Merge mozilla-central to fx-team

accessible/atk/AccessibleWrap.h

@@ -52,11 +52,11 @@ public:
   virtual ~AccessibleWrap();
   void ShutdownAtkObject();
 
-  virtual void Shutdown();
+  virtual void Shutdown() MOZ_OVERRIDE;
 
   // return the atk object for this AccessibleWrap
   virtual void GetNativeInterface(void** aOutAccessible) MOZ_OVERRIDE;
-  virtual nsresult HandleAccEvent(AccEvent* aEvent);
+  virtual nsresult HandleAccEvent(AccEvent* aEvent) MOZ_OVERRIDE;
 
   AtkObject * GetAtkObject(void);
   static AtkObject* GetAtkObject(Accessible* aAccessible);

accessible/atk/ApplicationAccessibleWrap.h

@@ -19,9 +19,9 @@ public:
   virtual ~ApplicationAccessibleWrap();
 
   // Accessible
-  virtual mozilla::a11y::ENameValueFlag Name(nsString& aName);
+  virtual mozilla::a11y::ENameValueFlag Name(nsString& aName) MOZ_OVERRIDE;
   virtual bool InsertChildAt(uint32_t aIdx, Accessible* aChild) MOZ_OVERRIDE;
-  virtual bool RemoveChild(Accessible* aChild);
+  virtual bool RemoveChild(Accessible* aChild) MOZ_OVERRIDE;
 
   /**
    * Return the atk object for app root accessible.

accessible/atk/AtkSocketAccessible.h

@@ -45,7 +45,7 @@ public:
   AtkSocketAccessible(nsIContent* aContent, DocAccessible* aDoc,
                       const nsCString& aPlugId);
 
-  virtual void Shutdown();
+  virtual void Shutdown() MOZ_OVERRIDE;
 
   virtual void GetNativeInterface(void** aOutAccessible) MOZ_OVERRIDE;
 };

accessible/base/AccCollector.h

@@ -77,14 +77,14 @@ public:
   virtual ~EmbeddedObjCollector() { }
 
 public:
-  virtual int32_t GetIndexAt(Accessible* aAccessible);
+  virtual int32_t GetIndexAt(Accessible* aAccessible) MOZ_OVERRIDE;
 
 protected:
   // Make sure it's used by Accessible class only.
   explicit EmbeddedObjCollector(Accessible* aRoot) :
     AccCollector(aRoot, filters::GetEmbeddedObject) { }
 
-  virtual void AppendObject(Accessible* aAccessible);
+  virtual void AppendObject(Accessible* aAccessible) MOZ_OVERRIDE;
 
   friend class Accessible;
 };

accessible/base/AccEvent.h

@@ -154,7 +154,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eStateChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eStateChangeEvent);
   }
@@ -183,7 +183,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eTextChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eTextChangeEvent);
   }
@@ -223,7 +223,7 @@ public:
 
   // Event
   static const EventGroup kEventGroup = eMutationEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eMutationEvent);
   }
@@ -253,7 +253,7 @@ public:
 
   // Event
   static const EventGroup kEventGroup = eHideEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccMutationEvent::GetEventGroups() | (1U << eHideEvent);
   }
@@ -281,7 +281,7 @@ public:
 
   // Event
   static const EventGroup kEventGroup = eShowEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccMutationEvent::GetEventGroups() | (1U << eShowEvent);
   }
@@ -301,7 +301,7 @@ public:
 
   // Event
   static const EventGroup kEventGroup = eReorderEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eReorderEvent);
   }
@@ -354,7 +354,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eCaretMoveEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eCaretMoveEvent);
   }
@@ -380,7 +380,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eTextSelChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eTextSelChangeEvent);
   }
@@ -419,7 +419,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eSelectionChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eSelectionChangeEvent);
   }
@@ -449,7 +449,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eTableChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eTableChangeEvent);
   }
@@ -479,7 +479,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eVirtualCursorChangeEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eVirtualCursorChangeEvent);
   }
@@ -509,7 +509,7 @@ public:
 
   // AccEvent
   static const EventGroup kEventGroup = eObjectAttrChangedEvent;
-  virtual unsigned int GetEventGroups() const
+  virtual unsigned int GetEventGroups() const MOZ_OVERRIDE
   {
     return AccEvent::GetEventGroups() | (1U << eObjectAttrChangedEvent);
   }

accessible/base/AccIterator.h

@@ -43,7 +43,7 @@ public:
    * Return next accessible complying with filter function. Return the first
    * accessible for the first time.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   AccIterator();
@@ -89,7 +89,7 @@ public:
   /**
    * Return next related accessible for the given dependent accessible.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   RelatedAccIterator();
@@ -123,7 +123,7 @@ public:
   /**
    * Return next label accessible associated with the given element.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   HTMLLabelIterator();
@@ -150,7 +150,7 @@ public:
   /**
    * Return next output accessible associated with the given element.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   HTMLOutputIterator();
@@ -173,7 +173,7 @@ public:
   /**
    * Return next label accessible associated with the given element.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   XULLabelIterator();
@@ -196,7 +196,7 @@ public:
   /**
    * Return next description accessible associated with the given element.
    */
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   XULDescriptionIterator();
@@ -234,7 +234,7 @@ public:
   nsIContent* GetElem(const nsDependentSubstring& aID);
 
   // AccIterable
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   IDRefsIterator();
@@ -257,7 +257,7 @@ public:
   explicit SingleAccIterator(Accessible* aTarget): mAcc(aTarget) { }
   virtual ~SingleAccIterator() { }
 
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   SingleAccIterator();
@@ -278,7 +278,7 @@ public:
     mContainer(aItemContainer), mAnchor(nullptr) { }
   virtual ~ItemIterator() { }
 
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   ItemIterator() = delete;
@@ -300,7 +300,7 @@ public:
                       int32_t aRowIdx);
   virtual ~XULTreeItemIterator() { }
 
-  virtual Accessible* Next();
+  virtual Accessible* Next() MOZ_OVERRIDE;
 
 private:
   XULTreeItemIterator() = delete;

accessible/base/NotificationController.h

@@ -64,7 +64,7 @@ public:
     mInstance(aInstance), mCallback(aCallback), mArg(aArg) { }
   virtual ~TNotification() { mInstance = nullptr; }
 
-  virtual void Process()
+  virtual void Process() MOZ_OVERRIDE
   {
     (mInstance->*mCallback)(mArg);
 
@@ -91,8 +91,8 @@ class NotificationController MOZ_FINAL : public EventQueue,
 public:
   NotificationController(DocAccessible* aDocument, nsIPresShell* aPresShell);
 
-  NS_IMETHOD_(MozExternalRefCountType) AddRef(void);
+  NS_IMETHOD_(MozExternalRefCountType) AddRef(void) MOZ_OVERRIDE;
-  NS_IMETHOD_(MozExternalRefCountType) Release(void);
+  NS_IMETHOD_(MozExternalRefCountType) Release(void) MOZ_OVERRIDE;
 
   NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(NotificationController)
 
@@ -203,7 +203,7 @@ private:
   NotificationController& operator = (const NotificationController&);
 
   // nsARefreshObserver
-  virtual void WillRefresh(mozilla::TimeStamp aTime);
+  virtual void WillRefresh(mozilla::TimeStamp aTime) MOZ_OVERRIDE;
 
 private:
   /**

accessible/base/TextAttrs.h

@@ -130,7 +130,7 @@ protected:
 
     // TextAttr
     virtual void Expose(nsIPersistentProperties* aAttributes,
-                        bool aIncludeDefAttrValue)
+                        bool aIncludeDefAttrValue) MOZ_OVERRIDE
     {
       if (mGetRootValue) {
         if (mIsRootDefined)
@@ -148,7 +148,7 @@ protected:
         ExposeValue(aAttributes, mRootNativeValue);
     }
 
-    virtual bool Equal(Accessible* aAccessible)
+    virtual bool Equal(Accessible* aAccessible) MOZ_OVERRIDE
     {
       T nativeValue;
       bool isDefined = GetValueFor(aAccessible, &nativeValue);
@@ -203,9 +203,9 @@ protected:
   protected:
 
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, nsString* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, nsString* aValue) MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nsString& aValue);
+                             const nsString& aValue) MOZ_OVERRIDE;
 
   private:
     nsCOMPtr<nsIContent> mRootContent;
@@ -234,9 +234,9 @@ protected:
     };
 
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, uint32_t* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, uint32_t* aValue) MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const uint32_t& aValue);
+                             const uint32_t& aValue) MOZ_OVERRIDE;
 
   private:
     bool GetValue(nsIContent* aElm, uint32_t* aValue);
@@ -256,9 +256,10 @@ protected:
   protected:
 
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, nscolor* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, nscolor* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nscolor& aValue);
+                             const nscolor& aValue) MOZ_OVERRIDE;
 
   private:
     bool GetColor(nsIFrame* aFrame, nscolor* aColor);
@@ -278,9 +279,10 @@ protected:
   protected:
 
     // TTextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, nscolor* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, nscolor* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nscolor& aValue);
+                             const nscolor& aValue) MOZ_OVERRIDE;
   };
 
 
@@ -296,9 +298,10 @@ protected:
   protected:
 
     // TTextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, nsString* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, nsString* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nsString& aValue);
+                             const nsString& aValue) MOZ_OVERRIDE;
 
   private:
 
@@ -318,9 +321,10 @@ protected:
   protected:
 
     // TTextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, nscoord* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, nscoord* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nscoord& aValue);
+                             const nscoord& aValue) MOZ_OVERRIDE;
 
   private:
     nsDeviceContext* mDC;
@@ -339,9 +343,10 @@ protected:
   protected:
 
     // TTextAttr
-    virtual bool GetValueFor(Accessible* aContent, nscoord* aValue);
+    virtual bool GetValueFor(Accessible* aContent, nscoord* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const nscoord& aValue);
+                             const nscoord& aValue) MOZ_OVERRIDE;
   };
 
 
@@ -357,9 +362,10 @@ protected:
   protected:
 
     // TTextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, int32_t* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, int32_t* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const int32_t& aValue);
+                             const int32_t& aValue) MOZ_OVERRIDE;
 
   private:
     int32_t GetFontWeight(nsIFrame* aFrame);
@@ -377,9 +383,10 @@ protected:
 
   protected:
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, bool* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, bool* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const bool& aValue);
+                             const bool& aValue) MOZ_OVERRIDE;
   };
 
 
@@ -428,9 +435,10 @@ protected:
   protected:
 
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, TextDecorValue* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, TextDecorValue* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const TextDecorValue& aValue);
+                             const TextDecorValue& aValue) MOZ_OVERRIDE;
   };
 
   /**
@@ -453,9 +461,10 @@ protected:
   protected:
 
     // TextAttr
-    virtual bool GetValueFor(Accessible* aAccessible, TextPosValue* aValue);
+    virtual bool GetValueFor(Accessible* aAccessible, TextPosValue* aValue)
+      MOZ_OVERRIDE;
     virtual void ExposeValue(nsIPersistentProperties* aAttributes,
-                             const TextPosValue& aValue);
+                             const TextPosValue& aValue) MOZ_OVERRIDE;
 
   private:
     TextPosValue GetTextPosValue(nsIFrame* aFrame) const;

accessible/generic/Accessible.cpp

@@ -1729,7 +1729,7 @@ Accessible::DoCommand(nsIContent *aContent, uint32_t aActionIndex)
     Runnable(Accessible* aAcc, nsIContent* aContent, uint32_t aIdx) :
       mAcc(aAcc), mContent(aContent), mIdx(aIdx) { }
 
-    NS_IMETHOD Run()
+    NS_IMETHOD Run() MOZ_OVERRIDE
     {
       if (mAcc)
         mAcc->DispatchClickEvent(mContent, mIdx);

accessible/xpcom/xpcAccessible.h

@@ -24,60 +24,68 @@ class xpcAccessible : public nsIAccessible
 {
 public:
   // nsIAccessible
-  NS_IMETHOD GetParent(nsIAccessible** aParent) MOZ_FINAL;
+  NS_IMETHOD GetParent(nsIAccessible** aParent) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetNextSibling(nsIAccessible** aNextSibling) MOZ_FINAL;
+  NS_IMETHOD GetNextSibling(nsIAccessible** aNextSibling) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetPreviousSibling(nsIAccessible** aPreviousSibling) MOZ_FINAL;
+  NS_IMETHOD GetPreviousSibling(nsIAccessible** aPreviousSibling)
-  NS_IMETHOD GetFirstChild(nsIAccessible** aFirstChild) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetLastChild(nsIAccessible** aLastChild) MOZ_FINAL;
+  NS_IMETHOD GetFirstChild(nsIAccessible** aFirstChild) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetChildCount(int32_t* aChildCount) MOZ_FINAL;
+  NS_IMETHOD GetLastChild(nsIAccessible** aLastChild) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetChildAt(int32_t aChildIndex, nsIAccessible** aChild) MOZ_FINAL;
+  NS_IMETHOD GetChildCount(int32_t* aChildCount) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetChildren(nsIArray** aChildren) MOZ_FINAL;
+  NS_IMETHOD GetChildAt(int32_t aChildIndex, nsIAccessible** aChild)
-  NS_IMETHOD GetIndexInParent(int32_t* aIndexInParent) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetChildren(nsIArray** aChildren) MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetIndexInParent(int32_t* aIndexInParent) MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetDOMNode(nsIDOMNode** aDOMNode) MOZ_FINAL;
+  NS_IMETHOD GetDOMNode(nsIDOMNode** aDOMNode) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetDocument(nsIAccessibleDocument** aDocument) MOZ_FINAL;
+  NS_IMETHOD GetDocument(nsIAccessibleDocument** aDocument) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetRootDocument(nsIAccessibleDocument** aRootDocument) MOZ_FINAL;
+  NS_IMETHOD GetRootDocument(nsIAccessibleDocument** aRootDocument)
+    MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetRole(uint32_t* aRole) MOZ_FINAL;
+  NS_IMETHOD GetRole(uint32_t* aRole) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetState(uint32_t* aState, uint32_t* aExtraState) MOZ_FINAL;
+  NS_IMETHOD GetState(uint32_t* aState, uint32_t* aExtraState)
+    MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetDescription(nsAString& aDescription) MOZ_FINAL;
+  NS_IMETHOD GetDescription(nsAString& aDescription) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetName(nsAString& aName) MOZ_FINAL;
+  NS_IMETHOD GetName(nsAString& aName) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetLanguage(nsAString& aLanguage) MOZ_FINAL;
+  NS_IMETHOD GetLanguage(nsAString& aLanguage) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetValue(nsAString& aValue) MOZ_FINAL;
+  NS_IMETHOD GetValue(nsAString& aValue) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetHelp(nsAString& aHelp) MOZ_FINAL;
+  NS_IMETHOD GetHelp(nsAString& aHelp) MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetAccessKey(nsAString& aAccessKey) MOZ_FINAL;
+  NS_IMETHOD GetAccessKey(nsAString& aAccessKey) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetKeyboardShortcut(nsAString& aKeyBinding) MOZ_FINAL;
+  NS_IMETHOD GetKeyboardShortcut(nsAString& aKeyBinding) MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetAttributes(nsIPersistentProperties** aAttributes) MOZ_FINAL;
+  NS_IMETHOD GetAttributes(nsIPersistentProperties** aAttributes)
+    MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetBounds(int32_t* aX, int32_t* aY,
-                       int32_t* aWidth, int32_t* aHeight) MOZ_FINAL;
+                       int32_t* aWidth, int32_t* aHeight) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GroupPosition(int32_t* aGroupLevel, int32_t* aSimilarItemsInGroup,
-                           int32_t* aPositionInGroup) MOZ_FINAL;
+                           int32_t* aPositionInGroup) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetRelationByType(uint32_t aType,
-                               nsIAccessibleRelation** aRelation) MOZ_FINAL;
+                               nsIAccessibleRelation** aRelation)
-  NS_IMETHOD GetRelations(nsIArray** aRelations) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetRelations(nsIArray** aRelations) MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetFocusedChild(nsIAccessible** aChild) MOZ_FINAL;
+  NS_IMETHOD GetFocusedChild(nsIAccessible** aChild) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetChildAtPoint(int32_t aX, int32_t aY,
-                             nsIAccessible** aAccessible) MOZ_FINAL;
+                             nsIAccessible** aAccessible) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetDeepestChildAtPoint(int32_t aX, int32_t aY,
-                                    nsIAccessible** aAccessible) MOZ_FINAL;
+                                    nsIAccessible** aAccessible)
+    MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD SetSelected(bool aSelect) MOZ_FINAL;
+  NS_IMETHOD SetSelected(bool aSelect) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD ExtendSelection() MOZ_FINAL;
+  NS_IMETHOD ExtendSelection() MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD TakeSelection() MOZ_FINAL;
+  NS_IMETHOD TakeSelection() MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD TakeFocus() MOZ_FINAL;
+  NS_IMETHOD TakeFocus() MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD GetActionCount(uint8_t* aActionCount) MOZ_FINAL;
+  NS_IMETHOD GetActionCount(uint8_t* aActionCount) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetActionName(uint8_t aIndex, nsAString& aName) MOZ_FINAL;
+  NS_IMETHOD GetActionName(uint8_t aIndex, nsAString& aName) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetActionDescription(uint8_t aIndex, nsAString& aDescription) MOZ_FINAL;
+  NS_IMETHOD GetActionDescription(uint8_t aIndex, nsAString& aDescription)
-  NS_IMETHOD DoAction(uint8_t aIndex) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD DoAction(uint8_t aIndex) MOZ_FINAL MOZ_OVERRIDE;
 
-  NS_IMETHOD ScrollTo(uint32_t aHow) MOZ_FINAL;
+  NS_IMETHOD ScrollTo(uint32_t aHow) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD ScrollToPoint(uint32_t aCoordinateType,
-                           int32_t aX, int32_t aY) MOZ_FINAL;
+                           int32_t aX, int32_t aY) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   xpcAccessible() { }

accessible/xpcom/xpcAccessibleApplication.h

@@ -27,10 +27,10 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleApplication
-  NS_IMETHOD GetAppName(nsAString& aName) MOZ_FINAL;
+  NS_IMETHOD GetAppName(nsAString& aName) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetAppVersion(nsAString& aVersion) MOZ_FINAL;
+  NS_IMETHOD GetAppVersion(nsAString& aVersion) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetPlatformName(nsAString& aName) MOZ_FINAL;
+  NS_IMETHOD GetPlatformName(nsAString& aName) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetPlatformVersion(nsAString& aVersion) MOZ_FINAL;
+  NS_IMETHOD GetPlatformVersion(nsAString& aVersion) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   virtual ~xpcAccessibleApplication() {}

accessible/xpcom/xpcAccessibleDocument.h

@@ -32,17 +32,20 @@ public:
                                            xpcAccessibleGeneric)
 
   // nsIAccessibleDocument
-  NS_IMETHOD GetURL(nsAString& aURL) MOZ_FINAL;
+  NS_IMETHOD GetURL(nsAString& aURL) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetTitle(nsAString& aTitle) MOZ_FINAL;
+  NS_IMETHOD GetTitle(nsAString& aTitle) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetMimeType(nsAString& aType) MOZ_FINAL;
+  NS_IMETHOD GetMimeType(nsAString& aType) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetDocType(nsAString& aType) MOZ_FINAL;
+  NS_IMETHOD GetDocType(nsAString& aType) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetDOMDocument(nsIDOMDocument** aDOMDocument) MOZ_FINAL;
+  NS_IMETHOD GetDOMDocument(nsIDOMDocument** aDOMDocument) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetWindow(nsIDOMWindow** aDOMWindow) MOZ_FINAL;
+  NS_IMETHOD GetWindow(nsIDOMWindow** aDOMWindow) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetParentDocument(nsIAccessibleDocument** aDocument) MOZ_FINAL;
+  NS_IMETHOD GetParentDocument(nsIAccessibleDocument** aDocument)
-  NS_IMETHOD GetChildDocumentCount(uint32_t* aCount) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetChildDocumentCount(uint32_t* aCount) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetChildDocumentAt(uint32_t aIndex,
-                                nsIAccessibleDocument** aDocument) MOZ_FINAL;
+                                nsIAccessibleDocument** aDocument)
-  NS_IMETHOD GetVirtualCursor(nsIAccessiblePivot** aVirtualCursor) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetVirtualCursor(nsIAccessiblePivot** aVirtualCursor)
+    MOZ_FINAL MOZ_OVERRIDE;
 
   /**
    * Return XPCOM wrapper for the internal accessible.

accessible/xpcom/xpcAccessibleGeneric.h

@@ -41,7 +41,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(xpcAccessibleGeneric, nsIAccessible)
 
   // nsIAccessible
-  virtual Accessible* ToInternalAccessible() const MOZ_FINAL;
+  virtual Accessible* ToInternalAccessible() const MOZ_FINAL MOZ_OVERRIDE;
 
