Merge mozilla-central to tracemonkey.

browser/base/content/browser.js

@@ -6861,7 +6861,7 @@ let gPrivateBrowsingUI = {
                                    getService(Ci.nsIPrivateBrowsingService);
 
     if (this.privateBrowsingEnabled)
-      this.onEnterPrivateBrowsing();
+      this.onEnterPrivateBrowsing(true);
   },
 
   uninit: function PBUI_unint() {
@@ -6956,7 +6956,7 @@ let gPrivateBrowsingUI = {
     return result;
   },
 
-  onEnterPrivateBrowsing: function PBUI_onEnterPrivateBrowsing() {
+  onEnterPrivateBrowsing: function PBUI_onEnterPrivateBrowsing(aOnWindowOpen) {
     if (BrowserSearch.searchBar)
       this._searchBarValue = BrowserSearch.searchBar.textbox.value;
 
@@ -6993,7 +6993,7 @@ let gPrivateBrowsingUI = {
       DownloadMonitorPanel.updateStatus();
     }, 0);
 
-    if (this._disableUIOnToggle)
+    if (!aOnWindowOpen && this._disableUIOnToggle)
       document.getElementById("Tools:PrivateBrowsing")
               .setAttribute("disabled", "true");
   },

browser/base/content/sanitizeDialog.js

@@ -159,7 +159,7 @@ var gSanitizePromptDialog = {
     // which does not include date and time.  See bug 480169 comment 48.
 
     var warningStringID;
-    if (this.hasCustomizedItemSelection()) {
+    if (this.hasNonSelectedItems()) {
       warningStringID = "sanitizeSelectedWarning";
       if (!aDontShowItemList)
         this.showItemList();
@@ -231,11 +231,11 @@ var gSanitizePromptDialog = {
   /**
    * Check if all of the history items have been selected like the default status.
    */
-  hasCustomizedItemSelection: function () {
+  hasNonSelectedItems: function () {
     let checkboxes = document.querySelectorAll("#itemList > [preference]");
     for (let i = 0; i < checkboxes.length; ++i) {
       let pref = document.getElementById(checkboxes[i].getAttribute("preference"));
-      if (pref.value != pref.defaultValue)
+      if (!pref.value)
         return true;
     }
     return false;

browser/base/content/test/browser_sanitizeDialog.js

@@ -303,8 +303,8 @@ var gAllTests = [
   function () {
     let wh = new WindowHelper();
     wh.onload = function () {
-      // Reset the check boxes and select "Everything"
-      this.resetCheckboxes();
+      // Check all items and select "Everything"
+      this.checkAllCheckboxes();
       this.selectDuration(Sanitizer.TIMESPAN_EVERYTHING);
 
       // Hide details
@@ -317,11 +317,10 @@ var gAllTests = [
   function () {
     let wh = new WindowHelper();
     wh.onload = function () {
-      // Details should remain closed because the items selection is the same
-      // as the default state.
+      // Details should remain closed because all items are checked.
       this.checkDetails(false);
 
-      // Modify the default items state
+      // Uncheck history.
       this.checkPrefCheckbox("history", false);
       this.acceptDialog();
     };
@@ -330,8 +329,20 @@ var gAllTests = [
   function () {
     let wh = new WindowHelper();
     wh.onload = function () {
-      // Details should be open because the items selection is not the same
-      // as the default state.
+      // Details should be open because not all items are checked.
+      this.checkDetails(true);
+
+      // Modify the Site Preferences item state (bug 527820)
+      this.checkAllCheckboxes();
+      this.checkPrefCheckbox("siteSettings", false);
+      this.acceptDialog();
+    };
+    wh.open();
+  },
+  function () {
+    let wh = new WindowHelper();
+    wh.onload = function () {
+      // Details should be open because not all items are checked.
       this.checkDetails(true);
 
       // Hide details
@@ -344,8 +355,7 @@ var gAllTests = [
   function () {
     let wh = new WindowHelper();
     wh.onload = function () {
-      // Details should be open because the items selection is not the same
-      // as the default state.
+      // Details should be open because not all items are checked.
       this.checkDetails(true);
 
       // Select another duration
@@ -469,14 +479,14 @@ WindowHelper.prototype = {
   },
 
   /**
-   * Resets the checkboxes to their default state.
+   * Makes sure all the checkboxes are checked.
    */
-  resetCheckboxes: function () {
+  checkAllCheckboxes: function () {
     var cb = this.win.document.querySelectorAll("#itemList > [preference]");
     ok(cb.length > 1, "found checkboxes for preferences");
     for (var i = 0; i < cb.length; ++i) {
       var pref = this.win.document.getElementById(cb[i].getAttribute("preference"));
-      if (pref.value != pref.defaultValue)
+      if (!pref.value)
         cb[i].click();
     }
   },

browser/components/preferences/advanced.js

@@ -403,12 +403,12 @@ var gAdvancedPane = {
   {
     var aus = 
         Components.classes["@mozilla.org/updates/update-service;1"].
-        getService(Components.interfaces.nsIApplicationUpdateService);
+        getService(Components.interfaces.nsIApplicationUpdateService2);
 
     var enabledPref = document.getElementById("app.update.enabled");
     var enableAppUpdate = document.getElementById("enableAppUpdate");
 
-    enableAppUpdate.disabled = !aus.canUpdate || enabledPref.locked;
+    enableAppUpdate.disabled = !aus.canCheckForUpdates || enabledPref.locked;
   },
 
   /**

browser/components/privatebrowsing/test/browser/Makefile.in

@@ -56,6 +56,7 @@ _BROWSER_TEST_FILES =  \
 		browser_privatebrowsing_geoprompt.js \
 		browser_privatebrowsing_geoprompt_page.html \
 		browser_privatebrowsing_import.js \
+		browser_privatebrowsing_newwindow_stopcmd.js \
 		browser_privatebrowsing_opendir.js \
 		browser_privatebrowsing_openlocation.js \
 		browser_privatebrowsing_pageinfo.js \

browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js

@@ -0,0 +1,63 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Private Browsing Tests.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Ehsan Akhgari <ehsan.akhgari@gmail.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// This test makes sure that the stop private browsing command is enabled in
+// new windows opened from the private browsing mode (bug 529667).
+
+function test() {
+  // initialization
+  let pb = Cc["@mozilla.org/privatebrowsing;1"].
+           getService(Ci.nsIPrivateBrowsingService);
+  waitForExplicitFinish();
+
+  pb.privateBrowsingEnabled = true;
+
+  let win = OpenBrowserWindow();
+  win.addEventListener("load", function() {
+    executeSoon(function() {
+      executeSoon(function() {
+        let cmd = win.document.getElementById("Tools:PrivateBrowsing");
+        ok(!cmd.hasAttribute("disabled"),
+           "The Private Browsing command in a new window should be enabled");
+
+        win.close();
+        pb.privateBrowsingEnabled = false;
+        finish();
+      });
+    });
+  }, false);
+}

browser/components/sessionstore/src/nsSessionStore.js

@@ -186,6 +186,9 @@ SessionStoreService.prototype = {
   // whether we clearing history on shutdown
   _clearingOnShutdown: false,
 
+  // List of windows that are being closed during setBrowserState.
+  _closingWindows: [],
+
 #ifndef XP_MACOSX
   // whether the last window was closed and should be restored
   _restoreLastWindow: false,
@@ -340,6 +343,14 @@ SessionStoreService.prototype = {
         }, false);
       break;
     case "domwindowclosed": // catch closed windows
+      if (this._closingWindows.length > 0) {
+        let index = this._closingWindows.indexOf(aSubject);
+        if (index != -1) {
+          this._closingWindows.splice(index, 1);
+          if (this._closingWindows.length == 0)
+            this._sendRestoreCompletedNotifications(true);
+        }
+      }
       this.onClose(aSubject);
       break;
     case "quit-application-requested":
@@ -904,19 +915,21 @@ SessionStoreService.prototype = {
       return;
     }
 
-    // close all other browser windows
-    this._forEachBrowserWindow(function(aWindow) {
-      if (aWindow != window) {
-        aWindow.close();
-      }
-    });
-
     // make sure closed window data isn't kept
     this._closedWindows = [];
 
     // determine how many windows are meant to be restored
     this._restoreCount = state.windows ? state.windows.length : 0;
 
+    var self = this;
+    // close all other browser windows
+    this._forEachBrowserWindow(function(aWindow) {
+      if (aWindow != window) {
+        self._closingWindows.push(aWindow);
+        aWindow.close();
+      }
+    });
+
     // restore to the given state
     this.restoreWindow(window, state, true);
   },
@@ -2863,17 +2876,18 @@ SessionStoreService.prototype = {
     return jsonString;
   },
 
-  _sendRestoreCompletedNotifications: function sss_sendRestoreCompletedNotifications() {
-    if (this._restoreCount) {
+  _sendRestoreCompletedNotifications:
+  function sss_sendRestoreCompletedNotifications(aOnWindowClose) {
+    if (this._restoreCount && !aOnWindowClose)
       this._restoreCount--;
-      if (this._restoreCount == 0) {
+
+    if (this._restoreCount == 0 && this._closingWindows.length == 0) {
       // This was the last window restored at startup, notify observers.
       this._observerService.notifyObservers(null,
         this._browserSetState ? NOTIFY_BROWSER_STATE_RESTORED : NOTIFY_WINDOWS_RESTORED,
         "");
       this._browserSetState = false;
     }
-    }
   },
 
   /**

browser/components/sessionstore/test/browser/browser_459906.js

@@ -49,7 +49,7 @@ function test() {
     // wait for all frames to load completely
     if (frameCount++ < 2)
       return;
-    this.removeEventListener("load", arguments.callee, true);
+    tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
 
     let iframes = tab.linkedBrowser.contentWindow.frames;
     iframes[1].document.body.innerHTML = uniqueValue;
@@ -60,18 +60,10 @@ function test() {
       // wait for all frames to load (and reload!) completely
       if (frameCount++ < 2)
         return;
-      this.removeEventListener("load", arguments.callee, true);
+      tab2.linkedBrowser.removeEventListener("load", arguments.callee, true);
 
-      let pass = 0;
-      const MAX_PASS = 6;
       executeSoon(function() {
-        info("Checking innerHTML, pass: " + (pass + 1));
         let iframes = tab2.linkedBrowser.contentWindow.frames;
-        if (iframes[1].document.body.innerHTML != uniqueValue &&
-            ++pass <= MAX_PASS) {
-          setTimeout(arguments.callee, 500);
-          return;
-        }
         is(iframes[1].document.body.innerHTML, uniqueValue,
            "rich textarea's content correctly duplicated");
 

browser/components/sessionstore/test/browser/browser_459906_sample.html

@@ -8,8 +8,14 @@
 <iframe></iframe>
 
 <script type="application/javascript">
-  frames[0].addEventListener("DOMContentLoaded", function() {
-    frames[0].removeEventListener("DOMContentLoaded", arguments.callee, false);
+  var loadCount = 0;
+  frames[0].addEventListener("DOMContentLoaded", handleLoad, false);
+  frames[1].addEventListener("DOMContentLoaded", handleLoad, false);
+  function handleLoad() {
+    if (++loadCount < 2)
+      return;
+    frames[0].removeEventListener("DOMContentLoaded", handleLoad, false);
+    frames[1].removeEventListener("DOMContentLoaded", handleLoad, false);
     frames[0].document.designMode = "on";
     frames[0].document.__defineGetter__("designMode", function() {
       // inject a cross domain file ...
@@ -31,6 +37,6 @@
     });
 
     frames[1].document.designMode = "on";
-  }, false);
+  };
 </script>
 </body>

browser/components/sessionstore/test/browser/browser_461634.js

@@ -78,7 +78,7 @@ function test() {
   }
   
   // open a window and add the above closed tab list
-  let newWin = open(location, "", "chrome,all");
+  let newWin = openDialog(location, "", "chrome,all,dialog=no");
   newWin.addEventListener("load", function(aEvent) {
     gPrefService.setIntPref("browser.sessionstore.max_tabs_undo",
                             test_state.windows[0]._closedTabs.length);

browser/components/sessionstore/test/browser/browser_461743.js

@@ -42,14 +42,14 @@ function test() {
   let testURL = "http://localhost:8888/browser/" +
     "browser/components/sessionstore/test/browser/browser_461743_sample.html";
 
