From c12678f32b0d9f133b0e0913532dd3cc4f8857b6 Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Sat, 28 Feb 2009 23:46:48 +0000
Subject: [PATCH 01/22] Bug 458231 Frame overflow plays havoc with size of
 <label> or <description> r+sr=roc r=dao for backout of workaround for bug
 69710

---
 layout/generic/nsFrame.cpp                   | 90 ++++++--------------
 toolkit/themes/winstripe/global/checkbox.css |  9 --
 toolkit/themes/winstripe/global/radio.css    |  9 --
 3 files changed, 26 insertions(+), 82 deletions(-)

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 6c3710c6a03..6fb95acb6f2 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -6560,24 +6560,32 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
       computedWidth = PR_MAX(computedWidth, 0);
       reflowState.SetComputedWidth(computedWidth);
     }
-    if (aHeight != NS_INTRINSICSIZE) {
-      nscoord computedHeight =
-        aHeight - reflowState.mComputedBorderPadding.TopBottom();
-      computedHeight = PR_MAX(computedHeight, 0);
-      reflowState.SetComputedHeight(computedHeight);
-    } else {
-      reflowState.SetComputedHeight(
-        ComputeSize(aRenderingContext, availSize, availSize.width,
-                    nsSize(reflowState.mComputedMargin.LeftRight(),
-                           reflowState.mComputedMargin.TopBottom()),
-                    nsSize(reflowState.mComputedBorderPadding.LeftRight() -
-                             reflowState.mComputedPadding.LeftRight(),
-                           reflowState.mComputedBorderPadding.TopBottom() -
-                             reflowState.mComputedPadding.TopBottom()),
-                    nsSize(reflowState.mComputedPadding.LeftRight(),
-                           reflowState.mComputedPadding.TopBottom()),
-                    PR_FALSE).height
-        );
+
+    // Most child frames of box frames (e.g. subdocument or scroll frames)
+    // need to be constrained to the provided size and overflow as necessary.
+    // The one exception are block frames, because we need to know their
+    // natural height excluding any overflow area which may be caused by
+    // various CSS effects such as shadow or outline.
+    if (!IsFrameOfType(eBlockFrame)) {
+      if (aHeight != NS_INTRINSICSIZE) {
+        nscoord computedHeight =
+          aHeight - reflowState.mComputedBorderPadding.TopBottom();
+        computedHeight = PR_MAX(computedHeight, 0);
+        reflowState.SetComputedHeight(computedHeight);
+      } else {
+        reflowState.SetComputedHeight(
+          ComputeSize(aRenderingContext, availSize, availSize.width,
+                      nsSize(reflowState.mComputedMargin.LeftRight(),
+                             reflowState.mComputedMargin.TopBottom()),
+                      nsSize(reflowState.mComputedBorderPadding.LeftRight() -
+                               reflowState.mComputedPadding.LeftRight(),
+                             reflowState.mComputedBorderPadding.TopBottom() -
+                               reflowState.mComputedPadding.TopBottom()),
+                      nsSize(reflowState.mComputedPadding.LeftRight(),
+                               reflowState.mComputedPadding.TopBottom()),
+                      PR_FALSE).height
+          );
+      }
     }
 
     // Box layout calls SetRect before Layout, whereas non-box layout
@@ -6607,52 +6615,6 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
 
     NS_ASSERTION(NS_FRAME_IS_COMPLETE(status), "bad status");
 
-   // printf("width: %d, height: %d\n", aDesiredSize.mCombinedArea.width, aDesiredSize.mCombinedArea.height);
-
-    // see if the overflow option is set. If it is then if our child's bounds overflow then
-    // we will set the child's rect to include the overflow size.
-    if (GetStateBits() & NS_FRAME_OUTSIDE_CHILDREN) {
-      // This kinda sucks. We should be able to handle the case
-      // where there's overflow above or to the left of the
-      // origin. But for now just chop that stuff off.
-      // (note: For RTL mode, replace "to the left of the origin" 
-      // with "to the right of the range [0, aDesiredSize.width]")
-
-      //printf("OutsideChildren width=%d, height=%d\n", aDesiredSize.mOverflowArea.width, aDesiredSize.mOverflowArea.height);
-
-      if (NS_STYLE_DIRECTION_LTR == GetStyleVisibility()->mDirection) {
-        // LTR mode -- extend for overflow on right side.
-        aDesiredSize.width = PR_MAX(aDesiredSize.width, 
-                                    aDesiredSize.mOverflowArea.XMost());
-      } else {
-        // RTL mode -- extend for overflow on left side.
-        nscoord leftmostValue = PR_MIN(0, aDesiredSize.mOverflowArea.x);
-        // Note: If anything, this increases aDesiredSize.width, because
-        // leftmostValue is non-positive.
-        aDesiredSize.width = aDesiredSize.width - leftmostValue;
-      }
-      if (aDesiredSize.width <= aWidth) {
-        aDesiredSize.height = aDesiredSize.mOverflowArea.YMost();
-      } else {
-        nscoord computedWidth = aDesiredSize.width -
-          reflowState.mComputedBorderPadding.LeftRight();
-        computedWidth = PR_MAX(computedWidth, 0);
-        reflowState.SetComputedWidth(computedWidth);
-        reflowState.availableWidth = aDesiredSize.width;
-        DidReflow(aPresContext, &reflowState, NS_FRAME_REFLOW_FINISHED);
-        #ifdef DEBUG_REFLOW
-        nsAdaptorAddIndents();
-        nsAdaptorPrintReason(reflowState);
-        printf("\n");
-        #endif
-        AddStateBits(NS_FRAME_IS_DIRTY);
-        WillReflow(aPresContext);
-        Reflow(aPresContext, aDesiredSize, reflowState, status);
-        if (GetStateBits() & NS_FRAME_OUTSIDE_CHILDREN)
-          aDesiredSize.height = aDesiredSize.mOverflowArea.YMost();
-      }
-    }
-
     if (redrawAfterReflow) {
        nsRect r = GetRect();
        r.width = aDesiredSize.width;
diff --git a/toolkit/themes/winstripe/global/checkbox.css b/toolkit/themes/winstripe/global/checkbox.css
index ed1a0b11d93..d47d401c821 100644
--- a/toolkit/themes/winstripe/global/checkbox.css
+++ b/toolkit/themes/winstripe/global/checkbox.css
@@ -83,15 +83,6 @@ checkbox[disabled="true"] {
   color: GrayText;
 }
 
-/* XXX Hack to work around bug 458231 */
-checkbox:-moz-system-metric(windows-classic) {
-  text-shadow: 1px 1px transparent;
-}
-
-checkbox:-moz-system-metric(windows-classic) > .checkbox-label-box > .checkbox-label {
-  margin-bottom: -2px !important;
-}
-
 checkbox[disabled="true"]:-moz-system-metric(windows-classic) {
   color: ThreeDShadow;
   text-shadow: 1px 1px ThreeDHighlight;
diff --git a/toolkit/themes/winstripe/global/radio.css b/toolkit/themes/winstripe/global/radio.css
index 9f3010ab6f5..933b615623e 100644
--- a/toolkit/themes/winstripe/global/radio.css
+++ b/toolkit/themes/winstripe/global/radio.css
@@ -86,15 +86,6 @@ radio[disabled="true"] {
   color: GrayText;
 }
 
-/* XXX Hack to work around bug 458231 */
-radio:-moz-system-metric(windows-classic) {
-  text-shadow: 1px 1px transparent;
-}
-
-radio:-moz-system-metric(windows-classic) > .radio-label-box > .radio-label {
-  margin-bottom: -2px !important;
-}
-
 radio[disabled="true"]:-moz-system-metric(windows-classic) {
   color: ThreeDShadow;
   text-shadow: 1px 1px ThreeDHighlight;

From 4d435d88b866338a71cf003613abb9ea66da34b7 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sat, 28 Feb 2009 19:42:37 -0800
Subject: [PATCH 02/22] Back out patch for bug 458231 (Frame overflow plays
 havoc with size of <label> or <description>) for failing reftest
 386470-1a.html

---
 layout/generic/nsFrame.cpp                   | 90 ++++++++++++++------
 toolkit/themes/winstripe/global/checkbox.css |  9 ++
 toolkit/themes/winstripe/global/radio.css    |  9 ++
 3 files changed, 82 insertions(+), 26 deletions(-)

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 6fb95acb6f2..6c3710c6a03 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -6560,32 +6560,24 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
       computedWidth = PR_MAX(computedWidth, 0);
       reflowState.SetComputedWidth(computedWidth);
     }
-
-    // Most child frames of box frames (e.g. subdocument or scroll frames)
-    // need to be constrained to the provided size and overflow as necessary.
-    // The one exception are block frames, because we need to know their
-    // natural height excluding any overflow area which may be caused by
-    // various CSS effects such as shadow or outline.
-    if (!IsFrameOfType(eBlockFrame)) {
-      if (aHeight != NS_INTRINSICSIZE) {
-        nscoord computedHeight =
-          aHeight - reflowState.mComputedBorderPadding.TopBottom();
-        computedHeight = PR_MAX(computedHeight, 0);
-        reflowState.SetComputedHeight(computedHeight);
-      } else {
-        reflowState.SetComputedHeight(
-          ComputeSize(aRenderingContext, availSize, availSize.width,
-                      nsSize(reflowState.mComputedMargin.LeftRight(),
-                             reflowState.mComputedMargin.TopBottom()),
-                      nsSize(reflowState.mComputedBorderPadding.LeftRight() -
-                               reflowState.mComputedPadding.LeftRight(),
-                             reflowState.mComputedBorderPadding.TopBottom() -
-                               reflowState.mComputedPadding.TopBottom()),
-                      nsSize(reflowState.mComputedPadding.LeftRight(),
-                               reflowState.mComputedPadding.TopBottom()),
-                      PR_FALSE).height
-          );
-      }
+    if (aHeight != NS_INTRINSICSIZE) {
+      nscoord computedHeight =
+        aHeight - reflowState.mComputedBorderPadding.TopBottom();
+      computedHeight = PR_MAX(computedHeight, 0);
+      reflowState.SetComputedHeight(computedHeight);
+    } else {
+      reflowState.SetComputedHeight(
+        ComputeSize(aRenderingContext, availSize, availSize.width,
+                    nsSize(reflowState.mComputedMargin.LeftRight(),
+                           reflowState.mComputedMargin.TopBottom()),
+                    nsSize(reflowState.mComputedBorderPadding.LeftRight() -
+                             reflowState.mComputedPadding.LeftRight(),
+                           reflowState.mComputedBorderPadding.TopBottom() -
+                             reflowState.mComputedPadding.TopBottom()),
+                    nsSize(reflowState.mComputedPadding.LeftRight(),
+                           reflowState.mComputedPadding.TopBottom()),
+                    PR_FALSE).height
+        );
     }
 
     // Box layout calls SetRect before Layout, whereas non-box layout
@@ -6615,6 +6607,52 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
 
     NS_ASSERTION(NS_FRAME_IS_COMPLETE(status), "bad status");
 
+   // printf("width: %d, height: %d\n", aDesiredSize.mCombinedArea.width, aDesiredSize.mCombinedArea.height);
+
+    // see if the overflow option is set. If it is then if our child's bounds overflow then
+    // we will set the child's rect to include the overflow size.
+    if (GetStateBits() & NS_FRAME_OUTSIDE_CHILDREN) {
+      // This kinda sucks. We should be able to handle the case
+      // where there's overflow above or to the left of the
+      // origin. But for now just chop that stuff off.
+      // (note: For RTL mode, replace "to the left of the origin" 
+      // with "to the right of the range [0, aDesiredSize.width]")
+
+      //printf("OutsideChildren width=%d, height=%d\n", aDesiredSize.mOverflowArea.width, aDesiredSize.mOverflowArea.height);
+
+      if (NS_STYLE_DIRECTION_LTR == GetStyleVisibility()->mDirection) {
+        // LTR mode -- extend for overflow on right side.
+        aDesiredSize.width = PR_MAX(aDesiredSize.width, 
+                                    aDesiredSize.mOverflowArea.XMost());
+      } else {
+        // RTL mode -- extend for overflow on left side.
+        nscoord leftmostValue = PR_MIN(0, aDesiredSize.mOverflowArea.x);
+        // Note: If anything, this increases aDesiredSize.width, because
+        // leftmostValue is non-positive.
+        aDesiredSize.width = aDesiredSize.width - leftmostValue;
+      }
+      if (aDesiredSize.width <= aWidth) {
+        aDesiredSize.height = aDesiredSize.mOverflowArea.YMost();
+      } else {
+        nscoord computedWidth = aDesiredSize.width -
+          reflowState.mComputedBorderPadding.LeftRight();
+        computedWidth = PR_MAX(computedWidth, 0);
+        reflowState.SetComputedWidth(computedWidth);
+        reflowState.availableWidth = aDesiredSize.width;
+        DidReflow(aPresContext, &reflowState, NS_FRAME_REFLOW_FINISHED);
+        #ifdef DEBUG_REFLOW
+        nsAdaptorAddIndents();
+        nsAdaptorPrintReason(reflowState);
+        printf("\n");
+        #endif
+        AddStateBits(NS_FRAME_IS_DIRTY);
+        WillReflow(aPresContext);
+        Reflow(aPresContext, aDesiredSize, reflowState, status);
+        if (GetStateBits() & NS_FRAME_OUTSIDE_CHILDREN)
+          aDesiredSize.height = aDesiredSize.mOverflowArea.YMost();
+      }
+    }
+
     if (redrawAfterReflow) {
        nsRect r = GetRect();
        r.width = aDesiredSize.width;
diff --git a/toolkit/themes/winstripe/global/checkbox.css b/toolkit/themes/winstripe/global/checkbox.css
index d47d401c821..ed1a0b11d93 100644
--- a/toolkit/themes/winstripe/global/checkbox.css
+++ b/toolkit/themes/winstripe/global/checkbox.css
@@ -83,6 +83,15 @@ checkbox[disabled="true"] {
   color: GrayText;
 }
 
+/* XXX Hack to work around bug 458231 */
+checkbox:-moz-system-metric(windows-classic) {
+  text-shadow: 1px 1px transparent;
+}
+
+checkbox:-moz-system-metric(windows-classic) > .checkbox-label-box > .checkbox-label {
+  margin-bottom: -2px !important;
+}
+
 checkbox[disabled="true"]:-moz-system-metric(windows-classic) {
   color: ThreeDShadow;
   text-shadow: 1px 1px ThreeDHighlight;
diff --git a/toolkit/themes/winstripe/global/radio.css b/toolkit/themes/winstripe/global/radio.css
index 933b615623e..9f3010ab6f5 100644
--- a/toolkit/themes/winstripe/global/radio.css
+++ b/toolkit/themes/winstripe/global/radio.css
@@ -86,6 +86,15 @@ radio[disabled="true"] {
   color: GrayText;
 }
 
+/* XXX Hack to work around bug 458231 */
+radio:-moz-system-metric(windows-classic) {
+  text-shadow: 1px 1px transparent;
+}
+
+radio:-moz-system-metric(windows-classic) > .radio-label-box > .radio-label {
+  margin-bottom: -2px !important;
+}
+
 radio[disabled="true"]:-moz-system-metric(windows-classic) {
   color: ThreeDShadow;
   text-shadow: 1px 1px ThreeDHighlight;

From 532f2948744f50434dd953d90cacfb0b930d97ab Mon Sep 17 00:00:00 2001
From: Daniel Veditz <dveditz@cruzio.com>
Date: Sun, 1 Mar 2009 00:45:24 -0800
Subject: [PATCH 03/22] bug 480357 change default ssl domain display,
 r/ui-r/a=mconnor

---
 browser/app/profile/firefox.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index ea06a3f1220..ef0d8db0294 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -771,7 +771,7 @@ pref("browser.ssl_override_behavior", 2);
 // 0 - do not show domain
 // 1 - show effectiveTLD + 1 (e.g. mozilla.org)
 // 2 - show full domain (e.g. bugzilla.mozilla.org)
-pref("browser.identity.ssl_domain_display", 0);
+pref("browser.identity.ssl_domain_display", 1);
 
 // True if the user should be prompted when a web application supports
 // offline apps.

