions", 0, 0),
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str, collator_toSource, 0, 0),
 #endif
@@ -1053,12 +1053,12 @@ numberFormat_toSource(JSContext *cx, unsigned argc, Value *vp)
 #endif
 
 static const JSFunctionSpec numberFormat_static_methods[] = {
-    {"supportedLocalesOf", JSOP_NULLWRAPPER, 1, JSFunction::INTERPRETED, "Intl_NumberFormat_supportedLocalesOf"},
+    JS_SELF_HOSTED_FN("supportedLocalesOf", "Intl_NumberFormat_supportedLocalesOf", 1, 0),
     JS_FS_END
 };
 
 static const JSFunctionSpec numberFormat_methods[] = {
-    {"resolvedOptions", JSOP_NULLWRAPPER, 0, JSFunction::INTERPRETED, "Intl_NumberFormat_resolvedOptions"},
+    JS_SELF_HOSTED_FN("resolvedOptions", "Intl_NumberFormat_resolvedOptions", 0, 0),
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str, numberFormat_toSource, 0, 0),
 #endif
@@ -1510,12 +1510,12 @@ dateTimeFormat_toSource(JSContext *cx, unsigned argc, Value *vp)
 #endif
 
 static const JSFunctionSpec dateTimeFormat_static_methods[] = {
-    {"supportedLocalesOf", JSOP_NULLWRAPPER, 1, JSFunction::INTERPRETED, "Intl_DateTimeFormat_supportedLocalesOf"},
+    JS_SELF_HOSTED_FN("supportedLocalesOf", "Intl_DateTimeFormat_supportedLocalesOf", 1, 0),
     JS_FS_END
 };
 
 static const JSFunctionSpec dateTimeFormat_methods[] = {
-    {"resolvedOptions", JSOP_NULLWRAPPER, 0, JSFunction::INTERPRETED, "Intl_DateTimeFormat_resolvedOptions"},
+    JS_SELF_HOSTED_FN("resolvedOptions", "Intl_DateTimeFormat_resolvedOptions", 0, 0),
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str, dateTimeFormat_toSource, 0, 0),
 #endif

js/src/builtin/MapObject.cpp

@@ -1039,7 +1039,7 @@ const JSFunctionSpec MapObject::methods[] = {
     JS_FN("keys", keys, 0, 0),
     JS_FN("values", values, 0, 0),
     JS_FN("clear", clear, 0, 0),
-    {"forEach", {nullptr, nullptr}, 2, 0, "MapForEach"},
+    JS_SELF_HOSTED_FN("forEach", "MapForEach", 2, 0),
     JS_FS_END
 };
 
@@ -1600,7 +1600,7 @@ const JSFunctionSpec SetObject::methods[] = {
     JS_FN("delete", delete_, 1, 0),
     JS_FN("entries", entries, 0, 0),
     JS_FN("clear", clear, 0, 0),
-    {"forEach", {nullptr, nullptr}, 2, 0, "SetForEach"},
+    JS_SELF_HOSTED_FN("forEach", "SetForEach", 2, 0),
     JS_FS_END
 };
 

js/src/builtin/ParallelArray.cpp

@@ -23,13 +23,13 @@ using namespace js;
 FixedHeapPtr<PropertyName> ParallelArrayObject::ctorNames[NumCtors];
 
 const JSFunctionSpec ParallelArrayObject::methods[] = {
-    { "map",       JSOP_NULLWRAPPER, 2, 0, "ParallelArrayMap"       },
-    { "reduce",    JSOP_NULLWRAPPER, 2, 0, "ParallelArrayReduce"    },
-    { "scan",      JSOP_NULLWRAPPER, 2, 0, "ParallelArrayScan"      },
-    { "scatter",   JSOP_NULLWRAPPER, 5, 0, "ParallelArrayScatter"   },
-    { "filter",    JSOP_NULLWRAPPER, 2, 0, "ParallelArrayFilter"    },
-    { "partition", JSOP_NULLWRAPPER, 1, 0, "ParallelArrayPartition" },
-    { "flatten",   JSOP_NULLWRAPPER, 0, 0, "ParallelArrayFlatten" },
+    JS_SELF_HOSTED_FN("map",       "ParallelArrayMap",       2, 0),
+    JS_SELF_HOSTED_FN("reduce",    "ParallelArrayReduce",    2, 0),
+    JS_SELF_HOSTED_FN("scan",      "ParallelArrayScan",      2, 0),
+    JS_SELF_HOSTED_FN("scatter",   "ParallelArrayScatter",   5, 0),
+    JS_SELF_HOSTED_FN("filter",    "ParallelArrayFilter",    2, 0),
+    JS_SELF_HOSTED_FN("partition", "ParallelArrayPartition", 1, 0),
+    JS_SELF_HOSTED_FN("flatten",   "ParallelArrayFlatten",   0, 0),
 
     // FIXME #838906. Note that `get()` is not currently defined on this table but
     // rather is assigned to each instance of ParallelArray as an own
@@ -38,9 +38,9 @@ const JSFunctionSpec ParallelArrayObject::methods[] = {
     // receiver.  In the future we can improve this by (1) extending
     // TI to track the dimensionality of the receiver and (2) using a
     // hint to aggressively inline calls to get().
-    // { "get",      JSOP_NULLWRAPPER, 1, 0, "ParallelArrayGet" },
+    // JS_SELF_HOSTED_FN("get", "ParallelArrayGet", 1, 0),
 
-    { "toString", JSOP_NULLWRAPPER, 0, 0, "ParallelArrayToString" },
+    JS_SELF_HOSTED_FN("toString",  "ParallelArrayToString",  0, 0),
     JS_FS_END
 };
 

js/src/config/config.mk

@@ -132,7 +132,7 @@ SLEEP ?= sleep
 TOUCH ?= touch
 
 ifdef .PYMAKE
-PYCOMMANDPATH += $(topsrcdir)/config
+PYCOMMANDPATH += $(PYTHON_SITE_PACKAGES)
 endif
 