+  let frameCount = 0;
   let tab = gBrowser.addTab(testURL);
-  info("New tab added");
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
-    info("New tab loaded");
+    // Wait for all frames to load completely.
+    if (frameCount++ < 2)
+      return;
     tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
-    executeSoon(function() {
     let tab2 = gBrowser.duplicateTab(tab);
-      info("Duplicated tab");
     tab2.linkedBrowser.addEventListener("461743", function(aEvent) {
       tab2.linkedBrowser.removeEventListener("461743", arguments.callee, true);
       is(aEvent.data, "done", "XSS injection was attempted");
@@ -60,13 +60,12 @@ function test() {
         isnot(innerHTML, Components.utils.reportError.toString(),
               "chrome access denied!");
 
-          // clean up
+        // Clean up.
         gBrowser.removeTab(tab2);
         gBrowser.removeTab(tab);
 
         finish();
       });
     }, true, true);
-    });
   }, true);
 }

browser/components/sessionstore/test/browser/browser_461743_sample.html

@@ -11,7 +11,15 @@
   var chromeUrl = "chrome://global/content/mozilla.xhtml";
   var exploitUrl = "javascript:try { document.body.innerHTML = Components.utils.reportError; } catch (ex) { }";
 
-  window.onload = function() {
+  var loadCount = 0;
+  frames[0].addEventListener("DOMContentLoaded", handleLoad, false);
+  frames[1].addEventListener("DOMContentLoaded", handleLoad, false);
+  function handleLoad() {
+    if (++loadCount < 2)
+      return;
+    frames[0].removeEventListener("DOMContentLoaded", handleLoad, false);
+    frames[1].removeEventListener("DOMContentLoaded", handleLoad, false);
+
     var flip = 0;
     MutationEvent.prototype.toString = function() {
       return flip++ == 0 ? chromeUrl : exploitUrl;

browser/components/sessionstore/test/browser/browser_464199.js

@@ -86,7 +86,7 @@ function test() {
     aClosedTabList.filter(function(aData) aData.title == aTitle).length;
   
   // open a window and add the above closed tab list
-  let newWin = open(location, "", "chrome,all");
+  let newWin = openDialog(location, "", "chrome,all,dialog=no");
   newWin.addEventListener("load", function(aEvent) {
     gPrefService.setIntPref("browser.sessionstore.max_tabs_undo",
                             test_state.windows[0]._closedTabs.length);

browser/components/sessionstore/test/browser/browser_522545.js

@@ -55,17 +55,21 @@ function test() {
 
   let ss = Cc["@mozilla.org/browser/sessionstore;1"].
            getService(Ci.nsISessionStore);
-  let os = Cc["@mozilla.org/observer-service;1"].
-           getService(Ci.nsIObserverService);
 
   function waitForBrowserState(aState, aSetStateCallback) {
-    let observer = {
-      observe: function(aSubject, aTopic, aData) {
-        os.removeObserver(this, "sessionstore-browser-state-restored");
+    var locationChanges = 0;
+    gBrowser.addTabsProgressListener({
+      onLocationChange: function (aBrowser) {
+        if (++locationChanges == aState.windows[0].tabs.length) {
+          gBrowser.removeTabsProgressListener(this);
           executeSoon(aSetStateCallback);
         }
-    };
-    os.addObserver(observer, "sessionstore-browser-state-restored", false);
+      },
+      onProgressChange: function () {},
+      onSecurityChange: function () {},
+      onStateChange: function () {},
+      onStatusChange: function () {}
+    });
     ss.setBrowserState(JSON.stringify(aState));
   }
 
@@ -300,11 +304,9 @@ function test() {
                test_getBrowserState_lotsOfTabsOpening,
                test_getBrowserState_userTypedValue, test_userTypedClearLoadURI];
   let originalState = ss.getBrowserState();
-  info(JSON.parse(originalState).windows.length);
-  info(originalState);
   function runNextTest() {
     if (tests.length) {
-      tests.shift().call();
+      tests.shift()();
     } else {
       ss.setBrowserState(originalState);
       executeSoon(function () {

build/win32/crashinject.cpp

@@ -43,7 +43,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <Windows.h>
+#include <windows.h>
 
 int main(int argc, char** argv)
 {

build/win32/crashinjectdll/crashinjectdll.cpp

@@ -1,5 +1,5 @@
 #include <stdio.h>
-#include <Windows.h>
+#include <windows.h>
 
 // make sure we only ever spawn one thread
 DWORD tid = -1;

config/rules.mk

@@ -362,6 +362,9 @@ endif # WINNT
 
 ifeq ($(SOLARIS_SUNPRO_CXX),1)
 CXXFLAGS += -features=extensions -D__FUNCTION__=__func__
+ifeq (86,$(findstring 86,$(OS_TEST)))
+OS_LDFLAGS += -M $(topsrcdir)/config/solaris_ia32.map
+endif # x86
 endif # Solaris Sun Studio C++
 
 ifeq (,$(filter-out WINNT WINCE,$(HOST_OS_ARCH)))

config/solaris_ia32.map

@@ -0,0 +1 @@
+hwcap_1 = OVERRIDE;

content/base/public/nsIObjectLoadingContent.idl

@@ -39,11 +39,13 @@
 
 interface nsIObjectFrame;
 interface nsIPluginInstance;
+interface nsIDOMElement;
+interface nsIDOMClientRect;
 
 /**
  * This interface represents a content node that loads objects.
  */
-[scriptable, uuid(90ab443e-3e99-405e-88c9-9c42adaa3217)]
+[scriptable, uuid(8afe3b08-293c-48bd-a997-321745478611)]
 interface nsIObjectLoadingContent : nsISupports
 {
   const unsigned long TYPE_LOADING  = 0;
@@ -105,4 +107,12 @@ interface nsIObjectLoadingContent : nsISupports
    * because nsIObjectFrame is unscriptable.
    */
   [noscript] void hasNewFrame(in nsIObjectFrame aFrame);
+
+  /**
+   * Tells the object to paint directly in this location ignoring any
+   * positioning information that may have been provided otherwise
+   */
+  void setAbsoluteScreenPosition(in nsIDOMElement element,
+                                 in nsIDOMClientRect position,
+                                 in nsIDOMClientRect clip);
 };

content/base/src/nsDOMFileReader.cpp

@@ -360,6 +360,28 @@ nsDOMFileReader::OnStartRequest(nsIRequest *request, nsISupports *ctxt)
   return NS_OK;
 }
 
+static
+NS_METHOD
+ReadFuncBinaryString(nsIInputStream* in,
+                     void* closure,
+                     const char* fromRawSegment,
+                     PRUint32 toOffset,
+                     PRUint32 count,
+                     PRUint32 *writeCount)
+{
+  PRUnichar* dest = static_cast<PRUnichar*>(closure) + toOffset;
+  PRUnichar* end = dest + count;
+  const unsigned char* source = (const unsigned char*)fromRawSegment;
+  while (dest != end) {
+    *dest = *source;
+    ++dest;
+    ++source;
+  }
+  *writeCount = count;
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMFileReader::OnDataAvailable(nsIRequest *aRequest,
                                  nsISupports *aContext,
@@ -367,6 +389,21 @@ nsDOMFileReader::OnDataAvailable(nsIRequest *aRequest,
                                  PRUint32 aOffset,
                                  PRUint32 aCount)
 {
+  //Continuously update our binary string as data comes in
+  if (mDataFormat == FILE_AS_BINARY) {
+    PRUint32 oldLen = mResult.Length();
+    PRUnichar *buf = nsnull;
+    mResult.GetMutableData(&buf, oldLen + aCount);
+    NS_ENSURE_TRUE(buf, NS_ERROR_OUT_OF_MEMORY);
+
+    PRUint32 bytesRead;
+    aInputStream->ReadSegments(ReadFuncBinaryString, buf + oldLen, aCount,
+                               &bytesRead);
+    NS_ASSERTION(bytesRead == aCount, "failed to read data");
+
+    return NS_OK;
+  }
+
   //Update memory buffer to reflect the contents of the file
   mFileData = (char *)PR_Realloc(mFileData, aOffset + aCount);
   NS_ENSURE_TRUE(mFileData, NS_ERROR_OUT_OF_MEMORY);
@@ -375,27 +412,6 @@ nsDOMFileReader::OnDataAvailable(nsIRequest *aRequest,
   mDataLen += aCount;
   mReadTransferred = mDataLen;
 
-  //Continuously update our binary string as data comes in
-  if (mDataFormat == FILE_AS_BINARY) {
-    PRUint32 oldLen = mResult.Length();
-    PRUint32 newLen = oldLen + aCount;
-    PRUnichar *buf; 
-
-    if (mResult.GetMutableData(&buf, newLen) != newLen) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-
-    PRUnichar *bufEnd = buf + newLen;
-    buf += oldLen;
-
-    char *source = mFileData + aOffset;
-    while (buf < bufEnd) {
-      *buf = *source;
-      ++buf;
-      ++source;
-    }
-  }
-
   //Notify the timer is the appropriate timeframe has passed
   if (mTimerIsActive) {
     mProgressEventWasDelayed = PR_TRUE;
@@ -469,6 +485,7 @@ nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
   mDataFormat = aDataFormat;
   mCharset = aCharset;
   mError = nsnull;
+  SetDOMStringToNull(mResult);
 
   //Obtain the nsDOMFile's underlying nsIFile
   nsresult rv;

content/base/src/nsImageLoadingContent.cpp

@@ -600,6 +600,8 @@ nsImageLoadingContent::LoadImage(nsIURI* aNewURI,
                                  nsLoadFlags aLoadFlags)
 {
   if (!mLoadingEnabled) {
+    // XXX Why fire an error here? seems like the callers to SetLoadingEnabled
+    // don't want/need it.
     FireEvent(NS_LITERAL_STRING("error"));
     return NS_OK;
   }

content/base/src/nsObjectLoadingContent.cpp

@@ -890,7 +890,6 @@ nsObjectLoadingContent::GetInterface(const nsIID & aIID, void **aResult)
     NS_ADDREF(sink);
     return NS_OK;
   }
-
   return NS_NOINTERFACE;
 }
 
@@ -1872,3 +1871,17 @@ nsObjectLoadingContent::GetPluginDisabledState(const nsCString& aContentType)
     return ePluginBlocklisted;
   return ePluginUnsupported;
 }
+
+NS_IMETHODIMP
+nsObjectLoadingContent::SetAbsoluteScreenPosition(nsIDOMElement* element,
+                                                  nsIDOMClientRect* position,
+                                                  nsIDOMClientRect* clip)
+{
+  nsIObjectFrame* frame = GetExistingFrame(eFlushLayout);
+  if (!frame)
+    return NS_ERROR_NOT_AVAILABLE;
+
+  return frame->SetAbsoluteScreenPosition(element, position, clip);
+}
+
+

content/base/src/nsScriptLoader.cpp

@@ -509,15 +509,6 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         !aElement->GetScriptAsync();
       mPreloads.RemoveElementAt(i);
 
-      if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-        nsCString spec;
-        request->mURI->GetSpec(spec);
-        printf("Grabbing existing speculative load for %s (%p). async:%d defer:%d\n",
-               spec.get(), request.get(), aElement->GetScriptAsync(),
-               request->mDefer);
-      }
-
-
       rv = CheckContentPolicy(mDocument, aElement, request->mURI, type);
       if (NS_FAILED(rv)) {
         // Note, we're dropping our last ref to request here.
@@ -567,14 +558,6 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     request->mIsInline = PR_FALSE;
     request->mLoading = PR_TRUE;
 
-    if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-      nsCString spec;
-      request->mURI->GetSpec(spec);
-      printf("Starting normal load for %s (%p). async:%d defer:%d\n",
-             spec.get(), request.get(), aElement->GetScriptAsync(),
-             request->mDefer);
-    }
-
     rv = StartLoad(request, type);
     if (NS_FAILED(rv)) {
       return rv;
@@ -587,10 +570,6 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
     request->mLineNo = aElement->GetScriptLineNumber();
 
-    if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-      printf("Creating inline request (%p).\n", request.get());
-    }
-
     // If we've got existing pending requests, add ourselves
     // to this list.
     if (!hadPendingRequests && ReadyToExecuteScripts() &&
@@ -630,10 +609,6 @@ nsScriptLoader::ProcessRequest(nsScriptLoadRequest* aRequest)
   nsAFlatString* script;
   nsAutoString textData;
 
