Merge the last PGO-green inbound changeset to m-c.

content/canvas/src/WebGLContextGL.cpp

@@ -4954,9 +4954,8 @@ WebGLContext::CompileShader(WebGLShader *shader)
             compileOptions |= SH_OBJECT_CODE
                             | SH_MAP_LONG_VARIABLE_NAMES;
 #ifdef XP_MACOSX
-            // work around bug 665578
+            // work around bug 665578 and bug 769810
             if (gl->WorkAroundDriverBugs() &&
-                !nsCocoaFeatures::OnLionOrLater() &&
                 gl->Vendor() == gl::GLContext::VendorATI)
             {
                 compileOptions |= SH_EMULATE_BUILT_IN_FUNCTIONS;

content/canvas/src/WebGLContextValidate.cpp

@@ -607,20 +607,6 @@ WebGLContext::InitAndValidateGL()
         return false;
     }
 
-#ifdef MOZ_JAVA_COMPOSITOR
-    // bug 736123, blacklist WebGL on Adreno
-    bool forceEnabled = Preferences::GetBool("webgl.force-enabled", false);
-    if (!forceEnabled) {
-        int renderer = gl->Renderer();
-        if (renderer == gl::GLContext::RendererAdreno200 ||
-            renderer == gl::GLContext::RendererAdreno205)
-        {
-            GenerateWarning("WebGL blocked on this Adreno driver!");
-            return false;
-        }
-    }
-#endif
-
     mMinCapability = Preferences::GetBool("webgl.min_capability_mode", false);
     mDisableExtensions = Preferences::GetBool("webgl.disable-extensions", false);
 
@@ -760,6 +746,15 @@ WebGLContext::InitAndValidateGL()
         }
     }
 
+#ifdef XP_MACOSX
+    if (gl->WorkAroundDriverBugs() &&
+        gl->Vendor() == gl::GLContext::VendorATI) {
+        // The Mac ATI driver, in all known OSX version up to and including 10.8,
+        // renders points sprites upside-down. Apple bug 11778921
+        gl->fPointParameterf(LOCAL_GL_POINT_SPRITE_COORD_ORIGIN, LOCAL_GL_LOWER_LEFT);
+    }
+#endif
+
     // Check the shader validator pref
     NS_ENSURE_TRUE(Preferences::GetRootBranch(), false);
 

content/html/content/src/nsHTMLInputElement.cpp

@@ -3961,12 +3961,14 @@ nsHTMLInputElement::HasTypeMismatch() const
 bool
 nsHTMLInputElement::HasPatternMismatch() const
 {
-  nsAutoString pattern;
   if (!DoesPatternApply() ||
-      !GetAttr(kNameSpaceID_None, nsGkAtoms::pattern, pattern)) {
+      !HasAttr(kNameSpaceID_None, nsGkAtoms::pattern)) {
     return false;
   }
 
+  nsAutoString pattern;
+  GetAttr(kNameSpaceID_None, nsGkAtoms::pattern, pattern);
+
   nsAutoString value;
   NS_ENSURE_SUCCESS(GetValueInternal(value), false);
 

dom/apps/src/Webapps.js

@@ -119,6 +119,8 @@ WebappsRegistry.prototype = {
   // mozIDOMApplicationRegistry implementation
   
   install: function(aURL, aParams) {
+    let installURL = this._window.location.href;
+    let installOrigin = this._getOrigin(installURL);
     let request = this.createRequest();
     let requestID = this.getRequestId(request);
     let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Ci.nsIXMLHttpRequest);
@@ -127,7 +129,6 @@ WebappsRegistry.prototype = {
     xhr.addEventListener("load", (function() {
       if (xhr.status == 200) {
         try {
-          let installOrigin = this._getOrigin(this._window.location.href);
           let manifest = JSON.parse(xhr.responseText, installOrigin);
           if (!this.checkManifest(manifest, installOrigin)) {
             Services.DOMRequest.fireError(request, "INVALID_MANIFEST");
@@ -138,7 +139,7 @@ WebappsRegistry.prototype = {
                                                               manifestURL: aURL,
                                                               manifest: manifest,
                                                               receipts: receipts },
-                                                              from: this._window.location.href,
+                                                              from: installURL,
                                                               oid: this._id,
                                                               requestID: requestID });
           }

dom/base/Navigator.cpp

@@ -98,7 +98,7 @@ NS_INTERFACE_MAP_BEGIN(Navigator)
   NS_INTERFACE_MAP_ENTRY(nsIDOMClientInformation)
   NS_INTERFACE_MAP_ENTRY(nsIDOMNavigatorDeviceStorage)
   NS_INTERFACE_MAP_ENTRY(nsIDOMNavigatorGeolocation)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMMozNavigatorBattery)
+  NS_INTERFACE_MAP_ENTRY(nsINavigatorBattery)
   NS_INTERFACE_MAP_ENTRY(nsIDOMNavigatorDesktopNotification)
   NS_INTERFACE_MAP_ENTRY(nsIDOMMozNavigatorSms)
 #ifdef MOZ_MEDIA_NAVIGATOR
@@ -699,7 +699,7 @@ Navigator::RemoveIdleObserver(nsIIdleObserver* aIdleObserver)
 }
 
 NS_IMETHODIMP
-Navigator::MozVibrate(const jsval& aPattern, JSContext* cx)
+Navigator::Vibrate(const jsval& aPattern, JSContext* cx)
 {
   nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
   NS_ENSURE_TRUE(win, NS_OK);
@@ -1002,11 +1002,11 @@ NS_IMETHODIMP Navigator::GetMozNotification(nsIDOMDesktopNotificationCenter** aR
 }
 
 //*****************************************************************************
-//    Navigator::nsIDOMNavigatorBattery
+//    Navigator::nsINavigatorBattery
 //*****************************************************************************
 
 NS_IMETHODIMP
-Navigator::GetMozBattery(nsIDOMMozBatteryManager** aBattery)
+Navigator::GetBattery(nsIDOMBatteryManager** aBattery)
 {
   if (!mBatteryManager) {
     *aBattery = nsnull;

dom/base/Navigator.h

@@ -12,7 +12,7 @@
 #include "nsIDOMNavigatorDeviceStorage.h"
 #include "nsIDOMNavigatorDesktopNotification.h"
 #include "nsIDOMClientInformation.h"
-#include "nsIDOMNavigatorBattery.h"
+#include "nsINavigatorBattery.h"
 #include "nsIDOMNavigatorSms.h"
 #include "nsIDOMNavigatorNetwork.h"
 #include "nsAutoPtr.h"
@@ -69,7 +69,7 @@ class Navigator : public nsIDOMNavigator
                 , public nsIDOMNavigatorDeviceStorage
                 , public nsIDOMNavigatorGeolocation
                 , public nsIDOMNavigatorDesktopNotification
-                , public nsIDOMMozNavigatorBattery
+                , public nsINavigatorBattery
                 , public nsIDOMMozNavigatorSms
 #ifdef MOZ_MEDIA_NAVIGATOR
                 , public nsIDOMNavigatorUserMedia
@@ -93,7 +93,7 @@ public:
   NS_DECL_NSIDOMNAVIGATORDEVICESTORAGE
   NS_DECL_NSIDOMNAVIGATORGEOLOCATION
   NS_DECL_NSIDOMNAVIGATORDESKTOPNOTIFICATION
-  NS_DECL_NSIDOMMOZNAVIGATORBATTERY
+  NS_DECL_NSINAVIGATORBATTERY
   NS_DECL_NSIDOMMOZNAVIGATORSMS
 #ifdef MOZ_MEDIA_NAVIGATOR
   NS_DECL_NSIDOMNAVIGATORUSERMEDIA

dom/base/nsDOMClassInfo.cpp

@@ -1454,7 +1454,7 @@ static nsDOMClassInfoData sClassInfoData[] = {
   NS_DEFINE_CLASSINFO_DATA(GeoPositionError, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
-  NS_DEFINE_CLASSINFO_DATA(MozBatteryManager, nsDOMGenericSH,
+  NS_DEFINE_CLASSINFO_DATA(BatteryManager, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(MozPowerManager, nsDOMGenericSH,
@@ -2471,7 +2471,7 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_CONDITIONAL_ENTRY(nsIDOMNavigatorDesktopNotification,
                                         Navigator::HasDesktopNotificationSupport())
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMClientInformation)
-    DOM_CLASSINFO_MAP_CONDITIONAL_ENTRY(nsIDOMMozNavigatorBattery,
+    DOM_CLASSINFO_MAP_CONDITIONAL_ENTRY(nsINavigatorBattery,
                                         battery::BatteryManager::HasSupport())
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozNavigatorSms)
 #ifdef MOZ_MEDIA_NAVIGATOR
@@ -4105,8 +4105,8 @@ nsDOMClassInfo::Init()
      DOM_CLASSINFO_MAP_ENTRY(nsIDOMGeoPositionError)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN(MozBatteryManager, nsIDOMMozBatteryManager)
+  DOM_CLASSINFO_MAP_BEGIN(BatteryManager, nsIDOMBatteryManager)
-     DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozBatteryManager)
+     DOM_CLASSINFO_MAP_ENTRY(nsIDOMBatteryManager)
      DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)
   DOM_CLASSINFO_MAP_END
 

dom/base/nsDOMClassInfoClasses.h

@@ -397,7 +397,7 @@ DOMCI_CLASS(GeoPosition)
 DOMCI_CLASS(GeoPositionCoords)
 DOMCI_CLASS(GeoPositionError)
 
-DOMCI_CLASS(MozBatteryManager)
+DOMCI_CLASS(BatteryManager)
 
 DOMCI_CLASS(MozPowerManager)
 DOMCI_CLASS(MozWakeLock)

dom/battery/BatteryManager.cpp

@@ -21,7 +21,7 @@
 #define DISCHARGINGTIMECHANGE_EVENT_NAME NS_LITERAL_STRING("dischargingtimechange")
 #define CHARGINGTIMECHANGE_EVENT_NAME    NS_LITERAL_STRING("chargingtimechange")
 
-DOMCI_DATA(MozBatteryManager, mozilla::dom::battery::BatteryManager)
+DOMCI_DATA(BatteryManager, mozilla::dom::battery::BatteryManager)
 
 namespace mozilla {
 namespace dom {
@@ -46,8 +46,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(BatteryManager,
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(BatteryManager)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMMozBatteryManager)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMBatteryManager)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(MozBatteryManager)
+  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(BatteryManager)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(BatteryManager, nsDOMEventTargetHelper)

dom/battery/BatteryManager.h

@@ -26,12 +26,12 @@ namespace dom {
 namespace battery {
 
 class BatteryManager : public nsDOMEventTargetHelper
-                     , public nsIDOMMozBatteryManager
+                     , public nsIDOMBatteryManager
                      , public BatteryObserver
 {
 public:
   NS_DECL_ISUPPORTS
-  NS_DECL_NSIDOMMOZBATTERYMANAGER
+  NS_DECL_NSIDOMBATTERYMANAGER
   NS_FORWARD_NSIDOMEVENTTARGET(nsDOMEventTargetHelper::)
 
   BatteryManager();

dom/battery/Makefile.in

@@ -33,7 +33,7 @@ LOCAL_INCLUDES = \
 
 XPIDLSRCS = \
   nsIDOMBatteryManager.idl \
-  nsIDOMNavigatorBattery.idl \
+  nsINavigatorBattery.idl \
   $(NULL)
 
 TEST_DIRS += test

dom/battery/nsIDOMBatteryManager.idl

@@ -6,8 +6,8 @@
 
 interface nsIDOMEventListener;
 
-[scriptable, builtinclass, uuid(41e88f87-42cb-4db1-8724-f5456a16c410)]
+[scriptable, builtinclass, uuid(03c6dd20-7efd-4640-b958-c0ce11b9aadf)]
-interface nsIDOMMozBatteryManager : nsIDOMEventTarget
+interface nsIDOMBatteryManager : nsIDOMEventTarget
 {
   readonly attribute double     level;
   readonly attribute boolean    charging;

dom/battery/nsINavigatorBattery.idl

@@ -4,10 +4,10 @@
 
 #include "nsISupports.idl"
 
-interface nsIDOMMozBatteryManager;
+interface nsIDOMBatteryManager;
 
-[scriptable, uuid(c295f049-be3d-4f83-9f7c-5c3e91d6ecb9)]
+[scriptable, uuid(4a78a8d5-5bbb-4a92-ad97-f19e853a7008)]
-interface nsIDOMMozNavigatorBattery : nsISupports
+interface nsINavigatorBattery : nsISupports
 {
-  readonly attribute nsIDOMMozBatteryManager mozBattery;
+  readonly attribute nsIDOMBatteryManager battery;
 };

dom/battery/test/marionette/test_battery.js

@@ -3,7 +3,7 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.mozBattery;
+let battery = window.navigator.battery;
 ok(battery);
 
 /**

dom/battery/test/test_battery_basics.html

@@ -14,15 +14,9 @@
 
 /** Test for Battery API **/
 
-// Testing prefixing.
+ok('battery' in navigator, "navigator.battery should exist");
-ok(!("NavigatorBattery" in window), "NavigatorBattery shouldn't be visible");
-ok(("MozNavigatorBattery" in window), "MozNavigatorBattery should be visible");
-ok(!("BatteryManager" in window), "BatteryManager shouldn't be visible");
-ok(("MozBatteryManager" in window), "MozBatteryManager should be visible");
 
-ok('mozBattery' in navigator, "navigator.mozBattery should exist");
+var battery = navigator.battery;
-
-var battery = navigator.mozBattery;
 is(battery.level, 1.0, "Default battery level should be 1.0");
 is(battery.charging, true, "Default charging value should be true");
 is(battery.dischargingTime, Infinity, "Default dischargingTime should be Inifinity");

dom/interfaces/base/nsIDOMNavigator.idl

@@ -7,7 +7,7 @@
 
 interface nsIIdleObserver;
 
-[scriptable, uuid(c148ed5a-31c1-4a21-a13b-341f592579ff)]
+[scriptable, uuid(b0ccf251-d793-48a1-94aa-cf840fe6639d)]
 interface nsIDOMNavigator : nsISupports
 {
   readonly attribute DOMString             appCodeName;
@@ -37,14 +37,14 @@ interface nsIDOMNavigator : nsISupports
    * vibrator, this function does nothing.  If the window is hidden, this
    * function does nothing.
    *
-   * mozVibrate takes one argument, which specifies either how long to vibrate
+   * vibrate takes one argument, which specifies either how long to vibrate for
-   * for or gives a pattern of vibrator-on/vibrator-off timings.
+   * or gives a pattern of vibrator-on/vibrator-off timings.
    *
    * If a vibration pattern is in effect when this function is called, this
    * call will overwrite the existing pattern, if this call successfully
    * completes.
    *
-   * We handle the argument to mozVibrate as follows.
+   * We handle the argument to vibrate as follows.
    *
    * - If the argument is undefined or null, we throw
    *   NS_ERROR_DOM_NOT_SUPPORTED_ERR.
@@ -78,7 +78,7 @@ interface nsIDOMNavigator : nsISupports
    *   too long, or if any of its elements is too large.
    */
   [implicit_jscontext]
-  void mozVibrate(in jsval aPattern);
+  void vibrate(in jsval aPattern);
 
   /** 
    * Navigator requests to add an idle observer to the existing window.

dom/tests/mochitest/general/test_interfaces.html

@@ -25,7 +25,7 @@ var interfaceNamesInGlobalScope =
     "MozApplicationEvent",
     "HTMLByteRanges",
     "URL",
-    "MozBatteryManager",
+    "BatteryManager",
     "HTMLStyleElement",
     "PropertyNodeList",
     "SVGPatternElement",
@@ -324,7 +324,6 @@ var interfaceNamesInGlobalScope =
     "Navigator",
     "SVGPathSegCurvetoQuadraticSmoothAbs",
     "HTMLButtonElement",
-    "MozNavigatorBattery",
     "WebGLProgram",
     "SVGPointList",
     "SVGFEColorMatrixElement",

dom/tests/mochitest/general/test_vibrator.html

@@ -9,29 +9,29 @@
 <body>
 
 <!-- Although we can't test that the vibrator works properly, we can test that
-     navigator.mozVibrate throws an exception where appropriate. -->
+     navigator.vibrate throws an exception where appropriate. -->
 