   // xpcAccessibleGeneric
   virtual void Shutdown();

accessible/xpcom/xpcAccessibleHyperLink.h

@@ -23,12 +23,13 @@ class Accessible;
 class xpcAccessibleHyperLink : public nsIAccessibleHyperLink
 {
 public:
-  NS_IMETHOD GetAnchorCount(int32_t* aAnchorCount) MOZ_FINAL;
+  NS_IMETHOD GetAnchorCount(int32_t* aAnchorCount) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetStartIndex(int32_t* aStartIndex) MOZ_FINAL;
+  NS_IMETHOD GetStartIndex(int32_t* aStartIndex) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetEndIndex(int32_t* aEndIndex) MOZ_FINAL;
+  NS_IMETHOD GetEndIndex(int32_t* aEndIndex) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetURI(int32_t aIndex, nsIURI** aURI) MOZ_FINAL;
+  NS_IMETHOD GetURI(int32_t aIndex, nsIURI** aURI) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetAnchor(int32_t aIndex, nsIAccessible** aAccessible) MOZ_FINAL;
+  NS_IMETHOD GetAnchor(int32_t aIndex, nsIAccessible** aAccessible)
-  NS_IMETHOD GetValid(bool* aValid) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetValid(bool* aValid) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   xpcAccessibleHyperLink() { }

accessible/xpcom/xpcAccessibleImage.h

@@ -24,8 +24,8 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_IMETHOD GetImagePosition(uint32_t aCoordType,
-                              int32_t* aX, int32_t* aY) MOZ_FINAL;
+                              int32_t* aX, int32_t* aY) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetImageSize(int32_t* aWidth, int32_t* aHeight) MOZ_FINAL;
+  NS_IMETHOD GetImageSize(int32_t* aWidth, int32_t* aHeight) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   virtual ~xpcAccessibleImage() {}

accessible/xpcom/xpcAccessibleSelectable.h

@@ -25,14 +25,17 @@ class xpcAccessibleSelectable : public nsIAccessibleSelectable
 {
 public:
   // nsIAccessibleSelectable
-  NS_IMETHOD GetSelectedItems(nsIArray** aSelectedItems) MOZ_FINAL;
+  NS_IMETHOD GetSelectedItems(nsIArray** aSelectedItems) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetSelectedItemCount(uint32_t* aSelectedItemCount) MOZ_FINAL;
+  NS_IMETHOD GetSelectedItemCount(uint32_t* aSelectedItemCount)
-  NS_IMETHOD GetSelectedItemAt(uint32_t aIndex, nsIAccessible** aItem) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD IsItemSelected(uint32_t aIndex, bool* aIsSelected) MOZ_FINAL;
+  NS_IMETHOD GetSelectedItemAt(uint32_t aIndex, nsIAccessible** aItem)
-  NS_IMETHOD AddItemToSelection(uint32_t aIndex) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD RemoveItemFromSelection(uint32_t aIndex) MOZ_FINAL;
+  NS_IMETHOD IsItemSelected(uint32_t aIndex, bool* aIsSelected)
-  NS_IMETHOD SelectAll(bool* aIsMultiSelect) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD UnselectAll() MOZ_FINAL;
+  NS_IMETHOD AddItemToSelection(uint32_t aIndex) MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD RemoveItemFromSelection(uint32_t aIndex) MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD SelectAll(bool* aIsMultiSelect) MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD UnselectAll() MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   xpcAccessibleSelectable() { }

accessible/xpcom/xpcAccessibleTable.h

@@ -26,42 +26,55 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
-  NS_IMETHOD GetCaption(nsIAccessible** aCaption) MOZ_FINAL;
+  NS_IMETHOD GetCaption(nsIAccessible** aCaption) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetSummary(nsAString& aSummary) MOZ_FINAL;
+  NS_IMETHOD GetSummary(nsAString& aSummary) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnCount(int32_t* aColumnCount) MOZ_FINAL;
+  NS_IMETHOD GetColumnCount(int32_t* aColumnCount) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetRowCount(int32_t* aRowCount) MOZ_FINAL;
+  NS_IMETHOD GetRowCount(int32_t* aRowCount) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetCellAt(int32_t aRowIndex, int32_t aColumnIndex,
-                       nsIAccessible** aCell) MOZ_FINAL;
+                       nsIAccessible** aCell) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetCellIndexAt(int32_t aRowIndex, int32_t aColumnIndex,
-                            int32_t* aCellIndex) MOZ_FINAL;
+                            int32_t* aCellIndex) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnIndexAt(int32_t aCellIndex, int32_t* aColumnIndex) MOZ_FINAL;
+  NS_IMETHOD GetColumnIndexAt(int32_t aCellIndex, int32_t* aColumnIndex)
-  NS_IMETHOD GetRowIndexAt(int32_t aCellIndex, int32_t* aRowIndex) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetRowIndexAt(int32_t aCellIndex, int32_t* aRowIndex)
+    MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetRowAndColumnIndicesAt(int32_t aCellIndex, int32_t* aRowIndex,
-                                      int32_t* aColumnIndex) MOZ_FINAL;
+                                      int32_t* aColumnIndex)
+    MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetColumnExtentAt(int32_t row, int32_t column,
-                               int32_t* aColumnExtent) MOZ_FINAL;
+                               int32_t* aColumnExtent) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetRowExtentAt(int32_t row, int32_t column,
-                            int32_t* aRowExtent) MOZ_FINAL;
+                            int32_t* aRowExtent) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnDescription(int32_t aColIdx, nsAString& aDescription) MOZ_FINAL;
+  NS_IMETHOD GetColumnDescription(int32_t aColIdx, nsAString& aDescription)
-  NS_IMETHOD GetRowDescription(int32_t aRowIdx, nsAString& aDescription) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD IsColumnSelected(int32_t aColIdx, bool* _retval) MOZ_FINAL;
+  NS_IMETHOD GetRowDescription(int32_t aRowIdx, nsAString& aDescription)
-  NS_IMETHOD IsRowSelected(int32_t aRowIdx, bool* _retval) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD IsCellSelected(int32_t aRowIdx, int32_t aColIdx, bool* _retval) MOZ_FINAL;
+  NS_IMETHOD IsColumnSelected(int32_t aColIdx, bool* _retval)
-  NS_IMETHOD GetSelectedCellCount(uint32_t* aSelectedCellCount) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetSelectedColumnCount(uint32_t* aSelectedColumnCount) MOZ_FINAL;
+  NS_IMETHOD IsRowSelected(int32_t aRowIdx, bool* _retval)
-  NS_IMETHOD GetSelectedRowCount(uint32_t* aSelectedRowCount) MOZ_FINAL;
+    MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetSelectedCells(nsIArray** aSelectedCell) MOZ_FINAL;
+  NS_IMETHOD IsCellSelected(int32_t aRowIdx, int32_t aColIdx, bool* _retval)
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetSelectedCellCount(uint32_t* aSelectedCellCount)
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetSelectedColumnCount(uint32_t* aSelectedColumnCount)
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetSelectedRowCount(uint32_t* aSelectedRowCount)
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetSelectedCells(nsIArray** aSelectedCell) MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetSelectedCellIndices(uint32_t* aCellsArraySize,
-                                    int32_t** aCellsArray) MOZ_FINAL;
+                                    int32_t** aCellsArray)
+    MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetSelectedColumnIndices(uint32_t* aColsArraySize,
-                                      int32_t** aColsArray) MOZ_FINAL;
+                                      int32_t** aColsArray)
+    MOZ_FINAL MOZ_OVERRIDE;
   NS_IMETHOD GetSelectedRowIndices(uint32_t* aRowsArraySize,
-                                   int32_t** aRowsArray) MOZ_FINAL;
+                                   int32_t** aRowsArray) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD SelectColumn(int32_t aColIdx) MOZ_FINAL;
+  NS_IMETHOD SelectColumn(int32_t aColIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD SelectRow(int32_t aRowIdx) MOZ_FINAL;
+  NS_IMETHOD SelectRow(int32_t aRowIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD UnselectColumn(int32_t aColIdx) MOZ_FINAL;
+  NS_IMETHOD UnselectColumn(int32_t aColIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD UnselectRow(int32_t aRowIdx) MOZ_FINAL;
+  NS_IMETHOD UnselectRow(int32_t aRowIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD IsProbablyForLayout(bool* aIsForLayout) MOZ_FINAL;
+  NS_IMETHOD IsProbablyForLayout(bool* aIsForLayout) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   virtual ~xpcAccessibleTable() {}

accessible/xpcom/xpcAccessibleTableCell.h

@@ -27,14 +27,14 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
-  NS_IMETHOD GetTable(nsIAccessibleTable** aTable) MOZ_FINAL;
+  NS_IMETHOD GetTable(nsIAccessibleTable** aTable) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnIndex(int32_t* aColIdx) MOZ_FINAL;
+  NS_IMETHOD GetColumnIndex(int32_t* aColIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetRowIndex(int32_t* aRowIdx) MOZ_FINAL;
+  NS_IMETHOD GetRowIndex(int32_t* aRowIdx) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnExtent(int32_t* aExtent) MOZ_FINAL;
+  NS_IMETHOD GetColumnExtent(int32_t* aExtent) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetRowExtent(int32_t* aExtent) MOZ_FINAL;
+  NS_IMETHOD GetRowExtent(int32_t* aExtent) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetColumnHeaderCells(nsIArray** aHeaderCells) MOZ_FINAL;
+  NS_IMETHOD GetColumnHeaderCells(nsIArray** aHeaderCells) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetRowHeaderCells(nsIArray** aHeaderCells) MOZ_FINAL;
+  NS_IMETHOD GetRowHeaderCells(nsIArray** aHeaderCells) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD IsSelected(bool* aSelected) MOZ_FINAL;
+  NS_IMETHOD IsSelected(bool* aSelected) MOZ_FINAL MOZ_OVERRIDE;
 
 protected:
   virtual ~xpcAccessibleTableCell() {}

accessible/xul/XULFormControlAccessible.h

@@ -174,8 +174,8 @@ public:
   XULToolbarButtonAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // Accessible
-  virtual void GetPositionAndSizeInternal(int32_t *aPosInSet,
+  virtual void GetPositionAndSizeInternal(int32_t* aPosInSet,
-                                          int32_t *aSetSize);
+                                          int32_t* aSetSize) MOZ_OVERRIDE;
 
   // nsXULToolbarButtonAccessible
   static bool IsSeparator(Accessible* aAccessible);

accessible/xul/XULTreeAccessible.h

@@ -262,7 +262,8 @@ protected:
 
   // Accessible
   virtual Accessible* GetSiblingAtOffset(int32_t aOffset,
-                                         nsresult *aError = nullptr) const;
+                                         nsresult* aError = nullptr) const
+    MOZ_OVERRIDE;
 };
 
 

b2g/app/b2g.js

@@ -322,7 +322,7 @@ pref("media.fragmented-mp4.gonk.enabled", true);
 pref("media.video-queue.default-size", 3);
 
 // optimize images' memory usage
-pref("image.mem.decodeondraw", true);
+pref("image.mem.decodeondraw", false);
 pref("image.mem.allow_locking_in_content_processes", false); /* don't allow image locking */
 // Limit the surface cache to 1/8 of main memory or 128MB, whichever is smaller.
 // Almost everything that was factored into 'max_decoded_image_kb' is now stored

b2g/app/nsBrowserApp.cpp

@@ -223,6 +223,8 @@ int main(int argc, _CONST char* argv[])
 #elif defined(XP_WIN)
   IO_COUNTERS ioCounters;
   gotCounters = GetProcessIoCounters(GetCurrentProcess(), &ioCounters);
+#else
+  #error "Unknown platform"  // having this here keeps cppcheck happy
 #endif
 
 #ifdef HAS_DLL_BLOCKLIST
@@ -271,6 +273,8 @@ int main(int argc, _CONST char* argv[])
       XRE_TelemetryAccumulate(mozilla::Telemetry::GLUESTARTUP_HARD_FAULTS,
                               int(newRUsage.ru_majflt - initialRUsage.ru_majflt));
     }
+#else
+  #error "Unknown platform"  // having this here keeps cppcheck happy
 #endif
   }
 

b2g/config/dolphin/sources.xml

@@ -15,15 +15,15 @@
   <project name="platform_build" path="build" remote="b2g" revision="e0c735ec89df011ea7dd435087a9045ecff9ff9e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -116,7 +116,7 @@
   <project name="platform_prebuilts_qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="f7d9bf71cf6693474f3f2a81a4ba62c0fc5646aa"/>
   <project name="platform/prebuilts/sdk" path="prebuilts/sdk" revision="cfcef469537869947abb9aa1d656774cc2678d4c"/>
   <project name="platform/prebuilts/tools" path="prebuilts/tools" revision="5a48c04c4bb5f079bc757e29864a42427378e051"/>
-  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="aa3adea9c18ae00d36e597d5890cf14cb7dfb105"/>
+  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="bdc5a9f9602652c3c2626e020da03674a2c2e1b6"/>
   <project name="platform/system/extras" path="system/extras" revision="10e78a05252b3de785f88c2d0b9ea8a428009c50"/>
   <project name="platform/system/media" path="system/media" revision="7ff72c2ea2496fa50b5e8a915e56e901c3ccd240"/>
   <project name="platform_system_libfdio" path="system/libfdio" remote="b2g" revision="fe95bc6f83af5c18a73aa86c96e7fa7f79b91477"/>

b2g/config/emulator-ics/sources.xml

@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="6fa7a4936414ceb4055fd27f7a30e76790f834fb"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform_bionic" path="bionic" remote="b2g" revision="e2b3733ba3fa5e3f404e983d2e4142b1f6b1b846"/>

b2g/config/emulator-jb/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -118,7 +118,7 @@
   <project name="platform/prebuilts/sdk" path="prebuilts/sdk" revision="842e33e43a55ea44833b9e23e4d180fa17c843af"/>
   <project name="platform/prebuilts/tools" path="prebuilts/tools" revision="5db24726f0f42124304195a6bdea129039eeeaeb"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="930ae098543881f47eac054677726ee4b998b2f8"/>
-  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="aa3adea9c18ae00d36e597d5890cf14cb7dfb105"/>
+  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="bdc5a9f9602652c3c2626e020da03674a2c2e1b6"/>
   <project name="platform_system_core" path="system/core" remote="b2g" revision="542d1f59dc331b472307e5bd043101d14d5a3a3e"/>
   <project name="platform/system/extras" path="system/extras" revision="18c1180e848e7ab8691940481f5c1c8d22c37b3e"/>
   <project name="platform_system_libfdio" path="system/libfdio" remote="b2g" revision="fe95bc6f83af5c18a73aa86c96e7fa7f79b91477"/>

b2g/config/emulator-kk/sources.xml

@@ -15,15 +15,15 @@
   <project name="platform_build" path="build" remote="b2g" revision="e0c735ec89df011ea7dd435087a9045ecff9ff9e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="f92a936f2aa97526d4593386754bdbf02db07a12"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="6e47ff2790f5656b5b074407829ceecf3e6188c4"/>
@@ -116,7 +116,7 @@
   <project name="platform_prebuilts_qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="f7d9bf71cf6693474f3f2a81a4ba62c0fc5646aa"/>
   <project name="platform/prebuilts/sdk" path="prebuilts/sdk" revision="b562b01c93de9578d5db537b6a602a38e1aaa0ce"/>
   <project name="platform/prebuilts/tools" path="prebuilts/tools" revision="387f03e815f57d536dd922706db1622bddba8d81"/>
-  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="aa3adea9c18ae00d36e597d5890cf14cb7dfb105"/>
+  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="bdc5a9f9602652c3c2626e020da03674a2c2e1b6"/>
   <project name="platform/system/extras" path="system/extras" revision="5356165f67f4a81c2ef28671c13697f1657590df"/>
   <project name="platform/system/media" path="system/media" revision="be0e2fe59a8043fa5200f75697df9220a99abe9d"/>
   <project name="platform_system_libfdio" path="system/libfdio" remote="b2g" revision="fe95bc6f83af5c18a73aa86c96e7fa7f79b91477"/>

b2g/config/emulator/sources.xml

@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="d5d3f93914558b6f168447b805cd799c8233e300"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="6fa7a4936414ceb4055fd27f7a30e76790f834fb"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform_bionic" path="bionic" remote="b2g" revision="e2b3733ba3fa5e3f404e983d2e4142b1f6b1b846"/>

b2g/config/flame-kk/sources.xml

@@ -15,15 +15,15 @@
   <project name="platform_build" path="build" remote="b2g" revision="e0c735ec89df011ea7dd435087a9045ecff9ff9e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -35,10 +35,8 @@
   <project name="device/sample" path="device/sample" revision="9c19bbbe0793ebdc427277dc37f9bb4ae20bccb2"/>
   <project name="platform/abi/cpp" path="abi/cpp" revision="18f1b5e28734183ff8073fe86dc46bc4ebba8a59"/>
   <project name="platform/bionic" path="bionic" revision="e36fba720d5327bf5532dfcde013239080f38b56"/>
-  <project name="platform/bootable/recovery" path="bootable/recovery" revision="dc8da21282a0c68328d05268433d19b0f2f6a15c"/>
   <project name="platform/external/aac" path="external/aac" revision="fa3eba16446cc8f2f5e2dfc20d86a49dbd37299e"/>
   <project name="platform/external/bison" path="external/bison" revision="c2418b886165add7f5a31fc5609f0ce2d004a90e"/>
-  <project name="platform/external/bluetooth/bluedroid" path="external/bluetooth/bluedroid" revision="5cac78cb53f1b08386d64379c4bf61ecfbf5f56b"/>
   <project name="platform/external/bsdiff" path="external/bsdiff" revision="23e322ab19fb7d74c2c37e40ce364d9f709bdcee"/>
   <project name="platform/external/bzip2" path="external/bzip2" revision="1cb636bd8e9e5cdfd5d5b2909a122f6e80db62de"/>
   <project name="platform/external/checkpolicy" path="external/checkpolicy" revision="0d73ef7049feee794f14cf1af88d05dae8139914"/>
@@ -102,11 +100,8 @@
   <project name="platform/external/webrtc" path="external/webrtc" revision="446452f84e9cc4c75d8e80f6f05e24793397a19d"/>
   <project name="platform/external/yaffs2" path="external/yaffs2" revision="a2cff2275e1b501ff478b03757d6e4f05fddc2db"/>
   <project name="platform/external/zlib" path="external/zlib" revision="6eb3570ff8fa71bd83bb375b4bf09804c6089fed"/>
-  <project name="platform/frameworks/base" path="frameworks/base" revision="08d8f3d58fe78840103ea3d39044bc474d686e94"/>
-  <project name="platform/frameworks/native" path="frameworks/native" revision="5be7d8ca7bb5e193e092c39fd4f164189527b895"/>
   <project name="platform/frameworks/opt/emoji" path="frameworks/opt/emoji" revision="dbbe673145107e99883f62bafd70c5f43f11065c"/>
   <project name="platform/frameworks/wilhelm" path="frameworks/wilhelm" revision="f0c3b4edf597c40aae4ea311575f39c8bcf203df"/>
-  <project name="platform/hardware/libhardware" path="hardware/libhardware" revision="9a60e685a9fb38a716f18a89cd872942f75b4706"/>
   <project name="platform/hardware/libhardware_legacy" path="hardware/libhardware_legacy" revision="adb52b35ecb523bd332854945c09828ee887e575"/>
   <project name="platform/libcore" path="libcore" revision="baf7d8068dd501cfa338d3a8b1b87216d6ce0571"/>
   <project name="platform/libnativehelper" path="libnativehelper" revision="50c4430e32849530ced32680fd6ee98963b3f7ac"/>
@@ -116,20 +111,14 @@
   <project name="platform_prebuilts_qemu-kernel" path="prebuilts/qemu-kernel" remote="b2g" revision="f7d9bf71cf6693474f3f2a81a4ba62c0fc5646aa"/>
   <project name="platform/prebuilts/sdk" path="prebuilts/sdk" revision="69d524e80cdf3981006627c65ac85f3a871238a3"/>
   <project name="platform/prebuilts/tools" path="prebuilts/tools" revision="5a48c04c4bb5f079bc757e29864a42427378e051"/>
-  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="aa3adea9c18ae00d36e597d5890cf14cb7dfb105"/>
+  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="bdc5a9f9602652c3c2626e020da03674a2c2e1b6"/>
   <project name="platform/system/extras" path="system/extras" revision="576f57b6510de59c08568b53c0fb60588be8689e"/>
-  <project name="platform/system/media" path="system/media" revision="20c2fb4c896aa59f2e8379d755f439dc59a5cf9b"/>
   <project name="platform_system_libfdio" path="system/libfdio" remote="b2g" revision="fe95bc6f83af5c18a73aa86c96e7fa7f79b91477"/>
   <project name="platform/system/netd" path="system/netd" revision="a6531f7befb49b1c81bc0de7e51c5482b308e1c5"/>
   <project name="platform/system/security" path="system/security" revision="ee8068b9e7bfb2770635062fc9c2035be2142bd8"/>
   <project name="platform/system/vold" path="system/vold" revision="42fa2a0f14f965970a4b629a176bbd2666edf017"/>
   <project name="platform/external/curl" path="external/curl" revision="e68addd988448959ea8157c5de637346b4180c33"/>
   <project name="platform/external/icu4c" path="external/icu4c" revision="d3ec7428eb276db43b7ed0544e09344a6014806c"/>
-  <remove-project name="platform/frameworks/base"/>
-  <remove-project name="platform/frameworks/native"/>
-  <remove-project name="platform/hardware/libhardware"/>
-  <remove-project name="platform/external/bluetooth/bluedroid"/>
-  <remove-project name="platform/system/media"/>
   <project name="platform/system/media" path="system/media" revision="c1332c21c608f4932a6d7e83450411cde53315ef"/>
   <!--original fetch url was git://github.com/t2m-foxfone/-->
   <remote fetch="https://git.mozilla.org/external/t2m-foxfone" name="t2m"/>
@@ -137,10 +126,9 @@
   <!-- Flame specific things -->
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="1bb28abbc215f45220620af5cd60a8ac1be93722"/>
   <project name="device/qcom/common" path="device/qcom/common" revision="54c32c2ddef066fbdf611d29e4b7c47e0363599e"/>
-  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="a814b2e2dfdda7140cb3a357617dc4fbb1435e76"/>
+  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="e7c90613521145db090dd24147afd5ceb5703190"/>
   <project name="codeaurora_kernel_msm" path="kernel" remote="b2g" revision="0865bc4134b67220df4058625fba29305d6b10c3"/>
   <project name="kernel_lk" path="bootable/bootloader/lk" remote="b2g" revision="fda40423ffa573dc6cafd3780515010cb2a086be"/>
-  <remove-project name="platform/bootable/recovery"/>
   <project name="platform_bootable_recovery" path="bootable/recovery" remote="b2g" revision="26e78a979f3090dc196219e268467620b6c40ec5"/>
   <project name="platform/external/bluetooth/bluedroid" path="external/bluetooth/bluedroid" revision="30b96dfca99cb384bf520a16b81f3aba56f09907"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="5b71e40213f650459e95d35b6f14af7e88d8ab62"/>

b2g/config/flame/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->

b2g/config/gaia.json

@@ -1,9 +1,9 @@
 {
     "git": {
-        "git_revision": "", 
+        "git_revision": "579e01ad4d6e4177a8f636305ac877835d99f134", 
-        "remote": "", 
+        "remote": "https://git.mozilla.org/releases/gaia.git", 
         "branch": ""
     }, 
-    "revision": "11761056b5ee6533ef11443b95a5aee1398e6dd4", 
+    "revision": "91945bbce2f909915fe3edf033215baa4c80e3cd", 
     "repo_path": "integration/gaia-central"
 }

b2g/config/hamachi/sources.xml

@@ -17,11 +17,11 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform_bionic" path="bionic" remote="b2g" revision="1a2a32eda22ef2cd18f57f423a5e7b22a105a6f8"/>