-  if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-    printf("Running request (%p).\n", aRequest);
-  }
-
   // If there's no script text, we try to get it from the element
   if (aRequest->mIsInline) {
     // XXX This is inefficient - GetText makes multiple
@@ -984,13 +959,6 @@ nsScriptLoader::OnStreamComplete(nsIStreamLoader* aLoader,
   NS_ASSERTION(request, "null request in stream complete handler");
   NS_ENSURE_TRUE(request, NS_ERROR_FAILURE);
 
-  if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-    nsCString spec;
-    request->mURI->GetSpec(spec);
-    printf("Finished loading %s (%p). status:%d\n", spec.get(), request,
-           aStatus);
-  }
-
   nsresult rv = PrepareLoadedRequest(request, aLoader, aStatus, aStringLen,
                                      aString);
   if (NS_FAILED(rv)) {
@@ -1144,14 +1112,6 @@ nsScriptLoader::PreloadURI(nsIURI *aURI, const nsAString &aCharset,
   request->mLoading = PR_TRUE;
   request->mDefer = PR_FALSE; // This is computed later when we go to execute the
                               // script.
-
-  if (nsContentUtils::GetBoolPref("content.scriptloader.logloads")) {
-    nsCString spec;
-    request->mURI->GetSpec(spec);
-    printf("Starting speculative load for %s (%p).\n", spec.get(),
-           request.get());
-  }
-
   nsresult rv = StartLoad(request, aType);
   if (NS_FAILED(rv)) {
     return;

content/base/test/file_bug503481b_inner.html

@@ -4,19 +4,10 @@
 <!-- Async script that isn't preloaded -->
 <script async src="file_bug503481.sjs?blockOn=R&body=runFirst();"></script>
 <script>
-function enableLogs(b) {
-  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-  var prefs = Components.classes["@mozilla.org/preferences-service;1"]
-              .getService(Components.interfaces.nsIPrefBranch);
-  prefs.setBoolPref("content.scriptloader.logloads", b);
-}
-enableLogs(true);
 firstRan = false;
 secondRan = false;
 thirdRan = false;
 forthRan = false;
-fifthRan = false;
-sixthRan = false;
 function runFirst() {
   firstRan = true;
 }
@@ -28,23 +19,12 @@ function runThird() {
 function runForth() {
   forthRan = true;
 }
-function runFifth() {
-  parent.is(sixthRan, false, "sixth should be not run before non-async fifth");
-  fifthRan = true;
-}
-function runSixth() {
-  parent.is(fifthRan, true, "fifth should run before async sixth");
-  sixthRan = true;
-}
 
 function done() {
   parent.is(firstRan, true, "first should have run by onload");
   parent.is(secondRan, true, "second should have run by onload");
   parent.is(thirdRan, true, "third should have run by onload");
   parent.is(forthRan, true, "forth should have run by onload");
-  parent.is(fifthRan, true, "fifth should have run by onload");
-  parent.is(sixthRan, true, "sixth should have run by onload");
-  enableLogs(false);
   parent.SimpleTest.finish();
 }
 
@@ -65,7 +45,7 @@ unblock("R");
 <script async>
 secondRan = true;
 </script>
-<script async>
+<script>
 parent.is(secondRan, true, "Second script shouldn't be async");
 </script>
 
@@ -77,17 +57,6 @@ unblock("S");
 </script>
 <script src="file_bug503481.sjs?blockOn=T&body=runForth();"></script>
 
-<!-- test that preloading an async script works -->
-<script>
-setTimeout(function () { unblock("U"); }, 1000);
-</script>
-<script src="file_bug503481.sjs?blockOn=U&body=runFifth();"></script>
-<script async src="file_bug503481.sjs?blockOn=V&body=runSixth();"></script>
-<script>
-parent.is(fifthRan, true, "fifth should have run by now");
-parent.is(sixthRan, false, "sixth should not have run yet");
-unblock("V");
-</script>
 </head>
 
 <body onload="done()">

content/base/test/test_fileapi.html

@@ -20,272 +20,235 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=414796
 
 <pre id="test">
 <script class="testbody" type="text/javascript">
-
-var testCounter = 0;
+const minFileSize = 20000;
+var fileNum = 1;
+var testRanCounter = 0;
+var expectedTestCount = 0;
 SimpleTest.waitForExplicitFinish();
 netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
-// Write a test file > 8192 characters
-
 is(FileReader.EMPTY, 0, "correct EMPTY value");
 is(FileReader.LOADING, 1, "correct LOADING value");
 is(FileReader.DONE, 2, "correct DONE value");
 
-var testData = "asdfblahqwer";
-for (var i = 0; i < 10; i++) {
-  testData = testData + testData;
+// Create strings containing data we'll test with. We'll want long
+// strings to ensure they span multiple buffers while loading
+var testTextData = "asd b\tlah\u1234w\u00a0r";
+while (testTextData.length < minFileSize) {
+  testTextData = testTextData + testTextData;
 }
-var testData2 = testData + "a";
-var testData3 = testData + "as";
 
-//Ensure we have different sizes of data for thoroughly testing data URI retrieval
-is(testData.length % 3, 0, "Need to have data length % 3 == 0");
-is(testData2.length % 3, 1, "Need to have data length % 3 == 1");
-is(testData3.length % 3, 2, "Need to have data lenght % 3 == 2");
-
-//Create UTF data that should be the same for UTF-16
-var utf16Data = "\0a\0s\0d\0f\0b\0l\0a\0h\0q\0w\0e\0r";
-for (var i = 0; i < 10; i++) {
-  utf16Data = utf16Data + utf16Data;
+var testASCIIData = "abcdef 123456\n";
+while (testASCIIData.length < minFileSize) {
+  testASCIIData = testASCIIData + testASCIIData;
 }
-var utf16File = createFileWithData(utf16Data, "01");
 
-//Create UTF data that should be the same for UTF-32
-var utf32Data = "\0\0\0a\0\0\0s\0\0\0d\0\0\0f\0\0\0b\0\0\0l\0\0\0a\0\0\0h\0\0\0q\0\0\0w\0\0\0e\0\0\0r";
-for (var i = 0; i < 10; i++) {
-  utf32Data = utf32Data + utf32Data;
+var testBinaryData = "";
+for (var i = 0; i < 256; i++) {
+  testBinaryData += String.fromCharCode(i);
+}
+while (testBinaryData.length < minFileSize) {
+  testBinaryData = testBinaryData + testBinaryData;
 }
-var utf32File = createFileWithData(utf32Data, "001");
 
-//Obtain a variety of encodings so we can test async return values
-var file = createFileWithData(testData, "00");
-var domFileData = file.getAsDataURL();
-var domFileBinary = file.getAsBinary();
 
-var domFileBinary2 = utf16File.getAsBinary();
-var domFileBinary3 = utf32File.getAsBinary();
-
-var request1 = new FileReader();
-is(request1.readyState, FileReader.EMPTY, "correct initial readyState");
-request1.onload = handleTextISO1;
-request1.readAsText(file, "iso-8859-1");
-is(request1.readyState, FileReader.LOADING, "correct loading readyState");
-
-var request2 = new FileReader();
-request2.onload = handleTextUTF8;
-request2.readAsText(file);
-
-var request3 = new FileReader();
-request3.onload = handleTextUTF8;
-request3.readAsText(file, "");
-
-var request4 = new FileReader();
-request4.onload = handleTextUTF8;
-request4.readAsText(file, "UTF-8");
-
-//Test a variety of encodings, and make sure they work properly
-//Also, test a variety of the same calls with different numbers of arguments
-var request5 = new FileReader();
-request5.onload = handleTextUTF16;
-request5.readAsText(utf16File, "UTF-16");
-
-var request6 = new FileReader();
-request6.onload = handleTextUTF32;
-request6.readAsText(utf32File, "UTF-32");
-
-//Test binary data accessor
-var request7 = new FileReader();
-is(request7.readyState, FileReader.EMPTY, "correct initial readyState");
-request7.onload = handleDataBinary;
-request7.readAsBinaryString(file);
-is(request7.readyState, FileReader.LOADING, "correct loading readyState");
-
-var request71 = new FileReader();
-request71.onload = handleDataBinary16;
-request71.readAsBinaryString(utf16File);
-
-var request72 = new FileReader();
-request72.onload = handleDataBinary32;
-request72.readAsBinaryString(utf32File);
-
-//Test data URI encoding on differing file sizes
-//Testing data URI when length % 3 == 0
-var request8 = new FileReader();
-request8.onload = handleDataURI;
-request8.readAsDataURL(file);
-
-//Testing data URI when length % 3 == 1
-var file2 = createFileWithData(testData2, "02");
-var domFileData1 = file2.getAsDataURL();
-
-var request9 = new FileReader();
-request9.onload = handleDataURI1;
-request9.readAsDataURL(file2);
-
-//Testing data URI when length % 3 == 2
-var file3 = createFileWithData(testData3, "03");
-var domFileData2 = file3.getAsDataURL();
-
-var request10 = new FileReader();
-request10.onload = handleDataURI2;
-request10.readAsDataURL(file3);
-
-//Test asynchronous property of file access
-var globalVar = 0;
-var request105 = new FileReader();
-request105.onload = incGlobalVar;
-request105.readAsText(file, "");
-is(globalVar, 0, "testing to make sure getAsText doesn't block subsequent execution");
-
-//Create second file for testing cancelReads()
-var dirSvc = Components.classes["@mozilla.org/file/directory_service;1"].getService(Components.interfaces.nsIProperties);
-var testFile4 = dirSvc.get("ProfD", Components.interfaces.nsIFile);
-testFile4.append("testfile04");
-var outStream4 = Components.classes["@mozilla.org/network/file-output-stream;1"].createInstance(Components.interfaces.nsIFileOutputStream);
-outStream4.init(testFile4, 0x02 | 0x08 | 0x20, 0666, 0);
-outStream4.write(testData, testData.length);
-outStream4.close();
+//Set up files for testing
+var asciiFile = createFileWithData(testASCIIData);
+var binaryFile = createFileWithData(testBinaryData);
 
 var fileList = document.getElementById('fileList');
-fileList.value = testFile4.path;
-var file4 = fileList.files[0];
+fileList.value = "/none/existing/path/fileAPI/testing";
+var nonExistingFile = fileList.files[0];
 
-var request11 = new FileReader();
-request11.onabort = handleCancel;
-request11.readAsText(file4);
-request11.abort();
+// Test that plain reading works and fires events as expected, both
+// for text and binary reading
+var onloadHasRunText = false;
+var onloadStartHasRunText = false;
+r = new FileReader();
+is(r.readyState, FileReader.EMPTY, "correct initial text readyState");
+r.onload = getLoadHandler(testASCIIData, "plain reading");
+r.addEventListener("load", function() { onloadHasRunText = true }, false);
+r.addEventListener("loadstart", function() { onloadStartHasRunText = true }, false);
+r.readAsText(asciiFile);
+is(r.readyState, FileReader.LOADING, "correct loading text readyState");
+is(onloadHasRunText, false, "text loading must be async");
+is(onloadStartHasRunText, true, "text loadstart should fire sync");
+expectedTestCount++;
 
-//Test error handling - Note: currently throws exceptions
-/*testFile4.permissions = 0;
-var request12 = new FileReader();
-request12.onerror = handleSecurityError;
-request12.readAsText(file4, "");
+var onloadHasRunBinary = false;
+var onloadStartHasRunBinary = false;
+r = new FileReader();
+is(r.readyState, FileReader.EMPTY, "correct initial binary readyState");
+r.addEventListener("load", function() { onloadHasRunBinary = true }, false);
+r.addEventListener("loadstart", function() { onloadStartHasRunBinary = true }, false);
+r.readAsBinaryString(binaryFile);
+r.onload = getLoadHandler(testBinaryData, "binary reading");
+is(r.readyState, FileReader.LOADING, "correct loading binary readyState");
+is(onloadHasRunBinary, false, "binary loading must be async");
+is(onloadStartHasRunBinary, true, "binary loadstart should fire sync");
+expectedTestCount++;
 
-testFile4.remove(false);
-var request13 = new FileReader();
-request13.onerror = handleNotFoundError;
-request13.readAsText(file4, "");*/
 