 <script class="testbody" type="text/javascript;version=1.7">
 function expectFailure(param) {
   try {
-    navigator.mozVibrate(param);
+    navigator.vibrate(param);
   }
   catch(e) {
-    ok(true, 'mozVibrate(' + param + ') threw an expected exception.');
+    ok(true, 'vibrate(' + param + ') threw an expected exception.');
     return;
   }
-  ok(false, 'mozVibrate(' + param + ') should have thrown an exception.');
+  ok(false, 'vibrate(' + param + ') should have thrown an exception.');
 }
 
 function expectSuccess(param) {
   try {
-    navigator.mozVibrate(param);
+    navigator.vibrate(param);
   }
   catch(e) {
-    ok(false, 'mozVibrate(' + param + ') threw an unexpected exception.');
+    ok(false, 'vibrate(' + param + ') threw an unexpected exception.');
     return;
   }
-  ok(true, 'mozVibrate(' + param + ') did not throw an exception.');
+  ok(true, 'vibrate(' + param + ') did not throw an exception.');
 }
 
 function testFailures() {
@@ -69,7 +69,7 @@ function testSuccesses() {
 
   // The following loop shouldn't cause us to crash.  See bug 701716.
   for (var i = 0; i < 10000; i++) {
-    navigator.mozVibrate([100, 100]);
+    navigator.vibrate([100, 100]);
   }
   ok(true, "Didn't crash after issuing a lot of vibrate() calls.");
 }

dom/tests/mochitest/webapps/Makefile.in

@@ -17,6 +17,7 @@ DIRS = \
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES	= \
+    test_bug_765063.xul \
     test_install_app.xul \
     test_list_api.xul \
     test_install_errors.xul \

dom/tests/mochitest/webapps/apps/Makefile.in

@@ -13,6 +13,7 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES	= \
+    bug_765063.xul \
     include.html \
     wild_crazy.webapp \
     wild_crazy.webapp^headers^ \

dom/tests/mochitest/webapps/apps/bug_765063.xul

@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script>
+    navigator.mozApps.install("http://www.example.com:80/chrome/dom/tests/mochitest/webapps/apps/super_crazy.webapp", null);
+    document.location = "about:blank";
+  </script>
+</window>

dom/tests/mochitest/webapps/test_bug_765063.xul

@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="Mozilla Bug 765063">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="apphelper.js"/>
+  <!-- We only need jshelper.js for debug(), which apphelper.js calls.  But
+     - since we include it, we also let it call apphelper.js's popup_listener(),
+     - which listens for the install doorhanger and presses its main button. -->
+  <script type="application/javascript" src="jshelper.js"/>
+
+<script> 
+SimpleTest.waitForExplicitFinish();
+
+// Observe app installation and confirm that the install origin didn't change.
+var observer = {
+  observe: function observe(subject, topic, data) {
+    ok(JSON.parse(data).installOrigin == "http://www.example.com",
+       "the install origin didn't change");
+    tearDown();
+    SimpleTest.finish();
+  }
+};
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+Services.obs.addObserver(observer, "webapps-sync-install", false);
+</script> 
+
+  <!-- Load a page that initiates an app installation and then immediately
+     - redirects to a page at a different origin.  We can't do this directly
+     - inside this test page, because that would cause the test to hang. -->
+  <iframe src="http://www.example.com:80/chrome/dom/tests/mochitest/webapps/apps/bug_765063.xul"/>
+
+</window>

embedding/android/GeckoAppShell.java

@@ -1843,4 +1843,8 @@ public class GeckoAppShell
 
     public static void notifyWakeLockChanged(String topic, String state) {
     }
+
+    public static String getGfxInfoData() {
+        return null;
+    }
 }

gfx/gl/GLContext.cpp

@@ -265,6 +265,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
                 { (PRFuncPtr*) &mSymbols.fReadBuffer, { "ReadBuffer", NULL } },
                 { (PRFuncPtr*) &mSymbols.fMapBuffer, { "MapBuffer", NULL } },
                 { (PRFuncPtr*) &mSymbols.fUnmapBuffer, { "UnmapBuffer", NULL } },
+                { (PRFuncPtr*) &mSymbols.fPointParameterf, { "PointParameterf", NULL } },
                 { NULL, { NULL } },
             };
 

gfx/gl/GLContext.h

@@ -2453,6 +2453,12 @@ public:
         AFTER_GL_CALL;
     }
 
+    void fPointParameterf(GLenum pname, GLfloat param) {
+        BEFORE_GL_CALL;
+        mSymbols.fPointParameterf(pname, param);
+        AFTER_GL_CALL;
+    }
+
     void fPolygonOffset(GLfloat factor, GLfloat bias) {
         BEFORE_GL_CALL;
         mSymbols.fPolygonOffset(factor, bias);

gfx/gl/GLContextSymbols.h

@@ -163,6 +163,8 @@ struct GLContextSymbols
     PFNGLLINKPROGRAMPROC fLinkProgram;
     typedef void (GLAPIENTRY * PFNGLPIXELSTOREIPROC) (GLenum pname, GLint param);
     PFNGLPIXELSTOREIPROC fPixelStorei;
+    typedef void (GLAPIENTRY * PFNGLPOINTPARAMETERFPROC) (GLenum pname, GLfloat param);
+    PFNGLPOINTPARAMETERFPROC fPointParameterf;
     typedef void (GLAPIENTRY * PFNGLPOLYGONOFFSETPROC) (GLfloat factor, GLfloat bias);
     PFNGLPOLYGONOFFSETPROC fPolygonOffset;
     typedef void (GLAPIENTRY * PFNGLREADBUFFERPROC) (GLenum);

gfx/thebes/gfxASurface.cpp

@@ -642,7 +642,7 @@ gfxASurface::RecordMemoryFreed()
     }
 }
 
-#ifdef MOZ_DUMP_PAINTING
+#ifdef MOZ_DUMP_IMAGES
 void
 gfxASurface::WriteAsPNG(const char* aFile)
 {
@@ -791,6 +791,20 @@ gfxASurface::WriteAsPNG_internal(FILE* aFile, bool aBinary)
   string.Append(encodedImg);
 
   if (aFile) {
+#ifdef ANDROID
+     if (aFile == stdout || aFile == stderr) {
+       // ADB logcat cuts off long strings so we will break it down
+       const char* cStr = string.BeginReading();
+       size_t len = strlen(cStr);
+       while (true) {
+         printf_stderr("IMG: %.140s\n", cStr);
+         if (len <= 140)
+           break;
+         len -= 140;
+         cStr += 140;
+       }
+     }
+#endif
     fprintf(aFile, "%s", string.BeginReading());
   } else {
     nsCOMPtr<nsIClipboardHelper> clipboard(do_GetService("@mozilla.org/widget/clipboardhelper;1", &rv));

gfx/thebes/gfxASurface.h

@@ -6,6 +6,10 @@
 #ifndef GFX_ASURFACE_H
 #define GFX_ASURFACE_H
 
+#ifdef MOZ_DUMP_PAINTING
+ #define MOZ_DUMP_IMAGES
+#endif
+
 #include "gfxTypes.h"
 #include "gfxRect.h"
 #include "nsAutoPtr.h"
@@ -213,7 +217,7 @@ public:
 
     virtual const gfxIntSize GetSize() const { return gfxIntSize(-1, -1); }
 
-#ifdef MOZ_DUMP_PAINTING
+#ifdef MOZ_DUMP_IMAGES
     /**
      * Debug functions to encode the current image as a PNG and export it.
      */

js/src/jsapi.cpp

@@ -3397,7 +3397,7 @@ JS_DeepFreezeObject(JSContext *cx, JSObject *obj_)
 
 static JSBool
 LookupPropertyById(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
-                   MutableHandleObject objp, JSProperty **propp)
+                   MutableHandleObject objp, MutableHandleShape propp)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
@@ -3411,17 +3411,15 @@ LookupPropertyById(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
 
 static JSBool
 LookupResult(JSContext *cx, HandleObject obj, HandleObject obj2, jsid id,
-             JSProperty* prop, Value *vp)
+             HandleShape shape, Value *vp)
 {
-    if (!prop) {
+    if (!shape) {
         /* XXX bad API: no way to tell "not defined" from "void value" */
         vp->setUndefined();
         return JS_TRUE;
     }
 
     if (obj2->isNative()) {
-        Shape *shape = (Shape *) prop;
-
         /* Peek at the native property's slot value, without doing a Get. */
         if (shape->hasSlot()) {
             *vp = obj2->nativeGetSlot(shape->slot());
@@ -3452,7 +3450,7 @@ JS_LookupPropertyById(JSContext *cx, JSObject *obj_, jsid id_, jsval *vp)
     RootedId id(cx, id_);
     RootedObject obj(cx, obj_);
     RootedObject obj2(cx);
-    JSProperty* prop;
+    RootedShape prop(cx);
 
     return LookupPropertyById(cx, obj, id, JSRESOLVE_QUALIFIED, &obj2, &prop) &&
            LookupResult(cx, obj, obj2, id, prop, vp);
@@ -3490,7 +3488,7 @@ JS_LookupPropertyWithFlagsById(JSContext *cx, JSObject *obj_, jsid id_, unsigned
     RootedObject obj(cx, obj_);
     RootedObject objp(cx, *objp_);
     RootedId id(cx, id_);
-    JSProperty* prop;
+    RootedShape prop(cx);
 
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
@@ -3521,7 +3519,7 @@ JS_HasPropertyById(JSContext *cx, JSObject *obj_, jsid id_, JSBool *foundp)
     RootedObject obj(cx, obj_);
     RootedId id(cx, id_);
     RootedObject obj2(cx);
-    JSProperty* prop;
+    RootedShape prop(cx);
     JSBool ok = LookupPropertyById(cx, obj, id, JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
                                    &obj2, &prop);
     *foundp = (prop != NULL);
@@ -3566,7 +3564,7 @@ JS_AlreadyHasOwnPropertyById(JSContext *cx, JSObject *obj_, jsid id_, JSBool *fo
 
     if (!obj->isNative()) {
         RootedObject obj2(cx);
-        JSProperty *prop;
+        RootedShape prop(cx);
 
         if (!LookupPropertyById(cx, obj, id, JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
                                 &obj2, &prop)) {
@@ -3838,12 +3836,12 @@ GetPropertyDescriptorById(JSContext *cx, HandleObject obj, HandleId id, unsigned
                           JSBool own, PropertyDescriptor *desc)
 {
     RootedObject obj2(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
 
-    if (!LookupPropertyById(cx, obj, id, flags, &obj2, &prop))
+    if (!LookupPropertyById(cx, obj, id, flags, &obj2, &shape))
         return JS_FALSE;
 
-    if (!prop || (own && obj != obj2)) {
+    if (!shape || (own && obj != obj2)) {
         desc->obj = NULL;
         desc->attrs = 0;
         desc->getter = NULL;
@@ -3854,7 +3852,6 @@ GetPropertyDescriptorById(JSContext *cx, HandleObject obj, HandleId id, unsigned
 
     desc->obj = obj2;
     if (obj2->isNative()) {
-        Shape *shape = (Shape *) prop;
         desc->attrs = shape->attributes();
         desc->getter = shape->getter();
         desc->setter = shape->setter();
@@ -3963,15 +3960,14 @@ static JSBool
 SetPropertyAttributesById(JSContext *cx, HandleObject obj, HandleId id, unsigned attrs, JSBool *foundp)
 {
     RootedObject obj2(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
 
-    if (!LookupPropertyById(cx, obj, id, JSRESOLVE_QUALIFIED, &obj2, &prop))
+    if (!LookupPropertyById(cx, obj, id, JSRESOLVE_QUALIFIED, &obj2, &shape))
         return false;
-    if (!prop || obj != obj2) {
+    if (!shape || obj != obj2) {
         *foundp = false;
         return true;
     }
-    Shape *shape = (Shape *) prop;
     JSBool ok = obj->isNative()
                 ? obj->changePropertyAttributes(cx, shape, attrs)
                 : obj->setGenericAttributes(cx, id, &attrs);

js/src/jsarray.cpp

@@ -347,7 +347,7 @@ DoGetElement(JSContext *cx, JSObject *obj_, double index, JSBool *hole, Value *v
     }
 
     RootedObject obj2(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     if (!obj->lookupGeneric(cx, id, &obj2, &prop))
         return JS_FALSE;
     if (!prop) {
@@ -692,14 +692,14 @@ IsDenseArrayId(JSContext *cx, JSObject *obj, jsid id)
 }
 
 static JSBool
-array_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
+array_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                    JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     if (!obj->isDenseArray())
         return baseops::LookupProperty(cx, obj, id, objp, propp);
 
     if (IsDenseArrayId(cx, obj, id)) {
-        *propp = (JSProperty *) 1;  /* non-null to indicate found */
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(obj);
         return JS_TRUE;
     }
@@ -707,7 +707,7 @@ array_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleO
     JSObject *proto = obj->getProto();
     if (!proto) {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
         return JS_TRUE;
     }
     return proto->lookupGeneric(cx, id, objp, propp);
@@ -715,21 +715,21 @@ array_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleO
 
 static JSBool
 array_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                     MutableHandleObject objp, JSProperty **propp)
+                     MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return array_lookupGeneric(cx, obj, id, objp, propp);
 }
 
 static JSBool
-array_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleObject objp,
+array_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                    JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     if (!obj->isDenseArray())
         return baseops::LookupElement(cx, obj, index, objp, propp);
 
     if (IsDenseArrayIndex(obj, index)) {
-        *propp = (JSProperty *) 1;  /* non-null to indicate found */
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(obj);
         return true;
     }
@@ -738,13 +738,13 @@ array_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHand
         return proto->lookupElement(cx, index, objp, propp);
 
     objp.set(NULL);
-    *propp = NULL;
+    propp.set(NULL);
     return true;
 }
 
 static JSBool
-array_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, MutableHandleObject objp,
+array_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                    JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return array_lookupGeneric(cx, obj, id, objp, propp);

js/src/jsclass.h

@@ -149,17 +149,17 @@ typedef JS::Handle<SpecialId> HandleSpecialId;
 /* js::Class operation signatures. */
 
 typedef JSBool
-(* LookupGenericOp)(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
+(* LookupGenericOp)(JSContext *cx, HandleObject obj, HandleId id,
-                    JSProperty **propp);
+                    MutableHandleObject objp, MutableHandleShape propp);
 typedef JSBool
-(* LookupPropOp)(JSContext *cx, HandleObject obj, HandlePropertyName name, MutableHandleObject objp,
+(* LookupPropOp)(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                 JSProperty **propp);
+                 MutableHandleObject objp, MutableHandleShape propp);
 typedef JSBool
-(* LookupElementOp)(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleObject objp,
+(* LookupElementOp)(JSContext *cx, HandleObject obj, uint32_t index,
-                    JSProperty **propp);
+                    MutableHandleObject objp, MutableHandleShape propp);
 typedef JSBool
-(* LookupSpecialOp)(JSContext *cx, HandleObject obj, HandleSpecialId sid, MutableHandleObject objp,
+(* LookupSpecialOp)(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                    JSProperty **propp);
+                    MutableHandleObject objp, MutableHandleShape propp);
 typedef JSBool
 (* DefineGenericOp)(JSContext *cx, HandleObject obj, HandleId id, const Value *value,
                     PropertyOp getter, StrictPropertyOp setter, unsigned attrs);

js/src/jsclone.cpp

@@ -559,7 +559,7 @@ JSStructuredCloneWriter::write(const Value &v)
                  * NativeIterators.
                  */
                 RootedObject obj2(context());
-                JSProperty *prop;
+                RootedShape prop(context());
                 if (!js_HasOwnProperty(context(), obj->getOps()->lookupGeneric, obj, id,
                                        &obj2, &prop)) {
                     return false;

js/src/jsinterp.cpp

@@ -954,7 +954,7 @@ js::AssertValidPropertyCacheHit(JSContext *cx, JSObject *start_,
 
     RootedObject obj(cx);
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     JSBool ok;
 
     if (JOF_OPMODE(*pc) == JOF_NAME)
@@ -967,9 +967,7 @@ js::AssertValidPropertyCacheHit(JSContext *cx, JSObject *start_,
         JS_PROPERTY_CACHE(cx).restore(&savedEntry);
     JS_ASSERT(prop);
     JS_ASSERT(pobj == found);
-
+    JS_ASSERT(entry->prop == prop);
-    Shape *shape = (Shape *) prop;
-    JS_ASSERT(entry->prop == shape);
 }
 #endif /* DEBUG && !JS_THREADSAFE */
 
@@ -1281,6 +1279,7 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
     RootedTypeObject rootType0(cx);
     RootedPropertyName rootName0(cx);
     RootedId rootId0(cx);
+    RootedShape rootShape0(cx);
 
     if (rt->profilingScripts)
         ENABLE_INTERRUPTS();
@@ -1746,7 +1745,7 @@ BEGIN_CASE(JSOP_IN)
     RootedId &id = rootId0;
     FETCH_ELEMENT_ID(obj, -2, id);
     RootedObject &obj2 = rootObject1;
-    JSProperty *prop;
+    RootedShape &prop = rootShape0;
     if (!obj->lookupGeneric(cx, id, &obj2, &prop))
         goto error;
     bool cond = prop != NULL;
@@ -2206,7 +2205,7 @@ BEGIN_CASE(JSOP_DELNAME)
 
     RootedObject &obj = rootObject1;
     RootedObject &obj2 = rootObject2;
-    JSProperty *prop;
+    RootedShape &prop = rootShape0;
     if (!FindProperty(cx, name, scopeObj, &obj, &obj2, &prop))
         goto error;
 
@@ -2553,7 +2552,7 @@ BEGIN_CASE(JSOP_IMPLICITTHIS)
 
     RootedObject &obj = rootObject1;
     RootedObject &obj2 = rootObject2;
-    JSProperty *prop;
+    RootedShape &prop = rootShape0;
     if (!FindPropertyHelper(cx, name, false, scopeObj, &obj, &obj2, &prop))
         goto error;
 
@@ -2920,9 +2919,9 @@ BEGIN_CASE(JSOP_DEFFUN)
     /* ES5 10.5 (NB: with subsequent errata). */
     RootedPropertyName &name = rootName0;
     name = fun->atom->asPropertyName();
-    JSProperty *prop = NULL;
+    RootedShape &shape = rootShape0;
     RootedObject &pobj = rootObject1;
-    if (!parent->lookupProperty(cx, name, &pobj, &prop))
+    if (!parent->lookupProperty(cx, name, &pobj, &shape))
         goto error;
 
     RootedValue &rval = rootValue0;
@@ -2930,7 +2929,7 @@ BEGIN_CASE(JSOP_DEFFUN)
 
     do {
         /* Steps 5d, 5f. */
-        if (!prop || pobj != parent) {
+        if (!shape || pobj != parent) {
             if (!parent->defineProperty(cx, name, rval,
                                         JS_PropertyStub, JS_StrictPropertyStub, attrs))
             {
@@ -2941,7 +2940,6 @@ BEGIN_CASE(JSOP_DEFFUN)
 
