merge mozilla-inbound to mozilla-central a=merge

2024-09-13 09:24:08 -07:00 · 2015-03-04 15:24:55 +01:00 · 2015-03-04 15:24:55 +01:00 · 8bf2cb83cb
commit 8bf2cb83cb
parent 5a391be893 171cf0ee9d
74 changed files with 1015 additions and 322 deletions
--- a/accessible/atk/Platform.cpp
+++ b/accessible/atk/Platform.cpp
@ -18,8 +18,9 @@
 #include <dbus/dbus.h>
 #endif
 #include <gtk/gtk.h>
+
 #if (MOZ_WIDGET_GTK == 3)
-#include <atk-bridge.h>
+extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
 #endif

 using namespace mozilla;
@ -46,7 +47,6 @@ static gulong sToplevel_hide_hook = 0;

 GType g_atk_hyperlink_impl_type = G_TYPE_INVALID;

-#if (MOZ_WIDGET_GTK == 2)
 struct GnomeAccessibilityModule
 {
    const char *libName;
@ -67,11 +67,13 @@ static GnomeAccessibilityModule sAtkBridge = {
    "gnome_accessibility_module_shutdown", nullptr
 };

+#if (MOZ_WIDGET_GTK == 2)
 static GnomeAccessibilityModule sGail = {
    "libgail.so", nullptr,
    "gnome_accessibility_module_init", nullptr,
    "gnome_accessibility_module_shutdown", nullptr
 };
+#endif

 static nsresult
 LoadGtkModule(GnomeAccessibilityModule& aModule)
@ -98,7 +100,11 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
            else
                subLen = loc2 - loc1;
            nsAutoCString sub(Substring(libPath, loc1, subLen));
+#if (MOZ_WIDGET_GTK == 2)
            sub.AppendLiteral("/gtk-2.0/modules/");
+#else
+            sub.AppendLiteral("/gtk-3.0/modules/");
+#endif
            sub.Append(aModule.libName);
            aModule.lib = PR_LoadLibrary(sub.get());
            if (aModule.lib)
@ -123,7 +129,6 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
    }
    return NS_OK;
 }
-#endif // (MOZ_WIDGET_GTK == 2)

 void
 a11y::PlatformInit()
@ -175,14 +180,17 @@ a11y::PlatformInit()

  // Init atk-bridge now
  PR_SetEnv("NO_AT_BRIDGE=0");
-#if (MOZ_WIDGET_GTK == 2)
-  rv = LoadGtkModule(sAtkBridge);
-  if (NS_SUCCEEDED(rv)) {
-    (*sAtkBridge.init)();
-  }
-#else
-  atk_bridge_adaptor_init(nullptr, nullptr);
+#if (MOZ_WIDGET_GTK == 3)
+  if (atk_bridge_adaptor_init) {
+    atk_bridge_adaptor_init(nullptr, nullptr);
+  } else
 #endif
+  {
+    nsresult rv = LoadGtkModule(sAtkBridge);
+    if (NS_SUCCEEDED(rv)) {
+      (*sAtkBridge.init)();
+    }
+  }

  if (!sToplevel_event_hook_added) {
    sToplevel_event_hook_added = true;
@ -210,7 +218,6 @@ a11y::PlatformShutdown()
                                    sToplevel_hide_hook);
    }

-#if (MOZ_WIDGET_GTK == 2)
    if (sAtkBridge.lib) {
        // Do not shutdown/unload atk-bridge,
        // an exit function registered will take care of it
@ -221,6 +228,7 @@ a11y::PlatformShutdown()
        sAtkBridge.init = nullptr;
        sAtkBridge.shutdown = nullptr;
    }
+#if (MOZ_WIDGET_GTK == 2)
    if (sGail.lib) {
        // Do not shutdown gail because
        // 1) Maybe it's not init-ed by us. e.g. GtkEmbed
--- a/accessible/generic/HyperTextAccessible-inl.h
+++ b/accessible/generic/HyperTextAccessible-inl.h
@ -55,11 +55,22 @@ HyperTextAccessible::AddToSelection(int32_t aStartOffset, int32_t aEndOffset)
 inline void
 HyperTextAccessible::ReplaceText(const nsAString& aText)
 {
-  int32_t numChars = CharacterCount();
-  if (numChars != 0)
-    DeleteText(0, numChars);
+  // We need to call DeleteText() even if there is no contents because we need
+  // to ensure to move focus to the editor via SetSelectionRange() called in
+  // DeleteText().
+  DeleteText(0, CharacterCount());

-  InsertText(aText, 0);
+  nsCOMPtr<nsIEditor> editor = GetEditor();
+  nsCOMPtr<nsIPlaintextEditor> plaintextEditor(do_QueryInterface(editor));
+  if (!plaintextEditor) {
+    return;
+  }
+
+  // DeleteText() may cause inserting <br> element in some cases. Let's
+  // select all again and replace whole contents.
+  editor->SelectAll();
+
+  plaintextEditor->InsertText(aText);
 }

 inline void
--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@ -352,6 +352,23 @@ HyperTextAccessible::TransformOffset(Accessible* aDescendant,
  return CharacterCount();
 }

+/**
+ * GetElementAsContentOf() returns a content representing an element which is
+ * or includes aNode.
+ *
+ * XXX This method is enough to retrieve ::before or ::after pseudo element.
+ *     So, if you want to use this for other purpose, you might need to check
+ *     ancestors too.
+ */
+static nsIContent* GetElementAsContentOf(nsINode* aNode)
+{
+  if (aNode->IsElement()) {
+    return aNode->AsContent();
+  }
+  nsIContent* parent = aNode->GetParent();
+  return parent && parent->IsElement() ? parent : nullptr;
+}
+
 bool
 HyperTextAccessible::OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
                                       nsRange* aRange)
@ -360,9 +377,19 @@ HyperTextAccessible::OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
  if (!startPoint.node)
    return false;

-  aRange->SetStart(startPoint.node, startPoint.idx);
+  // HyperTextAccessible manages pseudo elements generated by ::before or
+  // ::after.  However, contents of them are not in the DOM tree normally.
+  // Therefore, they are not selectable and editable.  So, when this creates
+  // a DOM range, it should not start from nor end in any pseudo contents.
+
+  nsIContent* container = GetElementAsContentOf(startPoint.node);
+  DOMPoint startPointForDOMRange =
+    ClosestNotGeneratedDOMPoint(startPoint, container);
+  aRange->SetStart(startPointForDOMRange.node, startPointForDOMRange.idx);
+
+  // If the caller wants collapsed range, let's collapse the range to its start.
  if (aStartOffset == aEndOffset) {
-    aRange->SetEnd(startPoint.node, startPoint.idx);
+    aRange->Collapse(true);
    return true;
  }

@ -370,7 +397,13 @@ HyperTextAccessible::OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
  if (!endPoint.node)
    return false;

-  aRange->SetEnd(endPoint.node, endPoint.idx);
+  if (startPoint.node != endPoint.node) {
+    container = GetElementAsContentOf(endPoint.node);
+  }
+
+  DOMPoint endPointForDOMRange =
+    ClosestNotGeneratedDOMPoint(endPoint, container);
+  aRange->SetEnd(endPointForDOMRange.node, endPointForDOMRange.idx);
  return true;
 }

@ -421,6 +454,36 @@ HyperTextAccessible::OffsetToDOMPoint(int32_t aOffset)
    DOMPoint();
 }

+DOMPoint
+HyperTextAccessible::ClosestNotGeneratedDOMPoint(const DOMPoint& aDOMPoint,
+                                                 nsIContent* aElementContent)
+{
+  MOZ_ASSERT(aDOMPoint.node, "The node must not be null");
+
+  // ::before pseudo element
+  if (aElementContent &&
+      aElementContent->NodeInfo()->NameAtom() == nsGkAtoms::mozgeneratedcontentbefore) {
+    MOZ_ASSERT(aElementContent->GetParent(),
+               "::before must have parent element");
+    // The first child of its parent (i.e., immediately after the ::before) is
+    // good point for a DOM range.
+    return DOMPoint(aElementContent->GetParent(), 0);
+  }
+
+  // ::after pseudo element
+  if (aElementContent &&
+      aElementContent->NodeInfo()->NameAtom() == nsGkAtoms::mozgeneratedcontentafter) {
+    MOZ_ASSERT(aElementContent->GetParent(),
+               "::after must have parent element");
+    // The end of its parent (i.e., immediately before the ::after) is good
+    // point for a DOM range.
+    return DOMPoint(aElementContent->GetParent(),
+                    aElementContent->GetParent()->GetChildCount());
+  }
+
+  return aDOMPoint;
+}
+
 uint32_t
 HyperTextAccessible::FindOffset(uint32_t aOffset, nsDirection aDirection,
                                nsSelectionAmount aAmount,
--- a/accessible/generic/HyperTextAccessible.h
+++ b/accessible/generic/HyperTextAccessible.h
@ -139,7 +139,10 @@ public:
                           bool aIsEndOffset) const;

  /**
-   * Convert start and end hypertext offsets into DOM range.
+   * Convert start and end hypertext offsets into DOM range.  Note that if
+   * aStartOffset and/or aEndOffset is in generated content such as ::before or
+   * ::after, the result range excludes the generated content.  See also
+   * ClosestNotGeneratedDOMPoint() for more information.
   *
   * @param  aStartOffset  [in] the given start hypertext offset
   * @param  aEndOffset    [in] the given end hypertext offset
@ -518,6 +521,23 @@ protected:

  nsresult SetSelectionRange(int32_t aStartPos, int32_t aEndPos);

+  /**
+   * Convert the given DOM point to a DOM point in non-generated contents.
+   *
+   * If aDOMPoint is in ::before, the result is immediately after it.
+   * If aDOMPoint is in ::after, the result is immediately before it.
+   *
+   * @param aDOMPoint       [in] A DOM node and an index of its child. This may
+   *                             be in a generated content such as ::before or
+   *                             ::after.
+   * @param aElementContent [in] An nsIContent representing an element of
+   *                             aDOMPoint.node.
+   * @return                An DOM point which must not be in generated
+   *                        contents.
+   */
+  DOMPoint ClosestNotGeneratedDOMPoint(const DOMPoint& aDOMPoint,
+                                       nsIContent* aElementContent);
+
  // Helpers
  nsresult GetDOMPointByFrameOffset(nsIFrame* aFrame, int32_t aOffset,
                                    Accessible* aAccessible,
--- a/accessible/tests/mochitest/editabletext/editabletext.js
+++ b/accessible/tests/mochitest/editabletext/editabletext.js
@ -56,7 +56,7 @@ function editableTextTest(aID)
  /**
   * setTextContents test.
   */
-  this.setTextContents = function setTextContents(aValue)
+  this.setTextContents = function setTextContents(aValue, aSkipStartOffset)
  {
    var testID = "setTextContents '" + aValue + "' for " + prettyName(aID);

@ -66,9 +66,12 @@ function editableTextTest(aID)
      acc.setTextContents(aValue);
    }

-    var insertTripple = aValue ? [0, aValue.length, aValue] : null;
+    aSkipStartOffset = aSkipStartOffset || 0;
+    var insertTripple = aValue ?
+      [ aSkipStartOffset, aSkipStartOffset + aValue.length, aValue ] : null;
    var oldValue = getValue(aID);
-    var removeTripple = oldValue ? [0, oldValue.length, oldValue] : null;
+    var removeTripple = oldValue ?
+      [ aSkipStartOffset, aSkipStartOffset + oldValue.length, oldValue ] : null;

    this.generateTest(aID, removeTripple, insertTripple, setTextContentsInvoke,
                      getValueChecker(aID, aValue), testID);
--- a/accessible/tests/mochitest/editabletext/test_1.html
+++ b/accessible/tests/mochitest/editabletext/test_1.html
@ -20,22 +20,24 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=452161

  <script type="application/javascript">

-    function addTestEditable(aID, aTestRun)
+    function addTestEditable(aID, aTestRun, aBeforeContent, aAfterContent)
    {
      var et = new editableTextTest(aID);
+      var startOffset = aBeforeContent ? aBeforeContent.length : 0;
+      // XXX afterContent currently is not used

      //////////////////////////////////////////////////////////////////////////
      // setTextContents
-      et.scheduleTest(et.setTextContents, "hello");
-      et.scheduleTest(et.setTextContents, "olleh");
-      et.scheduleTest(et.setTextContents, "");
+      et.scheduleTest(et.setTextContents, "hello", startOffset);
+      et.scheduleTest(et.setTextContents, "olleh", startOffset);
+      et.scheduleTest(et.setTextContents, "", startOffset);

      //////////////////////////////////////////////////////////////////////////
      // insertText
-      et.scheduleTest(et.insertText, "hello", 0, "hello");
-      et.scheduleTest(et.insertText, "ma ", 0, "ma hello");
-      et.scheduleTest(et.insertText, "ma", 2, "mama hello");
-      et.scheduleTest(et.insertText, " hello", 10, "mama hello hello");
+      et.scheduleTest(et.insertText, "hello", startOffset, "hello");
+      et.scheduleTest(et.insertText, "ma ", startOffset, "ma hello");
+      et.scheduleTest(et.insertText, "ma", startOffset + 2, "mama hello");
+      et.scheduleTest(et.insertText, " hello", startOffset + 10, "mama hello hello");