b2g/config/helix/sources.xml

@@ -15,8 +15,8 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>

b2g/config/nexus-4/sources.xml

@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -118,7 +118,7 @@
   <project name="platform/prebuilts/sdk" path="prebuilts/sdk" revision="842e33e43a55ea44833b9e23e4d180fa17c843af"/>
   <project name="platform/prebuilts/tools" path="prebuilts/tools" revision="5db24726f0f42124304195a6bdea129039eeeaeb"/>
   <project name="platform/system/bluetooth" path="system/bluetooth" revision="930ae098543881f47eac054677726ee4b998b2f8"/>
-  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="aa3adea9c18ae00d36e597d5890cf14cb7dfb105"/>
+  <project name="platform_system_bluetoothd" path="system/bluetoothd" remote="b2g" revision="bdc5a9f9602652c3c2626e020da03674a2c2e1b6"/>
   <project name="platform_system_core" path="system/core" remote="b2g" revision="542d1f59dc331b472307e5bd043101d14d5a3a3e"/>
   <project name="platform/system/extras" path="system/extras" revision="18c1180e848e7ab8691940481f5c1c8d22c37b3e"/>
   <project name="platform_system_libfdio" path="system/libfdio" remote="b2g" revision="fe95bc6f83af5c18a73aa86c96e7fa7f79b91477"/>

b2g/config/wasabi/sources.xml

@@ -17,12 +17,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="a5c5ac093814a80b0627514c3bd5f9e96c096a4b"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="579e01ad4d6e4177a8f636305ac877835d99f134"/>
-  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="049c281ad212bf528b2af8fc246b0dd0c9f97415"/>
+  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="320dad6b787c296ba701bca8377f71ab5fd72ee8"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="1b3591a50ed352fc6ddb77462b7b35d0bfa555a3"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="fe893bb760a3bb64375f62fdf4762a58c59df9ef"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c28e606f7656de3a3a8808b68eb048528397d5a7"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="e7c3ee43c96a0079d7e4f3fe471149293225917b"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>

browser/app/nsBrowserApp.cpp

@@ -613,6 +613,8 @@ int main(int argc, char* argv[])
 #elif defined(XP_WIN)
   IO_COUNTERS ioCounters;
   gotCounters = GetProcessIoCounters(GetCurrentProcess(), &ioCounters);
+#else
+  #error "Unknown platform"  // having this here keeps cppcheck happy
 #endif
 
   nsIFile *xreDirectory;
@@ -657,6 +659,8 @@ int main(int argc, char* argv[])
       XRE_TelemetryAccumulate(mozilla::Telemetry::GLUESTARTUP_HARD_FAULTS,
                               int(newRUsage.ru_majflt - initialRUsage.ru_majflt));
     }
+#else
+  #error "Unknown platform"  // having this here keeps cppcheck happy
 #endif
   }
 

build/clang-plugin/clang-plugin.cpp

@@ -220,7 +220,7 @@ public:
       }
     }
 
-    if (isInterestingDecl(d)) {
+    if (!d->isAbstract() && isInterestingDecl(d)) {
       for (CXXRecordDecl::ctor_iterator ctor = d->ctor_begin(),
            e = d->ctor_end(); ctor != e; ++ctor) {
         // Ignore non-converting ctors
@@ -241,7 +241,10 @@ public:
         }
         unsigned ctorID = Diag.getDiagnosticIDs()->getCustomDiagID(
           DiagnosticIDs::Error, "bad implicit conversion constructor for %0");
+        unsigned noteID = Diag.getDiagnosticIDs()->getCustomDiagID(
+          DiagnosticIDs::Note, "consider adding the explicit keyword to the constructor");
         Diag.Report(ctor->getLocation(), ctorID) << d->getDeclName();
+        Diag.Report(ctor->getLocation(), noteID);
       }
     }
 

build/clang-plugin/tests/TestBadImplicitConversionCtor.cpp

@@ -1,9 +1,9 @@
 #define MOZ_IMPLICIT __attribute__((annotate("moz_implicit")))
 
 struct Foo {
-  Foo(int); // expected-error {{bad implicit conversion constructor for 'Foo'}}
+  Foo(int); // expected-error {{bad implicit conversion constructor for 'Foo'}} expected-note {{consider adding the explicit keyword to the constructor}}
-  Foo(int, char=0); // expected-error {{bad implicit conversion constructor for 'Foo'}}
+  Foo(int, char=0); // expected-error {{bad implicit conversion constructor for 'Foo'}} expected-note {{consider adding the explicit keyword to the constructor}}
-  Foo(...); // expected-error {{bad implicit conversion constructor for 'Foo'}}
+  Foo(...); // expected-error {{bad implicit conversion constructor for 'Foo'}} expected-note {{consider adding the explicit keyword to the constructor}}
   Foo(int, unsigned);
   Foo(Foo&);
   Foo(const Foo&);
@@ -32,3 +32,10 @@ struct Barn {
   Barn(int, char=0) = delete;
   Barn(...) = delete;
 };
+
+struct Abstract {
+  Abstract(int);
+  Abstract(int, char=0);
+  Abstract(...);
+  virtual void f() = 0;
+};

dom/base/Element.h

@@ -1296,7 +1296,7 @@ public:
                                    nsIContent* aContent,
                                    nsIDocument* aDoc);
 
-  NS_IMETHOD Run();
+  NS_IMETHOD Run() MOZ_OVERRIDE;
 private:
   virtual ~RemoveFromBindingManagerRunnable();
   nsRefPtr<nsBindingManager> mManager;

dom/base/nsContentList.cpp

@@ -215,14 +215,14 @@ NS_GetContentList(nsINode* aRootNode,
   };
 
   // Initialize the hashtable if needed.
-  if (!gContentListHashTable.ops) {
+  if (!gContentListHashTable.IsInitialized()) {
     PL_DHashTableInit(&gContentListHashTable, &hash_table_ops,
                       sizeof(ContentListHashEntry));
   }
 
   ContentListHashEntry *entry = nullptr;
   // First we look in our hashtable.  Then we create a content list if needed
-  if (gContentListHashTable.ops) {
+  if (gContentListHashTable.IsInitialized()) {
 
     // A PL_DHASH_ADD is equivalent to a PL_DHASH_LOOKUP for cases
     // when the entry is already in the hashtable.
@@ -325,14 +325,14 @@ GetFuncStringContentList(nsINode* aRootNode,
   };
 
   // Initialize the hashtable if needed.
-  if (!gFuncStringContentListHashTable.ops) {
+  if (!gFuncStringContentListHashTable.IsInitialized()) {
     PL_DHashTableInit(&gFuncStringContentListHashTable, &hash_table_ops,
                       sizeof(FuncStringContentListHashEntry));
   }
 
   FuncStringContentListHashEntry *entry = nullptr;
   // First we look in our hashtable.  Then we create a content list if needed
-  if (gFuncStringContentListHashTable.ops) {
+  if (gFuncStringContentListHashTable.IsInitialized()) {
     nsFuncStringCacheKey hashKey(aRootNode, aFunc, aString);
 
     // A PL_DHASH_ADD is equivalent to a PL_DHASH_LOOKUP for cases
@@ -977,14 +977,13 @@ nsContentList::RemoveFromHashtable()
     sRecentlyUsedContentLists[recentlyUsedCacheIndex] = nullptr;
   }
 
-  if (!gContentListHashTable.ops)
+  if (!gContentListHashTable.IsInitialized())
     return;
 
   PL_DHashTableRemove(&gContentListHashTable, &key);
 
   if (gContentListHashTable.EntryCount() == 0) {
     PL_DHashTableFinish(&gContentListHashTable);
-    gContentListHashTable.ops = nullptr;
   }
 }
 
@@ -1016,7 +1015,7 @@ nsCacheableFuncStringContentList::~nsCacheableFuncStringContentList()
 void
 nsCacheableFuncStringContentList::RemoveFromFuncStringHashtable()
 {
-  if (!gFuncStringContentListHashTable.ops) {
+  if (!gFuncStringContentListHashTable.IsInitialized()) {
     return;
   }
 
@@ -1025,7 +1024,6 @@ nsCacheableFuncStringContentList::RemoveFromFuncStringHashtable()
 
   if (gFuncStringContentListHashTable.EntryCount() == 0) {
     PL_DHashTableFinish(&gFuncStringContentListHashTable);
-    gFuncStringContentListHashTable.ops = nullptr;
   }
 }
 

dom/base/nsContentUtils.cpp

@@ -344,7 +344,7 @@ public:
   {
     // We don't measure the |EventListenerManager| objects pointed to by the
     // entries because those references are non-owning.
-    int64_t amount = sEventListenerManagersHash.ops
+    int64_t amount = sEventListenerManagersHash.IsInitialized()
                    ? PL_DHashTableSizeOfExcludingThis(
                        &sEventListenerManagersHash, nullptr, MallocSizeOf)
                    : 0;
@@ -476,7 +476,7 @@ nsContentUtils::Init()
   if (!InitializeEventTable())
     return NS_ERROR_FAILURE;
 
-  if (!sEventListenerManagersHash.ops) {
+  if (!sEventListenerManagersHash.IsInitialized()) {
     static const PLDHashTableOps hash_table_ops =
     {
       PL_DHashVoidPtrKeyStub,
@@ -1761,7 +1761,7 @@ nsContentUtils::Shutdown()
   delete sUserDefinedEvents;
   sUserDefinedEvents = nullptr;
 
-  if (sEventListenerManagersHash.ops) {
+  if (sEventListenerManagersHash.IsInitialized()) {
     NS_ASSERTION(sEventListenerManagersHash.EntryCount() == 0,
                  "Event listener manager hash not empty at shutdown!");
 
@@ -1776,7 +1776,6 @@ nsContentUtils::Shutdown()
 
     if (sEventListenerManagersHash.EntryCount() == 0) {
       PL_DHashTableFinish(&sEventListenerManagersHash);
-      sEventListenerManagersHash.ops = nullptr;
     }
   }
 
@@ -3911,7 +3910,7 @@ ListenerEnumerator(PLDHashTable* aTable, PLDHashEntryHdr* aEntry,
 void
 nsContentUtils::UnmarkGrayJSListenersInCCGenerationDocuments(uint32_t aGeneration)
 {
-  if (sEventListenerManagersHash.ops) {
+  if (sEventListenerManagersHash.IsInitialized()) {
     PL_DHashTableEnumerate(&sEventListenerManagersHash, ListenerEnumerator,
                            &aGeneration);
   }
@@ -3922,7 +3921,7 @@ void
 nsContentUtils::TraverseListenerManager(nsINode *aNode,
                                         nsCycleCollectionTraversalCallback &cb)
 {
-  if (!sEventListenerManagersHash.ops) {
+  if (!sEventListenerManagersHash.IsInitialized()) {
     // We're already shut down, just return.
     return;
   }
@@ -3939,7 +3938,7 @@ nsContentUtils::TraverseListenerManager(nsINode *aNode,
 EventListenerManager*
 nsContentUtils::GetListenerManagerForNode(nsINode *aNode)
 {
-  if (!sEventListenerManagersHash.ops) {
+  if (!sEventListenerManagersHash.IsInitialized()) {
     // We're already shut down, don't bother creating an event listener
     // manager.
 
@@ -3970,7 +3969,7 @@ nsContentUtils::GetExistingListenerManagerForNode(const nsINode *aNode)
     return nullptr;
   }
   
-  if (!sEventListenerManagersHash.ops) {
+  if (!sEventListenerManagersHash.IsInitialized()) {
     // We're already shut down, don't bother creating an event listener
     // manager.
 
@@ -3991,7 +3990,7 @@ nsContentUtils::GetExistingListenerManagerForNode(const nsINode *aNode)
 void
 nsContentUtils::RemoveListenerManager(nsINode *aNode)
 {
-  if (sEventListenerManagersHash.ops) {
+  if (sEventListenerManagersHash.IsInitialized()) {
     EventListenerManagerMapEntry *entry =
       static_cast<EventListenerManagerMapEntry *>
                  (PL_DHashTableLookup(&sEventListenerManagersHash, aNode));

dom/base/nsDocument.cpp

@@ -2032,7 +2032,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
     tmp->mAnimationController->Traverse(&cb);
   }
 
-  if (tmp->mSubDocuments && tmp->mSubDocuments->ops) {
+  if (tmp->mSubDocuments && tmp->mSubDocuments->IsInitialized()) {
     PL_DHashTableEnumerate(tmp->mSubDocuments, SubDocTraverser, &cb);
   }
 

dom/base/nsFrameMessageManager.h

@@ -148,7 +148,8 @@ public:
   {
   }
 
-  bool ToObject(JSContext* aCx, JS::MutableHandle<JSObject*> aObjp);
+  virtual bool ToObject(JSContext* aCx, JS::MutableHandle<JSObject*> aObjp)
+    MOZ_OVERRIDE;
 
 private:
   JS::Rooted<JSObject*> mObj;

dom/base/nsJSEnvironment.h

@@ -192,7 +192,7 @@ public:
     : mReport(aReport)
   {}
 
-  NS_IMETHOD Run()
+  NS_IMETHOD Run() MOZ_OVERRIDE
   {
     mReport->LogToConsole();
     return NS_OK;

dom/base/nsPropertyTable.cpp

@@ -215,7 +215,7 @@ nsPropertyTable::SetPropertyInternal(nsPropertyOwner     aObject,
   } else {
     propertyList = new PropertyList(aPropertyName, aPropDtorFunc,
                                     aPropDtorData, aTransfer);
-    if (!propertyList || !propertyList->mObjectValueMap.ops) {
+    if (!propertyList || !propertyList->mObjectValueMap.IsInitialized()) {
       delete propertyList;
       return NS_ERROR_OUT_OF_MEMORY;
     }

dom/bluetooth/BluetoothCommon.h

@@ -53,8 +53,8 @@ extern bool gBluetoothDebugFlag;
     }                                                                \
   } while(0)
 
-#define BT_LOGR(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
+#define BT_LOGR(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__)
-#define BT_WARNING(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
+#define BT_WARNING(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__)
 #endif
 
 /**

dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp

@@ -5,6 +5,9 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "BluetoothDaemonInterface.h"
+#include <cutils/properties.h>
+#include <fcntl.h>
+#include <stdlib.h>
 #include "BluetoothDaemonA2dpInterface.h"
 #include "BluetoothDaemonAvrcpInterface.h"
 #include "BluetoothDaemonHandsfreeInterface.h"
@@ -12,7 +15,10 @@
 #include "BluetoothDaemonSetupInterface.h"
 #include "BluetoothDaemonSocketInterface.h"
 #include "BluetoothInterfaceHelpers.h"
+#include "mozilla/ipc/ListenSocket.h"
+#include "mozilla/ipc/UnixSocketConnector.h"
 #include "mozilla/unused.h"
+#include "prrng.h"
 
 using namespace mozilla::ipc;
 
@@ -1431,7 +1437,9 @@ class BluetoothDaemonProtocol MOZ_FINAL
   , public BluetoothDaemonAvrcpModule
 {
 public:
-  BluetoothDaemonProtocol(BluetoothDaemonConnection* aConnection);
+  BluetoothDaemonProtocol();
+
+  void SetConnection(BluetoothDaemonConnection* aConnection);
 
   nsresult RegisterModule(uint8_t aId, uint8_t aMode, uint32_t aMaxNumClients,
                           BluetoothSetupResultHandler* aRes) MOZ_OVERRIDE;
@@ -1471,11 +1479,13 @@ private:
   nsTArray<void*> mUserDataQ;
 };
 
-BluetoothDaemonProtocol::BluetoothDaemonProtocol(
+BluetoothDaemonProtocol::BluetoothDaemonProtocol()
-  BluetoothDaemonConnection* aConnection)
+{ }
-  : mConnection(aConnection)
+
+void
+BluetoothDaemonProtocol::SetConnection(BluetoothDaemonConnection* aConnection)
 {
-  MOZ_ASSERT(mConnection);
+  mConnection = aConnection;
 }
 
 nsresult
@@ -1497,6 +1507,7 @@ BluetoothDaemonProtocol::UnregisterModule(uint8_t aId,
 nsresult
 BluetoothDaemonProtocol::Send(BluetoothDaemonPDU* aPDU, void* aUserData)
 {
+  MOZ_ASSERT(mConnection);
   MOZ_ASSERT(aPDU);
 
   aPDU->SetUserData(aUserData);
@@ -1606,16 +1617,13 @@ BluetoothDaemonProtocol::FetchUserData(const BluetoothDaemonPDUHeader& aHeader)
 }
 
 //
-// Channels
+// Listen socket
 //
 
-class BluetoothDaemonChannel MOZ_FINAL : public BluetoothDaemonConnection
+class BluetoothDaemonListenSocket MOZ_FINAL : public ipc::ListenSocket
 {
 public:
-  BluetoothDaemonChannel(BluetoothDaemonInterface::Channel aChannel);
+  BluetoothDaemonListenSocket(BluetoothDaemonInterface* aInterface);
-
-  nsresult ConnectSocket(BluetoothDaemonInterface* aInterface,
-                         BluetoothDaemonPDUConsumer* aConsumer);
 
   // Connection state
   //
@@ -1624,28 +1632,80 @@ public:
   void OnConnectError() MOZ_OVERRIDE;
   void OnDisconnect() MOZ_OVERRIDE;
 
+private:
+  BluetoothDaemonInterface* mInterface;
+};
+
+BluetoothDaemonListenSocket::BluetoothDaemonListenSocket(
+  BluetoothDaemonInterface* aInterface)
+  : mInterface(aInterface)
+{ }
+
+void
+BluetoothDaemonListenSocket::OnConnectSuccess()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mInterface);
+
+  mInterface->OnConnectSuccess(BluetoothDaemonInterface::LISTEN_SOCKET);
+}
+
+void
+BluetoothDaemonListenSocket::OnConnectError()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mInterface);
+
+  mInterface->OnConnectError(BluetoothDaemonInterface::LISTEN_SOCKET);
+}
+
+void
+BluetoothDaemonListenSocket::OnDisconnect()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mInterface);
+
+  mInterface->OnDisconnect(BluetoothDaemonInterface::LISTEN_SOCKET);
+}
+
+//
+// Channels
+//
+
+class BluetoothDaemonChannel MOZ_FINAL : public BluetoothDaemonConnection
+{
+public:
+  BluetoothDaemonChannel(BluetoothDaemonInterface* aInterface,
+                         BluetoothDaemonInterface::Channel aChannel,
+                         BluetoothDaemonPDUConsumer* aConsumer);
+
+  // SocketBase
+  //
+
+  void OnConnectSuccess() MOZ_OVERRIDE;
+  void OnConnectError() MOZ_OVERRIDE;
+  void OnDisconnect() MOZ_OVERRIDE;
+
+  // ConnectionOrientedSocket
+  //
+
+  ConnectionOrientedSocketIO* GetIO() MOZ_OVERRIDE;
+
 private:
   BluetoothDaemonInterface* mInterface;
   BluetoothDaemonInterface::Channel mChannel;
+  BluetoothDaemonPDUConsumer* mConsumer;
 };
 
 BluetoothDaemonChannel::BluetoothDaemonChannel(
-  BluetoothDaemonInterface::Channel aChannel)
+  BluetoothDaemonInterface* aInterface,
-: mInterface(nullptr)
+  BluetoothDaemonInterface::Channel aChannel,
-, mChannel(aChannel)
+  BluetoothDaemonPDUConsumer* aConsumer)
+  : mInterface(aInterface)
+  , mChannel(aChannel)
+  , mConsumer(aConsumer)
 { }
 
-nsresult
-BluetoothDaemonChannel::ConnectSocket(BluetoothDaemonInterface* aInterface,
-                                      BluetoothDaemonPDUConsumer* aConsumer)
-{
-  MOZ_ASSERT(aInterface);
-
-  mInterface = aInterface;
-
-  return BluetoothDaemonConnection::ConnectSocket(aConsumer);
-}
-
 void
 BluetoothDaemonChannel::OnConnectSuccess()
 {
@@ -1662,7 +1722,6 @@ BluetoothDaemonChannel::OnConnectError()
   MOZ_ASSERT(mInterface);
 
   mInterface->OnConnectError(mChannel);
-  mInterface = nullptr;
 }
 
 void
@@ -1672,7 +1731,12 @@ BluetoothDaemonChannel::OnDisconnect()
   MOZ_ASSERT(mInterface);
 
   mInterface->OnDisconnect(mChannel);
-  mInterface = nullptr;
+}
+
+ConnectionOrientedSocketIO*
+BluetoothDaemonChannel::GetIO()
+{
+  return PrepareAccept(mConsumer);
 }
 
 //
@@ -1694,38 +1758,13 @@ BluetoothDaemonInterface::GetInstance()
     return sBluetoothInterface;
   }
 
-  // Only create channel objects here. The connection will be
+  sBluetoothInterface = new BluetoothDaemonInterface();
-  // established by |BluetoothDaemonInterface::Init|.
-
-  BluetoothDaemonChannel* cmdChannel =
-    new BluetoothDaemonChannel(BluetoothDaemonInterface::CMD_CHANNEL);
-
-  BluetoothDaemonChannel* ntfChannel =
-    new BluetoothDaemonChannel(BluetoothDaemonInterface::NTF_CHANNEL);
-
-  // Create a new interface object with the channels and a
-  // protocol handler.
-
-  sBluetoothInterface =
-    new BluetoothDaemonInterface(cmdChannel,
-                                 ntfChannel,
-                                 new BluetoothDaemonProtocol(cmdChannel));
 
   return sBluetoothInterface;
 }
 
-BluetoothDaemonInterface::BluetoothDaemonInterface(
+BluetoothDaemonInterface::BluetoothDaemonInterface()
-  BluetoothDaemonChannel* aCmdChannel,
+{ }
-  BluetoothDaemonChannel* aNtfChannel,
-  BluetoothDaemonProtocol* aProtocol)
-: mCmdChannel(aCmdChannel)
-, mNtfChannel(aNtfChannel)
-, mProtocol(aProtocol)
-{
-  MOZ_ASSERT(mCmdChannel);
-  MOZ_ASSERT(mNtfChannel);
-  MOZ_ASSERT(mProtocol);
-}
 