         /* Step 5e. */
         JS_ASSERT(parent->isNative());
-        Shape *shape = reinterpret_cast<Shape *>(prop);
         if (parent->isGlobal()) {
             if (shape->configurable()) {
                 if (!parent->defineProperty(cx, name, rval,

js/src/jsinterpinlines.h

@@ -385,10 +385,10 @@ NameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, Value *vp)
         return true;
     }
 
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!FindPropertyHelper(cx, name, true, obj, &obj, &obj2, &prop))
+    if (!FindPropertyHelper(cx, name, true, obj, &obj, &obj2, &shape))
         return false;
-    if (!prop) {
+    if (!shape) {
         /* Kludge to allow (typeof foo == "undefined") tests. */
         JSOp op2 = JSOp(pc[JSOP_NAME_LENGTH]);
         if (op2 == JSOP_TYPEOF) {
@@ -401,13 +401,12 @@ NameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, Value *vp)
         return false;
     }
 
-    /* Take the slow path if prop was not found in a native object. */
+    /* Take the slow path if shape was not found in a native object. */
     if (!obj->isNative() || !obj2->isNative()) {
         Rooted<jsid> id(cx, NameToId(name));
         if (!obj->getGeneric(cx, id, vp))
             return false;
     } else {
-        Shape *shape = (Shape *)prop;
         Rooted<JSObject*> normalized(cx, obj);
         if (normalized->getClass() == &WithClass && !shape->hasDefaultGetter())
             normalized = &normalized->asWith().object();
@@ -424,7 +423,7 @@ DefVarOrConstOperation(JSContext *cx, HandleObject varobj, PropertyName *dn, uns
     JS_ASSERT(varobj->isVarObj());
     JS_ASSERT(!varobj->getOps()->defineProperty || varobj->isDebugScope());
 
-    JSProperty *prop;
+    RootedShape prop(cx);
     RootedObject obj2(cx);
     if (!varobj->lookupProperty(cx, dn, &obj2, &prop))
         return false;

js/src/jsiter.cpp

@@ -993,7 +993,7 @@ SuppressDeletedPropertyHelper(JSContext *cx, HandleObject obj, StringPredicate p
                     if (obj->getProto()) {
                         JSObject *proto = obj->getProto();
                         RootedObject obj2(cx);
-                        JSProperty *prop;
+                        RootedShape prop(cx);
                         RootedId id(cx);
                         if (!ValueToId(cx, StringValue(*idp), id.address()))
                             return false;
@@ -1002,7 +1002,7 @@ SuppressDeletedPropertyHelper(JSContext *cx, HandleObject obj, StringPredicate p
                         if (prop) {
                             unsigned attrs;
                             if (obj2->isNative())
-                                attrs = ((Shape *) prop)->attributes();
+                                attrs = prop->attributes();
                             else if (!obj2->getGenericAttributes(cx, id, &attrs))
                                 return false;
 

js/src/jsobj.cpp

@@ -179,7 +179,7 @@ MarkSharpObjects(JSContext *cx, HandleObject obj, JSIdArray **idap, JSSharpInfo
         for (int i = 0, length = ida->length; i < length; i++) {
             id = ida->vector[i];
             RootedObject obj2(cx);
-            JSProperty *prop;
+            RootedShape prop(cx);
             ok = obj->lookupGeneric(cx, id, &obj2, &prop);
             if (!ok)
                 break;
@@ -460,7 +460,7 @@ obj_toSource(JSContext *cx, unsigned argc, Value *vp)
         JSLinearString *idstr;
 
         RootedObject obj2(cx);
-        JSProperty *prop;
+        RootedShape prop(cx);
         if (!obj->lookupGeneric(cx, id, &obj2, &prop))
             return false;
 
@@ -807,7 +807,7 @@ js_HasOwnPropertyHelper(JSContext *cx, LookupGenericOp lookup, unsigned argc,
     if (!obj)
         return false;
     RootedObject obj2(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     if (obj->isProxy()) {
         bool has;
         if (!Proxy::hasOwn(cx, obj, id, &has))
@@ -823,7 +823,7 @@ js_HasOwnPropertyHelper(JSContext *cx, LookupGenericOp lookup, unsigned argc,
 
 JSBool
 js_HasOwnProperty(JSContext *cx, LookupGenericOp lookup, HandleObject obj, HandleId id,
-                  MutableHandleObject objp, JSProperty **propp)
+                  MutableHandleObject objp, MutableHandleShape propp)
 {
     JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING);
     if (lookup) {
@@ -833,7 +833,7 @@ js_HasOwnProperty(JSContext *cx, LookupGenericOp lookup, HandleObject obj, Handl
         if (!baseops::LookupProperty(cx, obj, id, objp, propp))
             return false;
     }
-    if (!*propp)
+    if (!propp)
         return true;
 
     if (objp == obj)
@@ -848,7 +848,7 @@ js_HasOwnProperty(JSContext *cx, LookupGenericOp lookup, HandleObject obj, Handl
     }
 
     if (outer != objp)
-        *propp = NULL;
+        propp.set(NULL);
     return true;
 }
 
@@ -894,7 +894,7 @@ JSBool
 js_PropertyIsEnumerable(JSContext *cx, HandleObject obj, HandleId id, Value *vp)
 {
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     if (!obj->lookupGeneric(cx, id, &pobj, &prop))
         return false;
 
@@ -1004,13 +1004,12 @@ obj_lookupGetter(JSContext *cx, unsigned argc, Value *vp)
         return JS_TRUE;
     }
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!obj->lookupGeneric(cx, id, &pobj, &prop))
+    if (!obj->lookupGeneric(cx, id, &pobj, &shape))
         return JS_FALSE;
     vp->setUndefined();
-    if (prop) {
+    if (shape) {
         if (pobj->isNative()) {
-            Shape *shape = (Shape *) prop;
             if (shape->hasGetterValue())
                 *vp = shape->getterValue();
         }
@@ -1039,13 +1038,12 @@ obj_lookupSetter(JSContext *cx, unsigned argc, Value *vp)
         return JS_TRUE;
     }
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!obj->lookupGeneric(cx, id, &pobj, &prop))
+    if (!obj->lookupGeneric(cx, id, &pobj, &shape))
         return JS_FALSE;
     vp->setUndefined();
-    if (prop) {
+    if (shape) {
         if (pobj->isNative()) {
-            Shape *shape = (Shape *) prop;
             if (shape->hasSetterValue())
                 *vp = shape->setterValue();
         }
@@ -1171,17 +1169,16 @@ GetOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id, PropertyD
         return Proxy::getOwnPropertyDescriptor(cx, obj, id, false, desc);
 
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!js_HasOwnProperty(cx, obj->getOps()->lookupGeneric, obj, id, &pobj, &prop))
+    if (!js_HasOwnProperty(cx, obj->getOps()->lookupGeneric, obj, id, &pobj, &shape))
         return false;
-    if (!prop) {
+    if (!shape) {
         desc->obj = NULL;
         return true;
     }
 
     bool doGet = true;
     if (pobj->isNative()) {
-        Shape *shape = (Shape *) prop;
         desc->attrs = shape->attributes();
         if (desc->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
             doGet = false;
@@ -1509,16 +1506,16 @@ DefinePropertyOnObject(JSContext *cx, HandleObject obj, HandleId id, const PropD
                        bool throwError, bool *rval)
 {
     /* 8.12.9 step 1. */
-    JSProperty *current;
+    RootedShape shape(cx);
     RootedObject obj2(cx);
     JS_ASSERT(!obj->getOps()->lookupGeneric);
-    if (!js_HasOwnProperty(cx, NULL, obj, id, &obj2, &current))
+    if (!js_HasOwnProperty(cx, NULL, obj, id, &obj2, &shape))
         return JS_FALSE;
 
     JS_ASSERT(!obj->getOps()->defineProperty);
 
     /* 8.12.9 steps 2-4. */
-    if (!current) {
+    if (!shape) {
         if (!obj->isExtensible())
             return Reject(cx, obj, JSMSG_OBJECT_NOT_EXTENSIBLE, throwError, rval);
 
@@ -1553,7 +1550,6 @@ DefinePropertyOnObject(JSContext *cx, HandleObject obj, HandleId id, const PropD
 
     JS_ASSERT(obj == obj2);
 
-    Rooted<Shape *> shape(cx, reinterpret_cast<Shape *>(current));
     do {
         if (desc.isAccessorDescriptor()) {
             if (!shape->isAccessorDescriptor())
@@ -3857,9 +3853,6 @@ js_FindClassObject(JSContext *cx, HandleObject start, JSProtoKey protoKey,
                    MutableHandleValue vp, Class *clasp)
 {
     RootedId id(cx);
-    JSProperty *prop;
-    Shape *shape;
-
     RootedObject obj(cx);
 
     if (start) {
@@ -3891,11 +3884,11 @@ js_FindClassObject(JSContext *cx, HandleObject start, JSProtoKey protoKey,
 
     JS_ASSERT(obj->isNative());
     RootedObject pobj(cx);
-    if (!LookupPropertyWithFlags(cx, obj, id, 0, &pobj, &prop))
+    RootedShape shape(cx);
+    if (!LookupPropertyWithFlags(cx, obj, id, 0, &pobj, &shape))
         return false;
     RootedValue v(cx, UndefinedValue());
-    if (prop && pobj->isNative()) {
+    if (shape && pobj->isNative()) {
-        shape = (Shape *) prop;
         if (shape->hasSlot()) {
             v = pobj->nativeGetSlot(shape->slot());
             if (v.get().isPrimitive())
@@ -4115,8 +4108,6 @@ DefineNativeProperty(JSContext *cx, HandleObject obj, HandleId id, const Value &
      */
     RootedShape shape(cx);
     if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
-        JSProperty *prop;
-
         /* Type information for getter/setter properties is unknown. */
         AddTypePropertyId(cx, obj, id, types::Type::UnknownType());
         MarkTypePropertyConfigured(cx, obj, id);
@@ -4127,10 +4118,11 @@ DefineNativeProperty(JSContext *cx, HandleObject obj, HandleId id, const Value &
          * property cache line for (obj, id) to map shape.
          */
         RootedObject pobj(cx);
+        RootedShape prop(cx);
         if (!baseops::LookupProperty(cx, obj, id, &pobj, &prop))
             return NULL;
         if (prop && pobj == obj) {
-            shape = (Shape *) prop;
+            shape = prop;
             if (shape->isAccessorDescriptor()) {
                 shape = obj->changeProperty(cx, shape, attrs,
                                             JSPROP_GETTER | JSPROP_SETTER,
@@ -4218,7 +4210,7 @@ DefineNativeProperty(JSContext *cx, HandleObject obj, HandleId id, const Value &
  */
 static JSBool
 CallResolveOp(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
-              MutableHandleObject objp, JSProperty **propp, bool *recursedp)
+              MutableHandleObject objp, MutableHandleShape propp, bool *recursedp)
 {
     Class *clasp = obj->getClass();
     JSResolveOp resolve = clasp->resolve;
@@ -4239,7 +4231,7 @@ CallResolveOp(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
     }
     *recursedp = false;
 
-    *propp = NULL;
+    propp.set(NULL);
 
     if (clasp->flags & JSCLASS_NEW_RESOLVE) {
         JSNewResolveOp newresolve = reinterpret_cast<JSNewResolveOp>(resolve);
@@ -4273,7 +4265,7 @@ CallResolveOp(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
     if (!obj->nativeEmpty()) {
         if (Shape *shape = obj->nativeLookup(cx, id)) {
             objp.set(obj);
-            *propp = (JSProperty *) shape;
+            propp.set(shape);
         }
     }
 
@@ -4282,7 +4274,7 @@ CallResolveOp(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
 
 static JS_ALWAYS_INLINE bool
 LookupPropertyWithFlagsInline(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
-                              MutableHandleObject objp, JSProperty **propp)
+                              MutableHandleObject objp, MutableHandleShape propp)
 {
     /* Search scopes starting with obj and following the prototype link. */
     RootedObject current(cx, obj);
@@ -4290,7 +4282,7 @@ LookupPropertyWithFlagsInline(JSContext *cx, HandleObject obj, HandleId id, unsi
         Shape *shape = current->nativeLookup(cx, id);
         if (shape) {
             objp.set(current);
-            *propp = (JSProperty *) shape;
+            propp.set(shape);
             return true;
         }
 
@@ -4301,7 +4293,7 @@ LookupPropertyWithFlagsInline(JSContext *cx, HandleObject obj, HandleId id, unsi
                 return false;
             if (recursed)
                 break;
-            if (*propp) {
+            if (propp) {
                 /*
                  * For stats we do not recalculate protoIndex even if it was
                  * resolved on some other object.
@@ -4326,7 +4318,7 @@ LookupPropertyWithFlagsInline(JSContext *cx, HandleObject obj, HandleId id, unsi
              * arguments.callee through the delegating |this| object's method
              * read barrier.
              */
-            if (*propp && objp->isNative()) {
+            if (propp && objp->isNative()) {
                 while ((proto = proto->getProto()) != objp)
                     JS_ASSERT(proto);
             }
@@ -4338,20 +4330,20 @@ LookupPropertyWithFlagsInline(JSContext *cx, HandleObject obj, HandleId id, unsi
     }
 
     objp.set(NULL);
-    *propp = NULL;
+    propp.set(NULL);
     return true;
 }
 
 JS_FRIEND_API(JSBool)
 baseops::LookupProperty(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
-                        JSProperty **propp)
+                        MutableHandleShape propp)
 {
     return LookupPropertyWithFlagsInline(cx, obj, id, cx->resolveFlags, objp, propp);
 }
 
 JS_FRIEND_API(JSBool)
 baseops::LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                       MutableHandleObject objp, JSProperty **propp)
+                       MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
     if (!IndexToId(cx, index, id.address()))
@@ -4362,7 +4354,7 @@ baseops::LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
 
 bool
 js::LookupPropertyWithFlags(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
-                            MutableHandleObject objp, JSProperty **propp)
+                            MutableHandleObject objp, MutableHandleShape propp)
 {
     return LookupPropertyWithFlagsInline(cx, obj, id, flags, objp, propp);
 }
@@ -4370,13 +4362,14 @@ js::LookupPropertyWithFlags(JSContext *cx, HandleObject obj, HandleId id, unsign
 bool
 js::FindPropertyHelper(JSContext *cx,
                        HandlePropertyName name, bool cacheResult, HandleObject scopeChain,
-                       MutableHandleObject objp, MutableHandleObject pobjp, JSProperty **propp)
+                       MutableHandleObject objp, MutableHandleObject pobjp,
+                       MutableHandleShape propp)
 {
     RootedId id(cx, NameToId(name));
 
     RootedObject pobj(cx);
     int scopeIndex;
-    JSProperty *prop;
+    RootedShape prop(cx);
 
     /* Scan entries on the scope chain that we can cache across. */
     RootedObject obj(cx, scopeChain);
@@ -4416,8 +4409,7 @@ js::FindPropertyHelper(JSContext *cx,
              * non-native prototype.
              */
             if (cacheResult && pobj->isNative()) {
-                JS_PROPERTY_CACHE(cx).fill(cx, scopeChain, scopeIndex, pobj,
+                JS_PROPERTY_CACHE(cx).fill(cx, scopeChain, scopeIndex, pobj, prop);
-                                           (Shape *) prop);
             }
 
             goto out;
@@ -4453,7 +4445,7 @@ js::FindPropertyHelper(JSContext *cx,
     JS_ASSERT(!!pobj == !!prop);
     objp.set(obj);
     pobjp.set(pobj);
-    *propp = prop;
+    propp.set(prop);
     return true;
 }
 
@@ -4463,7 +4455,7 @@ js::FindPropertyHelper(JSContext *cx,
  */
 bool
 js::FindProperty(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
-                 MutableHandleObject objp, MutableHandleObject pobjp, JSProperty **propp)
+                 MutableHandleObject objp, MutableHandleObject pobjp, MutableHandleShape propp)
 {
     return !!FindPropertyHelper(cx, name, false, scopeChain, objp, pobjp, propp);
 }
@@ -4493,16 +4485,16 @@ js::FindIdentifierBase(JSContext *cx, HandleObject scopeChain, HandlePropertyNam
          scopeIndex++)
     {
         RootedObject pobj(cx);
-        JSProperty *prop;
+        RootedShape shape(cx);
-        if (!LookupPropertyWithFlags(cx, obj, name, cx->resolveFlags, &pobj, &prop))
+        if (!LookupPropertyWithFlags(cx, obj, name, cx->resolveFlags, &pobj, &shape))
             return NULL;
-        if (prop) {
+        if (shape) {
             if (!pobj->isNative()) {
                 JS_ASSERT(obj->isGlobal());
                 return obj;
             }
             JS_ASSERT_IF(obj->isScope(), pobj->getClass() == obj->getClass());
-            JS_PROPERTY_CACHE(cx).fill(cx, scopeChain, scopeIndex, pobj, (Shape *) prop);
+            JS_PROPERTY_CACHE(cx).fill(cx, scopeChain, scopeIndex, pobj, shape);
             return obj;
         }
 
@@ -4515,10 +4507,10 @@ js::FindIdentifierBase(JSContext *cx, HandleObject scopeChain, HandlePropertyNam
     /* Loop until we find a property or reach the global object. */
     do {
         RootedObject pobj(cx);
-        JSProperty *prop;
+        RootedShape shape(cx);
-        if (!obj->lookupProperty(cx, name, &pobj, &prop))
+        if (!obj->lookupProperty(cx, name, &pobj, &shape))
             return NULL;
-        if (prop)
+        if (shape)
             break;
 