-//Corresponding callback functions
-function incGlobalVar(fileAsText) {
-  globalVar++;
+// Test a variety of encodings, and make sure they work properly
+r = new FileReader();
+r.onload = getLoadHandler(testASCIIData, "no encoding reading");
+r.readAsText(asciiFile, "");
+expectedTestCount++;
+
+r = new FileReader();
+r.onload = getLoadHandler(testASCIIData, "iso8859 reading");
+r.readAsText(asciiFile, "iso-8859-1");
+expectedTestCount++;
+
+r = new FileReader();
+r.onload = getLoadHandler(testTextData, "utf8 reading");
+r.readAsText(createFileWithData(convertToUTF8(testTextData)), "utf8");
+expectedTestCount++;
+
+r = new FileReader();
+r.readAsText(createFileWithData(convertToUTF16(testTextData)), "utf-16");
+r.onload = getLoadHandler(testTextData, "utf16 reading");
+expectedTestCount++;
+
+r = new FileReader();
+r.onload = getLoadHandler(testTextData, "utf32 reading");
+r.readAsText(createFileWithData(convertToUTF32(testTextData)), "UTF-32");
+expectedTestCount++;
+
+
+// Test reusing a FileReader to read multiple times
+r = new FileReader();
+r.onload = getLoadHandler(testASCIIData, "to-be-reused reading")
+var makeAnotherReadListener = function(event) {
+  r = event.target;
+  r.removeEventListener("load", makeAnotherReadListener, false);
+  r.onload = getLoadHandler(testBinaryData, "reused reading");
+  r.readAsBinaryString(binaryFile);
+};
+r.addEventListener("load", makeAnotherReadListener, false);
+r.readAsText(asciiFile, "");
+expectedTestCount += 2;
+
+
+//Test data-URI encoding on differing file sizes
+dataurldata = testBinaryData.substr(0, testBinaryData.length -
+                                       testBinaryData.length % 3);
+is(dataurldata.length % 3, 0, "Want to test data with length % 3 == 0");
+r = new FileReader();
+r.onload = getLoadHandler(convertToDataURL(dataurldata),
+                          "dataurl reading, %3 = 0");
+r.readAsDataURL(createFileWithData(dataurldata));
+expectedTestCount++;
+
+dataurldata = testBinaryData.substr(0, testBinaryData.length - 2 -
+                                       testBinaryData.length % 3);
+is(dataurldata.length % 3, 1, "Want to test data with length % 3 == 1");
+r = new FileReader();
+r.onload = getLoadHandler(convertToDataURL(dataurldata),
+                          "dataurl reading, %3 = 1");
+r.readAsDataURL(createFileWithData(dataurldata));
+expectedTestCount++;
+
+dataurldata = testBinaryData.substr(0, testBinaryData.length - 1 -
+                                       testBinaryData.length % 3);
+is(dataurldata.length % 3, 2, "Want to test data with length % 3 == 2");
+r = new FileReader();
+r.onload = getLoadHandler(convertToDataURL(dataurldata),
+                          "dataurl reading, %3 = 2");
+r.readAsDataURL(createFileWithData(dataurldata));
+expectedTestCount++;
+
+
+// Test abort()
+var abortHasRun = false;
+var loadEndHasRun = false;
+r = new FileReader();
+r.onabort = function (event) {
+  is(abortHasRun, false, "abort should only fire once");
+  is(loadEndHasRun, false, "loadend shouldn't have fired yet");
+  abortHasRun = true;
+  is(event.target.readyState, FileReader.DONE, "should be DONE while firing onabort");
+  is(event.target.error.code, FileError.ABORT_ERR, "error code set to CANCELED for canceled reads");
+  is(event.target.result, null, "file data should be null on canceled reads");
 }
+r.onloadend = function (event) {
+  is(abortHasRun, true, "abort should fire before loadend");
+  is(loadEndHasRun, false, "loadend should only fire once");
+  loadEndHasRun = true;
+  is(event.target.readyState, FileReader.DONE, "should be DONE while firing onabort");
+  is(event.target.error.code, FileError.ABORT_ERR, "error code set to CANCELED for canceled reads");
+  is(event.target.result, null, "file data should be null on canceled reads");
+}
+r.onload = function() { ok(false, "load should not fire for aborted reads") };
+r.onerror = function() { ok(false, "error should not fire for aborted reads") };
+r.onprogress = function() { ok(false, "progress should not fire for aborted reads") };
+r.abort();
+is(abortHasRun, false, "abort() is a no-op unless loading");
+r.readAsText(asciiFile);
+r.abort();
+is(abortHasRun, true, "abort should fire sync");
+is(loadEndHasRun, true, "loadend should fire sync");
 
-function handleCancel(event) {
-  var fileAsText = event.target.result;
-  var error = event.target.error;
-  is(error.code, FileError.ABORT_ERR, "error code set to CANCELED for canceled reads");
-  is(fileAsText, null, "file data should be null on canceled reads");
+// Test calling readAsX to cause abort()
+var reuseAbortHasRun = false;
+r = new FileReader();
+r.onabort = function (event) {
+  is(reuseAbortHasRun, false, "abort should only fire once");
+  reuseAbortHasRun = true;
+  is(event.target.readyState, FileReader.DONE, "should be DONE while firing onabort");
+  is(event.target.error.code, FileError.ABORT_ERR, "error code set to CANCELED for canceled reads");
+  is(event.target.result, null, "file data should be null on canceled reads");
+}
+r.onload = function() { ok(false, "load should not fire for aborted reads") };
+r.abort();
+is(reuseAbortHasRun, false, "abort() is a no-op unless loading");
+r.readAsText(asciiFile);
+r.readAsText(asciiFile);
+is(reuseAbortHasRun, true, "abort should fire sync");
+r.onload = getLoadHandler(testASCIIData, "reuse-as-abort reading");
+expectedTestCount++;
+
+
+// Test reading from non-existing files
+r = new FileReader();
+var didThrow = false;
+try {
+  r.readAsDataURL(nonExistingFile);
+} catch(ex) {
+  didThrow = true;
+}
+// Once this test passes, we shoud test that onerror gets called and
+// that the FileReader object is in the right state during that call.
+todo(!didThrow, "shouldn't throw when opening non-existing file, should fire error instead");
+
+
+function getLoadHandler(expectedResult, testName) {
+  return function (event) {
+    is(event.target.readyState, FileReader.DONE,
+       "readyState in test " + testName);
+    is(event.target.error, null,
+       "no error in test " + testName);
+    is(event.target.result, expectedResult,
+       "result in test " + testName);
     testHasRun();
   }
-
-function handleTextISO1(event) {
-  is(event.target.readyState, FileReader.DONE, "correct final readyState");
-  var fileAsText = event.target.result;
-  var error = event.target.error;
-  is(error, null, "error code set to null for successful data accesses");
-  is(testData.length, fileAsText.length, "iso-1 async length should match testdata");
-  is(testData, fileAsText, "iso-1 async string result should match testdata");
-  testHasRun();
-}
-
-function handleTextUTF8(event) {
-  var fileAsUTF8 = event.target.result;
-  var error = event.target.error;
-  is(error, null, "error code set to null for successful data accesses");
-  is(testData.length, fileAsUTF8.length, "UTF-8 async length should match testdata");
-  is(testData, fileAsUTF8, "UTF-8 async string result should match testdata");
-  testHasRun();
-}
-
-function handleTextUTF16(event) {
-  var fileAsUTF16 = event.target.result;
-  var error = event.target.error;
-  is(error, null, "error code set to SUCCESS for successful data accesses");
-  is(testData.length, fileAsUTF16.length, "UTF-16 async length should match testdata");
-  is(testData, fileAsUTF16, "UTF-16 async string result should match testdata");
-  testHasRun();
-}
-
-function handleTextUTF32(event) {
-  var fileAsUTF32 = event.target.result;
-  var error = event.target.error;
-  is(error, null, "error code set to SUCCESS for successful data accesses");
-  is(testData.length, fileAsUTF32.length, "UTF-32 async length should match testdata");
-  is(testData, fileAsUTF32, "UTF-32 async string result should match testdata");
-  testHasRun();
-}
-
-//Tests dataURI.length % 3 == 0
-function handleDataURI(event) {
-  var fileAsDataURI = event.target.result;
-  is(domFileData.length, fileAsDataURI.length, "data URI async length should match dom file data");
-  is(domFileData, fileAsDataURI, "data URI async string result should match dom file data");
-  testHasRun();
-}
-
-//Tests dataURI.length % 3 == 1
-function handleDataURI1(event) {
-  var fileAsDataURI = event.target.result;
-  is(domFileData1.length, fileAsDataURI.length, "data URI async length should match dom file data1");
-  is(domFileData1, fileAsDataURI, "data URI async string result should match dom file data1");
-  testHasRun();
-}
-
-//Tests dataURI.length % 3 == 2
-function handleDataURI2(event) {
-  var fileAsDataURI = event.target.result;
-  is(domFileData2.length, fileAsDataURI.length, "data URI async length should match dom file data2");
-  is(domFileData2, fileAsDataURI, "data URI async string result should match dom file data2");
-  testHasRun();
-}
-
-function handleDataBinary(event) {
-  is(event.target.readyState, FileReader.DONE, "correct final readyState");
-  var fileAsBinary = event.target.result;
-  is(domFileBinary.length, fileAsBinary.length, "binary data async length should match dom file binary");
-  is(domFileBinary, fileAsBinary, "binary data async string result should match dom file binary");
-  testHasRun();
-}
-
-function handleDataBinary16(event) {
-  var fileAsBinary = event.target.result;
-  is(domFileBinary2.length, fileAsBinary.length, "binary data async length should match dom file binary16");
-  is(domFileBinary2, fileAsBinary, "binary data async string result should match dom file binary16");
-  testHasRun();
-}
-
-function handleDataBinary32(event) {
-  var fileAsBinary = event.target.result;
-  is(domFileBinary3.length, fileAsBinary.length, "binary data async length should match dom file binary32");
-  is(domFileBinary3, fileAsBinary, "binary data async string result should match dom file binary32");
-  testHasRun();
-}
-
-function handleSecurityError(event) {
-  var fileAsText = event.target.result;
-  var error = event.target.error;
-  is(error.code, FileError.SECURITY_ERR, "code for file security error should have value 18");
-  is(fileAsText, null, "file content should be null when error is encountered");
-  testHasRun();
-}
-
-function handleNotFoundError(event) {
-  var fileAsText = event.target.result;
-  var error = event.target.error;
-  is(error.code, FileError.NOT_FOUND_ERR, "code for file not found error should have value 8");
-  is(fileAsText, null, "file content should be null when error is encountered");
-  testHasRun();
 }
 
 function testHasRun() {
-  if (++testCounter == 13) SimpleTest.finish();
+ //alert(testRanCounter);
+ ++testRanCounter;
+ if (testRanCounter == expectedTestCount) {
+    is(onloadHasRunText, true, "onload text should have fired by now"); 
+    is(onloadHasRunBinary, true, "onload binary should have fired by now"); 
+    SimpleTest.finish();
+  }
 }
 
-function createFileWithData(fileData, fileNum) {
+function createFileWithData(fileData) {
   var dirSvc = Components.classes["@mozilla.org/file/directory_service;1"].getService(Components.interfaces.nsIProperties);
   var testFile = dirSvc.get("ProfD", Components.interfaces.nsIFile);
-  testFile.append("testfile" + fileNum);
+  testFile.append("fileAPItestfile" + fileNum);
+  fileNum++;
   var outStream = Components.classes["@mozilla.org/network/file-output-stream;1"].createInstance(Components.interfaces.nsIFileOutputStream);
   outStream.init(testFile, 0x02 | 0x08 | 0x20, // write, create, truncate
                  0666, 0);
@@ -298,6 +261,32 @@ function createFileWithData(fileData, fileNum) {
   return fileList.files[0];
 }
 