From 943791bbcb7bd235b8b0fdd90a914074447dc0bb Mon Sep 17 00:00:00 2001
From: Daniel Veditz <dveditz@cruzio.com>
Date: Sun, 1 Mar 2009 01:15:25 -0800
Subject: [PATCH 04/22] bug 478901 update to libpng 1.2.35, patch by Glenn
 Randers-Pehrson, r=Joe Drew, sr=dveditz, blocking=vlad

---
 modules/libimg/png/CHANGES    | 21 ++++++++++++++++++++-
 modules/libimg/png/LICENSE    |  4 ++--
 modules/libimg/png/MOZCHANGES |  2 ++
 modules/libimg/png/README     | 14 +++++++-------
 modules/libimg/png/libpng.txt | 12 +++++++-----
 modules/libimg/png/png.c      |  4 ++--
 modules/libimg/png/png.h      | 27 ++++++++++++++++-----------
 modules/libimg/png/pngconf.h  |  6 ++++--
 modules/libimg/png/pngget.c   |  2 +-
 modules/libimg/png/pngread.c  |  8 ++++----
 modules/libimg/png/pngrtran.c | 21 +++++++++++++--------
 modules/libimg/png/pngrutil.c | 12 ++++++++++--
 modules/libimg/png/pngset.c   | 19 +++++++++++--------
 modules/libimg/png/pngwio.c   |  6 +++---
 modules/libimg/png/pngwrite.c |  2 +-
 15 files changed, 103 insertions(+), 57 deletions(-)

diff --git a/modules/libimg/png/CHANGES b/modules/libimg/png/CHANGES
index 3f04811b31e..da52eab4772 100644
--- a/modules/libimg/png/CHANGES
+++ b/modules/libimg/png/CHANGES
@@ -2186,7 +2186,7 @@ version 1.2.30beta03 [July 6, 2008]
 version 1.2.30beta04 [July 10, 2008]
   Merged more cosmetic whitespace changes from libpng-1.4.0beta19.
 
-version 1.0.38rc01, 1.2.30rc01 [December 18, 2008]
+version 1.0.38rc01, 1.2.30rc01 [July 18, 2008]
   No changes.
 
 version 1.0.38rc02, 1.2.30rc02 [July 21, 2008]
@@ -2309,6 +2309,25 @@ version 1.0.42rc01, 1.2.34rc01 [December 11, 2008]
 version 1.0.42, 1.2.34 [December 18, 2008]
   No changes.
 
+version 1.2.35beta01 [February 4, 2009]
+  Zero out some arrays of pointers after png_malloc(). (Tavis Ormandy)
+
+version 1.2.35beta02 [Feburary 4, 2009]
+  Zero out more arrays of pointers after png_malloc().
+
+version 1.2.35beta03 [February 5, 2009]
+  Use png_memset() instead of a loop to intialize pointers.  We realize
+    this will not work on platforms where the NULL pointer is not all zeroes.
+
+version 1.2.35rc01 [February 11, 2009]
+  No changes.
+
+version 1.2.35rc02 [February 12, 2009]
+  Fix typo in new png_memset call in pngset.c (png_color should be png_charp)
+
+version 1.0.43 and 1.2.35 [February 14, 2009]
+  No changes.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
diff --git a/modules/libimg/png/LICENSE b/modules/libimg/png/LICENSE
index 4597e138f31..50b4041cce5 100644
--- a/modules/libimg/png/LICENSE
+++ b/modules/libimg/png/LICENSE
@@ -8,7 +8,7 @@ COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
 If you modify libpng you may insert additional notices immediately following
 this sentence.
 
-libpng versions 1.2.6, August 15, 2004, through 1.2.34, December 18, 2008, are
+libpng versions 1.2.6, August 15, 2004, through 1.2.35, February 14, 2009, are
 Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -106,4 +106,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-December 18, 2008
+February 14, 2009
diff --git a/modules/libimg/png/MOZCHANGES b/modules/libimg/png/MOZCHANGES
index 120199708fb..1e8af5ecc02 100644
--- a/modules/libimg/png/MOZCHANGES
+++ b/modules/libimg/png/MOZCHANGES
@@ -1,6 +1,8 @@
 
 Changes made to pristine png source by mozilla.org developers.
 
+2009/02/19  -- Synced with libpng-1.2.35 (bug #478901).
+
 2008/08/21  -- Synced with libpng-1.2.31 (bug #418900).
 
 2008/03/29  -- Initialize prev_row for each APNG frame, only when
diff --git a/modules/libimg/png/README b/modules/libimg/png/README
index 3dd92f41f7b..6d57ac478bf 100644
--- a/modules/libimg/png/README
+++ b/modules/libimg/png/README
@@ -1,4 +1,4 @@
-README for libpng version 1.2.34 - December 18, 2008 (shared library 12.0)
+README for libpng version 1.2.35 - February 14, 2009 (shared library 12.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -194,11 +194,11 @@ Files in this distribution:
        descrip.mms      =>  VMS makefile for MMS or MMK
        makefile.std     =>  Generic UNIX makefile (cc, creates static libpng.a)
        makefile.elf     =>  Linux/ELF makefile symbol versioning,
-                            gcc, creates libpng12.so.0.1.2.34)
+                            gcc, creates libpng12.so.0.1.2.35)
        makefile.linux   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.34)
+                            (gcc, creates libpng12.so.0.1.2.35)
        makefile.gcmmx   =>  Linux/ELF makefile
-                            (gcc, creates libpng12.so.0.1.2.34,
+                            (gcc, creates libpng12.so.0.1.2.35,
                             uses assembler code tuned for Intel MMX platform)
        makefile.gcc     =>  Generic makefile (gcc, creates static libpng.a)
        makefile.knr     =>  Archaic UNIX Makefile that converts files with
@@ -220,12 +220,12 @@ Files in this distribution:
        makefile.openbsd =>  OpenBSD makefile
        makefile.sgi     =>  Silicon Graphics IRIX (cc, creates static lib)
        makefile.sggcc   =>  Silicon Graphics
-                            (gcc, creates libpng12.so.0.1.2.34)
+                            (gcc, creates libpng12.so.0.1.2.35)
        makefile.sunos   =>  Sun makefile
        makefile.solaris =>  Solaris 2.X makefile
-                            (gcc, creates libpng12.so.0.1.2.34)
+                            (gcc, creates libpng12.so.0.1.2.35)
        makefile.so9     =>  Solaris 9 makefile
-                            (gcc, creates libpng12.so.0.1.2.34)
+                            (gcc, creates libpng12.so.0.1.2.35)
        makefile.32sunu  =>  Sun Ultra 32-bit makefile
        makefile.64sunu  =>  Sun Ultra 64-bit makefile
        makefile.sco     =>  For SCO OSr5  ELF and Unixware 7 with Native cc
diff --git a/modules/libimg/png/libpng.txt b/modules/libimg/png/libpng.txt
index f9921aaa603..4f56736716a 100644
--- a/modules/libimg/png/libpng.txt
+++ b/modules/libimg/png/libpng.txt
@@ -1,15 +1,15 @@
   libpng.txt - A description on how to use and modify libpng
   
- libpng version 1.2.34 - December 18, 2008
+ libpng version 1.2.35 - February 14, 2009
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
- Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ Copyright (c) 1998-2009 Glenn Randers-Pehrson
  For conditions of distribution and use, see copyright
  notice in png.h.
   
  Based on:
   
- libpng versions 0.97, January 1998, through 1.2.34 - December 18, 2008
+ libpng versions 0.97, January 1998, through 1.2.35 - February 14, 2009
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2008 Glenn Randers-Pehrson
 
@@ -471,6 +471,8 @@ row_pointers prior to calling png_read_png() with
          "Image is too wide to process in memory");
    row_pointers = png_malloc(png_ptr,
       height*png_sizeof(png_bytep));
+   for (int i=0; i<height, i++)
+      row_pointers[i]=NULL;  /* security precaution */
    for (int i=0; i<height, i++)
       row_pointers[i]=png_malloc(png_ptr,
          width*pixel_size);
@@ -2851,13 +2853,13 @@ application:
 
 IX. Y2K Compliance in libpng
 
-August 21, 2008
+February 14, 2009
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.2.31 are Y2K compliant.  It is my belief that earlier
+upward through 1.2.35 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has three year fields.  One is a 2-byte unsigned integer that
diff --git a/modules/libimg/png/png.c b/modules/libimg/png/png.c
index ae78dd37900..2f8fcb0c042 100644
--- a/modules/libimg/png/png.c
+++ b/modules/libimg/png/png.c
@@ -13,7 +13,7 @@
 #include "png.h"
 
 /* Generate a compiler error if there is an old png.h in the search path. */
-typedef version_1_2_34 Your_png_h_is_not_version_1_2_34;
+typedef version_1_2_35 Your_png_h_is_not_version_1_2_35;
 
 /* Version information for C files.  This had better match the version
  * string defined in png.h.  */
@@ -697,7 +697,7 @@ png_charp PNGAPI
 png_get_copyright(png_structp png_ptr)
 {
    png_ptr = png_ptr;  /* silence compiler warning about unused png_ptr */
-   return ((png_charp) "\n libpng version 1.2.34 - December 18, 2008\n\
+   return ((png_charp) "\n libpng version 1.2.35 - February 14, 2009\n\
    Copyright (c) 1998-2008 Glenn Randers-Pehrson\n\
    Copyright (c) 1996-1997 Andreas Dilger\n\
    Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.\n");
diff --git a/modules/libimg/png/png.h b/modules/libimg/png/png.h
index b9bee0b1789..969c8e171a0 100644
--- a/modules/libimg/png/png.h
+++ b/modules/libimg/png/png.h
@@ -1,14 +1,14 @@
 /* png.h - header file for PNG reference library
  *
- * libpng version 1.2.34 - December 18, 2008
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * libpng version 1.2.35 - February 14, 2009
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
  * Authors and maintainers:
  *  libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat
  *  libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger
- *  libpng versions 0.97, January 1998, through 1.2.34 - December 18, 2008: Glenn
+ *  libpng versions 0.97, January 1998, through 1.2.35 - February 14, 2009: Glenn
  *  See also "Contributing Authors", below.
  *
  * Note about libpng version numbers:
@@ -217,6 +217,11 @@
  *    1.2.34rc01              13    10234  12.so.0.34[.0]
  *    1.0.42                  10    10042  10.so.0.42[.0]
  *    1.2.34                  13    10234  12.so.0.34[.0]
+ *    1.2.35beta01-03         13    10235  12.so.0.35[.0]
+ *    1.0.43rc01-02           10    10043  10.so.0.43[.0]
+ *    1.2.35rc01-02           13    10235  12.so.0.35[.0]
+ *    1.0.43                  10    10043  10.so.0.43[.0]
+ *    1.2.35                  13    10235  12.so.0.35[.0]
  *
  *    Henceforth the source version will match the shared-library major
  *    and minor numbers; the shared-library major version number will be
@@ -246,7 +251,7 @@
  * If you modify libpng you may insert additional notices immediately following
  * this sentence.
  *
- * libpng versions 1.2.6, August 15, 2004, through 1.2.34, December 18, 2008, are
+ * libpng versions 1.2.6, August 15, 2004, through 1.2.35, February 14, 2009, are
  * Copyright (c) 2004, 2006-2008 Glenn Randers-Pehrson, and are
  * distributed according to the same disclaimer and license as libpng-1.2.5
  * with the following individual added to the list of Contributing Authors:
@@ -358,13 +363,13 @@
  * Y2K compliance in libpng:
  * =========================
  *
- *    December 18, 2008
+ *    February 14, 2009
  *
  *    Since the PNG Development group is an ad-hoc body, we can't make
  *    an official declaration.
  *
  *    This is your unofficial assurance that libpng from version 0.71 and
- *    upward through 1.2.34 are Y2K compliant.  It is my belief that earlier
+ *    upward through 1.2.35 are Y2K compliant.  It is my belief that earlier
  *    versions were also Y2K compliant.
  *
  *    Libpng only has three year fields.  One is a 2-byte unsigned integer
@@ -420,9 +425,9 @@
  */
 
 /* Version information for png.h - this should match the version in png.c */
-#define PNG_LIBPNG_VER_STRING "1.2.34"
+#define PNG_LIBPNG_VER_STRING "1.2.35"
 #define PNG_HEADER_VERSION_STRING \
-   " libpng version 1.2.34 - December 18, 2008\n"
+   " libpng version 1.2.35 - February 14, 2009\n"
 
 #define PNG_LIBPNG_VER_SONUM   0
 #define PNG_LIBPNG_VER_DLLNUM  13
@@ -430,7 +435,7 @@
 /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
 #define PNG_LIBPNG_VER_MAJOR   1
 #define PNG_LIBPNG_VER_MINOR   2
-#define PNG_LIBPNG_VER_RELEASE 34
+#define PNG_LIBPNG_VER_RELEASE 35
 /* This should match the numeric part of the final component of
  * PNG_LIBPNG_VER_STRING, omitting any leading zero: */
 
@@ -458,7 +463,7 @@
  * Versions 0.7 through 1.0.0 were in the range 0 to 100 here (only
  * version 1.0.0 was mis-numbered 100 instead of 10000).  From
  * version 1.0.1 it's    xxyyzz, where x=major, y=minor, z=release */
-#define PNG_LIBPNG_VER 10234 /* 1.2.34 */
+#define PNG_LIBPNG_VER 10235 /* 1.2.35 */
 
 #ifndef PNG_VERSION_INFO_ONLY
 /* include the compression library's header */
@@ -1534,7 +1539,7 @@ struct png_struct_def
 /* This triggers a compiler error in png.c, if png.c and png.h
  * do not agree upon the version number.
  */
-typedef png_structp version_1_2_34;
+typedef png_structp version_1_2_35;
 
 typedef png_struct FAR * FAR * png_structpp;
 
diff --git a/modules/libimg/png/pngconf.h b/modules/libimg/png/pngconf.h
index e47d53c3595..f6a44659c2b 100644
--- a/modules/libimg/png/pngconf.h
+++ b/modules/libimg/png/pngconf.h
@@ -1,9 +1,9 @@
 
