merge mozilla-inbound to mozilla-central a=merge

b2g/app/b2g.js

@@ -322,6 +322,7 @@ pref("media.fragmented-mp4.gonk.enabled", true);
 pref("media.video-queue.default-size", 3);
 
 // optimize images' memory usage
+pref("image.downscale-during-decode.enabled", true);
 pref("image.mem.decodeondraw", true);
 pref("image.mem.allow_locking_in_content_processes", false); /* don't allow image locking */
 // Limit the surface cache to 1/8 of main memory or 128MB, whichever is smaller.

dom/animation/test/chrome/test_running_on_compositor.html

@@ -14,7 +14,7 @@
   to { transform: translate(100px) }
 }
 .target {
-  // Element needs geometry to be eligible for layerization
+  /* Element needs geometry to be eligible for layerization */
   width: 100px;
   height: 100px;
   background-color: white;

dom/animation/test/mochitest.ini

@@ -22,4 +22,3 @@ skip-if = buildapp == 'mulet'
 [css-transitions/test_element-get-animation-players.html]
 skip-if = buildapp == 'mulet'
 [mozilla/test_deferred_start.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' # bug 1113425, 1119981

dom/animation/test/mozilla/test_deferred_start.html

@@ -11,7 +11,7 @@
   to { transform: translate(100px); }
 }
 .target {
-  // Element needs geometry to be eligible for layerization
+  /* Element needs geometry to be eligible for layerization */
   width: 100px;
   height: 100px;
   background-color: white;
@@ -60,13 +60,18 @@ async_test(function(t) {
       assert_unreached('ready promise was rejected');
     });
 
-  // We need to wait for up to two frames since the animation may not start
-  // until the beginning of the next refresh driver tick and it won't queue
-  // the ready Promise callback until that point.
-  }).then(waitForFrame).then(waitForFrame).then(t.step_func(function() {
+  // We need to wait for up to three frames. This is because in some
+  // cases it can take up to two frames for the initial layout
+  // to take place. Even after that happens we don't actually resolve the
+  // ready promise until the following tick.
+  })
+  .then(waitForFrame)
+  .then(waitForFrame)
+  .then(waitForFrame)
+  .then(t.step_func(function() {
     assert_true(promiseCallbackDone,
-                'ready promise callback was called before the next'
-                + ' requestAnimationFrame callback');
+                'ready promise for an empty animation was resolved'
+                + ' within three animation frames');
     t.done();
   }));
 }, 'AnimationPlayer.ready is resolved for an empty animation');

dom/base/Element.cpp

@@ -1832,7 +1832,7 @@ Element::IsLabelable() const
 }
 
 bool
-Element::IsInteractiveHTMLContent() const
+Element::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return false;
 }

dom/base/Element.h

@@ -276,7 +276,7 @@ public:
   /**
    * Returns if the element is interactive content as per HTML specification.
    */
-  virtual bool IsInteractiveHTMLContent() const;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const;
 
   /**
    * Is the attribute named stored in the mapped attributes?

dom/base/moz.build

@@ -74,6 +74,7 @@ EXPORTS += [
     'nsDOMNavigationTiming.h',
     'nsDOMString.h',
     'nsFocusManager.h',
+    'nsFormData.h',
     'nsFrameMessageManager.h',
     'nsGenericDOMDataNode.h',
     'nsGkAtomList.h',

dom/cache/TypeUtils.cpp

@@ -229,7 +229,7 @@ TypeUtils::ToPCacheResponseWithoutBody(PCacheResponse& aOut,
 
   aOut.status() = aIn.GetStatus();
   aOut.statusText() = aIn.GetStatusText();
-  nsRefPtr<InternalHeaders> headers = aIn.Headers();
+  nsRefPtr<InternalHeaders> headers = aIn.UnfilteredHeaders();
   MOZ_ASSERT(headers);
   headers->GetPHeaders(aOut.headers());
   aOut.headersGuard() = headers->Guard();
@@ -278,37 +278,14 @@ TypeUtils::ToPCacheQueryParams(PCacheQueryParams& aOut,
 already_AddRefed<Response>
 TypeUtils::ToResponse(const PCacheResponse& aIn)
 {
-  nsRefPtr<InternalResponse> ir;
-  switch (aIn.type())
-  {
-    case ResponseType::Error:
-      ir = InternalResponse::NetworkError();
-      break;
-    case ResponseType::Opaque:
-      ir = InternalResponse::OpaqueResponse();
-      break;
-    case ResponseType::Default:
-      ir = new InternalResponse(aIn.status(), aIn.statusText());
-      break;
-    case ResponseType::Basic:
-    {
-      nsRefPtr<InternalResponse> inner = new InternalResponse(aIn.status(),
-                                                              aIn.statusText());
-      ir = InternalResponse::BasicResponse(inner);
-      break;
-    }
-    case ResponseType::Cors:
-    {
-      nsRefPtr<InternalResponse> inner = new InternalResponse(aIn.status(),
-                                                              aIn.statusText());
-      ir = InternalResponse::CORSResponse(inner);
-      break;
-    }
-    default:
-      MOZ_CRASH("Unexpected ResponseType!");
+  if (aIn.type() == ResponseType::Error) {
+    nsRefPtr<InternalResponse> error = InternalResponse::NetworkError();
+    nsRefPtr<Response> r = new Response(GetGlobalObject(), error);
+    return r.forget();
   }
-  MOZ_ASSERT(ir);
 
+  nsRefPtr<InternalResponse> ir = new InternalResponse(aIn.status(),
+                                                       aIn.statusText());
   ir->SetUrl(NS_ConvertUTF16toUTF8(aIn.url()));
 
   nsRefPtr<InternalHeaders> internalHeaders =
@@ -324,6 +301,24 @@ TypeUtils::ToResponse(const PCacheResponse& aIn)
   nsCOMPtr<nsIInputStream> stream = ReadStream::Create(aIn.body());
   ir->SetBody(stream);
 
+  switch (aIn.type())
+  {
+    case ResponseType::Default:
+      break;
+    case ResponseType::Opaque:
+      ir = ir->OpaqueResponse();
+      break;
+    case ResponseType::Basic:
+      ir = ir->BasicResponse();
+      break;
+    case ResponseType::Cors:
+      ir = ir->CORSResponse();
+      break;
+    default:
+      MOZ_CRASH("Unexpected ResponseType!");
+  }
+  MOZ_ASSERT(ir);
+
   nsRefPtr<Response> ref = new Response(GetGlobalObject(), ir);
   return ref.forget();
 }

dom/cache/test/mochitest/driver.js

@@ -81,8 +81,7 @@ function runTests(testFile, order) {
   SimpleTest.waitForExplicitFinish();
 
   if (typeof order == "undefined") {
-    order = "sequential"; // sequential by default, see bug 1143222.
-    // TODO: Make this "both".
+    order = "both"; // both by default
   }
 
   ok(order == "parallel" || order == "sequential" || order == "both",

dom/cache/test/mochitest/test_cache_matchAll_request.js

@@ -18,7 +18,10 @@ function checkResponse(r, response, responseText) {
   is(r.statusText, response.statusText,
      "Both responses should have the same status text");
   return r.text().then(function(text) {
-    is(text, responseText, "The response body should be correct");
+    // Avoid dumping out the large response text to the log if they're equal.
+    if (text !== responseText) {
+      is(text, responseText, "The response body should be correct");
+    }
   });
 }
 

dom/cache/test/mochitest/test_cache_match_request.js

@@ -16,7 +16,10 @@ function checkResponse(r) {
   is(r.statusText, response.statusText,
      "Both responses should have the same status text");
   return r.text().then(function(text) {
-    is(text, responseText, "The response body should be correct");
+    // Avoid dumping out the large response text to the log if they're equal.
+    if (text !== responseText) {
+      is(text, responseText, "The response body should be correct");
+    }
   });
 }
 

dom/fetch/Fetch.cpp

@@ -32,6 +32,7 @@
 #include "InternalRequest.h"
 #include "InternalResponse.h"
 
+#include "nsFormData.h"
 #include "WorkerPrivate.h"
 #include "WorkerRunnable.h"
 #include "WorkerScope.h"
@@ -452,6 +453,16 @@ ExtractFromBlob(const File& aFile, nsIInputStream** aStream,
   return NS_OK;
 }
 
+nsresult
+ExtractFromFormData(nsFormData& aFormData, nsIInputStream** aStream,
+                    nsCString& aContentType)
+{
+  uint64_t unusedContentLength;
+  nsAutoCString unusedCharset;
+  return aFormData.GetSendInfo(aStream, &unusedContentLength,
+                               aContentType, unusedCharset);
+}
+
 nsresult
 ExtractFromUSVString(const nsString& aStr,
                      nsIInputStream** aStream,
@@ -502,7 +513,7 @@ ExtractFromURLSearchParams(const URLSearchParams& aParams,
 } // anonymous namespace
 
 nsresult
-ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams& aBodyInit,
+ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& aBodyInit,
                           nsIInputStream** aStream,
                           nsCString& aContentType)
 {
@@ -517,6 +528,9 @@ ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStr
   } else if (aBodyInit.IsBlob()) {
     const File& blob = aBodyInit.GetAsBlob();
     return ExtractFromBlob(blob, aStream, aContentType);
+  } else if (aBodyInit.IsFormData()) {
+    nsFormData& form = aBodyInit.GetAsFormData();
+    return ExtractFromFormData(form, aStream, aContentType);
   } else if (aBodyInit.IsUSVString()) {
     nsAutoString str;
     str.Assign(aBodyInit.GetAsUSVString());
@@ -531,7 +545,7 @@ ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStr
 }
 
 nsresult
-ExtractByteStreamFromBody(const ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams& aBodyInit,
+ExtractByteStreamFromBody(const ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& aBodyInit,
                           nsIInputStream** aStream,
                           nsCString& aContentType)
 {
@@ -546,6 +560,9 @@ ExtractByteStreamFromBody(const ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrU
   } else if (aBodyInit.IsBlob()) {
     const File& blob = aBodyInit.GetAsBlob();
     return ExtractFromBlob(blob, aStream, aContentType);
+  } else if (aBodyInit.IsFormData()) {
+    nsFormData& form = aBodyInit.GetAsFormData();
+    return ExtractFromFormData(form, aStream, aContentType);
   } else if (aBodyInit.IsUSVString()) {
     nsAutoString str;
     str.Assign(aBodyInit.GetAsUSVString());

dom/fetch/Fetch.h

@@ -26,9 +26,9 @@ class nsIGlobalObject;
 namespace mozilla {
 namespace dom {
 
-class ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams;
+class ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams;
 class InternalRequest;
-class OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams;
+class OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams;
 class RequestOrUSVString;
 
 namespace workers {
@@ -48,7 +48,7 @@ UpdateRequestReferrer(nsIGlobalObject* aGlobal, InternalRequest* aRequest);
  * Stores content type in out param aContentType.
  */
 nsresult
-ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams& aBodyInit,
+ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& aBodyInit,
                           nsIInputStream** aStream,
                           nsCString& aContentType);
 
@@ -56,7 +56,7 @@ ExtractByteStreamFromBody(const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStr
  * Non-owning version.
  */
 nsresult
-ExtractByteStreamFromBody(const ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams& aBodyInit,
+ExtractByteStreamFromBody(const ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& aBodyInit,
                           nsIInputStream** aStream,
                           nsCString& aContentType);
 

dom/fetch/FetchDriver.cpp

@@ -485,16 +485,24 @@ FetchDriver::HttpFetch(bool aCORSFlag, bool aCORSPreflightFlag, bool aAuthentica
     internalChan->ForceNoIntercept();
   }
 
-  // Set up a CORS proxy that will handle the various requirements of the CORS
-  // protocol. It handles the preflight cache and CORS response headers.
-  // If the request is allowed, it will start our original request
-  // and our observer will be notified. On failure, our observer is notified
-  // directly.
-  nsRefPtr<nsCORSListenerProxy> corsListener =
-    new nsCORSListenerProxy(this, mPrincipal, useCredentials);
-  rv = corsListener->Init(chan, true /* allow data uri */);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return FailWithNetworkError();
+  nsCOMPtr<nsIStreamListener> listener = this;
+
+  // Unless the cors mode is explicitly no-cors, we set up a cors proxy even in
+  // the same-origin case, since the proxy does not enforce cors header checks
+  // in the same-origin case.
+  if (mRequest->Mode() != RequestMode::No_cors) {
+    // Set up a CORS proxy that will handle the various requirements of the CORS
+    // protocol. It handles the preflight cache and CORS response headers.
+    // If the request is allowed, it will start our original request
+    // and our observer will be notified. On failure, our observer is notified
+    // directly.
+    nsRefPtr<nsCORSListenerProxy> corsListener =
+      new nsCORSListenerProxy(this, mPrincipal, useCredentials);
+    rv = corsListener->Init(chan, true /* allow data uri */);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return FailWithNetworkError();
+    }
+    listener = corsListener.forget();
   }
 
   // If preflight is required, start a "CORS preflight fetch"
@@ -507,12 +515,12 @@ FetchDriver::HttpFetch(bool aCORSFlag, bool aCORSPreflightFlag, bool aAuthentica
     nsAutoTArray<nsCString, 5> unsafeHeaders;
     mRequest->Headers()->GetUnsafeHeaders(unsafeHeaders);
 
-    rv = NS_StartCORSPreflight(chan, corsListener, mPrincipal,
+    rv = NS_StartCORSPreflight(chan, listener, mPrincipal,
                                useCredentials,
                                unsafeHeaders,
                                getter_AddRefs(preflightChannel));
   } else {
-   rv = chan->AsyncOpen(corsListener, nullptr);
+   rv = chan->AsyncOpen(listener, nullptr);
   }
 