 PYTHON_PATH = $(PYTHON) $(topsrcdir)/config/pythonpath.py

js/src/config/expandlibs_exec.py

@@ -318,7 +318,11 @@ def main():
 
         if options.verbose:
             print_command(sys.stderr, args)
-        proc = subprocess.Popen(args, stdout = subprocess.PIPE, stderr = subprocess.STDOUT)
+        try:
+            proc = subprocess.Popen(args, stdout = subprocess.PIPE, stderr = subprocess.STDOUT)
+        except Exception, e:
+            print >>sys.stderr, 'error: Launching', args, ':', e
+            raise e
         (stdout, stderr) = proc.communicate()
         if proc.returncode and not options.verbose:
             print_command(sys.stderr, args)

js/src/config/rules.mk

@@ -1254,9 +1254,6 @@ $(DEPTH)/config/autoconf.mk: $(topsrcdir)/config/autoconf.mk.in
 # Bunch of things that extend the 'export' rule (in order):
 ###############################################################################
 
-################################################################################
-# Copy each element of EXPORTS to $(DIST)/include
-
 ifneq ($(XPI_NAME),)
 $(FINAL_TARGET):
 	$(NSINSTALL) -D $@
@@ -1264,26 +1261,6 @@ $(FINAL_TARGET):
 export:: $(FINAL_TARGET)
 endif
 
-ifndef NO_DIST_INSTALL
-ifneq (,$(EXPORTS))
-EXPORTS_FILES := $(EXPORTS)
-EXPORTS_DEST := $(DIST)/include
-EXPORTS_TARGET := export
-INSTALL_TARGETS += EXPORTS
-endif
-endif # NO_DIST_INSTALL
-
-define EXPORT_NAMESPACE_RULE
-ifndef NO_DIST_INSTALL
-EXPORTS_$(namespace)_FILES := $$(EXPORTS_$(namespace))
-EXPORTS_$(namespace)_DEST := $$(DIST)/include/$(namespace)
-EXPORTS_$(namespace)_TARGET := export
-INSTALL_TARGETS += EXPORTS_$(namespace)
-endif # NO_DIST_INSTALL
-endef
-
-$(foreach namespace,$(EXPORTS_NAMESPACES),$(eval $(EXPORT_NAMESPACE_RULE)))
-
 ################################################################################
 # Copy each element of PREF_JS_EXPORTS
 

js/src/editline/Makefile.ref

@@ -1,110 +0,0 @@
-# -*- Mode: makefile -*-
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-# Copyright 1992,1993 Simmule Turner and Rich Salz.  All rights reserved.
-#
-# This software is not subject to any license of the American Telephone
-# and Telegraph Company or of the Regents of the University of California.
-#
-# Permission is granted to anyone to use this software for any purpose on
-# any computer system, and to alter it and redistribute it freely, subject
-# to the following restrictions:
-# 1. The authors are not responsible for the consequences of use of this
-#    software, no matter how awful, even if they arise from flaws in it.
-# 2. The origin of this software must not be misrepresented, either by
-#    explicit claim or by omission.  Since few users ever read sources,
-#    credits must appear in the documentation.
-# 3. Altered versions must be plainly marked as such, and must not be
-#    misrepresented as being the original software.  Since few users
-#    ever read sources, credits must appear in the documentation.
-# 4. This notice may not be removed or altered.
-#
-
-#
-#  Unix makefile for editline library.
-#
-
-##  Set your options:
-##	-DANSI_ARROWS		ANSI arrows keys work like emacs.
-##	-DHAVE_STDLIB		Have <stdlib.h>.
-##	-DHAVE_TCGETATTR	Have tcgetattr(), tcsetattr().
-##	-DHAVE_TERMIO		Have "struct termio" and <termio.h>
-##	(If neither of above two, we use <sgttyb.h> and BSD ioctl's)
-##	-DHIDE			Make static functions static (non debug).
-##	-DHIST_SIZE=n		History size.
-##	-DNEED_STRDUP		Don't have strdup().
-##	-DUNIQUE_HISTORY	Don't save command if same as last one.
-##	-DUSE_DIRENT		Use <dirent.h>, not <sys/dir.h>?
-##	-DUSE_TERMCAP		Use the termcap library for terminal size
-##				see LDFLAGS, below, if you set this.
-##	-DNEED_PERROR		Don't have perror() (used in testit)
-
-##  If you have -DUSE_TERMCAP, set this as appropriate:
-#LDFLAGS = -ltermlib
-#LDFLAGS = -ltermcap
-
-DEFS	= -DANSI_ARROWS -DHAVE_TCGETATTR -DHIDE -DUSE_DIRENT -DSYS_UNIX \
-	-DHAVE_STDLIB -DUNIQUE_HISTORY
-
-DEPTH           = ..
-
-include $(DEPTH)/config.mk
-
-LOCAL_OBJDIR = $(OBJDIR)/editline
-
-#
-# Default IEEE libm
-#
-CFLAGS          += -DXP_UNIX $(OPTIMIZER) $(OS_CFLAGS) $(DEFINES) $(INCLUDES) \
-		  $(XCFLAGS) $(DEFS)
-
-INCFILES = editline.h
-.INIT: $(INCFILES)
-.KEEP_STATE:
-EDITLINE_CFILES = editline.c sysunix.c
-
-EDITLINE_OBJS = $(addprefix $(LOCAL_OBJDIR)/, $(EDITLINE_CFILES:.c=.o))
-
-LIBRARY = $(LOCAL_OBJDIR)/libedit.a
-
-all: $(LIBRARY) 
-
-export:
-
-# make objects to depen on $(LOCAL_OBJDIR) only when it exists
-$(EDITLINE_OBJS) : $(filter-out $(wildcard $(LOCAL_OBJDIR)), $(LOCAL_OBJDIR))
-
-$(LOCAL_OBJDIR) :
-	mkdir -p $@
-
-$(LOCAL_OBJDIR)/%: %.c
-	$(CC) -o $@ $(CFLAGS) $*.c $(LDFLAGS)
-
-$(LOCAL_OBJDIR)/%.o: %.c
-	$(CC) -o $@ -c $(CFLAGS) $*.c
-
-$(LOCAL_OBJDIR)/%.o: %.s
-	$(AS) -o $@ $(ASFLAGS) $*.s
-
-$(LIBRARY): $(EDITLINE_OBJS)
-	$(AR) rv $@ $?
-	$(RANLIB) $@
-
-#libedit.a : $(EDITLINE_OBJS) 
-#	$(AR) cru $(LOCAL_OBJDIR)/libedit.a $(EDITLINE_OBJS)
-#	$(RANLIB) $(LOCAL_OBJDIR)/libedit.a
-
-clean:
-	rm -rf $(EDITLINE_OBJS) $(EDITLINE_OBJS:.o=.d)
-
-clobber: clean
-	rm -rf $(LIBRARY) $(DEPENDENCIES)
-	if test -d $(LOCAL_OBJDIR); then rmdir $(LOCAL_OBJDIR); fi
-
-SUFFIXES: .i
-%.i: %.c
-	$(CC) -C -E $(CFLAGS) $< > $*.i