      // XXX: bug 452584

@ -71,7 +73,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=452161

      addTestEditable("input", testRun);
      addTestEditable("div", testRun);
-      addTestEditable(getNode("frame").contentDocument, testRun, '\n');
+      addTestEditable("divb", testRun, "pseudo element", "");
+      addTestEditable("diva", testRun, "", "pseudo element");
+      addTestEditable("divba", testRun, "before", "after");
+      addTestEditable(getNode("frame").contentDocument, testRun);

      testRun.run(); // Will call SimpleTest.finish();
    }
@ -90,16 +95,35 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=452161
    SimpleTest.waitForExplicitFinish();
    addA11yLoadEvent(doTest);
  </script>
+  <style>
+    #divb::before,
+    #diva::after {
+      content: "pseudo element";
+    }
+    #divba::before {
+      content: "before";
+    }
+    #divba::after {
+      content: "after";
+    }
+  </style>
 </head>
 <body>

  <a target="_blank"
     title="nsIAccessibleEditableText chrome tests"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=452161">Mozilla Bug 452161</a>
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=452161">
+    Bug 452161
+  </a>
  <a target="_blank"
     title="Cache rendered text on a11y side"
     href="https://bugzilla.mozilla.org/show_bug.cgi?id=626660">
-    Mozilla Bug 626660
+    Bug 626660
+  </a>
+  <a target="_blank"
+     title="Pseudo element support test"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=1105611">
+    Bug 1105611
  </a>
  <p id="display"></p>
  <div id="content" style="display: none"></div>
@ -108,7 +132,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=452161

  <input id="input"/>

-  <div id="div" contentEditable="true"></div>
+  <div id="div" contenteditable="true"></div>
+  <div id="divb" contenteditable="true"></div>
+  <div id="diva" contenteditable="true"></div>
+  <div id="divba" contenteditable="true"></div>

  <iframe id="frame"/>
 </body>
--- a/config/system-headers
+++ b/config/system-headers
@ -189,7 +189,6 @@ asm/signal.h
 ASRegistry.h
 assert.h
 atk/atk.h
-atk-bridge.h
 atlcom.h
 atlconv.h
 atlctl.cpp
--- a/configure.in
+++ b/configure.in
@ -4408,7 +4408,7 @@ fi

 if test "$COMPILE_ENVIRONMENT"; then
  if test "$MOZ_ENABLE_GTK3"; then
-    PKG_CHECK_MODULES(MOZ_GTK3, gtk+-3.0 >= $GTK3_VERSION gtk+-unix-print-3.0 glib-2.0 gobject-2.0 atk-bridge-2.0 $GDK_PACKAGES)
+    PKG_CHECK_MODULES(MOZ_GTK3, gtk+-3.0 >= $GTK3_VERSION gtk+-unix-print-3.0 glib-2.0 gobject-2.0 $GDK_PACKAGES)
    MOZ_GTK3_CFLAGS="-I${_topsrcdir}/widget/gtk/compat-gtk3 $MOZ_GTK3_CFLAGS"
    dnl Contrary to MOZ_GTK2_LIBS, MOZ_GTK3_LIBS needs to be literally added to TK_LIBS instead
    dnl of a make reference because of how TK_LIBS is mangled in toolkit/library/moz.build
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -14107,6 +14107,13 @@ nsGlobalWindow::CreateNamedPropertiesObject(JSContext *aCx,
  return WindowNamedPropertiesHandler::Create(aCx, aProto);
 }

+bool
+nsGlobalWindow::GetIsPrerendered()
+{
+  nsIDocShell* docShell = GetDocShell();
+  return docShell && docShell->GetIsPrerendered();
+}
+
 #ifdef MOZ_B2G
 void
 nsGlobalWindow::EnableNetworkEvent(uint32_t aType)
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@ -1272,6 +1272,8 @@ public:
                           const nsAString &aPopupWindowFeatures);
  void FireOfflineStatusEventIfChanged();

+  bool GetIsPrerendered();
+
  // Inner windows only.
  nsresult ScheduleNextIdleObserverCallback();
  uint32_t GetFuzzTimeMS();
--- a/dom/base/nsPlainTextSerializer.cpp
+++ b/dom/base/nsPlainTextSerializer.cpp
@ -88,7 +88,7 @@ nsPlainTextSerializer::nsPlainTextSerializer()
  // Flow
  mEmptyLines = 1; // The start of the document is an "empty line" in itself,
  mInWhitespace = false;
-  mPreFormatted = false;
+  mPreFormattedMail = false;
  mStartedOutput = false;

  mPreformattedBlockBoundary = false;
@ -499,7 +499,7 @@ nsPlainTextSerializer::DoOpenContainer(nsIAtom* aTag)

  if (aTag == nsGkAtoms::body) {
    // Try to figure out here whether we have a
-    // preformatted style attribute.
+    // preformatted style attribute set by Thunderbird.
    //
    // Trigger on the presence of a "pre-wrap" in the
    // style attribute. That's a very simplistic way to do
@ -513,9 +513,9 @@ nsPlainTextSerializer::DoOpenContainer(nsIAtom* aTag)

      if (kNotFound != style.Find("pre-wrap", true, whitespace)) {
 #ifdef DEBUG_preformatted
-        printf("Set mPreFormatted based on style pre-wrap\n");
+        printf("Set mPreFormattedMail based on style pre-wrap\n");
 #endif
-        mPreFormatted = true;
+        mPreFormattedMail = true;
        int32_t widthOffset = style.Find("width:");
        if (widthOffset >= 0) {
          // We have to search for the ch before the semicolon,
@ -541,16 +541,16 @@ nsPlainTextSerializer::DoOpenContainer(nsIAtom* aTag)
      }
      else if (kNotFound != style.Find("pre", true, whitespace)) {
 #ifdef DEBUG_preformatted
-        printf("Set mPreFormatted based on style pre\n");
+        printf("Set mPreFormattedMail based on style pre\n");
 #endif
-        mPreFormatted = true;
+        mPreFormattedMail = true;
        mWrapColumn = 0;
      }
    } 
    else {
      /* See comment at end of function. */
      mInWhitespace = true;
-      mPreFormatted = false;
+      mPreFormattedMail = false;
    }

    return NS_OK;
@ -1035,7 +1035,7 @@ nsPlainTextSerializer::DoAddText(bool aIsLineBreak, const nsAString& aText)
    // prettyprinting to mimic the html format, and in neither case
    // does the formatting of the html source help us.
    if ((mFlags & nsIDocumentEncoder::OutputPreformatted) ||
-        (mPreFormatted && !mWrapColumn) ||
+        (mPreFormattedMail && !mWrapColumn) ||
        IsInPre()) {
      EnsureVerticalSpace(mEmptyLines+1);
    }
@ -1556,14 +1556,14 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
  // We have two major codepaths here. One that does preformatted text and one
  // that does normal formatted text. The one for preformatted text calls
  // Output directly while the other code path goes through AddToLine.
-  if ((mPreFormatted && !mWrapColumn) || IsInPre()
+  if ((mPreFormattedMail && !mWrapColumn) || (IsInPre() && !mPreFormattedMail)
      || ((mSpanLevel > 0 || mDontWrapAnyQuotes)
          && mEmptyLines >= 0 && str.First() == char16_t('>'))) {
    // No intelligent wrapping.

    // This mustn't be mixed with intelligent wrapping without clearing
    // the mCurrentLine buffer before!!!
-    NS_ASSERTION(mCurrentLine.IsEmpty() || IsInPre(),
+    NS_ASSERTION(mCurrentLine.IsEmpty() || (IsInPre() && !mPreFormattedMail),
                 "Mixed wrapping data and nonwrapping data on the same line");
    if (!mCurrentLine.IsEmpty()) {
      FlushLine();
@ -1701,7 +1701,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
        }
      }
      // If we're already in whitespace and not preformatted, just skip it:
-      if (mInWhitespace && (nextpos == bol) && !mPreFormatted &&
+      if (mInWhitespace && (nextpos == bol) && !mPreFormattedMail &&
          !(mFlags & nsIDocumentEncoder::OutputPreformatted)) {
        // Skip whitespace
        bol++;
@ -1720,7 +1720,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
      mInWhitespace = true;
      
      offsetIntoBuffer = str.get() + bol;
-      if (mPreFormatted || (mFlags & nsIDocumentEncoder::OutputPreformatted)) {
+      if (mPreFormattedMail || (mFlags & nsIDocumentEncoder::OutputPreformatted)) {
        // Preserve the real whitespace character
        nextpos++;
        AddToLine(offsetIntoBuffer, nextpos-bol);
--- a/dom/base/nsPlainTextSerializer.h
+++ b/dom/base/nsPlainTextSerializer.h
@ -164,7 +164,8 @@ private:
                                // line and -1 if we are in a line.

  bool             mInWhitespace;
-  bool             mPreFormatted;
+  bool             mPreFormattedMail; // we're dealing with special DOM
+                                      // used by Thunderbird code.
  bool             mStartedOutput; // we've produced at least a character

  // While handling a new tag, this variable should remind if any line break
--- a/dom/base/test/TestPlainTextSerializer.cpp
+++ b/dom/base/test/TestPlainTextSerializer.cpp
@ -162,6 +162,39 @@ TestBlockElement()
  return NS_OK;
 }

+nsresult
+TestPreWrapElementForThunderbird()
+{
+  // This test examines the magic pre-wrap setup that Thunderbird relies on.
+  nsString test;
+  test.AppendLiteral(
+    "<html>" NS_LINEBREAK
+    "<body style=\"white-space: pre-wrap; width: 10ch;\">" NS_LINEBREAK
+    "<pre>" NS_LINEBREAK
+    "  first line is too long" NS_LINEBREAK
+    "  second line is even loooonger  " NS_LINEBREAK
+    "</pre>" NS_LINEBREAK
+    "</body>" NS_LINEBREAK "</html>");
+
+  ConvertBufToPlainText(test, nsIDocumentEncoder::OutputWrap);
+  // "\n\n  first\nline is\ntoo long\n  second\nline is\neven\nloooonger\n\n\n"
+  if (!test.EqualsLiteral(NS_LINEBREAK NS_LINEBREAK
+                          "  first" NS_LINEBREAK
+                          "line is" NS_LINEBREAK
+                          "too long" NS_LINEBREAK
+                          "  second" NS_LINEBREAK
+                          "line is" NS_LINEBREAK
+                          "even" NS_LINEBREAK
+                          "loooonger" NS_LINEBREAK
+                          NS_LINEBREAK NS_LINEBREAK)) {
+    fail("Wrong prettyprinted html to text serialization");
+    return NS_ERROR_FAILURE;
+  }
+
+  passed("prettyprinted HTML to text serialization test");
+  return NS_OK;
+}
+
 nsresult
 TestPlainTextSerializer()
 {
@ -191,6 +224,9 @@ TestPlainTextSerializer()
  rv = TestBlockElement();
  NS_ENSURE_SUCCESS(rv, rv);

+  rv = TestPreWrapElementForThunderbird();
+  NS_ENSURE_SUCCESS(rv, rv);
+
  // Add new tests here...
  return NS_OK;
 }
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@ -2417,13 +2417,7 @@ EnforceNotInPrerendering(JSContext* aCx, JSObject* aObj)
    return true;
  }

-  nsIDocShell* docShell = window->GetDocShell();
-  if (!docShell) {
-    // Without a docshell, we cannot check the safety.
-    return true;
-  }
-
-  if (docShell->GetIsPrerendered()) {
+  if (window->GetIsPrerendered()) {
    HandlePrerenderingViolation(window);
    // When the bindings layer sees a false return value, it returns false form
    // the JSNative in order to trigger an uncatchable exception.
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@ -222,7 +222,7 @@ UnwrapDOMObjectToISupports(JSObject* aObject)
    return nullptr;
  }

-  return UnwrapDOMObject<nsISupports>(aObject);
+  return UnwrapPossiblyNotInitializedDOMObject<nsISupports>(aObject);
 }

 inline bool
@ -3036,8 +3036,10 @@ struct CreateGlobalOptions<nsGlobalWindow>
 nsresult
 RegisterDOMNames();

+// The return value is whatever the ProtoHandleGetter we used
+// returned.  This should be the DOM prototype for the global.
 template <class T, ProtoHandleGetter GetProto>
-bool
+JS::Handle<JSObject*>
 CreateGlobal(JSContext* aCx, T* aNative, nsWrapperCache* aCache,
             const JSClass* aClass, JS::CompartmentOptions& aOptions,
             JSPrincipals* aPrincipal, bool aInitStandardClasses,
@ -3049,7 +3051,7 @@ CreateGlobal(JSContext* aCx, T* aNative, nsWrapperCache* aCache,
                                 JS::DontFireOnNewGlobalHook, aOptions));
  if (!aGlobal) {
    NS_WARNING("Failed to create global");
-    return false;
+    return JS::NullPtr();
  }

  JSAutoCompartment ac(aCx, aGlobal);
@ -3064,7 +3066,7 @@ CreateGlobal(JSContext* aCx, T* aNative, nsWrapperCache* aCache,
                                    CreateGlobalOptions<T>::ProtoAndIfaceCacheKind);

    if (!CreateGlobalOptions<T>::PostCreateGlobal(aCx, aGlobal)) {
-      return false;
+      return JS::NullPtr();
    }
  }