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -548,13 +556,13 @@ FetchDriver::BeginAndGetFilteredResponse(InternalResponse* aResponse)
   nsRefPtr<InternalResponse> filteredResponse;
   switch (mRequest->GetResponseTainting()) {
     case InternalRequest::RESPONSETAINT_BASIC:
-      filteredResponse = InternalResponse::BasicResponse(aResponse);
+      filteredResponse = aResponse->BasicResponse();
       break;
     case InternalRequest::RESPONSETAINT_CORS:
-      filteredResponse = InternalResponse::CORSResponse(aResponse);
+      filteredResponse = aResponse->CORSResponse();
       break;
     case InternalRequest::RESPONSETAINT_OPAQUE:
-      filteredResponse = InternalResponse::OpaqueResponse();
+      filteredResponse = aResponse->OpaqueResponse();
       break;
     default:
       MOZ_CRASH("Unexpected case");
@@ -775,7 +783,7 @@ FetchDriver::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
   if (!NS_IsInternalSameURIRedirect(aOldChannel, aNewChannel, aFlags)) {
     rv = DoesNotRequirePreflight(aNewChannel);
     if (NS_FAILED(rv)) {
-      NS_WARNING("nsXMLHttpRequest::OnChannelRedirect: "
+      NS_WARNING("FetchDriver::OnChannelRedirect: "
                  "DoesNotRequirePreflight returned failure");
       return rv;
     }

dom/fetch/InternalResponse.cpp

@@ -23,25 +23,17 @@ InternalResponse::InternalResponse(uint16_t aStatus, const nsACString& aStatusTe
 {
 }
 
-// Headers are not copied since BasicResponse and CORSResponse both need custom
-// header handling.  Body is not copied as it cannot be shared directly.
-InternalResponse::InternalResponse(const InternalResponse& aOther)
-  : mType(aOther.mType)
-  , mTerminationReason(aOther.mTerminationReason)
-  , mURL(aOther.mURL)
-  , mFinalURL(aOther.mFinalURL)
-  , mStatus(aOther.mStatus)
-  , mStatusText(aOther.mStatusText)
-  , mContentType(aOther.mContentType)
-  , mSecurityInfo(aOther.mSecurityInfo)
-{
-}
-
 already_AddRefed<InternalResponse>
 InternalResponse::Clone()
 {
-  nsRefPtr<InternalResponse> clone = new InternalResponse(*this);
+  nsRefPtr<InternalResponse> clone = CreateIncompleteCopy();
+
   clone->mHeaders = new InternalHeaders(*mHeaders);
+  if (mWrappedResponse) {
+    clone->mWrappedResponse = mWrappedResponse->Clone();
+    MOZ_ASSERT(!mBody);
+    return clone.forget();
+  }
 
   if (!mBody) {
     return clone.forget();
@@ -62,27 +54,25 @@ InternalResponse::Clone()
   return clone.forget();
 }
 
-// static
 already_AddRefed<InternalResponse>
-InternalResponse::BasicResponse(InternalResponse* aInner)
+InternalResponse::BasicResponse()
 {
-  MOZ_ASSERT(aInner);
-  nsRefPtr<InternalResponse> basic = new InternalResponse(*aInner);
+  MOZ_ASSERT(!mWrappedResponse, "Can't BasicResponse a already wrapped response");
+  nsRefPtr<InternalResponse> basic = CreateIncompleteCopy();
   basic->mType = ResponseType::Basic;
-  basic->mHeaders = InternalHeaders::BasicHeaders(aInner->mHeaders);
-  basic->mBody.swap(aInner->mBody);
+  basic->mHeaders = InternalHeaders::BasicHeaders(Headers());
+  basic->mWrappedResponse = this;
   return basic.forget();
 }
 
-// static
 already_AddRefed<InternalResponse>
-InternalResponse::CORSResponse(InternalResponse* aInner)
+InternalResponse::CORSResponse()
 {
-  MOZ_ASSERT(aInner);
-  nsRefPtr<InternalResponse> cors = new InternalResponse(*aInner);
+  MOZ_ASSERT(!mWrappedResponse, "Can't CORSResponse a already wrapped response");
+  nsRefPtr<InternalResponse> cors = CreateIncompleteCopy();
   cors->mType = ResponseType::Cors;
-  cors->mHeaders = InternalHeaders::CORSHeaders(aInner->mHeaders);
-  cors->mBody.swap(aInner->mBody);
+  cors->mHeaders = InternalHeaders::CORSHeaders(Headers());
+  cors->mWrappedResponse = this;
   return cors.forget();
 }
 

dom/fetch/InternalResponse.h

@@ -38,27 +38,34 @@ public:
     return response.forget();
   }
 
-  static already_AddRefed<InternalResponse>
+  already_AddRefed<InternalResponse>
   OpaqueResponse()
   {
+    MOZ_ASSERT(!mWrappedResponse, "Can't OpaqueResponse a already wrapped response");
     nsRefPtr<InternalResponse> response = new InternalResponse(0, EmptyCString());
     response->mType = ResponseType::Opaque;
+    response->mTerminationReason = mTerminationReason;
+    response->mURL = mURL;
+    response->mFinalURL = mFinalURL;
+    response->mSecurityInfo = mSecurityInfo;
+    response->mWrappedResponse = this;
     return response.forget();
   }
 
-  // DO NOT use the inner response after filtering it since the filtered
-  // response will adopt the inner response's body.
-  static already_AddRefed<InternalResponse>
-  BasicResponse(InternalResponse* aInner);
+  already_AddRefed<InternalResponse>
+  BasicResponse();
 
-  // DO NOT use the inner response after filtering it since the filtered
-  // response will adopt the inner response's body.
-  static already_AddRefed<InternalResponse>
-  CORSResponse(InternalResponse* aInner);
+  already_AddRefed<InternalResponse>
+  CORSResponse();
 
   ResponseType
   Type() const
   {
+    MOZ_ASSERT_IF(mType == ResponseType::Error, !mWrappedResponse);
+    MOZ_ASSERT_IF(mType == ResponseType::Default, !mWrappedResponse);
+    MOZ_ASSERT_IF(mType == ResponseType::Basic, mWrappedResponse);
+    MOZ_ASSERT_IF(mType == ResponseType::Cors, mWrappedResponse);
+    MOZ_ASSERT_IF(mType == ResponseType::Opaque, mWrappedResponse);
     return mType;
   }
 
@@ -111,9 +118,28 @@ public:
     return mHeaders;
   }
 
+  InternalHeaders*
+  UnfilteredHeaders()
+  {
+    if (mWrappedResponse) {
+      return mWrappedResponse->Headers();
+    };
+
+    return Headers();
+  }
+
   void
   GetBody(nsIInputStream** aStream)
   {
+    if (Type() == ResponseType::Opaque) {
+      *aStream = nullptr;
+      return;
+    }
+
+    if (mWrappedResponse) {
+      MOZ_ASSERT(!mBody);
+      return mWrappedResponse->GetBody(aStream);
+    }
     nsCOMPtr<nsIInputStream> stream = mBody;
     stream.forget(aStream);
   }
@@ -121,6 +147,9 @@ public:
   void
   SetBody(nsIInputStream* aBody)
   {
+    if (mWrappedResponse) {
+      return mWrappedResponse->SetBody(aBody);
+    }
     // A request's body may not be reset once set.
     MOZ_ASSERT(!mBody);
     mBody = aBody;
@@ -142,9 +171,22 @@ private:
   ~InternalResponse()
   { }
 
-  // Used to create filtered and cloned responses.
-  // Does not copy headers or body stream.
-  explicit InternalResponse(const InternalResponse& aOther);
+  explicit InternalResponse(const InternalResponse& aOther) = delete;
+  InternalResponse& operator=(const InternalResponse&) = delete;
+
+  // Returns an instance of InternalResponse which is a copy of this
+  // InternalResponse, except headers, body and wrapped response (if any) which
+  // are left uninitialized. Used for cloning and filtering.
+  already_AddRefed<InternalResponse> CreateIncompleteCopy()
+  {
+    nsRefPtr<InternalResponse> copy = new InternalResponse(mStatus, mStatusText);
+    copy->mType = mType;
+    copy->mTerminationReason = mTerminationReason;
+    copy->mURL = mURL;
+    copy->mFinalURL = mFinalURL;
+    copy->mSecurityInfo = mSecurityInfo;
+    return copy.forget();
+  }
 
   ResponseType mType;
   nsCString mTerminationReason;
@@ -154,8 +196,13 @@ private:
   const nsCString mStatusText;
   nsRefPtr<InternalHeaders> mHeaders;
   nsCOMPtr<nsIInputStream> mBody;
-  nsCString mContentType;
   nsCString mSecurityInfo;
+
+  // For filtered responses.
+  // Cache, and SW interception should always serialize/access the underlying
+  // unfiltered headers and when deserializing, create an InternalResponse
+  // with the unfiltered headers followed by wrapping it.
+  nsRefPtr<InternalResponse> mWrappedResponse;
 };
 
 } // namespace dom

dom/fetch/Request.cpp

@@ -228,7 +228,7 @@ Request::Constructor(const GlobalObject& aGlobal,
       return nullptr;
     }
 
-    const OwningArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams& bodyInit = aInit.mBody.Value();
+    const OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& bodyInit = aInit.mBody.Value();
     nsCOMPtr<nsIInputStream> stream;
     nsCString contentType;
     aRv = ExtractByteStreamFromBody(bodyInit,

dom/fetch/Response.cpp

@@ -99,7 +99,7 @@ Response::Redirect(const GlobalObject& aGlobal, const nsAString& aUrl,
     return nullptr;
   }
 
-  Optional<ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams> body;
+  Optional<ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams> body;
   ResponseInit init;
   init.mStatus = aStatus;
   nsRefPtr<Response> r = Response::Constructor(aGlobal, body, init, aRv);
@@ -120,7 +120,7 @@ Response::Redirect(const GlobalObject& aGlobal, const nsAString& aUrl,
 
 /*static*/ already_AddRefed<Response>
 Response::Constructor(const GlobalObject& aGlobal,
-                      const Optional<ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams>& aBody,
+                      const Optional<ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams>& aBody,
                       const ResponseInit& aInit, ErrorResult& aRv)
 {
   if (aInit.mStatus < 200 || aInit.mStatus > 599) {

dom/fetch/Response.h

@@ -103,7 +103,7 @@ public:
 
   static already_AddRefed<Response>
   Constructor(const GlobalObject& aGlobal,
-              const Optional<ArrayBufferOrArrayBufferViewOrBlobOrUSVStringOrURLSearchParams>& aBody,
+              const Optional<ArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams>& aBody,
               const ResponseInit& aInit, ErrorResult& rv);
 
   nsIGlobalObject* GetParentObject() const

dom/html/HTMLAnchorElement.h

@@ -43,7 +43,7 @@ public:
   virtual bool Draggable() const MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLAudioElement.cpp

@@ -41,7 +41,7 @@ HTMLAudioElement::~HTMLAudioElement()
 }
 
 bool
-HTMLAudioElement::IsInteractiveHTMLContent() const
+HTMLAudioElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return HasAttr(kNameSpaceID_None, nsGkAtoms::controls);
 }

dom/html/HTMLAudioElement.h

@@ -24,7 +24,7 @@ public:
   explicit HTMLAudioElement(already_AddRefed<NodeInfo>& aNodeInfo);
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   // nsIDOMHTMLMediaElement
   using HTMLMediaElement::GetPaused;

dom/html/HTMLButtonElement.h

@@ -37,7 +37,7 @@ public:
   NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLButtonElement, button)
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLIFrameElement.h

@@ -27,7 +27,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLImageElement.cpp

@@ -149,7 +149,7 @@ NS_IMPL_STRING_ATTR(HTMLImageElement, UseMap, usemap)
 NS_IMPL_INT_ATTR(HTMLImageElement, Vspace, vspace)
 
 bool
-HTMLImageElement::IsInteractiveHTMLContent() const
+HTMLImageElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return HasAttr(kNameSpaceID_None, nsGkAtoms::usemap);
 }

dom/html/HTMLImageElement.h

@@ -47,7 +47,7 @@ public:
   virtual bool Draggable() const MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   // nsIDOMHTMLImageElement
   NS_DECL_NSIDOMHTMLIMAGEELEMENT

dom/html/HTMLInputElement.cpp

@@ -3222,7 +3222,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
 }
 
 bool
-HTMLInputElement::IsInteractiveHTMLContent() const
+HTMLInputElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return mType != NS_FORM_INPUT_HIDDEN;
 }

dom/html/HTMLInputElement.h

@@ -120,7 +120,7 @@ public:
   virtual void Focus(ErrorResult& aError) MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   // nsIDOMHTMLInputElement
   NS_DECL_NSIDOMHTMLINPUTELEMENT

dom/html/HTMLLabelElement.cpp

@@ -88,7 +88,7 @@ InInteractiveHTMLContent(nsIContent* aContent, nsIContent* aStop)
   nsIContent* content = aContent;
   while (content && content != aStop) {
     if (content->IsElement() &&
-        content->AsElement()->IsInteractiveHTMLContent()) {
+        content->AsElement()->IsInteractiveHTMLContent(true)) {
       return true;
     }
     content = content->GetParent();

dom/html/HTMLLabelElement.h

@@ -33,7 +33,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLObjectElement.cpp

@@ -50,7 +50,7 @@ HTMLObjectElement::~HTMLObjectElement()
 }
 
 bool
-HTMLObjectElement::IsInteractiveHTMLContent() const
+HTMLObjectElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return HasAttr(kNameSpaceID_None, nsGkAtoms::usemap);
 }

dom/html/HTMLObjectElement.h

@@ -37,7 +37,7 @@ public:
 #endif
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   // nsIDOMHTMLObjectElement
   NS_DECL_NSIDOMHTMLOBJECTELEMENT

dom/html/HTMLSelectElement.h

@@ -148,7 +148,7 @@ public:
   virtual int32_t TabIndexDefault() MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLTextAreaElement.h

@@ -54,7 +54,7 @@ public:
   virtual int32_t TabIndexDefault() MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE
   {
     return true;
   }

dom/html/HTMLVideoElement.cpp

@@ -127,7 +127,7 @@ nsresult HTMLVideoElement::SetAcceptHeader(nsIHttpChannel* aChannel)
 }
 
 bool
-HTMLVideoElement::IsInteractiveHTMLContent() const
+HTMLVideoElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return HasAttr(kNameSpaceID_None, nsGkAtoms::controls);
 }

dom/html/HTMLVideoElement.h

@@ -50,7 +50,7 @@ public:
   virtual nsresult SetAcceptHeader(nsIHttpChannel* aChannel) MOZ_OVERRIDE;
 