         /*
@@ -4629,16 +4621,15 @@ static JS_ALWAYS_INLINE JSBool
 js_GetPropertyHelperInline(JSContext *cx, HandleObject obj, HandleObject receiver, jsid id_,
                            uint32_t getHow, Value *vp)
 {
-    JSProperty *prop;
-
     RootedId id(cx, id_);
 
     /* This call site is hot -- use the always-inlined variant of LookupPropertyWithFlags(). */
     RootedObject obj2(cx);
-    if (!LookupPropertyWithFlagsInline(cx, obj, id, cx->resolveFlags, &obj2, &prop))
+    RootedShape shape(cx);
+    if (!LookupPropertyWithFlagsInline(cx, obj, id, cx->resolveFlags, &obj2, &shape))
         return false;
 
-    if (!prop) {
+    if (!shape) {
         vp->setUndefined();
 
         if (!CallJSPropertyOp(cx, obj->getClass()->getProperty, obj, id, vp))
@@ -4706,8 +4697,6 @@ js_GetPropertyHelperInline(JSContext *cx, HandleObject obj, HandleObject receive
                : obj2->getGeneric(cx, id, vp);
     }
 
-    Shape *shape = (Shape *) prop;
-
     if (getHow & JSGET_CACHE_RESULT)
         JS_PROPERTY_CACHE(cx).fill(cx, obj, 0, obj2, shape);
 
@@ -4745,7 +4734,7 @@ baseops::GetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint
 JSBool
 baseops::GetPropertyDefault(JSContext *cx, HandleObject obj, HandleId id, const Value &def, Value *vp)
 {
-    JSProperty *prop;
+    RootedShape prop(cx);
     RootedObject obj2(cx);
     if (!LookupPropertyWithFlags(cx, obj, id, JSRESOLVE_QUALIFIED, &obj2, &prop))
         return false;
@@ -4836,7 +4825,6 @@ JSBool
 baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
                            unsigned defineHow, Value *vp, JSBool strict)
 {
-    JSProperty *prop;
     unsigned attrs, flags;
     int shortid;
     Class *clasp;
@@ -4854,9 +4842,10 @@ baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receive
     }
 
     RootedObject pobj(cx);
-    if (!LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags, &pobj, &prop))
+    RootedShape shape(cx);
+    if (!LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags, &pobj, &shape))
         return false;
-    if (prop) {
+    if (shape) {
         if (!pobj->isNative()) {
             if (pobj->isProxy()) {
                 AutoPropertyDescriptorRooter pd(cx);
@@ -4878,7 +4867,7 @@ baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receive
                 }
             }
 
-            prop = NULL;
+            shape = NULL;
         }
     } else {
         /* We should never add properties to lexical blocks. */
@@ -4891,8 +4880,6 @@ baseops::SetPropertyHelper(JSContext *cx, HandleObject obj, HandleObject receive
         }
     }
 
-    RootedShape shape(cx, (Shape *) prop);
-
     /*
      * Now either shape is null, meaning id was not found in obj or one of its
      * prototypes; or shape is non-null, meaning id was found directly in pobj.
@@ -5032,17 +5019,16 @@ JSBool
 baseops::GetAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp)
 {
     RootedObject nobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!baseops::LookupProperty(cx, obj, id, &nobj, &prop))
+    if (!baseops::LookupProperty(cx, obj, id, &nobj, &shape))
         return false;
-    if (!prop) {
+    if (!shape) {
         *attrsp = 0;
         return true;
     }
     if (!nobj->isNative())
         return nobj->getGenericAttributes(cx, id, attrsp);
 
-    Shape *shape = (Shape *)prop;
     *attrsp = shape->attributes();
     return true;
 }
@@ -5051,17 +5037,16 @@ JSBool
 baseops::GetElementAttributes(JSContext *cx, HandleObject obj, uint32_t index, unsigned *attrsp)
 {
     RootedObject nobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!baseops::LookupElement(cx, obj, index, &nobj, &prop))
+    if (!baseops::LookupElement(cx, obj, index, &nobj, &shape))
         return false;
-    if (!prop) {
+    if (!shape) {
         *attrsp = 0;
         return true;
     }
     if (!nobj->isNative())
         return nobj->getElementAttributes(cx, index, attrsp);
 
-    Shape *shape = (Shape *)prop;
     *attrsp = shape->attributes();
     return true;
 }
@@ -5070,13 +5055,13 @@ JSBool
 baseops::SetAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp)
 {
     RootedObject nobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!baseops::LookupProperty(cx, obj, id, &nobj, &prop))
+    if (!baseops::LookupProperty(cx, obj, id, &nobj, &shape))
         return false;
-    if (!prop)
+    if (!shape)
         return true;
     return nobj->isNative()
-           ? nobj->changePropertyAttributes(cx, (Shape *) prop, *attrsp)
+           ? nobj->changePropertyAttributes(cx, shape, *attrsp)
            : nobj->setGenericAttributes(cx, id, attrsp);
 }
 
@@ -5084,28 +5069,26 @@ JSBool
 baseops::SetElementAttributes(JSContext *cx, HandleObject obj, uint32_t index, unsigned *attrsp)
 {
     RootedObject nobj(cx);
-    JSProperty *prop;
+    RootedShape shape(cx);
-    if (!baseops::LookupElement(cx, obj, index, &nobj, &prop))
+    if (!baseops::LookupElement(cx, obj, index, &nobj, &shape))
         return false;
-    if (!prop)
+    if (!shape)
         return true;
     return nobj->isNative()
-           ? nobj->changePropertyAttributes(cx, (Shape *) prop, *attrsp)
+           ? nobj->changePropertyAttributes(cx, shape, *attrsp)
            : nobj->setElementAttributes(cx, index, attrsp);
 }
 
 JSBool
 baseops::DeleteGeneric(JSContext *cx, HandleObject obj, HandleId id, Value *rval, JSBool strict)
 {
-    JSProperty *prop;
-    Shape *shape;
-
     rval->setBoolean(true);
 
     RootedObject proto(cx);
-    if (!baseops::LookupProperty(cx, obj, id, &proto, &prop))
+    RootedShape shape(cx);
+    if (!baseops::LookupProperty(cx, obj, id, &proto, &shape))
         return false;
-    if (!prop || proto != obj) {
+    if (!shape || proto != obj) {
         /*
          * If no property, or the property comes from a prototype, call the
          * class's delProperty hook, passing rval as the result parameter.
@@ -5113,7 +5096,6 @@ baseops::DeleteGeneric(JSContext *cx, HandleObject obj, HandleId id, Value *rval
         return CallJSPropertyOp(cx, obj->getClass()->delProperty, obj, id, rval);
     }
 
-    shape = (Shape *)prop;
     if (!shape->configurable()) {
         if (strict)
             return obj->reportNotConfigurable(cx, id);
@@ -5305,9 +5287,6 @@ CheckAccess(JSContext *cx, JSObject *obj_, HandleId id, JSAccessMode mode,
             Value *vp, unsigned *attrsp)
 {
     JSBool writing;
-    JSProperty *prop;
-    Shape *shape;
-
     RootedObject obj(cx, obj_), pobj(cx);
 
     while (JS_UNLIKELY(obj->isWith()))
@@ -5323,9 +5302,10 @@ CheckAccess(JSContext *cx, JSObject *obj_, HandleId id, JSAccessMode mode,
         break;
 
       default:
-        if (!obj->lookupGeneric(cx, id, &pobj, &prop))
+        RootedShape shape(cx);
+        if (!obj->lookupGeneric(cx, id, &pobj, &shape))
             return JS_FALSE;
-        if (!prop) {
+        if (!shape) {
             if (!writing)
                 vp->setUndefined();
             *attrsp = 0;
@@ -5341,7 +5321,6 @@ CheckAccess(JSContext *cx, JSObject *obj_, HandleId id, JSAccessMode mode,
             break;
         }
 
-        shape = (Shape *)prop;
         *attrsp = shape->attributes();
         if (!writing) {
             if (shape->hasSlot())

js/src/jsobj.h

@@ -99,11 +99,11 @@ namespace baseops {
  */
 extern JS_FRIEND_API(JSBool)
 LookupProperty(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
-               JSProperty **propp);
+               MutableHandleShape propp);
 
 inline bool
 LookupProperty(JSContext *cx, HandleObject obj, PropertyName *name,
-               MutableHandleObject objp, JSProperty **propp)
+               MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return LookupProperty(cx, obj, id, objp, propp);
@@ -111,7 +111,7 @@ LookupProperty(JSContext *cx, HandleObject obj, PropertyName *name,
 
 extern JS_FRIEND_API(JSBool)
 LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-              MutableHandleObject objp, JSProperty **propp);
+              MutableHandleObject objp, MutableHandleShape propp);
 
 extern JSBool
 DefineGeneric(JSContext *cx, HandleObject obj, HandleId id, const js::Value *value,
@@ -785,12 +785,14 @@ struct JSObject : public js::ObjectImpl
     /* Clear the scope, making it empty. */
     void clear(JSContext *cx);
 
-    inline JSBool lookupGeneric(JSContext *cx, js::HandleId id, js::MutableHandleObject objp, JSProperty **propp);
+    inline JSBool lookupGeneric(JSContext *cx, js::HandleId id,
-    inline JSBool lookupProperty(JSContext *cx, js::PropertyName *name, js::MutableHandleObject objp, JSProperty **propp);
+                                js::MutableHandleObject objp, js::MutableHandleShape propp);
+    inline JSBool lookupProperty(JSContext *cx, js::PropertyName *name,
+                                 js::MutableHandleObject objp, js::MutableHandleShape propp);
     inline JSBool lookupElement(JSContext *cx, uint32_t index,
-                                js::MutableHandleObject objp, JSProperty **propp);
+                                js::MutableHandleObject objp, js::MutableHandleShape propp);
     inline JSBool lookupSpecial(JSContext *cx, js::SpecialId sid,
-                                js::MutableHandleObject objp, JSProperty **propp);
+                                js::MutableHandleObject objp, js::MutableHandleShape propp);
 
     inline JSBool defineGeneric(JSContext *cx, js::HandleId id, const js::Value &value,
                                 JSPropertyOp getter = JS_PropertyStub,
@@ -1046,7 +1048,7 @@ js_HasOwnPropertyHelper(JSContext *cx, js::LookupGenericOp lookup, unsigned argc
 
 extern JSBool
 js_HasOwnProperty(JSContext *cx, js::LookupGenericOp lookup, js::HandleObject obj, js::HandleId id,
-                  js::MutableHandleObject objp, JSProperty **propp);
+                  js::MutableHandleObject objp, js::MutableHandleShape propp);
 
 extern JSBool
 js_PropertyIsEnumerable(JSContext *cx, js::HandleObject obj, js::HandleId id, js::Value *vp);
@@ -1165,11 +1167,11 @@ DefineNativeProperty(JSContext *cx, HandleObject obj, PropertyName *name, const
  */
 extern bool
 LookupPropertyWithFlags(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
-                        js::MutableHandleObject objp, JSProperty **propp);
+                        js::MutableHandleObject objp, js::MutableHandleShape propp);
 
 inline bool
 LookupPropertyWithFlags(JSContext *cx, HandleObject obj, PropertyName *name, unsigned flags,
-                        js::MutableHandleObject objp, JSProperty **propp)
+                        js::MutableHandleObject objp, js::MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return LookupPropertyWithFlags(cx, obj, id, flags, objp, propp);
@@ -1208,7 +1210,7 @@ static const unsigned RESOLVE_INFER = 0xffff;
 extern bool
 FindPropertyHelper(JSContext *cx, HandlePropertyName name,
                    bool cacheResult, HandleObject scopeChain,
-                   MutableHandleObject objp, MutableHandleObject pobjp, JSProperty **propp);
+                   MutableHandleObject objp, MutableHandleObject pobjp, MutableHandleShape propp);
 
 /*
  * Search for name either on the current scope chain or on the scope chain's
@@ -1216,7 +1218,7 @@ FindPropertyHelper(JSContext *cx, HandlePropertyName name,
  */
 extern bool
 FindProperty(JSContext *cx, HandlePropertyName name, HandleObject scopeChain,
-             MutableHandleObject objp, MutableHandleObject pobjp, JSProperty **propp);
+             MutableHandleObject objp, MutableHandleObject pobjp, MutableHandleShape propp);
 
 extern JSObject *
 FindIdentifierBase(JSContext *cx, HandleObject scopeChain, HandlePropertyName name);

js/src/jsobjinlines.h

@@ -927,7 +927,7 @@ inline bool
 JSObject::hasProperty(JSContext *cx, js::HandleId id, bool *foundp, unsigned flags)
 {
     js::RootedObject pobj(cx);
-    JSProperty *prop;
+    js::RootedShape prop(cx);
     JSAutoResolveFlags rf(cx, flags);
     if (!lookupGeneric(cx, id, &pobj, &prop))
         return false;
@@ -1034,7 +1034,8 @@ JSObject::sizeOfExcludingThis(JSMallocSizeOfFun mallocSizeOf,
 }
 
 inline JSBool
-JSObject::lookupGeneric(JSContext *cx, js::HandleId id, js::MutableHandleObject objp, JSProperty **propp)
+JSObject::lookupGeneric(JSContext *cx, js::HandleId id,
+                        js::MutableHandleObject objp, js::MutableHandleShape propp)
 {
     js::RootedObject self(cx, this);
 
@@ -1045,7 +1046,8 @@ JSObject::lookupGeneric(JSContext *cx, js::HandleId id, js::MutableHandleObject
 }
 
 inline JSBool
-JSObject::lookupProperty(JSContext *cx, js::PropertyName *name, js::MutableHandleObject objp, JSProperty **propp)
+JSObject::lookupProperty(JSContext *cx, js::PropertyName *name,
+                         js::MutableHandleObject objp, js::MutableHandleShape propp)
 {
     js::Rooted<jsid> id(cx, js::NameToId(name));
     return lookupGeneric(cx, id, objp, propp);
@@ -1097,7 +1099,8 @@ JSObject::defineSpecial(JSContext *cx, js::SpecialId sid, const js::Value &value
 }
 
 inline JSBool
-JSObject::lookupElement(JSContext *cx, uint32_t index, js::MutableHandleObject objp, JSProperty **propp)
+JSObject::lookupElement(JSContext *cx, uint32_t index,
+                        js::MutableHandleObject objp, js::MutableHandleShape propp)
 {
     js::RootedObject self(cx, this);
 
@@ -1106,7 +1109,8 @@ JSObject::lookupElement(JSContext *cx, uint32_t index, js::MutableHandleObject o
 }
 
 inline JSBool
-JSObject::lookupSpecial(JSContext *cx, js::SpecialId sid, js::MutableHandleObject objp, JSProperty **propp)
+JSObject::lookupSpecial(JSContext *cx, js::SpecialId sid,
+                        js::MutableHandleObject objp, js::MutableHandleShape propp)
 {
     js::Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return lookupGeneric(cx, id, objp, propp);
@@ -1154,7 +1158,7 @@ JSObject::getElementIfPresent(JSContext *cx, js::HandleObject receiver, uint32_t
         return false;
 
     js::RootedObject obj2(cx);
-    JSProperty *prop;
+    js::RootedShape prop(cx);
     if (!self->lookupGeneric(cx, id, &obj2, &prop))
         return false;
 

js/src/jsproxy.cpp

@@ -1221,34 +1221,34 @@ proxy_innerObject(JSContext *cx, HandleObject obj)
 }
 
 static JSBool
-proxy_LookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
+proxy_LookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                    JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     bool found;
     if (!Proxy::has(cx, obj, id, &found))
         return false;
 
     if (found) {
-        *propp = (JSProperty *)0x1;
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(obj);
     } else {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
     }
     return true;
 }
 
 static JSBool
 proxy_LookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                     MutableHandleObject objp, JSProperty **propp)
+                     MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return proxy_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static JSBool
-proxy_LookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleObject objp,
+proxy_LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                    JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
     if (!IndexToId(cx, index, id.address()))
@@ -1258,7 +1258,7 @@ proxy_LookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHand
 
 static JSBool
 proxy_LookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                    MutableHandleObject objp, JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return proxy_LookupGeneric(cx, obj, id, objp, propp);

js/src/jsprvtd.h

@@ -51,7 +51,6 @@ typedef struct JSArgumentFormatMap  JSArgumentFormatMap;
 typedef struct JSGCThing            JSGCThing;
 typedef struct JSGenerator          JSGenerator;
 typedef struct JSNativeEnumerator   JSNativeEnumerator;
-typedef struct JSProperty           JSProperty;
 typedef struct JSSharpObjectMap     JSSharpObjectMap;
 typedef struct JSTryNote            JSTryNote;
 
@@ -225,6 +224,8 @@ typedef JS::Handle<types::TypeObject*> HandleTypeObject;
 typedef JS::Handle<JSAtom*>            HandleAtom;
 typedef JS::Handle<PropertyName*>      HandlePropertyName;
 