js/src/jit-test/tests/gc/bug-919536.js

@@ -0,0 +1,17 @@
+if ("gczeal" in this) {
+  gczeal(2, 1000);
+
+  var a = new Array(10 * 1000);
+
+  var i = a.length;
+  while (i-- != 0) {
+    switch (i % 3) {
+     case 0:
+      a[i] = { };
+      break;
+    }
+  }
+
+  gc();
+}
+

js/src/jit/IonCaches.cpp

@@ -3341,6 +3341,11 @@ SetElementIC::attachDenseElement(JSContext *cx, IonScript *ion, JSObject *obj, c
                 masm.callPreBarrier(target, MIRType_Value);
         }
 
+        // Call post barrier if necessary, and recalculate elements pointer if it got cobbered.
+        Register postBarrierScratch = elements;
+        if (masm.maybeCallPostBarrier(object(), value(), postBarrierScratch))
+            masm.loadPtr(Address(object(), JSObject::offsetOfElements()), elements);
+
         // Store the value.
         masm.bind(&storeElem);
         masm.storeConstantOrRegister(value(), target);

js/src/jit/IonMacroAssembler.cpp

@@ -338,6 +338,53 @@ MacroAssembler::PopRegsInMaskIgnore(RegisterSet set, RegisterSet ignore)
     JS_ASSERT(diffG == 0);
 }
 
+bool MacroAssembler::maybeCallPostBarrier(Register object, ConstantOrRegister value,
+                                          Register maybeScratch) {
+    bool usedMaybeScratch = false;
+
+#ifdef JSGC_GENERATIONAL
+    JSRuntime *runtime = GetIonContext()->runtime;
+    if (value.constant()) {
+        JS_ASSERT_IF(value.value().isGCThing(),
+                     !gc::IsInsideNursery(runtime, value.value().toGCThing()));
+        return false;
+    }
+
+    TypedOrValueRegister valReg = value.reg();
+    if (valReg.hasTyped() && valReg.type() != MIRType_Object)
+        return false;
+
+    Label done;
+    Label tenured;
+    branchPtr(Assembler::Below, object, ImmWord(runtime->gcNurseryStart_), &tenured);
+    branchPtr(Assembler::Below, object, ImmWord(runtime->gcNurseryEnd_), &done);
+
+    bind(&tenured);
+    if (valReg.hasValue()) {
+        branchTestObject(Assembler::NotEqual, valReg.valueReg(), &done);
+        extractObject(valReg, maybeScratch);
+        usedMaybeScratch = true;
+    }
+    Register valObj = valReg.hasValue() ? maybeScratch : valReg.typedReg().gpr();
+    branchPtr(Assembler::Below, valObj, ImmWord(runtime->gcNurseryStart_), &done);
+    branchPtr(Assembler::AboveOrEqual, valObj, ImmWord(runtime->gcNurseryEnd_), &done);
+
+    GeneralRegisterSet saveRegs = GeneralRegisterSet::Volatile();
+    PushRegsInMask(saveRegs);
+    Register callScratch = saveRegs.getAny();
+    setupUnalignedABICall(2, callScratch);
+    movePtr(ImmPtr(runtime), callScratch);
+    passABIArg(callScratch);
+    passABIArg(object);
+    callWithABI(JS_FUNC_TO_DATA_PTR(void *, PostWriteBarrier));
+    PopRegsInMask(saveRegs);
+
+    bind(&done);
+#endif
+
+    return usedMaybeScratch;
+}
+
 void
 MacroAssembler::branchNurseryPtr(Condition cond, const Address &ptr1, const ImmMaybeNurseryPtr &ptr2,
                                  Label *label)

js/src/jit/IonMacroAssembler.h

@@ -662,6 +662,14 @@ class MacroAssembler : public MacroAssemblerSpecific
         bind(&done);
     }
 
+    /*
+     * Call the post barrier if necessary when writing value to a slot or
+     * element of object.
+     *
+     * Returns whether the maybeScratch register was used.
+     */
+    bool maybeCallPostBarrier(Register object, ConstantOrRegister value, Register maybeScratch);
+
     void branchNurseryPtr(Condition cond, const Address &ptr1, const ImmMaybeNurseryPtr &ptr2,
                           Label *label);
     void moveNurseryPtr(const ImmMaybeNurseryPtr &ptr, const Register &reg);

js/src/jit/MIR.h

@@ -8629,7 +8629,7 @@ class MAsmJSStoreHeap : public MBinaryInstruction, public MAsmJSHeapAccess
 class MAsmJSLoadGlobalVar : public MNullaryInstruction
 {
     MAsmJSLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant)
-      : globalDataOffset_(globalDataOffset)
+      : globalDataOffset_(globalDataOffset), isConstant_(isConstant)
     {
         JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
         setResultType(type);
@@ -8637,6 +8637,7 @@ class MAsmJSLoadGlobalVar : public MNullaryInstruction
     }
 
     unsigned globalDataOffset_;
+    bool isConstant_;
 
   public:
     INSTRUCTION_HEADER(AsmJSLoadGlobalVar);
@@ -8650,7 +8651,7 @@ class MAsmJSLoadGlobalVar : public MNullaryInstruction
     bool congruentTo(MDefinition *ins) const;
 
     AliasSet getAliasSet() const {
-        return AliasSet::Load(AliasSet::AsmJSGlobalVar);
+        return isConstant_ ? AliasSet::None() : AliasSet::Load(AliasSet::AsmJSGlobalVar);
     }
 
     bool mightAlias(MDefinition *def);

js/src/jit/shared/CodeGenerator-x86-shared.cpp

@@ -226,7 +226,7 @@ CodeGeneratorX86Shared::visitAsmJSPassStackArg(LAsmJSPassStackArg *ins)
     const MAsmJSPassStackArg *mir = ins->mir();
     Address dst(StackPointer, mir->spOffset());
     if (ins->arg()->isConstant()) {
-        masm.store32(Imm32(ToInt32(ins->arg())), dst);
+        masm.storePtr(ImmWord(ToInt32(ins->arg())), dst);
     } else {
         if (ins->arg()->isGeneralReg())
             masm.storePtr(ToRegister(ins->arg()), dst);

js/src/jsapi.cpp

@@ -4034,13 +4034,32 @@ JS_NewFunctionById(JSContext *cx, JSNative native, unsigned nargs, unsigned flag
     RootedObject parent(cx, parentArg);
     JS_ASSERT(JSID_IS_STRING(id));
     JS_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
+    JS_ASSERT(native);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, parent);
 