   // Element
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   // WebIDL
 

dom/html/nsGenericHTMLElement.cpp

@@ -1794,11 +1794,11 @@ nsGenericHTMLElement::IsLabelable() const
 }
 
 bool
-nsGenericHTMLElement::IsInteractiveHTMLContent() const
+nsGenericHTMLElement::IsInteractiveHTMLContent(bool aIgnoreTabindex) const
 {
   return IsAnyOfHTMLElements(nsGkAtoms::details, nsGkAtoms::embed,
                              nsGkAtoms::keygen) ||
-         HasAttr(kNameSpaceID_None, nsGkAtoms::tabindex);
+         (!aIgnoreTabindex && HasAttr(kNameSpaceID_None, nsGkAtoms::tabindex));
 }
 
 already_AddRefed<UndoManager>

dom/html/nsGenericHTMLElement.h

@@ -923,7 +923,7 @@ public:
   }
 
   virtual bool IsLabelable() const MOZ_OVERRIDE;
-  virtual bool IsInteractiveHTMLContent() const MOZ_OVERRIDE;
+  virtual bool IsInteractiveHTMLContent(bool aIgnoreTabindex) const MOZ_OVERRIDE;
 
   static bool TouchEventsEnabled(JSContext* /* unused */, JSObject* /* unused */);
 

dom/html/test/forms/test_interactive_content_in_label.html

@@ -32,13 +32,13 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=229925
     <select id="yes12"><option>select</option></select>
     <textarea id="yes13" cols="1" rows="1"></textarea>
     <video id="yes14" controls></video>
-    <span id="yes15" tabindex="1">tabindex</span>
 
     <audio id="no1"></audio>
     <img id="no2" src="data:image/png,">
     <input id="no3" type="hidden">
     <object id="no4">object</object>
     <video id="no5"></video>
+    <span id="no6" tabindex="1">tabindex</span>
   </label>
 </form>
 <script class="testbody" type="text/javascript">
@@ -62,7 +62,6 @@ var yes_nodes = [
   document.getElementById("yes12"),
   document.getElementById("yes13"),
   document.getElementById("yes14"),
-  document.getElementById("yes15"),
 ];
 
 var no_nodes = [
@@ -72,6 +71,7 @@ var no_nodes = [
   document.getElementById("no3"),
   document.getElementById("no4"),
   document.getElementById("no5"),
+  document.getElementById("no6"),
 ];
 
 var target_clicked = false;

dom/media/VideoUtils.cpp

@@ -233,6 +233,12 @@ ExtractH264CodecDetails(const nsAString& aCodec,
   aLevel = PromiseFlatString(Substring(aCodec, 9, 2)).ToInteger(&rv, 16);
   NS_ENSURE_SUCCESS(rv, false);
 
+  if (aLevel == 9) {
+    aLevel = H264_LEVEL_1_b;
+  } else if (aLevel <= 5) {
+    aLevel *= 10;
+  }
+
   // Capture the constraint_set flag value for the purpose of Telemetry.
   // We don't NS_ENSURE_SUCCESS here because ExtractH264CodecDetails doesn't
   // care about this, but we make sure constraints is above 4 (constraint_set5_flag)

dom/media/fmp4/MP4Reader.cpp

@@ -486,9 +486,7 @@ MP4Reader::ReadMetadata(MediaInfo* aInfo,
     mInfo.mVideo.mDisplay =
       nsIntSize(video.display_width, video.display_height);
     mVideo.mCallback = new DecoderCallback(this, kVideo);
-    if (!mIsEncrypted && mSharedDecoderManager) {
-      // Note: Don't use SharedDecoderManager in EME content, as it doesn't
-      // handle reiniting the decoder properly yet.
+    if (mSharedDecoderManager) {
       mVideo.mDecoder =
         mSharedDecoderManager->CreateVideoDecoder(mPlatform,
                                                   video,
@@ -580,7 +578,7 @@ MP4Reader::GetNextKeyframeTime()
 void
 MP4Reader::DisableHardwareAcceleration()
 {
-  if (HasVideo() && !mIsEncrypted && mSharedDecoderManager) {
+  if (HasVideo() && mSharedDecoderManager) {
     mPlatform->DisableHardwareAcceleration();
 
     const VideoDecoderConfig& video = mDemuxer->VideoConfig();
@@ -1111,9 +1109,7 @@ void MP4Reader::NotifyResourcesStatusChanged()
 void
 MP4Reader::SetIdle()
 {
-  if (!mIsEncrypted && mSharedDecoderManager && mVideo.mDecoder) {
-    // Note: Don't use SharedDecoderManager in EME content, as it doesn't
-    // handle reiniting the decoder properly yet.
+  if (mSharedDecoderManager && mVideo.mDecoder) {
     mSharedDecoderManager->SetIdle(mVideo.mDecoder);
     NotifyResourcesStatusChanged();
   }

dom/media/mediasource/MediaSource.cpp

@@ -233,11 +233,27 @@ MediaSource::AddSourceBuffer(const nsAString& aType, ErrorResult& aRv)
     return nullptr;
   }
   mSourceBuffers->Append(sourceBuffer);
-  mActiveSourceBuffers->Append(sourceBuffer);
   MSE_DEBUG("sourceBuffer=%p", sourceBuffer.get());
   return sourceBuffer.forget();
 }
 
+void
+MediaSource::SourceBufferIsActive(SourceBuffer* aSourceBuffer)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  mActiveSourceBuffers->ClearSimple();
+  bool found = false;
+  for (uint32_t i = 0; i < mSourceBuffers->Length(); i++) {
+    SourceBuffer* sourceBuffer = mSourceBuffers->IndexedGetter(i, found);
+    MOZ_ALWAYS_TRUE(found);
+    if (sourceBuffer == aSourceBuffer) {
+      mActiveSourceBuffers->Append(aSourceBuffer);
+    } else if (sourceBuffer->IsActive()) {
+      mActiveSourceBuffers->AppendSimple(sourceBuffer);
+    }
+  }
+}
+
 void
 MediaSource::RemoveSourceBuffer(SourceBuffer& aSourceBuffer, ErrorResult& aRv)
 {

dom/media/mediasource/MediaSource.h

@@ -122,7 +122,7 @@ private:
   // MediaSourceDecoder uses DurationChange to set the duration
   // without hitting the checks in SetDuration.
   friend class mozilla::MediaSourceDecoder;
-  // SourceBuffer uses SetDuration
+  // SourceBuffer uses SetDuration and SourceBufferIsActive
   friend class mozilla::dom::SourceBuffer;
 
   ~MediaSource();
@@ -140,6 +140,9 @@ private:
   // SetDuration with no checks.
   void SetDuration(double aDuration, MSRangeRemovalAction aAction);
 
+  // Mark SourceBuffer as active and rebuild ActiveSourceBuffers.
+  void SourceBufferIsActive(SourceBuffer* aSourceBuffer);
+
   nsRefPtr<SourceBufferList> mSourceBuffers;
   nsRefPtr<SourceBufferList> mActiveSourceBuffers;
 

dom/media/mediasource/MediaSourceReader.cpp

@@ -120,7 +120,7 @@ MediaSourceReader::RequestAudioData()
   MOZ_DIAGNOSTIC_ASSERT(mSeekPromise.IsEmpty(), "No sample requests allowed while seeking");
   MOZ_DIAGNOSTIC_ASSERT(mAudioPromise.IsEmpty(), "No duplicate sample requests");
   nsRefPtr<AudioDataPromise> p = mAudioPromise.Ensure(__func__);
-  MSE_DEBUGV("");
+  MSE_DEBUGV("mLastAudioTime=%lld", mLastAudioTime);
   if (!mAudioTrack) {
     MSE_DEBUG("called with no audio track");
     mAudioPromise.Reject(DECODE_ERROR, __func__);
@@ -236,20 +236,21 @@ MediaSourceReader::OnAudioNotDecoded(NotDecodedReason aReason)
   mAudioRequest.Complete();
 
   MSE_DEBUG("aReason=%u IsEnded: %d", aReason, IsEnded());
-  if (aReason == DECODE_ERROR || aReason == CANCELED) {
-    mAudioPromise.Reject(aReason, __func__);
+  if (aReason == CANCELED) {
+    mAudioPromise.Reject(CANCELED, __func__);
     return;
   }
 
-  // End of stream. Force switching past this stream to another reader by
+  // If End of stream. Force switching past this stream to another reader by
   // switching to the end of the buffered range.
-  MOZ_ASSERT(aReason == END_OF_STREAM);
-  if (mAudioSourceDecoder) {
+  int64_t lastAudioTime = mLastAudioTime;
+  if (aReason == END_OF_STREAM && mAudioSourceDecoder) {
     AdjustEndTime(&mLastAudioTime, mAudioSourceDecoder);
   }
 
+  SwitchSourceResult result = SwitchAudioSource(&mLastAudioTime);
   // See if we can find a different source that can pick up where we left off.
-  if (SwitchAudioSource(&mLastAudioTime) == SOURCE_NEW) {
+  if (result == SOURCE_NEW) {
     GetAudioReader()->ResetDecode();
     mAudioSeekRequest.Begin(GetAudioReader()->Seek(GetReaderAudioTime(mLastAudioTime), 0)
                             ->RefableThen(GetTaskQueue(), __func__, this,
@@ -258,7 +259,22 @@ MediaSourceReader::OnAudioNotDecoded(NotDecodedReason aReason)
     return;
   }
 
+  // If we got a DECODE_ERROR and we have buffered data in the requested range
+  // then it must be a genuine decoding error.
+  // Otherwise we can assume that the data was either evicted or explicitely
+  // removed from the source buffer and we should wait for new data.
+  if (aReason == DECODE_ERROR && result != SOURCE_NONE) {
+    mAudioPromise.Reject(DECODE_ERROR, __func__);
+    return;
+  }
+
   CheckForWaitOrEndOfStream(MediaData::AUDIO_DATA, mLastAudioTime);
+
+  if (mLastAudioTime - lastAudioTime >= EOS_FUZZ_US) {
+    // No decoders are available to switch to. We will re-attempt from the last
+    // failing position.
+    mLastAudioTime = lastAudioTime;
+  }
 }
 
 nsRefPtr<MediaDecoderReader::VideoDataPromise>
@@ -268,8 +284,8 @@ MediaSourceReader::RequestVideoData(bool aSkipToNextKeyframe, int64_t aTimeThres
   MOZ_DIAGNOSTIC_ASSERT(mSeekPromise.IsEmpty(), "No sample requests allowed while seeking");
   MOZ_DIAGNOSTIC_ASSERT(mVideoPromise.IsEmpty(), "No duplicate sample requests");
   nsRefPtr<VideoDataPromise> p = mVideoPromise.Ensure(__func__);
-  MSE_DEBUGV("RequestVideoData(%d, %lld)",
-             aSkipToNextKeyframe, aTimeThreshold);
+  MSE_DEBUGV("RequestVideoData(%d, %lld), mLastVideoTime=%lld",
+             aSkipToNextKeyframe, aTimeThreshold, mLastVideoTime);
   if (!mVideoTrack) {
     MSE_DEBUG("called with no video track");
     mVideoPromise.Reject(DECODE_ERROR, __func__);
@@ -367,20 +383,22 @@ MediaSourceReader::OnVideoNotDecoded(NotDecodedReason aReason)
   mVideoRequest.Complete();
 
   MSE_DEBUG("aReason=%u IsEnded: %d", aReason, IsEnded());
-  if (aReason == DECODE_ERROR || aReason == CANCELED) {
-    mVideoPromise.Reject(aReason, __func__);
+
+  if (aReason == CANCELED) {
+    mVideoPromise.Reject(CANCELED, __func__);
     return;
   }
 
-  // End of stream. Force switching past this stream to another reader by
+  // if End of stream. Force switching past this stream to another reader by
   // switching to the end of the buffered range.
-  MOZ_ASSERT(aReason == END_OF_STREAM);
-  if (mVideoSourceDecoder) {
+  int64_t lastVideoTime = mLastVideoTime;
+  if (aReason == END_OF_STREAM && mVideoSourceDecoder) {
     AdjustEndTime(&mLastVideoTime, mVideoSourceDecoder);
   }
 
   // See if we can find a different reader that can pick up where we left off.
-  if (SwitchVideoSource(&mLastVideoTime) == SOURCE_NEW) {
+  SwitchSourceResult result = SwitchVideoSource(&mLastVideoTime);
+  if (result == SOURCE_NEW) {
     GetVideoReader()->ResetDecode();
     mVideoSeekRequest.Begin(GetVideoReader()->Seek(GetReaderVideoTime(mLastVideoTime), 0)
                            ->RefableThen(GetTaskQueue(), __func__, this,
@@ -389,7 +407,22 @@ MediaSourceReader::OnVideoNotDecoded(NotDecodedReason aReason)
     return;
   }
 
+  // If we got a DECODE_ERROR and we have buffered data in the requested range
+  // then it must be a genuine decoding error.
+  // Otherwise we can assume that the data was either evicted or explicitely
+  // removed from the source buffer and we should wait for new data.
+  if (aReason == DECODE_ERROR && result != SOURCE_NONE) {
+    mVideoPromise.Reject(DECODE_ERROR, __func__);
+    return;
+  }
+
   CheckForWaitOrEndOfStream(MediaData::VIDEO_DATA, mLastVideoTime);
+
+  if (mLastVideoTime - lastVideoTime >= EOS_FUZZ_US) {
+    // No decoders are available to switch to. We will re-attempt from the last
+    // failing position.
+    mLastVideoTime = lastVideoTime;
+  }
 }
 
 void

dom/media/mediasource/SourceBuffer.cpp

@@ -322,6 +322,7 @@ SourceBuffer::SourceBuffer(MediaSource* aMediaSource, const nsACString& aType)
   , mTimestampOffset(0)
   , mAppendMode(SourceBufferAppendMode::Segments)
   , mUpdating(false)
+  , mActive(false)
   , mUpdateID(0)
   , mType(aType)
 {
@@ -475,7 +476,11 @@ SourceBuffer::AppendDataCompletedWithSuccess(bool aGotMedia)
   }
 
   if (mTrackBuffer->HasInitSegment()) {
-    mMediaSource->QueueInitializationEvent();
+    if (!mActive) {
+      mActive = true;
+      mMediaSource->SourceBufferIsActive(this);
+      mMediaSource->QueueInitializationEvent();
+    }
   }
 
   if (aGotMedia) {

dom/media/mediasource/SourceBuffer.h

@@ -117,6 +117,11 @@ public:
   // Actually remove data between aStart and aEnd
   void DoRangeRemoval(double aStart, double aEnd);
 
