Merge last green changeset of mozilla-inbound to mozilla-central

dom/ipc/ContentChild.cpp

@@ -52,13 +52,14 @@
 #include "AudioChild.h"
 #endif
 
+#include "mozilla/dom/ExternalHelperAppChild.h"
+#include "mozilla/dom/PCrashReporterChild.h"
+#include "mozilla/dom/StorageChild.h"
+#include "mozilla/hal_sandbox/PHalChild.h"
 #include "mozilla/ipc/TestShellChild.h"
-#include "mozilla/net/NeckoChild.h"
 #include "mozilla/ipc/XPCShellEnvironment.h"
 #include "mozilla/jsipc/PContextWrapperChild.h"
-#include "mozilla/dom/ExternalHelperAppChild.h"
+#include "mozilla/net/NeckoChild.h"
-#include "mozilla/dom/StorageChild.h"
-#include "mozilla/dom/PCrashReporterChild.h"
 
 #if defined(MOZ_SYDNEYAUDIO)
 #include "nsAudioStream.h"
@@ -74,6 +75,7 @@
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
 #include "nsJSEnvironment.h"
+#include "SandboxHal.h"
 
 #include "History.h"
 #include "nsDocShellCID.h"
@@ -109,6 +111,7 @@
 #include "nsIAccessibilityService.h"
 #endif
 
+using namespace mozilla::hal_sandbox;
 using namespace mozilla::ipc;
 using namespace mozilla::net;
 using namespace mozilla::places;
@@ -440,6 +443,19 @@ ContentChild::DeallocPCrashReporter(PCrashReporterChild* crashreporter)
     return true;
 }
 
+PHalChild*
+ContentChild::AllocPHal()
+{
+    return CreateHalChild();
+}
+
+bool
+ContentChild::DeallocPHal(PHalChild* aHal)
+{
+    delete aHal;
+    return true;
+}
+
 PTestShellChild*
 ContentChild::AllocPTestShell()
 {
@@ -789,5 +805,13 @@ ContentChild::RecvCycleCollect()
     return true;
 }
 
+bool
+ContentChild::RecvAppInfo(const nsCString& version, const nsCString& buildID)
+{
+    mAppInfo.version.Assign(version);
+    mAppInfo.buildID.Assign(buildID);
+    return true;
+}
+
 } // namespace dom
 } // namespace mozilla

dom/ipc/ContentChild.h

@@ -64,6 +64,12 @@ public:
     ContentChild();
     virtual ~ContentChild();
 
+    struct AppInfo
+    {
+        nsCString version;
+        nsCString buildID;
+    };
+
     bool Init(MessageLoop* aIOLoop,
               base::ProcessHandle aParentHandle,
               IPC::Channel* aChannel);
@@ -74,6 +80,10 @@ public:
         return sSingleton;
     }
 
+    const AppInfo& GetAppInfo() {
+        return mAppInfo;
+    }
+
     /* if you remove this, please talk to cjones or dougt */
     virtual bool RecvDummy(Shmem& foo) { return true; }
 
@@ -86,6 +96,9 @@ public:
     virtual bool
     DeallocPCrashReporter(PCrashReporterChild*);
 
+    NS_OVERRIDE virtual PHalChild* AllocPHal();
+    NS_OVERRIDE virtual bool DeallocPHal(PHalChild*);
+
     virtual PMemoryReportRequestChild*
     AllocPMemoryReportRequest();
 
@@ -154,6 +167,8 @@ public:
     virtual bool RecvGarbageCollect();
     virtual bool RecvCycleCollect();
 
+    virtual bool RecvAppInfo(const nsCString& version, const nsCString& buildID);
+
 #ifdef ANDROID
     gfxIntSize GetScreenSize() { return mScreenSize; }
 #endif
@@ -181,6 +196,8 @@ private:
     gfxIntSize mScreenSize;
 #endif
 
+    AppInfo mAppInfo;
+
     static ContentChild* sSingleton;
 
     DISALLOW_EVIL_CONSTRUCTORS(ContentChild);

dom/ipc/ContentParent.cpp

@@ -71,10 +71,12 @@
 #include "nsIScriptError.h"
 #include "nsConsoleMessage.h"
 #include "nsAppDirectoryServiceDefs.h"
+#include "nsAppRunner.h"
 #include "IDBFactory.h"
 #if defined(MOZ_SYDNEYAUDIO)
 #include "AudioParent.h"
 #endif
+#include "SandboxHal.h"
 
 #if defined(ANDROID) || defined(LINUX)
 #include <sys/time.h>
@@ -93,6 +95,7 @@
 
 #include "mozilla/dom/ExternalHelperAppParent.h"
 #include "mozilla/dom/StorageParent.h"
+#include "mozilla/hal_sandbox/PHalParent.h"
 #include "mozilla/Services.h"
 #include "mozilla/unused.h"
 #include "nsDeviceMotion.h"
@@ -115,6 +118,7 @@ static const char* sClipboardTextFlavors[] = { kUnicodeMime };
 
 using mozilla::Preferences;
 using namespace mozilla::ipc;
+using namespace mozilla::hal_sandbox;
 using namespace mozilla::net;
 using namespace mozilla::places;
 using mozilla::unused; // heh
@@ -427,6 +431,14 @@ ContentParent::ContentParent()
         static_cast<nsChromeRegistryChrome*>(registrySvc.get());
     chromeRegistry->SendRegisteredChrome(this);
     mMessageManager = nsFrameMessageManager::NewProcessMessageManager(this);
+
+    if (gAppData) {
+        nsCString version(gAppData->version);
+        nsCString buildID(gAppData->buildID);
+
+        //Sending all information to content process
+        SendAppInfo(version, buildID);
+    }
 }
 
 ContentParent::~ContentParent()
@@ -811,6 +823,19 @@ ContentParent::DeallocPCrashReporter(PCrashReporterParent* crashreporter)
   return true;
 }
 
+PHalParent*
+ContentParent::AllocPHal()
+{
+    return CreateHalParent();
+}
+
+bool
+ContentParent::DeallocPHal(PHalParent* aHal)
+{
+    delete aHal;
+    return true;
+}
+
 PMemoryReportRequestParent*
 ContentParent::AllocPMemoryReportRequest()
 {

dom/ipc/ContentParent.h

@@ -135,6 +135,9 @@ private:
                                                const NativeThreadId& tid,
                                                const PRUint32& processType);
 
+    NS_OVERRIDE virtual PHalParent* AllocPHal();
+    NS_OVERRIDE virtual bool DeallocPHal(PHalParent*);
+
     virtual PMemoryReportRequestParent* AllocPMemoryReportRequest();
     virtual bool DeallocPMemoryReportRequest(PMemoryReportRequestParent* actor);
 

dom/ipc/Makefile.in

@@ -107,6 +107,8 @@ LOCAL_INCLUDES += \
 	-I$(srcdir)/../indexedDB \
 	-I$(topsrcdir)/extensions/cookie \
 	-I$(topsrcdir)/dom/base \
+	-I$(topsrcdir)/toolkit/xre \
+	-I$(topsrcdir)/hal/sandbox \
 	$(NULL)
 
 DEFINES += -DBIN_SUFFIX='"$(BIN_SUFFIX)"'

dom/ipc/PContent.ipdl

@@ -39,11 +39,12 @@
 include protocol PAudio;
 include protocol PBrowser;
 include protocol PCrashReporter;
-include protocol PTestShell;
-include protocol PNecko;
 include protocol PExternalHelperApp;
-include protocol PStorage;
+include protocol PHal;
 include protocol PMemoryReportRequest;
+include protocol PNecko;
+include protocol PStorage;
+include protocol PTestShell;
 
 include "mozilla/chrome/RegistryMessageUtils.h";
 include "mozilla/net/NeckoMessageUtils.h";
@@ -99,11 +100,12 @@ rpc protocol PContent
     manages PAudio;
     manages PBrowser;
     manages PCrashReporter;
-    manages PTestShell;
-    manages PNecko;
     manages PExternalHelperApp;
-    manages PStorage;
+    manages PHal;
     manages PMemoryReportRequest;
+    manages PNecko;
+    manages PStorage;
+    manages PTestShell;
 
 child:
     PBrowser(PRUint32 chromeFlags);
@@ -143,15 +145,19 @@ child:
      */
     ActivateA11y();
 