 /* pngconf.h - machine configurable file for libpng
  *
- * libpng version 1.2.34 - December 18, 2008
+ * libpng version 1.2.35 - February 14, 2009
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  */
@@ -235,6 +235,8 @@
 #  include <windows.h>
    /* Console I/O functions are not supported on WindowsCE */
 #  define PNG_NO_CONSOLE_IO
+   /* abort() may not be supported on some/all Windows CE platforms */
+#  define PNG_ABORT() exit(-1)
 #  ifdef PNG_DEBUG
 #    undef PNG_DEBUG
 #  endif
diff --git a/modules/libimg/png/pngget.c b/modules/libimg/png/pngget.c
index f9bb43da937..2d741988976 100644
--- a/modules/libimg/png/pngget.c
+++ b/modules/libimg/png/pngget.c
@@ -1044,7 +1044,7 @@ png_get_mmx_rowbytes_threshold (png_structp png_ptr)
 #endif /* ?PNG_ASSEMBLER_CODE_SUPPORTED */
 
 #ifdef PNG_SET_USER_LIMITS_SUPPORTED
-/* these functions were added to libpng 1.2.6 */
+/* These functions were added to libpng 1.2.6 */
 png_uint_32 PNGAPI
 png_get_user_width_max (png_structp png_ptr)
 {
diff --git a/modules/libimg/png/pngread.c b/modules/libimg/png/pngread.c
index e964e3e295c..8b8a153f022 100644
--- a/modules/libimg/png/pngread.c
+++ b/modules/libimg/png/pngread.c
@@ -1,9 +1,9 @@
 
 /* pngread.c - read a PNG file
  *
- * Last changed in libpng 1.2.30 [August 13, 2008]
+ * Last changed in libpng 1.2.35 [February 14, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -1577,11 +1577,11 @@ png_read_png(png_structp png_ptr, png_infop info_ptr,
 #ifdef PNG_FREE_ME_SUPPORTED
       info_ptr->free_me |= PNG_FREE_ROWS;
 #endif
+      png_memset(info_ptr->row_pointers, 0, info_ptr->height
+         * png_sizeof(png_bytep));
       for (row = 0; row < (int)info_ptr->height; row++)
-      {
          info_ptr->row_pointers[row] = (png_bytep)png_malloc(png_ptr,
             png_get_rowbytes(png_ptr, info_ptr));
-      }
    }
 
    png_read_image(png_ptr, info_ptr->row_pointers);
diff --git a/modules/libimg/png/pngrtran.c b/modules/libimg/png/pngrtran.c
index f3892759694..a916f54febe 100644
--- a/modules/libimg/png/pngrtran.c
+++ b/modules/libimg/png/pngrtran.c
@@ -1,9 +1,9 @@
 
 /* pngrtran.c - transforms the data in a row for PNG readers
  *
- * Last changed in libpng 1.2.30 [August 13, 2008]
+ * Last changed in libpng 1.2.35 [February 14, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -309,9 +309,7 @@ png_set_dither(png_structp png_ptr, png_colorp palette,
 
          hash = (png_dsortpp)png_malloc(png_ptr, (png_uint_32)(769 *
             png_sizeof(png_dsortp)));
-         for (i = 0; i < 769; i++)
-            hash[i] = NULL;
-/*         png_memset(hash, 0, 769 * png_sizeof(png_dsortp)); */
+         png_memset(hash, 0, 769 * png_sizeof(png_dsortp));
 
          num_new_palette = num_palette;
 
@@ -684,7 +682,7 @@ png_set_rgb_to_gray_fixed(png_structp png_ptr, int error_action,
       }
       png_ptr->rgb_to_gray_red_coeff   = red_int;
       png_ptr->rgb_to_gray_green_coeff = green_int;
-      png_ptr->rgb_to_gray_blue_coeff  = 
+      png_ptr->rgb_to_gray_blue_coeff  =
          (png_uint_16)(32768 - red_int - green_int);
    }
 }
@@ -1329,7 +1327,7 @@ png_do_read_transformations(png_structp png_ptr)
       if (rgb_error)
       {
          png_ptr->rgb_to_gray_status=1;
-         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) == 
+         if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
              PNG_RGB_TO_GRAY_WARN)
             png_warning(png_ptr, "png_do_rgb_to_gray found nongray pixel");
          if ((png_ptr->transformations & PNG_RGB_TO_GRAY) ==
@@ -3836,7 +3834,7 @@ png_do_expand(png_row_infop row_info, png_bytep row,
                dp = row + (row_info->rowbytes << 1) - 1;
                for (i = 0; i < row_width; i++)
                {
-                  if (*(sp - 1) == gray_high && *(sp) == gray_low) 
+                  if (*(sp - 1) == gray_high && *(sp) == gray_low)
                   {
                      *dp-- = 0;
                      *dp-- = 0;
@@ -4133,6 +4131,8 @@ png_build_gamma_table(png_structp png_ptr)
         double fin, fout;
         png_uint_32 last, max;
 
+        png_memset(png_ptr->gamma_16_table, 0, num * png_sizeof(png_uint_16p)); 
+
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_table[i] = (png_uint_16p)png_malloc(png_ptr,
@@ -4188,6 +4188,8 @@ png_build_gamma_table(png_structp png_ptr)
         png_ptr->gamma_16_to_1 = (png_uint_16pp)png_malloc(png_ptr,
            (png_uint_32)(num * png_sizeof(png_uint_16p )));
 
+        png_memset(png_ptr->gamma_16_to_1, 0, num * png_sizeof(png_uint_16p)); 
+
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_to_1[i] = (png_uint_16p)png_malloc(png_ptr,
@@ -4211,6 +4213,9 @@ png_build_gamma_table(png_structp png_ptr)
         png_ptr->gamma_16_from_1 = (png_uint_16pp)png_malloc(png_ptr,
            (png_uint_32)(num * png_sizeof(png_uint_16p)));
 
+        png_memset(png_ptr->gamma_16_from_1, 0,
+           num * png_sizeof(png_uint_16p)); 
+
         for (i = 0; i < num; i++)
         {
            png_ptr->gamma_16_from_1[i] = (png_uint_16p)png_malloc(png_ptr,
diff --git a/modules/libimg/png/pngrutil.c b/modules/libimg/png/pngrutil.c
index 58ae8f93dd0..25d1d27c5da 100644
--- a/modules/libimg/png/pngrutil.c
+++ b/modules/libimg/png/pngrutil.c
@@ -1123,6 +1123,7 @@ png_handle_sPLT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_debug(1, "in png_handle_sPLT");
 
+
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before sPLT");
    else if (png_ptr->mode & PNG_HAVE_IDAT)
@@ -1909,6 +1910,7 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_debug(1, "in png_handle_tEXt");
 
+
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before tEXt");
 
@@ -1925,6 +1927,7 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 #endif
 
    png_free(png_ptr, png_ptr->chunkdata);
+
    png_ptr->chunkdata = (png_charp)png_malloc_warn(png_ptr, length + 1);
    if (png_ptr->chunkdata == NULL)
    {
@@ -1942,6 +1945,7 @@ png_handle_tEXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    }
 
    key = png_ptr->chunkdata;
+
    key[slength] = 0x00;
 
    for (text = key; *text; text++)
@@ -1991,6 +1995,8 @@ png_handle_zTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
    png_size_t slength, prefix_len, data_len;
 
    png_debug(1, "in png_handle_zTXt");
+
+
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before zTXt");
 
@@ -2095,6 +2101,7 @@ png_handle_iTXt(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_debug(1, "in png_handle_iTXt");
 
+
    if (!(png_ptr->mode & PNG_HAVE_IHDR))
       png_error(png_ptr, "Missing IHDR before iTXt");
 
@@ -2383,6 +2390,7 @@ png_handle_unknown(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 
    png_debug(1, "in png_handle_unknown");
 
+
    if (png_ptr->mode & PNG_HAVE_IDAT)
    {
 #ifdef PNG_USE_LOCAL_ARRAYS
@@ -3371,9 +3379,9 @@ defined(PNG_USER_TRANSFORM_PTR_SUPPORTED)
    png_debug1(3, "width = %lu,", png_ptr->width);
    png_debug1(3, "height = %lu,", png_ptr->height);
    png_debug1(3, "iwidth = %lu,", png_ptr->iwidth);
-   png_debug1(3, "num_rows = %lu", png_ptr->num_rows);
+   png_debug1(3, "num_rows = %lu,", png_ptr->num_rows);
    png_debug1(3, "rowbytes = %lu,", png_ptr->rowbytes);
-   png_debug1(3, "irowbytes = %lu,", png_ptr->irowbytes);
+   png_debug1(3, "irowbytes = %lu", png_ptr->irowbytes);
 
    png_ptr->flags |= PNG_FLAG_ROW_INIT;
 }
diff --git a/modules/libimg/png/pngset.c b/modules/libimg/png/pngset.c
index 1e303fbd9e1..77fbc7cc386 100644
--- a/modules/libimg/png/pngset.c
+++ b/modules/libimg/png/pngset.c
@@ -1,9 +1,9 @@
 
 /* pngset.c - storage of image information into info struct
  *
- * Last changed in libpng 1.2.34 [December 18, 2008]
+ * Last changed in libpng 1.2.35 [February 14, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -61,7 +61,8 @@ png_set_cHRM(png_structp png_ptr, png_infop info_ptr,
 #endif
    info_ptr->valid |= PNG_INFO_cHRM;
 }
-#endif
+#endif /* PNG_FLOATING_POINT_SUPPORTED */
+
 #ifdef PNG_FIXED_POINT_SUPPORTED
 void PNGAPI
 png_set_cHRM_fixed(png_structp png_ptr, png_infop info_ptr,
@@ -387,7 +388,11 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
       return;
    }
 
-   info_ptr->pcal_params[nparams] = NULL;
+#ifdef PNG_FREE_ME_SUPPORTED
+   info_ptr->free_me |= PNG_FREE_PCAL;
+#endif
+
+   png_memset(info_ptr->pcal_params, 0, (nparams + 1) * png_sizeof(png_charp));
 
    for (i = 0; i < nparams; i++)
    {
@@ -404,9 +409,6 @@ png_set_pCAL(png_structp png_ptr, png_infop info_ptr,
    }
 
    info_ptr->valid |= PNG_INFO_pCAL;
-#ifdef PNG_FREE_ME_SUPPORTED
-   info_ptr->free_me |= PNG_FREE_PCAL;
-#endif
 }
 #endif
 
@@ -640,7 +642,7 @@ png_set_sRGB_gAMA_and_cHRM(png_structp png_ptr, png_infop info_ptr,
    }
 #endif /* cHRM */
 }
-#endif
+#endif /* sRGB */
 
 
 #if defined(PNG_iCCP_SUPPORTED)
@@ -964,6 +966,7 @@ png_set_sPLT(png_structp png_ptr,
 
     png_memcpy(np, info_ptr->splt_palettes,
            info_ptr->splt_palettes_num * png_sizeof(png_sPLT_t));
+
     png_free(png_ptr, info_ptr->splt_palettes);
     info_ptr->splt_palettes=NULL;
 
diff --git a/modules/libimg/png/pngwio.c b/modules/libimg/png/pngwio.c
index 3c008c30832..52eb7c02669 100644
--- a/modules/libimg/png/pngwio.c
+++ b/modules/libimg/png/pngwio.c
@@ -1,9 +1,9 @@
 
 /* pngwio.c - functions for data output
  *
- * Last changed in libpng 1.2.30 [August 13, 2008]
+ * Last changed in libpng 1.2.35 [February 14, 2009]
  * For conditions of distribution and use, see copyright notice in png.h
- * Copyright (c) 1998-2008 Glenn Randers-Pehrson
+ * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
@@ -137,7 +137,7 @@ png_default_flush(png_structp png_ptr)
    if (png_ptr == NULL) return;
 #if !defined(_WIN32_WCE)
    io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
-   if (io_ptr != NULL)
+   if (io_ptr != NULL && fileno(io_ptr) != -1)
       fflush(io_ptr);
 #endif
 }
diff --git a/modules/libimg/png/pngwrite.c b/modules/libimg/png/pngwrite.c
index 0ef89a1a1de..b03753b7b09 100644
--- a/modules/libimg/png/pngwrite.c
+++ b/modules/libimg/png/pngwrite.c
@@ -1,7 +1,7 @@
 
 /* pngwrite.c - general routines to write a PNG file
  *
- * Last changed in libpng 1.2.31 [August 19, 2008]
+ * Last changed in libpng 1.2.34 [December 18, 2008]
  * For conditions of distribution and use, see copyright notice in png.h
  * Copyright (c) 1998-2008 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

From d99fd36e7c1c4a539489e2206bddb09401732900 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sun, 1 Mar 2009 11:51:18 +0100
Subject: [PATCH 05/22] Bug 456382 - mousing on last tab shouldn't close window
 (middle click, close button, context menu). r=gavin

---
 browser/base/content/tabbrowser.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 5538a7d920b..4e2f4ff6179 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -118,6 +118,7 @@
                           anonid="undoCloseTabMenuItem"/>
             <xul:menuseparator/>
             <xul:menuitem id="context_closeTab" label="&closeTab.label;" accesskey="&closeTab.accesskey;"
+                          tbattr="tabbrowser-multiple"
                           oncommand="var tabbrowser = this.parentNode.parentNode.parentNode.parentNode;
                                      tabbrowser.removeTab(tabbrowser.mContextTab);"/>
           </xul:menupopup>
@@ -1015,7 +1016,10 @@
             if (event.button != 1 || event.target.localName != 'tab')
               return;
 
-            this.removeTab(event.target);
+            if (this.mTabs.length > 1 ||
+                !this.mPrefs.getBoolPref("browser.tabs.closeWindowWithLastTab"))
+              this.removeTab(event.target);
+
             event.stopPropagation();
           ]]>
         </body>

From d8338fbc37213f1e365b100e0071dc5f8cf7eb9e Mon Sep 17 00:00:00 2001
From: Nochum Sossonko <highmind63@gmail.com>
Date: Sun, 1 Mar 2009 12:22:44 +0100
Subject: [PATCH 06/22] Bug 419612 - pref to not update site-specific zoom for
 existing background tabs. r=gavin

---
 browser/app/profile/firefox.js           |  3 +++
 browser/base/content/browser-textZoom.js | 17 +++++++++++++----
 browser/base/content/browser.js          |  3 ++-
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index ef0d8db0294..e8127407aa1 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -783,6 +783,9 @@ pref("browser.zoom.full", true);
 // Whether or not to save and restore zoom levels on a per-site basis.
 pref("browser.zoom.siteSpecific", true);
 
+// Whether or not to update background tabs to the current zoom level.
+pref("browser.zoom.updateBackgroundTabs", true);
+
 // replace newlines with spaces when pasting into <input type="text"> fields
 pref("editor.singleLine.pasteNewlines", 2);
 
diff --git a/browser/base/content/browser-textZoom.js b/browser/base/content/browser-textZoom.js
index d27e281664d..1d1ffbf22e2 100644
--- a/browser/base/content/browser-textZoom.js
+++ b/browser/base/content/browser-textZoom.js
@@ -86,6 +86,9 @@ var FullZoom = {
   // browser.zoom.siteSpecific preference cache
   _siteSpecificPref: undefined,
 
+  // browser.zoom.updateBackgroundTabs preference cache
+  updateBackgroundTabs: undefined,
+
   // whether we are in private browsing mode
   _inPrivateBrowsing: false,
 