+  bool IsActive() const
+  {
+    return mActive;
+  }
+
 #if defined(DEBUG)
   void Dump(const char* aPath);
 #endif
@@ -174,6 +179,8 @@ private:
   SourceBufferAppendMode mAppendMode;
   bool mUpdating;
 
+  bool mActive;
+
   // Each time mUpdating is set to true, mUpdateID will be incremented.
   // This allows for a queued AppendData task to identify if it was earlier
   // aborted and another AppendData queued.

dom/media/mediasource/SourceBufferList.cpp

@@ -61,6 +61,13 @@ SourceBufferList::Append(SourceBuffer* aSourceBuffer)
   QueueAsyncSimpleEvent("addsourcebuffer");
 }
 
+void
+SourceBufferList::AppendSimple(SourceBuffer* aSourceBuffer)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  mSourceBuffers.AppendElement(aSourceBuffer);
+}
+
 void
 SourceBufferList::Remove(SourceBuffer* aSourceBuffer)
 {
@@ -88,6 +95,13 @@ SourceBufferList::Clear()
   QueueAsyncSimpleEvent("removesourcebuffer");
 }
 
+void
+SourceBufferList::ClearSimple()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  mSourceBuffers.Clear();
+}
+
 bool
 SourceBufferList::IsEmpty()
 {

dom/media/mediasource/SourceBufferList.h

@@ -78,6 +78,13 @@ public:
   // Returns the highest end time of any of the Sourcebuffers.
   double GetHighestBufferedEndTime();
 
+  // Append a SourceBuffer to the list. No event is fired.
+  void AppendSimple(SourceBuffer* aSourceBuffer);
+
+  // Remove all SourceBuffers from mSourceBuffers.
+  //  No event is fired and no action is performed on the sourcebuffers.
+  void ClearSimple();
+
 #if defined(DEBUG)
   void Dump(const char* aPath);
 #endif

dom/media/mediasource/test/test_MediaSource.html

@@ -47,7 +47,8 @@ runWithMSE(function () {
     ok(sb, "Create a SourceBuffer");
     is(ms.sourceBuffers.length, 1, "MediaSource.sourceBuffers is expected length");
     is(ms.sourceBuffers[0], sb, "SourceBuffer in list matches our SourceBuffer");
-    is(ms.activeSourceBuffers[0], sb, "SourceBuffer in active list matches our SourceBuffer");
+    is(ms.activeSourceBuffers.length, 0, "MediaSource.activeSourceBuffers is expected length");
+
 
     fetchWithXHR("seek.webm", function (arrayBuffer) {
       sb.appendBuffer(new Uint8Array(arrayBuffer));
@@ -70,6 +71,7 @@ runWithMSE(function () {
     });
 
     sb.addEventListener("updateend", function () {
+      is(ms.activeSourceBuffers[0], sb, "SourceBuffer in active list matches our SourceBuffer");
       is(sb.updating, false, "SourceBuffer.updating is expected value in updateend event");
       updateendCount++;
       v.play();

dom/plugins/base/nsPluginInstanceOwner.cpp

@@ -580,8 +580,9 @@ NS_IMETHODIMP nsPluginInstanceOwner::ShowStatus(const char16_t *aStatusMsg)
 
 NS_IMETHODIMP nsPluginInstanceOwner::GetDocument(nsIDocument* *aDocument)
 {
-  if (!aDocument)
+  if (!aDocument || !mContent) {
     return NS_ERROR_NULL_POINTER;
+  }
 
   // XXX sXBL/XBL2 issue: current doc or owner doc?
   // But keep in mind bug 322414 comment 33

dom/tests/mochitest/fetch/test_fetch_basic_http.js

@@ -134,6 +134,60 @@ function testBlob() {
   });
 }
 
+// This test is a copy of dom/html/test/formData_test.js testSend() modified to
+// use the fetch API. Please change this if you change that.
+function testFormDataSend() {
+  var file, blob = new Blob(['hey'], {type: 'text/plain'});
+
+  var fd = new FormData();
+  fd.append("string", "hey");
+  fd.append("empty", blob);
+  fd.append("explicit", blob, "explicit-file-name");
+  fd.append("explicit-empty", blob, "");
+  file = new File([blob], 'testname',  {type: 'text/plain'});
+  fd.append("file-name", file);
+  file = new File([blob], '',  {type: 'text/plain'});
+  fd.append("empty-file-name", file);
+  file = new File([blob], 'testname',  {type: 'text/plain'});
+  fd.append("file-name-overwrite", file, "overwrite");
+
+  var req = new Request("/tests/dom/html/test/form_submit_server.sjs", {
+                          method: 'POST',
+                          body: fd,
+                        });
+
+  return fetch(req).then((r) => {
+    ok(r.status, 200, "status should match");
+    return r.json().then((response) => {
+      for (var entry of response) {
+        if (entry.headers['Content-Disposition'] != 'form-data; name="string"') {
+          is(entry.headers['Content-Type'], 'text/plain');
+        }
+
+        is(entry.body, 'hey');
+      }
+
+      is(response[1].headers['Content-Disposition'],
+          'form-data; name="empty"; filename="blob"');
+
+      is(response[2].headers['Content-Disposition'],
+          'form-data; name="explicit"; filename="explicit-file-name"');
+
+      is(response[3].headers['Content-Disposition'],
+          'form-data; name="explicit-empty"; filename=""');
+
+      is(response[4].headers['Content-Disposition'],
+          'form-data; name="file-name"; filename="testname"');
+
+      is(response[5].headers['Content-Disposition'],
+          'form-data; name="empty-file-name"; filename=""');
+
+      is(response[6].headers['Content-Disposition'],
+          'form-data; name="file-name-overwrite"; filename="overwrite"');
+    });
+  });
+}
+
 function runTest() {
   return Promise.resolve()
     .then(testURL)
@@ -141,5 +195,6 @@ function runTest() {
     .then(testRequestGET)
     .then(testResponses)
     .then(testBlob)
+    .then(testFormDataSend)
     // Put more promise based tests here.
 }

dom/tests/mochitest/fetch/test_fetch_cors.js

@@ -46,9 +46,11 @@ var corsServerPath = "/tests/dom/base/test/file_CrossSiteXHR_server.sjs?";
 function testModeNoCors() {
   // Fetch spec, section 4, step 4, response tainting should be set opaque, so
   // that fetching leads to an opaque filtered response in step 8.
-  var r = new Request("http://example.com" + corsServerPath + "status=200&allowOrigin=*", { mode: "no-cors" });
+  var r = new Request("http://example.com" + corsServerPath + "status=200", { mode: "no-cors" });
   return fetch(r).then(function(res) {
     ok(isOpaqueResponse(res), "no-cors Request fetch should result in opaque response");
+  }, function(e) {
+    ok(false, "no-cors Request fetch should not error");
   });
 }
 
@@ -1019,7 +1021,7 @@ function testRedirects() {
              hops: [{ server: "http://example.com",
                       allowOrigin: origin
                     },
-                    { server: "http://test2.mochi.test:8000",
+                    { server: "http://test2.mochi.test:8888",
                       allowOrigin: origin
                     },
                     { server: "http://sub2.xn--lt-uia.mochi.test:8888",
@@ -1035,7 +1037,7 @@ function testRedirects() {
              hops: [{ server: "http://example.com",
                       allowOrigin: origin
                     },
-                    { server: "http://test2.mochi.test:8000",
+                    { server: "http://test2.mochi.test:8888",
                       allowOrigin: origin
                     },
                     { server: "http://sub2.xn--lt-uia.mochi.test:8888",
@@ -1067,7 +1069,7 @@ function testRedirects() {
              hops: [{ server: "http://example.com",
                       allowOrigin: origin
                     },
-                    { server: "http://test2.mochi.test:8000",
+                    { server: "http://test2.mochi.test:8888",
                       allowOrigin: origin
                     },
                     { server: "http://sub2.xn--lt-uia.mochi.test:8888",
@@ -1083,7 +1085,7 @@ function testRedirects() {
              hops: [{ server: "http://example.com",
                       allowOrigin: origin
                     },
-                    { server: "http://test2.mochi.test:8000",
+                    { server: "http://test2.mochi.test:8888",
                       allowOrigin: origin
                     },
                     { server: "http://sub2.xn--lt-uia.mochi.test:8888",
@@ -1099,7 +1101,7 @@ function testRedirects() {
              hops: [{ server: "http://example.com",
                       allowOrigin: origin
                     },
-                    { server: "http://test2.mochi.test:8000",
+                    { server: "http://test2.mochi.test:8888",
                       allowOrigin: origin
                     },
                     { server: "http://sub2.xn--lt-uia.mochi.test:8888",

dom/webidl/Fetch.webidl

@@ -8,9 +8,7 @@
  */
 
 typedef object JSON;
-// FIXME(nsm): Bug 739173: FormData is not available in workers.
-// typedef (ArrayBuffer or ArrayBufferView or Blob or FormData or USVString or URLSearchParams) BodyInit;
-typedef (ArrayBuffer or ArrayBufferView or Blob or USVString or URLSearchParams) BodyInit;
+typedef (ArrayBuffer or ArrayBufferView or Blob or FormData or USVString or URLSearchParams) BodyInit;
 
 [NoInterfaceObject, Exposed=(Window,Worker)]
 interface Body {

gfx/layers/ipc/CompositorParent.cpp

@@ -1135,22 +1135,8 @@ CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
     // When testing we synchronously update the shadow tree with the animated
     // values to avoid race conditions when calling GetAnimationTransform etc.
     // (since the above SetShadowProperties will remove animation effects).
-    // However, we only do this update when a composite operation is already
-    // scheduled in order to better match the behavior under regular sampling
-    // conditions.
-    bool needTestComposite = mIsTesting && root &&
-                             (mCurrentCompositeTask ||
-                             (mCompositorVsyncObserver &&
-                              mCompositorVsyncObserver->NeedsComposite()));
-    if (needTestComposite) {
-      AutoResolveRefLayers resolve(mCompositionManager);
-      bool requestNextFrame =
-        mCompositionManager->TransformShadowTree(mTestTime);
-      if (!requestNextFrame) {
-        CancelCurrentCompositeTask();
-        // Pretend we composited in case someone is waiting for this event.
-        DidComposite();
-      }
+    if (mIsTesting) {
+      ApplyAsyncProperties(aLayerTree);
     }
   }
   mLayerManager->NotifyShadowTreeTransaction();
@@ -1197,6 +1183,31 @@ CompositorParent::LeaveTestMode(LayerTransactionParent* aLayerTree)
   mIsTesting = false;
 }
 
+void
+CompositorParent::ApplyAsyncProperties(LayerTransactionParent* aLayerTree)
+{
+  // NOTE: This should only be used for testing. For example, when mIsTesting is
+  // true or when called from test-only methods like
+  // LayerTransactionParent::RecvGetAnimationTransform.
+
+  // Synchronously update the layer tree, but only if a composite was already
+  // scehduled.
+  if (aLayerTree->GetRoot() &&
+      (mCurrentCompositeTask ||
+       (mCompositorVsyncObserver &&
+        mCompositorVsyncObserver->NeedsComposite()))) {
+    AutoResolveRefLayers resolve(mCompositionManager);
+    TimeStamp time = mIsTesting ? mTestTime : mLastCompose;
+    bool requestNextFrame =
+      mCompositionManager->TransformShadowTree(time);
+    if (!requestNextFrame) {
+      CancelCurrentCompositeTask();
+      // Pretend we composited in case someone is waiting for this event.
+      DidComposite();
+    }
+  }
+}
+
 bool
 CompositorParent::RecvRequestOverfill()
 {

gfx/layers/ipc/CompositorParent.h

@@ -194,6 +194,8 @@ public:
   virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                  const TimeStamp& aTime) MOZ_OVERRIDE;
   virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) MOZ_OVERRIDE;
+  virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree)
+               MOZ_OVERRIDE;
   virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                               APZTestData* aOutData) MOZ_OVERRIDE;
   virtual AsyncCompositionManager* GetCompositionManager(LayerTransactionParent* aLayerTree) MOZ_OVERRIDE { return mCompositionManager; }

gfx/layers/ipc/LayerTransactionParent.cpp

@@ -682,6 +682,12 @@ LayerTransactionParent::RecvGetAnimationTransform(PLayerParent* aParent,
     return false;
   }
 
+  // Make sure we apply the latest animation style or else we can end up with
+  // a race between when we temporarily clear the animation transform (in
+  // CompositorParent::SetShadowProperties) and when animation recalculates
+  // the value.
+  mShadowLayersManager->ApplyAsyncProperties(this);
+
   // This method is specific to transforms applied by animation.
   // This is because this method uses the information stored with an animation
   // such as the origin of the reference frame corresponding to the layer, to

gfx/layers/ipc/ShadowLayersManager.h

@@ -35,6 +35,7 @@ public:
     virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                    const TimeStamp& aTime) { return true; }
     virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) { }
+    virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree) { }
     virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                                 APZTestData* aOutData) { }
 };

gfx/thebes/gfxPrefs.h

@@ -232,7 +232,7 @@ private:
 