+typedef JS::MutableHandle<Shape*>      MutableHandleShape;
+
 typedef JS::Rooted<Shape*>             RootedShape;
 typedef JS::Rooted<BaseShape*>         RootedBaseShape;
 typedef JS::Rooted<types::TypeObject*> RootedTypeObject;

js/src/jsscope.cpp

@@ -1393,3 +1393,16 @@ JSCompartment::sweepInitialShapeTable()
         }
     }
 }
+
+/*
+ * Property lookup hooks on non-native objects are required to return a non-NULL
+ * shape to signify that the property has been found. The actual shape returned
+ * is arbitrary, and it should never be read from. We use the non-native
+ * object's shape_ field, since it is readily available.
+ */
+void
+js::MarkNonNativePropertyFound(HandleObject obj, MutableHandleShape propp)
+{
+    propp.set(obj->lastProperty());
+}
+

js/src/jsscope.h

@@ -1162,6 +1162,9 @@ Shape::searchNoAllocation(JSContext *cx, Shape *start, jsid id)
 }
 #endif /* DEBUG */
 
+void
+MarkNonNativePropertyFound(HandleObject obj, MutableHandleShape propp);
+
 } // namespace js
 
 #ifdef _MSC_VER

js/src/jstypedarray.cpp

@@ -295,14 +295,12 @@ ArrayBufferObject::obj_trace(JSTracer *trc, JSObject *obj)
     }
 }
 
-static JSProperty * const PROPERTY_FOUND = reinterpret_cast<JSProperty *>(1);
-
 JSBool
 ArrayBufferObject::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                                     MutableHandleObject objp, JSProperty **propp)
+                                     MutableHandleObject objp, MutableHandleShape propp)
 {
     if (JSID_IS_ATOM(id, cx->runtime->atomState.byteLengthAtom)) {
-        *propp = PROPERTY_FOUND;
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(getArrayBuffer(obj));
         return true;
     }
@@ -321,7 +319,7 @@ ArrayBufferObject::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId i
     if (!delegateResult)
         return false;
 
-    if (*propp != NULL) {
+    if (propp) {
         if (objp == delegate)
             objp.set(obj);
         return true;
@@ -330,7 +328,7 @@ ArrayBufferObject::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId i
     JSObject *proto = obj->getProto();
     if (!proto) {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
         return true;
     }
 
@@ -339,7 +337,7 @@ ArrayBufferObject::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId i
 
 JSBool
 ArrayBufferObject::obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                                      MutableHandleObject objp, JSProperty **propp)
+                                      MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return obj_lookupGeneric(cx, obj, id, objp, propp);
@@ -347,7 +345,7 @@ ArrayBufferObject::obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePro
 
 JSBool
 ArrayBufferObject::obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                                     MutableHandleObject objp, JSProperty **propp)
+                                     MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedObject delegate(cx, ArrayBufferDelegate(cx, obj));
     if (!delegate)
@@ -362,7 +360,7 @@ ArrayBufferObject::obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t i
     if (!delegate->lookupElement(cx, index, objp, propp))
         return false;
 
-    if (*propp != NULL) {
+    if (propp) {
         if (objp == delegate)
             objp.set(obj);
         return true;
@@ -372,13 +370,13 @@ ArrayBufferObject::obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t i
         return proto->lookupElement(cx, index, objp, propp);
 
     objp.set(NULL);
-    *propp = NULL;
+    propp.set(NULL);
     return true;
 }
 
 JSBool
 ArrayBufferObject::obj_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                                     MutableHandleObject objp, JSProperty **propp)
+                                     MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return obj_lookupGeneric(cx, obj, id, objp, propp);
@@ -774,13 +772,13 @@ js::IsDataView(JSObject* obj)
 
 JSBool
 TypedArray::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                              MutableHandleObject objp, JSProperty **propp)
+                              MutableHandleObject objp, MutableHandleShape propp)
 {
     JSObject *tarray = getTypedArray(obj);
     JS_ASSERT(tarray);
 
     if (isArrayIndex(cx, tarray, id)) {
-        *propp = PROPERTY_FOUND;
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(obj);
         return true;
     }
@@ -788,7 +786,7 @@ TypedArray::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
     JSObject *proto = obj->getProto();
     if (!proto) {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
         return true;
     }
 
@@ -797,7 +795,7 @@ TypedArray::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
 
 JSBool
 TypedArray::obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                               MutableHandleObject objp, JSProperty **propp)
+                               MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return obj_lookupGeneric(cx, obj, id, objp, propp);
@@ -805,13 +803,13 @@ TypedArray::obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyNa
 
 JSBool
 TypedArray::obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                              MutableHandleObject objp, JSProperty **propp)
+                              MutableHandleObject objp, MutableHandleShape propp)
 {
     JSObject *tarray = getTypedArray(obj);
     JS_ASSERT(tarray);
 
     if (index < length(tarray)) {
-        *propp = PROPERTY_FOUND;
+        MarkNonNativePropertyFound(obj, propp);
         objp.set(obj);
         return true;
     }
@@ -820,13 +818,13 @@ TypedArray::obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
         return proto->lookupElement(cx, index, objp, propp);
 
     objp.set(NULL);
-    *propp = NULL;
+    propp.set(NULL);
     return true;
 }
 
 JSBool
 TypedArray::obj_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                              MutableHandleObject objp, JSProperty **propp)
+                              MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return obj_lookupGeneric(cx, obj, id, objp, propp);

js/src/jstypedarray.h

@@ -47,16 +47,16 @@ class ArrayBufferObject : public JSObject
 
     static JSBool
     obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                      MutableHandleObject objp, JSProperty **propp);
+                      MutableHandleObject objp, MutableHandleShape propp);
     static JSBool
     obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                       MutableHandleObject objp, JSProperty **propp);
+                       MutableHandleObject objp, MutableHandleShape propp);
     static JSBool
     obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                      MutableHandleObject objp, JSProperty **propp);
+                      MutableHandleObject objp, MutableHandleShape propp);
     static JSBool
     obj_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                      MutableHandleObject objp, JSProperty **propp);
+                      MutableHandleObject objp, MutableHandleShape propp);
 
     static JSBool
     obj_defineGeneric(JSContext *cx, HandleObject obj, HandleId id, const Value *v,
@@ -189,13 +189,13 @@ struct TypedArray {
     static Class protoClasses[TYPE_MAX];
 
     static JSBool obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                                    MutableHandleObject objp, JSProperty **propp);
+                                    MutableHandleObject objp, MutableHandleShape propp);
     static JSBool obj_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                                     MutableHandleObject objp, JSProperty **propp);
+                                     MutableHandleObject objp, MutableHandleShape propp);
     static JSBool obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                                    MutableHandleObject objp, JSProperty **propp);
+                                    MutableHandleObject objp, MutableHandleShape propp);
     static JSBool obj_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                                    MutableHandleObject objp, JSProperty **propp);
+                                    MutableHandleObject objp, MutableHandleShape propp);
 
     static JSBool obj_getGenericAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp);
     static JSBool obj_getPropertyAttributes(JSContext *cx, HandleObject obj, HandlePropertyName name, unsigned *attrsp);

js/src/jsxml.cpp

@@ -4632,7 +4632,6 @@ HasSimpleContent(JSXML *xml);
 static JSBool
 HasFunctionProperty(JSContext *cx, JSObject *obj_, jsid funid_, JSBool *found)
 {
-    JSProperty *prop;
     JSXML *xml;
 
     JS_ASSERT(obj_->getClass() == &XMLClass);
@@ -4641,6 +4640,7 @@ HasFunctionProperty(JSContext *cx, JSObject *obj_, jsid funid_, JSBool *found)
 
     Rooted<JSObject*> obj(cx, obj_);
     RootedObject pobj(cx);
+    RootedShape prop(cx);
     if (!baseops::LookupProperty(cx, obj, funid, &pobj, &prop))
         return false;
     if (!prop) {
@@ -4743,8 +4743,8 @@ HasProperty(JSContext *cx, JSObject *obj, jsval id, JSBool *found)
  * For a proper solution see bug 355257.
 */
 static JSBool
-xml_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp,
+xml_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                  JSProperty **propp)
+                  MutableHandleObject objp, MutableHandleShape propp)
 {
     JSBool found;
     JSXML *xml;
@@ -4766,7 +4766,7 @@ xml_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObj
     }
     if (!found) {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
     } else {
         Shape *shape =
             js_AddNativeProperty(cx, obj, id, GetProperty, PutProperty,
@@ -4776,14 +4776,14 @@ xml_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObj
             return JS_FALSE;
 
         objp.set(obj);
-        *propp = (JSProperty *) shape;
+        propp.set(shape);
     }
     return JS_TRUE;
 }
 
 static JSBool
 xml_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                   MutableHandleObject objp, JSProperty **propp)
+                   MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return xml_lookupGeneric(cx, obj, id, objp, propp);
@@ -4791,12 +4791,12 @@ xml_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
 
 static JSBool
 xml_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleObject objp,
-                  JSProperty **propp)
+                  MutableHandleShape propp)
 {
     JSXML *xml = reinterpret_cast<JSXML *>(obj->getPrivate());
     if (!HasIndexedProperty(xml, index)) {
         objp.set(NULL);
-        *propp = NULL;
+        propp.set(NULL);
         return true;
     }
 
@@ -4811,13 +4811,13 @@ xml_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandle
         return false;
 
     objp.set(obj);
-    *propp = (JSProperty *) shape;
+    propp.set(shape);
     return true;
 }
 
 static JSBool
 xml_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                  MutableHandleObject objp, JSProperty **propp)
+                  MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return xml_lookupGeneric(cx, obj, id, objp, propp);
@@ -7745,7 +7745,6 @@ js_FindXMLProperty(JSContext *cx, const Value &nameval, MutableHandleObject objp
     JSObject *obj, *target, *proto;
     JSXML *xml;
     JSBool found;
-    JSProperty *prop;
 
     JS_ASSERT(nameval.isObject());
     nameobj = &nameval.toObject();
@@ -7792,6 +7791,7 @@ js_FindXMLProperty(JSContext *cx, const Value &nameval, MutableHandleObject objp
             }
         } else if (!JSID_IS_VOID(funid)) {
             RootedObject pobj(cx);
+            RootedShape prop(cx);
             if (!target->lookupGeneric(cx, funid, &pobj, &prop))
                 return JS_FALSE;
             if (prop) {

js/src/methodjit/Compiler.cpp

@@ -5071,13 +5071,12 @@ mjit::Compiler::testSingletonProperty(HandleObject obj, HandleId id)
     }
 
     RootedObject holder(cx);
-    JSProperty *prop = NULL;
+    RootedShape shape(cx);
-    if (!obj->lookupGeneric(cx, id, &holder, &prop))
+    if (!obj->lookupGeneric(cx, id, &holder, &shape))
         return false;
-    if (!prop)
+    if (!shape)
         return false;
 
-    Shape *shape = (Shape *) prop;
     if (shape->hasDefaultGetter()) {
         if (!shape->hasSlot())
             return false;

js/src/methodjit/FastOps.cpp

@@ -2686,18 +2686,17 @@ mjit::Compiler::jsop_initprop()
     }
 
     RootedObject holder(cx);
-    JSProperty *prop = NULL;
+    RootedShape shape(cx);
     Rooted<jsid> id(cx, NameToId(name));
 #ifdef DEBUG
     bool res =
 #endif
-    LookupPropertyWithFlags(cx, baseobj, id, JSRESOLVE_QUALIFIED, &holder, &prop);
+    LookupPropertyWithFlags(cx, baseobj, id, JSRESOLVE_QUALIFIED, &holder, &shape);
-    JS_ASSERT(res && prop && holder == baseobj);
+    JS_ASSERT(res && shape && holder == baseobj);
 
     RegisterID objReg = frame.copyDataIntoReg(obj);
 
     /* Perform the store. */
-    Shape *shape = (Shape *) prop;
     Address address = masm.objPropAddress(baseobj, objReg, shape->slot());
     frame.storeTo(fe, address);
     frame.freeReg(objReg);

js/src/methodjit/PolyIC.cpp

@@ -454,19 +454,17 @@ class SetPropCompiler : public PICStubCompiler
             return disable("ops set property hook");
 
         RootedObject holder(cx);
-        JSProperty *prop = NULL;
+        RootedShape shape(cx);
 
         /* lookupProperty can trigger recompilations. */
         RecompilationMonitor monitor(cx);
-        if (!obj->lookupProperty(cx, name, &holder, &prop))
+        if (!obj->lookupProperty(cx, name, &holder, &shape))
             return error();
         if (monitor.recompiled())
             return Lookup_Uncacheable;
 
         /* If the property exists but is on a prototype, treat as addprop. */
-        if (prop && holder != obj) {
+        if (shape && holder != obj) {
-            Shape *shape = (Shape *) prop;
-
             if (!holder->isNative())
                 return disable("non-native holder");
 
@@ -479,10 +477,10 @@ class SetPropCompiler : public PICStubCompiler
             if (!shape->hasSlot())
                 return disable("missing slot");
 
-            prop = NULL;
+            shape = NULL;
         }
 
-        if (!prop) {
+        if (!shape) {
             /* Adding a property to the object. */
             if (obj->isDelegate())
                 return disable("delegate");
@@ -523,7 +521,7 @@ class SetPropCompiler : public PICStubCompiler
              * populate the slot to satisfy the method invariant (in case we
              * hit an early return below).
              */
-            Shape *shape =
+            shape =
                 obj->putProperty(cx, name, getter, clasp->setProperty,
                                  SHAPE_INVALID_SLOT, JSPROP_ENUMERATE, flags, 0);
             if (!shape)
@@ -575,7 +573,6 @@ class SetPropCompiler : public PICStubCompiler
             return generateStub(initialShape, shape, true);
         }
 
-        Shape *shape = (Shape *) prop;
         if (!shape->writable())
             return disable("readonly");
         if (shape->hasDefaultSetter()) {
@@ -661,14 +658,14 @@ struct GetPropHelper {
     // These fields are set by |bind| and |lookup|. After a call to either
     // function, these are set exactly as they are in JSOP_GETPROP or JSOP_NAME.
     RootedObject       holder;
-    JSProperty         *prop;
+    RootedShape        prop;
 
     // This field is set by |bind| and |lookup| only if they returned
     // Lookup_Cacheable, otherwise it is NULL.
-    Shape *shape;
+    RootedShape        shape;
 
     GetPropHelper(JSContext *cx, JSObject *obj, PropertyName *name, IC &ic, VMFrame &f)
-      : cx(cx), obj(cx, obj), name(cx, name), ic(ic), f(f), holder(cx), prop(NULL), shape(NULL)
+      : cx(cx), obj(cx, obj), name(cx, name), ic(ic), f(f), holder(cx), prop(cx), shape(cx)
     { }
 
   public:
@@ -687,7 +684,7 @@ struct GetPropHelper {
             return ic.disable(cx, "non-native");
         if (!IsCacheableProtoChain(obj, holder))
             return ic.disable(cx, "non-native holder");
-        shape = (Shape *)prop;
+        shape = prop;
         return Lookup_Cacheable;
     }
 
@@ -708,7 +705,7 @@ struct GetPropHelper {
             return ic.disable(f, "lookup failed");
         if (!IsCacheableProtoChain(obj, holder))
             return ic.disable(f, "non-native holder");
-        shape = (Shape *)prop;
+        shape = prop;
         return Lookup_Cacheable;
     }
 
@@ -1675,7 +1672,7 @@ class ScopeNameCompiler : public PICStubCompiler
     {
         JSObject *obj = getprop.obj;
         Rooted<JSObject*> holder(cx, getprop.holder);
-        const JSProperty *prop = getprop.prop;
+        RootedShape prop(cx, getprop.prop);
 
         if (!prop) {
             /* Kludge to allow (typeof foo == "undefined") tests. */
@@ -1698,7 +1695,7 @@ class ScopeNameCompiler : public PICStubCompiler
             return true;
         }
 
-        Shape *shape = getprop.shape;
+        RootedShape shape(cx, getprop.shape);
         Rooted<JSObject*> normalized(cx, obj);
         if (obj->isWith() && !shape->hasDefaultGetter())
             normalized = &obj->asWith().object();

js/src/methodjit/StubCalls.cpp

@@ -193,7 +193,7 @@ stubs::ImplicitThis(VMFrame &f, PropertyName *name_)
     RootedPropertyName name(f.cx, name_);
 
     RootedObject obj(f.cx), obj2(f.cx);
-    JSProperty *prop;
+    RootedShape prop(f.cx);
     if (!FindPropertyHelper(f.cx, name, false, scopeObj, &obj, &obj2, &prop))
         THROW();
 
@@ -338,16 +338,16 @@ stubs::DefFun(VMFrame &f, JSFunction *fun_)
 
     /* ES5 10.5 (NB: with subsequent errata). */
     PropertyName *name = fun->atom->asPropertyName();
-    JSProperty *prop = NULL;
+    RootedShape shape(cx);
     RootedObject pobj(cx);
-    if (!parent->lookupProperty(cx, name, &pobj, &prop))
+    if (!parent->lookupProperty(cx, name, &pobj, &shape))
         THROW();
 
     Value rval = ObjectValue(*fun);
 
     do {
         /* Steps 5d, 5f. */
-        if (!prop || pobj != parent) {
+        if (!shape || pobj != parent) {
             if (!parent->defineProperty(cx, name, rval,
                                         JS_PropertyStub, JS_StrictPropertyStub, attrs))
             {
@@ -358,7 +358,6 @@ stubs::DefFun(VMFrame &f, JSFunction *fun_)
 
         /* Step 5e. */
         JS_ASSERT(parent->isNative());
-        Shape *shape = reinterpret_cast<Shape *>(prop);
         if (parent->isGlobal()) {
             if (shape->configurable()) {
                 if (!parent->defineProperty(cx, name, rval,
@@ -1339,7 +1338,7 @@ stubs::DelName(VMFrame &f, PropertyName *name_)
     RootedPropertyName name(f.cx, name_);
 