@@ -131,18 +134,20 @@ var FullZoom = {
                               getService(Ci.nsIPrivateBrowsingService).
                               privateBrowsingEnabled;
 
-    // Listen for changes to the browser.zoom.siteSpecific preference so we can
-    // enable/disable per-site saving and restoring of zoom levels accordingly.
     this._siteSpecificPref =
       this._prefBranch.getBoolPref("browser.zoom.siteSpecific");
-    this._prefBranch.addObserver("browser.zoom.siteSpecific", this, true);
+    this.updateBackgroundTabs = 
+      this._prefBranch.getBoolPref("browser.zoom.updateBackgroundTabs");
+    // Listen for changes to the browser.zoom branch so we can enable/disable
+    // updating background tabs and per-site saving and restoring of zoom levels.
+    this._prefBranch.addObserver("browser.zoom.", this, true);
   },
 
   destroy: function FullZoom_destroy() {
     let os = Cc["@mozilla.org/observer-service;1"].
              getService(Ci.nsIObserverService);
     os.removeObserver(this, "private-browsing");
-    this._prefBranch.removeObserver("browser.zoom.siteSpecific", this);
+    this._prefBranch.removeObserver("browser.zoom.", this);
     this._cps.removeObserver(this.name, this);
     window.removeEventListener("DOMMouseScroll", this, false);
     delete this._cps;
@@ -210,6 +215,10 @@ var FullZoom = {
             this._siteSpecificPref =
               this._prefBranch.getBoolPref("browser.zoom.siteSpecific");
             break;
+          case "browser.zoom.updateBackgroundTabs":
+            this.updateBackgroundTabs =
+              this._prefBranch.getBoolPref("browser.zoom.updateBackgroundTabs");
+            break;
         }
         break;
       case "private-browsing":
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 65d772d82f9..ea8768b90fe 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -4161,7 +4161,8 @@ var XULBrowserWindow = {
 
   // simulate all change notifications after switching tabs
   onUpdateCurrentBrowser: function (aStateFlags, aStatus, aMessage, aTotalProgress) {
-    FullZoom.onLocationChange(gBrowser.currentURI);
+    if (FullZoom.updateBackgroundTabs)
+      FullZoom.onLocationChange(gBrowser.currentURI);
     var nsIWebProgressListener = Components.interfaces.nsIWebProgressListener;
     var loadingDone = aStateFlags & nsIWebProgressListener.STATE_STOP;
     // use a pseudo-object instead of a (potentially non-existing) channel for getting

From 9934e05a0ccdd5de33873bae1b505d752b3b06a8 Mon Sep 17 00:00:00 2001
From: Nochum Sossonko <highmind63@gmail.com>
Date: Sun, 1 Mar 2009 12:16:04 +0100
Subject: [PATCH 07/22] Bug 473692 - Use "General" as the name in the first tab
 in Preferences rather than "Main". r=gavin, ui-r=faaborg

---
 .../locales/en-US/chrome/browser/preferences/preferences.dtd    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/locales/en-US/chrome/browser/preferences/preferences.dtd b/browser/locales/en-US/chrome/browser/preferences/preferences.dtd
index dca9447c966..b06af7599ec 100644
--- a/browser/locales/en-US/chrome/browser/preferences/preferences.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/preferences.dtd
@@ -7,7 +7,7 @@
 <!ENTITY  prefWin.styleMac2       "width: 47em; min-height: 40em;">
 <!ENTITY  prefWin.styleGNOME2     "width: 42em; min-height: 39.5em;">
 
-<!ENTITY  paneMain.title          "Main">
+<!ENTITY  paneMain.title          "General">
 <!ENTITY  paneTabs.title          "Tabs">
 <!ENTITY  paneContent.title       "Content">
 <!ENTITY  paneApplications.title  "Applications">

From 143552ff64595abe9ba1c82987ad9d713dda132b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20B=C3=BCnzli?= <zeniko@gmail.com>
Date: Sun, 1 Mar 2009 12:30:32 +0100
Subject: [PATCH 08/22] Bug 477657 - saner default handling for _closedTabs and
 sizemode. r=dietrich

---
 .../sessionstore/src/nsSessionStore.js        |  7 +-
 .../sessionstore/test/browser/Makefile.in     |  1 +
 .../test/browser/browser_477657.js            | 96 +++++++++++++++++++
 3 files changed, 101 insertions(+), 3 deletions(-)
 create mode 100644 browser/components/sessionstore/test/browser/browser_477657.js

diff --git a/browser/components/sessionstore/src/nsSessionStore.js b/browser/components/sessionstore/src/nsSessionStore.js
index 5ad82ba3b6c..db724faebca 100644
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -1619,20 +1619,21 @@ SessionStoreService.prototype = {
     
     if (aOverwriteTabs) {
       this.restoreWindowFeatures(aWindow, winData);
+      delete this._windows[aWindow.__SSi].extData;
     }
     if (winData.cookies) {
       this.restoreCookies(winData.cookies);
     }
     if (winData.extData) {
-      if (aOverwriteTabs  || !this._windows[aWindow.__SSi].extData) {
+      if (!this._windows[aWindow.__SSi].extData) {
         this._windows[aWindow.__SSi].extData = {};
       }
       for (var key in winData.extData) {
         this._windows[aWindow.__SSi].extData[key] = winData.extData[key];
       }
     }
-    if (winData._closedTabs && (root._firstTabs || aOverwriteTabs)) {
-      this._windows[aWindow.__SSi]._closedTabs = winData._closedTabs;
+    if (aOverwriteTabs || root._firstTabs) {
+      this._windows[aWindow.__SSi]._closedTabs = winData._closedTabs || [];
     }
     
     this.restoreHistoryPrecursor(aWindow, tabs, winData.tabs,
diff --git a/browser/components/sessionstore/test/browser/Makefile.in b/browser/components/sessionstore/test/browser/Makefile.in
index 0a63b701f3e..08cb8e29e12 100644
--- a/browser/components/sessionstore/test/browser/Makefile.in
+++ b/browser/components/sessionstore/test/browser/Makefile.in
@@ -74,6 +74,7 @@ _BROWSER_TEST_FILES = \
 	browser_466937_sample.html \
 	browser_476161.js \
 	browser_476161_sample.html \
+	browser_477657.js \
 	$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)
diff --git a/browser/components/sessionstore/test/browser/browser_477657.js b/browser/components/sessionstore/test/browser/browser_477657.js
new file mode 100644
index 00000000000..9103f966ca7
--- /dev/null
+++ b/browser/components/sessionstore/test/browser/browser_477657.js
@@ -0,0 +1,96 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is sessionstore test code.
+ *
+ * The Initial Developer of the Original Code is
+ * Simon Bünzli <zeniko@gmail.com>.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function test() {
+  /** Test for Bug 477657 **/
+  
+  // test setup
+  let ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
+  waitForExplicitFinish();
+  
+  let newWin = openDialog(location, "_blank", "chrome,all,dialog=no");
+  newWin.addEventListener("load", function(aEvent) {
+    let newState = { windows: [{
+      tabs: [{ entries: [] }],
+      _closedTabs: [{
+        state: { entries: [{ url: "about:" }]},
+        title: "About:"
+      }],
+      sizemode: "maximized"
+    }] };
+    
+    let uniqueKey = "bug 477657";
+    let uniqueValue = "unik" + Date.now();
+  
+    ss.setWindowValue(newWin, uniqueKey, uniqueValue);
+    is(ss.getWindowValue(newWin, uniqueKey), uniqueValue,
+       "window value was set before the window was overwritten");
+    ss.setWindowState(newWin, JSON.stringify(newState), true);
+    
+    executeSoon(function() {
+      is(ss.getWindowValue(newWin, uniqueKey), "",
+         "window value was implicitly cleared");
+      
+      is(newWin.windowState, newWin.STATE_MAXIMIZED,
+         "the window was maximized");
+      
+      is(JSON.parse(ss.getClosedTabData(newWin)).length, 1,
+         "the closed tab was added before the window was overwritten");
+      delete newState.windows[0]._closedTabs;
+      delete newState.windows[0].sizemode;
+      ss.setWindowState(newWin, JSON.stringify(newState), true);
+      
+      executeSoon(function() {
+        is(JSON.parse(ss.getClosedTabData(newWin)).length, 0,
+           "closed tabs were implicitly cleared");
+        
+        is(newWin.windowState, newWin.STATE_MAXIMIZED,
+           "the window remains maximized");
+        newState.windows[0].sizemode = "normal";
+        ss.setWindowState(newWin, JSON.stringify(newState), true);
+        
+        executeSoon(function() {
+          isnot(newWin.windowState, newWin.STATE_MAXIMIZED,
+                "the window was explicitly unmaximized");
+          
+          // clean up
+          newWin.close();
+          finish();
+        });
+      });
+    });
+  }, false);
+}

From 53d295f987e7a1b4bde8cf44091bd3921c8ee432 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan.akhgari@gmail.com>
Date: Sun, 1 Mar 2009 16:30:37 +0430
Subject: [PATCH 09/22] Bug 463253 - Application name displayed in title bar
 (tests); r=gavin

---
 .../privatebrowsing/test/browser/Makefile.in  |   2 +
 .../browser_privatebrowsing_windowtitle.js    | 140 ++++++++++++++++++
 ...wser_privatebrowsing_windowtitle_page.html |   9 ++
 3 files changed, 151 insertions(+)
 create mode 100644 browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js
 create mode 100644 browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle_page.html

diff --git a/browser/components/privatebrowsing/test/browser/Makefile.in b/browser/components/privatebrowsing/test/browser/Makefile.in
index ebbf622493d..a2815c46fb1 100644
--- a/browser/components/privatebrowsing/test/browser/Makefile.in
+++ b/browser/components/privatebrowsing/test/browser/Makefile.in
@@ -54,6 +54,8 @@ _BROWSER_TEST_FILES =  \
 		browser_privatebrowsing_transition.js \
 		browser_privatebrowsing_import.js \
 		browser_privatebrowsing_crh.js \
+		browser_privatebrowsing_windowtitle.js \
+		browser_privatebrowsing_windowtitle_page.html \
 		$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)
diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js
new file mode 100644
index 00000000000..10bf8b9b33b
--- /dev/null
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js
@@ -0,0 +1,140 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Private Browsing Tests.
+ *
+ * The Initial Developer of the Original Code is
+ * Ehsan Akhgari.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Ehsan Akhgari <ehsan.akhgari@gmail.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// This test makes sure that the window title changes correctly while switching
+// from and to private browsing mode.
+
+function test() {
+  // initialization
+  let prefBranch = Cc["@mozilla.org/preferences-service;1"].
+                   getService(Ci.nsIPrefBranch);
+  prefBranch.setBoolPref("browser.privatebrowsing.keep_current_session", true);
+  let pb = Cc["@mozilla.org/privatebrowsing;1"].
+           getService(Ci.nsIPrivateBrowsingService);
+
+  const testPageURL = "http://localhost:8888/browser/" +
+    "browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle_page.html";
+  waitForExplicitFinish();
+
+  // initialization of expected titles
+  let test_title = "Test title";
+  let app_name = document.documentElement.getAttribute("title");
+  const isOSX = ("nsILocalFileMac" in Ci);
+    var page_with_title;
+    var page_without_title;
+    var pb_page_with_title;
+    var pb_page_without_title;
+    var about_pb_title;
+  if (isOSX) {
+    page_with_title = test_title;
+    page_without_title = app_name;
+    pb_page_with_title = test_title + " - (Private Browsing)";
+    pb_page_without_title = app_name + " - (Private Browsing)";
+    about_pb_title = pb_page_without_title;
+  }
+  else {
+    page_with_title = test_title + " - " + app_name;
+    page_without_title = app_name;
+    pb_page_with_title = test_title + " - " + app_name + " (Private Browsing)";
+    pb_page_without_title = app_name + " (Private Browsing)";
+    about_pb_title = "Private Browsing - " + app_name + " (Private Browsing)";
+  }
+
+  // check the window title for a page without a title
+  let blankTab = gBrowser.addTab();
+  gBrowser.selectedTab = blankTab;
+  is(document.title, page_without_title, "The window title for a page without a title matches " +
+    "(outside private browsing mode)");
+  gBrowser.removeTab(blankTab);
+
+  let pageTab = gBrowser.addTab();
+  gBrowser.selectedTab = pageTab;
+  let pageBrowser = gBrowser.getBrowserForTab(pageTab);
+  pageBrowser.addEventListener("load", function () {
+    pageBrowser.removeEventListener("load", arguments.callee, true);
+
+    // check the window title for a page with a title
+    is(document.title, page_with_title, "The window title for a page with a title matches " +
+      "(outside private browsing mode)");
+
+    gBrowser.removeTab(pageTab);
+
+    // enter the private browsing mode
+    pb.privateBrowsingEnabled = true;
+
+    // check the window title for a page without a title
+    blankTab = gBrowser.addTab();
+    gBrowser.selectedTab = blankTab;
+    is(document.title, pb_page_without_title, "The window title for a page without a title matches " +
+      "(inside private browsing mode)");
+    gBrowser.removeTab(blankTab);
+
+    pageTab = gBrowser.addTab();
+    gBrowser.selectedTab = pageTab;
+    pageBrowser = gBrowser.getBrowserForTab(pageTab);
+    pageBrowser.addEventListener("load", function () {
+      pageBrowser.removeEventListener("load", arguments.callee, true);
+
+      // check the window title for a page with a title
+      is(document.title, pb_page_with_title, "The window title for a page with a title matches " +
+        "(inside private browsing mode)");
+
+      gBrowser.removeTab(pageTab);
+
+      let aboutPBTab = gBrowser.addTab();
+      gBrowser.selectedTab = aboutPBTab;
+      let aboutPBBrowser = gBrowser.getBrowserForTab(aboutPBTab);
+      aboutPBBrowser.addEventListener("load", function() {
+        aboutPBBrowser.removeEventListener("load", arguments.callee, true);
+
+        // check the window title for about:privatebrowsing
+        is(document.title, about_pb_title, "The window title for about:privatebrowsing matches " +
+          "(inside private browsing mode)");
+
+        gBrowser.removeTab(aboutPBTab);
+
+        // cleanup
+        pb.privateBrowsingEnabled = false;
+        prefBranch.clearUserPref("browser.privatebrowsing.keep_current_session");
+        finish();
+      }, true);
+      aboutPBBrowser.contentWindow.location = "about:privatebrowsing";
+    }, true);
+    pageBrowser.contentWindow.location = testPageURL;
+  }, true);
+  pageBrowser.contentWindow.location = testPageURL;
+}
diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle_page.html b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle_page.html
new file mode 100644
index 00000000000..760bde7d148
--- /dev/null
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle_page.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
+<html>
+  <head>
+    <title>Test title</title>
+  </head>
+  <body>
+    Test page for the window title test
+  </body>
+</html>

From 7a957a90dda8d2284fd3e8be88443c6ab508a474 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sun, 1 Mar 2009 10:16:29 -0500
Subject: [PATCH 10/22] Bug 478956.  Merge pseudo-frame handling for outer
 tables and non-table frames.  r=bernd, sr=roc

