Merge trunk into HTML5 repo

.hgtags

@@ -31,3 +31,4 @@ d7d64f68423b68a671f623f123e90057ebc49dac UPDATE_PACKAGING_R7
 fb32f6e1859c07846a01b4478a7b1678019e0b45 UPDATE_PACKAGING_R7
 f817a4378f32b1ad0a7c4b5a9949586dba816da5 FENNEC_M11
 5c1e7c779b6edc8ff912001990edc579f80597f4 FENNEC_B1
+fe9cc55b8db7f56f7e68a246acba363743854979 UPDATE_PACKAGING_R8

accessible/tests/mochitest/test_events_mutation.html

@@ -53,15 +53,31 @@
       this.doNotExpectEvents = aDoNotExpectEvents;
       this.eventSeq = [];
 
+      /**
+       * Change default target (aNodeOrID) registered for the given event type.
+       */
       this.setTarget = function mutateA11yTree_setTarget(aEventType, aTarget)
       {
         var type = this.getA11yEventType(aEventType);
         for (var idx = 0; idx < this.eventSeq.length; idx++) {
           if (this.eventSeq[idx][0] == type) {
             this.eventSeq[idx][1] = aTarget;
-            break;
+            return idx;
           }
         }
+        return -1;
+      }
+
+      /**
+       * Replace the default target currently registered for a given event type
+       * with the nodes in the targets array.
+       */
+      this.setTargets = function mutateA11yTree_setTargets(aEventType, aTargets) {
+        var targetIdx = this.setTarget(aEventType, aTargets[0]);
+
+        var type = this.getA11yEventType(aEventType);
+        for (var i = 1; i < aTargets.length; i++)
+          this.eventSeq.splice(++targetIdx, 0, [type, aTargets[i]]);
       }
 
       // Implementation
@@ -140,7 +156,7 @@
      * Clone the node and append it to its parent.
      */
     function cloneAndAppendToDOM(aNodeOrID, aEventTypes,
-                                 aTargetFunc, aReorderTargetFunc)
+                                 aTargetsFunc, aReorderTargetFunc)
     {
       var eventTypes = aEventTypes || kShowEvents;
       var doNotExpectEvents = (aEventTypes == kNoEvents);
@@ -153,12 +169,12 @@
         var newElm = this.DOMNode.cloneNode(true);
         newElm.removeAttribute('id');
 
-        var target = this.mTargetFunc ?
-          this.mTargetFunc.call(null, newElm) : newElm;          
-        this.setTarget(kShowEvent, target);
+        var targets = aTargetsFunc ?
+          aTargetsFunc.call(null, newElm) : [newElm];
+        this.setTargets(kShowEvent, targets);
 
-        if (this.mReorderTargetFunc) {
-          var reorderTarget = this.mReorderTargetFunc.call(null, this.DOMNode);
+        if (aReorderTargetFunc) {
+          var reorderTarget = aReorderTargetFunc.call(null, this.DOMNode);
           this.setTarget(kReorderEvent, reorderTarget);
         }
 
@@ -169,16 +185,13 @@
       {
         return aNodeOrID + " clone and append to DOM.";
       }
-
-      this.mTargetFunc = aTargetFunc;
-      this.mReorderTargetFunc = aReorderTargetFunc;
     }
 
     /**
      * Removes the node from DOM.
      */
     function removeFromDOM(aNodeOrID, aEventTypes,
-                           aTargetFunc, aReorderTargetFunc)
+                           aTargetsFunc, aReorderTargetFunc)
     {
       var eventTypes = aEventTypes || kHideEvents;
       var doNotExpectEvents = (aEventTypes == kNoEvents);
@@ -196,8 +209,8 @@
         return aNodeOrID + " remove from DOM.";
       }
 
-      if (aTargetFunc && (eventTypes & kHideEvent))
-        this.setTarget(kHideEvent, aTargetFunc.call(null, this.DOMNode));
+      if (aTargetsFunc && (eventTypes & kHideEvent))
+        this.setTargets(kHideEvent, aTargetsFunc.call(null, this.DOMNode));
 
       if (aReorderTargetFunc && (eventTypes & kReorderEvent))
         this.setTarget(kReorderEvent,
@@ -226,8 +239,38 @@
       }
     }
 
-    function getFirstChild(aNode) { return aNode.firstChild; }
-    function getParent(aNode) { return aNode.parentNode; }
+    /**
+     * Target getters.
+     */
+    function getFirstChild(aNode)
+    {
+      return [aNode.firstChild];
+    }
+
+    function getNEnsureFirstChild(aNode)
+    {
+      var node = aNode.firstChild;
+      getAccessible(node);
+      return [node];
+    }
+
+    function getNEnsureChildren(aNode)
+    {
+      var children = [];
+      var node = aNode.firstChild;
+      do {
+        children.push(node);
+        getAccessible(node);
+        node = node.nextSibling;
+      } while (node);
+
+      return children;
+    }
+
+    function getParent(aNode)
+    {
+      return aNode.parentNode;
+    }
 
     /**
      * Do tests.
@@ -289,8 +332,15 @@
       gQueue.push(new cloneAndAppendToDOM(id, kShowEvents, getFirstChild,
                                           getParent));
 
-      // XXX: bug 475503, there is no hide event
-      gQueue.push(new removeFromDOM(id, kReorderEvent, getFirstChild, getParent));
+      // Hide event for accessible child of unaccessible removed DOM node and
+      // reorder event for its parent.
+      gQueue.push(new removeFromDOM(id, kHideEvents,
+                                    getNEnsureFirstChild, getParent));
+
+      // Hide events for accessible children of unaccessible removed DOM node
+      // and reorder event for its parent.
+      gQueue.push(new removeFromDOM("child4", kHideEvents,
+                                    getNEnsureChildren, getParent));
 
       // Show/hide events by creating new accessible DOM node and replacing
       // old one.
@@ -343,6 +393,7 @@
       <span id="child1"></span>
       <span id="child2" role="listitem"></span>
       <span id="child3"><span role="listitem"></span></span>
+      <span id="child4"><span role="listitem"></span><span role="listitem"></span></span>
     </div>
 
     <a id="link6" href="http://www.google.com">Link #6</a>

browser/base/content/baseMenuOverlay.xul

@@ -115,7 +115,7 @@
     <keyset id="baseMenuKeyset">
 #ifdef XP_MACOSX
         <key id="key_openHelpMac"
-             oncommand="openHelpLink('firefox-help');"
+             oncommand="openHelpLink('firefox-osxkey');"
              key="&helpMac.commandkey;"
              modifiers="accel"/>
 <!-- These are used to build the Application menu under Cocoa widgets -->
@@ -130,7 +130,7 @@
              modifiers="accel,alt"/>
 #else
         <key id="key_openHelp"
-            oncommand="openHelpLink('firefox-help');"
+            oncommand="openHelpLink('firefox-f1');"
             keycode="&openHelp.commandkey;"/>
 #endif
     </keyset>

browser/base/content/browser.js

@@ -2155,7 +2155,7 @@ function URLBarSetURI(aURI, aValid) {
   var value = gBrowser.userTypedValue;
   var valid = false;
 
-  if (!value) {
+  if (value == null) {
     let uri = aURI || getWebNavigation().currentURI;
 
     // Replace initial page URIs with an empty string
@@ -2165,7 +2165,8 @@ function URLBarSetURI(aURI, aValid) {
     else
       value = losslessDecodeURI(uri);
 
-    valid = value && (!aURI || aValid);
+    let isBlank = (uri.spec == "about:blank");
+    valid = !isBlank && (!aURI || aValid);
   }
 
   gURLBar.value = value;

browser/base/content/test/Makefile.in

@@ -116,6 +116,7 @@ _BROWSER_FILES = browser_sanitize-timespans.js \
                  browser_sanitizeDialog.js \
                  browser_tabs_owner.js \
                  browser_bug491431.js \
+                 browser_bug304198.js \
     $(NULL)
 
 ifeq (,$(filter mac cocoa,$(MOZ_WIDGET_TOOLKIT)))

browser/base/content/test/browser_bug304198.js

@@ -0,0 +1,109 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is bug 491431 test.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jon Herron <leftturnsolutions@yahoo.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function test() {
+  waitForExplicitFinish();
+
+  let deletedURLTab, fullURLTab, partialURLTab, testPartialURL, testURL;
+
+  deletedURLTab = gBrowser.addTab();
+  fullURLTab = gBrowser.addTab();
+  partialURLTab = gBrowser.addTab();
+  testPartialURL = "http://example.org/brow";
+  testURL = "http://example.org/browser/browser/base/content/test/dummy_page.html";
+
+  function cleanUp() {
+
+    gBrowser.removeTab(fullURLTab);
+    gBrowser.removeTab(partialURLTab);
+    gBrowser.removeTab(deletedURLTab);
+  }
+
+  // function borrowed from browser_bug386835.js
+  function load(tab, url, cb) {
+    tab.linkedBrowser.addEventListener("load", function (event) {
+      event.currentTarget.removeEventListener("load", arguments.callee, true);
+      cb();
+    }, true);
+    tab.linkedBrowser.loadURI(url);
+  }
+
+  function runTests() {
+    gBrowser.selectedTab = fullURLTab;
+    is(gURLBar.value, testURL, 'gURLBar.value should be testURL after initial switch to fullURLTab');
+
+    gBrowser.selectedTab = partialURLTab;
+    is(gURLBar.value, testURL, 'gURLBar.value should be testURL after initial switch to partialURLTab');
+
+    // simulate the user removing part of the url from the location bar
+    gBrowser.userTypedValue = testPartialURL;
+    URLBarSetURI();
+    is(gURLBar.value, testPartialURL, 'gURLBar.value should be testPartialURL (just set)');
+
+    gBrowser.selectedTab = deletedURLTab;
+    is(gURLBar.value, testURL, 'gURLBar.value should be testURL after initial switch to deletedURLTab');
+
+    // simulate the user removing the whole url from the location bar
+    gBrowser.userTypedValue = '';
+    URLBarSetURI();
+    is(gURLBar.value, '', 'gURLBar.value should be "" (just set)');
+
+    // now cycle the tabs and make sure everything looks good
+    gBrowser.selectedTab = fullURLTab;
+    is(gURLBar.value, testURL, 'gURLBar.value should be testURL after switching back to fullURLTab');
+
+    gBrowser.selectedTab = partialURLTab;
+    is(gURLBar.value, testPartialURL, 'gURLBar.value should be testPartialURL after switching back to partialURLTab');
+
+    gBrowser.selectedTab = deletedURLTab;
+    is(gURLBar.value, '', 'gURLBar.value should be "" after switching back to deletedURLTab');
+
+    gBrowser.selectedTab = fullURLTab;
+    is(gURLBar.value, testURL, 'gURLBar.value should be testURL after switching back to fullURLTab');
+  }
+
+  load(deletedURLTab, testURL, function() {
+    load(fullURLTab, testURL, function() {
+      load(partialURLTab, testURL, function() {
+        runTests();
+        cleanUp();
+        finish();
+      });
+    });
+  });
+}
+

browser/components/places/tests/browser/Makefile.in

@@ -58,6 +58,7 @@ _BROWSER_TEST_FILES = \
 	browser_bookmarksProperties.js \
 	browser_forgetthissite_single.js \
 	browser_library_left_pane_commands.js \
+	browser_drag_bookmarks_on_toolbar.js \
 	$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)