   DECL_GFX_PREF(Once, "image.cache.timeweight",                ImageCacheTimeWeight, int32_t, 500);
   DECL_GFX_PREF(Once, "image.cache.size",                      ImageCacheSize, int32_t, 5*1024*1024);
-  DECL_GFX_PREF(Live, "image.downscale-during-decode.enabled", ImageDownscaleDuringDecodeEnabled, bool, false);
+  DECL_GFX_PREF(Live, "image.downscale-during-decode.enabled", ImageDownscaleDuringDecodeEnabled, bool, true);
   DECL_GFX_PREF(Live, "image.high_quality_downscaling.enabled", ImageHQDownscalingEnabled, bool, false);
   DECL_GFX_PREF(Live, "image.high_quality_downscaling.min_factor", ImageHQDownscalingMinFactor, uint32_t, 1000);
   DECL_GFX_PREF(Live, "image.high_quality_upscaling.max_size", ImageHQUpscalingMaxSize, uint32_t, 20971520);

image/public/imgIContainer.idl

@@ -98,7 +98,7 @@ native nsIntRectByVal(nsIntRect);
 [ref] native nsIntSize(nsIntSize);
 native nsSize(nsSize);
 [ptr] native nsIFrame(nsIFrame);
-[ptr] native ImageContainer(mozilla::layers::ImageContainer);
+native TempRefImageContainer(already_AddRefed<mozilla::layers::ImageContainer>);
 [ref] native ImageRegion(mozilla::image::ImageRegion);
 [ptr] native LayerManager(mozilla::layers::LayerManager);
 native Orientation(mozilla::image::Orientation);
@@ -116,7 +116,7 @@ native nsIntSizeByVal(nsIntSize);
  *
  * Internally, imgIContainer also manages animation of images.
  */
-[scriptable, builtinclass, uuid(9a43298b-bf49-44fc-9abe-9ff702f1bd25)]
+[scriptable, builtinclass, uuid(44fbd7d5-e417-4d31-ae4a-8ad61d07eb3c)]
 interface imgIContainer : nsISupports
 {
   /**
@@ -277,8 +277,17 @@ interface imgIContainer : nsISupports
   /**
    * Attempts to create an ImageContainer (and Image) containing the current
    * frame. Only valid for RASTER type images.
+   *
+   * @param aManager The LayerManager which will be used to create the
+   *                 ImageContainer.
+   * @param aFlags Decoding / drawing flags (in other words, FLAG_* flags).
+   *               Currently only FLAG_SYNC_DECODE and FLAG_SYNC_DECODE_IF_FAST
+   *               are supported.
+   * @return An ImageContainer for the current frame, or nullptr if one could
+   *         not be created.
    */
-  [noscript] ImageContainer getImageContainer(in LayerManager aManager);
+  [noscript, notxpcom] TempRefImageContainer getImageContainer(in LayerManager aManager,
+                                                               in uint32_t aFlags);
 
   /**
    * Draw the requested frame of this image onto the context specified.

image/src/ClippedImage.cpp

@@ -266,8 +266,8 @@ ClippedImage::GetFrameInternal(const nsIntSize& aSize,
   return mCachedSurface->Surface();
 }
 
-NS_IMETHODIMP
-ClippedImage::GetImageContainer(LayerManager* aManager, ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+ClippedImage::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
   // XXX(seth): We currently don't have a way of clipping the result of
   // GetImageContainer. We work around this by always returning null, but if it
@@ -276,11 +276,10 @@ ClippedImage::GetImageContainer(LayerManager* aManager, ImageContainer** _retval
   // that method for performance reasons.
 
   if (!ShouldClip()) {
-    return InnerImage()->GetImageContainer(aManager, _retval);
+    return InnerImage()->GetImageContainer(aManager, aFlags);
   }
 
-  *_retval = nullptr;
-  return NS_OK;
+  return nullptr;
 }
 
 static bool

image/src/ClippedImage.h

@@ -37,8 +37,9 @@ public:
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
   NS_IMETHOD_(TemporaryRef<SourceSurface>)
     GetFrame(uint32_t aWhichFrame, uint32_t aFlags) MOZ_OVERRIDE;
-  NS_IMETHOD GetImageContainer(layers::LayerManager* aManager,
-                               layers::ImageContainer** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<layers::ImageContainer>)
+    GetImageContainer(layers::LayerManager* aManager,
+                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD_(DrawResult) Draw(gfxContext* aContext,
                                const nsIntSize& aSize,
                                const ImageRegion& aRegion,

image/src/DynamicImage.cpp

@@ -205,12 +205,10 @@ DynamicImage::IsOpaque()
   return false;
 }
 
-NS_IMETHODIMP
-DynamicImage::GetImageContainer(LayerManager* aManager,
-                                ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+DynamicImage::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
-  *_retval = nullptr;
-  return NS_OK;
+  return nullptr;
 }
 
 NS_IMETHODIMP_(DrawResult)

image/src/FrozenImage.cpp

@@ -44,18 +44,15 @@ FrozenImage::GetFrame(uint32_t aWhichFrame,
   return InnerImage()->GetFrame(FRAME_FIRST, aFlags);
 }
 
-NS_IMETHODIMP
-FrozenImage::GetImageContainer(layers::LayerManager* aManager,
-                               layers::ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+FrozenImage::GetImageContainer(layers::LayerManager* aManager, uint32_t aFlags)
 {
   // XXX(seth): GetImageContainer does not currently support anything but the
   // current frame. We work around this by always returning null, but if it ever
   // turns out that FrozenImage is widely used on codepaths that can actually
   // benefit from GetImageContainer, it would be a good idea to fix that method
   // for performance reasons.
-
-  *_retval = nullptr;
-  return NS_OK;
+  return nullptr;
 }
 
 NS_IMETHODIMP_(DrawResult)

image/src/FrozenImage.h

@@ -37,8 +37,9 @@ public:
   NS_IMETHOD GetAnimated(bool* aAnimated) MOZ_OVERRIDE;
   NS_IMETHOD_(TemporaryRef<SourceSurface>)
     GetFrame(uint32_t aWhichFrame, uint32_t aFlags) MOZ_OVERRIDE;
-  NS_IMETHOD GetImageContainer(layers::LayerManager* aManager,
-                               layers::ImageContainer** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<layers::ImageContainer>)
+    GetImageContainer(layers::LayerManager* aManager,
+                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD_(DrawResult) Draw(gfxContext* aContext,
                                const nsIntSize& aSize,
                                const ImageRegion& aRegion,

image/src/ImageWrapper.cpp

@@ -192,11 +192,10 @@ ImageWrapper::IsOpaque()
   return mInnerImage->IsOpaque();
 }
 
-NS_IMETHODIMP
-ImageWrapper::GetImageContainer(LayerManager* aManager,
-                                ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+ImageWrapper::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
-  return mInnerImage->GetImageContainer(aManager, _retval);
+  return mInnerImage->GetImageContainer(aManager, aFlags);
 }
 
 NS_IMETHODIMP_(DrawResult)

image/src/OrientedImage.cpp

@@ -122,9 +122,8 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
   return target->Snapshot();
 }
 
-NS_IMETHODIMP
-OrientedImage::GetImageContainer(LayerManager* aManager,
-                                 ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+OrientedImage::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
   // XXX(seth): We currently don't have a way of orienting the result of
   // GetImageContainer. We work around this by always returning null, but if it
@@ -133,11 +132,10 @@ OrientedImage::GetImageContainer(LayerManager* aManager,
   // that method for performance reasons.
 
   if (mOrientation.IsIdentity()) {
-    return InnerImage()->GetImageContainer(aManager, _retval);
+    return InnerImage()->GetImageContainer(aManager, aFlags);
   }
 
-  *_retval = nullptr;
-  return NS_OK;
+  return nullptr;
 }
 
 struct MatrixBuilder

image/src/OrientedImage.h

@@ -34,8 +34,9 @@ public:
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
   NS_IMETHOD_(TemporaryRef<SourceSurface>)
     GetFrame(uint32_t aWhichFrame, uint32_t aFlags) MOZ_OVERRIDE;
-  NS_IMETHOD GetImageContainer(layers::LayerManager* aManager,
-                               layers::ImageContainer** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<layers::ImageContainer>)
+    GetImageContainer(layers::LayerManager* aManager,
+                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD_(DrawResult) Draw(gfxContext* aContext,
                                const nsIntSize& aSize,
                                const ImageRegion& aRegion,

image/src/RasterImage.cpp

@@ -256,6 +256,7 @@ RasterImage::RasterImage(ProgressTracker* aProgressTracker,
   mLockCount(0),
   mDecodeCount(0),
   mRequestedSampleSize(0),
+  mLastImageContainerDrawResult(DrawResult::NOT_READY),
 #ifdef DEBUG
   mFramesNotified(0),
 #endif
@@ -325,6 +326,7 @@ RasterImage::Init(const char* aMimeType,
 
   // Lock this image's surfaces in the SurfaceCache if we're not discardable.
   if (!mDiscardable) {
+    mLockCount++;
     SurfaceCache::LockImage(ImageKey(this));
   }
 
@@ -727,19 +729,21 @@ NS_IMETHODIMP_(TemporaryRef<SourceSurface>)
 RasterImage::GetFrame(uint32_t aWhichFrame,
                       uint32_t aFlags)
 {
-  return GetFrameInternal(aWhichFrame, aFlags);
+  return GetFrameInternal(aWhichFrame, aFlags).second().forget();
 }
 
-TemporaryRef<SourceSurface>
+Pair<DrawResult, RefPtr<SourceSurface>>
 RasterImage::GetFrameInternal(uint32_t aWhichFrame, uint32_t aFlags)
 {
   MOZ_ASSERT(aWhichFrame <= FRAME_MAX_VALUE);
 
-  if (aWhichFrame > FRAME_MAX_VALUE)
-    return nullptr;
+  if (aWhichFrame > FRAME_MAX_VALUE) {
+    return MakePair(DrawResult::BAD_ARGS, RefPtr<SourceSurface>());
+  }
 
-  if (mError)
-    return nullptr;
+  if (mError) {
+    return MakePair(DrawResult::BAD_IMAGE, RefPtr<SourceSurface>());
+  }
 
   // Get the frame. If it's not there, it's probably the caller's fault for
   // not waiting for the data to be loaded from the network or not passing
@@ -748,7 +752,7 @@ RasterImage::GetFrameInternal(uint32_t aWhichFrame, uint32_t aFlags)
     LookupFrame(GetRequestedFrameIndex(aWhichFrame), mSize, aFlags);
   if (!frameRef) {
     // The OS threw this frame away and we couldn't redecode it.
-    return nullptr;
+    return MakePair(DrawResult::TEMPORARY_ERROR, RefPtr<SourceSurface>());
   }
 
   // If this frame covers the entire image, we can just reuse its existing
@@ -767,50 +771,57 @@ RasterImage::GetFrameInternal(uint32_t aWhichFrame, uint32_t aFlags)
     frameSurf = CopyFrame(aWhichFrame, aFlags);
   }
 
-  return frameSurf;
+  if (!frameRef->IsImageComplete()) {
+    return MakePair(DrawResult::INCOMPLETE, Move(frameSurf));
+  }
+
+  return MakePair(DrawResult::SUCCESS, Move(frameSurf));
 }
 
-already_AddRefed<layers::Image>
-RasterImage::GetCurrentImage(ImageContainer* aContainer)
+Pair<DrawResult, nsRefPtr<layers::Image>>
+RasterImage::GetCurrentImage(ImageContainer* aContainer, uint32_t aFlags)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aContainer);
 
-  RefPtr<SourceSurface> surface =
-    GetFrameInternal(FRAME_CURRENT, FLAG_ASYNC_NOTIFY);
-  if (!surface) {
+  auto result = GetFrameInternal(FRAME_CURRENT, aFlags | FLAG_ASYNC_NOTIFY);
+  if (!result.second()) {
     // The OS threw out some or all of our buffer. We'll need to wait for the
     // redecode (which was automatically triggered by GetFrame) to complete.
-    return nullptr;
+    return MakePair(result.first(), nsRefPtr<layers::Image>());
   }
 
   CairoImage::Data cairoData;
   GetWidth(&cairoData.mSize.width);
   GetHeight(&cairoData.mSize.height);
-  cairoData.mSourceSurface = surface;
+  cairoData.mSourceSurface = result.second();
 
   nsRefPtr<layers::Image> image =
     aContainer->CreateImage(ImageFormat::CAIRO_SURFACE);
-  NS_ASSERTION(image, "Failed to create Image");
+  MOZ_ASSERT(image);
 
   static_cast<CairoImage*>(image.get())->SetData(cairoData);
 
-  return image.forget();
+  return MakePair(result.first(), Move(image));
 }
 
 
-NS_IMETHODIMP
-RasterImage::GetImageContainer(LayerManager* aManager, ImageContainer **_retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+RasterImage::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aManager);
+  MOZ_ASSERT((aFlags & ~(FLAG_SYNC_DECODE |
+                         FLAG_SYNC_DECODE_IF_FAST |
+                         FLAG_ASYNC_NOTIFY))
+               == FLAG_NONE,
+             "Unsupported flag passed to GetImageContainer");
 
   int32_t maxTextureSize = aManager->GetMaxTextureSize();
   if (!mHasSize ||
       mSize.width > maxTextureSize ||
       mSize.height > maxTextureSize) {
-    *_retval = nullptr;
-    return NS_OK;
+    return nullptr;
   }
 
   if (IsUnlocked() && mProgressTracker) {
@@ -818,28 +829,34 @@ RasterImage::GetImageContainer(LayerManager* aManager, ImageContainer **_retval)
   }
 
   nsRefPtr<layers::ImageContainer> container = mImageContainer.get();
-  if (container) {
-    container.forget(_retval);
-    return NS_OK;
+
+  bool mustRedecode =
+    (aFlags & (FLAG_SYNC_DECODE | FLAG_SYNC_DECODE_IF_FAST)) &&
+    mLastImageContainerDrawResult != DrawResult::SUCCESS &&
+    mLastImageContainerDrawResult != DrawResult::BAD_IMAGE;
+
+  if (container && !mustRedecode) {
+    return container.forget();
   }
 
   // We need a new ImageContainer, so create one.
   container = LayerManager::CreateImageContainer();
 
-  nsRefPtr<layers::Image> image = GetCurrentImage(container);
-  if (!image) {
-    return NS_ERROR_NOT_AVAILABLE;
+  auto result = GetCurrentImage(container, aFlags);
+  if (!result.second()) {
+    // We couldn't get an Image.
+    return nullptr;
   }
 
-  // |image| holds a reference to a SourceSurface which in turn holds a lock on
-  // the current frame's VolatileBuffer, ensuring that it doesn't get freed as
-  // long as the layer system keeps this ImageContainer alive.
-  container->SetCurrentImageInTransaction(image);
+  // |result.second()| holds a reference to a SourceSurface which in turn holds
+  // a lock on the current frame's VolatileBuffer, ensuring that it doesn't get
+  // freed as long as the layer system keeps this ImageContainer alive.
+  container->SetCurrentImageInTransaction(result.second());
 