-parent:
+    AppInfo(nsCString version, nsCString buildID);
-    PNecko();
-    
-    PStorage(StorageConstructData data);
 
+parent:
     PAudio(PRInt32 aNumChannels, PRInt32 aRate, PRInt32 aFormat);
 
     sync PCrashReporter(NativeThreadId tid, PRUint32 processType);
 
+    PHal();
+
+    PNecko();
+    
+    PStorage(StorageConstructData data);
+
     // Services remoting
 
     async StartVisitedQuery(URI uri);

gfx/2d/DrawTargetD2D.cpp

@@ -642,6 +642,8 @@ DrawTargetD2D::DrawSurfaceWithShadow(SourceSurface *aSurface,
 void
 DrawTargetD2D::ClearRect(const Rect &aRect)
 {
+  MarkChanged();
+
   mRT->SetTransform(D2DMatrix(mTransform));
   PopAllClips();
 
@@ -670,6 +672,8 @@ DrawTargetD2D::CopySurface(SourceSurface *aSurface,
                            const IntRect &aSourceRect,
                            const IntPoint &aDestination)
 {
+  MarkChanged();
+
   Rect srcRect(Float(aSourceRect.x), Float(aSourceRect.y),
                Float(aSourceRect.width), Float(aSourceRect.height));
   Rect dstRect(Float(aDestination.x), Float(aDestination.y),

gfx/layers/opengl/CanvasLayerOGL.cpp

@@ -261,7 +261,7 @@ CanvasLayerOGL::RenderLayer(int aPreviousDestination,
   }
 #endif
 
-  ApplyFilter(mFilter);
+  gl()->ApplyFilterToBoundTexture(mFilter);
 
   program->Activate();
   program->SetLayerQuadRect(drawRect);
@@ -366,7 +366,7 @@ ShadowCanvasLayerOGL::RenderLayer(int aPreviousFrameBuffer,
   ColorTextureLayerProgram *program =
     mOGLManager->GetColorTextureLayerProgram(mTexImage->GetShaderProgramType());
 
-  ApplyFilter(mFilter);
+  mTexImage->SetFilter(mFilter);
 
   program->Activate();
   program->SetLayerTransform(GetEffectiveTransform());
@@ -376,7 +376,7 @@ ShadowCanvasLayerOGL::RenderLayer(int aPreviousFrameBuffer,
 
   mTexImage->BeginTileIteration();
   do {
-    TextureImage::ScopedBindTexture texBind(mTexImage, LOCAL_GL_TEXTURE0);
+    TextureImage::ScopedBindTextureAndApplyFilter texBind(mTexImage, LOCAL_GL_TEXTURE0);
     program->SetLayerQuadRect(mTexImage->GetTileRect());
     mOGLManager->BindAndDrawQuad(program, mNeedsYFlip); // FIXME flip order of tiles?
   } while (mTexImage->NextTile());

gfx/layers/opengl/ImageLayerOGL.cpp

@@ -428,13 +428,13 @@ ImageLayerOGL::RenderLayer(int,
 
     gl()->fActiveTexture(LOCAL_GL_TEXTURE0);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, yuvImage->mTextures[0].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
     gl()->fActiveTexture(LOCAL_GL_TEXTURE1);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, yuvImage->mTextures[1].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
     gl()->fActiveTexture(LOCAL_GL_TEXTURE2);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, yuvImage->mTextures[2].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
     
     YCbCrTextureLayerProgram *program = mOGLManager->GetYCbCrLayerProgram();
 
@@ -482,7 +482,7 @@ ImageLayerOGL::RenderLayer(int,
     ColorTextureLayerProgram *program = 
       mOGLManager->GetColorTextureLayerProgram(cairoImage->mLayerProgram);
 
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
 
     program->Activate();
     // The following uniform controls the scaling of the vertex coords.
@@ -957,23 +957,23 @@ ShadowImageLayerOGL::RenderLayer(int aPreviousFrameBuffer,
     colorProgram->SetLayerOpacity(GetEffectiveOpacity());
     colorProgram->SetRenderOffset(aOffset);
 
+    mTexImage->SetFilter(mFilter);
     mTexImage->BeginTileIteration();
     do {
-      TextureImage::ScopedBindTexture texBind(mTexImage, LOCAL_GL_TEXTURE0);
+      TextureImage::ScopedBindTextureAndApplyFilter texBind(mTexImage, LOCAL_GL_TEXTURE0);
-      ApplyFilter(mFilter);
       colorProgram->SetLayerQuadRect(mTexImage->GetTileRect());
       mOGLManager->BindAndDrawQuad(colorProgram);
     } while (mTexImage->NextTile());
   } else {
     gl()->fActiveTexture(LOCAL_GL_TEXTURE0);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, mYUVTexture[0].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
     gl()->fActiveTexture(LOCAL_GL_TEXTURE1);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, mYUVTexture[1].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
     gl()->fActiveTexture(LOCAL_GL_TEXTURE2);
     gl()->fBindTexture(LOCAL_GL_TEXTURE_2D, mYUVTexture[2].GetTextureID());
-    ApplyFilter(mFilter);
+    gl()->ApplyFilterToBoundTexture(mFilter);
 
     YCbCrTextureLayerProgram *yuvProgram = mOGLManager->GetYCbCrLayerProgram();
 

gfx/layers/opengl/LayerManagerOGL.cpp

@@ -1166,21 +1166,6 @@ LayerManagerOGL::CreateFBOWithTexture(const nsIntRect& aRect, InitMode aInit,
   *aTexture = tex;
 }
 
-void 
-LayerOGL::ApplyFilter(gfxPattern::GraphicsFilter aFilter)
-{
-  if (aFilter == gfxPattern::FILTER_NEAREST) {
-    gl()->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_NEAREST);
-    gl()->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MAG_FILTER, LOCAL_GL_NEAREST);
-  } else {
-    if (aFilter != gfxPattern::FILTER_GOOD) {
-      NS_WARNING("Unsupported filter type!");
-    }
-    gl()->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_LINEAR);
-    gl()->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MAG_FILTER, LOCAL_GL_LINEAR);
-  }
-}
-
 already_AddRefed<ShadowThebesLayer>
 LayerManagerOGL::CreateShadowThebesLayer()
 {

gfx/layers/opengl/LayerManagerOGL.h

@@ -540,7 +540,6 @@ public:
   LayerManagerOGL* OGLManager() const { return mOGLManager; }
   GLContext *gl() const { return mOGLManager->gl(); }
 
-  void ApplyFilter(gfxPattern::GraphicsFilter aFilter);
 protected:
   LayerManagerOGL *mOGLManager;
   bool mDestroyed;

gfx/thebes/GLContext.cpp

@@ -554,6 +554,20 @@ GLContext::CreateTextureImage(const nsIntSize& aSize,
     return CreateBasicTextureImage(texture, aSize, aWrapMode, aContentType, this);
 }
 
+void GLContext::ApplyFilterToBoundTexture(gfxPattern::GraphicsFilter aFilter)
+{
+    if (aFilter == gfxPattern::FILTER_NEAREST) {
+        fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_NEAREST);
+        fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MAG_FILTER, LOCAL_GL_NEAREST);
+    } else {
+        if (aFilter != gfxPattern::FILTER_GOOD) {
+            NS_WARNING("Unsupported filter type!");
+        }
+        fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_LINEAR);
+       fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MAG_FILTER, LOCAL_GL_LINEAR);
+    }
+}
+
 BasicTextureImage::~BasicTextureImage()
 {
     GLContext *ctx = mGLContext;
@@ -646,6 +660,13 @@ BasicTextureImage::BindTexture(GLenum aTextureUnit)
     mGLContext->fActiveTexture(LOCAL_GL_TEXTURE0);
 }
 
+void
+BasicTextureImage::ApplyFilter()
+{
+  mGLContext->ApplyFilterToBoundTexture(mFilter);
+}
+
+
 already_AddRefed<gfxASurface>
 BasicTextureImage::GetSurfaceForUpdate(const gfxIntSize& aSize, ImageFormat aFmt)
 {
@@ -928,6 +949,12 @@ TiledTextureImage::BindTexture(GLenum aTextureUnit)
     mImages[mCurrentImage]->BindTexture(aTextureUnit);
 }
 
+void
+TiledTextureImage::ApplyFilter()
+{
+   mGL->ApplyFilterToBoundTexture(mFilter);
+}
+
 /*
  * simple resize, just discards everything. we can be more clever just
  * adding or discarding tiles, but do we want this?