---
 layout/base/nsCSSFrameConstructor.cpp  | 112 ++++++++++---------------
 layout/base/nsCSSFrameConstructor.h    |  12 +--
 layout/reftests/bugs/478956-1-ref.html |  17 ++++
 layout/reftests/bugs/478956-1a.html    |  16 ++++
 layout/reftests/bugs/478956-1b.html    |  16 ++++
 layout/reftests/bugs/reftest.list      |   2 +
 6 files changed, 102 insertions(+), 73 deletions(-)
 create mode 100644 layout/reftests/bugs/478956-1-ref.html
 create mode 100644 layout/reftests/bugs/478956-1a.html
 create mode 100644 layout/reftests/bugs/478956-1b.html

diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 7c21daa5bf9..e7281619dfc 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -2990,12 +2990,12 @@ nsCSSFrameConstructor::GetPseudoCellFrame(PRInt32                  aNameSpaceID,
 }
 
 nsresult 
-nsCSSFrameConstructor::GetParentFrame(PRInt32                  aNameSpaceID,
-                                      nsIFrame&                aParentFrameIn, 
-                                      nsIAtom*                 aChildFrameType, 
-                                      nsFrameConstructorState& aState, 
-                                      nsIFrame*&               aParentFrame,
-                                      PRBool&                  aIsPseudoParent)
+nsCSSFrameConstructor::CreateRequiredPseudoFrames(PRInt32                  aNameSpaceID,
+                                                  nsIFrame&                aParentFrameIn,
+                                                  nsIAtom*                 aChildFrameType,
+                                                  nsFrameConstructorState& aState,
+                                                  nsIFrame*&               aParentFrame,
+                                                  PRBool&                  aIsPseudoParent)
 {
   nsresult rv = NS_OK;
 
@@ -3008,15 +3008,7 @@ nsCSSFrameConstructor::GetParentFrame(PRInt32                  aNameSpaceID,
   nsFrameState savedStateBits  = aState.mAdditionalStateBits;
   aState.mAdditionalStateBits &= ~NS_FRAME_GENERATED_CONTENT;
 
-  if (nsGkAtoms::tableOuterFrame == aChildFrameType) { // table child
-    if (IsTableRelated(parentFrameType, PR_TRUE) &&
-        (nsGkAtoms::tableCaptionFrame != parentFrameType) ) { // need pseudo cell parent
-      rv = GetPseudoCellFrame(aNameSpaceID, aState, aParentFrameIn);
-      if (NS_FAILED(rv)) return rv;
-      pseudoParentFrame = pseudoFrames.mCellInner.mFrame;
-    }
-  } 
-  else if (nsGkAtoms::tableCaptionFrame == aChildFrameType) { // caption child
+  if (nsGkAtoms::tableCaptionFrame == aChildFrameType) { // caption child
     if (nsGkAtoms::tableOuterFrame != parentFrameType) { // need pseudo table parent
       rv = GetPseudoTableFrame(aNameSpaceID, aState, aParentFrameIn);
       if (NS_FAILED(rv)) return rv;
@@ -3060,16 +3052,11 @@ nsCSSFrameConstructor::GetParentFrame(PRInt32                  aNameSpaceID,
       pseudoParentFrame = pseudoFrames.mRow.mFrame;
     }
   }
-  else if (nsGkAtoms::tableFrame == aChildFrameType) { // invalid
-    NS_ASSERTION(PR_FALSE, "GetParentFrame called on nsGkAtoms::tableFrame child");
-  }
-  else { // foreign frame
-    if (IsTableRelated(parentFrameType, PR_FALSE)) { // need pseudo cell parent
-      rv = GetPseudoCellFrame(aNameSpaceID, aState, aParentFrameIn);
-      if (NS_FAILED(rv)) return rv;
-      pseudoParentFrame = pseudoFrames.mCellInner.mFrame;
-    }
+#ifdef DEBUG
+  else {
+    NS_ERROR("Unexpected frame type in CreateRequiredPseudoFrames");
   }
+#endif
   
   if (pseudoParentFrame) {
     aParentFrame = pseudoParentFrame;
@@ -3139,6 +3126,15 @@ nsCSSFrameConstructor::AdjustParentFrame(nsFrameConstructorState&     aState,
     // needs to become the float containing block.
     aState.PushFloatContainingBlock(aParentFrame, aSaveState);
     aCreatedPseudo = PR_TRUE;
+
+    // Now it might be that we had existing pseudo-frames and in particular an
+    // existing pseudo-cell (so that the pseudo cell we just got is not the
+    // lowest pseudo-frame).  If that's the case, we need to process everythign
+    // below that cell, so that our later siblings don't see those
+    // pseudo-frames.
+    if (aState.mPseudoFrames.mTableOuter.mFrame) {
+      ProcessPseudoFrames(aState, nsGkAtoms::tableOuterFrame);
+    }
   }
   return NS_OK;
 }
@@ -3194,30 +3190,13 @@ nsCSSFrameConstructor::ConstructTableFrame(nsFrameConstructorState& aState,
 #endif
     aNewOuterFrame = NS_NewTableOuterFrame(mPresShell, outerStyleContext);
 
-  nsIFrame* parentFrame = aContentParent;
-  nsFrameItems* frameItems = &aChildItems;
-  // We may need to push a float containing block
-  nsFrameConstructorSaveState floatSaveState;
-  if (!aIsPseudo) {
-    // this frame may have a pseudo parent
-    PRBool hasPseudoParent = PR_FALSE;
-    GetParentFrame(aNameSpaceID,*parentFrame, nsGkAtoms::tableOuterFrame,
-                   aState, parentFrame, hasPseudoParent);
-    if (!hasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
-      ProcessPseudoFrames(aState, aChildItems);
-    }
-    if (hasPseudoParent) {
-      aState.PushFloatContainingBlock(parentFrame, floatSaveState);
-      frameItems = &aState.mPseudoFrames.mCellInner.mChildList;
-      if (aState.mPseudoFrames.mTableOuter.mFrame) {
-        ProcessPseudoFrames(aState, nsGkAtoms::tableOuterFrame);
-      }
-    }
-  }
+  NS_ASSERTION(!IsTableRelated(aContentParent->GetType(), PR_TRUE) ||
+               aContentParent->GetType() == nsGkAtoms::tableCaptionFrame,
+               "Unexpected parent frame for table");
 
   nsIFrame* geometricParent = aState.GetGeometricParent
                                 (outerStyleContext->GetStyleDisplay(),
-                                 parentFrame);
+                                 aContentParent);
 
   // Init the table outer frame and see if we need to create a view, e.g.
   // the frame is absolutely positioned  
@@ -3239,8 +3218,8 @@ nsCSSFrameConstructor::ConstructTableFrame(nsFrameConstructorState& aState,
     // Put the newly created frames into the right child list
     aNewOuterFrame->SetInitialChildList(nsnull, aNewInnerFrame);
 
-    rv = aState.AddChild(aNewOuterFrame, *frameItems, aContent,
-                         aStyleContext, parentFrame);
+    rv = aState.AddChild(aNewOuterFrame, aChildItems, aContent,
+                         aStyleContext, aContentParent);
     if (NS_FAILED(rv)) {
       return rv;
     }
@@ -3289,9 +3268,9 @@ nsCSSFrameConstructor::ConstructTableCaptionFrame(nsFrameConstructorState& aStat
   nsIFrame* parentFrame = aParentFrameIn;
   *aHasPseudoParent = PR_FALSE;
   // this frame may have a pseudo parent
-  GetParentFrame(aNameSpaceID, *aParentFrameIn, 
-                 nsGkAtoms::tableCaptionFrame, aState, parentFrame,
-                 *aHasPseudoParent);
+  CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                             nsGkAtoms::tableCaptionFrame, aState, parentFrame,
+                             *aHasPseudoParent);
   if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
     ProcessPseudoFrames(aState, aChildItems);
   }
@@ -3333,9 +3312,9 @@ nsCSSFrameConstructor::ConstructTableRowGroupFrame(nsFrameConstructorState& aSta
   *aHasPseudoParent = PR_FALSE;
   if (!aIsPseudo) {
     // this frame may have a pseudo parent
-    GetParentFrame(aNameSpaceID, *aParentFrameIn, 
-                   nsGkAtoms::tableRowGroupFrame, aState, parentFrame,
-                   *aHasPseudoParent);
+    CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                               nsGkAtoms::tableRowGroupFrame, aState,
+                               parentFrame, *aHasPseudoParent);
     if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(aState, aChildItems);
     }
@@ -3403,9 +3382,9 @@ nsCSSFrameConstructor::ConstructTableColGroupFrame(nsFrameConstructorState& aSta
   *aHasPseudoParent = PR_FALSE;
   if (!aIsPseudo) {
     // this frame may have a pseudo parent
-    GetParentFrame(aNameSpaceID, *aParentFrameIn,
-                   nsGkAtoms::tableColGroupFrame, aState, parentFrame,
-                   *aHasPseudoParent);
+    CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                               nsGkAtoms::tableColGroupFrame, aState,
+                               parentFrame, *aHasPseudoParent);
     if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(aState, aChildItems);
     }
@@ -3452,9 +3431,9 @@ nsCSSFrameConstructor::ConstructTableRowFrame(nsFrameConstructorState& aState,
   *aHasPseudoParent = PR_FALSE;
   if (!aIsPseudo) {
     // this frame may have a pseudo parent
-    GetParentFrame(aNameSpaceID, *aParentFrameIn,
-                   nsGkAtoms::tableRowFrame, aState, parentFrame,
-                   *aHasPseudoParent);
+    CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                               nsGkAtoms::tableRowFrame, aState, parentFrame,
+                               *aHasPseudoParent);
     if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(aState, aChildItems);
     }
@@ -3507,9 +3486,9 @@ nsCSSFrameConstructor::ConstructTableColFrame(nsFrameConstructorState& aState,
   *aHasPseudoParent = PR_FALSE;
   if (!aIsPseudo) {
     // this frame may have a pseudo parent
-    GetParentFrame(aNameSpaceID, *aParentFrameIn,
-                   nsGkAtoms::tableColFrame, aState, parentFrame,
-                   *aHasPseudoParent);
+    CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                               nsGkAtoms::tableColFrame, aState, parentFrame,
+                               *aHasPseudoParent);
     if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(aState, aChildItems);
     }
@@ -3568,9 +3547,9 @@ nsCSSFrameConstructor::ConstructTableCellFrame(nsFrameConstructorState& aState,
   if (!aIsPseudo) {
     // this frame may have a pseudo parent
     // use nsGkAtoms::tableCellFrame which will match if it is really nsGkAtoms::bcTableCellFrame
-    GetParentFrame(aNameSpaceID, *aParentFrameIn,
-                   nsGkAtoms::tableCellFrame, aState, parentFrame,
-                   *aHasPseudoParent);
+    CreateRequiredPseudoFrames(aNameSpaceID, *aParentFrameIn,
+                               nsGkAtoms::tableCellFrame, aState, parentFrame,
+                               *aHasPseudoParent);
     if (!*aHasPseudoParent && !aState.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(aState, aChildItems);
     }
@@ -5881,8 +5860,7 @@ nsCSSFrameConstructor::FindDisplayData(const nsStyleDisplay* aDisplay,
   if (NS_STYLE_DISPLAY_TABLE == aDisplay->mDisplay ||
       NS_STYLE_DISPLAY_INLINE_TABLE == aDisplay->mDisplay) {
     static const FrameConstructionData sTableData =
-      FULL_CTOR_FCDATA(FCDATA_IS_TABLE_PART,
-                       &nsCSSFrameConstructor::ConstructTable);
+      FULL_CTOR_FCDATA(0, &nsCSSFrameConstructor::ConstructTable);
     return &sTableData;
   }
 
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index c21d73f4f67..f594ce98635 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -539,12 +539,12 @@ private:
                               nsFrameConstructorState& aState, 
                               nsIFrame&                aParentFrameIn);
 
-  nsresult GetParentFrame(PRInt32                  aNameSpaceID,
-                          nsIFrame&                aParentFrameIn, 
-                          nsIAtom*                 aChildFrameType, 
-                          nsFrameConstructorState& aState, 
-                          nsIFrame*&               aParentFrame,
-                          PRBool&                  aIsPseudoParent);
+  nsresult CreateRequiredPseudoFrames(PRInt32                  aNameSpaceID,
+                                      nsIFrame&                aParentFrameIn,
+                                      nsIAtom*                 aChildFrameType,
+                                      nsFrameConstructorState& aState,
+                                      nsIFrame*&               aParentFrame,
+                                      PRBool&                  aIsPseudoParent);
 
 private:
   /* A constructor function that just creates an nsIFrame object.  The caller
diff --git a/layout/reftests/bugs/478956-1-ref.html b/layout/reftests/bugs/478956-1-ref.html
new file mode 100644
index 00000000000..3815f3a4608
--- /dev/null
+++ b/layout/reftests/bugs/478956-1-ref.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <table cellpadding="0" cellspacing="0">
+      <tr>
+        <td>Long long cell</td>
+        <td>cell</td>
+      </tr>
+    </table>
+    <table cellpadding="0" cellspacing="0">
+      <tr>
+        <td>cell</td>
+        <td>cell</td>
+      </tr>
+    </table>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/478956-1a.html b/layout/reftests/bugs/478956-1a.html
new file mode 100644
index 00000000000..4ae0aca8e68
--- /dev/null
+++ b/layout/reftests/bugs/478956-1a.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="display: table-row">
+      <div style="display: table-row">
+        <div style="display: table-cell">Long long cell</div>
+        <div style="display: table-cell">cell</div>
+      </div>
+      <span style="display: table"></span>
+      <div style="display: table-row">
+        <div style="display: table-cell">cell</div>
+        <div style="display: table-cell">cell</div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/478956-1b.html b/layout/reftests/bugs/478956-1b.html
new file mode 100644
index 00000000000..1b656a98e57
--- /dev/null
+++ b/layout/reftests/bugs/478956-1b.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="display: table-row">
+      <div style="display: table-row">
+        <div style="display: table-cell">Long long cell</div>
+        <div style="display: table-cell">cell</div>
+      </div>
+      <span style="display: block"></span>
+      <div style="display: table-row">
+        <div style="display: table-cell">cell</div>
+        <div style="display: table-cell">cell</div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 9bf15e9ad91..beba24adc83 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1092,3 +1092,5 @@ fails == 461512-1.html 461512-1-ref.html # Bug 461512
 == 478811-2.html 478811-2-ref.html
 == 478811-3.html 478811-3-ref.html
 == 478811-4.html 478811-4-ref.html
+== 478956-1a.html 478956-1-ref.html
+== 478956-1b.html 478956-1-ref.html

From b1f152d8fb96e863890af52659bd4ee345b80094 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sun, 1 Mar 2009 10:16:29 -0500
Subject: [PATCH 11/22] Bug 479114.  Create page-break frames only after we
 know our final parent.