+function convertToUTF16(s) {
+  res = "";
+  for (var i = 0; i < s.length; ++i) {
+    c = s.charCodeAt(i);
+    res += String.fromCharCode(c >>> 8, c & 255);
+  }
+  return res;
+}
+
+function convertToUTF32(s) {
+  res = "";
+  for (var i = 0; i < s.length; ++i) {
+    c = s.charCodeAt(i);
+    res += "\0\0" + String.fromCharCode(c >>> 8, c & 255);
+  }
+  return res;
+}
+
+function convertToUTF8(s) {
+  return unescape(encodeURIComponent(s));
+}
+
+function convertToDataURL(s) {
+  return "data:application/octet-stream;base64," + btoa(s);
+}
+
 </script>
 </pre>
 </body> </html>

content/html/content/src/nsHTMLFormElement.cpp

@@ -2027,11 +2027,21 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
       NS_ASSERTION(list->Length() > 1,
                    "List should have been converted back to a single element");
 
+      // Fast-path appends; this check is ok even if the child is
+      // already in the list, since if it tests true the child would
+      // have come at the end of the list, and the PositionIsBefore
+      // will test false.
       if(nsContentUtils::PositionIsBefore(list->GetNodeAt(list->Length() - 1), aChild)) {
         list->AppendElement(aChild);
         return NS_OK;
       }
 
+      // If a control has a name equal to its id, it could be in the
+      // list already.
+      if (list->IndexOf(aChild) != -1) {
+        return NS_OK;
+      }
+      
       // first is the first possible insertion index, last is the last possible
       // insertion index
       PRUint32 first = 0;

content/html/content/src/nsHTMLImageElement.cpp

@@ -553,10 +553,15 @@ nsHTMLImageElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
 
   if (HasAttr(kNameSpaceID_None, nsGkAtoms::src)) {
     ClearBrokenState();
+    // If loading is temporarily disabled, don't even launch MaybeLoadImage.
+    // Otherwise MaybeLoadImage may run later when someone has reenabled
+    // loading.
+    if (LoadingEnabled()) {
       nsContentUtils::AddScriptRunner(
         new nsRunnableMethod<nsHTMLImageElement>(this,
                                                  &nsHTMLImageElement::MaybeLoadImage));
     }
+  }
 
   return rv;
 }

content/html/content/src/nsHTMLInputElement.cpp

@@ -2711,6 +2711,15 @@ nsHTMLInputElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
       }
     }
 
+    if (files.Count() == 0) {
+      // If no file was selected, pretend we had an empty file with an
+      // empty filename.
+      aFormSubmission->AddNameFilePair(this, name, EmptyString(), nsnull,
+                                       NS_LITERAL_CSTRING("application/octet-stream"),
+                                       PR_FALSE);
+
+    }
+
     return NS_OK;
   }
 

content/html/content/test/Makefile.in

@@ -141,6 +141,8 @@ _TEST_FILES = 	test_bug589.html \
 		test_bug519987.html \
 		test_bug523771.html \
 		form_submit_server.sjs \
+		test_bug529819.html \
+		test_bug529859.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)

content/html/content/test/test_bug529819.html

@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=529819
+-->
+<head>
+  <title>Test for Bug 529819</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=529819">Mozilla Bug 529819</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<form id="form">
+  <input name="foo" id="foo">
+  <input name="bar" type="radio">
+  <input name="bar" id="bar" type="radio">
+</form>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 529819 **/
+is($("form").elements["foo"] instanceof HTMLInputElement, true, "Should have an element here");
+is($("form").elements["bar"] instanceof HTMLInputElement, false, "Should have a list here");
+is($("form").elements["bar"].length, 2, "Should have a list with two elements here");
+
+</script>
+</pre>
+</body>
+</html>

content/html/content/test/test_bug529859.html

@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=529859
+-->
+<head>
+  <title>Test for Bug 529859</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=529859">Mozilla Bug 529859</a>
+<div id="content">
+  <iframe name="target_iframe" id="target_iframe"></iframe>
+  <form action="form_submit_server.sjs" target="target_iframe" id="form"
+        method="POST" enctype="multipart/form-data">
+    <input id="emptyFileInput" name="emptyFileInput" type="file">
+  </form>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 529859 **/
+
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function() {
+  $("target_iframe").onload = function() {
+    var response = JSON.parse(this.contentDocument.documentElement.textContent);
+    is(response.length, 1, "Unexpected number of inputs");
+    is(response[0].headers["Content-Disposition"],
+       "form-data; name=\"emptyFileInput\"; filename=\"\"",
+       "Incorrect content-disposition");
+    is(response[0].headers["Content-Type"], "application/octet-stream",
+       "Unexpected content-type");
+    SimpleTest.finish();
+  }
+  $("form").submit();
+});
+</script>
+</pre>
+</body>
+</html>

content/html/document/src/nsImageDocument.cpp

@@ -73,6 +73,7 @@
 #include "nsIContentViewer.h"
 #include "nsIMarkupDocumentViewer.h"
 #include "nsIDocShellTreeItem.h"
+#include "nsThreadUtils.h"
 
 #define AUTOMATIC_IMAGE_RESIZING_PREF "browser.enable_automatic_image_resizing"
 #define CLICK_IMAGE_RESIZING_PREF "browser.enable_click_image_resizing"
@@ -127,6 +128,9 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsImageDocument, nsMediaDocument)
 
   friend class ImageListener;
+
+  void DefaultCheckOverflowing() { CheckOverflowing(mResizeImageByDefault); }
+
 protected:
   virtual nsresult CreateSyntheticDocument();
 
@@ -572,7 +576,9 @@ nsImageDocument::OnStartContainer(imgIRequest* aRequest, imgIContainer* aImage)
 {
   aImage->GetWidth(&mImageWidth);
   aImage->GetHeight(&mImageHeight);
-  CheckOverflowing(mResizeImageByDefault);
+  nsCOMPtr<nsIRunnable> runnable =
+    NS_NEW_RUNNABLE_METHOD(nsImageDocument, this, DefaultCheckOverflowing);
+  nsContentUtils::AddScriptRunner(runnable);
   UpdateTitleAndCharset();
 
   return NS_OK;

content/xul/content/src/nsXULElement.cpp

@@ -580,8 +580,10 @@ nsXULElement::IsFocusable(PRInt32 *aTabIndex)
       }
       else {
         // otherwise, if there is no tabindex attribute, just use the value of
-        // *aTabIndex to indicate focusability
+        // *aTabIndex to indicate focusability. Reset any supplied tabindex to 0.
         shouldFocus = *aTabIndex >= 0;
+        if (shouldFocus)
+          *aTabIndex = 0;
       }
 
       if (shouldFocus && sTabFocusModelAppliesToXUL &&

docshell/test/test_bug529119-1.html

@@ -17,25 +17,24 @@ var w = null;
 var phase = 0;
 var gotWrongPageOnTryAgainClick = false;
 
-function pollForPage(expected_title, f, w)
+function pollForPage(f, w)
 {
   // Start with polling after a delay, we might mistakenly take the current page
   // as an expected one.
   window.setTimeout(function() {
-    var iterationsLeft = 20;
+    var iterationsLeft = 200;
     var int = window.setInterval(function() {
       iterationsLeft--;
 
-      netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+      var haveErrorPage = false;
       try {
         var title = w.document.title;
       }
       catch (ex) {
-        alert(ex);
-        return;
+        haveErrorPage = true;
       }
   
-      if (iterationsLeft == 0 || title.match(expected_title)) {
+      if (iterationsLeft == 0 || haveErrorPage) {
         window.clearInterval(int);
         f(iterationsLeft > 0);
       }
@@ -56,7 +55,7 @@ function windowLoaded()
     
       phase = 1;
 
-      pollForPage("Problem loading page", function(succeeded) {
+      pollForPage(function(succeeded) {
         ok(succeeded, "Waiting for error page succeeded");
         
         netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
@@ -64,7 +63,7 @@ function windowLoaded()
            click the "Try Again" button */
         w.location.reload();
 
-        pollForPage("Problem loading page", function(succeeded) {
+        pollForPage(function(succeeded) {
           ok(succeeded, "Waiting for error page succeeded");
           
           netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");

docshell/test/test_bug529119-2.html

@@ -16,25 +16,24 @@ var faultyURL = "http://some-non-existent-domain-27489274c892748217cn2384.com/";
 var w = null;
 var phase = 0;
 
-function pollForPage(expected_title, f, w)
+function pollForPage(expectErrorPage, f, w)
 {
   // Start with polling after a delay, we might mistakenly take the current page
   // as an expected one.
   window.setTimeout(function() {
-    var iterationsLeft = 20;
+    var iterationsLeft = 200;
     var int = window.setInterval(function() {
       iterationsLeft--;
       
-      netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+      var haveErrorPage = false;
       try {
         var title = w.document.title;
       }
       catch (ex) {
-        alert(ex);
-        return;
+        haveErrorPage = true;
       }
   
-      if (iterationsLeft == 0 || title.match(expected_title)) {
+      if (iterationsLeft == 0 || expectErrorPage == haveErrorPage) {
         window.clearInterval(int);
         f(iterationsLeft > 0);
       }
@@ -52,7 +51,7 @@ function windowLoaded()
     w.location.href = faultyURL;
   }, 0);
 
-  pollForPage("Problem loading page", function(succeeded) {
+  pollForPage(true, function(succeeded) {
     ok(succeeded, "Waiting for error page succeeded");
     
     netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
@@ -64,7 +63,7 @@ function windowLoaded()
       ok(false, "w.back() threw " + ex);
     }
 
-    pollForPage("Test bug 529119, sub-window", function(succeeded) {
+    pollForPage(false, function(succeeded) {
       ok(succeeded, "Waiting for original page succeeded");
       
       netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");

dom/base/nsFocusManager.cpp

@@ -80,6 +80,8 @@
 #include "nsFrameSelection.h"
 #include "nsXULPopupManager.h"
 #include "nsImageMapUtils.h"
+#include "nsTreeWalker.h"
+#include "nsIDOMNodeFilter.h"
 
 #ifdef MOZ_XUL
 #include "nsIDOMXULTextboxElement.h"
@@ -2115,6 +2117,8 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       startContent->IsFocusable(&tabIndex);
     else if (frame)
       frame->IsFocusable(&tabIndex, 0);
+    else
+      startContent->IsFocusable(&tabIndex);
 
     // if the current element isn't tabbable, ignore the tabindex and just
     // look for the next element. The root content won't have a tabindex
@@ -2356,7 +2360,8 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
 {
   *aResultContent = nsnull;
 
-  if (!aStartContent)
+  nsCOMPtr<nsIContent> startContent = aStartContent;
+  if (!startContent)
     return NS_OK;
 
 #ifdef DEBUG_FOCUS_NAVIGATION
@@ -2366,19 +2371,38 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
 
   nsPresContext* presContext = aPresShell->GetPresContext();
 
+  PRBool getNextFrame = PR_TRUE;
+  nsCOMPtr<nsIContent> iterStartContent = aStartContent;
   while (1) {
-    nsIFrame* aStartFrame = aPresShell->GetPrimaryFrameFor(aStartContent);
-    if (!aStartFrame) {
-      // if there is no frame, just get the root frame
-      aStartFrame = aPresShell->GetPrimaryFrameFor(aRootContent);
-      if (!aStartFrame)
+    nsIFrame* startFrame = aPresShell->GetPrimaryFrameFor(iterStartContent);
+    // if there is no frame, look for another content node that has a frame
+    if (!startFrame) {
+      // if the root content doesn't have a frame, just return
+      if (iterStartContent == aRootContent)
         return NS_OK;
-      aStartContent = aRootContent;
+
+      // look for the next or previous content node in tree order
+      nsTreeWalker walker(aRootContent, nsIDOMNodeFilter::SHOW_ALL, nsnull, PR_TRUE);
+      nsCOMPtr<nsIDOMNode> nextNode = do_QueryInterface(iterStartContent);
+      walker.SetCurrentNode(nextNode);
+      if (NS_SUCCEEDED(aForward ? walker.NextNode(getter_AddRefs(nextNode)) :
+                                  walker.PreviousNode(getter_AddRefs(nextNode)))) {
+        iterStartContent = do_QueryInterface(nextNode);
+        // we've already skipped over the initial focused content, so we
+        // don't want to traverse frames.
+        getNextFrame = PR_FALSE;
+        if (iterStartContent)
+          continue;
+      }
+
+      // otherwise, as a last attempt, just look at the root content
+      iterStartContent = aRootContent;
+      continue;
     }
 
     nsCOMPtr<nsIFrameEnumerator> frameTraversal;
     nsresult rv = NS_NewFrameTraversal(getter_AddRefs(frameTraversal),
-                                       presContext, aStartFrame,
+                                       presContext, startFrame,
                                        ePreOrder,
                                        PR_FALSE, // aVisual
                                        PR_FALSE, // aLockInScrollView
@@ -2386,12 +2410,13 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
                                        );
     NS_ENSURE_SUCCESS(rv, rv);
 