browser/components/places/tests/browser/browser_drag_bookmarks_on_toolbar.js

@@ -0,0 +1,264 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Places test.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Marco Bonardo <mak77@bonardo.net>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+const TEST_URL = "http://www.mozilla.org";
+const TEST_TITLE = "example_title";
+
+var gBookmarksToolbar = window.document.getElementById("bookmarksBarContent");
+var dragDirections = { LEFT: 0, UP: 1, RIGHT: 2, DOWN: 3 };
+
+/**
+ * Tests dragging on toolbar.
+ *
+ * We must test these 2 cases:
+ *   - Dragging toward left, top, right should start a drag.
+ *   - Dragging toward down should should open the container if the item is a
+ *     container, drag the item otherwise.
+ *
+ * @param aElement
+ *        DOM node element we will drag
+ * @param aExpectedDragData
+ *        Array of flavors and values in the form:
+ *        [ ["text/plain: sometext", "text/html: <b>sometext</b>"], [...] ]
+ *        Pass an empty array to check that drag even has been canceled.
+ * @param aDirection
+ *        Direction for the dragging gesture, see dragDirections helper object.
+ */
+function synthesizeDragWithDirection(aElement, aExpectedDragData, aDirection) {
+  var trapped = false;
+
+  // Dragstart listener function.
+  var trapDrag = function(event) {
+    trapped = true;
+    var dataTransfer = event.dataTransfer;
+    is(dataTransfer.mozItemCount, aExpectedDragData.length,
+       "Number of dragged items should be the same.");
+
+    for (var t = 0; t < dataTransfer.mozItemCount; t++) {
+      var types = dataTransfer.mozTypesAt(t);
+      var expecteditem = aExpectedDragData[t];
+      is(types.length, expecteditem.length,
+        "Number of flavors for item " + t + " should be the same.");
+
+      for (var f = 0; f < types.length; f++) {
+        is(types[f], expecteditem[f].substring(0, types[f].length),
+           "Flavor " + types[f] + " for item " + t + " should be the same.");
+        is(dataTransfer.mozGetDataAt(types[f], t),
+           expecteditem[f].substring(types[f].length + 2),
+           "Contents for item " + t + " with flavor " + types[f] + " should be the same.");
+      }
+    }
+
+    if (!aExpectedDragData.length)
+      ok(event.getPreventDefault(), "Drag has been canceled.");
+
+    event.preventDefault();
+    event.stopPropagation();
+  }
+
+  var xIncrement = 0;
+  var yIncrement = 0;
+
+  switch (aDirection) {
+    case dragDirections.LEFT:
+      xIncrement = -1;
+      break;
+    case dragDirections.RIGHT:
+      xIncrement = +1;
+      break;
+    case dragDirections.UP:
+      yIncrement = -1;
+      break;
+    case dragDirections.DOWN:
+      yIncrement = +1;
+      break;
+  }
+
+  var rect = aElement.getBoundingClientRect();
+  var startingPoint = { x: (rect.right - rect.left)/2,
+                        y: (rect.bottom - rect.top)/2 };
+
+  EventUtils.synthesizeMouse(aElement,
+                             startingPoint.x,
+                             startingPoint.y,
+                             { type: "mousedown" });
+  EventUtils.synthesizeMouse(aElement,
+                             startingPoint.x + xIncrement * 1,
+                             startingPoint.y + yIncrement * 1,
+                             { type: "mousemove" });
+  gBookmarksToolbar.addEventListener("dragstart", trapDrag, false);
+  EventUtils.synthesizeMouse(aElement,
+                             startingPoint.x + xIncrement * 8,
+                             startingPoint.y + yIncrement * 8,
+                             { type: "mousemove" });
+  ok(trapped, "A dragstart event has been trapped.");
+  gBookmarksToolbar.removeEventListener("dragstart", trapDrag, false);
+  EventUtils.synthesizeMouse(aElement,
+                             startingPoint.x + xIncrement * 8,
+                             startingPoint.y + yIncrement * 8,
+                             { type: "mouseup" });
+
+  // Cleanup eventually opened menus.
+  if (aElement.localName == "menu" && aElement.open)
+    aElement.open = false;
+}
+
+function getToolbarNodeForItemId(aItemId) {
+  var children = gBookmarksToolbar.childNodes;
+  var node = null;
+  for (var i = 0; i < children.length; i++) {
+    if (aItemId == children[i].node.itemId) {
+      node = children[i];
+      break;
+    }
+  }
+  return node;
+}
+
+function getExpectedDataForPlacesNode(aNode) {
+  var wrappedNode = [];
+  var flavors = ["text/x-moz-place",
+                 "text/x-moz-url",
+                 "text/plain",
+                 "text/html"];
+
+  flavors.forEach(function(aFlavor) {
+    var wrappedFlavor = aFlavor + ": " +
+                        PlacesUtils.wrapNode(aNode, aFlavor);
+    wrappedNode.push(wrappedFlavor);
+  });
+
+  return [wrappedNode];
+}
+
+var gTests = [
+
+//------------------------------------------------------------------------------
+
+  {
+    desc: "Drag a folder on toolbar",
+    run: function() {
+      // Create a test folder to be dragged.
+      var folderId = PlacesUtils.bookmarks
+                                .createFolder(PlacesUtils.toolbarFolderId,
+                                              TEST_TITLE,
+                                              PlacesUtils.bookmarks.DEFAULT_INDEX);
+      var element = getToolbarNodeForItemId(folderId);
+      isnot(element, null, "Found node on toolbar");
+
+      isnot(element.node, null, "Toolbar node has an associated Places node.");
+      var expectedData = getExpectedDataForPlacesNode(element.node);
+
+      ok(true, "Dragging left");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.LEFT);
+      ok(true, "Dragging right");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.RIGHT);
+      ok(true, "Dragging up");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.UP);
+      ok(true, "Dragging down");
+      synthesizeDragWithDirection(element, new Array(), dragDirections.DOWN);
+
+      // Cleanup.
+      PlacesUtils.bookmarks.removeItem(folderId);
+    }
+  },
+
+//------------------------------------------------------------------------------
+
+  {
+    desc: "Drag a bookmark on toolbar",
+    run: function() {
+      //XXX bug 496266: this test causes a page navigation to the bookmark, which in
+      // turn causes a history visit to be added for the page, which messes up
+      // subsequent tests, so disable it for now
+      return;
+
+      // Create a test bookmark to be dragged.
+      var itemId = PlacesUtils.bookmarks
+                              .insertBookmark(PlacesUtils.toolbarFolderId,
+                                              PlacesUtils._uri(TEST_URL),
+                                              PlacesUtils.bookmarks.DEFAULT_INDEX,
+                                              TEST_TITLE);
+      var element = getToolbarNodeForItemId(itemId);
+      isnot(element, null, "Found node on toolbar");
+
+      isnot(element.node, null, "Toolbar node has an associated Places node.");
+      var expectedData = getExpectedDataForPlacesNode(element.node);
+
+      ok(true, "Dragging left");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.LEFT);
+      ok(true, "Dragging right");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.RIGHT);
+      ok(true, "Dragging up");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.UP);
+      ok(true, "Dragging down");
+      synthesizeDragWithDirection(element, expectedData, dragDirections.DOWN);
+
+      // Cleanup.
+      PlacesUtils.bookmarks.removeItem(itemId);
+    }
+  },
+];
+
+function nextTest() {
+  if (gTests.length) {
+    var test = gTests.shift();
+    dump("TEST: " + test.desc + "\n");
+    ok(true, "TEST: " + test.desc);
+    test.run();
+
+    setTimeout(nextTest, 0);
+  }
+  else
+    finish();
+}
+
+function test() {
+  var osString = Cc["@mozilla.org/xre/app-info;1"].
+                 getService(Ci.nsIXULRuntime).OS;
+
+  // XXX bug 496277: this test fails on linux for some reason
+  if (osString == "Linux") {
+    finish();
+    return;
+  }
+
+  waitForExplicitFinish();
+
+  nextTest();
+}
+

browser/components/preferences/privacy.xul

@@ -151,11 +151,11 @@
               <description>&rememberDescription.label;</description>
               <separator/>
               <description>&rememberActions.pre.label;<html:a
-                class="inline-link"
-                onclick="gPrivacyPane.clearPrivateDataNow(false);"
+                class="inline-link" href="#"
+                onclick="gPrivacyPane.clearPrivateDataNow(false); return false;"
               >&rememberActions.clearHistory.label;</html:a>&rememberActions.middle.label;<html:a
-                class="inline-link"
-                onclick="gPrivacyPane.showCookies();"
+                class="inline-link" href="#"
+                onclick="gPrivacyPane.showCookies(); return false;"
               >&rememberActions.removeCookies.label;</html:a>&rememberActions.post.label;</description>
             </vbox>
             <spacer flex="1" class="indent"/>
@@ -168,8 +168,8 @@
               <description>&dontrememberDescription.label;</description>
               <separator/>
               <description>&dontrememberActions.pre.label;<html:a
-                class="inline-link"
-                onclick="gPrivacyPane.clearPrivateDataNow(true);"
+                class="inline-link" href="#"
+                onclick="gPrivacyPane.clearPrivateDataNow(true); return false;"
               >&dontrememberActions.clearHistory.label;</html:a>&dontrememberActions.post.label;</description>
             </vbox>
             <spacer flex="1" class="indent"/>

browser/components/sessionstore/src/nsSessionStore.js

@@ -98,9 +98,13 @@ const WINDOW_HIDEABLE_FEATURES = [
 docShell capabilities to (re)store
 Restored in restoreHistory()
 eg: browser.docShell["allow" + aCapability] = false;
+
+XXX keep these in sync with all the attributes starting
+    with "allow" in /docshell/base/nsIDocShell.idl
 */
 const CAPABILITIES = [
-  "Subframes", "Plugins", "Javascript", "MetaRedirects", "Images"
+  "Subframes", "Plugins", "Javascript", "MetaRedirects", "Images",
+  "DNSPrefetch", "Auth"
 ];
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
@@ -1290,8 +1294,18 @@ SessionStoreService.prototype = {
 
       let storage, storageItemCount = 0;
       try {
-        storage = aDocShell.getSessionStorageForURI(uri);
-        storageItemCount = storage.length;
+        var principal = Cc["@mozilla.org/scriptsecuritymanager;1"].
+                        getService(Ci.nsIScriptSecurityManager).
+                        getCodebasePrincipal(uri);
+
+        // Using getSessionStorageForPrincipal instead of getSessionStorageForURI
+        // just to be able to pass aCreate = false, that avoids creation of the
+        // sessionStorage object for the page earlier than the page really
+        // requires it. It was causing problems while accessing a storage when
+        // a page later changed its domain.
+        storage = aDocShell.getSessionStorageForPrincipal(principal, false);
+        if (storage)
+          storageItemCount = storage.length;
       }
       catch (ex) { /* sessionStorage might throw if it's turned off, see bug 458954 */ }
       if (storageItemCount == 0)

browser/components/sessionstore/test/browser/Makefile.in

@@ -87,6 +87,7 @@ _BROWSER_TEST_FILES = \
 	browser_485482_sample.html \
 	browser_485563.js \
 	browser_490040.js \
+	browser_493467.js \
 	$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)

browser/components/sessionstore/test/browser/browser_493467.js

@@ -0,0 +1,68 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is sessionstore test code.
+ *
+ * The Initial Developer of the Original Code is
+ * Simon Bünzli <zeniko@gmail.com>.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function test() {
+  /** Test for Bug 493467 **/
+  
+  let ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
+  
+  let tab = gBrowser.addTab();
+  let tabState = JSON.parse(ss.getTabState(tab));
+  is(tabState.disallow || "", "", "Everything is allowed per default");
+  
+  // collect all permissions that can be set on a docShell (i.e. all
+  // attributes starting with "allow" such as "allowJavascript") and
+  // disallow them all, as SessionStore only remembers disallowed ones
+  let permissions = [];
+  let docShell = tab.linkedBrowser.docShell;
+  for (let attribute in docShell) {
+    if (/^allow([A-Z].*)/.test(attribute)) {
+      permissions.push(RegExp.$1);
+      docShell[attribute] = false;
+    }
+  }
+  
+  // make sure that all available permissions have been remembered
+  tabState = JSON.parse(ss.getTabState(tab));
+  let disallow = tabState.disallow.split(",");
+  permissions.forEach(function(aName) {
+    ok(disallow.indexOf(aName) > -1, "Saved state of allow" + aName);
+  });
+  // IF A TEST FAILS, please add the missing permission's name (without the
+  // leading "allow") to nsSessionStore.js's CAPABILITIES array. Thanks.
+  
+  gBrowser.removeTab(tab);
+}

browser/themes/gnomestripe/browser/preferences/preferences.css

@@ -88,12 +88,10 @@ radio[pane=paneAdvanced] {
 .inline-link {
   color: -moz-nativehyperlinktext;
   text-decoration: underline;
-  outline: 1px solid transparent;
-  cursor: pointer;
 }
   
-.inline-link:focus, .inline-link:hover:active {
-  color: red;
+.inline-link:not(:focus) {
+  outline: 1px dotted transparent;
 }
 
 /* Modeless Window Dialogs */

browser/themes/pinstripe/browser/browser.css

@@ -368,7 +368,7 @@ toolbar[mode="icons"] #forward-button .toolbarbutton-text-box,
 /* ----- DEFAULT BACK/FORWARD BUTTONS ----- */
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button {
-  -moz-image-region: rect(0px, 539px, 33px, 504px);
+  -moz-image-region: rect(0px, 535px, 33px, 504px);
   -moz-margin-end: 0;
   -moz-padding-end: 0;
   border-left: none;
@@ -376,29 +376,29 @@ toolbar[mode="icons"] #unified-back-forward-button > #back-button {
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 582px, 33px, 547px);
+  -moz-image-region: rect(0px, 571px, 33px, 540px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button[disabled="true"] {
- -moz-image-region: rect(33px, 539px, 66px, 504px);
+ -moz-image-region: rect(33px, 535px, 66px, 504px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button[disabled="true"][chromedir="rtl"] {
-  -moz-image-region: rect(33px, 582px, 66px, 547px);
+  -moz-image-region: rect(33px, 571px, 66px, 540px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button:hover:active:not([disabled]),
 toolbar[mode="icons"] #unified-back-forward-button > #back-button[open="true"] {
-  -moz-image-region: rect(66px, 539px, 99px, 504px);
+  -moz-image-region: rect(66px, 535px, 99px, 504px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #back-button:hover:active[chromedir="rtl"]:not([disabled]),
 toolbar[mode="icons"] #unified-back-forward-button > #back-button[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(66px, 582px, 99px, 547px);
+  -moz-image-region: rect(66px, 571px, 99px, 540px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button {
-  -moz-image-region: rect(0px, 566px, 33px, 539px);
+  -moz-image-region: rect(0px, 560px, 33px, 535px);
   -moz-margin-start: 0;
   -moz-margin-end: 0;
   -moz-padding-start: 0;
@@ -408,29 +408,30 @@ toolbar[mode="icons"] #unified-back-forward-button > #forward-button {
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 547px, 33px, 519px);
+  -moz-image-region: rect(0px, 540px, 33px, 514px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[disabled="true"] {
- -moz-image-region: rect(33px, 566px, 66px, 539px);
+ -moz-image-region: rect(33px, 560px, 66px, 535px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[disabled="true"][chromedir="rtl"] {
- -moz-image-region: rect(33px, 547px, 66px, 519px);
+ -moz-image-region: rect(33px, 540px, 66px, 514px);
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button:hover:active:not([disabled]),
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[open="true"] {
-  -moz-image-region: rect(66px, 566px, 99px, 539px);
+  -moz-image-region: rect(99px, 560px, 132px, 530px);
+  -moz-margin-start: -5px;
 }
 
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[chromedir="rtl"]:hover:active:not([disabled]),
 toolbar[mode="icons"] #unified-back-forward-button > #forward-button[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(66px, 547px, 99px, 519px);
+  -moz-image-region: rect(99px, 545px, 132px, 514px);
 }
 
 #back-forward-dropmarker {
-  -moz-image-region: rect(0px, 582px, 33px, 566px);
+  -moz-image-region: rect(0px, 571px, 33px, 560px);
   -moz-margin-start: 0;
   -moz-margin-end: 3px;
   -moz-padding-start: 0;
@@ -440,7 +441,7 @@ toolbar[mode="icons"] #unified-back-forward-button > #forward-button[open="true"
 }
 