---
 layout/base/crashtests/479114-1.html   |  14 +++
 layout/base/crashtests/crashtests.list |   1 +
 layout/base/nsCSSFrameConstructor.cpp  | 159 ++++++++++---------------
 layout/base/nsCSSFrameConstructor.h    |  18 +--
 4 files changed, 87 insertions(+), 105 deletions(-)
 create mode 100644 layout/base/crashtests/479114-1.html

diff --git a/layout/base/crashtests/479114-1.html b/layout/base/crashtests/479114-1.html
new file mode 100644
index 00000000000..8ed600d76f2
--- /dev/null
+++ b/layout/base/crashtests/479114-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+  <body>
+    <div style="display: table-row">
+      <span style="display: block; page-break-before: always"></span>
+    </div>
+    <div style="display: table-row-group">
+      <span style="display: block; page-break-before: always"></span>
+    </div>
+    <div style="display: table">
+      <span style="display: block; page-break-before: always"></span>
+    </div>
+  </body>
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 1cc84ac467e..5421c3997d5 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -194,4 +194,5 @@ load 468546-1.xhtml
 load 468645-1.xhtml
 load 468645-2.xhtml
 load 468645-3.xhtml
+load 479114-1.html
 load 477333-1.xhtml
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index e7281619dfc..04c9c89589e 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -2165,8 +2165,10 @@ nsCSSFrameConstructor::CreateGeneratedContentFrame(nsFrameConstructorState& aSta
   // NS_FRAME_GENERATED_CONTENT.
   aState.mAdditionalStateBits |= NS_FRAME_GENERATED_CONTENT;
 
+  // XXXbz should we actually allow page-break frames here?
   ConstructFrameInternal(aState, container, aParentFrame,
-    elemName, kNameSpaceID_None, pseudoStyleContext, aFrameItems, PR_TRUE);
+                         elemName, kNameSpaceID_None, pseudoStyleContext,
+                         aFrameItems, PR_FALSE, PR_FALSE);
   aState.mAdditionalStateBits = savedStateBits;
 }
 
@@ -2185,23 +2187,9 @@ TextIsOnlyWhitespace(nsIContent* aContent)
 // frame has been used elsewhere to refer to frames that have generated content
 
 // aIncludeSpecial applies to captions, col groups, cols and cells.
-// These do not generate pseudo frame wrappers for foreign children. 
-
-static PRBool
-IsTableRelated(PRUint8 aDisplay)
-{
-  return
-    aDisplay == NS_STYLE_DISPLAY_TABLE              ||
-    aDisplay == NS_STYLE_DISPLAY_INLINE_TABLE       ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_HEADER_GROUP ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_ROW_GROUP    ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_FOOTER_GROUP ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_ROW          ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_CAPTION      ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN       ||
-    aDisplay == NS_STYLE_DISPLAY_TABLE_CELL;
-}
+// These do not generate pseudo frame wrappers for foreign children.
+// In fact, colgroups never have any children that are not cols and
+// cols never have any children at all.
 
 static PRBool
 IsTableRelated(nsIAtom* aParentType,
@@ -5855,8 +5843,6 @@ nsCSSFrameConstructor::FindDisplayData(const nsStyleDisplay* aDisplay,
     return &sInlineData;
   }
 
-  NS_ASSERTION(IsTableRelated(aDisplay->mDisplay), "Unexpected display type");
-
   if (NS_STYLE_DISPLAY_TABLE == aDisplay->mDisplay ||
       NS_STYLE_DISPLAY_INLINE_TABLE == aDisplay->mDisplay) {
     static const FrameConstructionData sTableData =
@@ -6467,15 +6453,13 @@ nsCSSFrameConstructor::PageBreakBefore(nsFrameConstructorState& aState,
                                        nsIContent*              aContent,
                                        nsIFrame*                aParentFrame,
                                        nsStyleContext*          aStyleContext,
+                                       const FrameConstructionData* aFCData,
                                        nsFrameItems&            aFrameItems)
 {
   const nsStyleDisplay* display = aStyleContext->GetStyleDisplay();
 
-  if (NS_STYLE_DISPLAY_NONE != display->mDisplay &&
-      NS_STYLE_POSITION_FIXED    != display->mPosition &&
-      NS_STYLE_POSITION_ABSOLUTE != display->mPosition &&
-      (NS_STYLE_DISPLAY_TABLE == display->mDisplay ||
-       !IsTableRelated(display->mDisplay))) {
+  if (!aStyleContext->GetStyleDisplay()->IsAbsolutelyPositioned() &&
+      !(aFCData->mBits & FCDATA_IS_TABLE_PART)) {
     if (display->mBreakBefore) {
       ConstructPageBreakFrame(aState, aContent, aParentFrame, aStyleContext,
                               aFrameItems);
@@ -6537,39 +6521,23 @@ nsCSSFrameConstructor::ConstructFrame(nsFrameConstructorState& aState,
   nsRefPtr<nsStyleContext> styleContext;
   styleContext = ResolveStyleContext(aParentFrame, aContent);
 
-  PRBool pageBreakAfter = PR_FALSE;
-
-  if (aState.mPresContext->IsPaginated()) {
-    // Construct a page break frame for page-break-before, and remember if
-    // we need one for page-break-after.
-    pageBreakAfter = PageBreakBefore(aState, aContent, aParentFrame,
-                                     styleContext, aFrameItems);
-  }
-
   // construct the frame
-  rv = ConstructFrameInternal(aState, aContent, aParentFrame,
-                              aContent->Tag(), aContent->GetNameSpaceID(),
-                              styleContext, aFrameItems, PR_FALSE);
-
-  if (NS_SUCCEEDED(rv) && pageBreakAfter) {
-    // Construct the page break after
-    ConstructPageBreakFrame(aState, aContent, aParentFrame, styleContext,
-                            aFrameItems);
-  }
-  
-  return rv;
+  return ConstructFrameInternal(aState, aContent, aParentFrame,
+                                aContent->Tag(), aContent->GetNameSpaceID(),
+                                styleContext, aFrameItems, PR_TRUE, PR_TRUE);
 }
 
 
 nsresult
-nsCSSFrameConstructor::ConstructFrameInternal( nsFrameConstructorState& aState,
-                                               nsIContent*              aContent,
-                                               nsIFrame*                aParentFrame,
-                                               nsIAtom*                 aTag,
-                                               PRInt32                  aNameSpaceID,
-                                               nsStyleContext*          aStyleContext,
-                                               nsFrameItems&            aFrameItems,
-                                               PRBool                   aXBLBaseTag)
+nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState& aState,
+                                              nsIContent*              aContent,
+                                              nsIFrame*                aParentFrame,
+                                              nsIAtom*                 aTag,
+                                              PRInt32                  aNameSpaceID,
+                                              nsStyleContext*          aStyleContext,
+                                              nsFrameItems&            aFrameItems,
+                                              PRBool                   aAllowXBLBase,
+                                              PRBool                   aAllowPageBreaks)
 {
   // The following code allows the user to specify the base tag
   // of an element using XBL.  XUL and HTML objects (like boxes, menus, etc.)
@@ -6577,49 +6545,31 @@ nsCSSFrameConstructor::ConstructFrameInternal( nsFrameConstructorState& aState,
   const nsStyleDisplay* display = aStyleContext->GetStyleDisplay();
   nsRefPtr<nsStyleContext> styleContext(aStyleContext);
   nsAutoEnqueueBinding binding(mDocument);
-  if (!aXBLBaseTag)
+  if (aAllowXBLBase && display->mBinding)
   {
-    
     // Ensure that our XBL bindings are installed.
-    if (display->mBinding) {
-      // Get the XBL loader.
-      nsresult rv;
-      // Load the bindings.
-      PRBool resolveStyle;
-      
-      nsIXBLService * xblService = GetXBLService();
-      if (!xblService)
-        return NS_ERROR_FAILURE;
 
-      rv = xblService->LoadBindings(aContent, display->mBinding->mURI,
-                                    display->mBinding->mOriginPrincipal,
-                                    PR_FALSE, getter_AddRefs(binding.mBinding),
-                                    &resolveStyle);
-      if (NS_FAILED(rv))
-        return NS_OK;
+    nsIXBLService * xblService = GetXBLService();
+    if (!xblService)
+      return NS_ERROR_FAILURE;
 
-      if (resolveStyle) {
-        styleContext = ResolveStyleContext(aParentFrame, aContent);
-        display = styleContext->GetStyleDisplay();
-      }
+    PRBool resolveStyle;
 
-      PRInt32 nameSpaceID;
-      nsCOMPtr<nsIAtom> baseTag =
-        mDocument->BindingManager()->ResolveTag(aContent, &nameSpaceID);
+    nsresult rv = xblService->LoadBindings(aContent, display->mBinding->mURI,
+                                           display->mBinding->mOriginPrincipal,
+                                           PR_FALSE,
+                                           getter_AddRefs(binding.mBinding),
+                                           &resolveStyle);
+    if (NS_FAILED(rv))
+      return NS_OK;
 
-      if (baseTag != aTag || aNameSpaceID != nameSpaceID) {
-        // Construct the frame using the XBL base tag.
-        rv = ConstructFrameInternal(aState,
-                                    aContent,
-                                    aParentFrame,
-                                    baseTag,
-                                    nameSpaceID,
-                                    styleContext,
-                                    aFrameItems,
-                                    PR_TRUE);
-        return rv;
-      }
+    if (resolveStyle) {
+      styleContext = ResolveStyleContext(aParentFrame, aContent);
+      display = styleContext->GetStyleDisplay();
+      aStyleContext = styleContext;
     }
+
+    aTag = mDocument->BindingManager()->ResolveTag(aContent, &aNameSpaceID);
   }
 
   // Pre-check for display "none" - if we find that, don't create
@@ -6671,7 +6621,7 @@ nsCSSFrameConstructor::ConstructFrameInternal( nsFrameConstructorState& aState,
 
     // Now check for XUL display types
     if (!data) {
-      data = FindXULDisplayData(display, aContent, aStyleContext);
+      data = FindXULDisplayData(display, aContent, styleContext);
     }
 
     // And general display types
@@ -6727,9 +6677,25 @@ nsCSSFrameConstructor::ConstructFrameInternal( nsFrameConstructorState& aState,
   }
 #endif /* MOZ_XUL */
 
-  return ConstructFrameFromData(data, aState, aContent, adjParentFrame, aTag,
-                                aNameSpaceID, styleContext, *frameItems,
-                                pseudoParent);
+  // Construct a page break frame for page-break-before, if needed, and
+  // remember whether we need one for page-break-after.
+  PRBool pageBreakAfter =
+    aAllowPageBreaks &&
+    aState.mPresContext->IsPaginated() &&
+    PageBreakBefore(aState, aContent, adjParentFrame, styleContext, data,
+                    *frameItems);
+
+  rv = ConstructFrameFromData(data, aState, aContent, adjParentFrame, aTag,
+                              aNameSpaceID, styleContext, *frameItems,
+                              pseudoParent);
+
+  if (NS_SUCCEEDED(rv) && pageBreakAfter) {
+    // Construct the page break after
+    ConstructPageBreakFrame(aState, aContent, adjParentFrame, styleContext,
+                            *frameItems);
+  }
+
+  return rv;
 }
 
 
@@ -11392,10 +11358,9 @@ nsCSSFrameConstructor::CreateListBoxContent(nsPresContext* aPresContext,
 
     BeginUpdate();
 
-    rv = ConstructFrameInternal(state, aChild,
-                                aParentFrame, aChild->Tag(),
-                                aChild->GetNameSpaceID(),
-                                styleContext, frameItems, PR_FALSE);
+    rv = ConstructFrameInternal(state, aChild, aParentFrame, aChild->Tag(),
+                                aChild->GetNameSpaceID(), styleContext,
+                                frameItems, PR_TRUE, PR_FALSE);
     if (!state.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(state, frameItems); 
     }
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index f594ce98635..2fd6b5262b8 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -826,6 +826,7 @@ private:
                          nsIContent*              aContent,
                          nsIFrame*                aParentFrame,
                          nsStyleContext*          aStyleContext,
+                         const FrameConstructionData* aFCData,
                          nsFrameItems&            aFrameItems);
 
   // Function to find FrameConstructionData for aContent.  Will return
@@ -871,14 +872,15 @@ private:
                                   nsFrameItems& aFrameItems,
                                   PRBool aHasPseudoParent);
 
-  nsresult ConstructFrameInternal( nsFrameConstructorState& aState,
-                                   nsIContent*              aContent,
-                                   nsIFrame*                aParentFrame,
-                                   nsIAtom*                 aTag,
-                                   PRInt32                  aNameSpaceID,
-                                   nsStyleContext*          aStyleContext,
-                                   nsFrameItems&            aFrameItems,
-                                   PRBool                   aXBLBaseTag);
+  nsresult ConstructFrameInternal(nsFrameConstructorState& aState,
+                                  nsIContent*              aContent,
+                                  nsIFrame*                aParentFrame,
+                                  nsIAtom*                 aTag,
+                                  PRInt32                  aNameSpaceID,
+                                  nsStyleContext*          aStyleContext,
+                                  nsFrameItems&            aFrameItems,
+                                  PRBool                   aAllowXBLBase,
+                                  PRBool                   aAllowPageBreaks);
 
   nsresult CreateAnonymousFrames(nsIAtom*                 aTag,
                                  nsFrameConstructorState& aState,

From 55f6d5a8f2445ccd80d129c8a4c486aad02e93a8 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sun, 1 Mar 2009 10:16:29 -0500
Subject: [PATCH 12/22] Bug 480017.  Suppress misplaced popups before we
 construct table pseudoframe parents.  r+sr=roc

---
 layout/base/nsCSSFrameConstructor.cpp  | 16 ++++++++--------
 layout/reftests/bugs/480017-1-ref.html | 15 +++++++++++++++
 layout/reftests/bugs/480017-1.html     | 24 ++++++++++++++++++++++++
 layout/reftests/bugs/reftest.list      |  1 +
 4 files changed, 48 insertions(+), 8 deletions(-)
 create mode 100644 layout/reftests/bugs/480017-1-ref.html
 create mode 100644 layout/reftests/bugs/480017-1.html

diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 04c9c89589e..111d266d664 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -6634,6 +6634,14 @@ nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState& aState,
     if (data->mBits & FCDATA_SUPPRESS_FRAME) {
       return NS_OK;
     }
+
+#ifdef MOZ_XUL
+    if ((data->mBits & FCDATA_IS_POPUP) &&
+        aParentFrame->GetType() != nsGkAtoms::menuFrame &&
+        !aState.mPopupItems.containingBlock) {
+      return NS_OK;
+    }
+#endif /* MOZ_XUL */
   }
   
   nsIFrame* adjParentFrame = aParentFrame;
@@ -6669,14 +6677,6 @@ nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState& aState,
     styleContext->GetStyleBackground();
   }
 