+  mLastImageContainerDrawResult = result.first();
   mImageContainer = container;
-  container.forget(_retval);
 
-  return NS_OK;
+  return container.forget();
 }
 
 void
@@ -852,12 +869,14 @@ RasterImage::UpdateImageContainer()
     return;
   }
 
-  nsRefPtr<layers::Image> image = GetCurrentImage(container);
-  if (!image) {
+  auto result = GetCurrentImage(container, FLAG_NONE);
+  if (!result.second()) {
+    // We couldn't get an Image.
     return;
   }
 
-  container->SetCurrentImage(image);
+  mLastImageContainerDrawResult = result.first();
+  container->SetCurrentImage(result.second());
 }
 
 size_t
@@ -1488,12 +1507,6 @@ RasterImage::Decode(const Maybe<nsIntSize>& aSize, uint32_t aFlags)
     return NS_OK;
   }
 
-  // Create a decoder.
-  nsRefPtr<Decoder> decoder = CreateDecoder(aSize, aFlags);
-  if (!decoder) {
-    return NS_ERROR_FAILURE;
-  }
-
   if (mDownscaleDuringDecode && aSize) {
     // We're about to decode again, which may mean that some of the previous
     // sizes we've decoded at aren't useful anymore. We can allow them to
@@ -1505,6 +1518,12 @@ RasterImage::Decode(const Maybe<nsIntSize>& aSize, uint32_t aFlags)
     SurfaceCache::UnlockSurfaces(ImageKey(this));
   }
 
+  // Create a decoder.
+  nsRefPtr<Decoder> decoder = CreateDecoder(aSize, aFlags);
+  if (!decoder) {
+    return NS_ERROR_FAILURE;
+  }
+
   if (aSize) {
     // This isn't a size decode (which doesn't send any early notifications), so
     // send out notifications right away.

image/src/RasterImage.h

@@ -30,6 +30,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/Pair.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/WeakPtr.h"
 #include "mozilla/UniquePtr.h"
@@ -297,8 +298,9 @@ private:
 
   TemporaryRef<gfx::SourceSurface> CopyFrame(uint32_t aWhichFrame,
                                              uint32_t aFlags);
-  TemporaryRef<gfx::SourceSurface> GetFrameInternal(uint32_t aWhichFrame,
-                                                    uint32_t aFlags);
+
+  Pair<DrawResult, RefPtr<gfx::SourceSurface>>
+    GetFrameInternal(uint32_t aWhichFrame, uint32_t aFlags);
 
   DrawableFrameRef LookupFrameInternal(uint32_t aFrameNum,
                                        const gfx::IntSize& aSize,
@@ -314,8 +316,9 @@ private:
   size_t SizeOfDecodedWithComputedFallbackIfHeap(gfxMemoryLocation aLocation,
                                                  MallocSizeOf aMallocSizeOf) const;
 
-  already_AddRefed<layers::Image>
-    GetCurrentImage(layers::ImageContainer* aContainer);
+  Pair<DrawResult, nsRefPtr<layers::Image>>
+    GetCurrentImage(layers::ImageContainer* aContainer, uint32_t aFlags);
+
   void UpdateImageContainer();
 
   // We would like to just check if we have a zero lock count, but we can't do
@@ -381,6 +384,10 @@ private: // data
   // the layer system needs it.
   WeakPtr<layers::ImageContainer> mImageContainer;
 
+  // If mImageContainer is non-null, this contains the DrawResult we obtained
+  // the last time we updated it.
+  DrawResult mLastImageContainerDrawResult;
+
 #ifdef DEBUG
   uint32_t                       mFramesNotified;
 #endif

image/src/VectorImage.cpp

@@ -697,12 +697,10 @@ VectorImage::GetFrame(uint32_t aWhichFrame,
 
 //******************************************************************************
 /* [noscript] ImageContainer getImageContainer(); */
-NS_IMETHODIMP
-VectorImage::GetImageContainer(LayerManager* aManager,
-                               layers::ImageContainer** _retval)
+NS_IMETHODIMP_(already_AddRefed<ImageContainer>)
+VectorImage::GetImageContainer(LayerManager* aManager, uint32_t aFlags)
 {
-  *_retval = nullptr;
-  return NS_OK;
+  return nullptr;
 }
 
 struct SVGDrawingParameters

image/test/crashtests/crashtests.list

@@ -46,4 +46,4 @@ load multiple-png-hassize.ico
 # Asserts in the debug build
 load 856616.gif
 
-skip-if(AddressSanitizer) load 944353.jpg
+skip-if(AddressSanitizer) skip-if(B2G) load 944353.jpg

ipc/glue/MessageChannel.cpp

@@ -707,6 +707,33 @@ MessageChannel::OnMessageReceivedFromLink(const Message& aMsg)
     }
 }
 
+void
+MessageChannel::ProcessPendingRequests()
+{
+    // Loop until there aren't any more priority messages to process.
+    for (;;) {
+        mozilla::Vector<Message> toProcess;
+
+        for (MessageQueue::iterator it = mPending.begin(); it != mPending.end(); ) {
+            Message &msg = *it;
+            if (!ShouldDeferMessage(msg)) {
+                toProcess.append(Move(msg));
+                it = mPending.erase(it);
+                continue;
+            }
+            it++;
+        }
+
+        if (toProcess.empty())
+            break;
+
+        // Processing these messages could result in more messages, so we
+        // loop around to check for more afterwards.
+        for (auto it = toProcess.begin(); it != toProcess.end(); it++)
+            ProcessPendingRequest(*it);
+    }
+}
+
 bool
 MessageChannel::Send(Message* aMsg, Message* aReply)
 {
@@ -766,31 +793,12 @@ MessageChannel::Send(Message* aMsg, Message* aReply)
     int32_t transaction = mCurrentTransaction;
     msg->set_transaction_id(transaction);
 
+    ProcessPendingRequests();
+
     mLink->SendMessage(msg.forget());
 
     while (true) {
-        // Loop until there aren't any more priority messages to process.
-        for (;;) {
-            mozilla::Vector<Message> toProcess;
-
-            for (MessageQueue::iterator it = mPending.begin(); it != mPending.end(); ) {
-                Message &msg = *it;
-                if (!ShouldDeferMessage(msg)) {
-                    toProcess.append(Move(msg));
-                    it = mPending.erase(it);
-                    continue;
-                }
-                it++;
-            }
-
-            if (toProcess.empty())
-                break;
-
-            // Processing these messages could result in more messages, so we
-            // loop around to check for more afterwards.
-            for (auto it = toProcess.begin(); it != toProcess.end(); it++)
-                ProcessPendingRequest(*it);
-        }
+        ProcessPendingRequests();
 
         // See if we've received a reply.
         if (mRecvdErrors) {

ipc/glue/MessageChannel.h

@@ -227,6 +227,7 @@ class MessageChannel : HasResultCodes
     bool InterruptEventOccurred();
     bool HasPendingEvents();
 
+    void ProcessPendingRequests();
     bool ProcessPendingRequest(const Message &aUrgent);
 
     void MaybeUndeferIncall();

ipc/ipdl/test/cxx/PTestRPC.ipdl

@@ -7,9 +7,7 @@ parent:
     prio(high) sync Test1_Start() returns (uint32_t result);
     prio(high) sync Test1_InnerEvent() returns (uint32_t result);
     async Test2_Start();
-    prio(high) sync Test2_Msg2();
-    prio(high) sync Test2_FirstUrgent();
-    prio(high) sync Test2_SecondUrgent();
+    prio(high) sync Test2_OutOfOrder();
     sync Test3_Start() returns (uint32_t result);
     prio(high) sync Test3_InnerEvent() returns (uint32_t result);
 
@@ -17,8 +15,8 @@ child:
     async Start();
     prio(high) sync Test1_InnerQuery() returns (uint32_t result);
     prio(high) sync Test1_NoReenter() returns (uint32_t result);
-    prio(high) sync Test2_Msg1();
-    prio(high) sync Test2_Msg3();
+    prio(high) sync Test2_FirstUrgent();
+    prio(high) sync Test2_SecondUrgent();
     prio(high) sync Test3_WakeUp() returns (uint32_t result);
 };
 

ipc/ipdl/test/cxx/TestHangs.cpp

@@ -84,6 +84,8 @@ TestHangsParent::ShouldContinueFromReplyTimeout()
     MessageLoop::current()->PostTask(
         FROM_HERE, NewRunnableMethod(this, &TestHangsParent::CleanUp));
 
+    GetIPCChannel()->CloseWithTimeout();
+
     return false;
 }
 

ipc/ipdl/test/cxx/TestRPC.cpp

@@ -14,6 +14,8 @@ namespace _ipdltest {
 // parent
 
 TestRPCParent::TestRPCParent()
+ : reentered_(false),
+   resolved_first_cpow_(false)
 {
   MOZ_COUNT_CTOR(TestRPCParent);
 }
@@ -59,30 +61,25 @@ TestRPCParent::RecvTest1_InnerEvent(uint32_t* aResult)
 bool
 TestRPCParent::RecvTest2_Start()
 {
-  if (!SendTest2_Msg1())
-    fail("SendTest2_Msg1");
+  // Send a CPOW. During this time, we must NOT process the RPC message, as
+  // we could start receiving CPOW replies out-of-order.
+  if (!SendTest2_FirstUrgent())
+    fail("SendTest2_FirstUrgent");
 
+  MOZ_ASSERT(!reentered_);
+  resolved_first_cpow_ = true;
   return true;
 }
 
 bool
-TestRPCParent::RecvTest2_Msg2()
+TestRPCParent::RecvTest2_OutOfOrder()
 {
-  if (!SendTest2_Msg3())
-    fail("SendTest2_Msg3");
+  // Send a CPOW. If this RPC call was initiated while waiting for the first
+  // CPOW to resolve, replies will be processed out of order, and we'll crash.
+  if (!SendTest2_SecondUrgent())
+    fail("SendTest2_SecondUrgent");
 
-  return true;
-}
-
-bool
-TestRPCParent::RecvTest2_FirstUrgent()
-{
-  return true;
-}
-
-bool
-TestRPCParent::RecvTest2_SecondUrgent()
-{
+  reentered_ = true;
   return true;
 }
 
@@ -107,8 +104,6 @@ TestRPCParent::RecvTest3_InnerEvent(uint32_t* aResult)
 
 
 TestRPCChild::TestRPCChild()
- : reentered_(false),
-   resolved_first_cpow_(false)
 {
     MOZ_COUNT_CTOR(TestRPCChild);
 }
@@ -130,8 +125,8 @@ TestRPCChild::RecvStart()
   if (!SendTest2_Start())
     fail("SendTest2_Start");
 
-  if (!SendTest2_Msg2())
-    fail("SendTest2_Msg2");
+  if (!SendTest2_OutOfOrder())
+    fail("SendTest2_OutOfOrder");
 
   result = 0;
   if (!SendTest3_Start(&result))
@@ -163,29 +158,15 @@ TestRPCChild::RecvTest1_NoReenter(uint32_t* aResult)
   return true;
 }
 
-bool TestRPCChild::RecvTest2_Msg1()
+bool
+TestRPCChild::RecvTest2_FirstUrgent()
 {
-  MOZ_ASSERT(resolved_first_cpow_);
-
-  // Send a CPOW. If this RPC call was initiated while waiting for the first
-  // CPOW to resolve, replies will be processed out of order, and we'll crash.
-  if (!SendTest2_SecondUrgent())
-    fail("SendTest2_SecondUrgent");
-
-  reentered_ = true;
   return true;
 }
 
 bool
-TestRPCChild::RecvTest2_Msg3()
+TestRPCChild::RecvTest2_SecondUrgent()
 {
-  // Send a CPOW. During this time, we must NOT process the RPC message, as
-  // we could start receiving CPOW replies out-of-order.
-  if (!SendTest2_FirstUrgent())
-    fail("SendTest2_FirstUrgent");
-
-  MOZ_ASSERT(!reentered_);
-  resolved_first_cpow_ = true;
   return true;
 }
 

ipc/ipdl/test/cxx/TestRPC.h

@@ -25,9 +25,7 @@ public:
     bool RecvTest1_Start(uint32_t* aResult) MOZ_OVERRIDE;
     bool RecvTest1_InnerEvent(uint32_t* aResult) MOZ_OVERRIDE;
     bool RecvTest2_Start() MOZ_OVERRIDE;
-    bool RecvTest2_Msg2() MOZ_OVERRIDE;
-    bool RecvTest2_FirstUrgent() MOZ_OVERRIDE;
-    bool RecvTest2_SecondUrgent() MOZ_OVERRIDE;
+    bool RecvTest2_OutOfOrder() MOZ_OVERRIDE;
     bool RecvTest3_Start(uint32_t* aResult) MOZ_OVERRIDE;
     bool RecvTest3_InnerEvent(uint32_t* aResult) MOZ_OVERRIDE;
 
@@ -35,9 +33,17 @@ public:
     {
         if (NormalShutdown != why)
             fail("unexpected destruction!");  
+        if (!reentered_)
+            fail("never processed raced RPC call!");
+        if (!resolved_first_cpow_)
+            fail("never resolved first CPOW!");
         passed("ok");
         QuitParent();
     }
+
+private:
+    bool reentered_;
+    bool resolved_first_cpow_;
 };
 
 
@@ -51,8 +57,8 @@ public:
     bool RecvStart() MOZ_OVERRIDE;
     bool RecvTest1_InnerQuery(uint32_t* aResult) MOZ_OVERRIDE;
     bool RecvTest1_NoReenter(uint32_t* aResult) MOZ_OVERRIDE;
-    bool RecvTest2_Msg1() MOZ_OVERRIDE;
-    bool RecvTest2_Msg3() MOZ_OVERRIDE;
+    bool RecvTest2_FirstUrgent() MOZ_OVERRIDE;
+    bool RecvTest2_SecondUrgent() MOZ_OVERRIDE;
     bool RecvTest3_WakeUp(uint32_t* aResult) MOZ_OVERRIDE;
 
     virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE
@@ -61,10 +67,6 @@ public:
             fail("unexpected destruction!");
         QuitChild();
     }
-
-private:
-    bool reentered_;
-    bool resolved_first_cpow_;
 };
 