gfx/thebes/GLContext.h

@@ -257,6 +257,11 @@ public:
     virtual void BindTexture(GLenum aTextureUnit) = 0;
     virtual void ReleaseTexture() {};
 
+    void BindTextureAndApplyFilter(GLenum aTextureUnit) {
+        BindTexture(aTextureUnit);
+        ApplyFilter();
+    }
+
     class ScopedBindTexture
     {
     public:
@@ -275,10 +280,22 @@ public:
             }       
         }
 
-    private:
+    protected:
         TextureImage *mTexture;
     };
 
+    class ScopedBindTextureAndApplyFilter
+        : public ScopedBindTexture
+    {
+    public:
+        ScopedBindTextureAndApplyFilter(TextureImage *aTexture, GLenum aTextureUnit) :
+          ScopedBindTexture(aTexture, aTextureUnit)
+        {
+            if (mTexture) {
+                mTexture->ApplyFilter();
+            }
+        }
+    };
 
     /**
      * Returns the shader program type that should be used to render
@@ -306,6 +323,8 @@ public:
 
     bool IsRGB() const { return mIsRGBFormat; }
 
+    void SetFilter(gfxPattern::GraphicsFilter aFilter) { mFilter = aFilter; }
+
 protected:
     friend class GLContext;
 
@@ -324,11 +343,18 @@ protected:
         , mIsRGBFormat(aIsRGB)
     {}
 
+    /**
+     * Applies this TextureImage's filter, assuming that its texture is
+     * the currently bound texture.
+     */
+    virtual void ApplyFilter() = 0;
+
     nsIntSize mSize;
     GLenum mWrapMode;
     ContentType mContentType;
     bool mIsRGBFormat;
     ShaderProgramType mShaderType;
+    gfxPattern::GraphicsFilter mFilter;
 };
 
 /**
@@ -391,6 +417,8 @@ protected:
 
     // The offset into the update surface at which the update rect is located.
     nsIntPoint mUpdateOffset;
+
+    virtual void ApplyFilter();
 };
 
 /**
@@ -434,6 +462,8 @@ protected:
     // The region of update requested
     nsIntRegion mUpdateRegion;
     TextureState mTextureState;
+
+    virtual void ApplyFilter();
 };
 
 struct THEBES_API ContextFormat
@@ -660,6 +690,12 @@ public:
      */
     virtual bool ReleaseTexImage() { return false; }
 
+    /**
+     * Applies aFilter to the texture currently bound to GL_TEXTURE_2D.
+     */
+    void ApplyFilterToBoundTexture(gfxPattern::GraphicsFilter aFilter);
+
+
     /*
      * Offscreen support API
      */

gfx/thebes/GLContextProviderEGL.cpp

@@ -1669,6 +1669,11 @@ protected:
 
     bool mBound;
     bool mIsLocked;
+
+    virtual void ApplyFilter()
+    {
+        mGLContext->ApplyFilterToBoundTexture(mFilter);
+    }
 };
 
 already_AddRefed<TextureImage>

gfx/thebes/GLContextProviderGLX.cpp

@@ -916,6 +916,11 @@ private:
     GLXPixmap mPixmap;
     bool mInUpdate;
     GLuint mTexture;
+
+    virtual void ApplyFilter()
+    {
+        mGLContext->ApplyFilterToBoundTexture(mFilter);
+    }
 };
 
 already_AddRefed<TextureImage>

hal/Hal.cpp

@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "Hal.h"
+#include "mozilla/Util.h"
+#include "nsThreadUtils.h"
+#include "nsXULAppAPI.h"
+
+#define PROXY_IF_SANDBOXED(_call)                 \
+  do {                                            \
+    if (InSandbox()) {                            \
+      hal_sandbox::_call;                         \
+    } else {                                      \
+      hal_impl::_call;                            \
+    }                                             \
+  } while (0)
+
+namespace mozilla {
+namespace hal {
+
+static void
+AssertMainThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+}
+
+static bool
+InSandbox()
+{
+  return GeckoProcessType_Content == XRE_GetProcessType();
+}
+
+void
+Vibrate(const nsTArray<uint32>& pattern)
+{
+  AssertMainThread();
+  PROXY_IF_SANDBOXED(Vibrate(pattern));
+}
+
+} // namespace hal
+} // namespace mozilla

hal/Hal.h

@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_Hal_h
+#define mozilla_Hal_h 1
+
+#include "base/basictypes.h"
+#include "mozilla/Types.h"
+#include "nsTArray.h"
+
+#ifndef MOZ_HAL_NAMESPACE
+// This goop plays some cpp tricks to ensure a uniform API across the
+// API entry point, "sandbox" implementations (for content processes),
+// and "impl" backends where the real work happens.  After this runs
+// through cpp, there will be three sets of identical APIs
+//   hal_impl:: --- the platform-specific implementation of an API.
+//   hal_sandbox:: --- forwards calls up to the parent process
+//   hal:: --- invokes sandboxed impl if in a sandboxed process,
+//             otherwise forwards to hal_impl
+//
+// External code should never invoke hal_impl:: or hal_sandbox:: code
+// directly.
+# include "HalImpl.h"
+# include "HalSandbox.h"
+# define MOZ_HAL_NAMESPACE hal
+# define MOZ_DEFINED_HAL_NAMESPACE 1
+#endif
+
+namespace mozilla {
+namespace MOZ_HAL_NAMESPACE /*hal*/ {
+
+/**
+ * Turn the default vibrator device on/off per the pattern specified
+ * by |pattern|.  Each element in the pattern is the number of
+ * milliseconds to turn the vibrator on or off.  The first element in
+ * |pattern| is an "on" element, the next is "off", and so on.
+ *
+ * If |pattern| is empty, any in-progress vibration is canceled.
+ */
+void Vibrate(const nsTArray<uint32>& pattern);
+
+}
+}
+
+#ifdef MOZ_DEFINED_HAL_NAMESPACE
+# undef MOZ_DEFINED_HAL_NAMESPACE
+# undef MOZ_HAL_NAMESPACE
+#endif
+
+#endif  // mozilla_Hal_h

hal/HalImpl.h

@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_Hal_h
+# error "This is an internal file, don't include it"
+#endif
+
+#undef mozilla_Hal_h
+#define MOZ_HAL_NAMESPACE hal_impl
+#include "Hal.h"
+#undef MOZ_HAL_NAMESPACE
+

hal/HalSandbox.h

@@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_Hal_h
+# error "This is an internal file, don't include it"
+#endif
+
+#undef mozilla_Hal_h
+#define MOZ_HAL_NAMESPACE hal_sandbox
+#include "Hal.h"
+#undef MOZ_HAL_NAMESPACE

hal/Makefile.in

@@ -0,0 +1,71 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is Mozilla Corporation code.
+#
+# The Initial Developer of the Original Code is Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Chris Jones <jones.chris.g@gmail.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH       = ..
+topsrcdir   = @top_srcdir@
+srcdir      = @srcdir@
+VPATH       = \
+  $(srcdir) \
+  $(srcdir)/fallback \
+  $(srcdir)/sandbox \
+  $(NULL)
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE         = hal
+LIBRARY_NAME   = hal_s
+FORCE_STATIC_LIB = 1
+LIBXUL_LIBRARY = 1
+EXPORT_LIBRARY = 1
+
+EXPORTS_NAMESPACES = mozilla
+EXPORTS_mozilla = \
+  Hal.h \
+  HalImpl.h \
+  HalSandbox.h \
+  $(NULL)
+
+CPPSRCS = \
+  Hal.cpp \
+  SandboxHal.cpp \
+  $(NULL)
+
+CPPSRCS += FallbackHal.cpp
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
+include $(topsrcdir)/config/rules.mk

hal/fallback/FallbackHal.cpp

@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "Hal.h"
+
+namespace mozilla {
+namespace hal_impl {
+
+void
+Vibrate(const nsTArray<uint32>& pattern)
+{}
+
+} // hal_impl
+} // namespace mozilla

hal/sandbox/PHal.ipdl

@@ -0,0 +1,55 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+include protocol PContent;
+
+namespace mozilla {
+namespace hal_sandbox {
+
+protocol PHal {
+    manager PContent;
+
+parent:
+    Vibrate(uint32[] pattern);
+
+    __delete__();
+};
+
+} // namespace hal
+} // namespace mozilla