 BluetoothDaemonInterface::~BluetoothDaemonInterface()
 { }
@@ -1763,11 +1802,11 @@ public:
 
     if (!mRegisteredSocketModule) {
       mRegisteredSocketModule = true;
-      // Init, step 4: Register Socket module
+      // Init, step 5: Register Socket module
       mInterface->mProtocol->RegisterModuleCmd(0x02, 0x00,
         BluetoothDaemonSocketModule::MAX_NUM_CLIENTS, this);
     } else if (mRes) {
-      // Init, step 5: Signal success to caller
+      // Init, step 6: Signal success to caller
       mRes->Init();
     }
   }
@@ -1785,24 +1824,33 @@ BluetoothDaemonInterface::OnConnectSuccess(enum Channel aChannel)
   MOZ_ASSERT(!mResultHandlerQ.IsEmpty());
 
   switch (aChannel) {
-    case CMD_CHANNEL:
+    case LISTEN_SOCKET: {
-      // Init, step 2: Connect notification channel...
+        // Init, step 2: Start Bluetooth daemon */
-      if (mNtfChannel->GetConnectionStatus() != SOCKET_CONNECTED) {
+        nsCString value("bluetoothd:-a ");
-        nsresult rv = mNtfChannel->ConnectSocket(this, mProtocol);
+        value.Append(mListenSocketName);
-        if (NS_FAILED(rv)) {
+        if (NS_WARN_IF(property_set("ctl.start", value.get()) < 0)) {
           OnConnectError(CMD_CHANNEL);
         }
-      } else {
-        // ...or go to step 3 if channel is already connected.
-        OnConnectSuccess(NTF_CHANNEL);
       }
       break;
-
+    case CMD_CHANNEL:
+      // Init, step 3: Listen for notification channel...
+      if (!mNtfChannel) {
+        mNtfChannel = new BluetoothDaemonChannel(this, NTF_CHANNEL, mProtocol);
+      } else if (
+        NS_WARN_IF(mNtfChannel->GetConnectionStatus() == SOCKET_CONNECTED)) {
+        /* Notification channel should not be open; let's close it. */
+        mNtfChannel->CloseSocket();
+      }
+      if (!mListenSocket->Listen(mNtfChannel)) {
+        OnConnectError(NTF_CHANNEL);
+      }
+      break;
     case NTF_CHANNEL: {
         nsRefPtr<BluetoothResultHandler> res = mResultHandlerQ.ElementAt(0);
         mResultHandlerQ.RemoveElementAt(0);
 
-        // Init, step 3: Register Core module
+        // Init, step 4: Register Core module
         nsresult rv = mProtocol->RegisterModuleCmd(
           0x01, 0x00, BluetoothDaemonCoreModule::MAX_NUM_CLIENTS,
           new InitResultHandler(this, res));
@@ -1824,7 +1872,11 @@ BluetoothDaemonInterface::OnConnectError(enum Channel aChannel)
     case NTF_CHANNEL:
       // Close command channel
       mCmdChannel->CloseSocket();
-    case CMD_CHANNEL: {
+    case CMD_CHANNEL:
+      // Stop daemon and close listen socket
+      unused << NS_WARN_IF(property_set("ctl.stop", "bluetoothd"));
+      mListenSocket->Close();
+    case LISTEN_SOCKET: {
         // Signal error to caller
         nsRefPtr<BluetoothResultHandler> res = mResultHandlerQ.ElementAt(0);
         mResultHandlerQ.RemoveElementAt(0);
@@ -1844,11 +1896,15 @@ BluetoothDaemonInterface::OnDisconnect(enum Channel aChannel)
   MOZ_ASSERT(!mResultHandlerQ.IsEmpty());
 
   switch (aChannel) {
-    case NTF_CHANNEL:
+    case CMD_CHANNEL:
-      // Cleanup, step 4: Close command channel
+      // We don't have to do anything here. Step 4 is triggered
-      mCmdChannel->CloseSocket();
+      // by the daemon.
       break;
-    case CMD_CHANNEL: {
+    case NTF_CHANNEL:
+      // Cleanup, step 4: Close listen socket
+      mListenSocket->Close();
+      break;
+    case LISTEN_SOCKET: {
         nsRefPtr<BluetoothResultHandler> res = mResultHandlerQ.ElementAt(0);
         mResultHandlerQ.RemoveElementAt(0);
 
@@ -1861,25 +1917,207 @@ BluetoothDaemonInterface::OnDisconnect(enum Channel aChannel)
   }
 }
 
+class BluetoothDaemonSocketConnector MOZ_FINAL
+  : public mozilla::ipc::UnixSocketConnector
+{
+public:
+  BluetoothDaemonSocketConnector(const nsACString& aSocketName)
+    : mSocketName(aSocketName)
+  { }
+
+  int
+  Create() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    int fd = socket(AF_UNIX, SOCK_SEQPACKET, 0);
+    if (fd < 0) {
+      BT_WARNING("Could not open socket!");
+      return -1;
+    }
+    return fd;
+  }
+
+  bool
+  CreateAddr(bool aIsServer,
+             socklen_t& aAddrSize,
+             sockaddr_any& aAddr,
+             const char* aAddress) MOZ_OVERRIDE
+  {
+    static const size_t sNameOffset = 1;
+
+    size_t namesiz = mSocketName.Length() + 1; /* include trailing '\0' */
+
+    if ((sNameOffset + namesiz) > sizeof(aAddr.un.sun_path)) {
+      BT_WARNING("Address too long for socket struct!");
+      return false;
+    }
+
+    memset(aAddr.un.sun_path, '\0', sNameOffset); // abstract socket
+    memcpy(aAddr.un.sun_path + sNameOffset, mSocketName.get(), namesiz);
+    aAddr.un.sun_family = AF_UNIX;
+
+    aAddrSize = offsetof(struct sockaddr_un, sun_path) + sNameOffset + namesiz;
+
+    return true;
+  }
+
+  bool
+  SetUp(int aFd) MOZ_OVERRIDE
+  {
+    if (TEMP_FAILURE_RETRY(fcntl(aFd, F_SETFL, O_NONBLOCK)) < 0) {
+      BT_WARNING("Failed to set non-blocking I/O.");
+      return false;
+    }
+    return true;
+  }
+
+  bool
+  SetUpListenSocket(int aFd) MOZ_OVERRIDE
+  {
+    return true;
+  }
+
+  void
+  GetSocketAddr(const sockaddr_any& aAddr, nsAString& aAddrStr) MOZ_OVERRIDE
+  {
+    // Unused.
+    MOZ_CRASH("This should never be called!");
+  }
+
+private:
+  nsCString mSocketName;
+};
+
+nsresult
+BluetoothDaemonInterface::CreateRandomAddressString(
+  const nsACString& aPrefix, unsigned long aPostfixLength,
+  nsACString& aAddress)
+{
+  static const char sHexChar[16] = {
+    [0x0] = '0', [0x1] = '1', [0x2] = '2', [0x3] = '3',
+    [0x4] = '4', [0x5] = '5', [0x6] = '6', [0x7] = '7',
+    [0x8] = '8', [0x9] = '9', [0xa] = 'a', [0xb] = 'b',
+    [0xc] = 'c', [0xd] = 'd', [0xe] = 'e', [0xf] = 'f'
+  };
+
+  unsigned short seed[3];
+
+  if (NS_WARN_IF(!PR_GetRandomNoise(seed, sizeof(seed)))) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
+  aAddress = aPrefix;
+  aAddress.Append('-');
+
+  while (aPostfixLength) {
+
+    // Android doesn't provide rand_r, so we use nrand48 here,
+    // even though it's deprecated.
+    long value = nrand48(seed);
+
+    size_t bits = sizeof(value) * CHAR_BIT;
+
+    while ((bits > 4) && aPostfixLength) {
+      aAddress.Append(sHexChar[value&0xf]);
+      bits -= 4;
+      value >>= 4;
+      --aPostfixLength;
+    }
+  }
+
+  return NS_OK;
+}
+
+/*
+ * The init procedure consists of several steps.
+ *
+ *  (1) Start listening for the command channel's socket connection: We
+ *      do this before anything else, so that we don't miss connection
+ *      requests from the Bluetooth daemon. This step will create a
+ *      listen socket.
+ *
+ *  (2) Start the Bluetooth daemon: When the daemon starts up it will
+ *      open two socket connections to Gecko and thus create the command
+ *      and notification channels. Gecko already opened the listen socket
+ *      in step (1). Step (2) ends with the creation of the command channel.
+ *
+ *  (3) Start listening for the notification channel's socket connection:
+ *      At the end of step (2), the command channel was opened by the
+ *      daemon. In step (3), the daemon immediately tries to open the
+ *      next socket for the notification channel. Gecko will accept the
+ *      incoming connection request for the notification channel. The
+ *      listen socket remained open after step (2), so there's no race
+ *      condition between Gecko and the Bluetooth daemon.
+ *
+ *  (4)(5) Register Core and Socket modules: The Core and Socket modules
+ *      are always available and have to be registered after opening the
+ *      socket connections during the initialization.
+ *
+ *  (6) Signal success to the caller.
+ *
+ * If any step fails, we roll-back the procedure and signal an error to the
+ * caller.
+ */
 void
 BluetoothDaemonInterface::Init(
   BluetoothNotificationHandler* aNotificationHandler,
   BluetoothResultHandler* aRes)
 {
+  static const char BASE_SOCKET_NAME[] = "bluetoothd";
+  static unsigned long POSTFIX_LENGTH = 16;
+
+  // If we could not cleanup properly before and an old
+  // instance of the daemon is still running, we kill it
+  // here.
+  unused << NS_WARN_IF(property_set("ctl.stop", "bluetoothd"));
+
   sNotificationHandler = aNotificationHandler;
 
   mResultHandlerQ.AppendElement(aRes);
 
-  // Init, step 1: Connect command channel...
+  if (!mProtocol) {
-  if (mCmdChannel->GetConnectionStatus() != SOCKET_CONNECTED) {
+    mProtocol = new BluetoothDaemonProtocol();
-    nsresult rv = mCmdChannel->ConnectSocket(this, mProtocol);
-    if (NS_FAILED(rv)) {
-      OnConnectError(CMD_CHANNEL);
-    }
-  } else {
-    // ...or go to step 2 if channel is already connected.
-    OnConnectSuccess(CMD_CHANNEL);
   }
+
+  if (!mListenSocket) {
+    mListenSocket = new BluetoothDaemonListenSocket(this);
+  }
+
+  // Init, step 1: Listen for command channel... */
+
+  if (!mCmdChannel) {
+    mCmdChannel = new BluetoothDaemonChannel(this, CMD_CHANNEL, mProtocol);
+  } else if (
+    NS_WARN_IF(mCmdChannel->GetConnectionStatus() == SOCKET_CONNECTED)) {
+    // Command channel should not be open; let's close it.
+    mCmdChannel->CloseSocket();
+  }
+
+  // The listen socket's name is generated with a random postfix. This
+  // avoids naming collisions if we still have a listen socket from a
+  // previously failed cleanup. It also makes it hard for malicious
+  // external programs to capture the socket name or connect before
+  // the daemon can do so. If no random postfix can be generated, we
+  // simply use the base name as-is.
+  nsresult rv = CreateRandomAddressString(NS_LITERAL_CSTRING(BASE_SOCKET_NAME),
+                                          POSTFIX_LENGTH,
+                                          mListenSocketName);
+  if (NS_FAILED(rv)) {
+    mListenSocketName = BASE_SOCKET_NAME;
+  }
+
+  bool success = mListenSocket->Listen(
+    new BluetoothDaemonSocketConnector(mListenSocketName), mCmdChannel);
+  if (!success) {
+    OnConnectError(CMD_CHANNEL);
+    return;
+  }
+
+  // The protocol implementation needs a command channel for
+  // sending commands to the daemon. We set it here, because
+  // this is the earliest time when it's available.
+  mProtocol->SetConnection(mCmdChannel);
 }
 
 class BluetoothDaemonInterface::CleanupResultHandler MOZ_FINAL
@@ -1914,8 +2152,8 @@ private:
       // Cleanup, step 2: Unregister Core module
       mInterface->mProtocol->UnregisterModuleCmd(0x01, this);
     } else {
-      // Cleanup, step 3: Close notification channel
+      // Cleanup, step 3: Close command channel
-      mInterface->mNtfChannel->CloseSocket();
+      mInterface->mCmdChannel->CloseSocket();
     }
   }
 
@@ -1923,6 +2161,31 @@ private:
   bool mUnregisteredCoreModule;
 };
 
+/*
+ * Cleaning up is inverse to initialization, except for the shutdown
+ * of the socket connections in step (3)
+ *
+ *  (1)(2) Unregister Socket and Core modules: These modules have been
+ *      registered during initialization and need to be unregistered
+ *      here. We assume that all other modules are already unregistered.
+ *
+ *  (3) Close command socket: We only close the command socket. The
+ *      daemon will then send any final notifications and close the
+ *      notification socket on its side. Once we see the notification
+ *      socket's disconnect, we continue with the cleanup.
+ *
+ *  (4) Close listen socket: The listen socket is not active any longer
+ *      and we simply close it.
+ *
+ *  (5) Signal success to the caller.
+ *
+ * We don't have to stop the daemon explicitly. It will cleanup and quit
+ * after it closed the notification socket.
+ *
+ * Rolling-back half-completed cleanups is not possible. In the case of
+ * an error, we simply push forward and try to recover during the next
+ * initialization.
+ */
 void
 BluetoothDaemonInterface::Cleanup(BluetoothResultHandler* aRes)
 {

dom/bluetooth/bluedroid/BluetoothDaemonInterface.h

@@ -11,6 +11,7 @@
 
 BEGIN_BLUETOOTH_NAMESPACE
 
+class BluetoothDaemonListenSocket;
 class BluetoothDaemonChannel;
 class BluetoothDaemonA2dpInterface;
 class BluetoothDaemonAvrcpInterface;
@@ -24,6 +25,7 @@ public:
   class CleanupResultHandler;
   class InitResultHandler;
 
+  friend class BluetoothDaemonListenSocket;
   friend class BluetoothDaemonChannel;
   friend class CleanupResultHandler;
   friend class InitResultHandler;
@@ -115,24 +117,29 @@ public:
 
 protected:
   enum Channel {
+    LISTEN_SOCKET,
     CMD_CHANNEL,
     NTF_CHANNEL
   };
 
-  BluetoothDaemonInterface(BluetoothDaemonChannel* aCmdChannel,
+  BluetoothDaemonInterface();
-                           BluetoothDaemonChannel* aNtfChannel,
-                           BluetoothDaemonProtocol* aProtocol);
   ~BluetoothDaemonInterface();
 
   void OnConnectSuccess(enum Channel aChannel);
   void OnConnectError(enum Channel aChannel);
   void OnDisconnect(enum Channel aChannel);
 
+  nsresult CreateRandomAddressString(const nsACString& aPrefix,
+                                     unsigned long aPostfixLength,
+                                     nsACString& aAddress);
+
 private:
   void DispatchError(BluetoothResultHandler* aRes, BluetoothStatus aStatus);
 
-  nsAutoPtr<BluetoothDaemonChannel> mCmdChannel;
+  nsCString mListenSocketName;
-  nsAutoPtr<BluetoothDaemonChannel> mNtfChannel;
+  nsRefPtr<BluetoothDaemonListenSocket> mListenSocket;
+  nsRefPtr<BluetoothDaemonChannel> mCmdChannel;
+  nsRefPtr<BluetoothDaemonChannel> mNtfChannel;
   nsAutoPtr<BluetoothDaemonProtocol> mProtocol;
 
   nsTArray<nsRefPtr<BluetoothResultHandler> > mResultHandlerQ;

dom/bluetooth2/BluetoothCommon.h

@@ -66,8 +66,8 @@ extern bool gBluetoothDebugFlag;
     }                                                                \
   } while(0)
 
-#define BT_LOGR(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
+#define BT_LOGR(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__)
-#define BT_WARNING(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
+#define BT_WARNING(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__)
 #endif
 
 /**

dom/bluetooth2/BluetoothPairingListener.cpp

@@ -21,13 +21,11 @@ NS_IMPL_RELEASE_INHERITED(BluetoothPairingListener, DOMEventTargetHelper)
 
 BluetoothPairingListener::BluetoothPairingListener(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
+  , mHasListenedToSignal(false)
 {
   MOZ_ASSERT(aWindow);
 
-  BluetoothService* bs = BluetoothService::Get();
+  TryListeningToBluetoothSignal();
-  NS_ENSURE_TRUE_VOID(bs);
-  bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_PAIRING_LISTENER),
-                                     this);
 }
 
 already_AddRefed<BluetoothPairingListener>
@@ -134,3 +132,39 @@ BluetoothPairingListener::DisconnectFromOwner()
   bs->UnregisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_PAIRING_LISTENER),
                                        this);
 }
+
+void
+BluetoothPairingListener::EventListenerAdded(nsIAtom* aType)
+{
+  DOMEventTargetHelper::EventListenerAdded(aType);
+
+  TryListeningToBluetoothSignal();
+}
+
+void
+BluetoothPairingListener::TryListeningToBluetoothSignal()
+{
+  if (mHasListenedToSignal) {
+    // We've handled prior pending pairing requests
+    return;
+  }
+
+  // Listen to bluetooth signal only if all pairing event handlers have been
+  // attached. All pending pairing requests queued in BluetoothService would
+  // be fired when pairing listener starts listening to bluetooth signal.
+  if (!HasListenersFor(nsGkAtoms::ondisplaypasskeyreq) ||
+      !HasListenersFor(nsGkAtoms::onenterpincodereq) ||
+      !HasListenersFor(nsGkAtoms::onpairingconfirmationreq) ||
+      !HasListenersFor(nsGkAtoms::onpairingconsentreq)) {
+    BT_LOGR("Pairing listener is not ready to handle pairing requests!");
+    return;
+  }
+
+  // Start listening to bluetooth signal to handle pairing requests
+  BluetoothService* bs = BluetoothService::Get();
+  NS_ENSURE_TRUE_VOID(bs);
+  bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_PAIRING_LISTENER),
+                                     this);
+
+  mHasListenedToSignal = true;
+}

dom/bluetooth2/BluetoothPairingListener.h

@@ -38,6 +38,7 @@ public:
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   virtual void DisconnectFromOwner() MOZ_OVERRIDE;
+  virtual void EventListenerAdded(nsIAtom* aType) MOZ_OVERRIDE;
 
   IMPL_EVENT_HANDLER(displaypasskeyreq);
   IMPL_EVENT_HANDLER(enterpincodereq);
@@ -47,6 +48,21 @@ public:
 private:
   BluetoothPairingListener(nsPIDOMWindow* aWindow);
   ~BluetoothPairingListener();
+
+  /**
+   * Listen to bluetooth signal if all pairing event handlers are ready.
+   *
+   * Listen to bluetooth signal only if all pairing event handlers have been
+   * attached. All pending pairing requests queued in BluetoothService would be
+   * fired when pairing listener starts listening to bluetooth signal.
+   */
+  void TryListeningToBluetoothSignal();
+
+  /**
+   * Indicate whether or not this pairing listener has started listening to
+   * Bluetooth signal.
+   */
+  bool mHasListenedToSignal;
 };
 
 END_BLUETOOTH_NAMESPACE

dom/canvas/WebGLContextReporter.cpp

@@ -126,8 +126,10 @@ WebGLMemoryTracker::GetBufferCacheMemoryUsed()
              buffer;
              buffer = buffer->getNext())
         {
-            if (buffer->Target() == LOCAL_GL_ELEMENT_ARRAY_BUFFER)
+            if (buffer->HasEverBeenBound() &&
+                buffer->Target() == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
                 result += buffer->SizeOfIncludingThis(WebGLBufferMallocSizeOf);
+            }
         }
     }
     return result;

dom/html/nsGenericHTMLElement.h

@@ -317,25 +317,25 @@ public:
 