 #back-forward-dropmarker[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 519px, 33px, 504px);
+  -moz-image-region: rect(0px, 514px, 33px, 504px);
 }
 
 toolbar[mode="icons"] #back-forward-dropmarker > image {
@@ -454,21 +455,21 @@ toolbar[mode="icons"] #back-forward-dropmarker > dropmarker {
 }
 
 #back-forward-dropmarker[disabled="true"] {
- -moz-image-region: rect(33px, 582px, 66px, 566px);
+ -moz-image-region: rect(33px, 571px, 66px, 560px);
 }
 
 #back-forward-dropmarker[disabled="true"][chromedir="rtl"] {
- -moz-image-region: rect(33px, 519px, 66px, 504px);
+ -moz-image-region: rect(33px, 514px, 66px, 504px);
 }
 
 #back-forward-dropmarker:hover:active:not([disabled]),
 #back-forward-dropmarker[open="true"] {
-  -moz-image-region: rect(66px, 582px, 99px, 566px);
+  -moz-image-region: rect(66px, 571px, 99px, 560px);
 }
 
 #back-forward-dropmarker[chromedir="rtl"]:hover:active:not([disabled]),
 #back-forward-dropmarker[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(66px, 519px, 99px, 504px);
+  -moz-image-region: rect(66px, 514px, 99px, 504px);
 }
 
 .unified-nav-back[_moz-menuactive],
@@ -485,7 +486,7 @@ menupopup[chromedir="rtl"] > .unified-nav-back[_moz-menuactive] {
 /* ----- SMALL BACK BUTTON, PAIRED----- */	
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button {
-  -moz-image-region: rect(0px, 616px, 23px, 582px);
+  -moz-image-region: rect(0px, 605px, 23px, 571px);
   -moz-margin-end: 0;
   -moz-padding-end: 0;
   border-left: none;
@@ -493,31 +494,31 @@ toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-but
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 664px, 23px, 630px);
+  -moz-image-region: rect(0px, 648px, 23px, 614px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[disabled="true"] {
-  -moz-image-region: rect(23px, 616px, 46px, 582px);
+  -moz-image-region: rect(23px, 605px, 46px, 571px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[disabled="true"][chromedir="rtl"] {
-  -moz-image-region: rect(23px, 664px, 46px, 630px);
+  -moz-image-region: rect(23px, 648px, 46px, 614px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button:hover:active:not([disabled]),
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[open="true"] {
-  -moz-image-region: rect(46px, 616px, 69px, 582px);
+  -moz-image-region: rect(46px, 605px, 69px, 571px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[chromedir="rtl"]:hover:active:not([disabled]),
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #back-button[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(46px, 664px, 69px, 630px);
+  -moz-image-region: rect(46px, 648px, 69px, 614px);
 }
 
 /* ----- SMALL FORWARD BUTTON, PAIRED ----- */	
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button {
-  -moz-image-region: rect(0px, 649px, 23px, 616px);
+  -moz-image-region: rect(0px, 638px, 23px, 605px);
   -moz-margin-start: 0;
   -moz-padding-start: 0;
   border-left: none;
@@ -525,53 +526,54 @@ toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 630px, 23px, 597px);
+  -moz-image-region: rect(0px, 614px, 23px, 580px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[disabled="true"] {
- -moz-image-region: rect(23px, 649px, 46px, 616px);
+ -moz-image-region: rect(23px, 638px, 46px, 605px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[disabled="true"][chromedir="rtl"] {
- -moz-image-region: rect(23px, 630px, 46px, 597px);
+ -moz-image-region: rect(23px, 614px, 46px, 580px);
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button:hover:active:not([disabled]),
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[open="true"] {
-  -moz-image-region: rect(46px, 649px, 69px, 616px);
+  -moz-image-region: rect(46px, 638px, 69px, 605px);
+  -moz-margin-start: 0;
 }
 
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[chromedir="rtl"]:hover:active:not([disabled]),
 toolbar[mode="icons"][iconsize="small"] #unified-back-forward-button > #forward-button[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(46px, 630px, 69px, 597px);
+  -moz-image-region: rect(46px, 614px, 69px, 580px);
 }
 
 /* ----- SMALL BACK/FORWARD DROPMARKER ----- */	
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker {
-  -moz-image-region: rect(0px, 664px, 23px, 649px);
+  -moz-image-region: rect(0px, 648px, 23px, 638px);
 }
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[chromedir="rtl"] {
-  -moz-image-region: rect(0px, 596px, 23px, 582px);
+  -moz-image-region: rect(0px, 580px, 23px, 571px);
 }
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[disabled="true"] {
- -moz-image-region: rect(23px, 664px, 46px, 649px);
+ -moz-image-region: rect(23px, 648px, 46px, 638px);
 }
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[disabled="true"][chromedir="rtl"] {
- -moz-image-region: rect(23px, 596px, 46px, 582px);
+ -moz-image-region: rect(23px, 580px, 46px, 571px);
 }
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker:hover:active:not([disabled]),
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[open="true"] {
-  -moz-image-region: rect(46px, 664px, 69px, 649px);
+  -moz-image-region: rect(46px, 648px, 69px, 638px);
 }
 
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[chromedir="rtl"]:hover:active:not([disabled]),
 toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarker[open="true"][chromedir="rtl"] {
-  -moz-image-region: rect(46px, 596px, 69px, 582px);
+  -moz-image-region: rect(46px, 580px, 69px, 571px);
 }
 
 /* ----- DEFAULT RELOAD BUTTON ----- */	
@@ -826,8 +828,18 @@ toolbar[iconsize="small"] #unified-back-forward-button > #back-forward-dropmarke
 }
 
 #urlbar-search-splitter {
-  min-width: 4px;
-  width: 4px;
+  /* This is a bit of a mess, because the location bar and the search bar are bigger
+     than they look. For example, -moz-margin-start: -6px should really be -4px.
+     Bug 482086 and bug 482105 will solve this. */
+  min-width: 8px;
+  width: 8px;
+  background-image: none;
+  -moz-margin-start: -6px;
+}
+
+#urlbar-search-splitter + #urlbar-container > #urlbar,
+#urlbar-search-splitter + #search-container > #searchbar > .searchbar-textbox {
+  -moz-margin-start: 0;
 }
 
 #wrapper-urlbar-container #urlbar,
@@ -1648,65 +1660,45 @@ tabbrowser > tabbox > tabpanels {
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up,
+.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down {
+  -moz-image-region: rect(0, 11px, 17px, 0);
+  margin: 0;
+  padding: 0 1px;
+  border: none;
+}
+
+.tabbrowser-arrowscrollbox > .scrollbutton-up[chromedir="ltr"],
 .tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[chromedir="rtl"] {
-  border: 0;
   border-right: 2px solid;
   -moz-border-right-colors: rgba(0,0,0,0.25) rgba(255,255,255,0.15);
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-start.png");
-  -moz-image-region: rect(0px, 7px, 11px, 0px);
-  padding: 0;
-  width: 16px;
-  margin: 0;
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-left.png");
 }
 
-.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[chromedir="rtl"] {
-  -moz-border-end: none;
+.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[chromedir="ltr"],
+.tabbrowser-arrowscrollbox > .scrollbutton-up[chromedir="rtl"] {
+  border-left: 2px solid;
+  -moz-border-left-colors: rgba(0,0,0,0.25) rgba(255,255,255,0.15);
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-right.png");
 }
 
-.tabbrowser-arrowscrollbox > .scrollbutton-up:hover {
+.tabbrowser-arrowscrollbox > .scrollbutton-up:hover,
+.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down:hover {
+  -moz-image-region: rect(0, 22px, 17px, 11px);
   background-color: rgba(0,0,0,0.10);
 }
 
-.tabbrowser-arrowscrollbox > .scrollbutton-up:hover:active {
+.tabbrowser-arrowscrollbox > .scrollbutton-up:hover:active,
+.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down:hover:active {
+  -moz-image-region: rect(0, 44px, 17px, 33px);
   background-color: rgba(0,0,0,0.20);
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up[disabled="true"],
-.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[disabled="true"][chromedir="rtl"] {
-  -moz-image-region: rect(0px, 28px, 11px, 21px);
+.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[disabled="true"] {
+  -moz-image-region: rect(0, 33px, 17px, 22px) !important;
   background-color: transparent !important; 
 }
 
-.tabbrowser-arrowscrollbox .scrollbutton-down,
-.tabbrowser-arrowscrollbox > .scrollbutton-up[chromedir="rtl"] {
-  border-left: 2px solid;
-  -moz-border-left-colors: rgba(0,0,0,0.25) rgba(255,255,255,0.15);
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-end.png");
-  -moz-image-region: rect(0px, 44px, 11px, 37px);
-  -moz-padding-start: 2px;
-  -moz-padding-end: 0;
-  width: 16px;
-  margin: 0;
-}
-
-.tabbrowser-arrowscrollbox > .scrollbutton-up[chromedir="rtl"] {
-  -moz-border-start: none;
-}
-
-.tabbrowser-arrowscrollbox .scrollbutton-down:hover {
-  background-color: rgba(0,0,0,0.10);
-}
-
-.tabbrowser-arrowscrollbox .scrollbutton-down:hover:active {
-  background-color: rgba(0,0,0,0.20);
-}
-
-.tabbrowser-arrowscrollbox > .scrollbutton-down-stack > .scrollbutton-down[disabled="true"],
-.tabbrowser-arrowscrollbox > .scrollbutton-up[disabled="true"][chromedir="rtl"] {
-  -moz-image-region: rect(0px, 23px, 11px, 16px);
-  background-color: transparent !important;
-}
-
 
 /**
  * Tabstrip New Tab & All Tabs Buttons
@@ -1719,14 +1711,31 @@ tabbrowser > tabbox > tabpanels {
   -moz-border-left-colors: rgba(0,0,0,0.25) rgba(255,255,255,0.15);
   -moz-border-right-colors: rgba(0,0,0,0.25) rgba(255,255,255,0.15);
   margin: 0;
-  padding: 0 4px;
+  padding: 0;
+}
+.tabs-newtab-button > .toolbarbutton-icon,
+.tabs-alltabs-button > .toolbarbutton-icon {
+  padding: 0;
 }
 .tabs-newtab-button {
   list-style-image: url(chrome://browser/skin/tabbrowser/newtab.png);
+  -moz-image-region: rect(0, 18px, 20px, 0);
+}
+.tabs-newtab-button:hover {
+  -moz-image-region: rect(0, 36px, 20px, 18px);
+}
+.tabs-newtab-button:hover:active {
+  -moz-image-region: rect(0, 54px, 20px, 36px);
 }
 .tabs-alltabs-button {
-  padding-top: 2px;
   list-style-image: url(chrome://browser/skin/tabbrowser/alltabs-box-bkgnd-icon.png);
+  -moz-image-region: rect(0, 22px, 20px, 0);
+}
+.tabs-alltabs-button:hover {
+  -moz-image-region: rect(0, 44px, 20px, 22px);
+}
+.tabs-alltabs-button:hover:active {
+  -moz-image-region: rect(0, 66px, 20px, 44px);
 }
 .tabs-container > .tabs-newtab-button:hover,
 .tabs-alltabs-button:hover {

browser/themes/pinstripe/browser/jar.mn

@@ -116,8 +116,8 @@ classic.jar:
   skin/classic/browser/tabbrowser/alltabs-box-bkgnd-icon.png             (tabbrowser/alltabs-box-bkgnd-icon.png)
   skin/classic/browser/tabbrowser/alltabs-box-overflow-bkgnd-animate.png (tabbrowser/alltabs-box-overflow-bkgnd-animate.png)
   skin/classic/browser/tabbrowser/newtab.png                             (tabbrowser/newtab.png)
-  skin/classic/browser/tabbrowser/tab-arrow-start.png                    (tabbrowser/tab-arrow-start.png)
-  skin/classic/browser/tabbrowser/tab-arrow-end.png                      (tabbrowser/tab-arrow-end.png)
+  skin/classic/browser/tabbrowser/tab-arrow-left.png                     (tabbrowser/tab-arrow-left.png)
+  skin/classic/browser/tabbrowser/tab-arrow-right.png                    (tabbrowser/tab-arrow-right.png)
   skin/classic/browser/tabbrowser/tabbrowser-tabs-bkgnd.png              (tabbrowser/tabbrowser-tabs-bkgnd.png)
   skin/classic/browser/tabbrowser/tabDragIndicator.png                   (tabbrowser/tabDragIndicator.png)
   skin/classic/browser/tabbrowser/tab-bkgnd.png                          (tabbrowser/tab-bkgnd.png)

browser/themes/pinstripe/browser/places/organizer.css

@@ -396,63 +396,6 @@
   list-style-image: url("chrome://browser/skin/places/minus-active.png") !important;
 }
 