     RootedObject obj(f.cx), obj2(f.cx);
-    JSProperty *prop;
+    RootedShape prop(f.cx);
     if (!FindProperty(f.cx, name, scopeObj, &obj, &obj2, &prop))
         THROW();
 
@@ -1439,7 +1438,7 @@ stubs::In(VMFrame &f)
         THROWV(JS_FALSE);
 
     RootedObject obj2(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     if (!obj->lookupGeneric(cx, id, &obj2, &prop))
         THROWV(JS_FALSE);
 

js/src/shell/js.cpp

@@ -2689,19 +2689,18 @@ static JSBool
 CopyProperty(JSContext *cx, HandleObject obj, HandleObject referent, HandleId id,
              unsigned lookupFlags, MutableHandleObject objp)
 {
-    JSProperty *prop;
+    RootedShape shape(cx);
     PropertyDescriptor desc;
     unsigned propFlags = 0;
     RootedObject obj2(cx);
 
     objp.set(NULL);
     if (referent->isNative()) {
-        if (!LookupPropertyWithFlags(cx, referent, id, lookupFlags, &obj2, &prop))
+        if (!LookupPropertyWithFlags(cx, referent, id, lookupFlags, &obj2, &shape))
             return false;
         if (obj2 != referent)
             return true;
 
-        const Shape *shape = (Shape *) prop;
         if (shape->hasSlot()) {
             desc.value = referent->nativeGetSlot(shape->slot());
         } else {
@@ -2724,7 +2723,7 @@ CopyProperty(JSContext *cx, HandleObject obj, HandleObject referent, HandleId id
         if (!desc.obj)
             return true;
     } else {
-        if (!referent->lookupGeneric(cx, id, objp, &prop))
+        if (!referent->lookupGeneric(cx, id, objp, &shape))
             return false;
         if (objp != referent)
             return true;

js/src/vm/ArgumentsObject.cpp

@@ -259,7 +259,7 @@ args_enumerate(JSContext *cx, HandleObject obj)
              : INT_TO_JSID(i);
 
         RootedObject pobj(cx);
-        JSProperty *prop;
+        RootedShape prop(cx);
         if (!baseops::LookupProperty(cx, argsobj, id, &pobj, &prop))
             return false;
     }
@@ -369,7 +369,7 @@ strictargs_enumerate(JSContext *cx, HandleObject obj)
      * js_LookupProperty calls.
      */
     RootedObject pobj(cx);
-    JSProperty *prop;
+    RootedShape prop(cx);
     RootedId id(cx);
 
     // length

js/src/vm/Debugger.cpp

@@ -4413,7 +4413,7 @@ DebuggerEnv_find(JSContext *cx, unsigned argc, Value *vp)
 
         /* This can trigger resolve hooks. */
         ErrorCopier ec(ac, dbg->toJSObject());
-        JSProperty *prop = NULL;
+        RootedShape prop(cx);
         RootedObject pobj(cx);
         for (; env && !prop; env = env->enclosingScope()) {
             if (!env->lookupGeneric(cx, id, &pobj, &prop))

js/src/vm/ScopeObject.cpp

@@ -351,22 +351,22 @@ WithObject::create(JSContext *cx, HandleObject proto, HandleObject enclosing, ui
 
 static JSBool
 with_LookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                   MutableHandleObject objp, JSProperty **propp)
+                   MutableHandleObject objp, MutableHandleShape propp)
 {
     return obj->asWith().object().lookupGeneric(cx, id, objp, propp);
 }
 
 static JSBool
 with_LookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
-                    MutableHandleObject objp, JSProperty **propp)
+                    MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, NameToId(name));
     return with_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static JSBool
-with_LookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleObject objp,
+with_LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
-                   JSProperty **propp)
+                   MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
     if (!IndexToId(cx, index, id.address()))
@@ -376,7 +376,7 @@ with_LookupElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandl
 
 static JSBool
 with_LookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
-                   MutableHandleObject objp, JSProperty **propp)
+                   MutableHandleObject objp, MutableHandleShape propp)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return with_LookupGeneric(cx, obj, id, objp, propp);

layout/svg/base/src/nsSVGOuterSVGFrame.cpp

@@ -109,9 +109,6 @@ nsSVGOuterSVGFrame::nsSVGOuterSVGFrame(nsStyleContext* aContext)
     : nsSVGOuterSVGFrameBase(aContext)
     , mFullZoom(0)
     , mViewportInitialized(false)
-#ifdef XP_MACOSX
-    , mEnableBitmapFallback(false)
-#endif
     , mIsRootContent(false)
 {
   // Outer-<svg> has CSS layout, so remove this bit:
@@ -490,64 +487,31 @@ nsDisplayOuterSVG::Paint(nsDisplayListBuilder* aBuilder,
   PRTime start = PR_Now();
 #endif
 
-  aContext->PushState();
+  // Create an SVGAutoRenderState so we can call SetPaintingToWindow on
+  // it, but do so without changing the render mode:
+  SVGAutoRenderState state(aContext, SVGAutoRenderState::GetRenderMode(aContext));
 
-  nsSVGOuterSVGFrame *frame = static_cast<nsSVGOuterSVGFrame*>(mFrame);
+  if (aBuilder->IsPaintingToWindow()) {
-
+    state.SetPaintingToWindow(true);
-#ifdef XP_MACOSX
-  if (frame->BitmapFallbackEnabled()) {
-    // nquartz fallback paths, which svg tends to trigger, need
-    // a non-window context target
-    aContext->ThebesContext()->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
   }
-#endif
 
   nsRect viewportRect =
-    frame->GetContentRectRelativeToSelf() + ToReferenceFrame();
+    mFrame->GetContentRectRelativeToSelf() + ToReferenceFrame();
+
   nsRect clipRect = mVisibleRect.Intersect(viewportRect);
 
+  nsIntRect contentAreaDirtyRect =
+    (clipRect - viewportRect.TopLeft()).
+      ToOutsidePixels(mFrame->PresContext()->AppUnitsPerDevPixel());
+
+  aContext->PushState();
   aContext->IntersectClip(clipRect);
   aContext->Translate(viewportRect.TopLeft());
-
+  nsSVGUtils::PaintFrameWithEffects(aContext, &contentAreaDirtyRect, mFrame);
-  frame->Paint(aBuilder, aContext, clipRect - viewportRect.TopLeft());
-
-#ifdef XP_MACOSX
-  if (frame->BitmapFallbackEnabled()) {
-    // show the surface we pushed earlier for fallbacks
-    aContext->ThebesContext()->PopGroupToSource();
-    aContext->ThebesContext()->Paint();
-  }
-
-  if (aContext->ThebesContext()->HasError() && !frame->BitmapFallbackEnabled()) {
-    frame->SetBitmapFallbackEnabled(true);
-    // It's not really clear what area to invalidate here. We might have
-    // stuffed up rendering for the entire window in this paint pass,
-    // so we can't just invalidate our own rect. Invalidate everything
-    // in sight.
-    // This won't work for printing, by the way, but failure to print the
-    // odd document is probably no worse than printing horribly for all
-    // documents. Better to fix things so we don't need fallback.
-    nsIFrame* ancestor = frame;
-    PRUint32 flags = 0;
-    while (true) {
-      nsIFrame* next = nsLayoutUtils::GetCrossDocParentFrame(ancestor);
-      if (!next)
-        break;
-      if (ancestor->GetParent() != next) {
-        // We're crossing a document boundary. Logically, the invalidation is
-        // being triggered by a subdocument of the root document. This will
-        // prevent an untrusted root document being told about invalidation
-        // that happened because a child was using SVG...
-        flags |= nsIFrame::INVALIDATE_CROSS_DOC;
-      }
-      ancestor = next;
-    }
-    ancestor->InvalidateWithFlags(nsRect(nsPoint(0, 0), ancestor->GetSize()), flags);
-  }
-#endif
-
   aContext->PopState();
 
+  NS_ASSERTION(!aContext->ThebesContext()->HasError(), "Cairo in error state");
+
 #if defined(DEBUG) && defined(SVG_DEBUG_PAINT_TIMING)
   PRTime end = PR_Now();
   printf("SVG Paint Timing: %f ms\n", (end-start)/1000.0);
@@ -642,26 +606,6 @@ nsSVGOuterSVGFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   return NS_OK;
 }
 
-void
-nsSVGOuterSVGFrame::Paint(const nsDisplayListBuilder* aBuilder,
-                          nsRenderingContext* aContext,
-                          const nsRect& aDirtyRect)
-{
-  // Create an SVGAutoRenderState so we can call SetPaintingToWindow on
-  // it, but don't change the render mode:
-  SVGAutoRenderState state(aContext, SVGAutoRenderState::GetRenderMode(aContext));
-
-  if (aBuilder->IsPaintingToWindow()) {
-    state.SetPaintingToWindow(true);
-  }
-
-  // Convert the (content area relative) dirty rect to dev pixels:
-  nsIntRect dirtyPxRect =
-    aDirtyRect.ToOutsidePixels(PresContext()->AppUnitsPerDevPixel());
-
-  nsSVGUtils::PaintFrameWithEffects(aContext, &dirtyPxRect, this);
-}
-
 nsSplittableType
 nsSVGOuterSVGFrame::GetSplittableType() const
 {

layout/svg/base/src/nsSVGOuterSVGFrame.h

@@ -65,10 +65,6 @@ public:
    */
   virtual nsIAtom* GetType() const;
 
-  void Paint(const nsDisplayListBuilder* aBuilder,
-             nsRenderingContext* aContext,
-             const nsRect& aDirtyRect);
-
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
@@ -95,16 +91,6 @@ public:
 
   virtual bool HasChildrenOnlyTransform(gfxMatrix *aTransform) const;
 
-#ifdef XP_MACOSX
-  bool BitmapFallbackEnabled() const {
-    return mEnableBitmapFallback;
-  }
-  void SetBitmapFallbackEnabled(bool aVal) {
-    NS_NOTREACHED("don't think me need this any more"); // comment in bug 732429 if we do
-    mEnableBitmapFallback = aVal;
-  }
-#endif
-
   /**
    * Return true only if the height is unspecified (defaulting to 100%) or else
    * the height is explicitly set to a percentage value no greater than 100%.
@@ -135,9 +121,6 @@ protected:
   float mFullZoom;
 
   bool mViewportInitialized;
-#ifdef XP_MACOSX
-  bool mEnableBitmapFallback;
-#endif
   bool mIsRootContent;
 };
 

mfbt/CheckedInt.h

@@ -270,10 +270,46 @@ template<typename T,
          typename U,
          bool IsTSigned = IsSigned<T>::value,
          bool IsUSigned = IsSigned<U>::value>
-struct IsInRangeImpl {};
+struct DoesRangeContainRange
+{
+};
+
+template<typename T, typename U, bool Signedness>
+struct DoesRangeContainRange<T, U, Signedness, Signedness>
+{
+    static const bool value = sizeof(T) >= sizeof(U);
+};
 
 template<typename T, typename U>
-struct IsInRangeImpl<T, U, true, true>
+struct DoesRangeContainRange<T, U, true, false>
+{
+    static const bool value = sizeof(T) > sizeof(U);
+};
+
+template<typename T, typename U>
+struct DoesRangeContainRange<T, U, false, true>
+{
+    static const bool value = false;
+};
+
+template<typename T,
+         typename U,
+         bool IsTSigned = IsSigned<T>::value,
+         bool IsUSigned = IsSigned<U>::value,
+         bool DoesTRangeContainURange = DoesRangeContainRange<T, U>::value>
+struct IsInRangeImpl {};
+
+template<typename T, typename U, bool IsTSigned, bool IsUSigned>
+struct IsInRangeImpl<T, U, IsTSigned, IsUSigned, true>
+{
+    static bool run(U)
+    {
+       return true;
+    }
+};
+
+template<typename T, typename U>
+struct IsInRangeImpl<T, U, true, true, false>
 {
     static bool run(U x)
     {
@@ -282,7 +318,7 @@ struct IsInRangeImpl<T, U, true, true>
 };
 
 template<typename T, typename U>
-struct IsInRangeImpl<T, U, false, false>
+struct IsInRangeImpl<T, U, false, false, false>
 {
     static bool run(U x)
     {
@@ -291,7 +327,7 @@ struct IsInRangeImpl<T, U, false, false>
 };
 
 template<typename T, typename U>
-struct IsInRangeImpl<T, U, true, false>
+struct IsInRangeImpl<T, U, true, false, false>
 {
     static bool run(U x)
     {
@@ -300,7 +336,7 @@ struct IsInRangeImpl<T, U, true, false>
 };
 
 template<typename T, typename U>
-struct IsInRangeImpl<T, U, false, true>
+struct IsInRangeImpl<T, U, false, true, false>
 {
     static bool run(U x)
     {
@@ -678,11 +714,13 @@ inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs,            \
 {                                                                     \
   T x = lhs.mValue;                                                   \
   T y = rhs.mValue;                                                   \
-  T result = x OP y;                                                  \
   T isOpValid = detail::Is##NAME##Valid(x, y);                        \
-  /* Help the compiler perform RVO (return value optimization). */    \
+  if (isOpValid) {                                                    \
-  return CheckedInt<T>(result,                                        \
+    T result = x OP y;                                                \
-                       lhs.mIsValid && rhs.mIsValid && isOpValid);    \
+    return CheckedInt<T>(result, lhs.mIsValid && rhs.mIsValid);       \
+  } else {                                                            \
+    return CheckedInt<T>(T(0), false);                                \
+  }                                                                   \
 }
 
 MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Add, +)

mfbt/tests/TestCheckedInt.cpp

@@ -99,17 +99,19 @@ void test()
   const CheckedInt<T> max(detail::MaxValue<T>::value);
   const CheckedInt<T> min(detail::MinValue<T>::value);
 
-  // Check min() and max(), since they are custom implementations and a mistake there
+  // Check MinValue and MaxValue, since they are custom implementations and a mistake there
   // could potentially NOT be caught by any other tests... while making everything wrong!
 
-  T bit = 1;
+  unsignedT bit = 1;
+  unsignedT unsignedMinValue(min.value());
+  unsignedT unsignedMaxValue(max.value());
   for (size_t i = 0; i < sizeof(T) * CHAR_BIT - 1; i++)
   {
-    VERIFY((min.value() & bit) == 0);
+    VERIFY((unsignedMinValue & bit) == 0);
     bit <<= 1;
   }
-  VERIFY((min.value() & bit) == (isTSigned ? bit : T(0)));
+  VERIFY((unsignedMinValue & bit) == (isTSigned ? bit : unsignedT(0)));
-  VERIFY(max.value() == T(~(min.value())));
+  VERIFY(unsignedMaxValue == unsignedT(~unsignedMinValue));
 
   const CheckedInt<T> zero(0);
   const CheckedInt<T> one(1);
@@ -117,7 +119,7 @@ void test()
   const CheckedInt<T> three(3);
   const CheckedInt<T> four(4);
 
-  /* Addition / substraction checks */
+  /* Addition / subtraction checks */
 
   VERIFY_IS_VALID(zero + zero);
   VERIFY(zero + zero == zero);
@@ -394,7 +396,7 @@ void test()
     if (isUSigned) \
       VERIFY_IS_VALID_IF(CheckedInt<T>(U(-1)), isTSigned); \
     if (sizeof(U) > sizeof(T)) \
-      VERIFY_IS_INVALID(CheckedInt<T>(U(detail::MaxValue<T>::value) + 1)); \
+      VERIFY_IS_INVALID(CheckedInt<T>(U(detail::MaxValue<T>::value) + one.value())); \
     VERIFY_IS_VALID_IF(CheckedInt<T>(detail::MaxValue<U>::value), \
       (sizeof(T) > sizeof(U) || ((sizeof(T) == sizeof(U)) && (isUSigned || !isTSigned)))); \
     VERIFY_IS_VALID_IF(CheckedInt<T>(detail::MinValue<U>::value), \

mobile/android/app/Makefile.in

@@ -63,6 +63,7 @@ DEFINES += \
   -DAPP_NAME=$(MOZ_APP_NAME) \
   -DAPP_VERSION=$(MOZ_APP_VERSION) \
   -DMOZ_UPDATER=$(MOZ_UPDATER) \
+  -DMOZ_PKG_SPECIAL=$(MOZ_PKG_SPECIAL) \
   $(NULL)
 
 ifeq ($(OS_ARCH),WINNT)

mobile/android/app/mobile.js

@@ -519,7 +519,11 @@ pref("app.update.auto", false);
 pref("app.update.channel", "@MOZ_UPDATE_CHANNEL@");
 pref("app.update.mode", 1);
 pref("app.update.silent", false);
+#ifdef MOZ_PKG_SPECIAL
+pref("app.update.url", "https://aus2.mozilla.org/update/4/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%-@MOZ_PKG_SPECIAL@/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PLATFORM_VERSION%/update.xml");
+#else
 pref("app.update.url", "https://aus2.mozilla.org/update/4/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PLATFORM_VERSION%/update.xml");
+#endif
 pref("app.update.promptWaitTime", 43200);
 pref("app.update.idletime", 60);
 pref("app.update.showInstalledUI", false);

mobile/android/base/AwesomeBar.java

@@ -367,7 +367,6 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
         // by any of the views, which usually means the edit box lost focus
         if (keyCode == KeyEvent.KEYCODE_BACK ||
             keyCode == KeyEvent.KEYCODE_MENU ||
-            keyCode == KeyEvent.KEYCODE_SEARCH ||
             keyCode == KeyEvent.KEYCODE_DPAD_UP ||
             keyCode == KeyEvent.KEYCODE_DPAD_DOWN ||
             keyCode == KeyEvent.KEYCODE_DPAD_LEFT ||
@@ -377,6 +376,12 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
             keyCode == KeyEvent.KEYCODE_VOLUME_UP ||
             keyCode == KeyEvent.KEYCODE_VOLUME_DOWN) {
             return super.onKeyDown(keyCode, event);
+        } else if (keyCode == KeyEvent.KEYCODE_SEARCH) {
+             mText.setText("");
+             mText.requestFocus();
+             InputMethodManager imm = (InputMethodManager) mText.getContext().getSystemService(Context.INPUT_METHOD_SERVICE);
+             imm.showSoftInput(mText, InputMethodManager.SHOW_IMPLICIT);
+             return true;
         } else {
             int selStart = -1;
             int selEnd = -1;

mobile/android/base/GeckoAppShell.java

@@ -123,6 +123,8 @@ public class GeckoAppShell
 
     private static Handler sGeckoHandler;
 