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
 
-  NS_IMETHOD GetTitle(nsAString& aTitle) MOZ_FINAL {
+  NS_IMETHOD GetTitle(nsAString& aTitle) MOZ_FINAL MOZ_OVERRIDE {
     nsString title;
     GetTitle(title);
     aTitle.Assign(title);
     return NS_OK;
   }
-  NS_IMETHOD GetLang(nsAString& aLang) MOZ_FINAL {
+  NS_IMETHOD GetLang(nsAString& aLang) MOZ_FINAL MOZ_OVERRIDE {
     nsString lang;
     GetLang(lang);
     aLang.Assign(lang);
     return NS_OK;
   }
-  NS_IMETHOD GetDir(nsAString& aDir) MOZ_FINAL {
+  NS_IMETHOD GetDir(nsAString& aDir) MOZ_FINAL MOZ_OVERRIDE {
     nsString dir;
     GetDir(dir);
     aDir.Assign(dir);
     return NS_OK;
   }
-  NS_IMETHOD SetDir(const nsAString& aDir) MOZ_FINAL {
+  NS_IMETHOD SetDir(const nsAString& aDir) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetDir(aDir, rv);
     return rv.ErrorCode();
@@ -348,131 +348,137 @@ public:
     SetClassName(aClassName);
     return NS_OK;
   }
-  NS_IMETHOD GetDataset(nsISupports** aDataset) MOZ_FINAL;
+  NS_IMETHOD GetDataset(nsISupports** aDataset) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetHidden(bool* aHidden) MOZ_FINAL {
+  NS_IMETHOD GetHidden(bool* aHidden) MOZ_FINAL MOZ_OVERRIDE {
     *aHidden = Hidden();
     return NS_OK;
   }
-  NS_IMETHOD SetHidden(bool aHidden) MOZ_FINAL {
+  NS_IMETHOD SetHidden(bool aHidden) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetHidden(aHidden, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD DOMBlur() MOZ_FINAL {
+  NS_IMETHOD DOMBlur() MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     Blur(rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetItemScope(bool* aItemScope) MOZ_FINAL {
+  NS_IMETHOD GetItemScope(bool* aItemScope) MOZ_FINAL MOZ_OVERRIDE {
     *aItemScope = ItemScope();
     return NS_OK;
   }
-  NS_IMETHOD SetItemScope(bool aItemScope) MOZ_FINAL {
+  NS_IMETHOD SetItemScope(bool aItemScope) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetItemScope(aItemScope, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetItemType(nsIVariant** aType) MOZ_FINAL {
+  NS_IMETHOD GetItemType(nsIVariant** aType) MOZ_FINAL MOZ_OVERRIDE {
     GetTokenList(nsGkAtoms::itemtype, aType);
     return NS_OK;
   }
-  NS_IMETHOD SetItemType(nsIVariant* aType) MOZ_FINAL {
+  NS_IMETHOD SetItemType(nsIVariant* aType) MOZ_FINAL MOZ_OVERRIDE {
     return SetTokenList(nsGkAtoms::itemtype, aType);
   }
-  NS_IMETHOD GetItemId(nsAString& aId) MOZ_FINAL {
+  NS_IMETHOD GetItemId(nsAString& aId) MOZ_FINAL MOZ_OVERRIDE {
     nsString id;
     GetItemId(id);
     aId.Assign(aId);
     return NS_OK;
   }
-  NS_IMETHOD SetItemId(const nsAString& aId) MOZ_FINAL {
+  NS_IMETHOD SetItemId(const nsAString& aId) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetItemId(aId, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetProperties(nsISupports** aReturn) MOZ_FINAL;
+  NS_IMETHOD GetProperties(nsISupports** aReturn) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetItemValue(nsIVariant** aValue) MOZ_FINAL;
+  NS_IMETHOD GetItemValue(nsIVariant** aValue) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD SetItemValue(nsIVariant* aValue) MOZ_FINAL;
+  NS_IMETHOD SetItemValue(nsIVariant* aValue) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD GetItemRef(nsIVariant** aRef) MOZ_FINAL {
+  NS_IMETHOD GetItemRef(nsIVariant** aRef) MOZ_FINAL MOZ_OVERRIDE {
     GetTokenList(nsGkAtoms::itemref, aRef);
     return NS_OK;
   }
-  NS_IMETHOD SetItemRef(nsIVariant* aRef) MOZ_FINAL {
+  NS_IMETHOD SetItemRef(nsIVariant* aRef) MOZ_FINAL MOZ_OVERRIDE {
     return SetTokenList(nsGkAtoms::itemref, aRef);
   }
-  NS_IMETHOD GetItemProp(nsIVariant** aProp) MOZ_FINAL {
+  NS_IMETHOD GetItemProp(nsIVariant** aProp) MOZ_FINAL MOZ_OVERRIDE {
     GetTokenList(nsGkAtoms::itemprop, aProp);
     return NS_OK;
   }
-  NS_IMETHOD SetItemProp(nsIVariant* aProp) MOZ_FINAL {
+  NS_IMETHOD SetItemProp(nsIVariant* aProp) MOZ_FINAL MOZ_OVERRIDE {
     return SetTokenList(nsGkAtoms::itemprop, aProp);
   }
-  NS_IMETHOD GetAccessKey(nsAString& aAccessKey) MOZ_FINAL {
+  NS_IMETHOD GetAccessKey(nsAString& aAccessKey) MOZ_FINAL MOZ_OVERRIDE {
     nsString accessKey;
     GetAccessKey(accessKey);
     aAccessKey.Assign(accessKey);
     return NS_OK;
   }
-  NS_IMETHOD SetAccessKey(const nsAString& aAccessKey) MOZ_FINAL {
+  NS_IMETHOD SetAccessKey(const nsAString& aAccessKey) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetAccessKey(aAccessKey, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetAccessKeyLabel(nsAString& aAccessKeyLabel) MOZ_FINAL {
+  NS_IMETHOD GetAccessKeyLabel(nsAString& aAccessKeyLabel)
+    MOZ_FINAL MOZ_OVERRIDE {
     nsString accessKeyLabel;
     GetAccessKeyLabel(accessKeyLabel);
     aAccessKeyLabel.Assign(accessKeyLabel);
     return NS_OK;
   }
-  NS_IMETHOD SetDraggable(bool aDraggable) MOZ_FINAL {
+  NS_IMETHOD SetDraggable(bool aDraggable) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetDraggable(aDraggable, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetContentEditable(nsAString& aContentEditable) MOZ_FINAL {
+  NS_IMETHOD GetContentEditable(nsAString& aContentEditable)
+    MOZ_FINAL MOZ_OVERRIDE {
     nsString contentEditable;
     GetContentEditable(contentEditable);
     aContentEditable.Assign(contentEditable);
     return NS_OK;
   }
-  NS_IMETHOD SetContentEditable(const nsAString& aContentEditable) MOZ_FINAL {
+  NS_IMETHOD SetContentEditable(const nsAString& aContentEditable)
+    MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetContentEditable(aContentEditable, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetIsContentEditable(bool* aIsContentEditable) MOZ_FINAL {
+  NS_IMETHOD GetIsContentEditable(bool* aIsContentEditable)
+    MOZ_FINAL MOZ_OVERRIDE {
     *aIsContentEditable = IsContentEditable();
     return NS_OK;
   }
-  NS_IMETHOD GetContextMenu(nsIDOMHTMLMenuElement** aContextMenu) MOZ_FINAL;
+  NS_IMETHOD GetContextMenu(nsIDOMHTMLMenuElement** aContextMenu)
-  NS_IMETHOD GetSpellcheck(bool* aSpellcheck) MOZ_FINAL {
+    MOZ_FINAL MOZ_OVERRIDE;
+  NS_IMETHOD GetSpellcheck(bool* aSpellcheck) MOZ_FINAL MOZ_OVERRIDE {
     *aSpellcheck = Spellcheck();
     return NS_OK;
   }
-  NS_IMETHOD SetSpellcheck(bool aSpellcheck) MOZ_FINAL {
+  NS_IMETHOD SetSpellcheck(bool aSpellcheck) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetSpellcheck(aSpellcheck, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetOuterHTML(nsAString& aOuterHTML) MOZ_FINAL {
+  NS_IMETHOD GetOuterHTML(nsAString& aOuterHTML) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::dom::Element::GetOuterHTML(aOuterHTML);
     return NS_OK;
   }
-  NS_IMETHOD SetOuterHTML(const nsAString& aOuterHTML) MOZ_FINAL {
+  NS_IMETHOD SetOuterHTML(const nsAString& aOuterHTML) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     mozilla::dom::Element::SetOuterHTML(aOuterHTML, rv);
     return rv.ErrorCode();
   }                                                                            \
   NS_IMETHOD InsertAdjacentHTML(const nsAString& position,
-                                const nsAString& text) MOZ_FINAL;
+                                const nsAString& text) MOZ_FINAL MOZ_OVERRIDE;
-  NS_IMETHOD ScrollIntoView(bool top, uint8_t _argc) MOZ_FINAL {
+  NS_IMETHOD ScrollIntoView(bool top, uint8_t _argc) MOZ_FINAL MOZ_OVERRIDE {
     if (!_argc) {
       top = true;
     }
     mozilla::dom::Element::ScrollIntoView(top);
     return NS_OK;
   }
-  NS_IMETHOD GetOffsetParent(nsIDOMElement** aOffsetParent) MOZ_FINAL {
+  NS_IMETHOD GetOffsetParent(nsIDOMElement** aOffsetParent)
+    MOZ_FINAL MOZ_OVERRIDE {
     mozilla::dom::Element* offsetParent = GetOffsetParent();
     if (!offsetParent) {
       *aOffsetParent = nullptr;
@@ -480,41 +486,41 @@ public:
     }
     return CallQueryInterface(offsetParent, aOffsetParent);
   }
-  NS_IMETHOD GetOffsetTop(int32_t* aOffsetTop) MOZ_FINAL {
+  NS_IMETHOD GetOffsetTop(int32_t* aOffsetTop) MOZ_FINAL MOZ_OVERRIDE {
     *aOffsetTop = OffsetTop();
     return NS_OK;
   }
-  NS_IMETHOD GetOffsetLeft(int32_t* aOffsetLeft) MOZ_FINAL {
+  NS_IMETHOD GetOffsetLeft(int32_t* aOffsetLeft) MOZ_FINAL MOZ_OVERRIDE {
     *aOffsetLeft = OffsetLeft();
     return NS_OK;
   }
-  NS_IMETHOD GetOffsetWidth(int32_t* aOffsetWidth) MOZ_FINAL {
+  NS_IMETHOD GetOffsetWidth(int32_t* aOffsetWidth) MOZ_FINAL MOZ_OVERRIDE {
     *aOffsetWidth = OffsetWidth();
     return NS_OK;
   }
-  NS_IMETHOD GetOffsetHeight(int32_t* aOffsetHeight) MOZ_FINAL {
+  NS_IMETHOD GetOffsetHeight(int32_t* aOffsetHeight) MOZ_FINAL MOZ_OVERRIDE {
     *aOffsetHeight = OffsetHeight();
     return NS_OK;
   }
-  NS_IMETHOD DOMClick() MOZ_FINAL {
+  NS_IMETHOD DOMClick() MOZ_FINAL MOZ_OVERRIDE {
     Click();
     return NS_OK;
   }
-  NS_IMETHOD GetTabIndex(int32_t* aTabIndex) MOZ_FINAL {
+  NS_IMETHOD GetTabIndex(int32_t* aTabIndex) MOZ_FINAL MOZ_OVERRIDE {
     *aTabIndex = TabIndex();
     return NS_OK;
   }
-  NS_IMETHOD SetTabIndex(int32_t aTabIndex) MOZ_FINAL {
+  NS_IMETHOD SetTabIndex(int32_t aTabIndex) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetTabIndex(aTabIndex, rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD Focus() MOZ_FINAL {
+  NS_IMETHOD Focus() MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     Focus(rv);
     return rv.ErrorCode();
   }
-  NS_IMETHOD GetDraggable(bool* aDraggable) MOZ_FINAL {
+  NS_IMETHOD GetDraggable(bool* aDraggable) MOZ_FINAL MOZ_OVERRIDE {
     *aDraggable = Draggable();
     return NS_OK;
   }
@@ -522,7 +528,7 @@ public:
     return mozilla::dom::Element::GetInnerHTML(aInnerHTML);
   }
   using mozilla::dom::Element::SetInnerHTML;
-  NS_IMETHOD SetInnerHTML(const nsAString& aInnerHTML) MOZ_FINAL {
+  NS_IMETHOD SetInnerHTML(const nsAString& aInnerHTML) MOZ_FINAL MOZ_OVERRIDE {
     mozilla::ErrorResult rv;
     SetInnerHTML(aInnerHTML, rv);
     return rv.ErrorCode();

dom/media/fmp4/MP4Reader.cpp

@@ -107,7 +107,6 @@ InvokeAndRetry(ThisType* aThisVal, ReturnType(ThisType::*aMethod)(), MP4Stream*
   }
 }
 
-
 MP4Reader::MP4Reader(AbstractMediaDecoder* aDecoder)
   : MediaDecoderReader(aDecoder)
   , mAudio(MediaData::AUDIO_DATA, Preferences::GetUint("media.mp4-audio-decode-ahead", 2))
@@ -196,6 +195,7 @@ MP4Reader::InitLayersBackendType()
 }
 
 static bool sIsEMEEnabled = false;
+static bool sDemuxSkipToNextKeyframe = true;
 
 nsresult
 MP4Reader::Init(MediaDecoderReader* aCloneDonor)
@@ -217,6 +217,7 @@ MP4Reader::Init(MediaDecoderReader* aCloneDonor)
   if (!sSetupPrefCache) {
     sSetupPrefCache = true;
     Preferences::AddBoolVarCache(&sIsEMEEnabled, "media.eme.enabled", false);
+    Preferences::AddBoolVarCache(&sDemuxSkipToNextKeyframe, "media.fmp4.demux-skip", true);
   }
 
   return NS_OK;
@@ -519,6 +520,29 @@ MP4Reader::GetDecoderData(TrackType aTrack)
   return mVideo;
 }
 
+Microseconds
+MP4Reader::GetNextKeyframeTime()
+{
+  MonitorAutoLock mon(mDemuxerMonitor);
+  return mDemuxer->GetNextKeyframeTime();
+}
+
+bool
+MP4Reader::ShouldSkip(bool aSkipToNextKeyframe, int64_t aTimeThreshold)
+{
+  // The MP4Reader doesn't do normal skip-to-next-keyframe if the demuxer
+  // has exposes where the next keyframe is. We can then instead skip only
+  // if the time threshold (the current playback position) is after the next
+  // keyframe in the stream. This means we'll only skip frames that we have
+  // no hope of ever playing.
+  Microseconds nextKeyframe = -1;
+  if (!sDemuxSkipToNextKeyframe ||
+      (nextKeyframe = GetNextKeyframeTime()) == -1) {
+    return aSkipToNextKeyframe;
+  }
+  return nextKeyframe < aTimeThreshold;
+}
+
 nsRefPtr<MediaDecoderReader::VideoDataPromise>
 MP4Reader::RequestVideoData(bool aSkipToNextKeyframe,
                             int64_t aTimeThreshold)
@@ -537,7 +561,7 @@ MP4Reader::RequestVideoData(bool aSkipToNextKeyframe,
   MOZ_ASSERT(HasVideo() && mPlatform && mVideo.mDecoder);
 
   bool eos = false;
-  if (aSkipToNextKeyframe) {
+  if (ShouldSkip(aSkipToNextKeyframe, aTimeThreshold)) {
     uint32_t parsed = 0;
     eos = !SkipVideoDemuxToNextKeyFrame(aTimeThreshold, parsed);
     if (!eos && NS_FAILED(mVideo.mDecoder->Flush())) {

dom/media/fmp4/MP4Reader.h

@@ -121,6 +121,9 @@ private:
   bool IsWaitingOnCodecResource();
   virtual bool IsWaitingOnCDMResource() MOZ_OVERRIDE;
 
+  Microseconds GetNextKeyframeTime();
+  bool ShouldSkip(bool aSkipToNextKeyframe, int64_t aTimeThreshold);
+
   size_t SizeOfQueue(TrackType aTrack);
 
   nsRefPtr<MP4Stream> mStream;

dom/media/fmp4/apple/AppleVDADecoder.cpp

@@ -356,10 +356,6 @@ AppleVDADecoder::SubmitFrame(mp4_demuxer::MP4Sample* aSample)
                                  block,
                                  frameInfo);
 
-  LOG("[%s]: FrameInfo retain count = %ld",
-      __func__, CFGetRetainCount(frameInfo));
-  MOZ_ASSERT(CFGetRetainCount(frameInfo) >= 2, "Bad retain count");
-
   if (rv != noErr) {
     NS_WARNING("AppleVDADecoder: Couldn't pass frame to decoder");
     return NS_ERROR_FAILURE;

dom/media/fmp4/wmf/MFTDecoder.cpp

@@ -48,9 +48,9 @@ MFTDecoder::Create(const GUID& aMFTClsID)
 
 HRESULT
 MFTDecoder::SetMediaTypes(IMFMediaType* aInputType,
-                          const GUID& aOutputSubType)
+                          IMFMediaType* aOutputType)
 {
-  mOutputSubtype = aOutputSubType;
+  mOutputType = aOutputType;
 
   // Set the input type to the one the caller gave us...
   HRESULT hr = mDecoder->SetInputType(0, aInputType, 0);
@@ -96,21 +96,14 @@ MFTDecoder::SetDecoderOutputType()
   RefPtr<IMFMediaType> outputType;
   UINT32 typeIndex = 0;
   while (SUCCEEDED(mDecoder->GetOutputAvailableType(0, typeIndex++, byRef(outputType)))) {
-    GUID subtype;
+    BOOL resultMatch;
-    hr = outputType->GetGUID(MF_MT_SUBTYPE, &subtype);
+    hr = mOutputType->Compare(outputType, MF_ATTRIBUTES_MATCH_OUR_ITEMS, &resultMatch);
-    if (FAILED(hr)) {
+    if (SUCCEEDED(hr) && resultMatch == TRUE) {
-      continue;
-    }
-    if (subtype == mOutputSubtype) {
-      if (subtype == MFAudioFormat_PCM) {
-        // Set output to PCM 16 bits, we can ignore errors.
-        outputType->SetUINT32(MF_MT_SAMPLE_SIZE, 2);
-        outputType->SetUINT32(MF_MT_AUDIO_BITS_PER_SAMPLE, 16);
-      }
       hr = mDecoder->SetOutputType(0, outputType, 0);
       NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
       return S_OK;
     }
+    outputType = nullptr;
   }
   return E_FAIL;
 }

dom/media/fmp4/wmf/MFTDecoder.h

@@ -33,11 +33,11 @@ public:
   //
   // Params:
   //  - aInputType needs at least major and minor types set.
-  //  - aOutputSubType is the minor type of the same major type e.g.
+  //  - aOutputType needs at least major and minor types set.
-  //    MFVideoFormat_H264. This is used to select the output type out
+  //    This is used to select the matching output type out
   //    of all the available output types of the MFT.
   HRESULT SetMediaTypes(IMFMediaType* aInputType,
-                        const GUID& aOutputSubType);
+                        IMFMediaType* aOutputType);
 
   // Returns the MFT's IMFAttributes object.
   TemporaryRef<IMFAttributes> GetAttributes();
@@ -92,7 +92,7 @@ private:
 
   RefPtr<IMFTransform> mDecoder;
 
-  GUID mOutputSubtype;
+  RefPtr<IMFMediaType> mOutputType;
 
   // True if the IMFTransform allocates the samples that it returns.
   bool mMFTProvidesOutputSamples;

dom/media/fmp4/wmf/WMFAudioMFTManager.cpp

@@ -128,34 +128,47 @@ WMFAudioMFTManager::Init()
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
   // Setup input/output media types
-  RefPtr<IMFMediaType> type;
+  RefPtr<IMFMediaType> inputType;
 
-  hr = wmf::MFCreateMediaType(byRef(type));
+  hr = wmf::MFCreateMediaType(byRef(inputType));
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Audio);
+  hr = inputType->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Audio);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetGUID(MF_MT_SUBTYPE, GetMediaSubtypeGUID());
+  hr = inputType->SetGUID(MF_MT_SUBTYPE, GetMediaSubtypeGUID());
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetUINT32(MF_MT_AUDIO_SAMPLES_PER_SECOND, mAudioRate);
+  hr = inputType->SetUINT32(MF_MT_AUDIO_SAMPLES_PER_SECOND, mAudioRate);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetUINT32(MF_MT_AUDIO_NUM_CHANNELS, mAudioChannels);
+  hr = inputType->SetUINT32(MF_MT_AUDIO_NUM_CHANNELS, mAudioChannels);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
   if (mStreamType == AAC) {
-    hr = type->SetUINT32(MF_MT_AAC_PAYLOAD_TYPE, 0x0); // Raw AAC packet
+    hr = inputType->SetUINT32(MF_MT_AAC_PAYLOAD_TYPE, 0x0); // Raw AAC packet
     NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-    hr = type->SetBlob(MF_MT_USER_DATA,
+    hr = inputType->SetBlob(MF_MT_USER_DATA,
-                       mUserData.Elements(),
+                            mUserData.Elements(),
-                       mUserData.Length());
+                            mUserData.Length());
     NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
   }
 
-  hr = decoder->SetMediaTypes(type, MFAudioFormat_PCM);
+  RefPtr<IMFMediaType> outputType;
+  hr = wmf::MFCreateMediaType(byRef(outputType));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = outputType->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Audio);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = outputType->SetGUID(MF_MT_SUBTYPE, MFAudioFormat_PCM);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = outputType->SetUINT32(MF_MT_AUDIO_BITS_PER_SAMPLE, 16);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = decoder->SetMediaTypes(inputType, outputType);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
   mDecoder = decoder;

dom/media/fmp4/wmf/WMFVideoMFTManager.cpp

@@ -188,21 +188,31 @@ WMFVideoMFTManager::Init()
   }
 
   // Setup the input/output media types.
-  RefPtr<IMFMediaType> type;
+  RefPtr<IMFMediaType> inputType;
-  hr = wmf::MFCreateMediaType(byRef(type));
+  hr = wmf::MFCreateMediaType(byRef(inputType));
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
+  hr = inputType->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetGUID(MF_MT_SUBTYPE, GetMediaSubtypeGUID());
+  hr = inputType->SetGUID(MF_MT_SUBTYPE, GetMediaSubtypeGUID());
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  hr = type->SetUINT32(MF_MT_INTERLACE_MODE, MFVideoInterlace_MixedInterlaceOrProgressive);
+  hr = inputType->SetUINT32(MF_MT_INTERLACE_MODE, MFVideoInterlace_MixedInterlaceOrProgressive);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
-  GUID outputType = mUseHwAccel ? MFVideoFormat_NV12 : MFVideoFormat_YV12;
+  RefPtr<IMFMediaType> outputType;
-  hr = decoder->SetMediaTypes(type, outputType);
+  hr = wmf::MFCreateMediaType(byRef(outputType));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = outputType->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  GUID outputSubType = mUseHwAccel ? MFVideoFormat_NV12 : MFVideoFormat_YV12;
+  hr = outputType->SetGUID(MF_MT_SUBTYPE, outputSubType);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+
+  hr = decoder->SetMediaTypes(inputType, outputType);
   NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
 
   mDecoder = decoder;

dom/plugins/base/nsJSNPRuntime.cpp

@@ -402,7 +402,7 @@ DestroyJSObjWrapperTable()
 static bool
 CreateNPObjWrapperTable()
 {
-  MOZ_ASSERT(!sNPObjWrappers.ops);
+  MOZ_ASSERT(!sNPObjWrappers.IsInitialized());
 
   if (!RegisterGCCallbacks()) {
     return false;
@@ -419,8 +419,6 @@ DestroyNPObjWrapperTable()
   MOZ_ASSERT(sNPObjWrappers.EntryCount() == 0);
 
   PL_DHashTableFinish(&sNPObjWrappers);
-
-  sNPObjWrappers.ops = nullptr;
 }
 
 static void
@@ -439,7 +437,7 @@ OnWrapperDestroyed()
       DestroyJSObjWrapperTable();
     }
 
-    if (sNPObjWrappers.ops) {
+    if (sNPObjWrappers.IsInitialized()) {
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
       DestroyNPObjWrapperTable();
@@ -1749,7 +1747,7 @@ NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj)
 {
   NPObject *npobj = (NPObject *)::JS_GetPrivate(obj);
   if (npobj) {
-    if (sNPObjWrappers.ops) {
+    if (sNPObjWrappers.IsInitialized()) {
       PL_DHashTableRemove(&sNPObjWrappers, npobj);
     }
   }
@@ -1765,7 +1763,7 @@ NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old)
   // The wrapper JSObject has been moved, so we need to update the entry in the
   // sNPObjWrappers hash table, if present.
 