-menulist {
-  -moz-appearance: none;
-  margin: 0px 3px 0px 5px !important;
-  padding: 2px 0px 2px 0px;
-  background: url("chrome://global/skin/icons/round-button-leftcap.png") no-repeat center left;
-}
-
-menulist:active,
-menulist[open="true"]  {
- background: url("chrome://global/skin/icons/round-button-active-leftcap.png") no-repeat center left !important;
-}
-  
-.menulist-label-box {
-  -moz-appearance: none;
-  margin: 0px 0px 0px 8px !important;
-  padding: 2px 0 2px 0px;
-  background: url("chrome://global/skin/icons/round-button-dropmarker.png") no-repeat center right;
-  border: none;
-}
-menulist:active > .menulist-label-box,
-menulist[open="true"] > .menulist-label-box {
-  background: url("chrome://global/skin/icons/round-button-active-dropmarker.png") no-repeat center right !important;
-}
-
-.menulist-label {
-  -moz-appearance: none;
-  margin: 0px 14px 0px 0px !important;
-  padding: 2px 0px 2px 0px;
-  background: url("chrome://global/skin/icons/round-button-middle.png") repeat-x center left;
-  border: none;
-}
-menulist:active > .menulist-label-box .menulist-label,
-menulist[open="true"] > .menulist-label-box  .menulist-label {
-  background: url("chrome://global/skin/icons/round-button-active-middle.png") repeat-x center left !important;
-}
-
-#editBMPanel_namePicker {
-  background: none !important;
-  margin: 0px !important;
-  padding:  0px !important;
-}
-#editBMPanel_namePicker[droppable="false"] > .menulist-editable-box {
-  -moz-appearance: textfield;
-  cursor: text;
-  margin: 4px 4px;
-  border: 3px solid;
-  -moz-border-top-colors: transparent #888888 #000000;
-  -moz-border-right-colors: transparent #FFFFFF #000000;
-  -moz-border-bottom-colors: transparent #FFFFFF #000000;
-  -moz-border-left-colors: transparent #888888 #000000;
-  -moz-border-radius-topright: 2px;
-  -moz-border-radius-bottomleft: 2px;
-  padding: 0;
-  background-color: -moz-Field;
-  color: -moz-FieldText;
-}
-
 #saveSearch {
   -moz-appearance: none;
   margin: 0;

browser/themes/pinstripe/browser/preferences/preferences.css

@@ -255,11 +255,10 @@ caption {
 .inline-link {
   color: -moz-nativehyperlinktext;
   text-decoration: underline;
-  cursor: pointer;
 }
   
-.inline-link:focus, .inline-link:hover:active {
-  color: red;
+.inline-link:not(:focus) {
+  outline: 1px dotted transparent;
 }
 
 /**

browser/themes/winstripe/browser/browser-aero.css

@@ -73,3 +73,26 @@
   color: black;
   text-shadow: white -1px -1px .5em, white -1px 1px .5em, white 1px 1px .5em, white 1px -1px .5em;
 }
+
+/* ::::: fullscreen window controls ::::: */
+
+#window-controls {
+  -moz-box-align: start;
+}
+
+#minimize-button,
+#restore-button,
+#close-button {
+  -moz-appearance: none;
+  border-style: none;
+  margin: 0;
+}
+#close-button {
+  -moz-image-region: rect(0, 49px, 16px, 32px);
+}
+#close-button:hover {
+  -moz-image-region: rect(16px, 49px, 32px, 32px);
+}
+#close-button:hover:active {
+  -moz-image-region: rect(32px, 49px, 48px, 32px);
+}

browser/themes/winstripe/browser/browser.css

@@ -1010,21 +1010,42 @@ toolbar[iconsize="small"] #paste-button:not([disabled="true"]):hover:active {
 
 /* ::::: fullscreen window controls ::::: */
 
-#window-controls {
-  -moz-box-align: start;
+#minimize-button,
+#restore-button,
+#close-button {
+  list-style-image: url("chrome://global/skin/icons/windowControls.png");
   padding: 0;
-  border-left: 2px solid;
-  -moz-border-left-colors: ThreeDHighlight ThreeDShadow;
 }
 
 #minimize-button {
-  list-style-image: url("chrome://global/skin/icons/Minimize.gif");
+  -moz-image-region: rect(0, 16px, 16px, 0);
+}
+#minimize-button:hover {
+  -moz-image-region: rect(16px, 16px, 32px, 0);
+}
+#minimize-button:hover:active {
+  -moz-image-region: rect(32px, 16px, 48px, 0);
 }
 #restore-button {
-  list-style-image: url("chrome://global/skin/icons/Restore.gif");
+  -moz-image-region: rect(0, 32px, 16px, 16px);
+}
+#restore-button:hover {
+  -moz-image-region: rect(16px, 32px, 32px, 16px);
+}
+#restore-button:hover:active {
+  -moz-image-region: rect(32px, 32px, 48px, 16px);
 }
 #close-button {
-  list-style-image: url("chrome://global/skin/icons/Close.gif");
+  -moz-image-region: rect(0, 48px, 16px, 32px);
+  -moz-appearance: none;
+  border-style: none;
+  margin: 2px;
+}
+#close-button:hover {
+  -moz-image-region: rect(16px, 48px, 32px, 32px);
+}
+#close-button:hover:active {
+  -moz-image-region: rect(32px, 48px, 48px, 32px);
 }
 
 /* ::::: nav-bar-inner ::::: */
@@ -1471,9 +1492,14 @@ tabpanels {
   background-image: url("chrome://browser/skin/tabbrowser/tab-hover-bkgnd.png");
 }
 
+.tabbrowser-arrowscrollbox > .scrollbutton-up,
+.tabbrowser-arrowscrollbox > .scrollbutton-down {
+  -moz-image-region: rect(0, 15px, 17px, 0);
+}
+
 .tabbrowser-arrowscrollbox > .scrollbutton-up:not([disabled="true"]):hover,
 .tabbrowser-arrowscrollbox > .scrollbutton-down:not([disabled="true"]):hover {
-  -moz-image-region: rect(0, 22px, 14px, 11px);
+  -moz-image-region: rect(0, 30px, 17px, 15px);
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up[disabled="true"],
@@ -1483,12 +1509,12 @@ tabpanels {
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up:not([disabled="true"]):hover:active,
 .tabbrowser-arrowscrollbox > .scrollbutton-down:not([disabled="true"]):hover:active {
-  -moz-image-region: rect(0, 44px, 14px, 33px);
+  -moz-image-region: rect(0, 45px, 17px, 30px);
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up {
   border-left-style: none;
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-start.png");
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-left.png");
   -moz-border-radius-topright: 2px;
 }
 
@@ -1497,11 +1523,7 @@ tabpanels {
   border-right-style: none;
   -moz-border-radius-topleft: 2px;
   -moz-border-radius-topright: 0px;
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-end.png");
-}
-
-.tabbrowser-arrowscrollbox > .scrollbutton-up > .toolbarbutton-icon {    
-  margin: 5px 0px 1px 0px;
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-right.png");
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-down,
@@ -1512,7 +1534,7 @@ tabpanels {
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-down {
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-end.png");
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-right.png");
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-down[chromedir="rtl"],
@@ -1525,30 +1547,25 @@ tabpanels {
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-down[chromedir="rtl"] {
-  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-start.png");
-}
-
-.tabbrowser-arrowscrollbox > .scrollbutton-down > .toolbarbutton-icon {
-  margin-top: 5px;
-  margin-bottom: 1px;
-  -moz-margin-end: 2px;
+  list-style-image: url("chrome://browser/skin/tabbrowser/tab-arrow-left.png");
 }
 
 .tabs-newtab-button {
   opacity: .8;
+  list-style-image: url(chrome://browser/skin/tabbrowser/newtab.png);
+  -moz-image-region: rect(0, 18px, 18px, 0);
+}
+
+.tabs-newtab-button:hover:active {
+  -moz-image-region: rect(0, 36px, 18px, 18px);
 }
 
 .tabbrowser-arrowscrollbox > .tabs-newtab-button {
-  width: 32px;
+  width: 31px;
   -moz-border-radius-topright: 2px;
   -moz-border-radius-topleft: 2px;
 }
 
-.tabs-newtab-button > .toolbarbutton-icon {
-  list-style-image: url(chrome://browser/skin/tabbrowser/newtab.png);
-  margin: 3px 0 0;
-}
-
 .tabs-alltabs-button > .toolbarbutton-text {
   display: none;
 }
@@ -1655,10 +1672,12 @@ toolbar[mode="text"] > #window-controls > toolbarbutton > .toolbarbutton-text {
 /* Location bar dropmarker */
 #urlbar > .autocomplete-history-dropmarker {
   -moz-appearance: none;
-  padding: 0;
+  padding: 0 1px;
   background-color: transparent;
   border: none;
   width: auto;
+  list-style-image: url(mainwindow-dropdown-arrow.png);
+  -moz-image-region: rect(0, 13px, 11px, 0);
 }
 
 #urlbar > .autocomplete-history-dropmarker:hover ,
@@ -1669,10 +1688,7 @@ toolbar[mode="text"] > #window-controls > toolbarbutton > .toolbarbutton-text {
 #urlbar > .autocomplete-history-dropmarker:hover:active,
 #urlbar > .autocomplete-history-dropmarker[open="true"] {
   background-position: 0 -120px !important;
-}
-
-#urlbar > .autocomplete-history-dropmarker > .dropmarker-icon {
-  margin: 0 5px;
+  -moz-image-region: rect(0, 26px, 11px, 13px);
 }
 
 #urlbar[chromedir="ltr"] > .autocomplete-history-dropmarker {

browser/themes/winstripe/browser/jar.mn

@@ -14,6 +14,7 @@ classic.jar:
         skin/classic/browser/Info.png                                (Info.png)
         skin/classic/browser/identity.png                            (identity.png)
         skin/classic/browser/KUI-background.png
+        skin/classic/browser/mainwindow-dropdown-arrow.png
         skin/classic/browser/pageInfo.css
         skin/classic/browser/pageInfo.png                            (pageInfo.png)
         skin/classic/browser/page-livemarks.png                      (feeds/feedIcon16.png)
@@ -80,8 +81,8 @@ classic.jar:
         skin/classic/browser/tabbrowser/alltabs-box-overflow-end-bkgnd-animate.png        (tabbrowser/alltabs-box-overflow-end-bkgnd-animate.png)
         skin/classic/browser/tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png      (tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png)
         skin/classic/browser/tabbrowser/newtab.png                              (tabbrowser/newtab.png)
-        skin/classic/browser/tabbrowser/tab-arrow-end.png                       (tabbrowser/tab-arrow-end.png)
-        skin/classic/browser/tabbrowser/tab-arrow-start.png                     (tabbrowser/tab-arrow-start.png)
+        skin/classic/browser/tabbrowser/tab-arrow-left.png                      (tabbrowser/tab-arrow-left.png)
+        skin/classic/browser/tabbrowser/tab-arrow-right.png                     (tabbrowser/tab-arrow-right.png)
         skin/classic/browser/tabbrowser/tabbrowser-tabs-bkgnd.png               (tabbrowser/tabbrowser-tabs-bkgnd.png)
         skin/classic/browser/tabbrowser/tabDragIndicator.png                    (tabbrowser/tabDragIndicator.png)
         skin/classic/browser/tabbrowser/tab-bkgnd.png                           (tabbrowser/tab-bkgnd.png)
@@ -105,6 +106,7 @@ classic.jar:
         skin/classic/aero/browser/Info.png                           (Info-aero.png)
         skin/classic/aero/browser/identity.png                       (identity-aero.png)
         skin/classic/aero/browser/KUI-background.png
+        skin/classic/aero/browser/mainwindow-dropdown-arrow.png      (mainwindow-dropdown-arrow-aero.png)
         skin/classic/aero/browser/pageInfo.css
         skin/classic/aero/browser/pageInfo.png                       (pageInfo-aero.png)
         skin/classic/aero/browser/page-livemarks.png                 (feeds/feedIcon16-aero.png)
@@ -173,8 +175,8 @@ classic.jar:
         skin/classic/aero/browser/tabbrowser/alltabs-box-overflow-end-bkgnd-animate.png   (tabbrowser/alltabs-box-overflow-end-bkgnd-animate.png)
         skin/classic/aero/browser/tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png (tabbrowser/alltabs-box-overflow-start-bkgnd-animate.png)
         skin/classic/aero/browser/tabbrowser/newtab.png                         (tabbrowser/newtab-aero.png)
-        skin/classic/aero/browser/tabbrowser/tab-arrow-end.png                  (tabbrowser/tab-arrow-end-aero.png)
-        skin/classic/aero/browser/tabbrowser/tab-arrow-start.png                (tabbrowser/tab-arrow-start-aero.png)
+        skin/classic/aero/browser/tabbrowser/tab-arrow-left.png                 (tabbrowser/tab-arrow-left-aero.png)
+        skin/classic/aero/browser/tabbrowser/tab-arrow-right.png                (tabbrowser/tab-arrow-right-aero.png)
         skin/classic/aero/browser/tabbrowser/tabbrowser-tabs-bkgnd.png          (tabbrowser/tabbrowser-tabs-bkgnd.png)
         skin/classic/aero/browser/tabbrowser/tabDragIndicator.png               (tabbrowser/tabDragIndicator-aero.png)
         skin/classic/aero/browser/tabbrowser/tab-bkgnd.png                      (tabbrowser/tab-bkgnd.png)

browser/themes/winstripe/browser/preferences/preferences.css

@@ -115,11 +115,10 @@ radio[pane=paneAdvanced][selected="true"] {
 .inline-link {
   color: -moz-nativehyperlinktext;
   text-decoration: underline;
-  cursor: pointer;
 }
-  
-.inline-link:focus, .inline-link:hover:active {
-  color: red;
+
+.inline-link:not(:focus) {
+  outline: 1px dotted transparent;
 }
 
 /* Modeless Window Dialogs */

browser/themes/winstripe/browser/searchbar.css

@@ -61,11 +61,10 @@
 .searchbar-engine-button > .button-box {
   -moz-appearance: none;
   padding: 0;
-  -moz-padding-end: 3px;
   border: 0;
 }
 
-.searchbar-engine-button[addengines="true"] > .button-box {
+.searchbar-engine-button[addengines="true"]:not([open="true"]) > .button-box {
   background: transparent url(chrome://browser/skin/Search-addengines.png) no-repeat right center;
 }
 
@@ -74,10 +73,15 @@
 }
 
 .searchbar-dropmarker-image {
-  list-style-image: url("chrome://global/skin/arrow/arrow-dn.gif");
-  -moz-margin-start: 3px;
+  list-style-image: url(mainwindow-dropdown-arrow.png);
+  -moz-image-region: rect(0, 13px, 11px, 0);
 }
 
+.searchbar-engine-button[open="true"] > .searchbar-dropmarker-image {
+  -moz-image-region: rect(0, 26px, 11px, 13px);
+}
+
+
 /* ::::: search-go-button ::::: */
 