-    RootedAtom atom(cx, JSID_TO_ATOM(id));
+    RootedAtom name(cx, JSID_TO_ATOM(id));
     JSFunction::Flags funFlags = JSAPIToJSFunctionFlags(flags);
-    return NewFunction(cx, NullPtr(), native, nargs, funFlags, parent, atom);
+    return NewFunction(cx, NullPtr(), native, nargs, funFlags, parent, name);
+}
+
+JS_PUBLIC_API(JSFunction *)
+JS::GetSelfHostedFunction(JSContext *cx, const char *selfHostedName, jsid id, unsigned nargs)
+{
+    JS_ASSERT(JSID_IS_STRING(id));
+    JS_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
+    AssertHeapIsIdle(cx);
+    CHECK_REQUEST(cx);
+
+    RootedAtom name(cx, JSID_TO_ATOM(id));
+    RootedAtom shName(cx, Atomize(cx, selfHostedName, strlen(selfHostedName)));
+    if (!shName)
+        return nullptr;
+    RootedValue funVal(cx);
+    if (!cx->global()->getSelfHostedFunction(cx, shName, name, nargs, &funVal))
+        return nullptr;
+    return &funVal.toObject().as<JSFunction>();
 }
 
 JS_PUBLIC_API(JSObject *)
@@ -4238,13 +4257,18 @@ JS_DefineFunctions(JSContext *cx, JSObject *objArg, const JSFunctionSpec *fs)
              * in. Self-hosted functions can access each other via their names,
              * but not via the builtin classes they get installed into.
              */
+            JS_ASSERT(!fs->call.op);
+            JS_ASSERT(!fs->call.info);
             if (cx->runtime()->isSelfHostingGlobal(cx->global()))
                 continue;
 
-            RootedValue funVal(cx);
-            if (!cx->global()->getSelfHostedFunction(cx, fs, atom, &funVal))
+            RootedAtom shName(cx, Atomize(cx, fs->selfHostedName, strlen(fs->selfHostedName)));
+            if (!shName)
                 return false;
-            if (!JSObject::defineGeneric(cx, obj, id, funVal, NULL, NULL, 0))
+            RootedValue funVal(cx);
+            if (!cx->global()->getSelfHostedFunction(cx, shName, atom, fs->nargs, &funVal))
+                return false;
+            if (!JSObject::defineGeneric(cx, obj, id, funVal, NULL, NULL, flags))
                 return false;
         } else {
             JSFunction *fun = DefineFunction(cx, obj, id, fs->call.op, fs->nargs, flags);

js/src/jsapi.h

@@ -2383,16 +2383,22 @@ struct JSFunctionSpec {
 #define JS_FS_END JS_FS(NULL,NULL,0,0)
 
 /*
- * Initializer macros for a JSFunctionSpec array element. JS_FN (whose name
- * pays homage to the old JSNative/JSFastNative split) simply adds the flag
- * JSFUN_STUB_GSOPS. JS_FNINFO allows the simple adding of JSJitInfos.
+ * Initializer macros for a JSFunctionSpec array element. JS_FN (whose name pays
+ * homage to the old JSNative/JSFastNative split) simply adds the flag
+ * JSFUN_STUB_GSOPS. JS_FNINFO allows the simple adding of
+ * JSJitInfos. JS_SELF_HOSTED_FN declares a self-hosted function. Finally
+ * JS_FNSPEC has slots for all the fields.
  */
 #define JS_FS(name,call,nargs,flags)                                          \
-    {name, JSOP_WRAPPER(call), nargs, flags}
+    JS_FNSPEC(name, call, nullptr, nargs, flags, nullptr)
 #define JS_FN(name,call,nargs,flags)                                          \
-    {name, JSOP_WRAPPER(call), nargs, (flags) | JSFUN_STUB_GSOPS}
+    JS_FNSPEC(name, call, nullptr, nargs, (flags) | JSFUN_STUB_GSOPS, nullptr)
 #define JS_FNINFO(name,call,info,nargs,flags)                                 \
-    {name,{call,info},nargs,flags}
+    JS_FNSPEC(name, call, info, nargs, flags, nullptr)
+#define JS_SELF_HOSTED_FN(name,selfHostedName,nargs,flags)                    \
+    JS_FNSPEC(name, nullptr, nullptr, nargs, flags, selfHostedName)
+#define JS_FNSPEC(name,call,info,nargs,flags,selfHostedName)                  \
+    {name, {call, info}, nargs, flags, selfHostedName}
 
 extern JS_PUBLIC_API(JSObject *)
 JS_InitClass(JSContext *cx, JSObject *obj, JSObject *parent_proto,
@@ -3101,6 +3107,13 @@ extern JS_PUBLIC_API(JSFunction *)
 JS_NewFunctionById(JSContext *cx, JSNative call, unsigned nargs, unsigned flags,
                    JSObject *parent, jsid id);
 
+namespace JS {
+
+extern JS_PUBLIC_API(JSFunction *)
+GetSelfHostedFunction(JSContext *cx, const char *selfHostedName, jsid id, unsigned nargs);
+
+} /* namespace JS */
+
 extern JS_PUBLIC_API(JSObject *)
 JS_GetFunctionObject(JSFunction *fun);
 

js/src/jsarray.cpp

@@ -2869,28 +2869,28 @@ static const JSFunctionSpec array_methods[] = {
     JS_FN("concat",             array_concat,       1,JSFUN_GENERIC_NATIVE),
     JS_FN("slice",              array_slice,        2,JSFUN_GENERIC_NATIVE),
 