hal/sandbox/SandboxHal.cpp

@@ -0,0 +1,94 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "Hal.h"
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/hal_sandbox/PHalChild.h"
+#include "mozilla/hal_sandbox/PHalParent.h"
+
+using namespace mozilla;
+using namespace mozilla::dom;
+using namespace mozilla::hal;
+
+namespace mozilla {
+namespace hal_sandbox {
+
+static PHalChild* sHal;
+static PHalChild*
+Hal()
+{
+  if (!sHal) {
+    sHal = ContentChild::GetSingleton()->SendPHalConstructor();
+  }
+  return sHal;
+}
+
+void
+Vibrate(const nsTArray<uint32>& pattern)
+{
+  AutoInfallibleTArray<uint32, 8> p(pattern);
+  Hal()->SendVibrate(p);
+}
+
+class HalParent : public PHalParent {
+public:
+  NS_OVERRIDE virtual bool
+  RecvVibrate(const InfallibleTArray<unsigned int>& pattern) {
+    // Forward to hal::, not hal_impl::, because we might be a
+    // subprocess of another sandboxed process.  The hal:: entry point
+    // will do the right thing.
+    hal::Vibrate(pattern);
+    return true;
+  }
+};
+
+class HalChild : public PHalChild {
+public:
+};
+
+PHalChild* CreateHalChild() {
+  return new HalChild();
+}
+
+PHalParent* CreateHalParent() {
+  return new HalParent();
+}
+
+} // namespace hal_sandbox
+} // namespace mozilla

hal/sandbox/SandboxHal.h

@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=8 et ft=cpp : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Chris Jones <jones.chris.g@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_SandboxHal_h
+#define mozilla_SandboxHal_h
+
+namespace mozilla {
+namespace hal_sandbox {
+
+class PHalChild;
+class PHalParent;
+
+PHalChild* CreateHalChild();
+
+PHalParent* CreateHalParent();
+
+}
+}
+
+#endif  // mozilla_SandboxHal_h

hal/sandbox/ipdl.mk

@@ -0,0 +1,39 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is Mozilla Content App.
+#
+# The Initial Developer of the Original Code is
+#   The Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+IPDLSRCS = \
+  PHal.ipdl \
+  $(NULL)

ipc/ipdl/Makefile.in

@@ -59,6 +59,7 @@ IPDLDIRS =  \
   dom/ipc  \
   dom/src/storage \
   gfx/layers/ipc \
+  hal/sandbox \
   ipc/testshell  \
   js/ipc  \
   js/jetpack \

ipc/ipdl/ipdl/builtin.py

@@ -75,7 +75,19 @@ Types = (
     'nsresult',
     'nsString',
     'nsCString',
-    'mozilla::ipc::Shmem'
+    'mozilla::ipc::Shmem',
+
+    # quasi-stdint types used by "public" Gecko headers
+    'int8',
+    'uint8',
+    'int16',
+    'uint16',
+    'int32',
+    'uint32',
+    'int64',
+    'uint64',
+    'intptr',
+    'uintptr',
 )
 
 

js/src/jit-test/tests/basic/bug688939.js

@@ -0,0 +1,4 @@
+gczeal(2);
+string=""
+for (var i = 0; i < 100; i++ )
+  hex=newGlobal('same-compartment');

js/src/jsfun.cpp

@@ -1595,15 +1595,14 @@ js_XDRFunctionObject(JSXDRState *xdr, JSObject **objp)
      * Don't directly store into fun->u.i.script because we want this to happen
      * at the same time as we set the script's owner.
      */
-    JSScript *script = fun->u.i.script;
+    JSScript *script = fun->script();
     if (!js_XDRScript(xdr, &script))
         return false;
-    fun->u.i.script = script;
 
     if (xdr->mode == JSXDR_DECODE) {
         *objp = fun;
-        fun->u.i.script->setOwnerObject(fun);
+        fun->setScript(script);
-        if (!fun->u.i.script->typeSetFunction(cx, fun))
+        if (!fun->script()->typeSetFunction(cx, fun))
             return false;
         JS_ASSERT(fun->nargs == fun->script()->bindings.countArgs());
         js_CallNewScriptHook(cx, fun->script(), fun);
@@ -2352,7 +2351,7 @@ js_NewFunction(JSContext *cx, JSObject *funobj, Native native, uintN nargs,
         JS_ASSERT(!native);
         JS_ASSERT(nargs == 0);
         fun->u.i.skipmin = 0;
-        fun->u.i.script = NULL;
+        fun->u.i.script_ = NULL;
     } else {
         fun->u.n.clasp = NULL;
         if (flags & JSFUN_TRCINFO) {
@@ -2421,22 +2420,21 @@ js_CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
         cfun->atom = fun->atom;
         clone->setPrivate(cfun);
         if (cfun->isInterpreted()) {
-            JSScript *script = cfun->script();
+            JSScript *script = fun->script();
             JS_ASSERT(script);
             JS_ASSERT(script->compartment() == fun->compartment());
             JS_ASSERT(script->compartment() != cx->compartment);
             JS_OPT_ASSERT(script->ownerObject == fun);
 
-            cfun->u.i.script = NULL;
+            cfun->u.i.script_ = NULL;
             JSScript *cscript = js_CloneScript(cx, script);
             if (!cscript)
                 return NULL;
 
-            cfun->u.i.script = cscript;
+            cfun->setScript(cscript);
-            if (!cfun->u.i.script->typeSetFunction(cx, cfun))
+            if (!cfun->script()->typeSetFunction(cx, cfun))
                 return NULL;
 
-            cfun->script()->setOwnerObject(cfun);
             js_CallNewScriptHook(cx, cfun->script(), cfun);
             Debugger::onNewScript(cx, cfun->script(), cfun, Debugger::NewHeldScript);
         }

js/src/jsfun.h

@@ -115,9 +115,10 @@ struct JSFunction : public JSObject_Slots2
             JSNativeTraceInfo *trcinfo;
         } n;
         struct Scripted {
-            JSScript    *script;  /* interpreted bytecode descriptor or null */
+            JSScript    *script_; /* interpreted bytecode descriptor or null;
+                                     use the setter! */
             uint16       skipmin; /* net skip amount up (toward zero) from
-                                     script->staticLevel to nearest upvar,
+                                     script_->staticLevel to nearest upvar,
                                      including upvars in nested functions */
             js::Shape   *names;   /* argument and variable names */
         } i;
@@ -196,7 +197,13 @@ struct JSFunction : public JSObject_Slots2
 
     JSScript *script() const {
         JS_ASSERT(isInterpreted());
-        return u.i.script;
+        return u.i.script_;
+    }
+
+    void setScript(JSScript *script) {
+        JS_ASSERT(isInterpreted());
+        u.i.script_ = script;
+        script->setOwnerObject(this);
     }
 
     JSScript * maybeScript() const {
@@ -213,7 +220,7 @@ struct JSFunction : public JSObject_Slots2
     }
 
     static uintN offsetOfNativeOrScript() {
-        JS_STATIC_ASSERT(offsetof(U, n.native) == offsetof(U, i.script));
+        JS_STATIC_ASSERT(offsetof(U, n.native) == offsetof(U, i.script_));
         JS_STATIC_ASSERT(offsetof(U, n.native) == offsetof(U, nativeOrScript));
         return offsetof(JSFunction, u.nativeOrScript);
     }

js/src/jsgc.cpp

@@ -888,8 +888,26 @@ MarkThreadDataConservatively(JSTracer *trc, ThreadData *td)
 void
 MarkStackRangeConservatively(JSTracer *trc, Value *beginv, Value *endv)
 {
+    /*
+     * Normally, the drainMarkStack phase of marking will never trace outside
+     * of the compartment currently being collected. However, conservative
+     * scanning during drainMarkStack (as is done for generators) can break
+     * this invariant. So we disable the compartment assertions in this
+     * situation.
+     */
+    struct AutoSkipChecking {
+        JSRuntime *runtime;
+        JSCompartment *savedCompartment;
+
+        AutoSkipChecking(JSRuntime *rt)
+          : runtime(rt), savedCompartment(rt->gcCheckCompartment) {
+            rt->gcCheckCompartment = NULL;
+        }
+        ~AutoSkipChecking() { runtime->gcCheckCompartment = savedCompartment; }
+    } as(trc->context->runtime);
+
     const jsuword *begin = beginv->payloadWord();
-    const jsuword *end = endv->payloadWord();;
+    const jsuword *end = endv->payloadWord();
 #ifdef JS_NUNBOX32
     /*
      * With 64-bit jsvals on 32-bit systems, we can optimize a bit by

js/src/jsinfer.cpp

@@ -388,30 +388,31 @@ TypeSet::add(JSContext *cx, TypeConstraint *constraint, bool callExisting)
     if (!callExisting)
         return;
 