 .search-go-container {

config/Makefile.in

@@ -166,9 +166,9 @@ check-python-modules::
 	done
 
 check-jar-mn::
-	make -C tests/src-simple check-jar
-	make -C tests/src-simple check-flat
-	make -C tests/src-simple check-flat USE_EXTENSION_MANIFEST=1
+	$(MAKE) -C tests/src-simple check-jar
+	$(MAKE) -C tests/src-simple check-flat
+	$(MAKE) -C tests/src-simple check-flat USE_EXTENSION_MANIFEST=1
 ifneq (,$(filter-out WINNT OS2,$(OS_ARCH)))
-	make -C tests/src-simple check-symlink
+	$(MAKE) -C tests/src-simple check-symlink
 endif

config/tests/src-simple/Makefile.in

@@ -57,7 +57,7 @@ REF_MANIFEST = $(if $(USE_EXTENSION_MANIFEST),chrome.manifest,test.manifest)
 
 check-%::
 	if test -d $(FINAL_TARGET); then rm -rf $(FINAL_TARGET); fi;
-	make realchrome MOZ_CHROME_FILE_FORMAT=$*
+	$(MAKE) realchrome MOZ_CHROME_FILE_FORMAT=$*
 	@echo "Comparing manifests..."
 	@if ! sort $(MY_MANIFEST) | diff --text -U 0 $(srcdir)/../$(REF_MANIFEST).$* - ; then \
 	  echo "TEST-UNEXPECTED-FAIL | config/tests/$(REF_MANIFEST).$* | differing content in manifest!" ; \

content/base/crashtests/494810-1.html

@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.domain = "[";
+  window.sessionStorage;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>

content/base/crashtests/crashtests.list

@@ -48,3 +48,4 @@ load 472593-1.html
 load 474041-1.svg
 load 483818-1.html
 load 490760-1.xhtml
+load 494810-1.html

content/base/src/nsAttrValue.cpp

@@ -393,8 +393,10 @@ nsAttrValue::ToString(nsAString& aResult) const
         PR_snprintf(buf, sizeof(buf), "#%02x%02x%02x",
                     NS_GET_R(v), NS_GET_G(v), NS_GET_B(v));
         CopyASCIItoUTF16(buf, aResult);
+      } else if (v == NS_RGBA(0,0,0,0)) {
+        aResult.AssignLiteral("transparent");
       } else {
-        NS_NOTREACHED("non-opaque color attribute cannot be stringified");
+        NS_NOTREACHED("translucent color attribute cannot be stringified");
         aResult.Truncate();
       }
       break;

content/html/content/src/nsHTMLMediaElement.cpp

@@ -1138,15 +1138,6 @@ void nsHTMLMediaElement::InitMediaTypes()
                                  PR_FALSE, PR_TRUE, nsnull);
       }
     }
-#endif
-#ifdef MOZ_WAVE
-    if (IsWaveEnabled()) {
-      for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(gWaveTypes); i++) {
-        catMan->AddCategoryEntry("Gecko-Content-Viewers", gWaveTypes[i],
-                                 "@mozilla.org/content/document-loader-factory;1",
-                                 PR_FALSE, PR_TRUE, nsnull);
-      }
-    }
 #endif
   }
 }

content/html/document/crashtests/495543.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script type="text/javascript">
+
+function boom()
+{
+  var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  document.documentElement.appendChild(htmlBody);
+  htmlBody.setAttribute('vlink', "transparent");
+  document.height;
+  document.vlinkColor;
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>

content/html/document/crashtests/crashtests.list

@@ -8,3 +8,4 @@ load 448564.html
 load 468562-1.html
 load 468562-2.html
 load 494225.html
+load 495543.svg

content/html/document/src/nsHTMLDocument.cpp

@@ -2477,8 +2477,10 @@ LegacyRGBToHex(nscolor aColor, nsAString& aResult)
     PR_snprintf(buf, sizeof(buf), "#%02x%02x%02x",
                 NS_GET_R(aColor), NS_GET_G(aColor), NS_GET_B(aColor));
     CopyASCIItoUTF16(buf, aResult);
+  } else if (aColor == NS_RGBA(0,0,0,0)) {
+    aResult.AssignLiteral("transparent");
   } else {
-    NS_NOTREACHED("non-opaque color property cannot be stringified");
+    NS_NOTREACHED("translucent color property cannot be stringified");
     aResult.Truncate();
   }
 }

content/media/video/public/nsOggDecoder.h

@@ -443,6 +443,10 @@ protected:
   // thread.
   void SeekingStopped();
 
+  // Seeking has stopped at the end of the resource. Inform the element on the main
+  // thread.
+  void SeekingStoppedAtEnd();
+
   // Seeking has started. Inform the element on the main
   // thread.
   void SeekingStarted();

content/media/video/src/nsAudioStream.cpp

@@ -242,10 +242,13 @@ float nsAudioStream::GetPosition()
   if (!mAudioHandle)
     return -1.0;
 
+  sa_position_t positionType = SA_POSITION_WRITE_SOFTWARE;
+#if defined(XP_WIN)
+  positionType = SA_POSITION_WRITE_HARDWARE;
+#endif
   PRInt64 position = 0;
   if (sa_stream_get_position(static_cast<sa_stream_t*>(mAudioHandle),
-                             SA_POSITION_WRITE_SOFTWARE,
-                             &position) == SA_SUCCESS) {
+                             positionType, &position) == SA_SUCCESS) {
     return (position / float(mRate) / mChannels / sizeof(short));
   }
 

content/media/video/src/nsOggDecoder.cpp

@@ -301,6 +301,11 @@ public:
   // E_OGGPLAY_TIMEOUT        = No frames decoded, timed out
   OggPlayErrorCode DecodeFrame();
 
+  // Handle any errors returned by liboggplay when decoding a frame.
+  // Since this function can change the decoding state it must be called
+  // with the decoder lock held.
+  void HandleDecodeErrors(OggPlayErrorCode r);
+
   // Returns the next decoded frame of data. The caller is responsible
   // for freeing the memory returned. This function must be called
   // only when the current state > DECODING_METADATA. The decode
@@ -372,6 +377,12 @@ public:
   }
 
 protected:
+
+  // Decodes from the current position until encountering a frame with time
+  // greater or equal to aSeekTime.
+  void DecodeToFrame(nsAutoMonitor& aMonitor,
+                     float aSeekTime);
+
   // Convert the OggPlay frame information into a format used by Gecko
   // (RGB for video, float for sound, etc).The decoder monitor must be
   // acquired in the scope of calls to these functions. They must be
@@ -653,6 +664,8 @@ public:
         r = oggplay_step_decoding(mPlayer);
         mon.Enter();
 
+        mDecodeStateMachine->HandleDecodeErrors(r);
+
         // Check whether decoding the last frame required us to read data
         // that wasn't available at the start of the frame. That means
         // we should probably start buffering.
@@ -716,7 +729,23 @@ nsOggDecodeStateMachine::~nsOggDecodeStateMachine()
 
 OggPlayErrorCode nsOggDecodeStateMachine::DecodeFrame()
 {
-  return oggplay_step_decoding(mPlayer);
+  OggPlayErrorCode r = oggplay_step_decoding(mPlayer);
+  return r;
+}
+
+void nsOggDecodeStateMachine::HandleDecodeErrors(OggPlayErrorCode aErrorCode)
+{
+  PR_ASSERT_CURRENT_THREAD_IN_MONITOR(mDecoder->GetMonitor());
+
+  if (aErrorCode != E_OGGPLAY_TIMEOUT &&
+      aErrorCode != E_OGGPLAY_OK &&
+      aErrorCode != E_OGGPLAY_USER_INTERRUPT &&
+      aErrorCode != E_OGGPLAY_CONTINUE) {
+    mState = DECODER_STATE_SHUTDOWN;
+    nsCOMPtr<nsIRunnable> event =
+      NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, NetworkError);
+    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+  }
 }
 
 nsOggDecodeStateMachine::FrameData* nsOggDecodeStateMachine::NextFrame()
@@ -767,20 +796,25 @@ nsOggDecodeStateMachine::FrameData* nsOggDecodeStateMachine::NextFrame()
     }
   }
 
-  PRBool needSilence = mAudioTrack != -1;
+  // If the audio stream has finished, but there's still video frames to
+  // be rendered, we need to send blank audio data to the audio hardware,
+  // so that the audio clock, which maintains the presentation time, keeps
+  // incrementing.
+  PRBool needSilence = PR_FALSE;
 
-  if (mAudioTrack != -1 &&
-      num_tracks > mAudioTrack &&
-      oggplay_callback_info_get_type(info[mAudioTrack]) == OGGPLAY_FLOATS_AUDIO) {
-    OggPlayDataHeader** headers = oggplay_callback_info_get_headers(info[mAudioTrack]);
-    if (headers[0]) {
-      audioTime = ((float)oggplay_callback_info_get_presentation_time(headers[0]))/1000.0;
-      int required = oggplay_callback_info_get_required(info[mAudioTrack]);
-      for (int j = 0; j < required; ++j) {
-        int size = oggplay_callback_info_get_record_size(headers[j]);
-        OggPlayAudioData* audio_data = oggplay_callback_info_get_audio_data(headers[j]);
-        HandleAudioData(frame, audio_data, size);
-        needSilence = PR_FALSE;
+  if (mAudioTrack != -1 && num_tracks > mAudioTrack) {
+    OggPlayDataType type = oggplay_callback_info_get_type(info[mAudioTrack]);
+    needSilence = (type == OGGPLAY_INACTIVE);
+    if (type == OGGPLAY_FLOATS_AUDIO) {
+      OggPlayDataHeader** headers = oggplay_callback_info_get_headers(info[mAudioTrack]);
+      if (headers[0]) {
+        audioTime = ((float)oggplay_callback_info_get_presentation_time(headers[0]))/1000.0;
+        int required = oggplay_callback_info_get_required(info[mAudioTrack]);
+        for (int j = 0; j < required; ++j) {
+          int size = oggplay_callback_info_get_record_size(headers[j]);
+          OggPlayAudioData* audio_data = oggplay_callback_info_get_audio_data(headers[j]);
+          HandleAudioData(frame, audio_data, size);
+        }
       }
     }
   }
@@ -1189,6 +1223,9 @@ void nsOggDecodeStateMachine::Seek(float aTime)
   NS_ASSERTION(mState != DECODER_STATE_SEEKING,
                "We shouldn't already be seeking");
   mSeekTime = aTime + mPlaybackStartTime;
+  float duration = static_cast<float>(mDuration) / 1000.0;
+  NS_ASSERTION(mSeekTime >= 0 && mSeekTime <= duration,
+               "Can only seek in range [0,duration]");
   LOG(PR_LOG_DEBUG, ("Changed state to SEEKING (to %f)", aTime));
   mState = DECODER_STATE_SEEKING;
 }
@@ -1274,6 +1311,71 @@ nsresult nsOggDecodeStateMachine::Seek(float aTime, nsChannelReader* aReader)
   return (rv < 0) ? NS_ERROR_FAILURE : NS_OK;
 }
 
+void nsOggDecodeStateMachine::DecodeToFrame(nsAutoMonitor& aMonitor,
+                                            float aTime)
+{
+  // Drop frames before the target time.
+  float target = aTime - mCallbackPeriod / 2.0;
+  FrameData* frame = nsnull;
+  OggPlayErrorCode r;
+  mLastFrameTime = 0;
+  // Some of the audio data from previous frames actually belongs
+  // to this frame and later frames. So rescue that data and stuff
+  // it into the first frame.
+  float audioTime = 0;
+  nsTArray<float> audioData;
+  do {
+    do {
+      aMonitor.Exit();
+      r = DecodeFrame();
+      aMonitor.Enter();
+    } while (mState != DECODER_STATE_SHUTDOWN && r == E_OGGPLAY_TIMEOUT);
+
+    HandleDecodeErrors(r);
+
+    if (mState == DECODER_STATE_SHUTDOWN)
+      break;
+
+    FrameData* nextFrame = NextFrame();
+    if (!nextFrame)
+      break;
+
+    delete frame;
+    frame = nextFrame;
+
+    audioData.AppendElements(frame->mAudioData);
+    audioTime += frame->mAudioData.Length() /
+    (float)mAudioRate / (float)mAudioChannels;
+  } while (frame->mDecodedFrameTime < target);
+
+  if (mState == DECODER_STATE_SHUTDOWN) {
+    delete frame;
+    return;
+  }
+
+  NS_ASSERTION(frame != nsnull, "No frame after decode!");
+  if (frame) {
+    if (audioTime > frame->mTime) {
+      // liboggplay gave us more data than expected, we need to prepend
+      // the extra data to the current frame to keep audio in sync.
+      audioTime -= frame->mTime;
+      // numExtraSamples must be evenly divisble by number of channels.
+      size_t numExtraSamples = mAudioChannels *
+        PRInt32(NS_ceil(mAudioRate*audioTime));
+      float* data = audioData.Elements() + audioData.Length() - numExtraSamples;
+      float* dst = frame->mAudioData.InsertElementsAt(0, numExtraSamples);
+      memcpy(dst, data, numExtraSamples * sizeof(float));
+    }
+
+    mLastFrameTime = 0;
+    frame->mTime = 0;
+    frame->mState = OGGPLAY_STREAM_JUST_SEEKED;
+    mDecodedFrames.Push(frame);
+    UpdatePlaybackPosition(frame->mDecodedFrameTime);
+    PlayVideo(frame);
+  }
+}
+
 void nsOggDecodeStateMachine::StopStepDecodeThread(nsAutoMonitor* aMonitor)
 {
   PR_ASSERT_CURRENT_THREAD_IN_MONITOR(mDecoder->GetMonitor());
@@ -1327,6 +1429,8 @@ nsresult nsOggDecodeStateMachine::Run()
           mon.Enter();
         }
 
+        HandleDecodeErrors(r);
+
         if (mState == DECODER_STATE_SHUTDOWN)
           continue;
 