-    if (aStartContent == aRootContent) {
+    if (iterStartContent == aRootContent) {
       if (!aForward)
         frameTraversal->Last();
     }
-    else if (!aStartContent || aStartContent->Tag() != nsGkAtoms::area ||
-             !aStartContent->IsHTML()) {
+    else if (getNextFrame &&
+             (!iterStartContent || iterStartContent->Tag() != nsGkAtoms::area ||
+              !iterStartContent->IsHTML())) {
       // Need to do special check in case we're in an imagemap which has multiple
       // content nodes per frame, so don't skip over the starting frame.
       if (aForward)
@@ -2430,7 +2455,7 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
           // nsIFrameTraversal so look for the next or previous area element.
           nsIContent *areaContent =
             GetNextTabbableMapArea(aForward, aCurrentTabIndex,
-                                   currentContent, aStartContent);
+                                   currentContent, iterStartContent);
           if (areaContent) {
             NS_ADDREF(*aResultContent = areaContent);
             return NS_OK;
@@ -2487,7 +2512,7 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
           // a textbox is focused, the enclosing textbox would be found and
           // the same inner input would be returned again.
           else if (currentContent == aRootContent ||
-                   (currentContent != aStartContent &&
+                   (currentContent != startContent &&
                     (aForward || !GetRedirectedFocus(currentContent)))) {
             NS_ADDREF(*aResultContent = currentContent);
             return NS_OK;
@@ -2535,7 +2560,7 @@ nsFocusManager::GetNextTabbableContent(nsIPresShell* aPresShell,
 
     // continue looking for next highest priority tabindex
     aCurrentTabIndex = GetNextTabIndex(aRootContent, aCurrentTabIndex, aForward);
-    aStartContent = aRootContent;
+    startContent = iterStartContent = aRootContent;
   }
 
   return NS_OK;

dom/base/nsFocusManager.h

@@ -316,6 +316,9 @@ protected:
    * node, in the case of recursive or looping calls.
    *
    * aStartContent is the starting point for this call of this method.
+   * If aStartContent doesn't have visual representation, the next content
+   * object, which does have a primary frame, will be used as a start.
+   * If that content object is focusable, the method may return it.
    *
    * aForward should be true for forward navigation or false for backward
    * navigation.

dom/base/nsGlobalWindow.cpp

@@ -930,6 +930,55 @@ nsGlobalWindow::ClearControllers()
   }
 }
 
+class ClearScopeEvent : public nsRunnable
+{
+public:
+  ClearScopeEvent(nsGlobalWindow *innerWindow)
+    : mInnerWindow(innerWindow) {
+  }
+
+  NS_IMETHOD Run()
+  {
+    mInnerWindow->ReallyClearScope(this);
+    return NS_OK;
+  }
+
+private:
+  nsRefPtr<nsGlobalWindow> mInnerWindow;
+};
+
+void
+nsGlobalWindow::ReallyClearScope(nsRunnable *aRunnable)
+{
+  NS_ASSERTION(IsInnerWindow(), "Must be an inner window");
+
+  nsIScriptContext *jsscx = GetContextInternal();
+  if (jsscx && jsscx->GetExecutingScript()) {
+    if (!aRunnable) {
+      aRunnable = new ClearScopeEvent(this);
+      if (!aRunnable) {
+        // The only reason that we clear scope here is to try to prevent
+        // leaks. Failing to clear scope might mean that we'll leak more
+        // but if we don't have enough memory to allocate a ClearScopeEvent
+        // we probably don't have to worry about this anyway.
+        return;
+      }
+    }
+
+    NS_DispatchToMainThread(aRunnable);
+    return;
+  }
+
+  PRUint32 lang_id;
+  NS_STID_FOR_ID(lang_id) {
+    // Note that scx comes from the outer window.  If this is an inner
+    // window, it may not be the current inner for its outer.
+    nsIScriptContext *scx = GetScriptContextInternal(lang_id);
+    if (scx)
+      scx->ClearScope(mScriptGlobals[NS_STID_INDEX(lang_id)], PR_TRUE);
+  }
+}
+
 void
 nsGlobalWindow::FreeInnerObjects(PRBool aClearScope)
 {
@@ -983,14 +1032,9 @@ nsGlobalWindow::FreeInnerObjects(PRBool aClearScope)
   }
 
   if (aClearScope) {
-    PRUint32 lang_id;
-    NS_STID_FOR_ID(lang_id) {
-      // Note that scx comes from the outer window.  If this is an inner
-      // window, it may not be the current inner for its outer.
-      nsIScriptContext *scx = GetScriptContextInternal(lang_id);
-      if (scx)
-        scx->ClearScope(mScriptGlobals[NS_STID_INDEX(lang_id)], PR_TRUE);
-    }
+    // NB: This might not clear our scope, but fire an event to do so
+    // instead.
+    ReallyClearScope(nsnull);
   }
 
   if (mDummyJavaPluginOwner) {

dom/base/nsGlobalWindow.h

@@ -122,6 +122,7 @@ class nsGlobalWindowObserver;
 class nsGlobalWindow;
 class nsDummyJavaPluginOwner;
 class PostMessageEvent;
+class nsRunnable;
 
 class nsDOMOfflineResourceList;
 class nsGeolocation;
@@ -238,6 +239,7 @@ public:
   nsPIDOMWindow* GetPrivateParent();
   // callback for close event
   void ReallyCloseWindow();
+  void ReallyClearScope(nsRunnable *aRunnable);
 
   // nsISupports
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS

dom/base/nsIScriptContext.h

@@ -56,10 +56,10 @@ class nsScriptObjectHolder;
 
 typedef void (*nsScriptTerminationFunc)(nsISupports* aRef);
 
-// 87482b5e-e019-4df5-9bc2-b2a51b1f2d28
+// A4FE2B52-62B5-40C3-BF9C-5E0A27B10F90
 #define NS_ISCRIPTCONTEXT_IID \
-{ 0x87482b5e, 0xe019, 0x4df5, \
-  { 0x9b, 0xc2, 0xb2, 0xa5, 0x1b, 0x1f, 0x2d, 0x28 } }
+{ 0xA4FE2B52, 0x62B5, 0x40C3, \
+  { 0xBF, 0x9C, 0x5E, 0x0A, 0x27, 0xB1, 0x0F, 0x90 } }
 
 /* This MUST match JSVERSION_DEFAULT.  This version stuff if we don't
    know what language we have is a little silly... */
@@ -402,6 +402,11 @@ public:
   virtual PRBool GetProcessingScriptTag() = 0;
   virtual void SetProcessingScriptTag(PRBool aResult) = 0;
 
+  /**
+   * Called to find out if this script context might be executing script.
+   */
+  virtual PRBool GetExecutingScript() = 0;
+
   /**
    * Tell the context whether or not to GC when destroyed.  An optimization
    * used when the window is a [i]frame, so GC will happen anyway.

dom/base/nsJSEnvironment.cpp

@@ -1312,7 +1312,9 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
   return 0;
 }
 
-nsJSContext::nsJSContext(JSRuntime *aRuntime) : mGCOnDestruction(PR_TRUE)
+nsJSContext::nsJSContext(JSRuntime *aRuntime)
+  : mGCOnDestruction(PR_TRUE),
+    mExecuteDepth(0)
 {
 
   ++sContextCount;
@@ -1522,6 +1524,8 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     JSAutoRequest ar(mContext);
     nsJSVersionSetter setVersion(mContext, aVersion);
 
+    ++mExecuteDepth;
+
     ok = ::JS_EvaluateUCScriptForPrincipals(mContext,
                                             (JSObject *)aScopeObject,
                                             jsprin,
@@ -1531,6 +1535,8 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
                                             aLineNo,
                                             &val);
 
+    --mExecuteDepth;
+
     if (!ok) {
       // Tell XPConnect about any pending exceptions. This is needed
       // to avoid dropping JS exceptions in case we got here through
@@ -1688,6 +1694,8 @@ nsJSContext::EvaluateString(const nsAString& aScript,
 
   nsJSContext::TerminationFuncHolder holder(this);
 
+  ++mExecuteDepth;
+
   // SecurityManager said "ok", but don't compile if aVersion is unknown.
   // Since the caller is responsible for parsing the version strings, we just
   // check it isn't JSVERSION_UNKNOWN.
@@ -1731,6 +1739,8 @@ nsJSContext::EvaluateString(const nsAString& aScript,
     }
   }
 
+  --mExecuteDepth;
+
   // Pop here, after JS_ValueToString and any other possible evaluation.
   if (NS_FAILED(stack->Pop(nsnull)))
     rv = NS_ERROR_FAILURE;
@@ -1849,6 +1859,7 @@ nsJSContext::ExecuteScript(void *aScriptObject,
 
   nsJSContext::TerminationFuncHolder holder(this);
   JSAutoRequest ar(mContext);
+  ++mExecuteDepth;
   ok = ::JS_ExecuteScript(mContext,
                           (JSObject *)aScopeObject,
                           (JSScript*)::JS_GetPrivate(mContext,
@@ -1868,6 +1879,8 @@ nsJSContext::ExecuteScript(void *aScriptObject,
     }
   }
 
+  --mExecuteDepth;
+
   // Pop here, after JS_ValueToString and any other possible evaluation.
   if (NS_FAILED(stack->Pop(nsnull)))
     rv = NS_ERROR_FAILURE;
@@ -2111,8 +2124,10 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
 
     jsval funval = OBJECT_TO_JSVAL(static_cast<JSObject *>(aHandler));
     JSAutoRequest ar(mContext);
+    ++mExecuteDepth;
     PRBool ok = ::JS_CallFunctionValue(mContext, target,
                                        funval, argc, argv, &rval);
+    --mExecuteDepth;
 
     if (!ok) {
       // Tell XPConnect about any pending exceptions. This is needed
@@ -3498,6 +3513,12 @@ nsJSContext::SetProcessingScriptTag(PRBool aFlag)
   mProcessingScriptTag = aFlag;
 }
 
+PRBool
+nsJSContext::GetExecutingScript()
+{
+  return JS_IsRunning(mContext) || mExecuteDepth > 0;
+}
+
 void
 nsJSContext::SetGCOnDestruction(PRBool aGCOnDestruction)
 {

dom/base/nsJSEnvironment.h

@@ -149,6 +149,8 @@ public:
   virtual PRBool GetProcessingScriptTag();
   virtual void SetProcessingScriptTag(PRBool aResult);
 
+  virtual PRBool GetExecutingScript();
+
   virtual void SetGCOnDestruction(PRBool aGCOnDestruction);
 
   virtual nsresult InitClasses(void *aGlobalObj);
@@ -292,6 +294,7 @@ private:
   PRPackedBool mGCOnDestruction;
   PRPackedBool mProcessingScriptTag;
 
+  PRUint32 mExecuteDepth;
   PRUint32 mDefaultJSOptions;
   PRTime mOperationCallbackTime;
 

dom/tests/mochitest/chrome/child_focus_frame.html

@@ -24,6 +24,7 @@
 <a id="t24" tabindex="0" href="#">2</a>
 <a id="t25" href="#">Link 3</a>
 <br>
+<span id="hiddenspan" style="display: none;"></span>
 <input id="t26" tabindex="0" type="checkbox" accesskey="a">
 <input id="o11" tabindex="-1" type="checkbox">
 <div style="display: none;"><input/></div>

dom/tests/mochitest/chrome/window_focus.xul

@@ -940,6 +940,33 @@ function testMoveFocus()
 
   prefs.setBoolPref("accessibility.browsewithcaret", false);
 