-#ifdef MOZ_XUL
-  if ((data->mBits & FCDATA_IS_POPUP) &&
-      adjParentFrame->GetType() != nsGkAtoms::menuFrame &&
-      !aState.mPopupItems.containingBlock) {
-    return NS_OK;
-  }
-#endif /* MOZ_XUL */
-
   // Construct a page break frame for page-break-before, if needed, and
   // remember whether we need one for page-break-after.
   PRBool pageBreakAfter =
diff --git a/layout/reftests/bugs/480017-1-ref.html b/layout/reftests/bugs/480017-1-ref.html
new file mode 100644
index 00000000000..3cb305a14a3
--- /dev/null
+++ b/layout/reftests/bugs/480017-1-ref.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <table cellpadding="0" cellspacing="0">
+      <tr>
+        <td>First Column</td>
+        <td>Second Column</td>
+      </tr>
+      <tr>
+        <td>First Column</td>
+        <td>Second Column</td>
+      </tr>
+    </table>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/480017-1.html b/layout/reftests/bugs/480017-1.html
new file mode 100644
index 00000000000..d1dd33a0df7
--- /dev/null
+++ b/layout/reftests/bugs/480017-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="display:table">
+      <div style="display: table-row">
+        <div style="display: table-cell">
+          First Column
+        </div>
+        <div style="display: table-cell">
+          Second Column
+        </div>
+      </div>
+      <div style="display: table-row">
+        <div style="display: table-cell">
+          First Column
+        </div>
+        <div style="display: -moz-popup; display: popup"></div>
+        <div style="display: table-cell">
+          Second Column
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index beba24adc83..860d8f20a45 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1094,3 +1094,4 @@ fails == 461512-1.html 461512-1-ref.html # Bug 461512
 == 478811-4.html 478811-4-ref.html
 == 478956-1a.html 478956-1-ref.html
 == 478956-1b.html 478956-1-ref.html
+== 480017-1.html 480017-1-ref.html

From dba41efe0b2e0f47d9171adc547e0d483c379b6f Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sun, 1 Mar 2009 10:16:30 -0500
Subject: [PATCH 13/22] Bug 480208.  Eliminate the tag version of
 CreateAnonymousFrames.  r+sr=roc

---
 layout/base/nsCSSFrameConstructor.cpp | 49 +++------------------------
 layout/base/nsCSSFrameConstructor.h   |  7 ----
 2 files changed, 5 insertions(+), 51 deletions(-)

diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 111d266d664..076f14f5bbf 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -4438,8 +4438,7 @@ nsCSSFrameConstructor::ConstructButtonFrame(nsFrameConstructorState& aState,
     // if there are any anonymous children create frames for them.  Note that
     // we're doing this using a different parent frame from the one we pass to
     // ProcessChildren!
-    CreateAnonymousFrames(aTag, aState, aContent, buttonFrame,
-                          anonymousChildItems);
+    CreateAnonymousFrames(aState, aContent, buttonFrame, anonymousChildItems);
     if (anonymousChildItems.childList) {
       // the anonymous content is already parented to the area frame
       aState.mFrameManager->AppendFrames(blockFrame, nsnull,
@@ -4548,8 +4547,7 @@ nsCSSFrameConstructor::ConstructSelectFrame(nsFrameConstructorState& aState,
       // element (the scrollbars).
 
       nsFrameItems childItems;
-      CreateAnonymousFrames(nsGkAtoms::combobox, aState, aContent,
-                            comboboxFrame, childItems);
+      CreateAnonymousFrames(aState, aContent, comboboxFrame, childItems);
   
       comboboxFrame->SetInitialChildList(nsnull, childItems.childList);
 
@@ -5287,40 +5285,6 @@ nsCSSFrameConstructor::ConstructFrameFromData(const FrameConstructionData* aData
   return NS_OK;
 }
 
-nsresult
-nsCSSFrameConstructor::CreateAnonymousFrames(nsIAtom*                 aTag,
-                                             nsFrameConstructorState& aState,
-                                             nsIContent*              aParent,
-                                             nsIFrame*                aNewFrame,
-                                             nsFrameItems&            aChildItems,
-                                             PRBool                   aIsRoot)
-{
-  // See if we might have anonymous content
-  // by looking at the tag rather than doing a QueryInterface on
-  // the frame.  Only these tags' frames can have anonymous content
-  // through nsIAnonymousContentCreator.  We do this check for
-  // performance reasons. If we did a QueryInterface on every tag it
-  // would be inefficient.
-  // XXXbz what about just having a virtual method to check this instead?
-  if (!aIsRoot &&
-      aTag != nsGkAtoms::input &&
-      aTag != nsGkAtoms::textarea &&
-      aTag != nsGkAtoms::combobox &&
-      aTag != nsGkAtoms::isindex &&
-      aTag != nsGkAtoms::scrollbar
-#ifdef MOZ_SVG
-      && aTag != nsGkAtoms::use
-#endif
-#ifdef MOZ_MEDIA
-      && aTag != nsGkAtoms::video
-      && aTag != nsGkAtoms::audio
-#endif
-      )
-    return NS_OK;
-
-  return CreateAnonymousFrames(aState, aParent, aNewFrame, aChildItems);
-}
-
 // after the node has been constructed and initialized create any
 // anonymous content a node needs.
 nsresult
@@ -10296,8 +10260,7 @@ nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState& aState,
     // Create any anonymous frames the initial containing block frame requires.
     // This must happen before the rest of ProcessChildren to ensure that
     // popups are never constructed before the popupset.
-    CreateAnonymousFrames(nsnull, aState, aContent, aFrame, aFrameItems,
-                          PR_TRUE);
+    CreateAnonymousFrames(aState, aContent, aFrame, aFrameItems);
   }
 
   nsresult rv = NS_OK;
@@ -10336,8 +10299,7 @@ nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState& aState,
   }
 
   if (aFrame != mRootElementFrame) {
-    CreateAnonymousFrames(aContent->Tag(), aState, aContent, aFrame,
-                          aFrameItems);
+    CreateAnonymousFrames(aState, aContent, aFrame, aFrameItems);
   }
 
   // process the current pseudo frame state
@@ -11527,8 +11489,7 @@ nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState& aState,
                                       childItems, &kidsAllInline);
   if (kidsAllInline) {
     // Set the inline frame's initial child list
-    CreateAnonymousFrames(aContent->Tag(), aState, aContent, newFrame,
-                          childItems);
+    CreateAnonymousFrames(aState, aContent, newFrame, childItems);
 
     newFrame->SetInitialChildList(nsnull, childItems.childList);
     if (NS_SUCCEEDED(rv)) {
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index 2fd6b5262b8..a89d7cb9e18 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -882,13 +882,6 @@ private:
                                   PRBool                   aAllowXBLBase,
                                   PRBool                   aAllowPageBreaks);
 
-  nsresult CreateAnonymousFrames(nsIAtom*                 aTag,
-                                 nsFrameConstructorState& aState,
-                                 nsIContent*              aParent,
-                                 nsIFrame*                aNewFrame,
-                                 nsFrameItems&            aChildItems,
-                                 PRBool                   aIsRoot = PR_FALSE);
-
   nsresult CreateAnonymousFrames(nsFrameConstructorState& aState,
                                  nsIContent*              aParent,
                                  nsIFrame*                aParentFrame,

From b66999c6dcd10d016fb272979e44ab008339cb73 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan.akhgari@gmail.com>
Date: Sun, 1 Mar 2009 20:03:52 +0430
Subject: [PATCH 14/22] Bug 478430 - [RTL] URLs in exceptions dialogs are
 right-to-left; r=gavin

---
 browser/components/preferences/permissions.js            | 9 ++++++++-
 .../components/passwordmgr/content/passwordManager.js    | 5 ++++-
 .../passwordmgr/content/passwordManagerCommon.js         | 6 ++++++
 .../passwordmgr/content/passwordManagerExceptions.js     | 5 ++++-
 4 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/browser/components/preferences/permissions.js b/browser/components/preferences/permissions.js
index 5b16d151052..1629af954b1 100644
--- a/browser/components/preferences/permissions.js
+++ b/browser/components/preferences/permissions.js
@@ -82,7 +82,10 @@ var gPermissionManager = {
     cycleHeader: function(column) {},
     getRowProperties: function(row,prop){},
     getColumnProperties: function(column,prop){},
-    getCellProperties: function(row,column,prop){}
+    getCellProperties: function(row,column,prop){
+      if (column.element.getAttribute("id") == "siteCol")
+        prop.AppendElement(this._ltrAtom);
+    }
   },
   
   _getCapabilityString: function (aCapability)
@@ -214,6 +217,10 @@ var gPermissionManager = {
     this._loadPermissions();
     
     urlField.focus();
+
+    this._ltrAtom = Components.classes["@mozilla.org/atom-service;1"]
+                              .getService(Components.interfaces.nsIAtomService)
+                              .getAtom("ltr");
   },
   
   uninit: function ()
diff --git a/toolkit/components/passwordmgr/content/passwordManager.js b/toolkit/components/passwordmgr/content/passwordManager.js
index a502af4c523..88c586a7994 100644
--- a/toolkit/components/passwordmgr/content/passwordManager.js
+++ b/toolkit/components/passwordmgr/content/passwordManager.js
@@ -93,7 +93,10 @@ var signonsTreeView = {
   cycleHeader : function(column) {},
   getRowProperties : function(row,prop) {},
   getColumnProperties : function(column,prop) {},
-  getCellProperties : function(row,column,prop) {}
+  getCellProperties : function(row,column,prop) {
+    if (column.element.getAttribute("id") == "siteCol")
+      prop.AppendElement(kLTRAtom);
+  }
  };
 
 
diff --git a/toolkit/components/passwordmgr/content/passwordManagerCommon.js b/toolkit/components/passwordmgr/content/passwordManagerCommon.js
index 4d1e97a8669..ff352728d1f 100644
--- a/toolkit/components/passwordmgr/content/passwordManagerCommon.js
+++ b/toolkit/components/passwordmgr/content/passwordManagerCommon.js
@@ -59,6 +59,8 @@ var rejectsTree;
 
 var showingPasswords = false;
 
+var kLTRAtom;
+
 function Startup() {
   // xpconnect to password manager interfaces
   passwordmanager = Components.classes["@mozilla.org/login-manager;1"]
@@ -73,6 +75,10 @@ function Startup() {
 
   signonsTree = document.getElementById("signonsTree");
   rejectsTree = document.getElementById("rejectsTree");
+
+  kLTRAtom = Components.classes["@mozilla.org/atom-service;1"]
+                       .getService(Components.interfaces.nsIAtomService)
+                       .getAtom("ltr");
 }
 
 function Shutdown() {
diff --git a/toolkit/components/passwordmgr/content/passwordManagerExceptions.js b/toolkit/components/passwordmgr/content/passwordManagerExceptions.js
index 62377e294e5..35a6fd6275e 100644
--- a/toolkit/components/passwordmgr/content/passwordManagerExceptions.js
+++ b/toolkit/components/passwordmgr/content/passwordManagerExceptions.js
@@ -64,7 +64,10 @@ var rejectsTreeView = {
   cycleHeader : function(column) {},
   getRowProperties : function(row,prop){},
   getColumnProperties : function(column,prop){},
-  getCellProperties : function(row,column,prop){}
+  getCellProperties : function(row,column,prop){
+    if (column.element.getAttribute("id") == "rejectCol")
+      prop.AppendElement(kLTRAtom);
+  }
  };
 
 function Reject(number, host) {

From 9054186d5206deefad4c142db1abf23b4434d945 Mon Sep 17 00:00:00 2001
From: Arpad Borsos <arpad.borsos@googlemail.com>
Date: Sun, 1 Mar 2009 18:23:25 +0100
Subject: [PATCH 15/22] Bug 474369 - get rid of nsVoidArray; activex fixup;
 r+sr=benjamin

---
 .../browser/activex/src/control/PromptService.cpp      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/embedding/browser/activex/src/control/PromptService.cpp b/embedding/browser/activex/src/control/PromptService.cpp
index e826eb67977..e9887a03279 100644
--- a/embedding/browser/activex/src/control/PromptService.cpp
+++ b/embedding/browser/activex/src/control/PromptService.cpp
@@ -666,18 +666,18 @@ CMozillaBrowser *CPromptService::GetOwningBrowser(nsIDOMWindow *parent)
     if (parent == nsnull)
     {
         // return the first element from the list if there is one
-        if (CMozillaBrowser::sBrowserList.Count() > 0)
+        if (CMozillaBrowser::sBrowserList.Length() > 0)
         {
-            return (CMozillaBrowser *) CMozillaBrowser::sBrowserList[0];
+            return CMozillaBrowser::sBrowserList[0];
         }
         return NULL;
     }
 
     // Search for the browser with a content window matching the one provided
-    PRInt32 i;
-    for (i = 0; i < CMozillaBrowser::sBrowserList.Count(); i++)
+    PRUint32 i;
+    for (i = 0; i < CMozillaBrowser::sBrowserList.Length(); i++)
     {
-        CMozillaBrowser *p = (CMozillaBrowser *) CMozillaBrowser::sBrowserList[i];
+        CMozillaBrowser *p = CMozillaBrowser::sBrowserList[i];
         if (p->mWebBrowser)
         {
             nsCOMPtr<nsIDOMWindow> domWindow;

From 1dbf14278337c38175655383a60d40afaa00968c Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Sun, 1 Mar 2009 18:23:26 +0100
Subject: [PATCH 16/22] Bug 479543 - mozStorageConnection::Close should use
 NS_ERROR instead of NS_WARNING to complain about unfinalized statements;
 r=sdwilsh

---
 storage/src/mozStorageConnection.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/storage/src/mozStorageConnection.cpp b/storage/src/mozStorageConnection.cpp
index c7efa44648a..b1ddd717393 100644
--- a/storage/src/mozStorageConnection.cpp
+++ b/storage/src/mozStorageConnection.cpp
@@ -264,7 +264,7 @@ mozStorageConnection::Close()
 
     int srv = sqlite3_close(mDBConn);
     if (srv != SQLITE_OK)
-        NS_WARNING("sqlite3_close failed. There are probably outstanding statements that are listed above!");
+        NS_ERROR("sqlite3_close failed. There are probably outstanding statements that are listed above!");
 
     mDBConn = NULL;
     return ConvertResultCode(srv);

From cc460b42fbb42831620fe80c9715d44910471a3d Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Sun, 1 Mar 2009 19:22:54 +0000
Subject: [PATCH 17/22] =?UTF-8?q?Bug=20364785=20Remove=20bogus=20popup=20a?=
 =?UTF-8?q?ttribute=20from=20menubutton=20r=3DD=C3=A3o?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 browser/components/search/content/search.xml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/browser/components/search/content/search.xml b/browser/components/search/content/search.xml
index 90a2e7ac4a6..bb4fb1204a0 100644
--- a/browser/components/search/content/search.xml
+++ b/browser/components/search/content/search.xml
@@ -81,13 +81,11 @@
         <xul:button class="searchbar-engine-button"
                     type="menu"
                     anonid="searchbar-engine-button"
-                    popup="_child"
                     chromedir="&locale.dir;">
           <xul:image class="searchbar-engine-image" xbl:inherits="src"/>
           <xul:image class="searchbar-dropmarker-image"/>
           <xul:menupopup class="searchbar-popup"
-                         anonid="searchbar-popup"
-                         position="after_start">
+                         anonid="searchbar-popup">
             <xul:menuseparator/>
             <xul:menuitem class="open-engine-manager"
                           anonid="open-engine-manager"

From df0b2421b8762f77c751cd3ab749aa24eb993f6d Mon Sep 17 00:00:00 2001
From: "timeless@mozdev.org" <none@none>
Date: Sun, 1 Mar 2009 17:06:55 -0800
Subject: [PATCH 18/22] Bug 400322 "ASSERTION: nsStandardURL not thread-safe"
 (nsJARInputThunk marked as threadsafe uses nsJARURI in a non threadsafe
 manner), r+sr=biesi

---
 modules/libjar/nsJARChannel.cpp | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp
index 73914dfae09..a943bbd6f7e 100644
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -90,11 +90,15 @@ public:
                     nsIZipReaderCache *jarCache)
         : mJarCache(jarCache)
         , mJarFile(jarFile)
-        , mFullJarURI(fullJarURI)
         , mJarEntry(jarEntry)
         , mContentLength(-1)
     {
         NS_ASSERTION(mJarFile, "no jar file");
+
+        if (fullJarURI) {
+            nsresult rv = fullJarURI->GetAsciiSpec(mJarDirSpec);
+            NS_ASSERTION(NS_SUCCEEDED(rv), "this shouldn't fail");
+        }
     }
 
     virtual ~nsJARInputThunk()
@@ -120,7 +124,7 @@ private:
     nsCOMPtr<nsIZipReaderCache> mJarCache;
     nsCOMPtr<nsIZipReader>      mJarReader;
     nsCOMPtr<nsIFile>           mJarFile;
-    nsCOMPtr<nsIURI>            mFullJarURI;
+    nsCString                   mJarDirSpec;
     nsCOMPtr<nsIInputStream>    mJarStream;
     nsCString                   mJarEntry;
     PRInt32                     mContentLength;
@@ -150,11 +154,9 @@ nsJARInputThunk::EnsureJarStream()
         // A directory stream also needs the Spec of the FullJarURI
         // because is included in the stream data itself.
 