 

ipc/ipdl/test/cxx/TestUrgentHangs.cpp

@@ -138,9 +138,9 @@ TestUrgentHangsChild::RecvTest4()
 {
     PR_Sleep(PR_SecondsToInterval(2));
 
-    // This should fail because Test4_1 timed out and hasn't gotten a response
-    // yet.
-    if (SendTestInner())
+    // This won't fail because we should handle Test4_1 here before actually
+    // sending TestInner to the parent.
+    if (!SendTestInner())
         fail("sending TestInner");
 
     return true;

js/src/jit/MIR.cpp

@@ -4124,6 +4124,97 @@ MLoadElement::foldsTo(TempAllocator &alloc)
     return foldsToStoredValue(alloc, store->value());
 }
 
+// Gets the MDefinition* representing the source/target object's storage.
+// Usually this is just an MElements*, but sometimes there are layers
+// of indirection or inlining, which are handled elsewhere.
+static inline const MElements *
+MaybeUnwrapElements(const MDefinition *elementsOrObj)
+{
+    // Sometimes there is a level of indirection for conversion.
+    if (elementsOrObj->isConvertElementsToDoubles())
+        return MaybeUnwrapElements(elementsOrObj->toConvertElementsToDoubles()->elements());
+
+    // For inline elements, the object may be passed directly, for example as MUnbox.
+    if (elementsOrObj->type() == MIRType_Object)
+        return nullptr;
+
+    return elementsOrObj->toElements();
+}
+
+// Gets the MDefinition of the target Object for the given store operation.
+static inline const MDefinition *
+GetStoreObject(const MDefinition *store)
+{
+    switch (store->op()) {
+      case MDefinition::Op_StoreElement: {
+        const MDefinition *elementsOrObj = store->toStoreElement()->elements();
+        const MDefinition *elements = MaybeUnwrapElements(elementsOrObj);
+        if (elements)
+            return elements->toElements()->input();
+
+        MOZ_ASSERT(elementsOrObj->type() == MIRType_Object);
+        return elementsOrObj;
+      }
+
+      case MDefinition::Op_StoreElementHole:
+        return store->toStoreElementHole()->object();
+
+      default:
+        return nullptr;
+    }
+}
+
+// Implements mightAlias() logic common to all load operations.
+static bool
+GenericLoadMightAlias(const MDefinition *elementsOrObj, const MDefinition *store)
+{
+    const MElements *elements = MaybeUnwrapElements(elementsOrObj);
+    if (elements)
+        return elements->mightAlias(store);
+
+    // If MElements couldn't be extracted, then storage must be inline.
+    // Refer to IsValidElementsType().
+    const MDefinition *object = elementsOrObj;
+    MOZ_ASSERT(object->type() == MIRType_Object);
+    if (!object->resultTypeSet())
+        return true;
+
+    const MDefinition *storeObject = GetStoreObject(store);
+    if (!storeObject)
+        return true;
+    if (!storeObject->resultTypeSet())
+        return true;
+
+    return object->resultTypeSet()->objectsIntersect(storeObject->resultTypeSet());
+}
+
+bool
+MElements::mightAlias(const MDefinition *store) const
+{
+    if (!input()->resultTypeSet())
+        return true;
+
+    const MDefinition *storeObj = GetStoreObject(store);
+    if (!storeObj)
+        return true;
+    if (!storeObj->resultTypeSet())
+        return true;
+
+    return input()->resultTypeSet()->objectsIntersect(storeObj->resultTypeSet());
+}
+
+bool
+MLoadElement::mightAlias(const MDefinition *store) const
+{
+    return GenericLoadMightAlias(elements(), store);
+}
+
+bool
+MInitializedLength::mightAlias(const MDefinition *store) const
+{
+    return GenericLoadMightAlias(elements(), store);
+}
+
 bool
 MGuardReceiverPolymorphic::congruentTo(const MDefinition *ins) const
 {

js/src/jit/MIR.h

@@ -7494,6 +7494,7 @@ class MElements
     AliasSet getAliasSet() const MOZ_OVERRIDE {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
+    bool mightAlias(const MDefinition *store) const;
 
     ALLOW_CLONE(MElements)
 };
@@ -7681,6 +7682,7 @@ class MInitializedLength
     AliasSet getAliasSet() const MOZ_OVERRIDE {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
+    bool mightAlias(const MDefinition *store) const;
 
     void computeRange(TempAllocator &alloc) MOZ_OVERRIDE;
 
@@ -8184,6 +8186,7 @@ class MLoadElement
     AliasSet getAliasSet() const MOZ_OVERRIDE {
         return AliasSet::Load(AliasSet::Element);
     }
+    bool mightAlias(const MDefinition *store) const;
 
     ALLOW_CLONE(MLoadElement)
 };

js/src/vm/TypeInference.cpp

@@ -419,6 +419,23 @@ TypeSet::isSubset(const TypeSet *other) const
     return true;
 }
 
+bool
+TypeSet::objectsIntersect(const TypeSet *other) const
+{
+    if (unknownObject() || other->unknownObject())
+        return true;
+
+    for (unsigned i = 0; i < getObjectCount(); i++) {
+        ObjectKey *key = getObject(i);
+        if (!key)
+            continue;
+        if (other->hasType(ObjectType(key)))
+            return true;
+    }
+
+    return false;
+}
+
 template <class TypeListT>
 bool
 TypeSet::enumerateTypes(TypeListT *list) const

js/src/vm/TypeInference.h

@@ -492,6 +492,8 @@ class TypeSet
         return this->isSubset(other) && other->isSubset(this);
     }
 
+    bool objectsIntersect(const TypeSet *other) const;
+
     /* Forward all types in this set to the specified constraint. */
     bool addTypesToConstraint(JSContext *cx, TypeConstraint *constraint);
 

layout/base/FrameLayerBuilder.cpp

@@ -3936,6 +3936,7 @@ ContainerState::Finish(uint32_t* aTextContentFlags, LayerManagerData* aData,
         MOZ_ASSERT(layerState == LAYER_ACTIVE_EMPTY);
         nsRefPtr<Layer> scrollInfoLayer = item->BuildLayer(mBuilder, mManager, mParameters);
         if (!scrollInfoLayer) {
+          item->~nsDisplayScrollInfoLayer();
           continue;
         }
 
@@ -3972,7 +3973,9 @@ ContainerState::Finish(uint32_t* aTextContentFlags, LayerManagerData* aData,
         }
 
         layer = scrollInfoLayer;
+        item->~nsDisplayScrollInfoLayer();
       }
+      mNewChildLayers[i].mScrollInfoItems.Clear();
     }
   }
 

layout/base/nsCSSRendering.cpp

@@ -5195,13 +5195,11 @@ nsImageRenderer::IsAnimatedImage()
 already_AddRefed<mozilla::layers::ImageContainer>
 nsImageRenderer::GetContainer(LayerManager* aManager)
 {
-  if (mType != eStyleImageType_Image || !mImageContainer)
+  if (mType != eStyleImageType_Image || !mImageContainer) {
     return nullptr;
+  }
 
-  nsRefPtr<ImageContainer> container;
-  nsresult rv = mImageContainer->GetImageContainer(aManager, getter_AddRefs(container));
-  NS_ENSURE_SUCCESS(rv, nullptr);
-  return container.forget();
+  return mImageContainer->GetImageContainer(aManager, imgIContainer::FLAG_NONE);
 }
 
 #define MAX_BLUR_RADIUS 300

layout/base/nsDisplayListInvalidation.h

@@ -133,7 +133,8 @@ public:
       return false;
     }
 
-    if (mLastDrawResult == mozilla::image::DrawResult::SUCCESS) {
+    if (mLastDrawResult == mozilla::image::DrawResult::SUCCESS ||
+        mLastDrawResult == mozilla::image::DrawResult::BAD_IMAGE) {
       return false;
     }
 

layout/generic/nsImageFrame.cpp

@@ -1171,6 +1171,28 @@ public:
   nsDisplayAltFeedback(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame)
     : nsDisplayItem(aBuilder, aFrame) {}
 
+  virtual nsDisplayItemGeometry*
+  AllocateGeometry(nsDisplayListBuilder* aBuilder) MOZ_OVERRIDE
+  {
+    return new nsDisplayItemGenericImageGeometry(this, aBuilder);
+  }
+
+  virtual void ComputeInvalidationRegion(nsDisplayListBuilder* aBuilder,
+                                         const nsDisplayItemGeometry* aGeometry,
+                                         nsRegion* aInvalidRegion) MOZ_OVERRIDE
+  {
+    auto geometry =
+      static_cast<const nsDisplayItemGenericImageGeometry*>(aGeometry);
+
+    if (aBuilder->ShouldSyncDecodeImages() &&
+        geometry->ShouldInvalidateToSyncDecodeImages()) {
+      bool snap;
+      aInvalidRegion->Or(*aInvalidRegion, GetBounds(aBuilder, &snap));
+    }
+
+    nsDisplayItem::ComputeInvalidationRegion(aBuilder, aGeometry, aInvalidRegion);
+  }
+
   virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder,
                            bool* aSnap) MOZ_OVERRIDE
   {
@@ -1181,25 +1203,33 @@ public:
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx) MOZ_OVERRIDE
   {
+    // Always sync decode, because these icons are UI, and since they're not
+    // discardable we'll pay the price of sync decoding at most once.
+    uint32_t flags = imgIContainer::FLAG_SYNC_DECODE;
+
     nsImageFrame* f = static_cast<nsImageFrame*>(mFrame);
     EventStates state = f->GetContent()->AsElement()->State();
-    f->DisplayAltFeedback(*aCtx,
-                          mVisibleRect,
-                          IMAGE_OK(state, true)
-                             ? nsImageFrame::gIconLoad->mLoadingImage
-                             : nsImageFrame::gIconLoad->mBrokenImage,
-                          ToReferenceFrame());
+    DrawResult result =
+      f->DisplayAltFeedback(*aCtx,
+                            mVisibleRect,
+                            IMAGE_OK(state, true)
+                               ? nsImageFrame::gIconLoad->mLoadingImage
+                               : nsImageFrame::gIconLoad->mBrokenImage,
+                            ToReferenceFrame(),
+                            flags);
 
+    nsDisplayItemGenericImageGeometry::UpdateDrawResult(this, result);
   }
 
   NS_DISPLAY_DECL_NAME("AltFeedback", TYPE_ALT_FEEDBACK)
 };
 
-void
+DrawResult
 nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
-                                 const nsRect&        aDirtyRect,
-                                 imgIRequest*         aRequest,
-                                 nsPoint              aPt)
+                                 const nsRect& aDirtyRect,
+                                 imgIRequest* aRequest,
+                                 nsPoint aPt,
+                                 uint32_t aFlags)
 {
   // We should definitely have a gIconLoad here.
   MOZ_ASSERT(gIconLoad, "How did we succeed in Init then?");
@@ -1219,7 +1249,7 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
   // Make sure we have enough room to actually render the border within
   // our frame bounds
   if ((inner.width < 2 * borderEdgeWidth) || (inner.height < 2 * borderEdgeWidth)) {
-    return;
+    return DrawResult::SUCCESS;
   }
 
   // Paint the border
@@ -1233,7 +1263,7 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
   inner.Deflate(nsPresContext::CSSPixelsToAppUnits(ICON_PADDING+ALT_BORDER_WIDTH), 
                 nsPresContext::CSSPixelsToAppUnits(ICON_PADDING+ALT_BORDER_WIDTH));
   if (inner.IsEmpty()) {
-    return;
+    return DrawResult::SUCCESS;
   }
 
   DrawTarget* drawTarget = aRenderingContext.GetDrawTarget();
@@ -1244,11 +1274,13 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
   gfx->Clip(NSRectToSnappedRect(inner, PresContext()->AppUnitsPerDevPixel(),
                                 *drawTarget));
 
-  // Check if we should display image placeholders
-  if (gIconLoad->mPrefShowPlaceholders) {
-    nscoord size = nsPresContext::CSSPixelsToAppUnits(ICON_SIZE);
+  DrawResult result = DrawResult::NOT_READY;
 
-    bool iconUsed = false;
+  // Check if we should display image placeholders
+  if (!gIconLoad->mPrefShowPlaceholders) {
+    result = DrawResult::SUCCESS;
+  } else {
+    nscoord size = nsPresContext::CSSPixelsToAppUnits(ICON_SIZE);
 
     // If we weren't previously displaying an icon, register ourselves
     // as an observer for load and animation updates and flag that we're
@@ -1262,7 +1294,7 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
     bool flushRight =
       (!wm.IsVertical() && !wm.IsBidiLTR()) || wm.IsVerticalRL();
 
-    // If the icon in question is loaded and decoded, draw it
+    // If the icon in question is loaded, draw it.
     uint32_t imageStatus = 0;
     if (aRequest)
       aRequest->GetImageStatus(&imageStatus);
@@ -1272,15 +1304,13 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
       MOZ_ASSERT(imgCon, "Load complete, but no image container?");
       nsRect dest(flushRight ? inner.XMost() - size : inner.x,
                   inner.y, size, size);
-      nsLayoutUtils::DrawSingleImage(*gfx, PresContext(), imgCon,
+      result = nsLayoutUtils::DrawSingleImage(*gfx, PresContext(), imgCon,
         nsLayoutUtils::GetGraphicsFilterForFrame(this), dest, aDirtyRect,
-        nullptr, imgIContainer::FLAG_SYNC_DECODE);
-      iconUsed = true;
+        nullptr, aFlags);
     }
 