@ -3072,16 +3074,16 @@ CreateGlobal(JSContext* aCx, T* aNative, nsWrapperCache* aCache,
      !CreateGlobalOptions<T>::ForceInitStandardClassesToFalse &&
      !JS_InitStandardClasses(aCx, aGlobal)) {
    NS_WARNING("Failed to init standard classes");
-    return false;
+    return JS::NullPtr();
  }

  JS::Handle<JSObject*> proto = GetProto(aCx, aGlobal);
  if (!proto || !JS_SplicePrototype(aCx, aGlobal, proto)) {
    NS_WARNING("Failed to set proto");
-    return false;
+    return JS::NullPtr();
  }

-  return true;
+  return proto;
 }

 /*
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -12,7 +12,7 @@ import textwrap
 import functools

 from WebIDL import BuiltinTypes, IDLBuiltinType, IDLNullValue, IDLSequenceType, IDLType, IDLAttribute, IDLInterfaceMember, IDLUndefinedValue, IDLEmptySequenceValue, IDLDictionary
-from Configuration import NoSuchDescriptorError, getTypesFromDescriptor, getTypesFromDictionary, getTypesFromCallback, getAllTypes, Descriptor
+from Configuration import NoSuchDescriptorError, getTypesFromDescriptor, getTypesFromDictionary, getTypesFromCallback, getAllTypes, Descriptor, MemberIsUnforgeable

 AUTOGENERATED_WARNING_COMMENT = \
    "/* THIS FILE IS AUTOGENERATED - DO NOT EDIT */\n\n"
@ -552,22 +552,6 @@ def PrototypeIDAndDepth(descriptor):
    return (prototypeID, depth)


-def MemberIsUnforgeable(member, descriptor):
-    # Note: "or" and "and" return either their LHS or RHS, not
-    # necessarily booleans.  Make sure to return a boolean from this
-    # method, because callers will compare its return value to
-    # booleans.
-    return bool((member.isAttr() or member.isMethod()) and
-                not member.isStatic() and
-                (member.isUnforgeable() or
-                 descriptor.interface.getExtendedAttribute("Unforgeable")))
-
-
-def HasUnforgeableMembers(descriptor):
-    return any(MemberIsUnforgeable(m, descriptor) for m in
-               descriptor.interface.members)
-
-
 def InterfacePrototypeObjectProtoGetter(descriptor):
    """
    Returns a tuple with two elements:
@ -611,6 +595,8 @@ class CGPrototypeJSClass(CGThing):
    def define(self):
        prototypeID, depth = PrototypeIDAndDepth(self.descriptor)
        slotCount = "DOM_INTERFACE_PROTO_SLOTS_BASE"
+        if self.descriptor.hasUnforgeableMembers:
+            slotCount += " + 1 /* slot for the JSObject holding the unforgeable properties */"
        (protoGetter, _) = InterfacePrototypeObjectProtoGetter(self.descriptor)
        type = "eGlobalInterfacePrototype" if self.descriptor.isGlobal() else "eInterfacePrototype"
        return fill(
@ -1524,8 +1510,9 @@ class CGAddPropertyHook(CGAbstractClassHook):
    def generate_code(self):
        assert self.descriptor.wrapperCache
        return dedent("""
-            // We don't want to preserve if we don't have a wrapper.
-            if (self->GetWrapperPreserveColor()) {
+            // We don't want to preserve if we don't have a wrapper, and we
+            // obviously can't preserve if we're not initialized.
+            if (self && self->GetWrapperPreserveColor()) {
              PreserveWrapper(self);
            }
            return true;
@ -2634,6 +2621,55 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
        else:
            prefCache = None

+        if self.descriptor.hasUnforgeableMembers:
+            assert needInterfacePrototypeObject
+            # We want to use the same JSClass and prototype as the object we'll
+            # end up defining the unforgeable properties on in the end, so that
+            # we can use JS_InitializePropertiesFromCompatibleNativeObject to do
+            # a fast copy.  In the case of proxies that's null, because the
+            # expando object is a vanilla object, but in the case of other DOM
+            # objects it's whatever our class is.
+            #
+            # Also, for a global we can't use the global's class; just use
+            # nullpr and when we do the copy off the holder we'll take a slower
+            # path.  This also means that we don't need to worry about matching
+            # the prototype.
+            if self.descriptor.proxy or self.descriptor.isGlobal():
+                holderClass = "nullptr"
+                holderProto = "nullptr"
+            else:
+                holderClass = "Class.ToJSClass()"
+                holderProto = "*protoCache"
+            failureCode = dedent(
+                """
+                *protoCache = nullptr;
+                if (interfaceCache) {
+                  *interfaceCache = nullptr;
+                }
+                return;
+                """)
+            createUnforgeableHolder = CGGeneric(fill(
+                """
+                JS::Rooted<JSObject*> unforgeableHolder(aCx);
+                {
+                  JS::Rooted<JSObject*> holderProto(aCx, ${holderProto});
+                  unforgeableHolder = JS_NewObjectWithoutMetadata(aCx, ${holderClass}, holderProto);
+                  if (!unforgeableHolder) {
+                    $*{failureCode}
+                  }
+                }
+                """,
+                holderProto=holderProto,
+                holderClass=holderClass,
+                failureCode=failureCode))
+            defineUnforgeables = InitUnforgeablePropertiesOnHolder(self.descriptor,
+                                                                   self.properties,
+                                                                   failureCode)
+            createUnforgeableHolder = CGList(
+                [createUnforgeableHolder, defineUnforgeables])
+        else:
+            createUnforgeableHolder = None
+
        getParentProto = fill(
            """
            JS::${type}<JSObject*> parentProto(${getParentProto});
@ -2699,10 +2735,12 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):

        call = fill(
            """
+            JS::Heap<JSObject*>* protoCache = ${protoCache};
+            JS::Heap<JSObject*>* interfaceCache = ${interfaceCache};
            dom::CreateInterfaceObjects(aCx, aGlobal, parentProto,
-                                        ${protoClass}, ${protoCache},
+                                        ${protoClass}, protoCache,
                                        constructorProto, ${interfaceClass}, ${constructHookHolder}, ${constructArgs}, ${namedConstructors},
-                                        ${interfaceCache},
+                                        interfaceCache,
                                        ${properties},
                                        ${chromeProperties},
                                        ${name}, aDefineOnGlobal);
@ -2718,9 +2756,21 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
            chromeProperties=chromeProperties,
            name='"' + self.descriptor.interface.identifier.name + '"' if needInterfaceObject else "nullptr")

+        if self.descriptor.hasUnforgeableMembers:
+            assert needInterfacePrototypeObject
+            setUnforgeableHolder = CGGeneric(fill(
+                """
+                if (*protoCache) {
+                  js::SetReservedSlot(*protoCache, DOM_INTERFACE_PROTO_SLOTS_BASE,
+                                      JS::ObjectValue(*unforgeableHolder));
+                }
+                """,
+                name=self.descriptor.name))
+        else:
+            setUnforgeableHolder = None
        return CGList(
            [CGGeneric(getParentProto), CGGeneric(getConstructorProto), initIds,
-             prefCache, CGGeneric(call)],
+             prefCache, CGGeneric(call), createUnforgeableHolder, setUnforgeableHolder],
            "\n").define()


@ -3023,15 +3073,71 @@ def CreateBindingJSObject(descriptor, properties):
    return objDecl + create


-def InitUnforgeableProperties(descriptor, properties, wrapperCache):
+def InitUnforgeablePropertiesOnHolder(descriptor, properties, failureCode):
    """
-    properties is a PropertyArrays instance
+    Define the unforgeable properties on the unforgeable holder for
+    the interface represented by descriptor.
+
+    properties is a PropertyArrays instance.
+
    """
-    unforgeableAttrs = properties.unforgeableAttrs
-    if not unforgeableAttrs.hasNonChromeOnly() and not unforgeableAttrs.hasChromeOnly():
+    assert (properties.unforgeableAttrs.hasNonChromeOnly() or
+            properties.unforgeableAttrs.hasChromeOnly() or
+            properties.unforgeableMethods.hasNonChromeOnly() or
+            properties.unforgeableMethods.hasChromeOnly)
+
+    unforgeables = []
+
+    defineUnforgeableAttrs = fill(
+        """
+        if (!DefineUnforgeableAttributes(aCx, unforgeableHolder, %s)) {
+          $*{failureCode}
+        }
+        """,
+        failureCode=failureCode)
+    defineUnforgeableMethods = fill(
+        """
+        if (!DefineUnforgeableMethods(aCx, unforgeableHolder, %s)) {
+          $*{failureCode}
+        }
+        """,
+        failureCode=failureCode)
+
+    unforgeableMembers = [
+        (defineUnforgeableAttrs, properties.unforgeableAttrs),
+        (defineUnforgeableMethods, properties.unforgeableMethods)
+    ]
+    for (template, array) in unforgeableMembers:
+        if array.hasNonChromeOnly():
+            unforgeables.append(CGGeneric(template % array.variableName(False)))
+        if array.hasChromeOnly():
+            unforgeables.append(
+                CGIfWrapper(CGGeneric(template % array.variableName(True)),
+                            "nsContentUtils::ThreadsafeIsCallerChrome()"))
+
+    if descriptor.interface.getExtendedAttribute("Unforgeable"):
+        # We do our undefined toJSON here, not as a regular property
+        # because we don't have a concept of value props anywhere in IDL.
+        unforgeables.append(CGGeneric(fill(
+            """
+            if (!JS_DefineProperty(aCx, unforgeableHolder, "toJSON", JS::UndefinedHandleValue,
+                                   JSPROP_READONLY | JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
+              $*{failureCode}
+            }
+            """,
+            failureCode=failureCode)))
+
+    return CGWrapper(CGList(unforgeables), pre="\n")
+
+def CopyUnforgeablePropertiesToInstance(descriptor, wrapperCache):
+    """
+    Copy the unforgeable properties from the unforgeable holder for
+    this interface to the instance object we have.
+    """
+    if not descriptor.hasUnforgeableMembers:
        return ""

-    unforgeables = [
+    copyCode = [
        CGGeneric(dedent(
            """
            // Important: do unforgeable property setup after we have handed
@ -3053,7 +3159,7 @@ def InitUnforgeableProperties(descriptor, properties, wrapperCache):
    # For proxies, we want to define on the expando object, not directly on the
    # reflector, so we can make sure we don't get confused by named getters.
    if descriptor.proxy:
-        unforgeables.append(CGGeneric(fill(
+        copyCode.append(CGGeneric(fill(
            """
            JS::Rooted<JSObject*> expando(aCx,
              DOMProxyHandler::EnsureExpandoObject(aCx, aReflector));
@ -3067,52 +3173,30 @@ def InitUnforgeableProperties(descriptor, properties, wrapperCache):
    else:
        obj = "aReflector"

-    defineUnforgeableAttrs = fill(
+    # We can't do the fast copy for globals, because we can't allocate the
+    # unforgeable holder for those with the right JSClass.  Luckily, there
+    # aren't too many globals being created.
+    if descriptor.isGlobal():
+        copyFunc = "JS_CopyPropertiesFrom"
+    else:
+        copyFunc = "JS_InitializePropertiesFromCompatibleNativeObject"
+    copyCode.append(CGGeneric(fill(
        """
-        if (!DefineUnforgeableAttributes(aCx, ${obj}, %s)) {
+        // XXXbz Once we allow subclassing, we'll want to make sure that
+        // this uses the canonical proto, not whatever random passed-in
+        // proto we end up using for the object.
+        JS::Rooted<JSObject*> unforgeableHolder(aCx,
+          &js::GetReservedSlot(proto, DOM_INTERFACE_PROTO_SLOTS_BASE).toObject());
+        if (!${copyFunc}(aCx, ${obj}, unforgeableHolder)) {
          $*{cleanup}
          return false;
        }
        """,
+        copyFunc=copyFunc,
        obj=obj,
-        cleanup=cleanup)
-    defineUnforgeableMethods = fill(
-        """
-        if (!DefineUnforgeableMethods(aCx, ${obj}, %s)) {
-          $*{cleanup}
-          return false;
-        }
-        """,
-        obj=obj,
-        cleanup=cleanup)
+        cleanup=cleanup)))