-         {"lastIndexOf",        {NULL, NULL},       1,0, "ArrayLastIndexOf"},
-         {"indexOf",            {NULL, NULL},       1,0, "ArrayIndexOf"},
-         {"forEach",            {NULL, NULL},       1,0, "ArrayForEach"},
-         {"map",                {NULL, NULL},       1,0, "ArrayMap"},
-         {"reduce",             {NULL, NULL},       1,0, "ArrayReduce"},
-         {"reduceRight",        {NULL, NULL},       1,0, "ArrayReduceRight"},
+    JS_SELF_HOSTED_FN("lastIndexOf", "ArrayLastIndexOf", 1,0),
+    JS_SELF_HOSTED_FN("indexOf",     "ArrayIndexOf",     1,0),
+    JS_SELF_HOSTED_FN("forEach",     "ArrayForEach",     1,0),
+    JS_SELF_HOSTED_FN("map",         "ArrayMap",         1,0),
+    JS_SELF_HOSTED_FN("reduce",      "ArrayReduce",      1,0),
+    JS_SELF_HOSTED_FN("reduceRight", "ArrayReduceRight", 1,0),
     JS_FN("filter",             array_filter,       1,JSFUN_GENERIC_NATIVE),
-         {"some",               {NULL, NULL},       1,0, "ArraySome"},
-         {"every",              {NULL, NULL},       1,0, "ArrayEvery"},
+    JS_SELF_HOSTED_FN("some",        "ArraySome",        1,0),
+    JS_SELF_HOSTED_FN("every",       "ArrayEvery",       1,0),
 
 #ifdef ENABLE_PARALLEL_JS
     /* Parallelizable and pure methods. */
-         {"mapPar",             {NULL, NULL},       2,0, "ArrayMapPar"},
-         {"reducePar",          {NULL, NULL},       2,0, "ArrayReducePar"},
-         {"scanPar",            {NULL, NULL},       2,0, "ArrayScanPar"},
-         {"scatterPar",         {NULL, NULL},       5,0, "ArrayScatterPar"},
-         {"filterPar",          {NULL, NULL},       2,0, "ArrayFilterPar"},
+    JS_SELF_HOSTED_FN("mapPar",      "ArrayMapPar",      2,0),
+    JS_SELF_HOSTED_FN("reducePar",   "ArrayReducePar",   2,0),
+    JS_SELF_HOSTED_FN("scanPar",     "ArrayScanPar",     2,0),
+    JS_SELF_HOSTED_FN("scatterPar",  "ArrayScatterPar",  5,0),
+    JS_SELF_HOSTED_FN("filterPar",   "ArrayFilterPar",   2,0),
 #endif
 
     /* ES6 additions */
-         {"find",               {NULL, NULL},       1,0, "ArrayFind"},
-         {"findIndex",          {NULL, NULL},       1,0, "ArrayFindIndex"},
+    JS_SELF_HOSTED_FN("find",        "ArrayFind",        1,0),
+    JS_SELF_HOSTED_FN("findIndex",   "ArrayFindIndex",   1,0),
 
     JS_FN("iterator",           JS_ArrayIterator,   0,0),
     JS_FS_END
@@ -2898,20 +2898,20 @@ static const JSFunctionSpec array_methods[] = {
 
 static const JSFunctionSpec array_static_methods[] = {
     JS_FN("isArray",            array_isArray,      1,0),
-         {"lastIndexOf",        {NULL, NULL},       2,0, "ArrayStaticLastIndexOf"},
-         {"indexOf",            {NULL, NULL},       2,0, "ArrayStaticIndexOf"},
-         {"forEach",            {NULL, NULL},       2,0, "ArrayStaticForEach"},
-         {"map",                {NULL, NULL},       2,0, "ArrayStaticMap"},
-         {"every",              {NULL, NULL},       2,0, "ArrayStaticEvery"},
-         {"some",               {NULL, NULL},       2,0, "ArrayStaticSome"},
-         {"reduce",             {NULL, NULL},       2,0, "ArrayStaticReduce"},
-         {"reduceRight",        {NULL, NULL},       2,0, "ArrayStaticReduceRight"},
+    JS_SELF_HOSTED_FN("lastIndexOf", "ArrayStaticLastIndexOf", 2,0),
+    JS_SELF_HOSTED_FN("indexOf",     "ArrayStaticIndexOf", 2,0),
+    JS_SELF_HOSTED_FN("forEach",     "ArrayStaticForEach", 2,0),
+    JS_SELF_HOSTED_FN("map",         "ArrayStaticMap",   2,0),
+    JS_SELF_HOSTED_FN("every",       "ArrayStaticEvery", 2,0),
+    JS_SELF_HOSTED_FN("some",        "ArrayStaticSome",  2,0),
+    JS_SELF_HOSTED_FN("reduce",      "ArrayStaticReduce", 2,0),
+    JS_SELF_HOSTED_FN("reduceRight", "ArrayStaticReduceRight", 2,0),
     JS_FN("of",                 array_of,           0,0),
 
 #ifdef ENABLE_PARALLEL_JS
-         {"build",              {NULL, NULL},       2,0, "ArrayStaticBuild"},
+    JS_SELF_HOSTED_FN("build",       "ArrayStaticBuild", 2,0),
     /* Parallelizable and pure static methods. */
-         {"buildPar",           {NULL, NULL},       3,0, "ArrayStaticBuildPar"},
+    JS_SELF_HOSTED_FN("buildPar",    "ArrayStaticBuildPar", 3,0),
 #endif
 
     JS_FS_END

js/src/jsdate.cpp

@@ -2946,9 +2946,9 @@ static const JSFunctionSpec date_methods[] = {
     JS_FN("toUTCString",         date_toGMTString,        0,0),
     JS_FN("toLocaleFormat",      date_toLocaleFormat,     0,0),
 #if EXPOSE_INTL_API
-         {js_toLocaleString_str, {NULL, NULL},            0,0, "Date_toLocaleString"},
-         {"toLocaleDateString",  {NULL, NULL},            0,0, "Date_toLocaleDateString"},
-         {"toLocaleTimeString",  {NULL, NULL},            0,0, "Date_toLocaleTimeString"},
+    JS_SELF_HOSTED_FN(js_toLocaleString_str, "Date_toLocaleString", 0,0),
+    JS_SELF_HOSTED_FN("toLocaleDateString", "Date_toLocaleDateString", 0,0),
+    JS_SELF_HOSTED_FN("toLocaleTimeString", "Date_toLocaleTimeString", 0,0),
 #else
     JS_FN(js_toLocaleString_str, date_toLocaleString,     0,0),
     JS_FN("toLocaleDateString",  date_toLocaleDateString, 0,0),