+    /* If any type is possible, there's no need to worry about specifics. */
     if (flags & TYPE_FLAG_UNKNOWN) {
         cx->compartment->types.addPending(cx, constraint, this, Type::UnknownType());
-        cx->compartment->types.resolvePending(cx);
+    } else {
-        return;
+        /* Enqueue type set members stored as bits. */ 
-    }
+        for (TypeFlags flag = 1; flag < TYPE_FLAG_ANYOBJECT; flag <<= 1) {
-
+            if (flags & flag) {
-    for (TypeFlags flag = 1; flag < TYPE_FLAG_ANYOBJECT; flag <<= 1) {
+                Type type = Type::PrimitiveType(TypeFlagPrimitive(flag));
-        if (flags & flag) {
+                cx->compartment->types.addPending(cx, constraint, this, type);
-            Type type = Type::PrimitiveType(TypeFlagPrimitive(flag));
+            }
-            cx->compartment->types.addPending(cx, constraint, this, type);
         }
-    }
 
-    if (flags & TYPE_FLAG_ANYOBJECT) {
+        /* If any object is possible, skip specifics. */
-        cx->compartment->types.addPending(cx, constraint, this, Type::AnyObjectType());
+        if (flags & TYPE_FLAG_ANYOBJECT) {
-        cx->compartment->types.resolvePending(cx);
+            cx->compartment->types.addPending(cx, constraint, this, Type::AnyObjectType());
-        return;
+        } else {
-    }
+            /* Enqueue specific object types. */
-
+            unsigned count = getObjectCount();
-    unsigned count = getObjectCount();
+            for (unsigned i = 0; i < count; i++) {
-    for (unsigned i = 0; i < count; i++) {
+                TypeObjectKey *object = getObject(i);
-        TypeObjectKey *object = getObject(i);
+                if (object)
-        if (object)
+                    cx->compartment->types.addPending(cx, constraint, this,
-            cx->compartment->types.addPending(cx, constraint, this, Type::ObjectType(object));
+                                                      Type::ObjectType(object));
+            }
+        }
     }
 
     cx->compartment->types.resolvePending(cx);

js/src/jsinterp.cpp

@@ -3803,6 +3803,7 @@ BEGIN_CASE(JSOP_GETELEM)
 {
     Value &lref = regs.sp[-2];
     Value &rref = regs.sp[-1];
+    Value &rval = regs.sp[-2];
     if (lref.isString() && rref.isInt32()) {
         JSString *str = lref.toString();
         int32_t i = rref.toInt32();
@@ -3810,9 +3811,9 @@ BEGIN_CASE(JSOP_GETELEM)
             str = cx->runtime->staticStrings.getUnitStringForElement(cx, str, size_t(i));
             if (!str)
                 goto error;
+            rval.setString(str);
+            TypeScript::Monitor(cx, script, regs.pc, rval);
             regs.sp--;
-            regs.sp[-1].setString(str);
-            TypeScript::Monitor(cx, script, regs.pc, regs.sp[-1]);
             len = JSOP_GETELEM_LENGTH;
             DO_NEXT_OP(len);
         }
@@ -3820,9 +3821,9 @@ BEGIN_CASE(JSOP_GETELEM)
 
     if (lref.isMagic(JS_LAZY_ARGUMENTS)) {
         if (rref.isInt32() && size_t(rref.toInt32()) < regs.fp()->numActualArgs()) {
+            rval = regs.fp()->canonicalActualArg(rref.toInt32());
+            TypeScript::Monitor(cx, script, regs.pc, rval);
             regs.sp--;
-            regs.sp[-1] = regs.fp()->canonicalActualArg(rref.toInt32());
-            TypeScript::Monitor(cx, script, regs.pc, regs.sp[-1]);
             len = JSOP_GETELEM_LENGTH;
             DO_NEXT_OP(len);
         }
@@ -3833,58 +3834,48 @@ BEGIN_CASE(JSOP_GETELEM)
     JSObject *obj;
     VALUE_TO_OBJECT(cx, &lref, obj);
 
-    const Value *copyFrom;
+    uint32 index;
-    Value rval;
+    if (IsDefinitelyIndex(rref, &index)) {
-    jsid id;
-    if (rref.isInt32()) {
-        int32_t i = rref.toInt32();
         if (obj->isDenseArray()) {
-            jsuint idx = jsuint(i);
+            if (index < obj->getDenseArrayInitializedLength()) {
-            if (idx < obj->getDenseArrayInitializedLength()) {
+                rval = obj->getDenseArrayElement(index);
-                copyFrom = &obj->getDenseArrayElement(idx);
+                if (!rval.isMagic())
-                if (!copyFrom->isMagic())
                     goto end_getelem;
             }
         } else if (obj->isArguments()) {
-            uint32 arg = uint32(i);
+            if (obj->asArguments()->getElement(index, &rval))
-            ArgumentsObject *argsobj = obj->asArguments();
+                goto end_getelem;
-
-            if (arg < argsobj->initialLength()) {
-                copyFrom = &argsobj->element(arg);
-                if (!copyFrom->isMagic(JS_ARGS_HOLE)) {
-                    if (StackFrame *afp = argsobj->maybeStackFrame())
-                        copyFrom = &afp->canonicalActualArg(arg);
-                    goto end_getelem;
-                }
-            }
         }
-        if (JS_LIKELY(INT_FITS_IN_JSID(i)))
+
-            id = INT_TO_JSID(i);
+        if (!obj->getElement(cx, index, &rval))
-        else
+            goto error;
-            goto intern_big_int;
     } else {
-        int32_t i;
+        if (script->hasAnalysis() && !regs.fp()->hasImacropc())
-        if (ValueFitsInInt32(rref, &i) && INT_FITS_IN_JSID(i)) {
+            script->analysis()->getCode(regs.pc).getStringElement = true;
-            id = INT_TO_JSID(i);
+
-        } else {
+        SpecialId special;
-          intern_big_int:
+        if (ValueIsSpecial(obj, &rref, &special, cx)) {
-            if (!js_InternNonIntElementId(cx, obj, rref, &id))
+            if (!obj->getSpecial(cx, special, &rval))
                 goto error;
+        } else {
+            JSAtom *name;
+            if (!js_ValueToAtom(cx, rref, &name))
+                goto error;
+
+            if (name->isIndex(&index)) {
+                if (!obj->getElement(cx, index, &rval))
+                    goto error;
+            } else {
+                if (!obj->getProperty(cx, name->asPropertyName(), &rval))
+                    goto error;
+            }
         }
     }
 
-    if (JSID_IS_STRING(id) && script->hasAnalysis() && !regs.fp()->hasImacropc())
-        script->analysis()->getCode(regs.pc).getStringElement = true;
-
-    if (!obj->getGeneric(cx, id, &rval))
-        goto error;
-    copyFrom = &rval;
-
   end_getelem:
+    assertSameCompartment(cx, rval);
+    TypeScript::Monitor(cx, script, regs.pc, rval);
     regs.sp--;
-    regs.sp[-1] = *copyFrom;
-    assertSameCompartment(cx, regs.sp[-1]);
-    TypeScript::Monitor(cx, script, regs.pc, regs.sp[-1]);
 }
 END_CASE(JSOP_GETELEM)
 

js/src/jsnum.h

@@ -613,6 +613,32 @@ ValueFitsInInt32(const Value &v, int32_t *pi)
     return v.isDouble() && JSDOUBLE_IS_INT32(v.toDouble(), pi);
 }
 