-    unforgeableMembers = [
-        (defineUnforgeableAttrs, properties.unforgeableAttrs),
-        (defineUnforgeableMethods, properties.unforgeableMethods)
-    ]
-    for (template, array) in unforgeableMembers:
-        if array.hasNonChromeOnly():
-            unforgeables.append(CGGeneric(template % array.variableName(False)))
-        if array.hasChromeOnly():
-            unforgeables.append(
-                CGIfWrapper(CGGeneric(template % array.variableName(True)),
-                            "nsContentUtils::ThreadsafeIsCallerChrome()"))
-
-    if descriptor.interface.getExtendedAttribute("Unforgeable"):
-        # We do our undefined toJSON here, not as a regular property
-        # because we don't have a concept of value props anywhere.
-        unforgeables.append(CGGeneric(fill(
-            """
-            if (!JS_DefineProperty(aCx, ${obj}, "toJSON", JS::UndefinedHandleValue,
-                                   JSPROP_READONLY | JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
-              $*{cleanup}
-              return false;
-            }
-            """,
-            obj=obj,
-            cleanup=cleanup)))
-
-    return CGWrapper(CGList(unforgeables), pre="\n").define()
+    return CGWrapper(CGList(copyCode), pre="\n").define()


 def AssertInheritanceChain(descriptor):
@ -3174,16 +3258,6 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
        self.properties = properties

    def definition_body(self):
-        # For proxies, we have to SetWrapper() before we init unforgeables.  But
-        # for non-proxies we'd rather do it the other way around, so our
-        # unforgeables don't force preservation of the wrapper.
-        setWrapper = "aCache->SetWrapper(aReflector);\n"
-        if self.descriptor.proxy:
-            setWrapperProxy = setWrapper
-            setWrapperNonProxy = ""
-        else:
-            setWrapperProxy = ""
-            setWrapperNonProxy = setWrapper
        return fill(
            """
            $*{assertion}
@ -3212,18 +3286,15 @@ class CGWrapWithCacheMethod(CGAbstractMethod):

            $*{createObject}

-            $*{setWrapperProxy}
+            aCache->SetWrapper(aReflector);
            $*{unforgeable}
-            $*{setWrapperNonProxy}
            $*{slots}
            creator.InitializationSucceeded();
            return true;
            """,
            assertion=AssertInheritanceChain(self.descriptor),
            createObject=CreateBindingJSObject(self.descriptor, self.properties),
-            setWrapperProxy=setWrapperProxy,
-            unforgeable=InitUnforgeableProperties(self.descriptor, self.properties, True),
-            setWrapperNonProxy=setWrapperNonProxy,
+            unforgeable=CopyUnforgeablePropertiesToInstance(self.descriptor, True),
            slots=InitMemberSlots(self.descriptor, True))


@ -3280,7 +3351,7 @@ class CGWrapNonWrapperCacheMethod(CGAbstractMethod):
            """,
            assertions=AssertInheritanceChain(self.descriptor),
            createObject=CreateBindingJSObject(self.descriptor, self.properties),
-            unforgeable=InitUnforgeableProperties(self.descriptor, self.properties, False),
+            unforgeable=CopyUnforgeablePropertiesToInstance(self.descriptor, False),
            slots=InitMemberSlots(self.descriptor, False))


@ -3321,13 +3392,23 @@ class CGWrapGlobalMethod(CGAbstractMethod):
        else:
            fireOnNewGlobal = ""

+        if self.descriptor.hasUnforgeableMembers:
+            declareProto = "JS::Handle<JSObject*> proto =\n"
+            assertProto = (
+                "MOZ_ASSERT(proto &&\n"
+                "           IsDOMIfaceAndProtoClass(js::GetObjectClass(proto)));\n")
+        else:
+            declareProto = ""
+            assertProto = ""
+
        return fill(
            """
            $*{assertions}
            MOZ_ASSERT(ToSupportsIsOnPrimaryInheritanceChain(aObject, aCache),
                       "nsISupports must be on our primary inheritance chain");

-            CreateGlobal<${nativeType}, GetProtoObjectHandle>(aCx,
+            $*{declareProto}
+              CreateGlobal<${nativeType}, GetProtoObjectHandle>(aCx,
                                             aObject,
                                             aCache,
                                             Class.ToJSClass(),
@ -3338,6 +3419,7 @@ class CGWrapGlobalMethod(CGAbstractMethod):
            if (!aReflector) {
              return false;
            }
+            $*{assertProto}

            // aReflector is a new global, so has a new compartment.  Enter it
            // before doing anything with it.
@ -3355,9 +3437,11 @@ class CGWrapGlobalMethod(CGAbstractMethod):
            """,
            assertions=AssertInheritanceChain(self.descriptor),
            nativeType=self.descriptor.nativeType,
+            declareProto=declareProto,
+            assertProto=assertProto,
            properties=properties,
            chromeProperties=chromeProperties,
-            unforgeable=InitUnforgeableProperties(self.descriptor, self.properties, True),
+            unforgeable=CopyUnforgeablePropertiesToInstance(self.descriptor, True),
            slots=InitMemberSlots(self.descriptor, True),
            fireOnNewGlobal=fireOnNewGlobal)

@ -10178,7 +10262,7 @@ class CGDOMJSProxyHandler_defineProperty(ClassMethod):

        namedSetter = self.descriptor.operations['NamedSetter']
        if namedSetter:
-            if HasUnforgeableMembers(self.descriptor):
+            if self.descriptor.hasUnforgeableMembers:
                raise TypeError("Can't handle a named setter on an interface "
                                "that has unforgeables.  Figure out how that "
                                "should work!")
@ -10235,7 +10319,7 @@ class CGDOMJSProxyHandler_delete(ClassMethod):
            assert type in ("Named", "Indexed")
            deleter = self.descriptor.operations[type + 'Deleter']
            if deleter:
-                if HasUnforgeableMembers(self.descriptor):
+                if self.descriptor.hasUnforgeableMembers:
                    raise TypeError("Can't handle a deleter on an interface "
                                    "that has unforgeables.  Figure out how "
                                    "that should work!")
@ -10591,7 +10675,7 @@ class CGDOMJSProxyHandler_setCustom(ClassMethod):
            if self.descriptor.operations['NamedCreator'] is not namedSetter:
                raise ValueError("In interface " + self.descriptor.name + ": " +
                                 "Can't cope with named setter that is not also a named creator")
-            if HasUnforgeableMembers(self.descriptor):
+            if self.descriptor.hasUnforgeableMembers:
                raise ValueError("In interface " + self.descriptor.name + ": " +
                                 "Can't cope with [OverrideBuiltins] and unforgeable members")

--- a/dom/bindings/Configuration.py
+++ b/dom/bindings/Configuration.py
@ -294,6 +294,18 @@ def methodReturnsJSObject(method):

    return False

+
+def MemberIsUnforgeable(member, descriptor):
+    # Note: "or" and "and" return either their LHS or RHS, not
+    # necessarily booleans.  Make sure to return a boolean from this
+    # method, because callers will compare its return value to
+    # booleans.
+    return bool((member.isAttr() or member.isMethod()) and
+                not member.isStatic() and
+                (member.isUnforgeable() or
+                 descriptor.interface.getExtendedAttribute("Unforgeable")))
+
+
 class Descriptor(DescriptorProvider):
    """
    Represents a single descriptor for an interface. See Bindings.conf.
@ -370,6 +382,9 @@ class Descriptor(DescriptorProvider):
        self.concrete = (not self.interface.isExternal() and
                         not self.interface.isCallback() and
                         desc.get('concrete', True))
+        self.hasUnforgeableMembers = (self.concrete and
+                                      any(MemberIsUnforgeable(m, self) for m in
+                                          self.interface.members))
        self.operations = {
            'IndexedGetter': None,
            'IndexedSetter': None,
--- a/dom/bindings/JSSlots.h
+++ b/dom/bindings/JSSlots.h
@ -26,7 +26,8 @@
 #define DOM_INTERFACE_SLOTS_BASE 0

 // Interface prototype objects store a number of reserved slots equal to
-// DOM_INTERFACE_PROTO_SLOTS_BASE.
+// DOM_INTERFACE_PROTO_SLOTS_BASE or DOM_INTERFACE_PROTO_SLOTS_BASE + 1 if a
+// slot for the unforgeable holder is needed.
 #define DOM_INTERFACE_PROTO_SLOTS_BASE 0

 #endif /* mozilla_dom_DOMSlots_h */
--- a/dom/bindings/test/chrome.ini
+++ b/dom/bindings/test/chrome.ini
@ -11,3 +11,5 @@ support-files =
  file_focuser.html
  file_fullScreenPropertyAccessor.html
 skip-if = e10s # prerendering doesn't work in e10s yet
+[test_kill_longrunning_prerendered_content.xul]
+skip-if = e10s # prerendering doesn't work in e10s yet
--- a/dom/bindings/test/test_kill_longrunning_prerendered_content.xul
+++ b/dom/bindings/test/test_kill_longrunning_prerendered_content.xul
@ -0,0 +1,85 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        onload="runTest();">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+
+<script class="testbody" type="application/javascript">
+<![CDATA[
+
+  SimpleTest.waitForExplicitFinish();
+
+  function Listener(aBrowser, aPrerendered, aCallback) {
+    this.init(aBrowser, aPrerendered, aCallback);
+  }
+
+  Listener.prototype = {
+    init: function(aBrowser, aCallback) {
+      this.mBrowser = aBrowser;
+      this.mCallback = aCallback;
+    },
+    QueryInterface: function(aIID) {
+      if (aIID.equals(Components.interfaces.nsIWebProgressListener) ||
+          aIID.equals(Components.interfaces.nsISupportsWeakReference) ||
+          aIID.equals(Components.interfaces.nsISupports))
+        return this;
+      throw Components.results.NS_NOINTERFACE;
+    },
+    onStateChange : function(aWebProgress, aRequest, aStateFlags, aStatus) {
+      if ((aStateFlags & Components.interfaces.nsIWebProgressListener.STATE_STOP) &&
+          (aStateFlags & Components.interfaces.nsIWebProgressListener.STATE_IS_DOCUMENT)) {
+        setTimeout(this.mCallback, 0);
+      }
+    },
+    onProgressChange : function(aWebProgress, aRequest,
+                                aCurSelfProgress, aMaxSelfProgress,
+                                aCurTotalProgress, aMaxTotalProgress) {},
+    onLocationChange : function(aWebProgress, aRequest, aLocation, aFlags) {},
+    onStatusChange : function(aWebProgress, aRequest, aStatus, aMessage) {},
+    onSecurityChange : function(aWebProgress, aRequest, aState) {},
+    mBrowser: null,
+    mPrerendered: false,
+    mCallback: null
+  };
+
+  var progress, progressListener;
+
+  function runTest() {
+    SpecialPowers.pushPrefEnv({
+      "set": [
+        ["dom.max_script_run_time", 1]
+      ]
+    }, function() {
+      test(function() {
+        ok("The page is successfully interrupted.");
+        SimpleTest.finish();
+      });
+    });
+  }
+
+  function test(aCallback) {
+    var browser = document.getElementById("prerendered");;
+    progressListener = new Listener(browser, aCallback);
+    var docShell = browser.docShell;
+    progress = docShell.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+                       .getInterface(Components.interfaces.nsIWebProgress);
+    progress.addProgressListener(progressListener,
+                                 Components.interfaces.nsIWebProgress.NOTIFY_ALL);
+    browser.loadURI("data:text/html,<script>;for(;;);</script" + ">");
+  }
+
+]]>
+</script>
+
+<body  id="html_body" xmlns="http://www.w3.org/1999/xhtml">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1050456">Mozilla Bug 1050456</a>
+<p id="display"></p>
+
+<pre id="test">
+</pre>
+</body>
+<browser prerendered="true" id="prerendered"/>
+</window>
--- a/dom/contacts/tests/test_contacts_cache.xul
+++ b/dom/contacts/tests/test_contacts_cache.xul
@ -17,7 +17,6 @@

  const { 'utils': Cu } = Components;
  Cu.import("resource://gre/modules/ContactDB.jsm", window);
-  Cu.importGlobalProperties(["indexedDB"]);

  let contactsDB = new ContactDB();
  contactsDB.init();
--- a/dom/contacts/tests/test_contacts_upgrade.xul
+++ b/dom/contacts/tests/test_contacts_upgrade.xul
@ -142,7 +142,6 @@

  const { 'utils': Cu } = Components;
  Cu.import("resource://gre/modules/ContactDB.jsm", window);
-  Cu.importGlobalProperties(["indexedDB"]);

  let cdb = new ContactDB();
  cdb.init();
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@ -7219,7 +7219,7 @@ HTMLInputElement::GetCols()
 NS_IMETHODIMP_(int32_t)
 HTMLInputElement::GetWrapCols()
 {
-  return -1; // only textarea's can have wrap cols
+  return 0; // only textarea's can have wrap cols
 }

 NS_IMETHODIMP_(int32_t)
--- a/dom/html/HTMLTextAreaElement.cpp
+++ b/dom/html/HTMLTextAreaElement.cpp
@ -1480,7 +1480,7 @@ HTMLTextAreaElement::GetWrapCols()
  nsITextControlElement::GetWrapPropertyEnum(this, wrapProp);
  if (wrapProp == nsITextControlElement::eHTMLTextWrap_Off) {
    // do not wrap when wrap=off
-    return -1;
+    return 0;
  }