js/src/jsfun.cpp

@@ -1197,8 +1197,7 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
     }
 
     /* Lazily cloned self hosted script. */
-    JSFunctionSpec *fs = static_cast<JSFunctionSpec *>(fun->getExtendedSlot(0).toPrivate());
-    RootedAtom funAtom(cx, Atomize(cx, fs->selfHostedName, strlen(fs->selfHostedName)));
+    RootedAtom funAtom(cx, &fun->getExtendedSlot(0).toString()->asAtom());
     if (!funAtom)
         return false;
     Rooted<PropertyName *> funName(cx, funAtom->asPropertyName());

js/src/jsnum.cpp

@@ -1009,7 +1009,7 @@ static const JSFunctionSpec number_methods[] = {
 #endif
     JS_FN(js_toString_str,       js_num_toString,       1, 0),
 #if EXPOSE_INTL_API
-         {js_toLocaleString_str, {NULL, NULL},           0,0, "Number_toLocaleString"},
+    JS_SELF_HOSTED_FN(js_toLocaleString_str, "Number_toLocaleString", 0,0),
 #else
     JS_FN(js_toLocaleString_str, num_toLocaleString,     0,0),
 #endif

js/src/jsstr.cpp

@@ -3624,11 +3624,11 @@ static const JSFunctionSpec string_methods[] = {
     JS_FN("toLocaleLowerCase", str_toLocaleLowerCase, 0,JSFUN_GENERIC_NATIVE),
     JS_FN("toLocaleUpperCase", str_toLocaleUpperCase, 0,JSFUN_GENERIC_NATIVE),
 #if EXPOSE_INTL_API
-         {"localeCompare",     {NULL, NULL},          1,0, "String_localeCompare"},
+    JS_SELF_HOSTED_FN("localeCompare", "String_localeCompare", 1,0),
 #else
     JS_FN("localeCompare",     str_localeCompare,     1,JSFUN_GENERIC_NATIVE),
 #endif
-         {"repeat",            {NULL, NULL},          1,0, "String_repeat"},
+    JS_SELF_HOSTED_FN("repeat", "String_repeat",      1,0),
 
     /* Perl-ish methods (search is actually Python-esque). */
     JS_FN("match",             str_match,             1,JSFUN_GENERIC_NATIVE),
@@ -3732,7 +3732,7 @@ static const JSFunctionSpec string_static_methods[] = {
     // This must be at the end because of bug 853075: functions listed after
     // self-hosted methods aren't available in self-hosted code.
 #if EXPOSE_INTL_API
-         {"localeCompare",     {NULL, NULL},          2,0, "String_static_localeCompare"},
+    JS_SELF_HOSTED_FN("localeCompare", "String_static_localeCompare", 2,0),
 #endif
     JS_FS_END
 };

js/src/vm/GlobalObject.cpp

@@ -631,14 +631,10 @@ GlobalObject::addDebugger(JSContext *cx, Handle<GlobalObject*> global, Debugger
 }
 
 bool
-GlobalObject::getSelfHostedFunction(JSContext *cx, const JSFunctionSpec *fs, HandleAtom atom,
-                                    MutableHandleValue funVal)
+GlobalObject::getSelfHostedFunction(JSContext *cx, HandleAtom selfHostedName, HandleAtom name,
+                                    unsigned nargs, MutableHandleValue funVal)
 {
-    JS_ASSERT(fs->selfHostedName);
-    RootedAtom shAtom(cx, Atomize(cx, fs->selfHostedName, strlen(fs->selfHostedName)));
-    if (!shAtom)
-        return false;
-    RootedId shId(cx, AtomToId(shAtom));
+    RootedId shId(cx, AtomToId(selfHostedName));
     RootedObject holder(cx, cx->global()->intrinsicsHolder());
 
     if (HasDataProperty(cx, holder, shId, funVal.address()))
@@ -649,12 +645,12 @@ GlobalObject::getSelfHostedFunction(JSContext *cx, const JSFunctionSpec *fs, Han
     if (!funVal.isUndefined())
         return true;
 
-    JSFunction *fun = NewFunction(cx, NullPtr(), NULL, fs->nargs, JSFunction::INTERPRETED_LAZY,
-                                  holder, atom, JSFunction::ExtendedFinalizeKind, SingletonObject);
+    JSFunction *fun = NewFunction(cx, NullPtr(), NULL, nargs, JSFunction::INTERPRETED_LAZY,
+                                  holder, name, JSFunction::ExtendedFinalizeKind, SingletonObject);
     if (!fun)
         return false;
     fun->setIsSelfHostedBuiltin();
-    fun->setExtendedSlot(0, PrivateValue(const_cast<JSFunctionSpec*>(fs)));
+    fun->setExtendedSlot(0, StringValue(selfHostedName));
     funVal.setObject(*fun);
 
     return JSObject::defineGeneric(cx, holder, shId, funVal, NULL, NULL, 0);

js/src/vm/GlobalObject.h

@@ -456,8 +456,9 @@ class GlobalObject : public JSObject
         RootedValue valCopy(cx, value);
         return JSObject::setProperty(cx, holder, holder, name, &valCopy, false);
     }
-    bool getSelfHostedFunction(JSContext *cx, const JSFunctionSpec *fs, HandleAtom atom,
-                               MutableHandleValue funVal);
+
+    bool getSelfHostedFunction(JSContext *cx, HandleAtom selfHostedName, HandleAtom name,
+                               unsigned nargs, MutableHandleValue funVal);
 
     RegExpStatics *getRegExpStatics() const {
         JSObject &resObj = getSlot(REGEXP_STATICS).toObject();

js/src/vm/Interpreter.cpp

@@ -1079,13 +1079,9 @@ AddOperation(JSContext *cx, HandleScript script, jsbytecode *pc,
 {
     if (lhs.isInt32() && rhs.isInt32()) {
         int32_t l = lhs.toInt32(), r = rhs.toInt32();
-        int32_t sum = l + r;
-        if (JS_UNLIKELY(bool((l ^ sum) & (r ^ sum) & 0x80000000))) {
-            res->setDouble(double(l) + double(r));
+        double d = double(l) + double(r);
+        if (!res->setNumber(d))
             types::TypeScript::MonitorOverflow(cx, script, pc);
-        } else {
-            res->setInt32(sum);
-        }
         return true;
     }
 

layout/generic/nsSelection.cpp

@@ -4383,7 +4383,7 @@ Selection::Collapse(nsINode* aParentNode, int32_t aOffset)
   nsresult result;
 
   nsRefPtr<nsPresContext> presContext = GetPresContext();
-  if (presContext->Document() != aParentNode->OwnerDoc())
+  if (!presContext || presContext->Document() != aParentNode->OwnerDoc())
     return NS_ERROR_FAILURE;
 