-  if (!sNPObjWrappers.ops) {
+  if (!sNPObjWrappers.IsInitialized()) {
     return;
   }
 
@@ -1824,7 +1822,7 @@ nsNPObjWrapper::OnDestroy(NPObject *npobj)
     return;
   }
 
-  if (!sNPObjWrappers.ops) {
+  if (!sNPObjWrappers.IsInitialized()) {
     // No hash yet (or any more), no used wrappers available.
 
     return;
@@ -1874,7 +1872,7 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
     return nullptr;
   }
 
-  if (!sNPObjWrappers.ops) {
+  if (!sNPObjWrappers.IsInitialized()) {
     // No hash yet (or any more), initialize it.
     if (!CreateNPObjWrapperTable()) {
       return nullptr;
@@ -1960,8 +1958,8 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
   if (entry->mNpp == nppcx->npp) {
     // Prevent invalidate() and deallocate() from touching the hash
     // we're enumerating.
-    const PLDHashTableOps *ops = table->ops;
+    const PLDHashTableOps *ops = table->Ops();
-    table->ops = nullptr;
+    table->SetOps(nullptr);
 
     NPObject *npobj = entry->mNPObj;
 
@@ -1989,7 +1987,7 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 
     ::JS_SetPrivate(entry->mJSObj, nullptr);
 
-    table->ops = ops;
+    table->SetOps(ops);
 
     if (sDelayedReleases && sDelayedReleases->RemoveElement(npobj)) {
       OnWrapperDestroyed();
@@ -2030,7 +2028,7 @@ nsJSNPRuntime::OnPluginDestroy(NPP npp)
   // Use the safe JSContext here as we're not always able to find the
   // JSContext associated with the NPP any more.
   AutoSafeJSContext cx;
-  if (sNPObjWrappers.ops) {
+  if (sNPObjWrappers.IsInitialized()) {
     NppAndCx nppcx = { npp, cx };
     PL_DHashTableEnumerate(&sNPObjWrappers,
                            NPObjWrapperPluginDestroyedCallback, &nppcx);

dom/xul/templates/nsContentSupportMap.cpp

@@ -15,14 +15,14 @@ nsContentSupportMap::Init()
 void
 nsContentSupportMap::Finish()
 {
-    if (mMap.ops)
+    if (mMap.IsInitialized())
         PL_DHashTableFinish(&mMap);
 }
 
 nsresult
 nsContentSupportMap::Remove(nsIContent* aElement)
 {
-    if (!mMap.ops)
+    if (!mMap.IsInitialized())
         return NS_ERROR_NOT_INITIALIZED;
 
     nsIContent* child = aElement;

dom/xul/templates/nsContentSupportMap.h

@@ -25,7 +25,7 @@ public:
     ~nsContentSupportMap() { Finish(); }
 
     nsresult Put(nsIContent* aElement, nsTemplateMatch* aMatch) {
-        if (!mMap.ops)
+        if (!mMap.IsInitialized())
             return NS_ERROR_NOT_INITIALIZED;
 
         PLDHashEntryHdr* hdr = PL_DHashTableAdd(&mMap, aElement);
@@ -39,7 +39,7 @@ public:
         return NS_OK; }
 
     bool Get(nsIContent* aElement, nsTemplateMatch** aMatch) {
-        if (!mMap.ops)
+        if (!mMap.IsInitialized())
             return false;
 
         PLDHashEntryHdr* hdr = PL_DHashTableLookup(&mMap, aElement);

gfx/2d/DrawTargetD2D1.cpp

@@ -859,7 +859,12 @@ DrawTargetD2D1::factory()
     return mFactory;
   }
 
-  HRESULT hr = D2DFactory()->QueryInterface((ID2D1Factory1**)&mFactory);
+  ID2D1Factory* d2dFactory = D2DFactory();
+  if (!d2dFactory) {
+    return nullptr;
+  }
+
+  HRESULT hr = d2dFactory->QueryInterface((ID2D1Factory1**)&mFactory);
 
   if (FAILED(hr)) {
     return nullptr;

gfx/layers/apz/src/APZCTreeManager.cpp

@@ -649,9 +649,6 @@ APZCTreeManager::ReceiveInputEvent(InputData& aEvent,
       break;
     }
   }
-  if (hitResult == HitOverscrolledApzc) {
-    result = nsEventStatus_eConsumeNoDefault;
-  }
   return result;
 }
 
@@ -772,9 +769,6 @@ APZCTreeManager::ProcessTouchInput(MultiTouchInput& aInput,
           outTransform, touchData.mScreenPoint);
     }
   }
-  if (mHitResultForInputBlock == HitOverscrolledApzc) {
-    result = nsEventStatus_eConsumeNoDefault;
-  }
 
   if (aInput.mType == MultiTouchInput::MULTITOUCH_END) {
     if (mTouchCount >= aInput.mTouches.Length()) {
@@ -834,9 +828,6 @@ APZCTreeManager::ProcessEvent(WidgetInputEvent& aEvent,
     Matrix4x4 outTransform = transformToApzc * transformToGecko;
     aEvent.refPoint = TransformTo<LayoutDevicePixel>(outTransform, aEvent.refPoint);
   }
-  if (hitResult == HitOverscrolledApzc) {
-    result = nsEventStatus_eConsumeNoDefault;
-  }
   return result;
 }
 
@@ -1195,8 +1186,6 @@ APZCTreeManager::GetTargetAPZC(const ScreenPoint& aPoint, HitTestResult* aOutHit
     PixelCastJustification::ScreenIsParentLayerForRoot);
   nsRefPtr<AsyncPanZoomController> target = GetAPZCAtPoint(mRootNode, point, &hitResult);
 
-  // If we are in an overscrolled APZC, we should be returning nullptr.
-  MOZ_ASSERT(!(target && (hitResult == HitOverscrolledApzc)));
   if (aOutHitResult) {
     *aOutHitResult = hitResult;
   }
@@ -1322,8 +1311,6 @@ APZCTreeManager::GetAPZCAtPoint(HitTestingTreeNode* aNode,
   // This walks the tree in depth-first, reverse order, so that it encounters
   // APZCs front-to-back on the screen.
   for (HitTestingTreeNode* node = aNode; node; node = node->GetPrevSibling()) {
-    AsyncPanZoomController* apzc = node->GetApzc();
-
     if (node->IsOutsideClip(aHitTestPoint)) {
       // If the point being tested is outside the clip region for this node
       // then we don't need to test against this node or any of its children.
@@ -1342,10 +1329,6 @@ APZCTreeManager::GetAPZCAtPoint(HitTestingTreeNode* aNode,
       ParentLayerPoint childPoint = ViewAs<ParentLayerPixel>(hitTestPointForChildLayers.ref(),
         PixelCastJustification::MovingDownToChildren);
       result = GetAPZCAtPoint(node->GetLastChild(), childPoint, aOutHitResult);
-      if (*aOutHitResult == HitOverscrolledApzc) {
-        // We matched an overscrolled APZC, abort.
-        return nullptr;
-      }
     }
 
     // If we didn't match anything in the subtree, check |node|.
@@ -1365,15 +1348,6 @@ APZCTreeManager::GetAPZCAtPoint(HitTestingTreeNode* aNode,
       }
     }
 
-    // If we are overscrolled, and the point matches us or one of our children,
-    // the result is inside an overscrolled APZC, inform our caller of this
-    // (callers typically ignore events targeted at overscrolled APZCs).
-    if (*aOutHitResult != HitNothing && apzc && apzc->IsOverscrolled()) {
-      APZCTM_LOG("Result is inside overscrolled APZC %p\n", apzc);
-      *aOutHitResult = HitOverscrolledApzc;
-      return nullptr;
-    }
-
     if (*aOutHitResult != HitNothing) {
       if (result && !gfxPrefs::LayoutEventRegionsEnabled()) {
         // When event-regions are disabled, we treat scrollinfo layers as
@@ -1523,7 +1497,7 @@ APZCTreeManager::GetScreenToApzcTransform(const AsyncPanZoomController *aApzc) c
     // ancestorUntransform is updated to RC.Inverse() * QC.Inverse() when parent == P
     ancestorUntransform = parent->GetAncestorTransform().Inverse();
     // asyncUntransform is updated to PA.Inverse() when parent == P
-    Matrix4x4 asyncUntransform = Matrix4x4(parent->GetCurrentAsyncTransform()).Inverse();
+    Matrix4x4 asyncUntransform = parent->GetCurrentAsyncTransformWithOverscroll().Inverse();
     // untransformSinceLastApzc is RC.Inverse() * QC.Inverse() * PA.Inverse()
     Matrix4x4 untransformSinceLastApzc = ancestorUntransform * asyncUntransform;
 
@@ -1555,7 +1529,7 @@ APZCTreeManager::GetApzcToGeckoTransform(const AsyncPanZoomController *aApzc) co
   // leftmost matrix in a multiplication is applied first.
 
   // asyncUntransform is LA.Inverse()
-  Matrix4x4 asyncUntransform = Matrix4x4(aApzc->GetCurrentAsyncTransform()).Inverse();
+  Matrix4x4 asyncUntransform = aApzc->GetCurrentAsyncTransformWithOverscroll().Inverse();
 
   // aTransformToGeckoOut is initialized to LA.Inverse() * LD * MC * NC * OC * PC
   result = asyncUntransform * aApzc->GetTransformToLastDispatchedPaint() * aApzc->GetAncestorTransform();

gfx/layers/apz/src/APZUtils.h

@@ -14,7 +14,11 @@ enum HitTestResult {
   HitNothing,
   HitLayer,
   HitDispatchToContentRegion,
-  HitOverscrolledApzc,
+};
+
+enum CancelAnimationFlags : uint32_t {
+  Default = 0,            /* Cancel all animations */
+  ExcludeOverscroll = 1   /* Don't clear overscroll */
 };
 
 }

gfx/layers/apz/src/AsyncPanZoomController.cpp

@@ -1146,7 +1146,8 @@ nsEventStatus AsyncPanZoomController::OnTouchStart(const MultiTouchInput& aEvent
     case FLING:
     case ANIMATING_ZOOM:
     case SMOOTH_SCROLL:
-      CurrentTouchBlock()->GetOverscrollHandoffChain()->CancelAnimations();
+    case OVERSCROLL_ANIMATION:
+      CurrentTouchBlock()->GetOverscrollHandoffChain()->CancelAnimations(ExcludeOverscroll);
       // Fall through.
     case NOTHING: {
       mX.StartTouch(point.x, aEvent.mTime);
@@ -1226,8 +1227,8 @@ nsEventStatus AsyncPanZoomController::OnTouchMove(const MultiTouchInput& aEvent)
 
     case OVERSCROLL_ANIMATION:
       // Should not receive a touch-move in the OVERSCROLL_ANIMATION state
-      // as touch blocks that begin in an overscrolled state
+      // as touch blocks that begin in an overscrolled state cancel the
-      // are ignored.
+      // animation.
       NS_WARNING("Received impossible touch in OnTouchMove");
       break;
   }
@@ -1269,7 +1270,11 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
     // that were not big enough to trigger scrolling. Clear that out.
     mX.SetVelocity(0);
     mY.SetVelocity(0);
-    SetState(NOTHING);
+    // It's possible we may be overscrolled if the user tapped during a
+    // previous overscroll pan. Make sure to snap back in this situation.
+    if (!SnapBackIfOverscrolled()) {
+      SetState(NOTHING);
+    }
     return nsEventStatus_eIgnore;
 
   case PANNING:
@@ -1310,9 +1315,9 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
     return nsEventStatus_eIgnore;
 
   case OVERSCROLL_ANIMATION:
-    // Should not receive a touch-move in the OVERSCROLL_ANIMATION state
+    // Should not receive a touch-end in the OVERSCROLL_ANIMATION state
-    // as touch blocks that begin in an overscrolled state
+    // as touch blocks that begin in an overscrolled state cancel the
-    // are ignored.
+    // animation.
     NS_WARNING("Received impossible touch in OnTouchEnd");
     break;
   }
@@ -2164,7 +2169,7 @@ void AsyncPanZoomController::StartAnimation(AsyncPanZoomAnimation* aAnimation)
   ScheduleComposite();
 }
 
-void AsyncPanZoomController::CancelAnimation() {
+void AsyncPanZoomController::CancelAnimation(CancelAnimationFlags aFlags) {
   ReentrantMonitorAutoEnter lock(mMonitor);
   APZC_LOG("%p running CancelAnimation in state %d\n", this, mState);
   SetState(NOTHING);
@@ -2176,7 +2181,7 @@ void AsyncPanZoomController::CancelAnimation() {
   // Setting the state to nothing and cancelling the animation can
   // preempt normal mechanisms for relieving overscroll, so we need to clear
   // overscroll here.
-  if (mX.IsOverscrolled() || mY.IsOverscrolled()) {
+  if (!(aFlags & ExcludeOverscroll) && IsOverscrolled()) {
     ClearOverscroll();
     RequestContentRepaint();
     ScheduleComposite();
@@ -2653,6 +2658,10 @@ ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() const {
   return ViewTransform(mFrameMetrics.GetAsyncZoom(), -translation);
 }
 
+Matrix4x4 AsyncPanZoomController::GetCurrentAsyncTransformWithOverscroll() const {
+  return Matrix4x4(GetCurrentAsyncTransform()) * GetOverscrollTransform();
+}
+
 Matrix4x4 AsyncPanZoomController::GetTransformToLastDispatchedPaint() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
 

gfx/layers/apz/src/AsyncPanZoomController.h

@@ -20,6 +20,7 @@
 #include "InputData.h"
 #include "Axis.h"
 #include "InputQueue.h"
+#include "APZUtils.h"
 #include "LayersTypes.h"
 #include "TaskThrottler.h"
 #include "mozilla/gfx/Matrix.h"
@@ -217,6 +218,12 @@ public:
    */
   ViewTransform GetCurrentAsyncTransform() const;
 
+  /**
+   * Returns the same transform as GetCurrentAsyncTransform(), but includes
+   * any transform due to axis over-scroll.
+   */
+  Matrix4x4 GetCurrentAsyncTransformWithOverscroll() const;
+
   /**
    * Returns the transform to take something from the coordinate space of the
    * last thing we know gecko painted, to the coordinate space of the last thing
@@ -285,8 +292,10 @@ public:
 
   /**
    * Cancels any currently running animation.
+   * aFlags is a bit-field to provide specifics of how to cancel the animation.
+   * See CancelAnimationFlags.
    */
-  void CancelAnimation();
+  void CancelAnimation(CancelAnimationFlags aFlags = Default);
 
   /**
    * Clear any overscroll on this APZC.

gfx/layers/apz/src/Axis.cpp

@@ -126,6 +126,8 @@ bool Axis::AdjustDisplacement(ParentLayerCoord aDisplacement,
     return false;
   }
 
+  StopSamplingOverscrollAnimation();
+
   ParentLayerCoord displacement = aDisplacement;
 
   // First consume any overscroll in the opposite direction along this axis.
@@ -160,12 +162,13 @@ ParentLayerCoord Axis::ApplyResistance(ParentLayerCoord aRequestedOverscroll) co
   // The actual overscroll is the requested overscroll multiplied by this
   // factor; this should prevent overscrolling by more than the composition
   // length.
-  float resistanceFactor = 1 - fabsf(mOverscroll) / GetCompositionLength();
+  float resistanceFactor = 1 - fabsf(GetOverscroll()) / GetCompositionLength();
   return resistanceFactor < 0 ? ParentLayerCoord(0) : aRequestedOverscroll * resistanceFactor;
 }
 
 void Axis::OverscrollBy(ParentLayerCoord aOverscroll) {
   MOZ_ASSERT(CanScroll());
+  StopSamplingOverscrollAnimation();
   aOverscroll = ApplyResistance(aOverscroll);
   if (aOverscroll > 0) {
 #ifdef DEBUG
@@ -200,6 +203,12 @@ ParentLayerCoord Axis::GetOverscroll() const {
   return result;
 }
 
+void Axis::StopSamplingOverscrollAnimation() {
+  ParentLayerCoord overscroll = GetOverscroll();
+  ClearOverscroll();
+  mOverscroll = overscroll;
+}
+
 void Axis::StepOverscrollAnimation(double aStepDurationMilliseconds) {
   // Apply spring physics to the overscroll as time goes on.
   // Note: this method of sampling isn't perfectly smooth, as it assumes

gfx/layers/apz/src/Axis.h

@@ -251,6 +251,10 @@ protected:
   // actual overscroll amount.
   ParentLayerCoord ApplyResistance(ParentLayerCoord aOverscroll) const;
 
+  // Helper function to disable overscroll transformations triggered by
+  // SampleOverscrollAnimation().
+  void StopSamplingOverscrollAnimation();
+
   // Helper function for SampleOverscrollAnimation().
   void StepOverscrollAnimation(double aStepDurationMilliseconds);
 

gfx/layers/apz/src/HitTestingTreeNode.cpp

@@ -174,7 +174,7 @@ HitTestingTreeNode::Untransform(const ParentLayerPoint& aPoint) const
   // convert into Layer coordinate space
   gfx::Matrix4x4 localTransform = mTransform;
   if (mApzc) {
-    localTransform = localTransform * gfx::Matrix4x4(mApzc->GetCurrentAsyncTransform());
+    localTransform = localTransform * mApzc->GetCurrentAsyncTransformWithOverscroll();
   }
   gfx::Point4D point = localTransform.Inverse().ProjectPoint(aPoint.ToUnknownPoint());
   return point.HasPositiveWCoord()

gfx/layers/apz/src/InputQueue.cpp

@@ -186,7 +186,7 @@ InputQueue::CancelAnimationsForNewBlock(CancelableBlockState* aBlock)
         INPQ_LOG("block %p tagged as fast-motion\n", touch);
       }
     }
-    aBlock->GetOverscrollHandoffChain()->CancelAnimations();
+    aBlock->GetOverscrollHandoffChain()->CancelAnimations(ExcludeOverscroll);
   }
 }
 

gfx/layers/apz/src/OverscrollHandoffState.cpp

@@ -88,9 +88,12 @@ OverscrollHandoffChain::FlushRepaints() const
 }
 
 void
-OverscrollHandoffChain::CancelAnimations() const
+OverscrollHandoffChain::CancelAnimations(CancelAnimationFlags aFlags) const
 {
-  ForEachApzc(&AsyncPanZoomController::CancelAnimation);
+  MOZ_ASSERT(Length() > 0);
+  for (uint32_t i = 0; i < Length(); ++i) {
+    mChain[i]->CancelAnimation(aFlags);
+  }
 }
 
 void

gfx/layers/apz/src/OverscrollHandoffState.h

@@ -11,6 +11,7 @@
 #include "nsAutoPtr.h"
 #include "nsISupportsImpl.h"  // for NS_INLINE_DECL_REFCOUNTING
 #include "Units.h"            // for ScreenPoint
+#include "APZUtils.h"         // for CancelAnimationFlags
 
 namespace mozilla {
 namespace layers {
@@ -93,7 +94,7 @@ public:
   void FlushRepaints() const;
 
   // Cancel animations all the way up the chain.
-  void CancelAnimations() const;
+  void CancelAnimations(CancelAnimationFlags aFlags = Default) const;
 
   // Clear overscroll all the way up the chain.
   void ClearOverscroll() const;

gfx/thebes/gfxASurface.h

@@ -229,7 +229,7 @@ public:
     }
 
     virtual ~gfxUnknownSurface() { }
-    virtual const nsIntSize GetSize() const { return mSize; }
+    virtual const nsIntSize GetSize() const MOZ_OVERRIDE { return mSize; }
 
 private:
     nsIntSize mSize;

gfx/thebes/gfxFT2FontList.cpp

@@ -640,7 +640,7 @@ public:
 
     ~FontNameCache()
     {
-        if (!mMap.ops) {
+        if (!mMap.IsInitialized()) {
             return;
         }
         if (!mWriteNeeded || !mCache) {
@@ -656,7 +656,7 @@ public:
 
     void Init()
     {
-        if (!mMap.ops || !mCache) {
+        if (!mMap.IsInitialized() || !mCache) {
             return;
         }
         uint32_t size;
@@ -712,7 +712,7 @@ public:
     GetInfoForFile(const nsCString& aFileName, nsCString& aFaceList,
                    uint32_t *aTimestamp, uint32_t *aFilesize)
     {
-        if (!mMap.ops) {
+        if (!mMap.IsInitialized()) {
             return;
         }
         PLDHashEntryHdr *hdr =
@@ -736,7 +736,7 @@ public:
     CacheFileInfo(const nsCString& aFileName, const nsCString& aFaceList,
                   uint32_t aTimestamp, uint32_t aFilesize)
     {
-        if (!mMap.ops) {
+        if (!mMap.IsInitialized()) {
             return;
         }
         FNCMapEntry* entry =

gfx/thebes/gfxFont.h

@@ -312,7 +312,7 @@ public:
 
     // This gets called when the timeout has expired on a zero-refcount
     // font; we just delete it.
-    virtual void NotifyExpired(gfxFont *aFont);
+    virtual void NotifyExpired(gfxFont *aFont) MOZ_OVERRIDE;
 
     // Cleans out the hashtable and removes expired fonts waiting for cleanup.
     // Other gfxFont objects may be still in use but they will be pushed
@@ -1197,7 +1197,7 @@ public:
         moz_free(p);
     }
 
-    CompressedGlyph *GetCharacterGlyphs() {
+    virtual CompressedGlyph *GetCharacterGlyphs() MOZ_OVERRIDE {
         return &mCharGlyphsStorage[0];
     }
 

image/src/ImageFactory.cpp

@@ -45,7 +45,8 @@ ComputeImageFlags(ImageURL* uri, const nsCString& aMimeType, bool isMultiPart)
 
   // We default to the static globals.
   bool isDiscardable = gfxPrefs::ImageMemDiscardable();
-  bool doDecodeOnDraw = gfxPrefs::ImageMemDecodeOnDraw();
+  bool doDecodeOnDraw = gfxPrefs::ImageMemDecodeOnDraw() &&
+                        gfxPrefs::AsyncPanZoomEnabled();
   bool doDownscaleDuringDecode = gfxPrefs::ImageDownscaleDuringDecodeEnabled();
 
   // We want UI to be as snappy as possible and not to flicker. Disable
@@ -64,9 +65,12 @@ ComputeImageFlags(ImageURL* uri, const nsCString& aMimeType, bool isMultiPart)
     isDiscardable = doDecodeOnDraw = false;
   }
 
-  // Downscale-during-decode is only enabled for certain content types.
+  // Downscale-during-decode and decode-on-draw are only enabled for certain
-  if (doDownscaleDuringDecode && !ShouldDownscaleDuringDecode(aMimeType)) {
+  // content types.
+  if ((doDownscaleDuringDecode || doDecodeOnDraw) &&
+      !ShouldDownscaleDuringDecode(aMimeType)) {
     doDownscaleDuringDecode = false;
+    doDecodeOnDraw = false;
   }
 
   // For multipart/x-mixed-replace, we basically want a direct channel to the

image/src/RasterImage.cpp

@@ -35,6 +35,7 @@
 
 #include "mozilla/gfx/2D.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/Likely.h"
 #include "mozilla/RefPtr.h"
 #include "mozilla/Move.h"
 #include "mozilla/MemoryReporting.h"
@@ -271,6 +272,7 @@ RasterImage::RasterImage(ProgressTracker* aProgressTracker,
   mSourceBuffer(new SourceBuffer()),
   mFrameCount(0),
   mHasSize(false),
+  mBlockedOnload(false),
   mDecodeOnDraw(false),
   mTransient(false),
   mDiscardable(false),
@@ -1166,26 +1168,58 @@ RasterImage::OnImageDataComplete(nsIRequest*, nsISupports*, nsresult aStatus,
     DoError();
   }
 