  // Otherwise we just wrap at the given number of columns
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@ -1713,7 +1713,7 @@ nsTextEditorState::InitializeRootNode()
  nsAutoString classValue;
  classValue.AppendLiteral("anonymous-div");
  int32_t wrapCols = GetWrapCols();
-  if (wrapCols >= 0) {
+  if (wrapCols > 0) {
    classValue.AppendLiteral(" wrap");
  }
  if (!IsSingleLineTextControl()) {
--- a/dom/indexedDB/test/chromeHelpers.js
+++ b/dom/indexedDB/test/chromeHelpers.js
@ -10,8 +10,6 @@ let testGenerator = testSteps();
 if (!window.runTest) {
  window.runTest = function()
  {
-    Cu.importGlobalProperties(["indexedDB"]);
-
    SimpleTest.waitForExplicitFinish();

    testGenerator.next();
--- a/dom/media/eme/CDMCaps.cpp
+++ b/dom/media/eme/CDMCaps.cpp
@ -81,7 +81,11 @@ CDMCaps::AutoLock::IsKeyUsable(const CencKeyId& aKeyId)
  mData.mMonitor.AssertCurrentThreadOwns();
  const auto& keys = mData.mKeyStatuses;
  for (size_t i = 0; i < keys.Length(); i++) {
-    if (keys[i].mId == aKeyId && keys[i].mStatus == kGMPUsable) {
+    if (keys[i].mId != aKeyId) {
+      continue;
+    }
+    if (keys[i].mStatus == kGMPUsable ||
+        keys[i].mStatus == kGMPOutputDownscaled) {
      return true;
    }
  }
@ -106,12 +110,20 @@ CDMCaps::AutoLock::SetKeyStatus(const CencKeyId& aKeyId,
    if (mData.mKeyStatuses[index].mStatus == aStatus) {
      return false;
    }
+    auto oldStatus = mData.mKeyStatuses[index].mStatus;
    mData.mKeyStatuses[index].mStatus = aStatus;
+    if (oldStatus == kGMPUsable || oldStatus == kGMPOutputDownscaled) {
+      return true;
+    }
  } else {
    mData.mKeyStatuses.AppendElement(key);
  }

-  if (aStatus != kGMPUsable) {
+  // Both kGMPUsable and kGMPOutputDownscaled are treated able to decrypt.
+  // We don't need to notify when transition happens between kGMPUsable and
+  // kGMPOutputDownscaled. Only call NotifyUsable() when we are going from
+  // ![kGMPUsable|kGMPOutputDownscaled] to [kGMPUsable|kGMPOutputDownscaled]
+  if (aStatus != kGMPUsable && aStatus != kGMPOutputDownscaled) {
    return true;
  }

--- a/dom/media/gmp/GMPDecryptorChild.cpp
+++ b/dom/media/gmp/GMPDecryptorChild.cpp
@ -13,15 +13,7 @@
 #define ON_GMP_THREAD() (mPlugin->GMPMessageLoop() == MessageLoop::current())

 #define CALL_ON_GMP_THREAD(_func, ...) \
-  do { \
-    if (ON_GMP_THREAD()) { \
-      _func(__VA_ARGS__); \
-    } else { \
-      mPlugin->GMPMessageLoop()->PostTask( \
-        FROM_HERE, NewRunnableMethod(this, &GMPDecryptorChild::_func, __VA_ARGS__) \
-      ); \
-    } \
-  } while(false)
+  CallOnGMPThread(&GMPDecryptorChild::_func, __VA_ARGS__)

 namespace mozilla {
 namespace gmp {
@ -41,6 +33,38 @@ GMPDecryptorChild::~GMPDecryptorChild()
 {
 }

+template <typename MethodType, typename... ParamType>
+void
+GMPDecryptorChild::CallMethod(MethodType aMethod, ParamType&&... aParams)
+{
+  MOZ_ASSERT(ON_GMP_THREAD());
+  // Don't send IPC messages after tear-down.
+  if (mSession) {
+    (this->*aMethod)(Forward<ParamType>(aParams)...);
+  }
+}
+
+template<typename T>
+struct AddConstReference {
+  typedef const typename RemoveReference<T>::Type& Type;
+};
+
+template<typename MethodType, typename... ParamType>
+void
+GMPDecryptorChild::CallOnGMPThread(MethodType aMethod, ParamType&&... aParams)
+{
+  if (ON_GMP_THREAD()) {
+    // Use forwarding reference when we can.
+    CallMethod(aMethod, Forward<ParamType>(aParams)...);
+  } else {
+    // Use const reference when we have to.
+    auto m = &GMPDecryptorChild::CallMethod<
+        decltype(aMethod), typename AddConstReference<ParamType>::Type...>;
+    auto t = NewRunnableMethod(this, m, aMethod, aParams...);
+    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
+  }
+}
+
 void
 GMPDecryptorChild::Init(GMPDecryptor* aSession)
 {
@ -145,7 +169,8 @@ GMPDecryptorChild::Decrypted(GMPBuffer* aBuffer, GMPErr aResult)
  if (!ON_GMP_THREAD()) {
    // We should run this whole method on the GMP thread since the buffer needs
    // to be deleted after the SendDecrypted call.
-    CALL_ON_GMP_THREAD(Decrypted, aBuffer, aResult);
+    auto t = NewRunnableMethod(this, &GMPDecryptorChild::Decrypted, aBuffer, aResult);
+    mPlugin->GMPMessageLoop()->PostTask(FROM_HERE, t);
    return;
  }

@ -155,7 +180,9 @@ GMPDecryptorChild::Decrypted(GMPBuffer* aBuffer, GMPErr aResult)
  }

  auto buffer = static_cast<GMPBufferImpl*>(aBuffer);
-  SendDecrypted(buffer->mId, aResult, buffer->mData);
+  if (mSession) {
+    SendDecrypted(buffer->mId, aResult, buffer->mData);
+  }
  delete buffer;
 }

@ -321,12 +348,16 @@ GMPDecryptorChild::RecvDecrypt(const uint32_t& aId,
 bool
 GMPDecryptorChild::RecvDecryptingComplete()
 {
-  if (!mSession) {
+  // Reset |mSession| before calling DecryptingComplete(). We should not send
+  // any IPC messages during tear-down.
+  auto session = mSession;
+  mSession = nullptr;
+
+  if (!session) {
    return false;
  }

-  mSession->DecryptingComplete();
-  mSession = nullptr;
+  session->DecryptingComplete();

  unused << Send__delete__(this);

--- a/dom/media/gmp/GMPDecryptorChild.h
+++ b/dom/media/gmp/GMPDecryptorChild.h
@ -114,6 +114,12 @@ private:

  virtual bool RecvDecryptingComplete() MOZ_OVERRIDE;

+  template <typename MethodType, typename... ParamType>
+  void CallMethod(MethodType, ParamType&&...);
+
+  template<typename MethodType, typename... ParamType>
+  void CallOnGMPThread(MethodType, ParamType&&...);
+
  // GMP's GMPDecryptor implementation.
  // Only call into this on the (GMP process) main thread.
  GMPDecryptor* mSession;
--- a/dom/media/mediasource/TrackBuffer.cpp
+++ b/dom/media/mediasource/TrackBuffer.cpp
@ -1003,8 +1003,8 @@ TrackBuffer::RangeRemoval(media::Microseconds aStart,
      decoders[i]->GetBuffered(buffered);
      if (media::Microseconds::FromSeconds(buffered->GetEndTime()) < aEnd) {
        // Can be fully removed.
-        MSE_DEBUG("remove all bufferedEnd=%f time=%f, size=%lld",
-                  buffered->GetEndTime(), time,
+        MSE_DEBUG("remove all bufferedEnd=%f size=%lld",
+                  buffered->GetEndTime(),
                  decoders[i]->GetResource()->GetSize());
        decoders[i]->GetResource()->EvictAll();
      } else {
--- a/gfx/skia/generate_mozbuild.py
+++ b/gfx/skia/generate_mozbuild.py
@ -3,6 +3,7 @@
 import os

 import locale
+from collections import defaultdict
 locale.setlocale(locale.LC_ALL, 'en_US.UTF-8')

 header = """
@ -192,7 +193,7 @@ def generate_platform_sources():


    f = open('trunk/sources.json');
-    sources[plat] = set(json.load(f));
+    sources[plat] = set(v.replace('../', 'trunk/') for v in json.load(f));
    f.close()

  return dict(sources.items() + generate_opt_sources().items())
@ -237,7 +238,7 @@ def generate_separated_sources(platform_sources):

    return False

-  separated = {
+  separated = defaultdict(set, {
    'common': {
      #'trunk/src/effects/gradients/SkGradientTileProc.cpp',
      'trunk/src/gpu/gl/GrGLCreateNativeInterface_none.cpp',
@ -282,45 +283,31 @@ def generate_separated_sources(platform_sources):
    'none': {
      'trunk/src/opts/SkUtils_opts_none.cpp',
    }
-  }
+  })

  for plat in platform_sources.keys():
-    if not separated.has_key(plat):
-      separated[plat] = set()
-
    for value in platform_sources[plat]:
      if isblacklisted(value):
        continue

-      if value.find('_SSE') > 0 or value.find('_SSSE') > 0 or value.find('_SSE4') > 0 : #lol
-        separated['intel'].add(value)
+      if value in separated['common']:
        continue

-      if value.find('_neon') > 0:
-        separated['neon'].add(value)
-        continue
+      key = plat

-      if value.find('_arm') > 0:
-        separated['arm'].add(value)
-        continue
+      if '_SSE' in value or '_SSSE' in value:
+        key = 'intel'
+      elif '_neon' in value:
+        key = 'neon'
+      elif '_arm' in value:
+        key = 'arm'
+      elif '_none' in value:
+        key = 'none'
+      elif all(value in platform_sources.get(p, {})
+               for p in platforms if p != plat):
+        key = 'common'

-      if value.find('_none') > 0:
-        separated['none'].add(value)
-        continue
-
-      found = True
-      for other in platforms:
-        if other == plat or not platform_sources.has_key(other):
-          continue
-
-        if not value in platform_sources[other]:
-          found = False
-          break;
-
-      if found:
-        separated['common'].add(value)
-      else:
-        separated[plat].add(value)
+      separated[key].add(value)

  return separated

@ -334,7 +321,7 @@ def write_cflags(f, values, subsearch, cflag, indent):
    for _ in range(indent):
        f.write(' ')

-  val_list = uniq(sorted(map(lambda val: val.replace('../', 'trunk/'), values), key=lambda x: x.lower()))
+  val_list = uniq(sorted(values, key=lambda x: x.lower()))

  if len(val_list) == 0:
    return
@ -396,7 +383,7 @@ def write_list(f, name, values, indent):
    for _ in range(indent):
        f.write(' ')

-  val_list = uniq(sorted(map(lambda val: val.replace('../', 'trunk/'), values), key=lambda x: x.lower()))
+  val_list = uniq(sorted(values, key=lambda x: x.lower()))

  if len(val_list) == 0:
    return
--- a/gfx/skia/moz.build
+++ b/gfx/skia/moz.build
@ -852,7 +852,6 @@ else:
        'trunk/src/opts/SkTextureCompression_opts_none.cpp',
        'trunk/src/opts/SkUtils_opts_none.cpp',
        'trunk/src/opts/SkXfermode_opts_none.cpp',
-        'trunk/src/ports/SkDiscardableMemory_none.cpp',
    ]


--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@ -194,31 +194,6 @@ SandboxImport(JSContext *cx, unsigned argc, Value *vp)
    return true;
 }

-static bool
-SandboxCreateXMLHttpRequest(JSContext *cx, unsigned argc, jsval *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    RootedObject global(cx, JS::CurrentGlobalOrNull(cx));
-    MOZ_ASSERT(global);
-
-    nsIScriptObjectPrincipal *sop =
-        static_cast<nsIScriptObjectPrincipal *>(xpc_GetJSPrivate(global));
-    nsCOMPtr<nsIGlobalObject> iglobal = do_QueryInterface(sop);
-
-    nsCOMPtr<nsIXMLHttpRequest> xhr = new nsXMLHttpRequest();
-    nsresult rv = xhr->Init(nsContentUtils::SubjectPrincipal(), nullptr,
-                            iglobal, nullptr, nullptr);
-    if (NS_FAILED(rv))
-        return false;
-
-    rv = nsContentUtils::WrapNative(cx, xhr, args.rval());
-    if (NS_FAILED(rv))
-        return false;
-
-    return true;
-}
-
 static bool
 SandboxCreateCrypto(JSContext *cx, JS::HandleObject obj)
 {
@ -843,7 +818,7 @@ xpc::GlobalProperties::Define(JSContext *cx, JS::HandleObject obj)
        return false;

    if (XMLHttpRequest &&
-        !JS_DefineFunction(cx, obj, "XMLHttpRequest", SandboxCreateXMLHttpRequest, 0, JSFUN_CONSTRUCTOR))
+        !dom::XMLHttpRequestBinding::GetConstructorObject(cx, obj))
        return false;

    if (TextEncoder &&
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@ -25,6 +25,7 @@
 #include "mozilla/dom/DOMExceptionBinding.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/StructuredCloneTags.h"
+#include "mozilla/dom/WindowBinding.h"
 #include "nsZipArchive.h"
 #include "nsIDOMFile.h"
 #include "nsIDOMFileList.h"
@ -2719,6 +2720,13 @@ nsXPCComponents_Utils::ImportGlobalProperties(HandleValue aPropertyList,
 {
    RootedObject global(cx, CurrentGlobalOrNull(cx));
    MOZ_ASSERT(global);
+
+    // Don't allow doing this if the global is a Window
+    nsGlobalWindow* win;
+    if (NS_SUCCEEDED(UNWRAP_OBJECT(Window, global, win))) {
+        return NS_ERROR_NOT_AVAILABLE;
+    }
+
    GlobalProperties options;
    NS_ENSURE_TRUE(aPropertyList.isObject(), NS_ERROR_INVALID_ARG);
    RootedObject propertyList(cx, &aPropertyList.toObject());
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@ -20,6 +20,7 @@
 #include "nsIMemoryReporter.h"
 #include "nsIObserverService.h"
 #include "nsIDebug2.h"
+#include "nsIDocShell.h"
 #include "amIAddonManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsPrintfCString.h"
@ -1452,6 +1453,13 @@ XPCJSRuntime::InterruptCallback(JSContext *cx)
    if (!win)
        return true;