+  // cases where focus in on a content node with no frame
+
+  if (!gPartialTabbing) {
+    getById("t24").blur();
+    gEvents = "";
+    gLastFocus = null;
+    gLastFocusWindow = gChildWindow;
+    gLastFocusMethod = fm.FLAG_BYKEY;
+
+    selection.selectAllChildren(getById("hiddenspan"));
+    expectFocusShift(function () synthesizeKey("VK_TAB", { }),
+                     gChildWindow, getById("t26"), true, "tab with selection on hidden content");
+
+    setFocusTo($("o15"), window);
+    $("o15").hidden = true;
+    document.documentElement.getBoundingClientRect(); // flush after hiding
+    expectFocusShift(function () synthesizeKey("VK_TAB", { }),
+                     window, $("o17"), true, "tab with focus on hidden content");
+
+    $("o17").hidden = true;
+    document.documentElement.getBoundingClientRect();
+    expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+                     window, $("o13"), true, "shift+tab with focus on hidden content");
+  }
+
+  // cases with selection in an <input>
+
   var t19 = getById("t19");
   t19.setSelectionRange(0, 0);
   setFocusTo("t18", gChildWindow);

extensions/auth/nsAuthSSPI.cpp

@@ -20,6 +20,7 @@
  *
  * Contributor(s):
  *   Darin Fisher <darin@meer.net>
+ *   Jim Mathies <jmathies@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -228,12 +229,8 @@ nsAuthSSPI::Init(const char *serviceName,
 {
     LOG(("  nsAuthSSPI::Init\n"));
 
-    // we don't expect to be passed any user credentials
-    NS_ASSERTION(!domain && !username && !password, "unexpected credentials");
-
-    // if we're configured for SPNEGO (Negotiate) or Kerberos, then it's critical 
-    // that the caller supply a service name to be used.
-    // For NTLM, the service principal name can no longer be null. (Bug 487872)
+    // The caller must supply a service name to be used. (For why we now require
+    // a service name for NTLM, see bug 487872.)
     NS_ENSURE_TRUE(serviceName && *serviceName, NS_ERROR_INVALID_ARG);
 
     nsresult rv;
@@ -266,18 +263,41 @@ nsAuthSSPI::Init(const char *serviceName,
 
     TimeStamp useBefore;
 
+    SEC_WINNT_AUTH_IDENTITY_W ai;
+    SEC_WINNT_AUTH_IDENTITY_W *pai = nsnull;
+    
+    // domain, username, and password will be null if nsHttpNTLMAuth's ChallengeReceived
+    // returns false for identityInvalid. Use default credentials in this case by passing
+    // null for pai.
+    if (username && password) {
+        if (domain) {
+            ai.Domain = const_cast<unsigned short*>(domain);
+            ai.DomainLength = wcslen(domain);
+        }
+        else {
+            ai.Domain = NULL;
+            ai.DomainLength = 0;
+        }
+        ai.User = const_cast<unsigned short*>(username);
+        ai.UserLength = wcslen(username);
+        ai.Password = const_cast<unsigned short*>(password);
+        ai.PasswordLength = wcslen(password);
+        ai.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
+        pai = &ai;
+    }
+
     rc = (sspi->AcquireCredentialsHandleW)(NULL,
                                            package,
                                            SECPKG_CRED_OUTBOUND,
                                            NULL,
-                                           NULL,
+                                           pai,
                                            NULL,
                                            NULL,
                                            &mCred,
                                            &useBefore);
     if (rc != SEC_E_OK)
         return NS_ERROR_UNEXPECTED;
-
+    LOG(("AcquireCredentialsHandle() succeeded.\n"));
     return NS_OK;
 }
 
@@ -351,6 +371,14 @@ nsAuthSSPI::GetNextToken(const void *inToken,
                                             &ctxAttr,
                                             &ignored);
     if (rc == SEC_I_CONTINUE_NEEDED || rc == SEC_E_OK) {
+
+#ifdef PR_LOGGING
+        if (rc == SEC_E_OK)
+            LOG(("InitializeSecurityContext: succeeded.\n"));
+        else
+            LOG(("InitializeSecurityContext: continue.\n"));
+#endif
+
         if (!ob.cbBuffer) {
             nsMemory::Free(ob.pvBuffer);
             ob.pvBuffer = NULL;

extensions/auth/nsHttpNegotiateAuth.cpp

@@ -257,15 +257,15 @@ nsHttpNegotiateAuth::GenerateCredentials(nsIHttpChannel *httpChannel,
             challenge++;
         len = strlen(challenge);
 
+        // strip off any padding (see bug 230351)
+        while (challenge[len - 1] == '=')
+            len--;
+
         inTokenLen = (len * 3)/4;
         inToken = malloc(inTokenLen);
         if (!inToken)
             return (NS_ERROR_OUT_OF_MEMORY);
 
-        // strip off any padding (see bug 230351)
-        while (challenge[len - 1] == '=')
-            len--;
-
         //
         // Decode the response that followed the "Negotiate" token
         //

extensions/spellcheck/hunspell/src/csutil.cpp

@@ -5231,11 +5231,13 @@ struct cs_info * get_current_cs(const char * es) {
     return nsnull;
 
   rv = ccm->GetUnicodeEncoder(es, getter_AddRefs(encoder));
-  if (encoder && NS_SUCCEEDED(rv))
-    encoder->SetOutputErrorBehavior(encoder->kOnError_Replace, nsnull, '?');
   if (NS_FAILED(rv))
     return nsnull;
+  encoder->SetOutputErrorBehavior(encoder->kOnError_Signal, nsnull, '?');
   rv = ccm->GetUnicodeDecoder(es, getter_AddRefs(decoder));
+  if (NS_FAILED(rv))
+    return nsnull;
+  decoder->SetInputErrorBehavior(decoder->kOnError_Signal);
 
   caseConv = do_GetService(kUnicharUtilCID, &rv);
   if (NS_FAILED(rv))
@@ -5243,49 +5245,60 @@ struct cs_info * get_current_cs(const char * es) {
 
   ccs = (struct cs_info *) malloc(256 * sizeof(cs_info));
 
-  PRInt32 charLength = 256;
-  PRInt32 uniLength = 512;
-  char *source = (char *)malloc(charLength * sizeof(char));
-  PRUnichar *uni = (PRUnichar *)malloc(uniLength * sizeof(PRUnichar));
-  char *lower = (char *)malloc(charLength * sizeof(char));
-  char *upper = (char *)malloc(charLength * sizeof(char));
+  for (unsigned int i = 0; i <= 0xff; ++i) {
+    PRBool success = PR_FALSE;
+    // We want to find the upper/lowercase equivalents of each byte
+    // in this 1-byte character encoding.  Call our encoding/decoding
+    // APIs separately for each byte since they may reject some of the
+    // bytes, and we want to handle errors separately for each byte.
+    char lower, upper;
+    do {
+      if (i == 0)
+        break;
+      const char source = char(i);
+      PRUnichar uni, uniCased;
+      PRInt32 charLength = 1, uniLength = 1;
 
-  // Create a long string of all chars.
-  unsigned int i;
-  for (i = 0x00; i <= 0xff ; ++i) {
-    source[i] = i;
+      rv = decoder->Convert(&source, &charLength, &uni, &uniLength);
+      // Explicitly check NS_OK because we don't want to allow
+      // NS_OK_UDEC_MOREOUTPUT or NS_OK_UDEC_MOREINPUT.
+      if (rv != NS_OK || charLength != 1 || uniLength != 1)
+        break;
+      rv = caseConv->ToLower(uni, &uniCased);
+      if (NS_FAILED(rv))
+        break;
+      rv = encoder->Convert(&uniCased, &uniLength, &lower, &charLength);
+      // Explicitly check NS_OK because we don't want to allow
+      // NS_OK_UDEC_MOREOUTPUT or NS_OK_UDEC_MOREINPUT.
+      if (rv != NS_OK || charLength != 1 || uniLength != 1)
+        break;
+
+      rv = caseConv->ToUpper(uni, &uniCased);
+      if (NS_FAILED(rv))
+        break;
+      rv = encoder->Convert(&uniCased, &uniLength, &upper, &charLength);
+      // Explicitly check NS_OK because we don't want to allow
+      // NS_OK_UDEC_MOREOUTPUT or NS_OK_UDEC_MOREINPUT.
+      if (rv != NS_OK || charLength != 1 || uniLength != 1)
+        break;
+
+      success = PR_TRUE;
+    } while (0);
+
+    if (success) {
+      ccs[i].cupper = upper;
+      ccs[i].clower = lower;
+    } else {
+      ccs[i].cupper = i;
+      ccs[i].clower = i;
     }
 
-  // Convert this long string to unicode
-  rv = decoder->Convert(source, &charLength, uni, &uniLength);
-
-  // Do case conversion stuff, and convert back.
-  caseConv->ToUpper(uni, uni, uniLength);
-  encoder->Convert(uni, &uniLength, upper, &charLength);
-
-  uniLength = 512;
-  charLength = 256;
-  rv = decoder->Convert(source, &charLength, uni, &uniLength);
-  caseConv->ToLower(uni, uni, uniLength);
-  encoder->Convert(uni, &uniLength, lower, &charLength);
-
-  // Store
-  for (i = 0x00; i <= 0xff ; ++i) {
-    ccs[i].cupper = upper[i];
-    ccs[i].clower = lower[i];
-    
     if (ccs[i].clower != (unsigned char)i)
       ccs[i].ccase = true;
     else
       ccs[i].ccase = false;
-      
   }
 
-  free(source);
-  free(uni);
-  free(lower);
-  free(upper);
-
   return ccs;
 }
 #endif

gfx/qcms/Makefile.in

@@ -20,11 +20,16 @@ ifeq (86,$(findstring 86,$(OS_TEST)))
 ifdef GNU_CC
 	SSE1_FLAGS=-msse
 	SSE2_FLAGS=-msse2
+else
+ifeq ($(SOLARIS_SUNPRO_CC),1)
+	SSE1_FLAGS=-xarch=sse
+	SSE2_FLAGS=-xarch=sse2
 else
 	SSE1_FLAGS=
 	SSE2_FLAGS=
 endif
 endif
+endif
 
 FORCE_STATIC_LIB = 1
 # This library is used by other shared libs

gfx/qcms/transform.c

@@ -25,10 +25,10 @@
 #include <assert.h>
 #include "qcmsint.h"
 
-/* for MSVC, GCC, and Intel compilers */
-#if defined(_M_IX86) || defined(__i386__) || defined(_M_AMD64) || defined(__x86_64__)
+/* for MSVC, GCC, Intel, and Sun compilers */
+#if defined(_M_IX86) || defined(__i386__) || defined(__i386) || defined(_M_AMD64) || defined(__x86_64__) || defined(__x86_64)
 #define X86
-#endif /* _M_IX86 || __i386__ || _M_AMD64 || __x86_64__ */
+#endif /* _M_IX86 || __i386__ || __i386 || _M_AMD64 || __x86_64__ || __x86_64 */
 
 //XXX: could use a bettername
 typedef uint16_t uint16_fract_t;
@@ -1062,7 +1062,7 @@ static void cpuid(uint32_t fxn, uint32_t *a, uint32_t *b, uint32_t *c, uint32_t
        *c = c_;
        *d = d_;
 }
-#elif defined(__GNUC__) && defined(__i386__)
+#elif (defined(__GNUC__) || defined(__SUNPRO_C)) && (defined(__i386__) || defined(__i386))
 #define HAS_CPUID
 /* Get us a CPUID function. We can't use ebx because it's the PIC register on
    some platforms, so we use ESI instead and save ebx to avoid clobbering it. */
@@ -1088,7 +1088,7 @@ static void cpuid(uint32_t fxn, uint32_t *a, uint32_t *b, uint32_t *c, uint32_t
 
 static int sse_version_available(void)
 {
-#if defined(__x86_64__) || defined(_M_AMD64)
+#if defined(__x86_64__) || defined(__x86_64) || defined(_M_AMD64)
 	/* we know at build time that 64-bit CPUs always have SSE2
 	 * this tells the compiler that non-SSE2 branches will never be
 	 * taken (i.e. OK to optimze away the SSE1 and non-SIMD code */

js/src/Makefile.in

@@ -472,13 +472,6 @@ endif
 endif
 
 ifdef SOLARIS_SUNPRO_CXX
-# Sun Studio x86 has an optimization bug with LIR.cpp, use -xO2 instead.
-ifeq (86,$(findstring 86,$(OS_TEST)))
-LIR.o: LIR.cpp Makefile.in
-	$(REPORT_BUILD)
-	@$(MAKE_DEPS_AUTO_CXX)
-	$(CXX) -o $@ -c $(patsubst -xO%,-xO2,$(COMPILE_CFLAGS)) $<
-else
 # Sun Studio SPARC doesn't work well with gcc inline asm, use lock_SunOS_sparc*.il
 jslock.o: jslock.cpp Makefile.in lock_sparcv8plus.il lock_sparcv9.il
 	$(REPORT_BUILD)
@@ -488,7 +481,6 @@ ifeq (sparcv9,$(findstring sparcv9,$(OS_TEST)))
 else
 	$(CXX) -o $@ -c $(COMPILE_CFLAGS) $(srcdir)/lock_sparcv8plus.il $<
 endif # sparcv9
-endif # x86
 endif # SOLARIS_SUNPRO_CXX
 