@@ -1493,7 +1597,7 @@ nsresult nsOggDecodeStateMachine::Run()
           NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, SeekingStarted);
         NS_DispatchToMainThread(startEvent, NS_DISPATCH_SYNC);
         
-        Seek(seekTime, reader);
+        nsresult res = Seek(seekTime, reader);
 
         // Reactivate all tracks. Liboggplay deactivates tracks when it
         // reads to the end of stream, but they must be reactivated in order
@@ -1506,79 +1610,43 @@ nsresult nsOggDecodeStateMachine::Run()
         if (mState == DECODER_STATE_SHUTDOWN)
           continue;
 
-        // Drop frames before the target seek time.
-        float seekTarget = seekTime - mCallbackPeriod / 2.0;
-        FrameData* frame = nsnull;
-        OggPlayErrorCode r;
-        mLastFrameTime = 0;
-        // Some of the audio data from previous frames actually belongs
-        // to this frame and later frames. So rescue that data and stuff
-        // it into the first frame.
-        float audioTime = 0;
-        nsTArray<float> audioData;
-        do {
+        if (NS_SUCCEEDED(res)) {
+          DecodeToFrame(mon, seekTime);
+          // mSeekTime should not have changed. While we seek, mPlayState
+          // should always be PLAY_STATE_SEEKING and no-one will call
+          // nsOggDecoderStateMachine::Seek.
+          NS_ASSERTION(seekTime == mSeekTime, "No-one should have changed mSeekTime");
+          if (mState == DECODER_STATE_SHUTDOWN) {
+            continue;
+          }
+
+          OggPlayErrorCode r;
+          // Now try to decode another frame to see if we're at the end.
           do {
             mon.Exit();
             r = DecodeFrame();
             mon.Enter();
           } while (mState != DECODER_STATE_SHUTDOWN && r == E_OGGPLAY_TIMEOUT);
-
+          HandleDecodeErrors(r);
           if (mState == DECODER_STATE_SHUTDOWN)
-            break;
-
-          FrameData* nextFrame = NextFrame();
-          if (!nextFrame)
-            break;
-
-          delete frame;
-          frame = nextFrame;
-
-          audioData.AppendElements(frame->mAudioData);
-          audioTime += frame->mAudioData.Length() /
-                       (float)mAudioRate / (float)mAudioChannels;
-        } while (frame->mDecodedFrameTime < seekTarget);
-
-        if (mState == DECODER_STATE_SHUTDOWN) {
-          delete frame;
-          continue;
-        }
-
-        NS_ASSERTION(frame != nsnull, "No frame after seek!");
-        if (frame) {
-          if (audioTime > frame->mTime) {
-            // liboggplay gave us more data than expected, we need to prepend
-            // the extra data to the current frame to keep audio in sync.
-            audioTime -= frame->mTime;
-            // numExtraSamples must be evenly divisble by number of channels.
-            size_t numExtraSamples = mAudioChannels *
-                                     PRInt32(NS_ceil(mAudioRate*audioTime));
-            float* data = audioData.Elements() + audioData.Length() - numExtraSamples;
-            float* dst = frame->mAudioData.InsertElementsAt(0, numExtraSamples);
-            memcpy(dst, data, numExtraSamples * sizeof(float));
-          }
-        
-          mLastFrameTime = 0;
-          frame->mTime = 0;
-          frame->mState = OGGPLAY_STREAM_JUST_SEEKED;
-          mDecodedFrames.Push(frame);
-          UpdatePlaybackPosition(frame->mDecodedFrameTime);
-          PlayVideo(frame);
+            continue;
+          QueueDecodedFrames();
         }
 
         // Change state to DECODING now. SeekingStopped will call
         // nsOggDecodeStateMachine::Seek to reset our state to SEEKING
         // if we need to seek again.
         LOG(PR_LOG_DEBUG, ("Changed state from SEEKING (to %f) to DECODING", seekTime));
-        // mSeekTime should not have changed. While we seek, mPlayState
-        // should always be PLAY_STATE_SEEKING and no-one will call
-        // nsOggDecoderStateMachine::Seek.
-        NS_ASSERTION(seekTime == mSeekTime, "No-one should have changed mSeekTime");
         mState = DECODER_STATE_DECODING;
         mon.NotifyAll();
 
         mon.Exit();
-        nsCOMPtr<nsIRunnable> stopEvent = 
-          NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, SeekingStopped);
+        nsCOMPtr<nsIRunnable> stopEvent;
+        if (mDecodedFrames.GetCount() > 1) {
+          stopEvent = NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, SeekingStopped);
+        } else {
+          stopEvent = NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, SeekingStoppedAtEnd);
+        }
         NS_DispatchToMainThread(stopEvent, NS_DISPATCH_SYNC);        
         mon.Enter();
       }
@@ -1658,6 +1726,9 @@ nsresult nsOggDecodeStateMachine::Run()
             continue;
         }
 
+        // Set the right current time
+        mCurrentFrameTime += mCallbackPeriod;
+
         mon.Exit();
         nsCOMPtr<nsIRunnable> event =
           NS_NEW_RUNNABLE_METHOD(nsOggDecoder, mDecoder, PlaybackEnded);
@@ -1774,7 +1845,7 @@ NS_IMPL_THREADSAFE_ISUPPORTS1(nsOggDecoder, nsIObserver)
 void nsOggDecoder::Pause() 
 {
   nsAutoMonitor mon(mMonitor);
-  if (mPlayState == PLAY_STATE_SEEKING) {
+  if (mPlayState == PLAY_STATE_SEEKING || mPlayState == PLAY_STATE_ENDED) {
     mNextState = PLAY_STATE_PAUSED;
     return;
   }
@@ -2122,6 +2193,7 @@ void nsOggDecoder::PlaybackEnded()
   if (mShuttingDown || mPlayState == nsOggDecoder::PLAY_STATE_SEEKING)
     return;
 
+  PlaybackPositionChanged();
   ChangeState(PLAY_STATE_ENDED);
 
   if (mElement)  {
@@ -2285,6 +2357,36 @@ void nsOggDecoder::SeekingStopped()
   }
 }
 
+// This is called when seeking stopped *and* we're at the end of the
+// media.
+void nsOggDecoder::SeekingStoppedAtEnd()
+{
+  if (mShuttingDown)
+    return;
+
+  PRBool fireEnded = PR_FALSE;
+  {
+    nsAutoMonitor mon(mMonitor);
+
+    // An additional seek was requested while the current seek was
+    // in operation.
+    if (mRequestedSeekTime >= 0.0) {
+      ChangeState(PLAY_STATE_SEEKING);
+    } else {
+      ChangeState(PLAY_STATE_ENDED);
+      fireEnded = PR_TRUE;
+    }
+  }
+
+  if (mElement) {
+    UpdateReadyStateForData();
+    mElement->SeekCompleted();
+    if (fireEnded) {
+      mElement->PlaybackEnded();
+    }
+  }
+}
+
 void nsOggDecoder::SeekingStarted()
 {
   if (mShuttingDown)

content/media/video/src/nsWaveDecoder.cpp

@@ -406,7 +406,7 @@ nsWaveStateMachine::Pause()
   nsAutoMonitor monitor(mMonitor);
   mPaused = PR_TRUE;
   if (mState == STATE_LOADING_METADATA || mState == STATE_SEEKING ||
-      mState == STATE_BUFFERING) {
+      mState == STATE_BUFFERING || mState == STATE_ENDED) {
     mNextState = STATE_PAUSED;
   } else if (mState == STATE_PLAYING) {
     ChangeState(STATE_PAUSED);
@@ -574,17 +574,18 @@ nsWaveStateMachine::Run()
           ChangeState(STATE_ENDED);
         }
 
-        PRInt64 available =
-          mStream->GetCachedDataEnd(mPlaybackPosition) - mPlaybackPosition;
+        PRInt64 availableOffset = mStream->GetCachedDataEnd(mPlaybackPosition);
 
         // don't buffer if we're at the end of the stream, or if the
         // load has been suspended by the cache (in the latter case
         // we need to advance playback to free up cache space)
-        if (mState != STATE_ENDED && available < len &&
+        if (mState != STATE_ENDED &&
+            availableOffset < mPlaybackPosition + len &&
             !mStream->IsSuspendedByCache()) {
             mBufferingStart = now;
             mBufferingEndOffset = mPlaybackPosition +
               TimeToBytes(mBufferingWait.ToSeconds());
+            mBufferingEndOffset = PR_MAX(mPlaybackPosition + len, mBufferingEndOffset);
             mNextState = mState;
             ChangeState(STATE_BUFFERING);
 

content/media/video/test/Makefile.in

@@ -72,6 +72,9 @@ _TEST_FILES += \
 		test_bug468190.html \
 		test_bug482461.html \
 		test_bug493187.html \
+		test_bug495145.html \
+		test_bug495300.html \
+		test_bug495319.html \
 		test_can_play_type_ogg.html \
 		test_closing_connections.html \
 		test_contentDuration1.html \
@@ -110,6 +113,7 @@ _TEST_FILES += \
 		contentDuration5.sjs \
 		contentDuration6.sjs \
 		seek.ogv \
+		small-shot.ogg \
 		sound.ogg \
 		$(NULL)
 
@@ -146,6 +150,7 @@ _TEST_FILES += \
 		test_bug463162.xhtml \
 		test_bug465498.html \
 		test_bug468190_wav.html \
+		test_bug495145_wav.html \
 		test_can_play_type_wave.html \
 		test_paused_after_ended.html \
 		test_wav_8bit.html \

content/media/video/test/test_bug495145.html

@@ -0,0 +1,71 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=495145
+-->
+
+<head>
+  <title>Bug 495145 - pausing while ended shouldn't cause problems</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=495145">Mozilla Bug 495145</a>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+var v;
+var completed = false;
+var testFinishedCount = 0;
+var ended1Count = 0;
+
+function finishTest() {
+  ++testFinishedCount;
+  if (testFinishedCount == 2) {
+    completed = true;
+    SimpleTest.finish();
+  }
+}
+
+function start(event) {
+  event.target.play();
+}
+
+function ended1(event) {
+  if (completed)
+    return;
+
+  ++ended1Count;
+  if (ended1Count == 2) {
+    ok(true, "Playing after pause while ended works");
+    finishTest();
+    return;
+  }
+
+  event.target.pause();
+  event.target.play();
+}
+
+function ended2(event) {
+  if (completed)
+    return;
+
+  event.target.pause();
+  event.target.currentTime = 0;
+}
+
+function seeked2(event) {
+  if (completed)
+    return;
+
+  ok(event.target.paused, "Paused after seek after pause while ended");
+  finishTest();
+}
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+<video src='320x240.ogv' onloadeddata='start(event)' onended='ended1(event)'></video>
+<video src='320x240.ogv' onloadeddata='start(event)' onended='ended2(event)' onseeked="seeked2(event)"></video>
+</body>
+</html>

content/media/video/test/test_bug495145_wav.html

@@ -0,0 +1,71 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=495145
+-->
+
+<head>
+  <title>Bug 495145 - pausing while ended shouldn't cause problems</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=495145">Mozilla Bug 495145</a>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+var v;
+var completed = false;
+var testFinishedCount = 0;
+var ended1Count = 0;
+
+function finishTest() {
+  ++testFinishedCount;
+  if (testFinishedCount == 2) {
+    completed = true;
+    SimpleTest.finish();
+  }
+}
+
+function start(event) {
+  event.target.play();
+}
+
+function ended1(event) {
+  if (completed)
+    return;
+
+  ++ended1Count;
+  if (ended1Count == 2) {
+    ok(true, "Playing after pause while ended works");
+    finishTest();
+    return;
+  }
+
+  event.target.pause();
+  event.target.play();
+}
+
+function ended2(event) {
+  if (completed)
+    return;
+
+  event.target.pause();
+  event.target.currentTime = 0;
+}
+
+function seeked2(event) {
+  if (completed)
+    return;
+
+  ok(event.target.paused, "Paused after seek after pause while ended");
+  finishTest();
+}
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+<audio src='r11025_u8_c1.wav' onloadeddata='start(event)' onended='ended1(event)'></audio>
+<audio src='r11025_u8_c1.wav' onloadeddata='start(event)' onended='ended2(event)' onseeked="seeked2(event)"></audio>
+</body>
+</html>

content/media/video/test/test_bug495300.html

@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=495300
+-->
+
+<head>
+  <title>Bug 495300 - seeking to the end should behave as "ended"</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=495300">Mozilla Bug 495300</a>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+var v;
+var completed = false;
+
+function start(event) {
+  event.target.currentTime = event.target.duration + 1;
+}
+
+function didEnd(event) {
+  ok(true, "Got ended event");
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+<video src='seek.ogv' onloadeddata='start(event)' onended='didEnd(event)' controls></video>
+</body>
+</html>

content/media/video/test/test_bug495319.html

@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=495319
+-->
+
+<head>
+  <title>Bug 495319 - playing back small audio files should fire timeupdate</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=495319">Mozilla Bug 495319</a>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+var v;
+var timeUpdateCount = 0;
+
+function timeUpdate(event) {
+  ++timeUpdateCount;
+}
+
+function done(event) {
+  ok(timeUpdateCount > 0, "Should see at least one timeupdate: " + event.target.currentTime);
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+<audio src='small-shot.ogg' ontimeupdate="timeUpdate(event)" onended='done(event)' controls autoplay></video>
+</body>
+</html>

content/media/video/test/test_duration1.html

@@ -17,7 +17,7 @@ function startTest() {
   if (completed)
     return false;
   var v = document.getElementById('v');
-  ok(Math.round(v.duration*1000) == 3833, "Check duration of video: " + v.duration);
+  is(Math.round(v.duration*1000), 3966, "Check duration of video: " + v.duration);
   completed = true;
   clearTimeout(timeout);
   SimpleTest.finish();