+    if (win->GetIsPrerendered()) {
+        // We cannot display a dialog if the page is being prerendered, so
+        // just kill the page.
+        mozilla::dom::HandlePrerenderingViolation(win);
+        return false;
+    }
+
    // Show the prompt to the user, and kill if requested.
    nsGlobalWindow::SlowScriptResponse response = win->ShowSlowScriptDialog();
    if (response == nsGlobalWindow::KillSlowScript)
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@ -2015,7 +2015,7 @@ RestyleManager::DebugVerifyStyleTree(nsIFrame* aFrame)

 // aContent must be the content for the frame in question, which may be
 // :before/:after content
-/* static */ void
+/* static */ bool
 RestyleManager::TryStartingTransition(nsPresContext* aPresContext,
                                      nsIContent* aContent,
                                      nsStyleContext* aOldStyleContext,
@ -2023,13 +2023,15 @@ RestyleManager::TryStartingTransition(nsPresContext* aPresContext,
                                        aNewStyleContext /* inout */)
 {
  if (!aContent || !aContent->IsElement()) {
-    return;
+    return false;
  }

  // Notify the transition manager.  If it starts a transition,
  // it might modify the new style context.
+  nsRefPtr<nsStyleContext> sc = *aNewStyleContext;
  aPresContext->TransitionManager()->StyleContextChanged(
    aContent->AsElement(), aOldStyleContext, aNewStyleContext);
+  return *aNewStyleContext != sc;
 }

 static dom::Element*
@ -3300,9 +3302,13 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf,
        }
      }
    } else {
-      RestyleManager::TryStartingTransition(mPresContext, aSelf->GetContent(),
-                                            oldContext, &newContext);
-
+      bool changedStyle =
+        RestyleManager::TryStartingTransition(mPresContext, aSelf->GetContent(),
+                                              oldContext, &newContext);
+      if (changedStyle) {
+        LOG_RESTYLE_CONTINUE("TryStartingTransition changed the new style context");
+        result = eRestyleResult_Continue;
+      }
      CaptureChange(oldContext, newContext, assumeDifferenceHint,
                    &equalStructs);
      if (equalStructs != NS_STYLE_INHERIT_MASK) {
--- a/layout/base/RestyleManager.h
+++ b/layout/base/RestyleManager.h
@ -228,12 +228,13 @@ public:
  /**
   * Try starting a transition for an element or a ::before or ::after
   * pseudo-element, given an old and new style context.  This may
-   * change the new style context if a transition is started.
+   * change the new style context if a transition is started.  Returns
+   * true iff it does change aNewStyleContext.
   *
   * For the pseudo-elements, aContent must be the anonymous content
   * that we're creating for that pseudo-element, not the real element.
   */
-  static void
+  static bool
  TryStartingTransition(nsPresContext* aPresContext, nsIContent* aContent,
                        nsStyleContext* aOldStyleContext,
                        nsRefPtr<nsStyleContext>* aNewStyleContext /* inout */);
--- a/layout/base/moz.build
+++ b/layout/base/moz.build
@ -4,6 +4,42 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('ActiveLayerTracker.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('Display*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('FrameLayerBuilder.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('LayerState.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('MaskLayerImageCache.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('PaintTracker.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('nsCSSRendering.*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('nsDisplay*'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
+with Files('Restyle*'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+
+with Files('nsStyle*'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+
+with Files('nsChangeHint.h'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+
+with Files('nsBidi*'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+
 XPIDL_SOURCES += [
    'nsIStyleSheetService.idl',
 ]
--- a/layout/forms/moz.build
+++ b/layout/forms/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+
 MOCHITEST_MANIFESTS += ['test/mochitest.ini']
 MOCHITEST_CHROME_MANIFESTS += ['test/chrome.ini']

--- a/layout/generic/moz.build
+++ b/layout/generic/moz.build
@ -4,6 +4,62 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('nsBlock*'):
+    # Parts of these files are really Layout: Floats
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('nsLine*'):
+    # Parts of these files are really Layout: Floats
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('nsInlineFrame.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('nsBRFrame.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('nsBulletFrame.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('nsFirstLetterFrame.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+
+with Files('MathML*'):
+    BUG_COMPONENT = ('Core', 'MathML')
+
+with Files('Text*'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+
+with Files('nsText*'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+
+with Files('nsFrameSetFrame*'):
+    BUG_COMPONENT = ('Core', 'Layout: HTML Frames')
+
+with Files('nsSubDocumentFrame*'):
+    BUG_COMPONENT = ('Core', 'Layout: HTML Frames')
+
+with Files('nsFloatManager.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Floats')
+
+with Files('nsIntervalSet.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Floats')
+
+with Files('nsHTMLCanvasFrame.*'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+
+with Files('nsImage*'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+
+with Files('nsAbsoluteContainingBlock.*'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+
+with Files('nsPluginFrame.*'):
+    BUG_COMPONENT = ('Core', 'Plug-ins')
+
+with Files('nsVideoFrame.*'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+
 EXPORTS += [
    'nsCanvasFrame.h',
    'nsContainerFrame.h',
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@ -3018,17 +3018,6 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
       (aBuilder->RootReferenceFrame()->PresContext() != mOuter->PresContext()));
  }

-  if (aBuilder->IsPaintingToWindow() &&
-      !mShouldBuildScrollableLayer &&
-      shouldBuildLayer)
-  {
-    if (nsDisplayLayerEventRegions *eventRegions = aBuilder->GetLayerEventRegions()) {
-      // Make sure that APZ will dispatch events back to content so we can
-      // create a displayport for this frame.
-      eventRegions->AddInactiveScrollPort(mScrollPort + aBuilder->ToReferenceFrame(mOuter));
-    }
-  }
-
  mScrollParentID = aBuilder->GetCurrentScrollParentId();

  nsDisplayListCollection scrolledContent;
@ -3138,31 +3127,49 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
      wrapper.WrapListsInPlace(aBuilder, mOuter, scrolledContent);
    }

+    // Make sure that APZ will dispatch events back to content so we can create
+    // a displayport for this frame. We'll add the item later on.
+    nsDisplayLayerEventRegions* inactiveRegionItem = nullptr;
+    if (aBuilder->IsPaintingToWindow() &&
+        !mShouldBuildScrollableLayer &&
+        shouldBuildLayer &&
+        gfxPrefs::LayoutEventRegionsEnabled())
+    {
+      inactiveRegionItem = new (aBuilder) nsDisplayLayerEventRegions(aBuilder, mScrolledFrame);
+      inactiveRegionItem->AddInactiveScrollPort(mScrollPort + aBuilder->ToReferenceFrame(mOuter));
+    }
+
    // In case we are not using displayport or the nsDisplayScrollLayers are
    // flattened during visibility computation, we still need to export the
    // metadata about this scroll box to the compositor process.
    nsDisplayScrollInfoLayer* layerItem = new (aBuilder) nsDisplayScrollInfoLayer(
      aBuilder, mScrolledFrame, mOuter);
+
    nsDisplayList* positionedDescendants = scrolledContent.PositionedDescendants();
+    nsDisplayList* destinationList = nullptr;
    if (BuildScrollContainerLayers()) {
      // We process display items from bottom to top, so if we need to flatten after
      // the scroll layer items have been processed we need to be on the top.
      if (!positionedDescendants->IsEmpty()) {
        layerItem->SetOverrideZIndex(MaxZIndexInList(positionedDescendants, aBuilder));
-        positionedDescendants->AppendNewToTop(layerItem);
+        destinationList = positionedDescendants;
      } else {
-        aLists.Outlines()->AppendNewToTop(layerItem);
+        destinationList = aLists.Outlines();
      }
    } else {
      int32_t zindex =
        MaxZIndexInListOfItemsContainedInFrame(positionedDescendants, mOuter);
      if (zindex >= 0) {
        layerItem->SetOverrideZIndex(zindex);
-        positionedDescendants->AppendNewToTop(layerItem);
+        destinationList = positionedDescendants;
      } else {
-        scrolledContent.Outlines()->AppendNewToTop(layerItem);
+        destinationList = scrolledContent.Outlines();
      }
    }
+    if (inactiveRegionItem) {
+      destinationList->AppendNewToTop(inactiveRegionItem);
+    }
+    destinationList->AppendNewToTop(layerItem);
  }
  // Now display overlay scrollbars and the resizer, if we have one.
  AppendScrollPartsTo(aBuilder, aDirtyRect, scrolledContent, usingDisplayport,
--- a/layout/generic/nsLineLayout.cpp
+++ b/layout/generic/nsLineLayout.cpp
@ -2895,7 +2895,10 @@ FindNearestRubyBaseAncestor(nsIFrame* aFrame)
  while (aFrame && aFrame->GetType() != nsGkAtoms::rubyBaseFrame) {
    aFrame = aFrame->GetParent();
  }
-  MOZ_ASSERT(aFrame, "No ruby base ancestor?");
+  // XXX It is possible that no ruby base ancestor is found because of
+  // some edge cases like form control or canvas inside ruby text.
+  // See bug 1138092 comment 4.
+  NS_ASSERTION(aFrame, "No ruby base ancestor?");
  return aFrame;
 }

@ -3066,7 +3069,7 @@ nsLineLayout::TextAlignLine(nsLineBox* aLine,
      if (firstFrame->mFrame->StyleContext()->IsInlineDescendantOfRuby()) {
        MOZ_ASSERT(!firstFrame->mJustificationAssignment.mGapsAtStart);
        nsIFrame* rubyBase = FindNearestRubyBaseAncestor(firstFrame->mFrame);
-        if (IsRubyAlignSpaceAround(rubyBase)) {
+        if (rubyBase && IsRubyAlignSpaceAround(rubyBase)) {
          firstFrame->mJustificationAssignment.mGapsAtStart = 1;
          additionalGaps++;
        }
@ -3075,7 +3078,7 @@ nsLineLayout::TextAlignLine(nsLineBox* aLine,
      if (lastFrame->mFrame->StyleContext()->IsInlineDescendantOfRuby()) {
        MOZ_ASSERT(!lastFrame->mJustificationAssignment.mGapsAtEnd);
        nsIFrame* rubyBase = FindNearestRubyBaseAncestor(lastFrame->mFrame);
-        if (IsRubyAlignSpaceAround(rubyBase)) {
+        if (rubyBase && IsRubyAlignSpaceAround(rubyBase)) {
          lastFrame->mJustificationAssignment.mGapsAtEnd = 1;
          additionalGaps++;
        }
--- a/layout/ipc/moz.build
+++ b/layout/ipc/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'Layout: View Rendering')
+
 EXPORTS.mozilla.layout += [
    'RenderFrameChild.h',
    'RenderFrameParent.h',
--- a/layout/mathml/moz.build
+++ b/layout/mathml/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'MathML')
+
 if CONFIG['ENABLE_TESTS']:
    MOCHITEST_MANIFESTS += ['tests/mochitest.ini']

--- a/layout/media/moz.build
+++ b/layout/media/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+
 if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
    GeckoSharedLibrary('gkmedias', linkage=None)
    USE_LIBS += [
--- a/layout/media/webrtc/moz.build
+++ b/layout/media/webrtc/moz.build
@ -4,5 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'WebRTC')
+
 Library('webrtc')
 FINAL_LIBRARY = 'xul'
--- a/layout/moz.build
+++ b/layout/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+
 DIRS += [
    'style',
    'base',
--- a/layout/reftests/css-ruby/lang-specific-style-1-ref.html
+++ b/layout/reftests/css-ruby/lang-specific-style-1-ref.html
@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Bug 1133624 - Test for lang-specific default stylesheet for ruby</title>
+  <link rel="stylesheet" href="common.css">
+</head>
+<body style="font: 200%/normal Ahem !important">
+  <p><ruby><rb>base x x<rt style="ruby-align: space-around; font-size: 50%">text x x</ruby></p>
+  <p><ruby><rb>base x x<rt style="ruby-align: space-around; font-size: 50%">text x x</ruby></p>
+  <p><ruby><rb>base x x<rt style="ruby-align: center; font-size: 50%">text x x</ruby></p>
+  <p><ruby><rb>base x x<rt style="ruby-align: center; font-size: 30%">text x x</ruby></p>
+</body>
+</html>
--- a/layout/reftests/css-ruby/lang-specific-style-1.html
+++ b/layout/reftests/css-ruby/lang-specific-style-1.html
@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Bug 1133624 - Test for lang-specific default stylesheet for ruby</title>
+  <link rel="stylesheet" href="common.css">
+</head>
+<body style="font: 200%/normal Ahem !important">
+  <p lang="en"><ruby><rb>base x x<rt>text x x</ruby></p>
+  <p lang="ja"><ruby><rb>base x x<rt>text x x</ruby></p>
+  <p lang="zh-CN"><ruby><rb>base x x<rt>text x x</ruby></p>
+  <p lang="zh-TW"><ruby><rb>base x x<rt>text x x</ruby></p>
+</body>
+</html>
--- a/layout/reftests/css-ruby/reftest.list
+++ b/layout/reftests/css-ruby/reftest.list
@ -23,6 +23,7 @@ test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLin
 == intrinsic-isize-1.html intrinsic-isize-1-ref.html
 == justification-1.html justification-1-ref.html
 == justification-2.html justification-2-ref.html
+fuzzy-if(winWidget,255,792) == lang-specific-style-1.html lang-specific-style-1-ref.html # bug 1134947
 == line-breaking-1.html line-breaking-1-ref.html
 == line-height-1.html line-height-1-ref.html
 == line-height-2.html line-height-2-ref.html
--- a/layout/style/html.css
+++ b/layout/style/html.css
@ -813,6 +813,12 @@ marquee[direction="up"], marquee[direction="down"] {
    font-size: 50%;
    line-height: 1;
  }
+  rtc:lang(zh), rt:lang(zh) {
+    ruby-align: center;
+  }
+  rtc:lang(zh-TW), rt:lang(zh-TW) {
+    font-size: 30%; /* bopomofo */
+  }
  rtc > rt {
    font-size: inherit;
  }
--- a/layout/style/moz.build
+++ b/layout/style/moz.build
@ -4,6 +4,21 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+
+with Files('nsComputedDOMStyle.*'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+
+with Files('nsROCSSPrimitiveValue.*'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+
+with Files('CSSRuleList.*'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+
+with Files('nsDOM*'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+
 DIRS += ['xbl-marquee']
 TEST_DIRS += ['test']