-        nsCAutoString jarDirSpec;
-        rv = mFullJarURI->GetAsciiSpec(jarDirSpec);
-        if (NS_FAILED(rv)) return rv;
+        NS_ENSURE_STATE(!mJarDirSpec.IsEmpty());
 
-        rv = mJarReader->GetInputStreamWithSpec(jarDirSpec,
+        rv = mJarReader->GetInputStreamWithSpec(mJarDirSpec,
                                                 mJarEntry.get(),
                                                 getter_AddRefs(mJarStream));
     }

From 4df8d3a34121ef76a721278255e884ffd0094745 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 1 Mar 2009 17:06:58 -0800
Subject: [PATCH 19/22] Bug 224012 - VerReg.c warning: "VR_FILE_SEP redefined",
 r+sr=dveditz

---
 modules/libreg/src/VerReg.c | 31 ++++---------------------------
 1 file changed, 4 insertions(+), 27 deletions(-)

diff --git a/modules/libreg/src/VerReg.c b/modules/libreg/src/VerReg.c
index 962464ff27a..3986a5efa04 100644
--- a/modules/libreg/src/VerReg.c
+++ b/modules/libreg/src/VerReg.c
@@ -76,7 +76,7 @@
 #include "NSReg.h"
 #include "VerReg.h"
 
-#if defined(XP_MAC) || defined(XP_MACOSX)
+#if defined(XP_MACOSX)
 #include <Folders.h>
 #endif
 
@@ -158,7 +158,7 @@ static REGERR vr_GetUninstallItemPath(char *regPackageName, char *regbuf, uint32
 static REGERR vr_convertPackageName(char *regPackageName, char *convertedPackageName, uint32 convertedDataLength);
 static REGERR vr_unmanglePackageName(char *mangledPackageName, char *regPackageName, uint32 regPackageLength);
 
-#if defined(XP_MAC) || defined(XP_MACOSX)
+#if defined(XP_MACOSX)
 static void vr_MacAliasFromPath(const char * fileName, void ** alias, int32 * length);
 static char * vr_PathFromMacAlias(const void * alias, uint32 aliasLength);
 #endif
@@ -289,14 +289,7 @@ done:
 
 #if defined(XP_WIN) || defined(XP_OS2)
 #define VR_FILE_SEP '\\'
-#endif
-#if defined(XP_MAC) || defined(XP_MACOSX)
-#define VR_FILE_SEP ':'
-#endif
-#ifdef XP_BEOS
-#define VR_FILE_SEP '/'
-#endif
-#ifdef XP_UNIX
+#elif defined(XP_UNIX) || defined(XP_BEOS)
 #define VR_FILE_SEP '/'
 #endif
 
@@ -452,7 +445,7 @@ static REGERR vr_GetPathname(HREG reg, RKEY key, char *entry, char *buf, uint32
     
     info.size = sizeof(REGINFO);
         
-#if !defined(XP_MAC) && !defined(XP_MACOSX)
+#if !defined(XP_MACOSX)
         err = NR_RegGetEntry( reg, key, entry, (void*)buf, &sizebuf );
         return err;
 #else
@@ -686,10 +679,6 @@ static REGERR vr_FindKey(char *component_path, HREG *hreg, RKEY *key)
  * ---------------------------------------------------------------------
  */
 
-#ifdef XP_MAC
-#pragma export on
-#endif
-
 #ifndef STANDALONE_REGISTRY
 VR_INTERFACE(REGERR) VR_PackRegistry(void *userData, nr_RegPackCallbackFunc fn)
 {
@@ -1159,10 +1148,6 @@ VR_INTERFACE(REGERR) VR_GetRefCount(char *component_path, int *result)
 
 }   /* GetRefCount */
 
-#ifdef XP_MAC
-#pragma export reset
-#endif
-
 static REGERR vr_GetUninstallItemPath(char *regPackageName, char *regbuf, uint32 regbuflen)
 {
     XP_Bool bSharedUninstall = FALSE;
@@ -1339,10 +1324,6 @@ static REGERR vr_unmanglePackageName(char *mangledPackageName, char *regPackageN
     return REGERR_OK;
 }
 
-#ifdef XP_MAC
-#pragma export on
-#endif
-
 VR_INTERFACE(REGERR) VR_UninstallCreateNode(char *regPackageName, char *userPackageName)
 {
     REGERR err;
@@ -1853,8 +1834,4 @@ VR_INTERFACE(REGERR) VR_EnumUninstall(REGENUM *state, char* userPackageName,
 
 }   /* EnumUninstall */
 
-#ifdef XP_MAC
-#pragma export reset
-#endif
-
 /* EOF: VerReg.c */

From e38706facd443bc5b766dbfea211d2cca2a8811f Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan.akhgari@gmail.com>
Date: Mon, 2 Mar 2009 08:32:29 +0430
Subject: [PATCH 20/22] Bug 463256 - SSL sites sometimes don't load after
 re-entering regular browsing mode (from Private Browsing); r=mconnor
 a1.9.1=blocking1.9.1+

---
 .../src/nsPrivateBrowsingService.js           |  8 ++
 .../privatebrowsing/test/browser/Makefile.in  |  1 +
 ...wser_privatebrowsing_sslsite_transition.js | 83 +++++++++++++++++++
 3 files changed, 92 insertions(+)
 create mode 100644 browser/components/privatebrowsing/test/browser/browser_privatebrowsing_sslsite_transition.js

diff --git a/browser/components/privatebrowsing/src/nsPrivateBrowsingService.js b/browser/components/privatebrowsing/src/nsPrivateBrowsingService.js
index c0b8278114f..fa6e2f4e7e6 100644
--- a/browser/components/privatebrowsing/src/nsPrivateBrowsingService.js
+++ b/browser/components/privatebrowsing/src/nsPrivateBrowsingService.js
@@ -268,6 +268,14 @@ PrivateBrowsingService.prototype = {
                       getService(Ci.nsIHttpAuthManager);
         authMgr.clearAll();
 
+        // Prevent any SSL sockets from remaining open (bug 463256)
+        let ios = Cc["@mozilla.org/network/io-service;1"].
+                  getService(Ci.nsIIOService);
+        if (!ios.offline) {
+          ios.offline = true;
+          ios.offline = false;
+        }
+
         if (!this._inPrivateBrowsing) {
           // Clear the error console
           let consoleService = Cc["@mozilla.org/consoleservice;1"].
diff --git a/browser/components/privatebrowsing/test/browser/Makefile.in b/browser/components/privatebrowsing/test/browser/Makefile.in
index a2815c46fb1..158527d50fd 100644
--- a/browser/components/privatebrowsing/test/browser/Makefile.in
+++ b/browser/components/privatebrowsing/test/browser/Makefile.in
@@ -56,6 +56,7 @@ _BROWSER_TEST_FILES =  \
 		browser_privatebrowsing_crh.js \
 		browser_privatebrowsing_windowtitle.js \
 		browser_privatebrowsing_windowtitle_page.html \
+		browser_privatebrowsing_sslsite_transition.js \
 		$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)
diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_sslsite_transition.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_sslsite_transition.js
new file mode 100644
index 00000000000..a67167eb563
--- /dev/null
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_sslsite_transition.js
@@ -0,0 +1,83 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Private Browsing Tests.
+ *
+ * The Initial Developer of the Original Code is
+ * Ehsan Akhgari.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Ehsan Akhgari <ehsan.akhgari@gmail.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// This test makes sure that SSL sites load correctly after leaving the
+// Private Browsing mode (bug 463256).
+
+function test() {
+  // initialization
+  let pb = Cc["@mozilla.org/privatebrowsing;1"].
+           getService(Ci.nsIPrivateBrowsingService);
+
+  const kTestURL = "https://example.com/";
+
+  // load an SSL site in the first tab and wait for it to finish loading
+  let tab = gBrowser.tabContainer.childNodes[0];
+  let browser = gBrowser.getBrowserForTab(tab);
+  browser.addEventListener("load", function() {
+    browser.removeEventListener("load", arguments.callee, true);
+
+    // enter the private browsing mode, and wait for the about:pb page to load
+    pb.privateBrowsingEnabled = true;
+    tab = gBrowser.tabContainer.childNodes[0];
+    browser = gBrowser.getBrowserForTab(tab);
+    browser.addEventListener("load", function() {
+      browser.removeEventListener("load", arguments.callee, true);
+
+      is(browser.contentWindow.location, "about:privatebrowsing",
+        "about:privatebrowsing should be loaded at this stage");
+
+      // leave the private browsing mode, and wait for the SSL page to load again
+      pb.privateBrowsingEnabled = false;
+      tab = gBrowser.tabContainer.childNodes[0];
+      browser = gBrowser.getBrowserForTab(tab);
+      // Note: if the page fails to load, the test will time out
+      browser.addEventListener("load", function() {
+        browser.removeEventListener("load", arguments.callee, true);
+
+        is(browser.contentWindow.location, kTestURL,
+          "The original SSL page should be loaded at this stage");
+
+        browser.contentWindow.location = "about:blank";
+        finish();
+      }, true);
+    }, true);
+  }, true);
+  browser.contentWindow.location = kTestURL;
+
+  waitForExplicitFinish();
+}

From d361e19219a3f4565e7e09c19905dfdf53b682bf Mon Sep 17 00:00:00 2001
From: Walter Meinl <wuno@lsvw.de>
Date: Mon, 2 Mar 2009 07:26:26 +0100
Subject: [PATCH 21/22] Bug 426639 - Fix the test harness to work on OS/2; rexx
 script; r=mozilla@Weilbacher.org

---
 testing/xpcshell/test_os2.cmd | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 testing/xpcshell/test_os2.cmd

diff --git a/testing/xpcshell/test_os2.cmd b/testing/xpcshell/test_os2.cmd
new file mode 100644
index 00000000000..684b0d935cf
--- /dev/null
+++ b/testing/xpcshell/test_os2.cmd
@@ -0,0 +1,24 @@
+/* Invoke unit tests on OS/2 */
+PARSE ARG dist prog parm
+dist=forwardtoback(dist);
+'set BEGINLIBPATH='dist'\bin;%BEGINLIBPATH%'
+'set LIBPATHSTRICT=T'
+if substr(FILESPEC("name",prog),1,5) \= 'test_'
+     then
+	do
+           prog=forwardtoback(prog)
+           prog parm
+           exit
+        end
+     else
+   bash prog parm
+exit
+
+forwardtoback: procedure
+  arg pathname
+  parse var pathname pathname'/'rest
+  do while (rest <> "")
+    pathname = pathname'\'rest
+    parse var pathname pathname'/'rest
+  end
+  return pathname

From 4ad9fe786b913345a73066e43074154434059d35 Mon Sep 17 00:00:00 2001
From: Walter Meinl <wuno@lsvw.de>
Date: Mon, 2 Mar 2009 07:28:09 +0100
Subject: [PATCH 22/22] Bug 426639 - Fix the test harness to work on OS/2; m-c
 *.mk files; r=mozilla@Weilbacher.org

---
 config/config.mk        | 4 ++++
 config/rules.mk         | 6 +++++-
 js/src/config/config.mk | 4 ++++
 js/src/config/rules.mk  | 6 +++++-
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/config/config.mk b/config/config.mk
index 91003253014..304fbc636fd 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -860,6 +860,10 @@ ifeq (,$(filter WINCE WINNT OS2,$(OS_ARCH)))
 RUN_TEST_PROGRAM = $(DIST)/bin/run-mozilla.sh
 endif
 
+ifeq ($(OS_ARCH),OS2)
+RUN_TEST_PROGRAM = $(topsrcdir)/testing/xpcshell/test_os2.cmd "$(DIST)"
+endif
+
 #
 # Java macros
 #
diff --git a/config/rules.mk b/config/rules.mk
index 5897cdadb20..ba1147b7ad2 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -155,9 +155,13 @@ else
 FWDSLASH_TOPSRCDIR := $(topsrcdir)
 ifeq ($(HOST_OS_ARCH),WINNT)
 NATIVE_TOPSRCDIR   := $(subst /,\\,$(WIN_TOP_SRC))
-else 
+else
+ifeq ($(HOST_OS_ARCH),os2-emx)
+NATIVE_TOPSRCDIR   := $(subst /,\\,$(topsrcdir))
+else
 NATIVE_TOPSRCDIR   := $(topsrcdir)
 endif
+endif
 endif # CYGWIN_WRAPPER
 
 testxpcsrcdir = $(topsrcdir)/testing/xpcshell
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 91003253014..304fbc636fd 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -860,6 +860,10 @@ ifeq (,$(filter WINCE WINNT OS2,$(OS_ARCH)))
 RUN_TEST_PROGRAM = $(DIST)/bin/run-mozilla.sh
 endif
 
+ifeq ($(OS_ARCH),OS2)
+RUN_TEST_PROGRAM = $(topsrcdir)/testing/xpcshell/test_os2.cmd "$(DIST)"
+endif
+
 #
 # Java macros
 #
diff --git a/js/src/config/rules.mk b/js/src/config/rules.mk
index 5897cdadb20..ba1147b7ad2 100644
--- a/js/src/config/rules.mk
+++ b/js/src/config/rules.mk
@@ -155,9 +155,13 @@ else
 FWDSLASH_TOPSRCDIR := $(topsrcdir)
 ifeq ($(HOST_OS_ARCH),WINNT)
 NATIVE_TOPSRCDIR   := $(subst /,\\,$(WIN_TOP_SRC))
-else 
+else
+ifeq ($(HOST_OS_ARCH),os2-emx)
+NATIVE_TOPSRCDIR   := $(subst /,\\,$(topsrcdir))
+else
 NATIVE_TOPSRCDIR   := $(topsrcdir)
 endif
+endif
 endif # CYGWIN_WRAPPER
 
 testxpcsrcdir = $(topsrcdir)/testing/xpcshell