content/xbl/crashtests/404125-1.xhtml

@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="lc">
+    <content>
+      <xul:listcell> t <children/></xul:listcell>
+    </content>
+  </binding>
+</bindings>
+
+<script>
+function boom()
+{
+  var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
+  document.getElementById("vv").appendChild(hbox);
+}
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<div style="-moz-binding: url(#lc);" id="vv"></div>
+
+</body>
+
+</html>

content/xbl/crashtests/420233-1.xhtml

@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="ab"><content><html:span>a b<children/></html:span></content></binding>
+  <binding id="empty"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("td").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><div style="width: 1px;"><span style="-moz-binding: url(#ab);"><td id="td"/></span></div></body>
+</html>

content/xbl/crashtests/464863-1.xhtml

@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><qqq><children xmlns="http://www.mozilla.org/xbl"/></qqq></content></binding></bindings>
+
+<script type="text/javascript">
+// <![CDATA[
+
+function boom()
+{
+  var s = document.getElementById("s");
+  var o = document.getAnonymousNodes(s)[0];
+  (document.body).appendChild(s);
+  o.appendChild(document.createTextNode("F"));
+}
+
+// ]]>
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url(#foo)"></span></body>
+</html>

content/xbl/crashtests/crashtests.list

@@ -13,12 +13,15 @@ load 368641-1.xhtml
 load 378521-1.xhtml
 load 382376-1.xhtml
 load 382376-2.xhtml
+load 404125-1.xhtml
 load 406900-1.xul
 load 406904-1.xhtml
 load 406904-2.xhtml
 load 418133-1.xhtml
 load 415192-1.xul
+load 420233-1.xhtml
 load 421997-1.xhtml
 load 432813-1.xhtml
 load 460665-1.xhtml
+load 464863-1.xhtml
 load 472260-1.xhtml

content/xml/document/crashtests/431703-1.xhtml

@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.body.innerHTML = '<circle xmlns="http://www.w3.org/2000/svg" onload=""/>';
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>

content/xml/document/crashtests/crashtests.list

@@ -4,3 +4,4 @@ load 382636-1.xml
 load 382636-2.svg
 load 382636-3.xhtml
 load 382636-4.xul # Throws (bug 455856)
+load 431703-1.xhtml

content/xul/document/crashtests/495635-1.xul

@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<?xul-overlay href="extA1.xul"?>
+<?xul-overlay href="extB1.xul"?>
+<?xul-overlay href="extA2.xul"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<vbox id="browser-bottombox">
+</vbox>
+</window>

content/xul/document/crashtests/crashtests.list

@@ -2,3 +2,4 @@ load 326204-1.xul
 load 344215-1.xul
 load 386914-1.html
 load 428951-1.xul
+load 495635-1.xul

content/xul/document/crashtests/extA1.xul

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA1"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <vbox id="browser-bottombox">
+    <statusbar id="extAbar" />
+  </vbox>
+</overlay>

content/xul/document/crashtests/extA2.xul

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA2"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <statusbar id="extAbar">
+    <statusbarpanel id="extApanel" label="panel 1">
+    </statusbarpanel>
+    <statusbarpanel id="extApanel2" label="panel 2" />
+  </statusbar>
+</overlay>

content/xul/document/crashtests/extB1.xul

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<overlay id="extA2"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <statusbar id="extAbar" removeelement="true" />
+</overlay>

content/xul/document/src/nsXULDocument.cpp

@@ -1759,6 +1759,7 @@ nsXULDocument::AddElementToDocumentPost(nsIContent* aElement)
 NS_IMETHODIMP
 nsXULDocument::AddSubtreeToDocument(nsIContent* aElement)
 {
+    NS_ASSERTION(aElement->GetCurrentDoc() == this, "Element not in doc!");
     // From here on we only care about elements.
     if (!aElement->IsNodeOfType(nsINode::eELEMENT)) {
         return NS_OK;
@@ -3961,8 +3962,11 @@ nsXULDocument::OverlayForwardReference::Resolve()
         if (NS_FAILED(rv)) return eResolve_Error;
     }
 
-    if (!notify) {
+    // Check if 'target' is still in our document --- it might not be!
+    if (!notify && target->GetCurrentDoc() == mDocument) {
         // Add child and any descendants to the element map
+        // XXX this is bogus, the content in 'target' might already be
+        // in the document
         rv = mDocument->AddSubtreeToDocument(target);
         if (NS_FAILED(rv)) return eResolve_Error;
     }

docshell/base/nsDocShell.cpp

@@ -2140,6 +2140,34 @@ nsDocShell::HistoryPurged(PRInt32 aNumEntries)
     return NS_OK;
 }
 
+static
+nsresult
+GetPrincipalDomain(nsIPrincipal* aPrincipal, nsACString& aDomain)
+{
+  aDomain.Truncate();
+
+  nsCOMPtr<nsIURI> codebaseURI;
+  nsresult rv = aPrincipal->GetDomain(getter_AddRefs(codebaseURI));
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (!codebaseURI) {
+     rv = aPrincipal->GetURI(getter_AddRefs(codebaseURI));
+     NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  if (!codebaseURI)
+     return NS_OK;
+
+  nsCOMPtr<nsIURI> innerURI = NS_GetInnermostURI(codebaseURI);
+  NS_ASSERTION(innerURI, "Failed to get innermost URI");
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = innerURI->GetAsciiHost(aDomain);
+  if (NS_FAILED(rv))
+      return rv;
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDocShell::GetSessionStorageForPrincipal(nsIPrincipal* aPrincipal,
                                           PRBool aCreate,
@@ -2166,15 +2194,15 @@ nsDocShell::GetSessionStorageForPrincipal(nsIPrincipal* aPrincipal,
         return topDocShell->GetSessionStorageForPrincipal(aPrincipal, aCreate,
                                                           aStorage);
 
-    nsXPIDLCString origin;
-    rv = aPrincipal->GetOrigin(getter_Copies(origin));
+    nsCAutoString currentDomain;
+    rv = GetPrincipalDomain(aPrincipal, currentDomain);
     if (NS_FAILED(rv))
         return rv;
 
-    if (origin.IsEmpty())
-        return NS_ERROR_FAILURE;
+    if (currentDomain.IsEmpty())
+        return NS_OK;
 
-    if (!mStorages.Get(origin, aStorage) && aCreate) {
+    if (!mStorages.Get(currentDomain, aStorage) && aCreate) {
         nsCOMPtr<nsIDOMStorage> newstorage =
             do_CreateInstance("@mozilla.org/dom/storage;2");
         if (!newstorage)
@@ -2183,9 +2211,11 @@ nsDocShell::GetSessionStorageForPrincipal(nsIPrincipal* aPrincipal,
         nsCOMPtr<nsPIDOMStorage> pistorage = do_QueryInterface(newstorage);
         if (!pistorage)
             return NS_ERROR_FAILURE;
-        pistorage->InitAsSessionStorage(aPrincipal);
+        rv = pistorage->InitAsSessionStorage(aPrincipal);
+        if (NS_FAILED(rv))
+            return rv;
 
-        if (!mStorages.Put(origin, newstorage))
+        if (!mStorages.Put(currentDomain, newstorage))
             return NS_ERROR_OUT_OF_MEMORY;
 
         newstorage.swap(*aStorage);
@@ -2256,19 +2286,19 @@ nsDocShell::AddSessionStorage(nsIPrincipal* aPrincipal,
     if (topItem) {
         nsCOMPtr<nsIDocShell> topDocShell = do_QueryInterface(topItem);
         if (topDocShell == this) {
-            nsXPIDLCString origin;
-            rv = aPrincipal->GetOrigin(getter_Copies(origin));
+            nsCAutoString currentDomain;
+            rv = GetPrincipalDomain(aPrincipal, currentDomain);
             if (NS_FAILED(rv))
                 return rv;
 
-            if (origin.IsEmpty())
+            if (currentDomain.IsEmpty())
                 return NS_ERROR_FAILURE;
 
             // Do not replace an existing session storage.
-            if (mStorages.GetWeak(origin))
+            if (mStorages.GetWeak(currentDomain))
                 return NS_ERROR_NOT_AVAILABLE;
 
-            if (!mStorages.Put(origin, aStorage))
+            if (!mStorages.Put(currentDomain, aStorage))
                 return NS_ERROR_OUT_OF_MEMORY;
         }
         else {

dom/base/nsGlobalWindow.cpp

@@ -348,6 +348,7 @@ static NS_DEFINE_CID(kXULControllersCID, NS_XULCONTROLLERS_CID);
 static const char sJSStackContractID[] = "@mozilla.org/js/xpc/ContextStack;1";
 
 static const char kCryptoContractID[] = NS_CRYPTO_CONTRACTID;
+static const char kPkcs11ContractID[] = NS_PKCS11_CONTRACTID;
 
 static PRBool
 IsAboutBlank(nsIURI* aURI)
@@ -2958,6 +2959,13 @@ nsGlobalWindow::GetCrypto(nsIDOMCrypto** aCrypto)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsGlobalWindow::GetPkcs11(nsIDOMPkcs11** aPkcs11)
+{
+  *aPkcs11 = nsnull;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsGlobalWindow::GetControllers(nsIControllers** aResult)
 {
@@ -3218,12 +3226,18 @@ nsGlobalWindow::GetInnerWidth(PRInt32* aInnerWidth)
   EnsureSizeUpToDate();
 
   nsCOMPtr<nsIBaseWindow> docShellWin(do_QueryInterface(mDocShell));
-  PRInt32 width = 0;
-  PRInt32 notused;
-  if (docShellWin)
-    docShellWin->GetSize(&width, &notused);
+  nsCOMPtr<nsPresContext> presContext;
+  mDocShell->GetPresContext(getter_AddRefs(presContext));
+
+  if (docShellWin && presContext) {
+    PRInt32 width, notused;
+    docShellWin->GetSize(&width, &notused);
+    *aInnerWidth = nsPresContext::
+      AppUnitsToIntCSSPixels(presContext->DevPixelsToAppUnits(width));
+  } else {
+    *aInnerWidth = 0;
+  }
 
-  *aInnerWidth = DevToCSSIntPixels(width);
   return NS_OK;
 }
 
@@ -3275,12 +3289,17 @@ nsGlobalWindow::GetInnerHeight(PRInt32* aInnerHeight)
   EnsureSizeUpToDate();
 
   nsCOMPtr<nsIBaseWindow> docShellWin(do_QueryInterface(mDocShell));
-  PRInt32 height = 0;
-  PRInt32 notused;
-  if (docShellWin)
-    docShellWin->GetSize(&notused, &height);
+  nsCOMPtr<nsPresContext> presContext;
+  mDocShell->GetPresContext(getter_AddRefs(presContext));
 
-  *aInnerHeight = DevToCSSIntPixels(height);
+  if (docShellWin && presContext) {
+    PRInt32 height, notused;
+    docShellWin->GetSize(&notused, &height);
+    *aInnerHeight = nsPresContext::
+      AppUnitsToIntCSSPixels(presContext->DevPixelsToAppUnits(height));
+  } else {
+    *aInnerHeight = 0;
+  }
   return NS_OK;
 }
 

dom/interfaces/base/Makefile.in

@@ -66,6 +66,7 @@ XPIDLSRCS =					\
 	nsIDOMMimeType.idl			\
 	nsIDOMMimeTypeArray.idl			\
 	nsIDOMNavigator.idl			\
+	nsIDOMPkcs11.idl			\
 	nsIDOMPlugin.idl			\
 	nsIDOMPluginArray.idl			\
 	nsIDOMScreen.idl			\

dom/interfaces/base/domstubs.idl

@@ -126,4 +126,5 @@ interface nsIDOMRange;
 // Crypto
 interface nsIDOMCRMFObject;
 interface nsIDOMCrypto;
+interface nsIDOMPkcs11;
 

dom/interfaces/base/nsIDOMPkcs11.idl

@@ -0,0 +1,49 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2000
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Johnny Stenback <jst@netscape.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "domstubs.idl"
+
+[scriptable, uuid(9fd42950-25e7-11d4-8a7d-006008c844c3)]
+interface nsIDOMPkcs11 : nsISupports
+{
+  long                      deletemodule(in DOMString moduleName);
+  long                      addmodule(in DOMString moduleName,
+                                      in DOMString libraryFullPath,
+                                      in long cryptoMechanismFlags,
+                                      in long cipherFlags);
+};

dom/interfaces/base/nsIDOMWindowInternal.idl

@@ -44,7 +44,7 @@ interface nsIControllers;
 interface nsIDOMLocation;
 interface nsIVariant;
 
-[scriptable, uuid(5c5ece60-d5f1-47fa-9afa-ee3b9c76b0e5)]
+[scriptable, uuid(3414EBC7-731F-4697-9F43-ACA6F5050875)]
 interface nsIDOMWindowInternal : nsIDOMWindow2
 {
   readonly attribute nsIDOMWindowInternal        window;
@@ -81,6 +81,7 @@ interface nsIDOMWindowInternal : nsIDOMWindow2
   readonly attribute nsIDOMBarProp               directories;
   readonly attribute boolean                     closed;
   readonly attribute nsIDOMCrypto                crypto;
+  readonly attribute nsIDOMPkcs11                pkcs11;
 
   // XXX Shouldn't this be in nsIDOMChromeWindow?
   /* [replaceable] controllers */

dom/src/storage/nsDOMStorage.cpp

@@ -535,25 +535,12 @@ nsDOMStorage::nsDOMStorage()
   , mLocalStorage(PR_FALSE)
   , mItemsCached(PR_FALSE)
 {
+  mSecurityChecker = this;
   mItems.Init(8);
   if (nsDOMStorageManager::gStorageManager)
     nsDOMStorageManager::gStorageManager->AddToStoragesHash(this);
 }
 