-    // if we could not draw the icon, flag that we're waiting for it and
-    // just draw some graffiti in the mean time
-    if (!iconUsed) {
+    // If we could not draw the icon, just draw some graffiti in the mean time.
+    if (result == DrawResult::NOT_READY) {
       ColorPattern color(ToDeviceColor(Color(1.f, 0.f, 0.f, 1.f)));
 
       nscoord iconXPos = flushRight ? inner.XMost() - size : inner.x;
@@ -1331,6 +1361,8 @@ nsImageFrame::DisplayAltFeedback(nsRenderingContext& aRenderingContext,
   }
 
   aRenderingContext.ThebesContext()->Restore();
+
+  return result;
 }
 
 #ifdef DEBUG
@@ -1395,9 +1427,11 @@ already_AddRefed<ImageContainer>
 nsDisplayImage::GetContainer(LayerManager* aManager,
                              nsDisplayListBuilder* aBuilder)
 {
-  nsRefPtr<ImageContainer> container;
-  mImage->GetImageContainer(aManager, getter_AddRefs(container));
-  return container.forget();
+  uint32_t flags = aBuilder->ShouldSyncDecodeImages()
+                 ? imgIContainer::FLAG_SYNC_DECODE
+                 : imgIContainer::FLAG_NONE;
+
+  return mImage->GetImageContainer(aManager, flags);
 }
 
 gfxRect
@@ -1457,8 +1491,12 @@ nsDisplayImage::GetLayerState(nsDisplayListBuilder* aBuilder,
     }
   }
 
-  nsRefPtr<ImageContainer> container;
-  mImage->GetImageContainer(aManager, getter_AddRefs(container));
+  uint32_t flags = aBuilder->ShouldSyncDecodeImages()
+                 ? imgIContainer::FLAG_SYNC_DECODE
+                 : imgIContainer::FLAG_NONE;
+
+  nsRefPtr<ImageContainer> container =
+    mImage->GetImageContainer(aManager, flags);
   if (!container) {
     return LAYER_NONE;
   }
@@ -1502,9 +1540,15 @@ nsDisplayImage::BuildLayer(nsDisplayListBuilder* aBuilder,
                            LayerManager* aManager,
                            const ContainerLayerParameters& aParameters)
 {
-  nsRefPtr<ImageContainer> container;
-  nsresult rv = mImage->GetImageContainer(aManager, getter_AddRefs(container));
-  NS_ENSURE_SUCCESS(rv, nullptr);
+  uint32_t flags = aBuilder->ShouldSyncDecodeImages()
+                 ? imgIContainer::FLAG_SYNC_DECODE
+                 : imgIContainer::FLAG_NONE;
+
+  nsRefPtr<ImageContainer> container =
+    mImage->GetImageContainer(aManager, flags);
+  if (!container) {
+    return nullptr;
+  }
 
   nsRefPtr<ImageLayer> layer = static_cast<ImageLayer*>
     (aManager->GetLayerBuilder()->GetLeafLayerFor(aBuilder, this));

layout/generic/nsImageFrame.h

@@ -143,10 +143,11 @@ public:
   static bool ShouldCreateImageFrameFor(mozilla::dom::Element* aElement,
                                           nsStyleContext* aStyleContext);
   
-  void DisplayAltFeedback(nsRenderingContext& aRenderingContext,
-                          const nsRect&        aDirtyRect,
-                          imgIRequest*         aRequest,
-                          nsPoint              aPt);
+  DrawResult DisplayAltFeedback(nsRenderingContext& aRenderingContext,
+                                const nsRect& aDirtyRect,
+                                imgIRequest* aRequest,
+                                nsPoint aPt,
+                                uint32_t aFlags);
 
   nsRect GetInnerArea() const;
 

layout/xul/nsImageBoxFrame.cpp

@@ -433,13 +433,18 @@ nsDisplayXULImage::ConfigureLayer(ImageLayer* aLayer, const nsIntPoint& aOffset)
 }
 
 already_AddRefed<ImageContainer>
-nsDisplayXULImage::GetContainer(LayerManager* aManager, nsDisplayListBuilder* aBuilder)
+nsDisplayXULImage::GetContainer(LayerManager* aManager,
+                                nsDisplayListBuilder* aBuilder)
 {
-  return static_cast<nsImageBoxFrame*>(mFrame)->GetContainer(aManager);
+  uint32_t flags = aBuilder->ShouldSyncDecodeImages()
+                 ? imgIContainer::FLAG_SYNC_DECODE
+                 : imgIContainer::FLAG_NONE;
+
+  return static_cast<nsImageBoxFrame*>(mFrame)->GetContainer(aManager, flags);
 }
 
 already_AddRefed<ImageContainer>
-nsImageBoxFrame::GetContainer(LayerManager* aManager)
+nsImageBoxFrame::GetContainer(LayerManager* aManager, uint32_t aFlags)
 {
   bool hasSubRect = !mUseSrcAttr && (mSubRect.width > 0 || mSubRect.height > 0);
   if (hasSubRect || !mImageRequest) {
@@ -452,9 +457,7 @@ nsImageBoxFrame::GetContainer(LayerManager* aManager)
     return nullptr;
   }
   
-  nsRefPtr<ImageContainer> container;
-  imgCon->GetImageContainer(aManager, getter_AddRefs(container));
-  return container.forget();
+  return imgCon->GetImageContainer(aManager, aFlags);
 }
 
 

layout/xul/nsImageBoxFrame.h

@@ -41,6 +41,7 @@ class nsImageBoxFrame MOZ_FINAL : public nsLeafBoxFrame
 {
 public:
   typedef mozilla::image::DrawResult DrawResult;
+  typedef mozilla::layers::ImageContainer ImageContainer;
   typedef mozilla::layers::LayerManager LayerManager;
 
   friend class nsDisplayXULImage;
@@ -95,7 +96,9 @@ public:
                         const nsRect& aDirtyRect,
                         nsPoint aPt, uint32_t aFlags);
 
-  already_AddRefed<mozilla::layers::ImageContainer> GetContainer(LayerManager* aManager);
+  already_AddRefed<ImageContainer> GetContainer(LayerManager* aManager,
+                                                uint32_t aFlags);
+
 protected:
   explicit nsImageBoxFrame(nsStyleContext* aContext);
 

media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp

@@ -1789,8 +1789,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
                 }
                 duration = ntohl(duration32);
             }
-            if (duration) {
-              mFileMetaData->setInt64(kKeyMovieDuration, duration * 1000LL);
+            if (duration && mHeaderTimescale) {
+                mFileMetaData->setInt64(
+                        kKeyMovieDuration, (duration * 1000000) / mHeaderTimescale);
             }
 
             *offset += chunk_size;

media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp

@@ -26,9 +26,11 @@
 #include "nsNetCID.h"
 #include "nsNetUtil.h"
 #include "nsICancelable.h"
+#include "nsIDocument.h"
+#include "nsILoadInfo.h"
+#include "nsIContentPolicy.h"
 #include "nsIProxyInfo.h"
 #include "nsIProtocolProxyService.h"
-#include "nsIIOService.h"
 
 #ifdef MOZILLA_INTERNAL_API
 #include "MediaStreamList.h"
@@ -227,15 +229,14 @@ PeerConnectionMedia::PeerConnectionMedia(PeerConnectionImpl *parent)
     return;
   }
 
-  nsCOMPtr<nsIIOService> ios = do_GetIOService(&rv);
-  if (NS_FAILED(rv)) {
-    CSFLogError(logTag, "%s: Failed to get IOService: %d",
-                __FUNCTION__, (int)rv);
-    return;
-  }
-
   nsCOMPtr<nsIChannel> channel;
-  rv = ios->NewChannelFromURI(fakeHttpsLocation, getter_AddRefs(channel));
+  nsCOMPtr<nsIDocument> doc = mParent->GetWindow()->GetExtantDoc();
+  rv = NS_NewChannel(getter_AddRefs(channel),
+                     fakeHttpsLocation,
+                     doc,
+                     nsILoadInfo::SEC_NORMAL,
+                     nsIContentPolicy::TYPE_OTHER);
+
   if (NS_FAILED(rv)) {
     CSFLogError(logTag, "%s: Failed to get channel from URI: %d",
                 __FUNCTION__, (int)rv);

mfbt/Pair.h

@@ -166,6 +166,18 @@ public:
 
   Pair(const Pair& aOther) = default;
 
+  Pair& operator=(Pair&& aOther)
+  {
+    MOZ_ASSERT(this != &aOther, "Self-moves are prohibited");
+
+    first() = Move(aOther.first());
+    second() = Move(aOther.second());
+
+    return *this;
+  }
+
+  Pair& operator=(const Pair& aOther) = default;
+
   /** The A instance. */
   using Base::first;
   /** The B instance. */

mfbt/tests/TestPair.cpp

@@ -75,5 +75,9 @@ main()
   static_assert(IsSame<decltype(MakePair(constA, constB)), Pair<A, B>>::value,
                 "MakePair should strip CV-qualifiers");
 
+  // Check that copy assignment and move assignment work.
+  a = constA;
+  a = A(0);
+
   return 0;
 }

mobile/android/app/mobile.js

@@ -566,6 +566,7 @@ pref("media.fragmented-mp4.android-media-codec.enabled", true);
 pref("media.fragmented-mp4.android-media-codec.preferred", true);
 
 // optimize images memory usage
+pref("image.downscale-during-decode.enabled", true);
 pref("image.mem.decodeondraw", true);
 
 #ifdef NIGHTLY_BUILD

modules/libpref/init/all.js

@@ -427,10 +427,10 @@ pref("media.getusermedia.screensharing.enabled", true);
 #endif
 
 #ifdef RELEASE_BUILD
-pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com");
+pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com");
 #else
  // temporary value, not intended for release - bug 1049087
-pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,collaborate.com,*.collaborate.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com");
+pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com");
 #endif
 // OS/X 10.6 and XP have screen/window sharing off by default due to various issues - Caveat emptor
 pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
@@ -3001,7 +3001,7 @@ pref("intl.keyboard.per_window_layout", false);
 
 #ifdef NS_ENABLE_TSF
 // Enable/Disable TSF support on Vista or later.
-#ifdef NIGHTLY_BUILD
+#ifndef RELEASE_BUILD
 pref("intl.tsf.enable", true);
 #else
 pref("intl.tsf.enable", false);
@@ -3819,7 +3819,7 @@ pref("image.cache.size", 5242880);
 pref("image.cache.timeweight", 500);
 
 // Whether we attempt to downscale images during decoding.
-pref("image.downscale-during-decode.enabled", false);
+pref("image.downscale-during-decode.enabled", true);
 
 // The default Accept header sent for images loaded over HTTP(S)
 pref("image.http.accept", "image/png,image/*;q=0.8,*/*;q=0.5");
@@ -4628,14 +4628,10 @@ pref("media.gmp.insecure.allow", false);
 
 // Use vsync aligned rendering. b2g prefs are in b2g.js
 // Only supported on windows, os x, and b2g
-#if defined(XP_MACOSX)
+#if defined(XP_MACOSX) || defined(XP_WIN)
 pref("gfx.vsync.hw-vsync.enabled", true);
 pref("gfx.vsync.compositor", true);
 pref("gfx.vsync.refreshdriver", false);
-#elif defined(XP_WIN)
-pref("gfx.vsync.hw-vsync.enabled", false);
-pref("gfx.vsync.compositor", false);
-pref("gfx.vsync.refreshdriver", false);
 #endif
 
 // Secure Element API

netwerk/protocol/http/nsHttpChannel.cpp

@@ -3149,6 +3149,10 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
             mRedirectedCachekeys->AppendElement(cacheKey);
     }
 
+    if (doValidation && mInterceptCache == INTERCEPTED) {
+        doValidation = false;
+    }
+
     mCachedContentIsValid = !doValidation;
 
     if (doValidation) {

testing/web-platform/meta/media-source/mediasource-addsourcebuffer.html.ini

@@ -1,20 +1,12 @@
 [mediasource-addsourcebuffer.html]
   type: testharness
-  [Test addSourceBuffer() with Vorbis and VP8]
-    expected: FAIL
-
-  [Test addSourceBuffer() with Vorbis and VP8 in separate SourceBuffers]
-    expected: FAIL
-
   [Test addSourceBuffer() with AAC and H.264]
-    expected: FAIL
+    expected:
+      if os == "linux": FAIL
+      if (os == "win") and (version == "5.1.2600"): FAIL
 
   [Test addSourceBuffer() with AAC and H.264 in separate SourceBuffers]
-    expected: FAIL
-
-  [Test addSourceBuffer() video only]
-    expected: FAIL
-
-  [Test addSourceBuffer() audio only]
-    expected: FAIL
+    expected:
+      if os == "linux": FAIL
+      if (os == "win") and (version == "5.1.2600"): FAIL
 

testing/web-platform/meta/media-source/mediasource-append-buffer.html.ini

@@ -1,21 +1,5 @@
 [mediasource-append-buffer.html]
   type: testharness
   disabled:
-    if (os == "win") and (version != "5.1.2600"): https://bugzilla.mozilla.org/show_bug.cgi?id=1128332
-  [Test MediaSource.removeSourceBuffer() call during a pending appendBuffer().]
-    expected: FAIL
-
-  [Test appendBuffer with partial init segments.]
-    expected:
-      if (os == "win") and (version != "5.1.2600"): FAIL
-      if os == "mac": FAIL
-
-  [Test appendBuffer with partial media segments.]
-    expected:
-      if (os == "win") and (version != "5.1.2600"): FAIL
-      if os == "mac": FAIL
-
-  [Test abort in the middle of an initialization segment.]
-    disabled:
-      if (os == "win") and (version != "5.1.2600"): https://bugzilla.mozilla.org/show_bug.cgi?id=1128332
-
+    if (os == "win") and (version != "5.1.2600"): https://bugzilla.mozilla.org/show_bug.cgi?id=1143650
+    if os == "mac": https://bugzilla.mozilla.org/show_bug.cgi?id=1143650

testing/web-platform/meta/media-source/mediasource-buffered.html.ini

@@ -1,7 +1,9 @@
 [mediasource-buffered.html]
   type: testharness
   [Demuxed content with different lengths]
-    expected: FAIL
+    expected:
+      if os == "linux": FAIL
+      if (os == "win") and (version == "5.1.2600"): FAIL
 
   [Muxed tracks with different lengths]
     expected: FAIL

testing/web-platform/meta/media-source/mediasource-config-change-mp4-av-audio-bitrate.html.ini

@@ -1,5 +1,7 @@
 [mediasource-config-change-mp4-av-audio-bitrate.html]
   type: testharness
   [Tests mp4 audio bitrate changes in multiplexed content.]
-    expected: FAIL
+    expected:
+      if os == "linux": FAIL
+      if (os == "win") and (version == "5.1.2600"): FAIL