--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@ -1208,6 +1208,17 @@ protected:
  // sites.
  bool mDidUnprefixWebkitBoxInEarlierDecl; // not :1 so we can use AutoRestore

+#ifdef DEBUG
+  // True if any parsing of URL values requires a sheet principal to have
+  // been passed in the nsCSSScanner constructor.  This is usually the case.
+  // It can be set to false, for example, when we create an nsCSSParser solely
+  // to parse a property value to test it for syntactic correctness.  When
+  // false, an assertion that mSheetPrincipal is non-null is skipped.  Should
+  // not be set to false if any nsCSSValues created during parsing can escape
+  // out of the parser.
+  bool mSheetPrincipalRequired;
+#endif
+
  // Stack of rule groups; used for @media and such.
  InfallibleTArray<nsRefPtr<css::GroupRule> > mGroupStack;

@ -1285,6 +1296,9 @@ CSSParserImpl::CSSParserImpl()
    mInFailingSupportsRule(false),
    mSuppressErrors(false),
    mDidUnprefixWebkitBoxInEarlierDecl(false),
+#ifdef DEBUG
+    mSheetPrincipalRequired(true),
+#endif
    mNextFree(nullptr)
 {
 }
@ -7608,8 +7622,9 @@ bool
 CSSParserImpl::SetValueToURL(nsCSSValue& aValue, const nsString& aURL)
 {
  if (!mSheetPrincipal) {
-    NS_NOTREACHED("Codepaths that expect to parse URLs MUST pass in an "
-                  "origin principal");
+    NS_ASSERTION(!mSheetPrincipalRequired,
+                 "Codepaths that expect to parse URLs MUST pass in an "
+                 "origin principal");
    return false;
  }

@ -15276,6 +15291,17 @@ CSSParserImpl::IsValueValidForProperty(const nsCSSProperty aPropID,
  css::ErrorReporter reporter(scanner, mSheet, mChildLoader, nullptr);
  InitScanner(scanner, reporter, nullptr, nullptr, nullptr);

+#ifdef DEBUG
+  // We normally would need to pass in a sheet principal to InitScanner,
+  // because we might parse a URL value.  However, we will never use the
+  // parsed nsCSSValue (and so whether we have a sheet principal or not
+  // doesn't really matter), so to avoid failing the assertion in
+  // SetValueToURL, we set mSheetPrincipalRequired to false to declare
+  // that it's safe to skip the assertion.
+  AutoRestore<bool> autoRestore(mSheetPrincipalRequired);
+  mSheetPrincipalRequired = false;
+#endif
+
  nsAutoSuppressErrors suppressErrors(this);

  mSection = eCSSSection_General;
--- a/layout/svg/moz.build
+++ b/layout/svg/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'SVG')
+
 EXPORTS += [
    'nsFilterInstance.h',
    'nsSVGEffects.h',
--- a/layout/tables/moz.build
+++ b/layout/tables/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+
 MOCHITEST_MANIFESTS += ['test/mochitest.ini']

 EXPORTS += [
--- a/layout/tools/reftest/moz.build
+++ b/layout/tools/reftest/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Testing', 'Reftest')
+
 if CONFIG['MOZ_BUILD_APP'] in ('b2g', 'b2g/dev', 'mobile/android'):
    DEFINES['BOOTSTRAP'] = True
    if CONFIG['MOZ_BUILD_APP'] in ('b2g', 'b2g/dev'):
--- a/layout/xul/grid/moz.build
+++ b/layout/xul/grid/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+
 EXPORTS += [
    'nsGrid.h',
    'nsGridCell.h',
--- a/layout/xul/moz.build
+++ b/layout/xul/moz.build
@ -4,6 +4,12 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+
+with Files('*Menu*'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: Menus')
+
 if CONFIG['ENABLE_TESTS']:
    MOCHITEST_MANIFESTS += ['test/mochitest.ini']
    MOCHITEST_CHROME_MANIFESTS += ['test/chrome.ini']
--- a/layout/xul/tree/moz.build
+++ b/layout/xul/tree/moz.build
@ -4,6 +4,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

+with Files('**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+
 XPIDL_SOURCES += [
    'nsITreeBoxObject.idl',
    'nsITreeColumns.idl',
--- a/media/libcubeb/README_MOZILLA
+++ b/media/libcubeb/README_MOZILLA
@ -5,4 +5,4 @@ Makefile.in build files for the Mozilla build system.

 The cubeb git repository is: git://github.com/kinetiknz/cubeb.git

-The git commit ID used was 6de5d3e488d808dd925ae0885a7552fc0a25b449.
+The git commit ID used was 588c82be50ffee59b7fab71b56e6081a5a89301c.
--- a/media/libcubeb/src/cubeb_wasapi.cpp
+++ b/media/libcubeb/src/cubeb_wasapi.cpp
@ -1191,6 +1191,32 @@ int wasapi_stream_start(cubeb_stream * stm)

  XASSERT(stm && !stm->thread && !stm->shutdown_event);

+  HRESULT hr = stm->client->Start();
+  if (hr == AUDCLNT_E_DEVICE_INVALIDATED) {
+    LOG("audioclient invalid device, reconfiguring\n", hr);
+
+    BOOL ok = ResetEvent(stm->reconfigure_event);
+    if (!ok) {
+      LOG("resetting reconfig event failed: %x\n", GetLastError());
+    }
+
+    close_wasapi_stream(stm);
+    int r = setup_wasapi_stream(stm);
+    if (r != CUBEB_OK) {
+      LOG("reconfigure failed\n");
+      return r;
+    }
+
+    HRESULT hr = stm->client->Start();
+    if (FAILED(hr)) {
+      LOG("could not start the stream after reconfig: %x\n", hr);
+      return CUBEB_ERROR;
+    }
+ } else if (FAILED(hr)) {
+    LOG("could not start the stream.\n");
+    return CUBEB_ERROR;
+  }
+
  stm->shutdown_event = CreateEvent(NULL, 0, 0, NULL);
  if (!stm->shutdown_event) {
    LOG("Can't create the shutdown event, error: %x\n", GetLastError());
@ -1203,37 +1229,35 @@ int wasapi_stream_start(cubeb_stream * stm)
    return CUBEB_ERROR;
  }

-  HRESULT hr = stm->client->Start();
-  if (FAILED(hr)) {
-    LOG("could not start the stream.\n");
-    return CUBEB_ERROR;
-  } else {
-    stm->state_callback(stm, stm->user_ptr, CUBEB_STATE_STARTED);
-  }
+  stm->state_callback(stm, stm->user_ptr, CUBEB_STATE_STARTED);

-  return FAILED(hr) ? CUBEB_ERROR : CUBEB_OK;
+  return CUBEB_OK;
 }

 int wasapi_stream_stop(cubeb_stream * stm)
 {
  XASSERT(stm);

-  auto_lock lock(stm->stream_reset_lock);
+  {
+    auto_lock lock(stm->stream_reset_lock);

-  HRESULT hr = stm->client->Stop();
-  if (FAILED(hr)) {
-    LOG("could not stop AudioClient\n");
-  }
+    if (!stm->client) {
+      XASSERT(!stm->thread);
+      LOG("stream already stopped\n");
+    } else {
+      HRESULT hr = stm->client->Stop();
+      if (FAILED(hr)) {
+        LOG("could not stop AudioClient\n");
+        return CUBEB_ERROR;
+      }
+    }

-  stm->stream_reset_lock->leave();
-  stop_and_join_render_thread(stm);
-  stm->stream_reset_lock->enter();
-
-  if (SUCCEEDED(hr)) {
    stm->state_callback(stm, stm->user_ptr, CUBEB_STATE_STOPPED);
  }

-  return FAILED(hr) ? CUBEB_ERROR : CUBEB_OK;
+  stop_and_join_render_thread(stm);
+
+  return CUBEB_OK;
 }

 int wasapi_stream_get_position(cubeb_stream * stm, uint64_t * position)
--- a/media/webrtc/signaling/test/sdp_unittests.cpp
+++ b/media/webrtc/signaling/test/sdp_unittests.cpp
@ -1161,15 +1161,20 @@ const std::string kBasicAudioVideoOffer =
 "a=candidate:0 2 UDP 2130379006 10.0.0.36 55428 typ host" CRLF
 "a=end-of-candidates" CRLF
 "a=ssrc:5150" CRLF
-"m=video 9 RTP/SAVPF 120" CRLF
+"m=video 9 RTP/SAVPF 120 121" CRLF
 "c=IN IP6 ::1" CRLF
 "a=mid:second" CRLF
 "a=rtpmap:120 VP8/90000" CRLF
 "a=fmtp:120 max-fs=3600;max-fr=30" CRLF
+"a=rtpmap:121 VP9/90000" CRLF
+"a=fmtp:121 max-fs=3600;max-fr=30" CRLF
 "a=recvonly" CRLF
 "a=rtcp-fb:120 nack" CRLF
 "a=rtcp-fb:120 nack pli" CRLF
 "a=rtcp-fb:120 ccm fir" CRLF
+"a=rtcp-fb:121 nack" CRLF
+"a=rtcp-fb:121 nack pli" CRLF
+"a=rtcp-fb:121 ccm fir" CRLF
 "a=setup:active" CRLF
 "a=rtcp-mux" CRLF
 "a=msid:streama tracka" CRLF
@ -1309,8 +1314,9 @@ TEST_P(NewSdpTest, CheckMlines) {
            mSdp->GetMediaSection(1).GetProtocol())
    << "Wrong protocol for video";
  auto video_formats = mSdp->GetMediaSection(1).GetFormats();
-  ASSERT_EQ(1U, video_formats.size()) << "Wrong number of formats for video";
+  ASSERT_EQ(2U, video_formats.size()) << "Wrong number of formats for video";
  ASSERT_EQ("120", video_formats[0]);
+  ASSERT_EQ("121", video_formats[1]);

  ASSERT_EQ(SdpMediaSection::kAudio, mSdp->GetMediaSection(2).GetMediaType())
    << "Wrong type for third media section";
@ -1408,14 +1414,23 @@ TEST_P(NewSdpTest, CheckRtpmap) {
              audiosec.GetFormats()[4],
              rtpmap);