-static PLDHashOperator
-CopyStorageItems(nsSessionStorageEntry* aEntry, void* userArg)
-{
-  nsDOMStorage* newstorage = static_cast<nsDOMStorage*>(userArg);
-
-  newstorage->SetItem(aEntry->GetKey(), aEntry->mItem->GetValueInternal());
-
-  if (aEntry->mItem->IsSecure()) {
-    newstorage->SetSecure(aEntry->GetKey(), PR_TRUE);
-  }
-
-  return PL_DHASH_NEXT;
-}
-
 nsDOMStorage::nsDOMStorage(nsDOMStorage& aThat)
   : mUseDB(PR_FALSE) // Any clone is not using the database
   , mSessionOnly(PR_TRUE)
@@ -564,8 +551,8 @@ nsDOMStorage::nsDOMStorage(nsDOMStorage& aThat)
   , mScopeDBKey(aThat.mScopeDBKey)
 #endif
 {
+  mSecurityChecker = this;
   mItems.Init(8);
-  aThat.mItems.EnumerateEntries(CopyStorageItems, this);
 
   if (nsDOMStorageManager::gStorageManager)
     nsDOMStorageManager::gStorageManager->AddToStoragesHash(this);
@@ -579,11 +566,19 @@ nsDOMStorage::~nsDOMStorage()
 
 static
 nsresult
-GetDomainURI(nsIPrincipal *aPrincipal, nsIURI **_domain)
+GetDomainURI(nsIPrincipal *aPrincipal, PRBool aIncludeDomain, nsIURI **_domain)
 {
   nsCOMPtr<nsIURI> uri;
-  nsresult rv = aPrincipal->GetURI(getter_AddRefs(uri));
-  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aIncludeDomain) {
+    nsresult rv = aPrincipal->GetDomain(getter_AddRefs(uri));
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  if (!uri) {
+    nsresult rv = aPrincipal->GetURI(getter_AddRefs(uri));
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   // Check if we really got any URI. System principal doesn't return a URI
   // instance and we would crash in NS_GetInnermostURI below.
@@ -602,7 +597,7 @@ nsresult
 nsDOMStorage::InitAsSessionStorage(nsIPrincipal *aPrincipal)
 {
   nsCOMPtr<nsIURI> domainURI;
-  nsresult rv = GetDomainURI(aPrincipal, getter_AddRefs(domainURI));
+  nsresult rv = GetDomainURI(aPrincipal, PR_TRUE, getter_AddRefs(domainURI));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // No need to check for a return value. If this would fail we would not get
@@ -624,7 +619,7 @@ nsresult
 nsDOMStorage::InitAsLocalStorage(nsIPrincipal *aPrincipal)
 {
   nsCOMPtr<nsIURI> domainURI;
-  nsresult rv = GetDomainURI(aPrincipal, getter_AddRefs(domainURI));
+  nsresult rv = GetDomainURI(aPrincipal, PR_FALSE, getter_AddRefs(domainURI));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // No need to check for a return value. If this would fail we would not get
@@ -670,6 +665,27 @@ nsDOMStorage::InitAsGlobalStorage(const nsACString &aDomainDemanded)
   return NS_OK;
 }
 
+static PLDHashOperator
+CopyStorageItems(nsSessionStorageEntry* aEntry, void* userArg)
+{
+  nsDOMStorage* newstorage = static_cast<nsDOMStorage*>(userArg);
+
+  newstorage->SetItem(aEntry->GetKey(), aEntry->mItem->GetValueInternal());
+
+  if (aEntry->mItem->IsSecure()) {
+    newstorage->SetSecure(aEntry->GetKey(), PR_TRUE);
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+nsresult
+nsDOMStorage::CloneFrom(nsDOMStorage* aThat)
+{
+  aThat->mItems.EnumerateEntries(CopyStorageItems, this);
+  return NS_OK;
+}
+
 //static
 PRBool
 nsDOMStorage::CanUseStorage(PRPackedBool* aSessionOnly)
@@ -750,7 +766,8 @@ nsDOMStorage::CacheStoragePermissions()
   nsCOMPtr<nsIPrincipal> subjectPrincipal;
   ssm->GetSubjectPrincipal(getter_AddRefs(subjectPrincipal));
 
-  return CanAccess(subjectPrincipal);
+  NS_ASSERTION(mSecurityChecker, "Has non-null mSecurityChecker");
+  return mSecurityChecker->CanAccess(subjectPrincipal);
 }
 
 
@@ -1404,6 +1421,7 @@ nsDOMStorage2::nsDOMStorage2()
 nsDOMStorage2::nsDOMStorage2(nsDOMStorage2& aThat)
 {
   mStorage = new nsDOMStorage(*aThat.mStorage.get());
+  mStorage->mSecurityChecker = mStorage;
   mPrincipal = aThat.mPrincipal;
 }
 
@@ -1414,6 +1432,8 @@ nsDOMStorage2::InitAsSessionStorage(nsIPrincipal *aPrincipal)
   if (!mStorage)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Leave security checks only for domain (nsDOMStorage implementation)
+  mStorage->mSecurityChecker = mStorage;
   mPrincipal = aPrincipal;
   return mStorage->InitAsSessionStorage(aPrincipal);
 }
@@ -1425,6 +1445,7 @@ nsDOMStorage2::InitAsLocalStorage(nsIPrincipal *aPrincipal)
   if (!mStorage)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  mStorage->mSecurityChecker = this;
   mPrincipal = aPrincipal;
   return mStorage->InitAsLocalStorage(aPrincipal);
 }
@@ -1443,6 +1464,7 @@ nsDOMStorage2::Clone()
   if (!storage)
     return nsnull;
 
+  storage->mStorage->CloneFrom(mStorage);
   NS_ADDREF(storage);
 
   return storage;
@@ -1463,6 +1485,9 @@ nsDOMStorage2::Principal()
 PRBool
 nsDOMStorage2::CanAccess(nsIPrincipal *aPrincipal)
 {
+  if (mStorage->mSecurityChecker != this)
+    return mStorage->mSecurityChecker->CanAccess(aPrincipal);
+
   // Allow C++ callers to access the storage
   if (!aPrincipal)
     return PR_TRUE;

dom/src/storage/nsDOMStorage.h

@@ -193,6 +193,9 @@ public:
   // clear all values from the store
   void ClearAll();
 
+  nsresult
+  CloneFrom(nsDOMStorage* aThat);
+
   nsIDOMStorageItem* GetNamedItem(const nsAString& aKey, nsresult* aResult);
 
   static nsDOMStorage* FromSupports(nsISupports* aSupports)
@@ -244,6 +247,9 @@ protected:
   nsCString mScopeDBKey;
   nsCString mQuotaDomainDBKey;
 
+  friend class nsIDOMStorage2;
+  nsPIDOMStorage* mSecurityChecker;
+
 public:
   // e.g. "moc.rab.oof.:" or "moc.rab.oof.:http:80" depending
   // on association with a domain (globalStorage) or

dom/tests/mochitest/bugs/Makefile.in

@@ -99,6 +99,7 @@ _TEST_FILES	= \
 		test_bug479143.html \
 		test_bug484775.html \
 		test_bug427744.html \
+		test_bug495219.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)

dom/tests/mochitest/bugs/test_bug495219.html

@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=495219
+-->
+<head>
+  <title>Test for Bug 495219</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=495219">Mozilla
+   Bug 495219</a>
+<iframe onload="this.style.display='none'"></iframe>
+<script type="application/javascript">
+
+SimpleTest.waitForExplicitFinish();
+window.onload = function () {
+  is(window.frames[0].innerWidth, 0, "width should be zero");
+  is(window.frames[0].innerHeight, 0, "height should be zero");
+  SimpleTest.finish();
+}
+
+</script>
+</body>
+</html>

dom/tests/mochitest/sessionstorage/Makefile.in

@@ -49,9 +49,12 @@ _TEST_FILES	= \
     frameReplace.html \
     frameEqual.html \
     frameNotEqual.html \
+    file_http.html \
+    file_https.html \
     test_sessionStorageBase.html \
     test_sessionStorageClone.html \
     test_sessionStorageReplace.html \
+    test_sessionStorageHttpHttps.html \
     interOriginSlave.js \
     interOriginTest.js \
     $(NULL)

dom/tests/mochitest/sessionstorage/file_http.html

@@ -0,0 +1,40 @@
+<html>
+<head>
+<script>
+
+window.addEventListener("message", onMessageReceived, false);
+
+function postMsg(msg)
+{
+  parent.postMessage(msg, "http://localhost:8888");
+}
+
+function onMessageReceived(event)
+{
+  if (event.data == "check") {
+    postMsg(sessionStorage.getItem("foo"));
+
+    var gotValue = "threw";
+    try {
+      gotValue = sessionStorage.getItem("foo-https");
+    } catch (e) {
+    }
+
+    postMsg(gotValue);
+
+    postMsg("the end");
+  }
+}
+
+function start()
+{
+  sessionStorage.setItem("foo", "insecure");
+  postMsg(sessionStorage.getItem("foo"));
+}
+
+</script>
+</head>
+<body onload="start();">
+insecure
+</body>
+</html>

dom/tests/mochitest/sessionstorage/file_https.html

@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+function start()
+{
+  sessionStorage.setItem("foo-https", "secure");
+  parent.postMessage(sessionStorage.getItem("foo-https"),
+                     "http://localhost:8888");
+}
+</script>
+</head>
+<body onload="start();">
+secure
+</body>
+</html>

dom/tests/mochitest/sessionstorage/test_sessionStorageFromChrome.xhtml

@@ -17,11 +17,11 @@ function startTest()
     sessionStorage;
   }
   catch (e) {
-    is(e.result, Components.results.NS_ERROR_NOT_AVAILABLE,
+    is(e.result, 2152923145,
        "Testing that we get the expected exception.");
     exceptionCaught = true;
   }
-  todo_is(exceptionCaught, true, "Testing that an exception was thrown.");
+  is(exceptionCaught, true, "Testing that an exception was thrown.");
 
   SimpleTest.finish();
 }

dom/tests/mochitest/sessionstorage/test_sessionStorageHttpHttps.html

@@ -0,0 +1,60 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>sessionStorage replace test</title>
+
+<!--
+  This test checks that sessionStorage values set in an https page
+  are not readable from a non-https page from the same domain.
+-->
+
+<script type="text/javascript" src="/MochiKit/packed.js"></script>
+<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+
+<script type="text/javascript">
+
+window.addEventListener("message", onMessageReceived, false);
+
+var messages = [];
+
+function onMessageReceived(event)
+{
+  if (event.data == "the end") {
+    is(messages.length, 4, "Wrong number of messages.");
+    is(messages[0], "insecure", "Wrong message from insecure page");
+    is(messages[1], "secure", "Wrong message from secure page");
+    is(messages[2], "insecure", "Wrong second message from insecure page");
+    is(messages[3], null, "Insecure page got secure message?");
+
+    SimpleTest.finish();
+
+    return;
+  }
+
+  messages.push(event.data);
+
+  if (event.data == "insecure" && messages.length == 1) {
+    window.httpsframe.location = "https://test1.example.com/tests/dom/tests/mochitest/sessionstorage/file_https.html";
+  }
+
+  if (event.data == "secure") {
+    window.httpframe.postMessage("check", "http://test1.example.com");
+  }
+}
+
+function startTest()
+{
+  window.httpframe.location = "http://test1.example.com/tests/dom/tests/mochitest/sessionstorage/file_http.html";
+}
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+
+</head>
+
+<body onload="startTest();">
+  <iframe src="" name="httpframe"></iframe>
+  <iframe src="" name="httpsframe"></iframe>
+</body>
+</html>

gfx/thebes/crashtests/408754-1.html

@@ -0,0 +1,13 @@
+<html>
+<head>
+<style>
+ .a { width: 17895680}
+ .b { width: 10}
+</style>
+</head>
+<body>
+<table><tr>
+<td class="a">a</td><td class="b">b</td>
+</tr></table>
+</body>
+</html>

gfx/thebes/crashtests/crashtests.list

@@ -40,6 +40,7 @@ load 404112-2.html
 load 405268-1.xhtml
 load 407761-1.html
 load 407842.html
+load 408754-1.html
 load 410728-1.xml
 load 416637-1.html
 load 419095-1.html

js/jsd/jsd_xpc.cpp

@@ -707,10 +707,10 @@ jsds_ScriptHookProc (JSDContext* jsdc, JSDScript* jsdscript, JSBool creating,
     JSRuntime *rt = JS_GetRuntime(cx);
 #endif
 
-    nsCOMPtr<jsdIScriptHook> hook;
-    gJsds->GetScriptHook (getter_AddRefs(hook));
-    
     if (creating) {
+        nsCOMPtr<jsdIScriptHook> hook;
+        gJsds->GetScriptHook(getter_AddRefs(hook));
+
         /* a script is being created */
         if (!hook) {
             /* nobody cares, just exit */
@@ -736,12 +736,15 @@ jsds_ScriptHookProc (JSDContext* jsdc, JSDScript* jsdscript, JSBool creating,
             static_cast<jsdIScript *>(JSD_GetScriptPrivate(jsdscript));
         if (!jsdis)
             return;
-        
+
         jsdis->Invalidate();
-        if (!hook)
-            return;
-        
+
         if (gGCStatus == JSGC_END) {
+            nsCOMPtr<jsdIScriptHook> hook;
+            gJsds->GetScriptHook(getter_AddRefs(hook));
+            if (!hook)
+                return;
+
             /* if GC *isn't* running, we can tell the user about the script
              * delete now. */
 #ifdef CAUTIOUS_SCRIPTHOOK

js/src/Makefile.in

@@ -75,7 +75,7 @@ MODULE_OPTIMIZE_FLAGS = -O2 -ip
 #XXX: do we want different INTERP_OPTIMIZER flags here?
 endif
 else # not INTEL_CXX
-MODULE_OPTIMIZE_FLAGS = -Os -fstrict-aliasing $(MOZ_OPTIMIZE_SIZE_TWEAK)
+MODULE_OPTIMIZE_FLAGS = -O3 -fstrict-aliasing $(MOZ_OPTIMIZE_SIZE_TWEAK)
 # Special optimization flags for jsinterp.c
 INTERP_OPTIMIZER = -O3 -fstrict-aliasing
 endif