   // Delete all of the current ranges
@@ -4624,7 +4624,7 @@ Selection::Extend(nsINode* aParentNode, int32_t aOffset)
     return NS_ERROR_FAILURE;
 
   nsRefPtr<nsPresContext> presContext = GetPresContext();
-  if (presContext->Document() != aParentNode->OwnerDoc())
+  if (!presContext || presContext->Document() != aParentNode->OwnerDoc())
     return NS_ERROR_FAILURE;
 
   //mFrameSelection->InvalidateDesiredX();

layout/mathml/crashtests/400157.xhtml

@@ -1,31 +1,34 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" class="reftest-wait">
 <mathml:mfenced/>
 
 
 <script><![CDATA[
 var docviewer;
 function do_onload() {
-netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-var navigator1 = parent.QueryInterface(Components.interfaces.nsIInterfaceRequestor).getInterface(Components.interfaces.nsIWebNavigation);
-var docShell = navigator1.QueryInterface(Components.interfaces.nsIDocShell);
-docviewer = docShell.contentViewer.QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
+  var navigator1 = SpecialPowers.wrap(parent).QueryInterface(SpecialPowers.Ci.nsIInterfaceRequestor).getInterface(SpecialPowers.Ci.nsIWebNavigation);
+  var docShell = navigator1.QueryInterface(SpecialPowers.Ci.nsIDocShell);
+  docviewer = docShell.contentViewer.QueryInterface(SpecialPowers.Ci.nsIMarkupDocumentViewer);
 
-setTimeout(function() {window.location.reload()}, 500);
-setTimeout(doe,50, 0.2);
+  setTimeout(function() {
+    clearTimeout(timer);
+    docviewer.textZoom = 1;
+    document.documentElement.removeAttribute("class");
+  }, 500);
+  setTimeout(doe,50, 0.2);
 }
 do_onload();
 
+var timer;
 function doe(i) {
-netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
- docviewer.textZoom += i;
+  docviewer.textZoom += i;
 
-if (docviewer.textZoom >=4)
-  i = -0.2;
+  if (docviewer.textZoom >=4)
+    i = -0.2;
 
-if (docviewer.textZoom <=0)
-  i = 0.2;
-window.status = docviewer.textZoom;
-setTimeout(doe, 50, i);
+  if (docviewer.textZoom <=0)
+    i = 0.2;
+  window.status = docviewer.textZoom;
+  timer = setTimeout(doe, 50, i);
 }
 ]]></script>
 </html>

layout/reftests/svg/reftest.list

@@ -106,7 +106,7 @@ skip-if(B2G) == dynamic-pattern-contents-02.svg pass.svg
 == dynamic-text-01.svg dynamic-text-01-ref.svg
 fuzzy-if(d2d&&layersGPUAccelerated,2,12739) == dynamic-text-02.svg dynamic-text-02-ref.svg # bug 776038 for Win7
 fuzzy-if(d2d&&layersGPUAccelerated,2,10539) == dynamic-text-03.svg dynamic-text-03-ref.svg # bug 776038 for Win7
-random-if(/^Windows\x20NT\x205\.1/.test(http.oscpu)) == dynamic-text-04.svg dynamic-text-04-ref.svg # bug 421587 for WinXP
+random-if(/^Windows\x20NT\x205\.1/.test(http.oscpu)) fuzzy-if(/^Windows\x20NT\x206\.1/.test(http.oscpu),47,89) == dynamic-text-04.svg dynamic-text-04-ref.svg # bug 421587 for WinXP, bug 776038 for Win7
 skip-if(B2G) == dynamic-text-05.svg pass.svg
 skip-if(B2G) == dynamic-text-06.svg pass.svg
 == dynamic-text-07.svg dynamic-text-07-ref.svg

layout/svg/nsSVGTextFrame2.cpp

@@ -645,7 +645,7 @@ struct TextRenderedRun
    *   eIncludeStroke) indicating what parts of the text to include in
    *   the rectangle.
    */
-  gfxRect GetRunUserSpaceRect(nsPresContext* aContext, uint32_t aFlags) const;
+  SVGBBox GetRunUserSpaceRect(nsPresContext* aContext, uint32_t aFlags) const;
 
   /**
    * Returns a rectangle that covers the fill and/or stroke of the rendered run
@@ -682,7 +682,7 @@ struct TextRenderedRun
    *   eIncludeStroke) indicating what parts of the text to include in
    *   the rectangle.
    */
-  gfxRect GetFrameUserSpaceRect(nsPresContext* aContext, uint32_t aFlags) const;
+  SVGBBox GetFrameUserSpaceRect(nsPresContext* aContext, uint32_t aFlags) const;
 
   /**
    * Returns a rectangle that covers the fill and/or stroke of the rendered run
@@ -695,7 +695,7 @@ struct TextRenderedRun
    *   frame user space rectangle before its bounds are transformed into
    *   user space.
    */
-  gfxRect GetUserSpaceRect(nsPresContext* aContext, uint32_t aFlags,
+  SVGBBox GetUserSpaceRect(nsPresContext* aContext, uint32_t aFlags,
                            const gfxMatrix* aAdditionalTransform = nullptr) const;
 
   /**
@@ -865,11 +865,11 @@ TextRenderedRun::GetTransformFromRunUserSpaceToFrameUserSpace(
                               0));
 }
 