-  // Notify our listeners, which will fire this image's load event.
   MOZ_ASSERT(mHasSize || mError, "Need to know size before firing load event");
   MOZ_ASSERT(!mHasSize ||
              (mProgressTracker->GetProgress() & FLAG_SIZE_AVAILABLE),
              "Should have notified that the size is available if we have it");
+
   Progress loadProgress = LoadCompleteProgress(aLastPart, mError, finalStatus);
+
+  if (mBlockedOnload) {
+    // For decode-on-draw images, we want to send notifications as if we've
+    // already finished decoding. Otherwise some observers will never even try
+    // to draw.
+    MOZ_ASSERT(mDecodeOnDraw, "Blocked onload but not decode-on-draw");
+    loadProgress |= FLAG_FRAME_COMPLETE |
+                    FLAG_DECODE_COMPLETE |
+                    FLAG_ONLOAD_UNBLOCKED;
+  }
+
+  // Notify our listeners, which will fire this image's load event.
   NotifyProgress(loadProgress);
 
   return finalStatus;
 }
 
+void
+RasterImage::BlockOnloadForDecodeOnDraw()
+{
+  if (mHasSourceData) {
+    // OnImageDataComplete got called before we got to run. No point in blocking
+    // onload now.
+    return;
+  }
+
+  // Block onload. We'll unblock it in OnImageDataComplete.
+  mBlockedOnload = true;
+  NotifyProgress(FLAG_DECODE_STARTED | FLAG_ONLOAD_BLOCKED);
+}
+
 nsresult
 RasterImage::OnImageDataAvailable(nsIRequest*,
                                   nsISupports*,
                                   nsIInputStream* aInStr,
-                                  uint64_t,
+                                  uint64_t aOffset,
                                   uint32_t aCount)
 {
   nsresult rv;
 
+  if (MOZ_UNLIKELY(mDecodeOnDraw && aOffset == 0)) {
+    nsCOMPtr<nsIRunnable> runnable =
+      NS_NewRunnableMethod(this, &RasterImage::BlockOnloadForDecodeOnDraw);
+    NS_DispatchToMainThread(runnable);
+  }
+
   // WriteToSourceBuffer always consumes everything it gets if it doesn't run
   // out of memory.
   uint32_t bytesRead;
@@ -1405,6 +1439,11 @@ RasterImage::WantDecodedFrames(const nsIntSize& aSize, uint32_t aFlags,
 NS_IMETHODIMP
 RasterImage::RequestDecode()
 {
+  // For decode-on-draw images, we only act on RequestDecodeForSize.
+  if (mDecodeOnDraw) {
+    return NS_OK;
+  }
+
   return RequestDecodeForSize(mSize, DECODE_FLAGS_DEFAULT);
 }
 
@@ -1417,6 +1456,11 @@ RasterImage::StartDecoding()
       NS_NewRunnableMethod(this, &RasterImage::StartDecoding));
   }
 
+  // For decode-on-draw images, we only act on RequestDecodeForSize.
+  if (mDecodeOnDraw) {
+    return NS_OK;
+  }
+
   return RequestDecodeForSize(mSize, FLAG_SYNC_DECODE);
 }
 
@@ -1457,7 +1501,7 @@ bool
 RasterImage::IsDecoded()
 {
   // XXX(seth): We need to get rid of this; it's not reliable.
-  return mHasBeenDecoded || mError;
+  return mHasBeenDecoded || mError || (mDecodeOnDraw && mHasSourceData);
 }
 
 NS_IMETHODIMP

image/src/RasterImage.h

@@ -242,6 +242,8 @@ public:
                                        nsresult aStatus,
                                        bool aLastPart) MOZ_OVERRIDE;
 
+  void BlockOnloadForDecodeOnDraw();
+
   /**
    * A hint of the number of bytes of source data that the image contains. If
    * called early on, this can help reduce copying and reallocations by
@@ -387,6 +389,7 @@ private: // data
 
   // Boolean flags (clustered together to conserve space):
   bool                       mHasSize:1;       // Has SetSize() been called?
+  bool                       mBlockedOnload:1; // Did send BLOCK_ONLOAD?
   bool                       mDecodeOnDraw:1;  // Decoding on draw?
   bool                       mTransient:1;     // Is the image short-lived?
   bool                       mDiscardable:1;   // Is container discardable?

image/src/imgRequestProxy.h

@@ -145,7 +145,7 @@ protected:
         : mOwner(owner), mStatus(status)
       {}
 
-      NS_IMETHOD Run() {
+      NS_IMETHOD Run() MOZ_OVERRIDE {
         mOwner->DoCancel(mStatus);
         return NS_OK;
       }

intl/unicharutil/util/nsUnicharUtils.h

@@ -45,7 +45,7 @@ public:
   virtual int32_t operator() (const char16_t*,
                               const char16_t*,
                               uint32_t,
-                              uint32_t) const;
+                              uint32_t) const MOZ_OVERRIDE;
 };
 
 class nsCaseInsensitiveUTF8StringComparator : public nsCStringComparator
@@ -54,7 +54,7 @@ public:
   virtual int32_t operator() (const char*,
                               const char*,
                               uint32_t,
-                              uint32_t) const;
+                              uint32_t) const MOZ_OVERRIDE;
 };
 
 class nsCaseInsensitiveStringArrayComparator
@@ -73,7 +73,7 @@ public:
   virtual int operator() (const char16_t*,
                           const char16_t*,
                           uint32_t,
-                          uint32_t) const;
+                          uint32_t) const MOZ_OVERRIDE;
 };
 
 inline bool

ipc/app/moz.build

@@ -66,6 +66,12 @@ if CONFIG['MOZ_SANDBOX'] and CONFIG['OS_TARGET'] == 'Linux':
         'mozsandbox',
     ]
 
+    # gcc lto likes to put the top level asm in syscall.cc in a different partition
+    # from the function using it which breaks the build.  Work around that by
+    # forcing there to be only one partition.
+    if '-flto' in CONFIG['OS_CXXFLAGS'] and not CONFIG['CLANG_CXX']:
+	LDFLAGS += ['--param lto-partitions=1']
+
 if CONFIG['_MSC_VER']:
     # Always enter a Windows program through wmain, whether or not we're
     # a console application.

ipc/bluetooth/BluetoothDaemonConnection.cpp

@@ -191,14 +191,22 @@ BluetoothDaemonPDUConsumer::~BluetoothDaemonPDUConsumer()
 //
 
 class BluetoothDaemonConnectionIO MOZ_FINAL : public UnixSocketWatcher
+                                            , public ConnectionOrientedSocketIO
 {
 public:
-  BluetoothDaemonConnectionIO(MessageLoop* aIOLoop,
+  BluetoothDaemonConnectionIO(MessageLoop* aIOLoop, int aFd,
+                              ConnectionStatus aConnectionStatus,
                               BluetoothDaemonConnection* aConnection,
                               BluetoothDaemonPDUConsumer* aConsumer);
 
   SocketBase* GetSocketBase();
 
+  // StreamSocketIOBase
+  //
+
+  nsresult Accept(int aFd,
+                  const union sockaddr_any* aAddr, socklen_t aAddrLen);
+
   // Shutdown state
   //
 
@@ -237,10 +245,11 @@ private:
 };
 
 BluetoothDaemonConnectionIO::BluetoothDaemonConnectionIO(
-  MessageLoop* aIOLoop,
+  MessageLoop* aIOLoop, int aFd,
+  ConnectionStatus aConnectionStatus,
   BluetoothDaemonConnection* aConnection,
   BluetoothDaemonPDUConsumer* aConsumer)
-: UnixSocketWatcher(aIOLoop)
+: UnixSocketWatcher(aIOLoop, aFd, aConnectionStatus)
 , mConnection(aConnection)
 , mConsumer(aConsumer)
 , mShuttingDownOnIOThread(false)
@@ -291,6 +300,30 @@ BluetoothDaemonConnectionIO::ShutdownOnIOThread()
   mShuttingDownOnIOThread = true;
 }
 
+nsresult
+BluetoothDaemonConnectionIO::Accept(int aFd,
+                                    const union sockaddr_any* aAddr,
+                                    socklen_t aAddrLen)
+{
+  MOZ_ASSERT(MessageLoopForIO::current() == GetIOLoop());
+  MOZ_ASSERT(GetConnectionStatus() == SOCKET_IS_CONNECTING);
+
+  // File-descriptor setup
+
+  if (TEMP_FAILURE_RETRY(fcntl(aFd, F_SETFL, O_NONBLOCK)) < 0) {
+    OnError("fcntl", errno);
+    ScopedClose cleanupFd(aFd);
+    return NS_ERROR_FAILURE;
+  }
+
+  SetSocket(aFd, SOCKET_IS_CONNECTED);
+
+  // Signal success
+  OnConnected();
+
+  return NS_OK;
+}
+
 void
 BluetoothDaemonConnectionIO::Connect(const char* aSocketName)
 {
@@ -519,7 +552,8 @@ BluetoothDaemonConnection::ConnectSocket(BluetoothDaemonPDUConsumer* aConsumer)
   SetConnectionStatus(SOCKET_CONNECTING);
 
   MessageLoop* ioLoop = XRE_GetIOMessageLoop();
-  mIO = new BluetoothDaemonConnectionIO(ioLoop, this, aConsumer);
+  mIO = new BluetoothDaemonConnectionIO(
+    ioLoop, -1, UnixSocketWatcher::SOCKET_IS_CONNECTING, this, aConsumer);
   ioLoop->PostTask(FROM_HERE, new BluetoothDaemonConnectTask(mIO));
 
   return NS_OK;
@@ -560,5 +594,30 @@ BluetoothDaemonConnection::Send(BluetoothDaemonPDU* aPDU)
   return NS_OK;
 }
 
+ConnectionOrientedSocketIO*
+BluetoothDaemonConnection::GetIO()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mIO); // Call |PrepareAccept| before listening for connections
+
+  return mIO;
+}
+
+ConnectionOrientedSocketIO*
+BluetoothDaemonConnection::PrepareAccept(BluetoothDaemonPDUConsumer* aConsumer)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mIO);
+  MOZ_ASSERT(aConsumer);
+
+  SetConnectionStatus(SOCKET_CONNECTING);
+
+  mIO = new BluetoothDaemonConnectionIO(
+    XRE_GetIOMessageLoop(), -1, UnixSocketWatcher::SOCKET_IS_CONNECTING,
+    this, aConsumer);
+
+  return mIO;
+}
+
 }
 }

ipc/bluetooth/BluetoothDaemonConnection.h

@@ -9,6 +9,7 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/FileUtils.h"
+#include "mozilla/ipc/ConnectionOrientedSocket.h"
 #include "mozilla/ipc/SocketBase.h"
 #include "nsError.h"
 #include "nsAutoPtr.h"
@@ -105,16 +106,33 @@ protected:
  * PDUs. PDU receiving is performed by |BluetoothDaemonPDUConsumer|.
  */
 class BluetoothDaemonConnection : public SocketBase
+                                , public ConnectionOrientedSocket
 {
 public:
   BluetoothDaemonConnection();
   virtual ~BluetoothDaemonConnection();
 
+  // SocketBase
+  //
+
   nsresult ConnectSocket(BluetoothDaemonPDUConsumer* aConsumer);
   void     CloseSocket();
 
   nsresult Send(BluetoothDaemonPDU* aPDU);
 
+  // ConnectionOrientedSocket
+  //
+
+  virtual ConnectionOrientedSocketIO* GetIO() MOZ_OVERRIDE;
+
+protected:
+
+  // Prepares an instance of |BluetoothDaemonConnection| in DISCONNECTED
+  // state for accepting a connection. Subclasses implementing |GetIO|
+  // need to call this method.
+  ConnectionOrientedSocketIO*
+    PrepareAccept(BluetoothDaemonPDUConsumer* aConsumer);
+
 private:
   BluetoothDaemonConnectionIO* mIO;
 };

ipc/unixsocket/ListenSocket.cpp

@@ -225,20 +225,7 @@ ListenSocketIO::OnAccepted(int aFd,
 
   RemoveWatchers(READ_WATCHER|WRITE_WATCHER);
 
-  nsRefPtr<nsRunnable> runnable;
+  mCOSocketIO->Accept(aFd, aAddr, aAddrLen);
-
-  if (NS_SUCCEEDED(mCOSocketIO->Accept(aFd, aAddr, aAddrLen))) {
-    runnable =
-      new SocketIOEventRunnable<ListenSocketIO>(
-        this, SocketIOEventRunnable<ListenSocketIO>::CONNECT_SUCCESS);
-    return;
-  } else {
-    runnable =
-      new SocketIOEventRunnable<ListenSocketIO>(
-        this, SocketIOEventRunnable<ListenSocketIO>::CONNECT_ERROR);
-  }
-
-  NS_DispatchToMainThread(runnable);
 }
 
 void
@@ -262,6 +249,12 @@ ListenSocketIO::OnListening()
   }
 
   AddWatchers(READ_WATCHER, true);
+
+  /* We signal a successful 'connection' to a local address for listening. */
+  nsRefPtr<nsRunnable> runnable =
+      new SocketIOEventRunnable<ListenSocketIO>(
+        this, SocketIOEventRunnable<ListenSocketIO>::CONNECT_SUCCESS);
+  NS_DispatchToMainThread(runnable);
 }
 
 void

js/src/jit/JitFrames.cpp

@@ -2928,21 +2928,21 @@ JitProfilingFrameIterator::operator++()
     JitFrameLayout *frame = framePtr();
     FrameType prevType = frame->prevType();
 
-    if (prevType == JitFrame_IonJS) {
+    if (prevType == JitFrame_IonJS || prevType == JitFrame_Unwound_IonJS) {
         returnAddressToFp_ = frame->returnAddress();
         fp_ = GetPreviousRawFrame<JitFrameLayout, uint8_t *>(frame);
         type_ = JitFrame_IonJS;
         return;
     }
 
-    if (prevType == JitFrame_BaselineJS) {
+    if (prevType == JitFrame_BaselineJS || prevType == JitFrame_Unwound_BaselineJS) {
         returnAddressToFp_ = frame->returnAddress();
         fp_ = GetPreviousRawFrame<JitFrameLayout, uint8_t *>(frame);
         type_ = JitFrame_BaselineJS;
         return;
     }
 
-    if (prevType == JitFrame_BaselineStub) {
+    if (prevType == JitFrame_BaselineStub || prevType == JitFrame_Unwound_BaselineStub) {
         BaselineStubFrameLayout *stubFrame =
             GetPreviousRawFrame<JitFrameLayout, BaselineStubFrameLayout *>(frame);
         MOZ_ASSERT(stubFrame->prevType() == JitFrame_BaselineJS);
@@ -2954,7 +2954,7 @@ JitProfilingFrameIterator::operator++()
         return;
     }
 
-    if (prevType == JitFrame_Rectifier) {
+    if (prevType == JitFrame_Rectifier || prevType == JitFrame_Unwound_Rectifier) {
         RectifierFrameLayout *rectFrame =
             GetPreviousRawFrame<JitFrameLayout, RectifierFrameLayout *>(frame);
         FrameType rectPrevType = rectFrame->prevType();

js/xpconnect/idl/nsIXPCScriptable.idl

@@ -156,8 +156,8 @@ class NS_NO_VTABLE nsXPCClassInfo : public nsIClassInfo,
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_XPCCLASSINFO_IID)
 
-  NS_IMETHOD_(MozExternalRefCountType) AddRef() = 0;
+  NS_IMETHOD_(MozExternalRefCountType) AddRef() MOZ_OVERRIDE = 0;
-  NS_IMETHOD_(MozExternalRefCountType) Release() = 0;
+  NS_IMETHOD_(MozExternalRefCountType) Release() MOZ_OVERRIDE = 0;
 
   virtual void PreserveWrapper(nsISupports *aNative) = 0;
 };

layout/base/nsFrameManager.cpp

@@ -153,7 +153,7 @@ nsFrameManager::GetPlaceholderFrameFor(const nsIFrame* aFrame)
 {
   NS_PRECONDITION(aFrame, "null param unexpected");
 
-  if (mPlaceholderMap.ops) {
+  if (mPlaceholderMap.IsInitialized()) {
     PlaceholderMapEntry *entry = static_cast<PlaceholderMapEntry*>
                                             (PL_DHashTableLookup(const_cast<PLDHashTable*>(&mPlaceholderMap),
                                 aFrame));
@@ -171,7 +171,7 @@ nsFrameManager::RegisterPlaceholderFrame(nsPlaceholderFrame* aPlaceholderFrame)
   NS_PRECONDITION(aPlaceholderFrame, "null param unexpected");
   NS_PRECONDITION(nsGkAtoms::placeholderFrame == aPlaceholderFrame->GetType(),
                   "unexpected frame type");
-  if (!mPlaceholderMap.ops) {
+  if (!mPlaceholderMap.IsInitialized()) {
     PL_DHashTableInit(&mPlaceholderMap, &PlaceholderMapOps,
                       sizeof(PlaceholderMapEntry));
   }
@@ -193,7 +193,7 @@ nsFrameManager::UnregisterPlaceholderFrame(nsPlaceholderFrame* aPlaceholderFrame
   NS_PRECONDITION(nsGkAtoms::placeholderFrame == aPlaceholderFrame->GetType(),
                   "unexpected frame type");
 
-  if (mPlaceholderMap.ops) {
+  if (mPlaceholderMap.IsInitialized()) {
     PL_DHashTableRemove(&mPlaceholderMap,
                         aPlaceholderFrame->GetOutOfFlowFrame());
   }
@@ -211,10 +211,9 @@ UnregisterPlaceholders(PLDHashTable* table, PLDHashEntryHdr* hdr,
 void
 nsFrameManager::ClearPlaceholderFrameMap()
 {
-  if (mPlaceholderMap.ops) {
+  if (mPlaceholderMap.IsInitialized()) {
     PL_DHashTableEnumerate(&mPlaceholderMap, UnregisterPlaceholders, nullptr);
     PL_DHashTableFinish(&mPlaceholderMap);
-    mPlaceholderMap.ops = nullptr;
   }
 }
 

layout/base/nsFrameManagerBase.h

@@ -37,7 +37,6 @@ public:
     , mDisplayContentsMap(nullptr)
     , mIsDestroyingFrames(false)
   {
-    mPlaceholderMap.ops = nullptr;
   }
 
   bool IsDestroyingFrames() { return mIsDestroyingFrames; }

layout/base/nsLayoutUtils.h

@@ -1082,14 +1082,14 @@ public:
 
     RectAccumulator();
 
-    virtual void AddRect(const nsRect& aRect);
+    virtual void AddRect(const nsRect& aRect) MOZ_OVERRIDE;
   };
 
   struct RectListBuilder : public RectCallback {
     DOMRectList* mRectList;
 
     explicit RectListBuilder(DOMRectList* aList);
-    virtual void AddRect(const nsRect& aRect);
+    virtual void AddRect(const nsRect& aRect) MOZ_OVERRIDE;
   };
 
   static nsIFrame* GetContainingBlockForClientRect(nsIFrame* aFrame);

layout/forms/test/mochitest.ini

@@ -34,7 +34,7 @@ skip-if = (toolkit == 'gonk' && debug) #debug-only failure
 [test_bug564115.html]
 skip-if = buildapp == 'mulet' || (buildapp == 'b2g' && (toolkit != 'gonk' || debug)) || toolkit == 'android' || e10s #TIMED_OUT # b2g-debug(times out on window.open and focus event) b2g-desktop(times out on window.open and focus event)
 [test_bug571352.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' #TIMED_OUT # b2g(shift-click multi-select not working?) b2g-debug(shift-click multi-select not working?) b2g-desktop(shift-click multi-select not working?)
+skip-if = (os == 'mac' && os_version == '10.10') ||  buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' #TIMED_OUT # OS X 10.10 - bug 947690, b2g(shift-click multi-select not working?) b2g-debug(shift-click multi-select not working?) b2g-desktop(shift-click multi-select not working?)
 [test_bug572406.html]
 [test_bug572649.html]
 skip-if = toolkit == 'android' #TIMED_OUT

layout/generic/nsImageFrame.cpp

@@ -1425,8 +1425,7 @@ nsDisplayImage::GetContainer(LayerManager* aManager,
                              nsDisplayListBuilder* aBuilder)
 {
   nsRefPtr<ImageContainer> container;
-  nsresult rv = mImage->GetImageContainer(aManager, getter_AddRefs(container));
+  mImage->GetImageContainer(aManager, getter_AddRefs(container));
-  NS_ENSURE_SUCCESS(rv, nullptr);
   return container.forget();
 }
 

layout/style/nsCSSRuleProcessor.cpp

@@ -218,7 +218,7 @@ RuleHash_CIMatchEntry(PLDHashTable *table, const PLDHashEntryHdr *hdr,
   nsIAtom *match_atom = const_cast<nsIAtom*>(static_cast<const nsIAtom*>
                                               (key));
   // Use our extra |getKey| callback to avoid code duplication.
-  nsIAtom *entry_atom = ToLocalOps(table->ops)->getKey(table, hdr);
+  nsIAtom *entry_atom = ToLocalOps(table->Ops())->getKey(table, hdr);
 
   // Check for case-sensitive match first.
   if (match_atom == entry_atom)
@@ -240,7 +240,7 @@ RuleHash_CSMatchEntry(PLDHashTable *table, const PLDHashEntryHdr *hdr,
   nsIAtom *match_atom = const_cast<nsIAtom*>(static_cast<const nsIAtom*>
                                               (key));
   // Use our extra |getKey| callback to avoid code duplication.
-  nsIAtom *entry_atom = ToLocalOps(table->ops)->getKey(table, hdr);
+  nsIAtom *entry_atom = ToLocalOps(table->Ops())->getKey(table, hdr);
 
   return match_atom == entry_atom;
 }
@@ -454,8 +454,7 @@ protected:
   void AppendUniversalRule(const RuleSelectorPair& aRuleInfo);
 
   int32_t     mRuleCount;
-  // The hashtables are lazily initialized; we use a null .ops to
+  // The hashtables are lazily initialized.
-  // indicate that they need initialization.
   PLDHashTable mIdTable;
   PLDHashTable mClassTable;
   PLDHashTable mTagTable;
@@ -514,11 +513,6 @@ RuleHash::RuleHash(bool aQuirksMode)
 #endif
 {
   MOZ_COUNT_CTOR(RuleHash);
-
-  mTagTable.ops = nullptr;
-  mIdTable.ops = nullptr;
-  mClassTable.ops = nullptr;
-  mNameSpaceTable.ops = nullptr;
 }
 