+/*
+ * Returns true if the given value is definitely an index: that is, the value
+ * is a number that's an unsigned 32-bit integer.
+ *
+ * This method prioritizes common-case speed over accuracy in every case.  It
+ * can produce false negatives (but not false positives): some values which are
+ * indexes will be reported not to be indexes by this method.  Users must
+ * consider this possibility when using this method.
+ */
+static JS_ALWAYS_INLINE bool
+IsDefinitelyIndex(const Value &v, uint32 *indexp)
+{
+    if (v.isInt32() && v.toInt32() >= 0) {
+        *indexp = v.toInt32();
+        return true;
+    }
+
+    int32 i;
+    if (v.isDouble() && JSDOUBLE_IS_INT32(v.toDouble(), &i) && i >= 0) {
+        *indexp = uint32(i);
+        return true;
+    }
+
+    return false;
+}
+
 /* ES5 9.4 ToInteger. */
 static inline bool
 ToInteger(JSContext *cx, const js::Value &v, jsdouble *dp)

js/src/jsobjinlines.h

@@ -1784,6 +1784,29 @@ ObjectClassIs(JSObject &obj, ESClassValue classValue, JSContext *cx)
     return false;
 }
 
+static JS_ALWAYS_INLINE bool
+ValueIsSpecial(JSObject *obj, Value *propval, SpecialId *sidp, JSContext *cx)
+{
+    if (!propval->isObject())
+        return false;
+
+#if JS_HAS_XML_SUPPORT
+    if (obj->isXML()) {
+        *sidp = SpecialId(propval->toObject());
+        return true;
+    }
+
+    JSObject &propobj = propval->toObject();
+    JSAtom *name;
+    if (propobj.isQName() && GetLocalNameFromFunctionQName(&propobj, &name, cx)) {
+        propval->setString(name);
+        return false;
+    }
+#endif
+
+    return false;
+}
+
 } /* namespace js */
 
 inline JSObject *

js/src/jsscript.cpp

@@ -1215,7 +1215,7 @@ JSScript::NewScriptFromCG(JSContext *cx, JSCodeGenerator *cg)
     fun = NULL;
     if (cg->inFunction()) {
         /*
-         * We initialize fun->u.i.script to be the script constructed above
+         * We initialize fun->script() to be the script constructed above
          * so that the debugger has a valid fun->script().
          */
         fun = cg->fun();
@@ -1238,8 +1238,7 @@ JSScript::NewScriptFromCG(JSContext *cx, JSCodeGenerator *cg)
         if (!script->typeSetFunction(cx, fun, singleton))
             return NULL;
 
-        fun->u.i.script = script;
+        fun->setScript(script);
-        script->setOwnerObject(fun);
     } else {
         /*
          * Initialize script->object, if necessary, so that the debugger has a

js/src/jsxml.cpp

@@ -2808,24 +2808,33 @@ ReportBadXMLName(JSContext *cx, const Value &idval)
     js_ReportValueError(cx, JSMSG_BAD_XML_NAME, JSDVG_IGNORE_STACK, idval, NULL);
 }
 
-static bool
+namespace js {
-GetLocalNameFromFunctionQName(JSObject *qn, jsid *funidp, JSContext *cx)
+
+bool
+GetLocalNameFromFunctionQName(JSObject *qn, JSAtom **namep, JSContext *cx)
 {
     JSAtom *atom = cx->runtime->atomState.functionNamespaceURIAtom;
     JSLinearString *uri = qn->getNameURI();
     if (uri && (uri == atom || EqualStrings(uri, atom))) {
-        *funidp = ATOM_TO_JSID(qn->getQNameLocalName());
+        *namep = qn->getQNameLocalName();
         return true;
     }
     return false;
 }
 
+} /* namespace js */
+
 bool
 js_GetLocalNameFromFunctionQName(JSObject *obj, jsid *funidp, JSContext *cx)
 {
     if (!obj->isQName())
         return false;
-    return GetLocalNameFromFunctionQName(obj, funidp, cx);
+    JSAtom *name;
+    if (GetLocalNameFromFunctionQName(obj, &name, cx)) {
+        *funidp = ATOM_TO_JSID(name);
+        return true;
+    }
+    return false;
 }
 
 static JSObject *
@@ -2893,8 +2902,10 @@ construct:
         return NULL;
 
 out:
-    if (!GetLocalNameFromFunctionQName(obj, funidp, cx))
+    JSAtom *localName;
-        *funidp = JSID_VOID;
+    *funidp = GetLocalNameFromFunctionQName(obj, &localName, cx)
+              ? ATOM_TO_JSID(localName)
+              : JSID_VOID;
     return obj;
 
 bad:
@@ -7618,8 +7629,11 @@ js_FindXMLProperty(JSContext *cx, const Value &nameval, JSObject **objp, jsid *i
     }
 
     qn = nameobj;
-    if (!GetLocalNameFromFunctionQName(qn, &funid, cx))
+
-        funid = JSID_VOID;
+    JSAtom *name;
+    funid = GetLocalNameFromFunctionQName(qn, &name, cx)
+            ? ATOM_TO_JSID(name)
+            : JSID_VOID;
 
     obj = cx->stack.currentScriptedScopeChain();
     do {

js/src/jsxml.h

@@ -332,4 +332,11 @@ js_TestXMLEquality(JSContext *cx, const js::Value &v1, const js::Value &v2,
 extern JSBool
 js_ConcatenateXML(JSContext *cx, JSObject *obj1, JSObject *obj2, js::Value *vp);
 
+namespace js {
+
+extern bool
+GetLocalNameFromFunctionQName(JSObject *qn, JSAtom **namep, JSContext *cx);
+
+} /* namespace js */
+
 #endif /* jsxml_h___ */

js/src/methodjit/MonoIC.cpp

@@ -734,7 +734,7 @@ class CallCompiler : public BaseCompiler
 
         /* funPtrReg is still valid. Check if a compilation is needed. */
         Address scriptAddr(ic.funPtrReg, offsetof(JSFunction, u) +
-                           offsetof(JSFunction::U::Scripted, script));
+                           offsetof(JSFunction::U::Scripted, script_));
         masm.loadPtr(scriptAddr, t0);
 
         /*

js/src/methodjit/StubCalls.cpp

@@ -433,6 +433,7 @@ stubs::GetElem(VMFrame &f)
 
     Value &lref = regs.sp[-2];
     Value &rref = regs.sp[-1];
+    Value &rval = regs.sp[-2];
     if (lref.isString() && rref.isInt32()) {
         JSString *str = lref.toString();
         int32_t i = rref.toInt32();
@@ -440,14 +441,14 @@ stubs::GetElem(VMFrame &f)
             str = f.cx->runtime->staticStrings.getUnitStringForElement(cx, str, (size_t)i);
             if (!str)
                 THROW();
-            f.regs.sp[-2].setString(str);
+            rval.setString(str);
             return;
         }
     }
 
     if (lref.isMagic(JS_LAZY_ARGUMENTS)) {
         if (rref.isInt32() && size_t(rref.toInt32()) < regs.fp()->numActualArgs()) {
-            regs.sp[-2] = regs.fp()->canonicalActualArg(rref.toInt32());
+            rval = regs.fp()->canonicalActualArg(rref.toInt32());
             return;
         }
         MarkArgumentsCreated(cx, f.script());
@@ -458,54 +459,40 @@ stubs::GetElem(VMFrame &f)
     if (!obj)
         THROW();
 
-    const Value *copyFrom;
+    uint32 index;
-    Value rval;
+    if (IsDefinitelyIndex(rref, &index)) {
-    jsid id;
-    if (rref.isInt32()) {
-        int32_t i = rref.toInt32();
         if (obj->isDenseArray()) {
-            jsuint idx = jsuint(i);
+            if (index < obj->getDenseArrayInitializedLength()) {
-
+                rval = obj->getDenseArrayElement(index);
-            if (idx < obj->getDenseArrayInitializedLength()) {
+                if (!rval.isMagic())
-                copyFrom = &obj->getDenseArrayElement(idx);
+                    return;
-                if (!copyFrom->isMagic())
-                    goto end_getelem;
             }
         } else if (obj->isArguments()) {
-            uint32 arg = uint32(i);
+            if (obj->asArguments()->getElement(index, &rval))
-            ArgumentsObject *argsobj = obj->asArguments();
+                return;
+        }
 