+    public static GfxInfoThread sGfxInfoThread = null;
+
     /* The Android-side API: API methods that Android calls */
 
     // Initialization methods
@@ -2224,6 +2226,13 @@ public class GeckoAppShell
     public static void notifyWakeLockChanged(String topic, String state) {
         GeckoApp.mAppContext.notifyWakeLockChanged(topic, state);
     }
+
+    public static String getGfxInfoData() {
+        String data = sGfxInfoThread.getData();
+        sGfxInfoThread = null;
+        return data;
+    }
+
 }
 
 class ScreenshotHandler {

mobile/android/base/GeckoThread.java

@@ -46,6 +46,16 @@ public class GeckoThread extends Thread {
     }
 
     public void run() {
+
+        // Here we start the GfxInfo thread, which will query OpenGL
+        // system information for Gecko. This must be done early enough that the data will be
+        // ready by the time it's needed to initialize the LayerManager (it takes about 100 ms
+        // to obtain). Doing it here seems to have no negative effect on startup time. See bug 766251.
+        // Starting the GfxInfoThread here from the GeckoThread, ensures that
+        // the Gecko thread is started first, adding some determinism there.
+        GeckoAppShell.sGfxInfoThread = new GfxInfoThread();
+        GeckoAppShell.sGfxInfoThread.start();
+
         final GeckoApp app = GeckoApp.mAppContext;
 
         // At some point while loading the gecko libs our default locale gets set

mobile/android/base/Makefile.in

@@ -107,6 +107,7 @@ FENNEC_JAVA_FILES = \
   gfx/DrawTimingQueue.java \
   gfx/FloatSize.java \
   gfx/GeckoLayerClient.java \
+  gfx/GfxInfoThread.java \
   gfx/GLController.java \
   gfx/ImmutableViewportMetrics.java \
   gfx/InputConnectionHandler.java \

mobile/android/base/gfx/GfxInfoThread.java

@@ -0,0 +1,176 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import android.util.Log;
+import java.util.concurrent.SynchronousQueue;
+
+import javax.microedition.khronos.egl.EGL10;
+import javax.microedition.khronos.egl.EGLConfig;
+import javax.microedition.khronos.egl.EGLContext;
+import javax.microedition.khronos.egl.EGLDisplay;
+import javax.microedition.khronos.egl.EGLSurface;
+import android.opengl.GLES20;
+
+public class GfxInfoThread extends Thread {
+
+    private static final String LOGTAG = "GfxInfoThread";
+
+    private SynchronousQueue<String> mDataQueue;
+
+    public GfxInfoThread() {
+        mDataQueue = new SynchronousQueue<String>();
+    }
+
+    private void error(String msg) {
+        Log.e(LOGTAG, msg);
+        try {
+            mDataQueue.put("ERROR\n" + msg + "\n");
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    private void eglError(EGL10 egl, String msg) {
+        error(msg + " (EGL error " + Integer.toHexString(egl.eglGetError()) + ")");
+    }
+
+    public String getData() {
+        String data = mDataQueue.poll();
+        if (data != null)
+            return data;
+
+        error("We need the GfxInfo data, but it is not yet available. " +
+              "We have to wait for it, so expect abnormally long startup times. " +
+              "Please report a Mozilla bug.");
+        try {
+            data = mDataQueue.take();
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+        Log.i(LOGTAG, "GfxInfo data is finally available.");
+        return data;
+    }
+
+    public void run() {
+        // initialize EGL
+        EGL10 egl = (EGL10) EGLContext.getEGL();
+        EGLDisplay eglDisplay = egl.eglGetDisplay(EGL10.EGL_DEFAULT_DISPLAY);
+
+        if (eglDisplay == EGL10.EGL_NO_DISPLAY) {
+            eglError(egl, "eglGetDisplay failed");
+            return;
+        }
+
+        int[] returnedVersion = new int[2];
+        if (!egl.eglInitialize(eglDisplay, returnedVersion)) {
+            eglError(egl, "eglInitialize failed");
+            return;
+        }
+
+        // query number of configs
+        int[] returnedNumberOfConfigs = new int[1];
+        int EGL_OPENGL_ES2_BIT = 4;
+        int[] configAttribs = new int[] {
+            EGL10.EGL_RENDERABLE_TYPE, EGL_OPENGL_ES2_BIT,
+            EGL10.EGL_NONE
+        };
+        if (!egl.eglChooseConfig(eglDisplay,
+                                 configAttribs,
+                                 null,
+                                 0,
+                                 returnedNumberOfConfigs))
+        {
+            eglError(egl, "eglChooseConfig failed (querying number of configs)");
+            return;
+        }
+
+        // get the first config
+        int numConfigs = returnedNumberOfConfigs[0];
+        EGLConfig[] returnedConfigs = new EGLConfig[numConfigs];
+        if (!egl.eglChooseConfig(eglDisplay,
+                                 configAttribs,
+                                 returnedConfigs,
+                                 numConfigs,
+                                 returnedNumberOfConfigs))
+        {
+            eglError(egl, "eglChooseConfig failed (listing configs)");
+            return;
+        }
+
+        EGLConfig eglConfig = returnedConfigs[0];
+
+        // create a ES 2.0 context
+        int EGL_CONTEXT_CLIENT_VERSION = 0x3098;
+        int[] contextAttribs = {EGL_CONTEXT_CLIENT_VERSION, 2, EGL10.EGL_NONE };
+        EGLContext eglContext = egl.eglCreateContext(eglDisplay,
+                                                     eglConfig,
+                                                     EGL10.EGL_NO_CONTEXT,
+                                                     contextAttribs);
+        if (eglContext == EGL10.EGL_NO_CONTEXT) {
+            eglError(egl, "eglCreateContext failed");
+            return;
+        }
+
+        // create a surface, necessary to make the context current. Hopefully PBuffers
+        // are well supported enough. Are there other kinds of off-screen surfaces in
+        // Android EGL anyway?
+        int[] surfaceAttribs = new int[] {
+            EGL10.EGL_WIDTH, 16,
+            EGL10.EGL_HEIGHT, 16,
+            EGL10.EGL_NONE
+        };
+        EGLSurface eglSurface = egl.eglCreatePbufferSurface(eglDisplay,
+                                                            eglConfig,
+                                                            surfaceAttribs);
+        if (eglSurface == EGL10.EGL_NO_SURFACE) {
+            eglError(egl, "eglCreatePbufferSurface failed");
+            return;
+        }
+
+        // obtain GL strings, store them in mDataQueue
+        if (!egl.eglMakeCurrent(eglDisplay, eglSurface, eglSurface, eglContext)) {
+            eglError(egl, "eglMakeCurrent failed");
+            return;
+        }
+
+        {
+            int error = egl.eglGetError();
+            if (error != EGL10.EGL_SUCCESS) {
+                error("EGL error " + Integer.toHexString(error));
+                return;
+            }
+        }
+
+        String data =
+            "VENDOR\n"   + GLES20.glGetString(GLES20.GL_VENDOR)   + "\n" +
+            "RENDERER\n" + GLES20.glGetString(GLES20.GL_RENDERER) + "\n" +
+            "VERSION\n"  + GLES20.glGetString(GLES20.GL_VERSION)  + "\n";
+
+        {
+            int error = GLES20.glGetError();
+            if (error != GLES20.GL_NO_ERROR) {
+                error("OpenGL error " + Integer.toHexString(error));
+                return;
+            }
+        }
+
+        // clean up after ourselves. This is especially important as some Android devices
+        // have a very low limit on the global number of GL contexts.
+        egl.eglMakeCurrent(eglDisplay, EGL10.EGL_NO_SURFACE, EGL10.EGL_NO_SURFACE, EGL10.EGL_NO_CONTEXT);
+        egl.eglDestroySurface(eglDisplay, eglSurface);
+        egl.eglDestroyContext(eglDisplay, eglContext);
+        // intentionally do not eglTerminate: maybe this will make the next eglInitialize faster?
+
+        // finally send the data. Notice that we've already freed the EGL resources, so that they don't
+        // remain there until the data is read.
+        try {
+            mDataQueue.put(data);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+        }
+    }
+}

mobile/android/base/tests/testBookmark.java.in

@@ -77,6 +77,9 @@ public class testBookmark extends BaseTest  {
         // Open the bookmark list and check the root folder view
         ListView bookmarksList = openBookmarksList();
 
+        // Clear VKB so that list is not obscured
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+
         // Wait for bookmark to appear in list
         mSolo.waitForText(ABOUT_HOME_URL);
 
@@ -125,9 +128,9 @@ public class testBookmark extends BaseTest  {
             Boolean res = (Boolean)mIsBookmarked.invoke(null, getActivity().getContentResolver(), BOOKMARK_URL);
             return res.booleanValue();
         } catch(java.lang.IllegalAccessException ex) {
-            mAsserter.is(true, false, "Can not call addBookmark");
+            mAsserter.is(true, false, "Can not call isBookmarked");
         } catch(java.lang.reflect.InvocationTargetException ex) {
-            mAsserter.is(true, false, "Error calling addBookmark");
+            mAsserter.is(true, false, "Error calling isBookmarked");
         }
         return !isBookmarked;
     }

mobile/android/base/tests/testBookmarksTab.java.in

@@ -54,6 +54,10 @@ public class testBookmarksTab extends BaseTest {
     private void testList(String url) {
         View child;
         ListView list = getBookmarksList();
+
+        // Clear VKB so that list is not obscured
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+
         mSolo.waitForText(url);
         mAsserter.ok(list != null, "checking that bookmarks list exists", list.toString());
 
@@ -99,6 +103,10 @@ public class testBookmarksTab extends BaseTest {
 
     private void testContextMenu(String url) {
         ListView list = getBookmarksList();
+
+        // Clear VKB so that list is not obscured
+        mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+
         mSolo.waitForText(url);
 
         // test long tap on a folder, this should fail but will still open the folder

toolkit/components/telemetry/TelemetryPing.js

@@ -723,7 +723,7 @@ TelemetryPing.prototype = {
                  RW_OWNER, ostream.DEFER_OPEN);
 
     if (sync) {
-      let utf8String = converter.ConvertToUnicode(pingString);
+      let utf8String = converter.ConvertFromUnicode(pingString);
       utf8String += converter.Finish();
       let amount = ostream.write(utf8String, utf8String.length);
       this.finishTelemetrySave(amount == utf8String.length, ostream);

widget/android/AndroidBridge.cpp

@@ -185,6 +185,8 @@ AndroidBridge::Init(JNIEnv *jEnv,
 
     jNotifyWakeLockChanged = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "notifyWakeLockChanged", "(Ljava/lang/String;Ljava/lang/String;)V");
 
+    jGetGfxInfoData = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getGfxInfoData", "()Ljava/lang/String;");
+
 #ifdef MOZ_JAVA_COMPOSITOR
     jPumpMessageLoop = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "pumpMessageLoop", "()V");
 
@@ -2326,6 +2328,25 @@ AndroidBridge::NotifyWakeLockChanged(const nsAString& topic, const nsAString& st
     env->CallStaticVoidMethod(mGeckoAppShellClass, jNotifyWakeLockChanged, jstrTopic, jstrState);
 }
 
+void
+AndroidBridge::GetGfxInfoData(nsACString& aRet)
+{
+    ALOG_BRIDGE("AndroidBridge::GetGfxInfoData");
+
+    JNIEnv* env = GetJNIEnv();
+    if (!env)
+        return;
+
+    AutoLocalJNIFrame jniFrame(env);
+    jstring jstrRet = static_cast<jstring>
+        (env->CallStaticObjectMethod(mGeckoAppShellClass, jGetGfxInfoData));
+    if (jniFrame.CheckForException())
+        return;
+
+    nsJNIString jniStr(jstrRet, env);
+    CopyUTF16toUTF8(jniStr, aRet);
+}
+
 /* attribute nsIAndroidBrowserApp browserApp; */
 NS_IMETHODIMP nsAndroidBridge::GetBrowserApp(nsIAndroidBrowserApp * *aBrowserApp)
 {

widget/android/AndroidBridge.h

@@ -357,6 +357,8 @@ public:
 
     void NotifyWakeLockChanged(const nsAString& topic, const nsAString& state);
 
+    void GetGfxInfoData(nsACString& aRet);
+
 protected:
     static AndroidBridge *sBridge;
 
@@ -478,6 +480,9 @@ protected:
     jmethodID jPumpMessageLoop;
     jmethodID jNotifyWakeLockChanged;
 
+    // for GfxInfo (gfx feature detection and blacklisting)
+    jmethodID jGetGfxInfoData;
+
     // For native surface stuff
     jclass jSurfaceClass;
     jfieldID jSurfacePointerField;

widget/android/GfxInfo.cpp

@@ -24,6 +24,11 @@ using namespace mozilla::widget;
 NS_IMPL_ISUPPORTS_INHERITED1(GfxInfo, GfxInfoBase, nsIGfxInfoDebug)
 #endif
 
+GfxInfo::GfxInfo()
+  : mInitializedFromJavaData(false)
+{
+}
+
 /* GetD2DEnabled and GetDwriteEnabled shouldn't be called until after gfxPlatform initialization
  * has occurred because they depend on it for information. (See bug 591561) */
 nsresult
@@ -58,53 +63,104 @@ GfxInfo::GetCleartypeParameters(nsAString & aCleartypeParams)
   return NS_ERROR_FAILURE;
 }
 
-nsresult
+void
-GfxInfo::Init()
+GfxInfo::EnsureInitializedFromGfxInfoData()
 {
-  mAdapterDescription.AssignLiteral(""); // we may append to it below
+  if (mInitializedFromJavaData)
-  if (mozilla::AndroidBridge::Bridge()) {
+    return;
-    nsAutoString str;
+  mInitializedFromJavaData = true;
 
-    mAdapterDescription.Append(NS_LITERAL_STRING("Model: '"));
+  {
-    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MODEL", str)) {
+    nsCString gfxInfoData;
-      mAdapterDeviceID = str;
+    mozilla::AndroidBridge::Bridge()->GetGfxInfoData(gfxInfoData);
-      mAdapterDescription.Append(str);
+
+    // the code here is a mini-parser for the text that GfxInfoThread.java produces.
+    // Here, |stringToFill| is the parser state. If it's null, we are expecting
+    // the next line to tell us what is the next string we'll read, e.g. "VENDOR"
+    // means that the next string we'll read is |mVendor|. We record that knowledge
+    // in the |stringToFill| pointer. So when it's not null, we just copy the next
+    // input line into the string pointed to by |stringToFill|.
+    nsCString *stringToFill = nsnull;
+    char *bufptr = gfxInfoData.BeginWriting();
+
+    while(true) {
+      char *line = NS_strtok("\n", &bufptr);
+      if (!line)
+        break;
+      if (stringToFill) {
+        stringToFill->Assign(line);
+        stringToFill = nsnull;
+      } else if(!strcmp(line, "VENDOR")) {
+        stringToFill = &mVendor;
+      } else if(!strcmp(line, "RENDERER")) {
+        stringToFill = &mRenderer;
+      } else if(!strcmp(line, "VERSION")) {
+        stringToFill = &mVersion;
+      } else if(!strcmp(line, "ERROR")) {
+        stringToFill = &mError;
+      }
+    }
   }
 
-    mAdapterDescription.Append(NS_LITERAL_STRING("', Product: '"));
-    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "PRODUCT", str))
-      mAdapterDescription.Append(str);
 
-    mAdapterDescription.Append(NS_LITERAL_STRING("', Manufacturer: '"));
+  if (!mError.IsEmpty()) {
-    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MANUFACTURER", str))
+    mAdapterDescription.AppendPrintf("An error occurred earlier while querying gfx info: %s. ",
-      mAdapterDescription.Append(str);
+                                     mError.get());
+    printf_stderr("%s\n", mAdapterDescription.get());
+  }
 