-  const SdpMediaSection& videosec = mSdp->GetMediaSection(1);
+  const SdpMediaSection& videosec1 = mSdp->GetMediaSection(1);
  CheckRtpmap("120",
              SdpRtpmapAttributeList::kVP8,
              "VP8",
              90000,
              0,
-              videosec.GetFormats()[0],
-              videosec.GetAttributeList().GetRtpmap());
+              videosec1.GetFormats()[0],
+              videosec1.GetAttributeList().GetRtpmap());
+
+  const SdpMediaSection& videosec2 = mSdp->GetMediaSection(1);
+  CheckRtpmap("121",
+              SdpRtpmapAttributeList::kVP9,
+              "VP9",
+              90000,
+              0,
+              videosec2.GetFormats()[1],
+              videosec2.GetAttributeList().GetRtpmap());
 }

 const std::string kH264AudioVideoOffer =
--- a/memory/jemalloc/0007-Preserve-LastError-when-calling-TlsGetValue.patch
+++ b/memory/jemalloc/0007-Preserve-LastError-when-calling-TlsGetValue.patch
@ -0,0 +1,45 @@
+From f44c19741e98f4a87cf20e59e31634bb8a29c657 Mon Sep 17 00:00:00 2001
+From: Mike Hommey <mh@glandium.org>
+Date: Wed, 4 Mar 2015 10:54:10 +0900
+Subject: [PATCH] Preserve LastError when calling TlsGetValue
+
+TlsGetValue has a semantic difference with pthread_getspecific, in that it
+can return a non-error NULL value, so it always sets the LastError.
+But allocator callers may not be expecting calling e.g. free() to change
+the value of the last error, so preserve it.
+---
+ include/jemalloc/internal/tsd.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/include/jemalloc/internal/tsd.h b/include/jemalloc/internal/tsd.h
+index dbb91a2..62a887e 100644
+--- a/include/jemalloc/internal/tsd.h
+++ b/include/jemalloc/internal/tsd.h
+@@ -277,9 +277,11 @@ a_name##tsd_set(a_type *val)						\
+ a_attr bool								\
+ a_name##tsd_cleanup_wrapper(void)					\
+ {									\
+-	a_name##tsd_wrapper_t *wrapper;					\
+	DWORD error = GetLastError();					\
+	a_name##tsd_wrapper_t *wrapper = (a_name##tsd_wrapper_t *)	\
+	    TlsGetValue(a_name##tsd_tsd);				\
+	SetLastError(error);						\
+ 									\
+-	wrapper = (a_name##tsd_wrapper_t *)TlsGetValue(a_name##tsd_tsd);\
+ 	if (wrapper == NULL)						\
+ 		return (false);						\
+ 	if (a_cleanup != malloc_tsd_no_cleanup &&			\
+@@ -307,8 +309,10 @@ a_name##tsd_wrapper_set(a_name##tsd_wrapper_t *wrapper)			\
+ a_attr a_name##tsd_wrapper_t *						\
+ a_name##tsd_wrapper_get(void)						\
+ {									\
+	DWORD error = GetLastError();					\
+ 	a_name##tsd_wrapper_t *wrapper = (a_name##tsd_wrapper_t *)	\
+ 	    TlsGetValue(a_name##tsd_tsd);				\
+	SetLastError(error);						\
+ 									\
+ 	if (unlikely(wrapper == NULL)) {				\
+ 		wrapper = (a_name##tsd_wrapper_t *)			\
+-- 
+2.3.0.3.g98027e3
+
--- a/memory/jemalloc/src/include/jemalloc/internal/tsd.h
+++ b/memory/jemalloc/src/include/jemalloc/internal/tsd.h
@ -277,9 +277,11 @@ a_name##tsd_set(a_type *val)						\
 a_attr bool								\
 a_name##tsd_cleanup_wrapper(void)					\
 {									\
-	a_name##tsd_wrapper_t *wrapper;					\
+	DWORD error = GetLastError();					\
+	a_name##tsd_wrapper_t *wrapper = (a_name##tsd_wrapper_t *)	\
+	    TlsGetValue(a_name##tsd_tsd);				\
+	SetLastError(error);						\
 									\
-	wrapper = (a_name##tsd_wrapper_t *)TlsGetValue(a_name##tsd_tsd);\
 	if (wrapper == NULL)						\
 		return (false);						\
 	if (a_cleanup != malloc_tsd_no_cleanup &&			\
@ -307,8 +309,10 @@ a_name##tsd_wrapper_set(a_name##tsd_wrapper_t *wrapper)			\
 a_attr a_name##tsd_wrapper_t *						\
 a_name##tsd_wrapper_get(void)						\
 {									\
+	DWORD error = GetLastError();					\
 	a_name##tsd_wrapper_t *wrapper = (a_name##tsd_wrapper_t *)	\
 	    TlsGetValue(a_name##tsd_tsd);				\
+	SetLastError(error);						\
 									\
 	if (unlikely(wrapper == NULL)) {				\
 		wrapper = (a_name##tsd_wrapper_t *)			\
--- a/memory/jemalloc/update.sh
+++ b/memory/jemalloc/update.sh
@ -20,6 +20,7 @@ patch -p1 < ../0003-Add-a-isblank-definition-for-MSVC-2013.patch
 patch -p1 < ../0004-Implement-stats.bookkeeping.patch
 patch -p1 < ../0005-Bug-1121314-Avoid-needing-the-arena-in-chunk_alloc_d.patch
 patch -p1 < ../0006-Make-opt.lg_dirty_mult-work-as-documented.patch
+patch -p1 < ../0007-Preserve-LastError-when-calling-TlsGetValue.patch

 cd ..
 hg addremove -q src
--- a/mobile/android/base/tests/robocop.ini
+++ b/mobile/android/base/tests/robocop.ini
@ -5,20 +5,16 @@
 skip-if = android_version == "10"
 [testAboutPasswords]
 [testAddonManager]
-# disabled on x86; bug 936216
 # disabled on 2.3; bug 941624, bug 1063509, bug 1073374, bug 1087221, bug 1088023, bug 1088027, bug 1090206
-skip-if = android_version == "10" || processor == "x86"
+skip-if = android_version == "10"
 [testAddSearchEngine]
 # disabled on Android 2.3; bug 979552
 skip-if = android_version == "10"
 [testAdobeFlash]
-skip-if = processor == "x86"
 [testANRReporter]
 [testAppConstants]
 [testAwesomebar]
 [testAxisLocking]
-# disabled on x86 only; bug 927476
-skip-if = processor == "x86"
 # [testBookmark] # see bug 915350
 [testBookmarksPanel]
 # disabled on 2.3; bug 979615
@ -31,8 +27,8 @@ skip-if = android_version == "10"
 [testBrowserProvider]
 [testBrowserSearchVisibility]
 [testClearPrivateData]
-# disabled on x86 and 2.3; bug 948591
-skip-if = android_version == "10" || processor == "x86"
+# disabled on 2.3; bug 948591
+skip-if = android_version == "10"
 [testDBUtils]
 [testDistribution]
 [testDoorHanger]
@ -43,17 +39,13 @@ skip-if = android_version == "10"
 # disabled on 2.3
 skip-if = android_version == "10"
 [testFlingCorrectness]
-# disabled on x86 only; bug 927476
-skip-if = processor == "x86"
 [testFormHistory]
 [testGetUserMedia]
 # [testHistory] # see bug 915350
 [testHomeBanner]
-# disabled on x86 only; bug 957185
-skip-if = processor == "x86"
 [testImportFromAndroid]
-# disabled on x86 and 2.3; bug 900664, 979552
-skip-if = android_version == "10" || processor == "x86"
+# disabled on 2.3; bug 979552
+skip-if = android_version == "10"
 [testInputUrlBar]
 [testJarReader]
 [testLinkContextMenu]
@ -67,8 +59,6 @@ skip-if = android_version == "10" || processor == "x86"
 # skip-if = android_version == "10" || android_version == "15"
 [testNewTab]
 [testPanCorrectness]
-# disabled on x86 only; bug 927476
-skip-if = processor == "x86"
 # [testPasswordEncrypt] # see bug 824067
 [testPasswordProvider]
 # [testPermissions] # see bug 757475
@ -76,8 +66,8 @@ skip-if = processor == "x86"
 [testPrefsObserver]
 [testPrivateBrowsing]
 [testPromptGridInput]
-# bug 957185 for x86, bug 1001657 for 2.3
-skip-if = android_version == "10" || processor == "x86"
+# bug 1001657 for 2.3
+skip-if = android_version == "10"
 # [testReaderMode] # see bug 913254, 936224
 [testReadingListCache]
 [testReadingListProvider]
@ -86,8 +76,8 @@ skip-if = android_version == "10" || processor == "x86"
 # disabled on 2.3; bug 907768
 skip-if = android_version == "10"
 [testSessionOOMSave]
-# disabled on x86 and 2.3; bug 945395
-skip-if = android_version == "10" || processor == "x86"
+# disabled on 2.3; bug 945395
+skip-if = android_version == "10"
 [testSessionOOMRestore]
 # disabled on Android 2.3; bug 979600
 skip-if = android_version == "10"
@ -96,8 +86,8 @@ skip-if = android_version == "10"
 skip-if = android_version == "10"
 # [testShareLink] # see bug 915897
 [testSystemPages]
-# disabled on x86 and 2.3; bug 907383, 979603
-skip-if = android_version == "10" || processor == "x86"
+# disabled on 2.3; bug 979603
+skip-if = android_version == "10"
 # [testThumbnails] # see bug 813107
 [testTitleBar]
 # disabled on Android 2.3; bug 979552
@ -118,7 +108,7 @@ skip-if = android_version == "10"
 [testOfflinePage]
 [testOrderedBroadcast]
 [testOSLocale]
-skip-if = processor == "x86" || android_version == "10" # x86: Bug 1088708, 2.3: Bug 1124494
+skip-if = android_version == "10" # 2.3: Bug 1124494
 [testResourceSubstitutions]
 [testRestrictedProfiles]
 [testSessionFormData]
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@ -427,10 +427,10 @@ pref("media.getusermedia.screensharing.enabled", true);
 #endif

 #ifdef RELEASE_BUILD
-pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,example.com");
+pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,example.com");
 #else
 // temporary value, not intended for release - bug 1049087
-pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,example.com");
+pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,example.com");
 #endif
 // OS/X 10.6 and XP have screen/window sharing off by default due to various issues - Caveat emptor
 pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
--- a/python/mozbuild/mozbuild/sphinx.py
+++ b/python/mozbuild/mozbuild/sphinx.py
@ -109,9 +109,10 @@ def format_module(m):
            'Sub-Context: %s' % subcontext,
            '=============' + '=' * len(subcontext),
            '',
-            prepare_docstring(cls.__doc__)[0],
-            '',
        ])
+        lines.extend(prepare_docstring(cls.__doc__))
+        if lines[-1]:
+            lines.append('')

        for k, v in sorted(cls.VARIABLES.items()):
            lines.extend(variable_reference(k, *v))
--- a/testing/config/mozharness/android_arm_4_3_config.py
+++ b/testing/config/mozharness/android_arm_4_3_config.py
--- a/testing/specialpowers/content/specialpowersAPI.js
+++ b/testing/specialpowers/content/specialpowersAPI.js
@ -19,7 +19,9 @@ Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");

-Cu.importGlobalProperties(["File"]);
+if (!this.File) {
+    Cu.importGlobalProperties(["File"]);
+}

 // Allow stuff from this scope to be accessed from non-privileged scopes. This
 // would crash if used outside of automation.
--- a/toolkit/devtools/server/tests/mochitest/test_css-logic.html
+++ b/toolkit/devtools/server/tests/mochitest/test_css-logic.html
@ -15,7 +15,6 @@ Cu.import("resource://gre/modules/devtools/Loader.jsm");
 const {Promise: promise} = Cu.import("resource://gre/modules/Promise.jsm", {});

 const {CssLogic} = devtools.require("devtools/styleinspector/css-logic");
-Cu.importGlobalProperties(['CSS']);

 window.onload = function() {
  SimpleTest.waitForExplicitFinish();
--- a/toolkit/xre/WindowsCrtPatch.h
+++ b/toolkit/xre/WindowsCrtPatch.h
@ -105,7 +105,7 @@ patched_RtlImageNtHeader(HMODULE module)
 {
  PIMAGE_NT_HEADERS headers = stub_RtlImageNtHeader(module);

-  if (module == GetModuleHandleA("msvcr120.dll")) {
+  if (module == GetModuleHandleW(L"msvcr120.dll")) {
    PatchModuleImports(module, headers);
  }

--- a/toolkit/xre/nsNativeAppSupportUnix.cpp
+++ b/toolkit/xre/nsNativeAppSupportUnix.cpp
@ -67,6 +67,7 @@ typedef enum {
  GNOME_DIALOG_NORMAL
 } GnomeDialogType;

+#if defined(MOZ_X11) && (MOZ_WIDGET_GTK == 2)
 typedef GnomeProgram * (*_gnome_program_init_fn)(const char *, const char *,
                                                 const GnomeModuleInfo *, int,
                                                 char **, const char *, ...);
@ -76,6 +77,7 @@ typedef GnomeClient * (*_gnome_master_client_fn)(void);
 typedef void (*_gnome_client_set_restart_command_fn)(GnomeClient*, gint, gchar*[]);

 static _gnome_client_set_restart_command_fn gnome_client_set_restart_command;
+#endif

 gboolean save_yourself_cb(GnomeClient *client, gint phase,
                          GnomeSaveStyle style, gboolean shutdown,
--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@ -619,10 +619,14 @@ CycleCollectedJSRuntime::NoteGCThingXPCOMChildren(const js::Class* aClasp,
    const DOMJSClass* domClass = GetDOMClass(aObj);
    if (domClass) {
      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(aCb, "UnwrapDOMObject(obj)");
+      // It's possible that our object is an unforgeable holder object, in
+      // which case it doesn't actually have a C++ DOM object associated with
+      // it.  Use UnwrapPossiblyNotInitializedDOMObject, which produces null in
+      // that case, since NoteXPCOMChild/NoteNativeChild are null-safe.
      if (domClass->mDOMObjectIsISupports) {
-        aCb.NoteXPCOMChild(UnwrapDOMObject<nsISupports>(aObj));
+        aCb.NoteXPCOMChild(UnwrapPossiblyNotInitializedDOMObject<nsISupports>(aObj));
      } else if (domClass->mParticipant) {
-        aCb.NoteNativeChild(UnwrapDOMObject<void>(aObj),
+        aCb.NoteNativeChild(UnwrapPossiblyNotInitializedDOMObject<void>(aObj),
                            domClass->mParticipant);
      }
    }