-            if (arg < argsobj->initialLength()) {
+        if (!obj->getElement(cx, index, &rval))
-                copyFrom = &argsobj->element(arg);
+            THROW();
-                if (!copyFrom->isMagic()) {
+    } else {
-                    if (StackFrame *afp = argsobj->maybeStackFrame())
+        SpecialId special;
-                        copyFrom = &afp->canonicalActualArg(arg);
+        if (ValueIsSpecial(obj, &rref, &special, cx)) {
-                    goto end_getelem;
+            if (!obj->getSpecial(cx, special, &rval))
-                }
+                THROW();
+        } else {
+            JSAtom *name;
+            if (!js_ValueToAtom(cx, rref, &name))
+                THROW();
+
+            if (name->isIndex(&index)) {
+                if (!obj->getElement(cx, index, &rval))
+                    THROW();
+            } else {
+                if (!obj->getProperty(cx, name->asPropertyName(), &rval))
+                    THROW();
             }
         }
-        if (JS_LIKELY(INT_FITS_IN_JSID(i)))
-            id = INT_TO_JSID(i);
-        else
-            goto intern_big_int;
-
-    } else {
-        int32_t i;
-        if (ValueFitsInInt32(rref, &i) && INT_FITS_IN_JSID(i)) {
-            id = INT_TO_JSID(i);
-        } else {
-          intern_big_int:
-            if (!js_InternNonIntElementId(cx, obj, rref, &id))
-                THROW();
-        }
     }
-
-    if (!obj->getGeneric(cx, id, &rval))
-        THROW();
-    copyFrom = &rval;
-
-  end_getelem:
-    f.regs.sp[-2] = *copyFrom;
 }
 
 static inline bool

js/src/shell/js.cpp

@@ -2736,7 +2736,7 @@ Clone(JSContext *cx, uintN argc, jsval *vp)
     }
     if (funobj->compartment() != cx->compartment) {
         JSFunction *fun = funobj->getFunctionPrivate();
-        if (fun->isInterpreted() && fun->u.i.script->compileAndGo) {
+        if (fun->isInterpreted() && fun->script()->compileAndGo) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                                  "function", "compile-and-go");
             return JS_FALSE;

js/src/vm/GlobalObject.cpp

@@ -141,10 +141,9 @@ GlobalObject::initFunctionAndObjectClasses(JSContext *cx)
         script->noScriptRval = true;
         script->code[0] = JSOP_STOP;
         script->code[1] = SRC_NULL;
-        functionProto->u.i.script = script;
+        functionProto->setScript(script);
         functionProto->getType(cx)->interpretedFunction = functionProto;
         script->hasFunction = true;
-        script->setOwnerObject(functionProto);
     }
 
     /* Create the Object function now that we have a [[Prototype]] for it. */

layout/reftests/bugs/691571-1-ref.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="A" width=200 height=50></canvas><br />
+<canvas id="B" width=200 height=50></canvas>
+<script>
+  var canvasA = document.getElementById("A"),
+    ctxA = canvasA.getContext('2d'),
+    canvasB = document.getElementById("B"),
+    ctxB = canvasB.getContext('2d'),
+    width = canvasA.width,
+    height = canvasA.height;
+
+  ctxB.fillStyle = 'red';
+  ctxB.fillRect(0, 0, width, height);
+</script>
+</body>
+</html>

layout/reftests/bugs/691571-1.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="A" width=200 height=50></canvas><br />
+<canvas id="B" width=200 height=50></canvas>
+<script>
+  var canvasA = document.getElementById("A"),
+    ctxA = canvasA.getContext('2d'),
+    canvasB = document.getElementById("B"),
+    ctxB = canvasB.getContext('2d'),
+    width = canvasA.width,
+    height = canvasA.height;
+
+  ctxA.fillStyle = 'red';
+  ctxA.fillRect(0, 0, width, height);
+  var pat = ctxB.createPattern(canvasA, "repeat");
+
+  ctxA.clearRect(0, 0, width, height);
+
+  ctxB.fillStyle = pat;
+  ctxB.fillRect(0, 0, width, height);
+</script>
+</body>
+</html>

layout/reftests/bugs/reftest.list

@@ -1666,3 +1666,4 @@ fails-if(layersGPUAccelerated&&cocoaWidget) == 654950-1.html 654950-1-ref.html #
 == 670467-1.html 670467-1-ref.html
 == 670467-2.html 670467-2-ref.html
 != 691087-1.html 691087-1-ref.html
+== 691571-1.html 691571-1-ref.html

memory/jemalloc/jemalloc.c

@@ -82,6 +82,10 @@
  *   |                           |     ... |
  *   |=====================================|
  *
+ * NOTE: Due to Mozilla bug 691003, we cannot reserve less than one word for an
+ * allocation on Linux or Mac.  So on 32-bit *nix, the smallest bucket size is
+ * 4 bytes, and on 64-bit, the smallest bucket size is 8 bytes.
+ *
  * A different mechanism is used for each category:
  *
  *   Small : Each size class is segregated into its own set of runs.  Each run
@@ -426,7 +430,7 @@ static const bool __isthreaded = true;
 /* Size of stack-allocated buffer passed to strerror_r(). */
 #define	STRERROR_BUF		64
 
-/* Minimum alignment of allocations is 2^QUANTUM_2POW_MIN bytes. */
+/* Minimum alignment of non-tiny allocations is 2^QUANTUM_2POW_MIN bytes. */
 #  define QUANTUM_2POW_MIN      4
 #ifdef MOZ_MEMORY_SIZEOF_PTR_2POW
 #  define SIZEOF_PTR_2POW		MOZ_MEMORY_SIZEOF_PTR_2POW
@@ -515,8 +519,15 @@ static const bool __isthreaded = true;
 #define	CACHELINE_2POW		6
 #define	CACHELINE		((size_t)(1U << CACHELINE_2POW))
 
-/* Smallest size class to support. */
+/*
+ * Smallest size class to support.  On Linux and Mac, even malloc(1) must
+ * reserve a word's worth of memory (see Mozilla bug 691003).
+ */
+#ifdef MOZ_MEMORY_WINDOWS
 #define	TINY_MIN_2POW		1
+#else
+#define TINY_MIN_2POW           (sizeof(void*) == 8 ? 3 : 2)
+#endif
 
 /*
  * Maximum size class that is a multiple of the quantum, but not (necessarily)

mobile/chrome/content/browser-ui.js

@@ -63,6 +63,7 @@ let Elements = {};
 [
   ["contentShowing",     "bcast_contentShowing"],
   ["urlbarState",        "bcast_urlbarState"],
+  ["mainKeyset",         "mainKeyset"],
   ["stack",              "stack"],
   ["tabList",            "tabs"],
   ["tabs",               "tabs-container"],
@@ -945,9 +946,9 @@ var BrowserUI = {
         break;
       // Window events
       case "keypress":
-        // Ignore events headed toward the browser; they will be
+        // Ignore events re-dispatched from content; we already
-        // re-dispatched after content has a chance to handle them.
+        // handled them when they were originally fired.
-        if (aEvent.target.localName == "browser")
+        if (aEvent.target == Elements.mainKeyset)
           break;
         if (aEvent.keyCode == aEvent.DOM_VK_ESCAPE)
           this.handleEscape(aEvent);

mobile/chrome/content/browser.js

@@ -1236,7 +1236,7 @@ var Browser = {
       }
 
       case "Browser:KeyPress": {
-        let keyset = document.getElementById("mainKeyset");
+        let keyset = Elements.mainKeyset;
         keyset.setAttribute("disabled", "false");
         if (json.preventDefault)
           break;

mobile/chrome/tests/browser_escape.js

@@ -101,6 +101,20 @@ function testReturnToOwner() {
   EventUtils.sendKey("ESCAPE", window);
   is(Browser.selectedTab, tab1, "tab1 is selected");
   closeTabs();
+  testContextMenu();
+}
+
+function testContextMenu() {
+  ContextHelper.showPopup({
+    json: {
+      types: ['link']
+    },
+    target: Browser.selectedBrowser
+  });
+  ok(ContextHelper.popupState, "Context menu is shown");
+  Browser.selectedBrowser.focus();
+  EventUtils.synthesizeKey("VK_ESCAPE", {type: "keypress"}, window);
+  ok(!ContextHelper.popupState, "Context menu is dismissed");
   finish();
 }
 

toolkit/content/widgets/datetimepicker.xml

@@ -791,6 +791,15 @@
       <method name="_init">
         <body>
           <![CDATA[
+            // We'll default to YYYY/MM/DD to start.
+            var yfield = "input-one";
+            var mfield = "input-two";
+            var dfield = "input-three";
+            var twoDigitYear = false;
+            this.yearLeadingZero = true;
+            this.monthLeadingZero = true;
+            this.dateLeadingZero = true;
+
             var numberOrder = /^(\D*)\s*(\d+)(\D*)(\d+)(\D*)(\d+)\s*(\D*)$/;
 
             var dt = new Date(2002,9,4).toLocaleFormat("%x");
@@ -799,11 +808,8 @@
               this._separatorFirst.value = numberFields[3];
               this._separatorSecond.value = numberFields[5];
 