-    mAdapterDescription.Append(NS_LITERAL_STRING("', Hardware: '"));
+  const char *spoofedVendor = PR_GetEnv("MOZ_GFX_SPOOF_GL_VENDOR");
-    PRInt32 version; // the HARDWARE field isn't available on Android SDK < 8
+  if (spoofedVendor)
+      mVendor.Assign(spoofedVendor);
+  const char *spoofedRenderer = PR_GetEnv("MOZ_GFX_SPOOF_GL_RENDERER");
+  if (spoofedRenderer)
+      mRenderer.Assign(spoofedRenderer);
+  const char *spoofedVersion = PR_GetEnv("MOZ_GFX_SPOOF_GL_VERSION");
+  if (spoofedVersion)
+      mVersion.Assign(spoofedVersion);
+
+  mAdapterDescription.AppendPrintf("%s -- %s -- %s",
+                                   mVendor.get(),
+                                   mRenderer.get(),
+                                   mVersion.get());
+
+  // Now we append general (non-gfx) device information. The only reason why this code is still here
+  // is that this used to be all we had in GfxInfo on Android, and we can't trivially remove it
+  // as it's useful information that isn't given anywhere else in about:support of in crash reports.
+  // But we should really move this out of GfxInfo.
+  if (mozilla::AndroidBridge::Bridge()) {
+    nsAutoString str;
+    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MODEL", str)) {
+      mAdapterDescription.AppendPrintf(" -- Model: %s",  NS_LossyConvertUTF16toASCII(str).get());
+    }
+
+    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "PRODUCT", str)) {
+      mAdapterDescription.AppendPrintf(", Product: %s", NS_LossyConvertUTF16toASCII(str).get());
+    }
+
+    if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MANUFACTURER", str)) {
+      mAdapterDescription.AppendPrintf(", Manufacturer: %s", NS_LossyConvertUTF16toASCII(str).get());
+    }
+
+    int32_t version; // the HARDWARE field isn't available on Android SDK < 8
     if (!mozilla::AndroidBridge::Bridge()->GetStaticIntField("android/os/Build$VERSION", "SDK_INT", &version))
       version = 0;
 
     if (version >= 8 && mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "HARDWARE", str)) {
       if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "HARDWARE", str)) {
-        mAdapterVendorID = str;
+        mAdapterDescription.AppendPrintf(", Hardware: %s", NS_LossyConvertUTF16toASCII(str).get());
-        mAdapterDescription.Append(str);
+      }
     }
   }
 
-    mAdapterDescription.Append(NS_LITERAL_STRING("'"));
+  AddCrashReportAnnotations();
-    mAndroidSDKVersion = version;
-  }
-
-  AddOpenGLCrashReportAnnotations();
-
-  return GfxInfoBase::Init();
 }
 
 /* readonly attribute DOMString adapterDescription; */
 NS_IMETHODIMP
 GfxInfo::GetAdapterDescription(nsAString & aAdapterDescription)
 {
-  aAdapterDescription = mAdapterDescription;
+  aAdapterDescription = NS_ConvertASCIItoUTF16(mAdapterDescription);
   return NS_OK;
 }
 
@@ -149,8 +205,7 @@ GfxInfo::GetAdapterDriver2(nsAString & aAdapterDriver)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriverVersion(nsAString & aAdapterDriverVersion)
 {
-  aAdapterDriverVersion.Truncate(0);
+  aAdapterDriverVersion = NS_ConvertASCIItoUTF16(mVersion);
-  aAdapterDriverVersion.AppendInt(mAndroidSDKVersion);
   return NS_OK;
 }
 
@@ -180,7 +235,7 @@ GfxInfo::GetAdapterDriverDate2(nsAString & aAdapterDriverDate)
 NS_IMETHODIMP
 GfxInfo::GetAdapterVendorID(nsAString & aAdapterVendorID)
 {
-  aAdapterVendorID = mAdapterVendorID;
+  aAdapterVendorID = NS_ConvertASCIItoUTF16(mVendor);
   return NS_OK;
 }
 
@@ -195,7 +250,7 @@ GfxInfo::GetAdapterVendorID2(nsAString & aAdapterVendorID)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDeviceID(nsAString & aAdapterDeviceID)
 {
-  aAdapterDeviceID = mAdapterDeviceID;
+  aAdapterDeviceID = NS_ConvertASCIItoUTF16(mRenderer);
   return NS_OK;
 }
 
@@ -214,35 +269,18 @@ GfxInfo::GetIsGPU2Active(bool* aIsGPU2Active)
 }
 
 void
-GfxInfo::AddOpenGLCrashReportAnnotations()
+GfxInfo::AddCrashReportAnnotations()
 {
 #if defined(MOZ_CRASHREPORTER)
-  nsAutoString adapterDescriptionString, deviceID, vendorID;
-  nsCAutoString narrowDeviceID, narrowVendorID;
-
-  GetAdapterDeviceID(deviceID);
-  GetAdapterVendorID(vendorID);
-  GetAdapterDescription(adapterDescriptionString);
-
-  narrowDeviceID = NS_ConvertUTF16toUTF8(deviceID);
-  narrowVendorID = NS_ConvertUTF16toUTF8(vendorID);
-
   CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("AdapterVendorID"),
-                                     narrowVendorID);
+                                     mVendor);
   CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("AdapterDeviceID"),
-                                     narrowDeviceID);
+                                     mRenderer);
 
   /* Add an App Note for now so that we get the data immediately. These
    * can go away after we store the above in the socorro db */
   nsCAutoString note;
-  /* AppendPrintf only supports 32 character strings, mrghh. */
+  note.AppendPrintf("AdapterDescription: '%s'\n", mAdapterDescription.get());
-  note.Append("AdapterVendorID: ");
-  note.Append(narrowVendorID);
-  note.Append(", AdapterDeviceID: ");
-  note.Append(narrowDeviceID);
-  note.Append(".\n");
-  note.AppendPrintf("AdapterDescription: '%s'.", NS_ConvertUTF16toUTF8(adapterDescriptionString).get());
-  note.Append("\n");
 
   CrashReporter::AppendAppNotesToCrashReport(note);
 #endif
@@ -251,10 +289,7 @@ GfxInfo::AddOpenGLCrashReportAnnotations()
 const nsTArray<GfxDriverInfo>&
 GfxInfo::GetGfxDriverInfo()
 {
-  if (!mDriverInfo->Length()) {
+  if (mDriverInfo->IsEmpty()) {
-    /* The following entry, when uncommented, will allow us to whitelist a
-     * specific device. See the long comment in GetFeatureStatusImpl for more
-     * info. */
 #ifdef MOZ_JAVA_COMPOSITOR
     APPEND_TO_DRIVER_BLOCKLIST2( DRIVER_OS_ALL,
       (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorAll), GfxDriverInfo::allDevices,
@@ -264,9 +299,10 @@ GfxInfo::GetGfxDriverInfo()
     APPEND_TO_DRIVER_BLOCKLIST2( DRIVER_OS_ALL,
       (nsAString&) GfxDriverInfo::GetDeviceVendor(VendorAll), GfxDriverInfo::allDevices,
       nsIGfxInfo::FEATURE_OPENGL_LAYERS, nsIGfxInfo::FEATURE_BLOCKED_DEVICE,
-      DRIVER_LESS_THAN, GfxDriverInfo::allDriverVersions );
+      DRIVER_COMPARISON_IGNORED, GfxDriverInfo::allDriverVersions );
 #endif
   }
+
   return *mDriverInfo;
 }
 
@@ -284,22 +320,22 @@ GfxInfo::GetFeatureStatusImpl(PRInt32 aFeature,
   if (aOS)
     *aOS = os;
 
+  EnsureInitializedFromGfxInfoData();
+
+  if (!mError.IsEmpty()) {
+    *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
+    return NS_OK;
+  }
+
   // Don't evaluate special cases when evaluating the downloaded blocklist.
-  if (!aDriverInfo.Length()) {
+  if (aDriverInfo.IsEmpty()) {
-    if (aFeature == FEATURE_OPENGL_LAYERS) {
+    if (aFeature == FEATURE_WEBGL_OPENGL) {
-      /* The following code is an old way to whitelist devices when we're ready.
+      if (mRenderer.Find("Adreno 200") != -1 ||
-       * It is staying here for reference. The best way to do this now is to add
+          mRenderer.Find("Adreno 205") != -1)
-       * an entry in the list above. There is a dummy entry which will whitelist a
+      {
-       * device when uncommented and device/vendor IDs are inserted. It is
+        *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
-       * preferred that we stop whitelisting and instead go to blocklisting, where
+        return NS_OK;
-       * everything is assumed to be okay as long as it's not in the blocklist. */
+      }
-      // nsAutoString str;
-      // /* Whitelist Galaxy S phones */
-      // if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "HARDWARE", str)) {
-      //   if (str != NS_LITERAL_STRING("smdkc110")) {
-      //     status = FEATURE_BLOCKED_DEVICE;
-      //   }
-      // }
     }
   }
 
@@ -313,21 +349,24 @@ GfxInfo::GetFeatureStatusImpl(PRInt32 aFeature,
 /* void spoofVendorID (in DOMString aVendorID); */
 NS_IMETHODIMP GfxInfo::SpoofVendorID(const nsAString & aVendorID)
 {
-  mAdapterVendorID = aVendorID;
+  EnsureInitializedFromGfxInfoData(); // initialization from GfxInfo data overwrites mVendor
+  mVendor = NS_LossyConvertUTF16toASCII(aVendorID);
   return NS_OK;
 }
 
 /* void spoofDeviceID (in unsigned long aDeviceID); */
 NS_IMETHODIMP GfxInfo::SpoofDeviceID(const nsAString & aDeviceID)
 {
-  mAdapterDeviceID = aDeviceID;
+  EnsureInitializedFromGfxInfoData(); // initialization from GfxInfo data overwrites mRenderer
+  mRenderer = NS_LossyConvertUTF16toASCII(aDeviceID);
   return NS_OK;
 }
 
 /* void spoofDriverVersion (in DOMString aDriverVersion); */
 NS_IMETHODIMP GfxInfo::SpoofDriverVersion(const nsAString & aDriverVersion)
 {
-  mDriverVersion = aDriverVersion;
+  EnsureInitializedFromGfxInfoData(); // initialization from GfxInfo data overwrites mVersion
+  mVersion = NS_LossyConvertUTF16toASCII(aDriverVersion);
   return NS_OK;
 }
 

widget/android/GfxInfo.h

@@ -19,6 +19,8 @@ namespace widget {
 class GfxInfo : public GfxInfoBase
 {
 public:
+  GfxInfo();
+
   // We only declare the subset of nsIGfxInfo that we actually implement. The
   // rest is brought forward from GfxInfoBase.
   NS_SCRIPTABLE NS_IMETHOD GetD2DEnabled(bool *aD2DEnabled);
@@ -45,7 +47,7 @@ public:
   using GfxInfoBase::GetFeatureSuggestedDriverVersion;
   using GfxInfoBase::GetWebGLParameter;
 
-  virtual nsresult Init();
+  void EnsureInitializedFromGfxInfoData();
 
 #ifdef DEBUG
   NS_DECL_ISUPPORTS_INHERITED
@@ -63,21 +65,18 @@ protected:
 
 private:
 
-  void     AddOpenGLCrashReportAnnotations();
+  void AddCrashReportAnnotations();
-  nsString mRendererIDsString;
-  nsString mAdapterRAMString;
 
-  nsString mDeviceID;
+  bool mInitializedFromJavaData;
-  nsString mDriverVersion;
-  nsString mDriverDate;
-  nsString mDeviceKey;
 
-  nsString mAdapterDeviceID;
+  // the GL strings
-  nsString mAdapterVendorID;
+  nsCString mVendor;
-  nsString mAdapterDescription;
+  nsCString mRenderer;
-  PRInt32 mAndroidSDKVersion;
+  nsCString mVersion;
+  // a possible error message produced by the data source (e.g. if EGL initialization failed)
+  nsCString mError;
 
-  PRUint32 mRendererIDs[16];
+  nsCString mAdapterDescription;
 };
 
 } // namespace widget

widget/android/nsScreenManagerAndroid.cpp

@@ -3,6 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#define MOZ_FATAL_ASSERTIONS_FOR_THREAD_SAFETY
+
 #include "nsScreenManagerAndroid.h"
 #include "nsWindow.h"
 #include "AndroidBridge.h"

widget/windows/nsFilePicker.cpp

@@ -564,14 +564,26 @@ nsFilePicker::ShowXPFolderPicker(const nsString& aInitialDir)
   return result;
 }
 
+/*
+ * Show a folder picker post Windows XP
+ * 
+ * @param aInitialDir   The initial directory, the last used directory will be
+ *                      used if left blank.
+ * @param aWasInitError Out parameter will hold true if there was an error
+ *                      before the folder picker is shown.
+ * @return true if a file was selected successfully.
+*/
 bool
-nsFilePicker::ShowFolderPicker(const nsString& aInitialDir)
+nsFilePicker::ShowFolderPicker(const nsString& aInitialDir, bool &aWasInitError)
 {
   nsRefPtr<IFileOpenDialog> dialog;
   if (FAILED(CoCreateInstance(CLSID_FileOpenDialog, NULL, CLSCTX_INPROC,
                               IID_IFileOpenDialog,
-                              getter_AddRefs(dialog))))
+                              getter_AddRefs(dialog)))) {
+    aWasInitError = true;
     return false;
+  }
+  aWasInitError = false;
 
   // hook up event callbacks
   dialog->Advise(this, &mFDECookie);
@@ -840,21 +852,35 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
   return true;
 }
 
+/*
+ * Show a file picker post Windows XP
+ * 
+ * @param aInitialDir   The initial directory, the last used directory will be
+ *                      used if left blank.
+ * @param aWasInitError Out parameter will hold true if there was an error
+ *                      before the file picker is shown.
+ * @return true if a file was selected successfully.
+*/
 bool
-nsFilePicker::ShowFilePicker(const nsString& aInitialDir)
+nsFilePicker::ShowFilePicker(const nsString& aInitialDir, bool &aWasInitError)
 {
   nsRefPtr<IFileDialog> dialog;
   if (mMode != modeSave) {
     if (FAILED(CoCreateInstance(CLSID_FileOpenDialog, NULL, CLSCTX_INPROC,
                                 IID_IFileOpenDialog,
-                                getter_AddRefs(dialog))))
+                                getter_AddRefs(dialog)))) {
+      aWasInitError = true;
       return false;
+    }
   } else {
     if (FAILED(CoCreateInstance(CLSID_FileSaveDialog, NULL, CLSCTX_INPROC,
                                 IID_IFileSaveDialog,
-                                getter_AddRefs(dialog))))
+                                getter_AddRefs(dialog)))) {
+      aWasInitError = true;
       return false;
     }
+  }
+  aWasInitError = false;
 
   // hook up event callbacks
   dialog->Advise(this, &mFDECookie);
@@ -1017,16 +1043,21 @@ nsFilePicker::ShowW(PRInt16 *aReturnVal)
   mUnicodeFile.Truncate();
   mFiles.Clear();
 
-  bool result = false;
+  // Launch the XP file/folder picker on XP and as a fallback on Vista+. 
+  // The CoCreateInstance call to CLSID_FileOpenDialog fails with "(0x80040111)
+  // ClassFactory cannot supply requested class" when the checkbox for
+  // Disable Visual Themes is on in the compatability tab within the shortcut
+  // properties.
+  bool result = false, wasInitError = true;
   if (mMode == modeGetFolder) {
     if (WinUtils::GetWindowsVersion() >= WinUtils::VISTA_VERSION)
-      result = ShowFolderPicker(initialDir);
+      result = ShowFolderPicker(initialDir, wasInitError);
-    else
+    if (!result && wasInitError)
       result = ShowXPFolderPicker(initialDir);
   } else {
     if (WinUtils::GetWindowsVersion() >= WinUtils::VISTA_VERSION)
-      result = ShowFilePicker(initialDir);
+      result = ShowFilePicker(initialDir, wasInitError);
-    else
+    if (!result && wasInitError)
       result = ShowXPFilePicker(initialDir);
   }
 

widget/windows/nsFilePicker.h

@@ -91,8 +91,8 @@ protected:
   bool FilePickerWrapper(OPENFILENAMEW* ofn, PickerType aType);
   bool ShowXPFolderPicker(const nsString& aInitialDir);
   bool ShowXPFilePicker(const nsString& aInitialDir);
-  bool ShowFolderPicker(const nsString& aInitialDir);
+  bool ShowFolderPicker(const nsString& aInitialDir, bool &aWasInitError);
-  bool ShowFilePicker(const nsString& aInitialDir);
+  bool ShowFilePicker(const nsString& aInitialDir, bool &aWasInitError);
   void AppendXPFilter(const nsAString& aTitle, const nsAString& aFilter);
   void RememberLastUsedDirectory();
   bool IsPrivacyModeEnabled();

widget/xpwidgets/nsBaseScreen.cpp

@@ -5,6 +5,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#define MOZ_FATAL_ASSERTIONS_FOR_THREAD_SAFETY
+
 #include "nsBaseScreen.h"
 
 NS_IMPL_ISUPPORTS1(nsBaseScreen, nsIScreen)

widget/xpwidgets/nsBaseWidget.cpp

@@ -853,6 +853,10 @@ nsBaseWidget::GetShouldAccelerate()
   
   if (!whitelisted) {
     NS_WARNING("OpenGL-accelerated layers are not supported on this system.");
+#ifdef MOZ_JAVA_COMPOSITOR
+    NS_RUNTIMEABORT("OpenGL-accelerated layers are a hard requirement on this platform. "
+                    "Cannot continue without support for them.");
+#endif
     return false;
   }
 

xpcom/glue/nsDebug.h

@@ -315,7 +315,10 @@
 /*****************************************************************************/
 
 #ifdef XPCOM_GLUE
-#define NS_CheckThreadSafe
+  #define NS_CheckThreadSafe(owningThread, msg)
+#elif defined MOZ_FATAL_ASSERTIONS_FOR_THREAD_SAFETY
+  #define NS_CheckThreadSafe(owningThread, msg)                 \
+    NS_ABORT_IF_FALSE(owningThread == PR_GetCurrentThread(), msg)
 #else
   #define NS_CheckThreadSafe(owningThread, msg)                 \
     NS_ASSERTION(owningThread == PR_GetCurrentThread(), msg)