 RuleHash::~RuleHash()
@@ -561,16 +555,16 @@ RuleHash::~RuleHash()
     delete [] mEnumList;
   }
   // delete arena for strings and small objects
-  if (mIdTable.ops) {
+  if (mIdTable.IsInitialized()) {
     PL_DHashTableFinish(&mIdTable);
   }
-  if (mClassTable.ops) {
+  if (mClassTable.IsInitialized()) {
     PL_DHashTableFinish(&mClassTable);
   }
-  if (mTagTable.ops) {
+  if (mTagTable.IsInitialized()) {
     PL_DHashTableFinish(&mTagTable);
   }
-  if (mNameSpaceTable.ops) {
+  if (mNameSpaceTable.IsInitialized()) {
     PL_DHashTableFinish(&mNameSpaceTable);
   }
 }
@@ -611,7 +605,7 @@ void RuleHash::AppendRule(const RuleSelectorPair& aRuleInfo)
     selector = selector->mNext;
   }
   if (nullptr != selector->mIDList) {
-    if (!mIdTable.ops) {
+    if (!mIdTable.IsInitialized()) {
       PL_DHashTableInit(&mIdTable,
                         mQuirksMode ? &RuleHash_IdTable_CIOps.ops
                                     : &RuleHash_IdTable_CSOps.ops,
@@ -621,7 +615,7 @@ void RuleHash::AppendRule(const RuleSelectorPair& aRuleInfo)
     RULE_HASH_STAT_INCREMENT(mIdSelectors);
   }
   else if (nullptr != selector->mClassList) {
-    if (!mClassTable.ops) {
+    if (!mClassTable.IsInitialized()) {
       PL_DHashTableInit(&mClassTable,
                         mQuirksMode ? &RuleHash_ClassTable_CIOps.ops
                                     : &RuleHash_ClassTable_CSOps.ops,
@@ -632,7 +626,7 @@ void RuleHash::AppendRule(const RuleSelectorPair& aRuleInfo)
   }
   else if (selector->mLowercaseTag) {
     RuleValue ruleValue(aRuleInfo, mRuleCount++, mQuirksMode);
-    if (!mTagTable.ops) {
+    if (!mTagTable.IsInitialized()) {
       PL_DHashTableInit(&mTagTable, &RuleHash_TagTable_Ops,
                         sizeof(RuleHashTagTableEntry));
     }
@@ -645,7 +639,7 @@ void RuleHash::AppendRule(const RuleSelectorPair& aRuleInfo)
     }
   }
   else if (kNameSpaceID_Unknown != selector->mNameSpace) {
-    if (!mNameSpaceTable.ops) {
+    if (!mNameSpaceTable.IsInitialized()) {
       PL_DHashTableInit(&mNameSpaceTable, &RuleHash_NameSpaceTable_Ops,
                         sizeof(RuleHashTableEntry));
     }
@@ -705,7 +699,7 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
     RULE_HASH_STAT_INCREMENT_LIST_COUNT(mUniversalRules, mElementUniversalCalls);
   }
   // universal rules within the namespace
-  if (kNameSpaceID_Unknown != nameSpace && mNameSpaceTable.ops) {
+  if (kNameSpaceID_Unknown != nameSpace && mNameSpaceTable.IsInitialized()) {
     RuleHashTableEntry *entry = static_cast<RuleHashTableEntry*>
                                            (PL_DHashTableLookup(&mNameSpaceTable, NS_INT32_TO_PTR(nameSpace)));
     if (PL_DHASH_ENTRY_IS_BUSY(entry)) {
@@ -713,7 +707,7 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
       RULE_HASH_STAT_INCREMENT_LIST_COUNT(entry->mRules, mElementNameSpaceCalls);
     }
   }
-  if (mTagTable.ops) {
+  if (mTagTable.IsInitialized()) {
     RuleHashTableEntry *entry = static_cast<RuleHashTableEntry*>
                                            (PL_DHashTableLookup(&mTagTable, tag));
     if (PL_DHASH_ENTRY_IS_BUSY(entry)) {
@@ -721,7 +715,7 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
       RULE_HASH_STAT_INCREMENT_LIST_COUNT(entry->mRules, mElementTagCalls);
     }
   }
-  if (id && mIdTable.ops) {
+  if (id && mIdTable.IsInitialized()) {
     RuleHashTableEntry *entry = static_cast<RuleHashTableEntry*>
                                            (PL_DHashTableLookup(&mIdTable, id));
     if (PL_DHASH_ENTRY_IS_BUSY(entry)) {
@@ -729,7 +723,7 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
       RULE_HASH_STAT_INCREMENT_LIST_COUNT(entry->mRules, mElementIdCalls);
     }
   }
-  if (mClassTable.ops) {
+  if (mClassTable.IsInitialized()) {
     for (int32_t index = 0; index < classCount; ++index) {
       RuleHashTableEntry *entry = static_cast<RuleHashTableEntry*>
                                              (PL_DHashTableLookup(&mClassTable, classList->AtomAt(index)));
@@ -792,25 +786,25 @@ RuleHash::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
 {
   size_t n = 0;
 
-  if (mIdTable.ops) {
+  if (mIdTable.IsInitialized()) {
     n += PL_DHashTableSizeOfExcludingThis(&mIdTable,
                                           SizeOfRuleHashTableEntry,
                                           aMallocSizeOf);
   }
 
-  if (mClassTable.ops) {
+  if (mClassTable.IsInitialized()) {
     n += PL_DHashTableSizeOfExcludingThis(&mClassTable,
                                           SizeOfRuleHashTableEntry,
                                           aMallocSizeOf);
   }
 
-  if (mTagTable.ops) {
+  if (mTagTable.IsInitialized()) {
     n += PL_DHashTableSizeOfExcludingThis(&mTagTable,
                                           SizeOfRuleHashTableEntry,
                                           aMallocSizeOf);
   }
 
-  if (mNameSpaceTable.ops) {
+  if (mNameSpaceTable.IsInitialized()) {
     n += PL_DHashTableSizeOfExcludingThis(&mNameSpaceTable,
                                           SizeOfRuleHashTableEntry,
                                           aMallocSizeOf);
@@ -3362,9 +3356,8 @@ struct CascadeEnumData {
       mCacheKey(aKey),
       mSheetType(aSheetType)
   {
-    if (!PL_DHashTableInit(&mRulesByWeight, &gRulesByWeightOps,
+    PL_DHashTableInit(&mRulesByWeight, &gRulesByWeightOps,
-                           sizeof(RuleByWeightEntry), fallible_t(), 32))
+                      sizeof(RuleByWeightEntry), 32);
-      mRulesByWeight.ops = nullptr;
 
     // Initialize our arena
     PL_INIT_ARENA_POOL(&mArena, "CascadeEnumDataArena",
@@ -3373,7 +3366,7 @@ struct CascadeEnumData {
 
   ~CascadeEnumData()
   {
-    if (mRulesByWeight.ops)
+    if (mRulesByWeight.IsInitialized())
       PL_DHashTableFinish(&mRulesByWeight);
     PL_FinishArenaPool(&mArena);
   }
@@ -3587,7 +3580,7 @@ nsCSSRuleProcessor::RefreshRuleCascade(nsPresContext* aPresContext)
                            newCascade->mCounterStyleRules,
                            newCascade->mCacheKey,
                            mSheetType);
-      if (!data.mRulesByWeight.ops)
+      if (!data.mRulesByWeight.IsInitialized())
         return; /* out of memory */
 
       for (uint32_t i = 0; i < mSheets.Length(); ++i) {

layout/style/nsHTMLStyleSheet.cpp

@@ -238,16 +238,16 @@ nsHTMLStyleSheet::nsHTMLStyleSheet(nsIDocument* aDocument)
   , mTableTHRule(new TableTHRule())
 {
   MOZ_ASSERT(aDocument);
-  mMappedAttrTable.ops = nullptr;
-  mLangRuleTable.ops = nullptr;
 }
 
 nsHTMLStyleSheet::~nsHTMLStyleSheet()
 {
-  if (mLangRuleTable.ops)
+  if (mLangRuleTable.IsInitialized()) {
     PL_DHashTableFinish(&mLangRuleTable);
-  if (mMappedAttrTable.ops)
+  }
+  if (mMappedAttrTable.IsInitialized()) {
     PL_DHashTableFinish(&mMappedAttrTable);
+  }
 }
 
 NS_IMPL_ISUPPORTS(nsHTMLStyleSheet, nsIStyleRuleProcessor)
@@ -425,13 +425,11 @@ nsHTMLStyleSheet::Reset()
   mVisitedRule       = nullptr;
   mActiveRule        = nullptr;
 
-  if (mLangRuleTable.ops) {
+  if (mLangRuleTable.IsInitialized()) {
     PL_DHashTableFinish(&mLangRuleTable);
-    mLangRuleTable.ops = nullptr;
   }
-  if (mMappedAttrTable.ops) {
+  if (mMappedAttrTable.IsInitialized()) {
     PL_DHashTableFinish(&mMappedAttrTable);
-    mMappedAttrTable.ops = nullptr;
   }
 }
 
@@ -481,7 +479,7 @@ nsHTMLStyleSheet::SetVisitedLinkColor(nscolor aColor)
 already_AddRefed<nsMappedAttributes>
 nsHTMLStyleSheet::UniqueMappedAttributes(nsMappedAttributes* aMapped)
 {
-  if (!mMappedAttrTable.ops) {
+  if (!mMappedAttrTable.IsInitialized()) {
     PL_DHashTableInit(&mMappedAttrTable, &MappedAttrTable_Ops,
                       sizeof(MappedAttrTableEntry));
   }
@@ -502,7 +500,7 @@ nsHTMLStyleSheet::DropMappedAttributes(nsMappedAttributes* aMapped)
 {
   NS_ENSURE_TRUE_VOID(aMapped);
 
-  NS_ASSERTION(mMappedAttrTable.ops, "table uninitialized");
+  NS_ASSERTION(mMappedAttrTable.IsInitialized(), "table uninitialized");
 #ifdef DEBUG
   uint32_t entryCount = mMappedAttrTable.EntryCount() - 1;
 #endif
@@ -515,7 +513,7 @@ nsHTMLStyleSheet::DropMappedAttributes(nsMappedAttributes* aMapped)
 nsIStyleRule*
 nsHTMLStyleSheet::LangRuleFor(const nsString& aLanguage)
 {
-  if (!mLangRuleTable.ops) {
+  if (!mLangRuleTable.IsInitialized()) {
     PL_DHashTableInit(&mLangRuleTable, &LangRuleTable_Ops,
                       sizeof(LangRuleTableEntry));
   }
@@ -545,7 +543,7 @@ nsHTMLStyleSheet::DOMSizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const
 {
   size_t n = aMallocSizeOf(this);
 
-  if (mMappedAttrTable.ops) {
+  if (mMappedAttrTable.IsInitialized()) {
     n += PL_DHashTableSizeOfExcludingThis(&mMappedAttrTable,
                                           SizeOfAttributesEntryExcludingThis,
                                           aMallocSizeOf);

layout/tables/SpanningCellSorter.cpp

@@ -19,14 +19,12 @@ SpanningCellSorter::SpanningCellSorter()
   , mSortedHashTable(nullptr)
 {
     memset(mArray, 0, sizeof(mArray));
-    mHashTable.ops = nullptr;
 }
 
 SpanningCellSorter::~SpanningCellSorter()
 {
-    if (mHashTable.ops) {
+    if (mHashTable.IsInitialized()) {
         PL_DHashTableFinish(&mHashTable);
-        mHashTable.ops = nullptr;
     }
     delete [] mSortedHashTable;
 }
@@ -72,7 +70,7 @@ SpanningCellSorter::AddCell(int32_t aColSpan, int32_t aRow, int32_t aCol)
         i->next = mArray[index];
         mArray[index] = i;
     } else {
-        if (!mHashTable.ops) {
+        if (!mHashTable.IsInitialized()) {
             PL_DHashTableInit(&mHashTable, &HashTableOps,
                               sizeof(HashTableEntry));
         }
@@ -147,7 +145,7 @@ SpanningCellSorter::GetNext(int32_t *aColSpan)
             /* prepare to enumerate the hash */
             mState = ENUMERATING_HASH;
             mEnumerationIndex = 0;
-            if (mHashTable.ops) {
+            if (mHashTable.IsInitialized()) {
                 HashTableEntry **sh =
                     new HashTableEntry*[mHashTable.EntryCount()];
                 if (!sh) {
@@ -162,7 +160,9 @@ SpanningCellSorter::GetNext(int32_t *aColSpan)
             }
             /* fall through */
         case ENUMERATING_HASH:
-            if (mHashTable.ops && mEnumerationIndex < mHashTable.EntryCount()) {
+            if (mHashTable.IsInitialized() &&
+                mEnumerationIndex < mHashTable.EntryCount())
+            {
                 Item *result = mSortedHashTable[mEnumerationIndex]->mItems;
                 *aColSpan = mSortedHashTable[mEnumerationIndex]->mColSpan;
                 NS_ASSERTION(result, "holes in hash table");

layout/xul/nsImageBoxFrame.cpp

@@ -434,8 +434,7 @@ nsImageBoxFrame::GetContainer(LayerManager* aManager)
   }
   
   nsRefPtr<ImageContainer> container;
-  nsresult rv = imgCon->GetImageContainer(aManager, getter_AddRefs(container));
+  imgCon->GetImageContainer(aManager, getter_AddRefs(container));
-  NS_ENSURE_SUCCESS(rv, nullptr);
   return container.forget();
 }
 

media/libstagefright/binding/Box.cpp

@@ -48,8 +48,8 @@ Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
     if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
         !byteRange->Contains(bigLengthRange) ||
         !mContext->mSource->CachedReadAt(aOffset, bigLength,
-                                         sizeof(bigLengthRange), &bytes) ||
+                                         sizeof(bigLength), &bytes) ||
-        bytes != sizeof(bigLengthRange)) {
+        bytes != sizeof(bigLength)) {
       return;
     }
     size = BigEndian::readUint64(bigLength);
@@ -94,7 +94,7 @@ Box::Read(nsTArray<uint8_t>* aDest)
 {
   aDest->SetLength(mRange.mEnd - mChildOffset);
   size_t bytes;
-  if (!mContext->mSource->CachedReadAt(mChildOffset, &(*aDest)[0],
+  if (!mContext->mSource->CachedReadAt(mChildOffset, aDest->Elements(),
                                        aDest->Length(), &bytes) ||
       bytes != aDest->Length()) {
     // Byte ranges are being reported incorrectly

media/libstagefright/binding/Index.cpp

@@ -186,6 +186,31 @@ void SampleIterator::Seek(Microseconds aTime)
   mCurrentSample = syncSample;
 }
 
+Microseconds
+SampleIterator::GetNextKeyframeTime()
+{
+  nsTArray<Moof>& moofs = mIndex->mMoofParser->Moofs();
+  size_t sample = mCurrentSample + 1;
+  size_t moof = mCurrentMoof;
+  while (true) {
+    while (true) {
+      if (moof == moofs.Length()) {
+        return -1;
+      }
+      if (sample < moofs[moof].mIndex.Length()) {
+        break;
+      }
+      sample = 0;
+      ++moof;
+    }
+    if (moofs[moof].mIndex[sample].mSync) {
+      return moofs[moof].mIndex[sample].mDecodeTime;
+    }
+    ++sample;
+  }
+  MOZ_ASSERT(false); // should not be reached.
+}
+
 Index::Index(const stagefright::Vector<MediaSource::Indice>& aIndex,
              Stream* aSource, uint32_t aTrackId, Microseconds aTimestampOffset,
              Monitor* aMonitor)

media/libstagefright/binding/MoofParser.cpp

@@ -286,21 +286,43 @@ public:
 void
 Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Tfdt& aTfdt, Mdhd& aMdhd, Edts& aEdts)
 {
-  if (!aMdhd.mTimescale) {
+  if (!aTfhd.IsValid() || !aTfdt.IsValid() ||
+      !aMdhd.IsValid() || !aEdts.IsValid()) {
     return;
   }
 
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   if ((flags & 0x404) == 0x404) {
     // Can't use these flags together
     reader->DiscardRemaining();
+    mValid = true;
     return;
   }
   uint8_t version = flags >> 24;
 
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t sampleCount = reader->ReadU32();
   if (sampleCount == 0) {
+    mValid = true;
+    return;
+  }
+
+  size_t need =
+    ((flags & 1) ? sizeof(uint32_t) : 0) +
+    ((flags & 4) ? sizeof(uint32_t) : 0);
+  uint16_t flag[] = { 0x100, 0x200, 0x400, 0x800, 0 };
+  for (size_t i = 0; flag[i]; i++) {
+    if (flags & flag[i]) {
+      need += sizeof(uint32_t) * sampleCount;
+    }
+  }
+  if (reader->Remaining() < need) {
     return;
   }
 
@@ -354,13 +376,22 @@ Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Tfdt& aTfdt, Mdhd& aMdhd, Edts& aEdts)
   }
   mTimeRange = Interval<Microseconds>(ctsOrder[0]->mCompositionRange.start,
       ctsOrder.LastElement()->mCompositionRange.end);
+  mValid = true;
 }
 
 Tkhd::Tkhd(Box& aBox)
 {
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
+  size_t need =
+    3*(version ? sizeof(int64_t) : sizeof(int32_t)) + 2*sizeof(int32_t);
+  if (reader->Remaining() < need) {
+    return;
+  }
   if (version == 0) {
     mCreationTime = reader->ReadU32();
     mModificationTime = reader->ReadU32();
@@ -378,13 +409,23 @@ Tkhd::Tkhd(Box& aBox)
   }
   // More stuff that we don't care about
   reader->DiscardRemaining();
+  mValid = true;
 }
 
 Mdhd::Mdhd(Box& aBox)
 {
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
+  size_t need =
+    3*(version ? sizeof(int64_t) : sizeof(int32_t)) + 2*sizeof(uint32_t);
+  if (reader->Remaining() < need) {
+    return;
+  }
+
   if (version == 0) {
     mCreationTime = reader->ReadU32();
     mModificationTime = reader->ReadU32();
@@ -398,17 +439,24 @@ Mdhd::Mdhd(Box& aBox)
   }
   // language and pre_defined=0
   reader->ReadU32();
+  if (mTimescale) {
+    mValid = true;
+  }
 }
 
 Trex::Trex(Box& aBox)
 {
   BoxReader reader(aBox);
+  if (reader->Remaining() < 6*sizeof(uint32_t)) {
+    return;
+  }
   mFlags = reader->ReadU32();
   mTrackId = reader->ReadU32();
   mDefaultSampleDescriptionIndex = reader->ReadU32();
   mDefaultSampleDuration = reader->ReadU32();
   mDefaultSampleSize = reader->ReadU32();
   mDefaultSampleFlags = reader->ReadU32();
+  mValid = true;
 }
 
 Tfhd::Tfhd(Box& aBox, Trex& aTrex) : Trex(aTrex)
@@ -418,7 +466,20 @@ Tfhd::Tfhd(Box& aBox, Trex& aTrex) : Trex(aTrex)
   MOZ_ASSERT(aBox.Parent()->Parent()->IsType("moof"));
 
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   mFlags = reader->ReadU32();
+  size_t need = sizeof(uint32_t) /* trackid */;
+  uint8_t flag[] = { 1, 2, 8, 0x10, 0x20, 0 };
+  for (size_t i = 0; flag[i]; i++) {
+    if (mFlags & flag[i]) {
+      need += sizeof(uint32_t);
+    }
+  }
+  if (reader->Remaining() < need) {
+    return;
+  }
   mBaseDataOffset =
     mFlags & 1 ? reader->ReadU32() : aBox.Parent()->Parent()->Offset();
   mTrackId = reader->ReadU32();
@@ -434,19 +495,28 @@ Tfhd::Tfhd(Box& aBox, Trex& aTrex) : Trex(aTrex)
   if (mFlags & 0x20) {
     mDefaultSampleFlags = reader->ReadU32();
   }
+  mValid = true;
 }
 
 Tfdt::Tfdt(Box& aBox)
 {
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
+  size_t need = version ? sizeof(uint64_t) : sizeof(uint32_t) ;
+  if (reader->Remaining() < need) {
+    return;
+  }
   if (version == 0) {
     mBaseMediaDecodeTime = reader->ReadU32();
   } else if (version == 1) {
     mBaseMediaDecodeTime = reader->ReadU64();
   }
   reader->DiscardRemaining();
+  mValid = true;
 }
 
 Edts::Edts(Box& aBox)
@@ -458,9 +528,16 @@ Edts::Edts(Box& aBox)
   }
 
   BoxReader reader(child);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
-
+  size_t need =
+    sizeof(uint32_t) + 2*(version ? sizeof(int64_t) : sizeof(uint32_t));
+  if (reader->Remaining() < need) {
+    return;
+  }
   uint32_t entryCount = reader->ReadU32();
   NS_ASSERTION(entryCount == 1, "Can't handle videos with multiple edits");
   if (entryCount != 1) {
@@ -483,9 +560,16 @@ Edts::Edts(Box& aBox)
 Saiz::Saiz(Box& aBox) : mAuxInfoType("sinf"), mAuxInfoTypeParameter(0)
 {
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
-
+  size_t need =
+    ((flags & 1) ? 2*sizeof(uint32_t) : 0) + sizeof(uint8_t) + sizeof(uint32_t);
+  if (reader->Remaining() < need) {
+    return;
+  }
   if (flags & 1) {
     mAuxInfoType = reader->ReadU32();
     mAuxInfoTypeParameter = reader->ReadU32();
@@ -497,21 +581,34 @@ Saiz::Saiz(Box& aBox) : mAuxInfoType("sinf"), mAuxInfoTypeParameter(0)
       mSampleInfoSize.AppendElement(defaultSampleInfoSize);
     }
   } else {
-    reader->ReadArray(mSampleInfoSize, count);
+    if (!reader->ReadArray(mSampleInfoSize, count)) {
+      return;
+    }
   }
+  mValid = true;
 }
 
 Saio::Saio(Box& aBox) : mAuxInfoType("sinf"), mAuxInfoTypeParameter(0)
 {
   BoxReader reader(aBox);
+  if (!reader->CanReadType<uint32_t>()) {
+    return;
+  }
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
-
+  size_t need = ((flags & 1) ? (2*sizeof(uint32_t)) : 0) + sizeof(uint32_t);
+  if (reader->Remaining() < need) {
+    return;
+  }
   if (flags & 1) {
     mAuxInfoType = reader->ReadU32();
     mAuxInfoTypeParameter = reader->ReadU32();
   }
   size_t count = reader->ReadU32();
+  need = (version ? sizeof(uint64_t) : sizeof(uint32_t)) * count;
+  if (reader->Remaining() < count) {
+    return;
+  }
   mOffsets.SetCapacity(count);
   if (version == 0) {
     for (size_t i = 0; i < count; i++) {
@@ -522,5 +619,6 @@ Saio::Saio(Box& aBox) : mAuxInfoType("sinf"), mAuxInfoTypeParameter(0)
       mOffsets.AppendElement(reader->ReadU64());
     }
   }
+  mValid = true;
 }
 }

media/libstagefright/binding/include/mp4_demuxer/ByteReader.h

@@ -36,14 +36,14 @@ public:
   void SetData(const nsTArray<uint8_t>& aData)
   {
     MOZ_ASSERT(!mPtr && !mRemaining);
-    mPtr = &aData[0];
+    mPtr = aData.Elements();
     mRemaining = aData.Length();
     mLength = mRemaining;
   }
 
   ~ByteReader()
   {
-    MOZ_ASSERT(!mRemaining);
+    NS_ASSERTION(!mRemaining, "Not all bytes have been processed");
   }
 
   size_t Offset()