-              var twoDigitYear = false;
-              var yfield = "input-one";
-              var mfield = "input-two";
-              var dfield = "input-three";
               var yi = 2, mi = 4, di = 6;
+
               for (var i = 1; i < numberFields.length; i++) {
                 switch (Number(numberFields[i])) {
                   case 2:
@@ -825,6 +831,10 @@
                     break;
                 }
               }
+
+              this.yearLeadingZero = (numberFields[yi].length > 1);
+              this.monthLeadingZero = (numberFields[mi].length > 1);
+              this.dateLeadingZero = (numberFields[di].length > 1);
             }
 
             this.yearField = document.getAnonymousElementByAttribute(this, "anonid", yfield);
@@ -834,10 +844,6 @@
             this.monthField = document.getAnonymousElementByAttribute(this, "anonid", mfield);
             this.dateField = document.getAnonymousElementByAttribute(this, "anonid", dfield);
 
-            this.yearLeadingZero = (numberFields[yi].length > 1);
-            this.monthLeadingZero = (numberFields[mi].length > 1);
-            this.dateLeadingZero = (numberFields[di].length > 1);
-
             this._fieldAMPM.parentNode.collapsed = true;
             this.yearField.size = twoDigitYear ? 2 : 4;
             this.yearField.maxLength = twoDigitYear ? 2 : 4;

toolkit/content/widgets/notification.xml

@@ -12,7 +12,8 @@
 
   <binding id="notificationbox">
     <content>
-      <xul:stack xbl:inherits="hidden=notificationshidden">
+      <xul:stack xbl:inherits="hidden=notificationshidden"
+                 class="notificationbox-stack">
         <xul:spacer/>
         <children includes="notification"/>
       </xul:stack>

toolkit/content/xul.css

@@ -191,6 +191,10 @@ notificationbox {
   -moz-box-orient: vertical;
 }
 
+.notificationbox-stack {
+  overflow: -moz-hidden-unscrollable;
+}
+
 notification {
   -moz-binding: url("chrome://global/content/bindings/notification.xml#notification");
   -moz-transition: margin-top 300ms, opacity 300ms;

toolkit/library/libxul-config.mk

@@ -96,6 +96,7 @@ STATIC_LIBS += \
   ipcshell_s \
   gfx2d \
   gfxipc_s \
+  hal_s \
   $(NULL)
 
 ifdef MOZ_IPDL_TESTS

toolkit/toolkit-makefiles.sh

@@ -734,6 +734,10 @@ MAKEFILES_startupcache="
   startupcache/Makefile
 "
 
+MAKEFILES_hal="
+  hal/Makefile
+"
+
 add_makefiles "
   $MAKEFILES_db
   $MAKEFILES_dom
@@ -775,6 +779,7 @@ add_makefiles "
   $MAKEFILES_libmar
   $MAKEFILES_extensions
   $MAKEFILES_startupcache
+  $MAKEFILES_hal
 "
 
 #

toolkit/toolkit-tiers.mk

@@ -94,6 +94,7 @@ tier_platform_dirs	+= gfx/qcms
 tier_platform_dirs += ipc js/ipc js/jetpack
 
 tier_platform_dirs += \
+		hal \
 		js/src/xpconnect \
 		intl/chardet \
 		$(NULL)

toolkit/xre/nsAppRunner.cpp

@@ -60,6 +60,7 @@
 #endif // MOZ_WIDGET_QT
 
 #include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/ContentChild.h"
 
 #include "nsAppRunner.h"
 #include "nsUpdateDriver.h"
@@ -253,6 +254,7 @@ static char **gQtOnlyArgv;
 #include "BinaryPath.h"
 
 using mozilla::dom::ContentParent;
+using mozilla::dom::ContentChild;
 
 // Save literal putenv string to environment variable.
 static void
@@ -607,7 +609,8 @@ NS_INTERFACE_MAP_BEGIN(nsXULAppInfo)
 #ifdef MOZ_CRASHREPORTER
   NS_INTERFACE_MAP_ENTRY(nsICrashReporter)
 #endif
-  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIXULAppInfo, gAppData)
+  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIXULAppInfo, gAppData || 
+                                     XRE_GetProcessType() == GeckoProcessType_Content)
 NS_INTERFACE_MAP_END
 
 NS_IMETHODIMP_(nsrefcnt)
@@ -625,6 +628,10 @@ nsXULAppInfo::Release()
 NS_IMETHODIMP
 nsXULAppInfo::GetVendor(nsACString& aResult)
 {
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    NS_WARNING("Attempt to get unavailable information in content process.");
+    return NS_ERROR_NOT_AVAILABLE;
+  }
   aResult.Assign(gAppData->vendor);
 
   return NS_OK;
@@ -633,6 +640,10 @@ nsXULAppInfo::GetVendor(nsACString& aResult)
 NS_IMETHODIMP
 nsXULAppInfo::GetName(nsACString& aResult)
 {
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    NS_WARNING("Attempt to get unavailable information in content process.");
+    return NS_ERROR_NOT_AVAILABLE;
+  }
   aResult.Assign(gAppData->name);
 
   return NS_OK;
@@ -641,6 +652,10 @@ nsXULAppInfo::GetName(nsACString& aResult)
 NS_IMETHODIMP
 nsXULAppInfo::GetID(nsACString& aResult)
 {
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    NS_WARNING("Attempt to get unavailable information in content process.");
+    return NS_ERROR_NOT_AVAILABLE;
+  }
   aResult.Assign(gAppData->ID);
 
   return NS_OK;
@@ -649,6 +664,11 @@ nsXULAppInfo::GetID(nsACString& aResult)
 NS_IMETHODIMP
 nsXULAppInfo::GetVersion(nsACString& aResult)
 {
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    ContentChild* cc = ContentChild::GetSingleton();
+    aResult = cc->GetAppInfo().version;
+    return NS_OK;
+  }
   aResult.Assign(gAppData->version);
 
   return NS_OK;
@@ -665,6 +685,11 @@ nsXULAppInfo::GetPlatformVersion(nsACString& aResult)
 NS_IMETHODIMP
 nsXULAppInfo::GetAppBuildID(nsACString& aResult)
 {
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    ContentChild* cc = ContentChild::GetSingleton();
+    aResult = cc->GetAppInfo().buildID;
+    return NS_OK;
+  }
   aResult.Assign(gAppData->buildID);
 
   return NS_OK;

tools/jprof/Makefile.in

@@ -56,6 +56,7 @@ CPPSRCS = \
 	$(NULL)
 
 OS_LIBS = \
+	-ldl \
 	-lbfd \
 	-liberty \
 	$(NULL)

xpcom/glue/nsTArray.h

@@ -1284,6 +1284,11 @@ class nsAutoTArray : public nsAutoArrayBase<nsTArray<E, Alloc>, N>
 {
 public:
   nsAutoTArray() {}
+
+  template<typename Allocator>
+  nsAutoTArray(const nsTArray<E, Allocator>& other) {
+    AppendElements(other);
+  }
 };
 
 template<class E, PRUint32 N>
@@ -1291,6 +1296,11 @@ class AutoFallibleTArray : public nsAutoArrayBase<FallibleTArray<E>, N>
 {
 public:
   AutoFallibleTArray() {}
+
+  template<typename Allocator>
+  AutoFallibleTArray(const nsTArray<E, Allocator>& other) {
+    AppendElements(other);
+  }
 };
 
 #if defined(MOZALLOC_HAVE_XMALLOC)
@@ -1299,6 +1309,11 @@ class AutoInfallibleTArray : public nsAutoArrayBase<InfallibleTArray<E>, N>
 {
 public:
   AutoInfallibleTArray() {}
+
+  template<typename Allocator>
+  AutoInfallibleTArray(const nsTArray<E, Allocator>& other) {
+    AppendElements(other);
+  }
 };
 #endif