-gfxRect
+SVGBBox
 TextRenderedRun::GetRunUserSpaceRect(nsPresContext* aContext,
                                      uint32_t aFlags) const
 {
-  gfxRect r;
+  SVGBBox r;
   if (!mFrame) {
     return r;
   }
@@ -930,28 +930,34 @@ TextRenderedRun::GetRunUserSpaceRect(nsPresContext* aContext,
   // Include the stroke if requested.
   if ((aFlags & eIncludeStroke) &&
       nsSVGUtils::GetStrokeWidth(mFrame) > 0) {
-    r = r.Union(nsSVGUtils::PathExtentsToMaxStrokeExtents(fill, mFrame,
-                                                          gfxMatrix()));
+    r.UnionEdges(nsSVGUtils::PathExtentsToMaxStrokeExtents(fill, mFrame,
+                                                           gfxMatrix()));
   }
 
   return r;
 }
 
-gfxRect
+SVGBBox
 TextRenderedRun::GetFrameUserSpaceRect(nsPresContext* aContext,
                                        uint32_t aFlags) const
 {
-  gfxRect r = GetRunUserSpaceRect(aContext, aFlags);
+  SVGBBox r = GetRunUserSpaceRect(aContext, aFlags);
+  if (r.IsEmpty()) {
+    return r;
+  }
   gfxMatrix m = GetTransformFromRunUserSpaceToFrameUserSpace(aContext);
   return m.TransformBounds(r);
 }
 
-gfxRect
+SVGBBox
 TextRenderedRun::GetUserSpaceRect(nsPresContext* aContext,
                                   uint32_t aFlags,
                                   const gfxMatrix* aAdditionalTransform) const
 {
-  gfxRect r = GetRunUserSpaceRect(aContext, aFlags);
+  SVGBBox r = GetRunUserSpaceRect(aContext, aFlags);
+  if (r.IsEmpty()) {
+    return r;
+  }
   gfxMatrix m = GetTransformFromRunUserSpaceToUserSpace(aContext);
   if (aAdditionalTransform) {
     m.Multiply(*aAdditionalTransform);
@@ -3307,16 +3313,17 @@ nsSVGTextFrame2::FindCloserFrameForSelection(
     uint32_t flags = TextRenderedRun::eIncludeFill |
                      TextRenderedRun::eIncludeStroke |
                      TextRenderedRun::eNoHorizontalOverflow;
-    gfxRect userRect = run.GetUserSpaceRect(presContext, flags);
+    SVGBBox userRect = run.GetUserSpaceRect(presContext, flags);
+    if (!userRect.IsEmpty()) {
+      nsRect rect = nsSVGUtils::ToCanvasBounds(userRect,
+                                               GetCanvasTM(FOR_HIT_TESTING),
+                                               presContext);
 
-    nsRect rect = nsSVGUtils::ToCanvasBounds(userRect,
-                                             GetCanvasTM(FOR_HIT_TESTING),
-                                             presContext);
-
-    if (nsLayoutUtils::PointIsCloserToRect(aPoint, rect,
-                                           aCurrentBestFrame->mXDistance,
-                                           aCurrentBestFrame->mYDistance)) {
-      aCurrentBestFrame->mFrame = run.mFrame;
+      if (nsLayoutUtils::PointIsCloserToRect(aPoint, rect,
+                                             aCurrentBestFrame->mXDistance,
+                                             aCurrentBestFrame->mYDistance)) {
+        aCurrentBestFrame->mFrame = run.mFrame;
+      }
     }
   }
 }
@@ -3640,7 +3647,7 @@ nsSVGTextFrame2::ReflowSVG()
 
   nsPresContext* presContext = PresContext();
 
-  gfxRect r;
+  SVGBBox r;
   TextRenderedRunIterator it(this, TextRenderedRunIterator::eAllFrames);
   for (TextRenderedRun run = it.Current(); run.mFrame; run = it.Next()) {
     uint32_t runFlags = 0;
@@ -3656,17 +3663,21 @@ nsSVGTextFrame2::ReflowSVG()
     }
 
     if (runFlags) {
-      r = r.Union(run.GetUserSpaceRect(presContext, runFlags));
+      r.UnionEdges(run.GetUserSpaceRect(presContext, runFlags));
     }
   }
-  mRect =
-    nsLayoutUtils::RoundGfxRectToAppRect(r, presContext->AppUnitsPerCSSPixel());
 
-  // Due to rounding issues when we have a transform applied, we sometimes
-  // don't include an additional row of pixels.  For now, just inflate our
-  // covered region.
-  mRect.Inflate(presContext->AppUnitsPerDevPixel());
+  if (r.IsEmpty()) {
+    mRect.SetEmpty();
+  } else {
+    mRect =
+      nsLayoutUtils::RoundGfxRectToAppRect(r, presContext->AppUnitsPerCSSPixel());
 
+    // Due to rounding issues when we have a transform applied, we sometimes
+    // don't include an additional row of pixels.  For now, just inflate our
+    // covered region.
+    mRect.Inflate(presContext->AppUnitsPerDevPixel());
+  }
 
   if (mState & NS_FRAME_FIRST_REFLOW) {
     // Make sure we have our filter property (if any) before calling
@@ -3719,15 +3730,15 @@ nsSVGTextFrame2::GetBBoxContribution(const gfxMatrix &aToBBoxUserspace,
 
   UpdateGlyphPositioning();
 
-  gfxRect bbox;
+  SVGBBox bbox;
   nsPresContext* presContext = PresContext();
 
   TextRenderedRunIterator it(this);
   for (TextRenderedRun run = it.Current(); run.mFrame; run = it.Next()) {
     uint32_t flags = TextRenderedRunFlagsForBBoxContribution(run, aFlags);
-    gfxRect bboxForRun =
+    SVGBBox bboxForRun =
       run.GetUserSpaceRect(presContext, flags, &aToBBoxUserspace);
-    bbox = bbox.Union(bboxForRun);
+    bbox.UnionEdges(bboxForRun);
   }
 
   return bbox;
@@ -5304,7 +5315,10 @@ nsSVGTextFrame2::TransformFrameRectToTextChild(const gfxRect& aRect,
     // Intersect it with this run's rectangle.
     uint32_t flags = TextRenderedRun::eIncludeFill |
                      TextRenderedRun::eIncludeStroke;
-    gfxRect runRectInFrameUserSpace = run.GetFrameUserSpaceRect(presContext, flags);
+    SVGBBox runRectInFrameUserSpace = run.GetFrameUserSpaceRect(presContext, flags);
+    if (runRectInFrameUserSpace.IsEmpty()) {
+      continue;
+    }
     gfxRect runIntersectionInFrameUserSpace =
       incomingRectInFrameUserSpace.Intersect(runRectInFrameUserSpace);