 # Allow building jsinterp.c with special optimization flags

js/src/config/rules.mk

@@ -362,6 +362,9 @@ endif # WINNT
 
 ifeq ($(SOLARIS_SUNPRO_CXX),1)
 CXXFLAGS += -features=extensions -D__FUNCTION__=__func__
+ifeq (86,$(findstring 86,$(OS_TEST)))
+OS_LDFLAGS += -M $(topsrcdir)/config/solaris_ia32.map
+endif # x86
 endif # Solaris Sun Studio C++
 
 ifeq (,$(filter-out WINNT WINCE,$(HOST_OS_ARCH)))

js/src/config/solaris_ia32.map

@@ -0,0 +1 @@
+hwcap_1 = OVERRIDE;

js/src/jsops.cpp

@@ -3256,7 +3256,7 @@ BEGIN_CASE(JSOP_LAMBDA)
         if (FUN_NULL_CLOSURE(fun)) {
             parent = fp->scopeChain;
 
-            if (OBJ_GET_PARENT(cx, obj) == parent) {
+            if (0 && OBJ_GET_PARENT(cx, obj) == parent) {
                 op = JSOp(regs.pc[JSOP_LAMBDA_LENGTH]);
 
                 /*

js/src/lock_SunOS.s

@@ -1,119 +0,0 @@
-! 
-! ***** BEGIN LICENSE BLOCK *****
-! Version: MPL 1.1/GPL 2.0/LGPL 2.1
-!
-! The contents of this file are subject to the Mozilla Public License Version
-! 1.1 (the "License"); you may not use this file except in compliance with
-! the License. You may obtain a copy of the License at
-! http://www.mozilla.org/MPL/
-!
-! Software distributed under the License is distributed on an "AS IS" basis,
-! WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-! for the specific language governing rights and limitations under the
-! License.
-!
-! The Original Code is Mozilla Communicator client code, released
-! March 31, 1998.
-!
-! The Initial Developer of the Original Code is
-! Netscape Communications Corporation.
-! Portions created by the Initial Developer are Copyright (C) 1998-1999
-! the Initial Developer. All Rights Reserved.
-!
-! Contributor(s):
-!
-! Alternatively, the contents of this file may be used under the terms of
-! either the GNU General Public License Version 2 or later (the "GPL"), or
-! the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-! in which case the provisions of the GPL or the LGPL are applicable instead
-! of those above. If you wish to allow use of your version of this file only
-! under the terms of either the GPL or the LGPL, and not to allow others to
-! use your version of this file under the terms of the MPL, indicate your
-! decision by deleting the provisions above and replace them with the notice
-! and other provisions required by the GPL or the LGPL. If you do not delete
-! the provisions above, a recipient may use your version of this file under
-! the terms of any one of the MPL, the GPL or the LGPL.
-!
-! ***** END LICENSE BLOCK *****
-
-!
-!  atomic compare-and-swap routines for V8 sparc 
-!  and for V8+ (ultrasparc)
-!
-!
-!  standard asm linkage macros; this module must be compiled
-!  with the -P option (use C preprocessor)
-
-#include <sys/asm_linkage.h>
-
-!  ======================================================================
-!
-!  Perform the sequence *a = b atomically with respect to previous value
-!  of a (a0). If *a==a0 then assign *a to b, all in one atomic operation.
-!  Returns 1 if assignment happened, and 0 otherwise.	
-!
-!  usage : old_val = compare_and_swap(address, oldval, newval)
-!
-!  -----------------------
-!  Note on REGISTER USAGE:
-!  as this is a LEAF procedure, a new stack frame is not created;
-!  we use the caller stack frame so what would normally be %i (input)
-!  registers are actually %o (output registers).  Also, we must not
-!  overwrite the contents of %l (local) registers as they are not
-!  assumed to be volatile during calls.
-!
-!  So, the registers used are:
-!     %o0  [input]   - the address of the value to increment
-!     %o1  [input]   - the old value to compare with	
-!     %o2  [input]   - the new value to set for [%o0]
-!     %o3  [local]   - work register
-!  -----------------------
-#ifndef ULTRA_SPARC
-!  v8	
-
-        ENTRY(compare_and_swap)         ! standard assembler/ELF prologue
-
-	stbar
-	mov -1,%o3                      ! busy flag
-	swap [%o0],%o3                  ! get current value
-l1:	cmp %o3,-1                      ! busy?
-	be,a l1                         ! if so, spin
-	swap [%o0],%o3                  ! using branch-delay to swap back value
-	cmp %o1,%o3                     ! compare old with current
-	be,a l2                         ! if equal then swap in new value
-	swap [%o0],%o2                  ! done.
-	swap [%o0],%o3                  ! otherwise, swap back current value
-	retl
-	mov 0,%o0                       ! return false
-l2:	retl
-	mov 1,%o0                       ! return true
-	
-	SET_SIZE(compare_and_swap)      ! standard assembler/ELF epilogue
-
-!
-!  end
-!
-#else /* ULTRA_SPARC */
-!  ======================================================================
-!
-!  v9
-
-        ENTRY(compare_and_swap)         ! standard assembler/ELF prologue
-
-	stbar
-	cas [%o0],%o1,%o2               ! compare *w with old value and set to new if equal
-	cmp %o1,%o2                     ! did we succeed?
-	be,a m1                         ! yes
-	mov 1,%o0                       ! return true (annulled when no jump)
-        mov 0,%o0                       ! return false
-m1:	retl
-	nop
-		
-	SET_SIZE(compare_and_swap)      ! standard assembler/ELF epilogue
-
-!
-!  end
-!
-!  ======================================================================
-!
-#endif

layout/base/nsDocumentViewer.cpp

@@ -839,6 +839,11 @@ DocumentViewerImpl::InitInternal(nsIWidget* aParentWidget,
                                  PRBool aInPrintPreview,
                                  PRBool aNeedMakeCX /*= PR_TRUE*/)
 {
+  // We don't want any scripts to run here. That can cause flushing,
+  // which can cause reentry into initialization of this document viewer,
+  // which would be disastrous.
+  nsAutoScriptBlocker blockScripts;
+
   mParentWidget = aParentWidget; // not ref counted
   mBounds = aBounds;
 

layout/base/nsPresArena.cpp

@@ -129,19 +129,19 @@ GetDesiredRegionSize()
 static void *
 ReserveRegion(PRUword region, PRUword size)
 {
-  return mmap((void *)region, size, PROT_NONE, MAP_PRIVATE|MAP_ANON, -1, 0);
+  return mmap((caddr_t)region, size, PROT_NONE, MAP_PRIVATE|MAP_ANON, -1, 0);
 }
 
 static void
 ReleaseRegion(void *region, PRUword size)
 {
-  munmap(region, size);
+  munmap((caddr_t)region, size);
 }
 
 static bool
 ProbeRegion(PRUword region, PRUword size)
 {
-  if (madvise((void *)region, size, MADV_NORMAL)) {
+  if (madvise((caddr_t)region, size, MADV_NORMAL)) {
     return true;
   } else {
     return false;

layout/base/tests/TestPoisonArea.cpp

@@ -159,6 +159,7 @@ typedef unsigned int uint32_t;
  */
 
 #if defined __i386__ || defined __x86_64__ ||   \
+  defined __i386 || defined __x86_64 ||         \
   defined _M_IX86 || defined _M_AMD64
 #define RETURN_INSTR 0xC3C3C3C3  /* ret; ret; ret; ret */
 
@@ -170,6 +171,9 @@ typedef unsigned int uint32_t;
 #elif defined _ARCH_PPC || defined _ARCH_PWR || defined _ARCH_PWR2
 #define RETURN_INSTR 0x4E800020 /* blr */
 
+#elif defined __sparc || defined __sparcv9
+#define RETURN_INSTR 0x81c3e008 /* retl */
+
 #else
 #error "Need return instruction for this architecture"
 #endif
@@ -257,7 +261,7 @@ static unsigned long _pagesize;
 static void *
 ReserveRegion(uintptr_t request, bool accessible)
 {
-  return mmap((void *)request, PAGESIZE,
+  return mmap((caddr_t)request, PAGESIZE,
               accessible ? PROT_READ|PROT_WRITE : PROT_NONE,
               MAP_PRIVATE|MAP_ANON, -1, 0);
 }
@@ -265,13 +269,13 @@ ReserveRegion(uintptr_t request, bool accessible)
 static void
 ReleaseRegion(void *page)
 {
-  munmap(page, PAGESIZE);
+  munmap((caddr_t)page, PAGESIZE);
 }
 
 static bool
 ProbeRegion(uintptr_t page)
 {
-  if (madvise((void *)page, PAGESIZE, MADV_NORMAL)) {
+  if (madvise((caddr_t)page, PAGESIZE, MADV_NORMAL)) {
     return true;
   } else {
     return false;
@@ -281,7 +285,7 @@ ProbeRegion(uintptr_t page)
 static int
 MakeRegionExecutable(void *page)
 {
-  return mprotect(page, PAGESIZE, PROT_READ|PROT_WRITE|PROT_EXEC);
+  return mprotect((caddr_t)page, PAGESIZE, PROT_READ|PROT_WRITE|PROT_EXEC);
 }
 
 #endif
@@ -437,7 +441,7 @@ TestPage(const char *pagelabel, uintptr_t pageaddr, int should_succeed)
              LastErrMsg());
       exit(2);
     } else if (pid == 0) {
-      unsigned char scratch;
+      volatile unsigned char scratch;
       switch (test) {
       case 0: scratch = *(volatile unsigned char *)opaddr; break;
       case 1: ((void (*)())opaddr)(); break;

layout/generic/nsIObjectFrame.h

@@ -94,6 +94,14 @@ public:
    * Get the native widget for the plugin, if any.
    */
   virtual nsIWidget* GetWidget() = 0;
+
+  /**
+   * Tells the object to paint directly in this location ignoring any
+   * positioning information that may have been provided otherwise.
+   */
+  virtual nsresult SetAbsoluteScreenPosition(class nsIDOMElement* element,
+                                             nsIDOMClientRect* position,
+                                             nsIDOMClientRect* clip) = 0;
 };
 
 #endif /* nsIObjectFrame_h___ */

layout/generic/nsObjectFrame.cpp

@@ -108,6 +108,7 @@
 #include "nsIImageLoadingContent.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsPIDOMWindow.h"
+#include "nsIDOMElement.h"
 #include "nsContentUtils.h"
 #include "nsDisplayList.h"
 #include "nsAttrName.h"
@@ -117,6 +118,7 @@
 #include "nsLayoutUtils.h"
 #include "nsFrameManager.h"
 #include "nsComponentManagerUtils.h"
+#include "nsIObserverService.h"
 
 // headers for plugin scriptability
 #include "nsIScriptGlobalObject.h"
@@ -124,6 +126,7 @@
 #include "nsIXPConnect.h"
 #include "nsIXPCScriptable.h"
 #include "nsIClassInfo.h"
+#include "nsIDOMClientRect.h"
 
 #include "nsObjectFrame.h"
 #include "nsIObjectFrame.h"
@@ -172,6 +175,16 @@ enum { XKeyPress = KeyPress };
 
 #if defined(MOZ_PLATFORM_HILDON) && defined(MOZ_WIDGET_GTK2)
 #define MOZ_COMPOSITED_PLUGINS 1
+
+#include "gfxXlibSurface.h"
+
+#include <X11/Xutil.h>
+#include <X11/Xatom.h>
+#include <X11/extensions/XShm.h>
+#include <sys/ipc.h>
+#include <sys/shm.h>
+
+
 #endif
 
 #ifdef MOZ_WIDGET_GTK2
@@ -331,11 +344,6 @@ public:
 
   void SetPluginHost(nsIPluginHost* aHost);
 
-#ifdef MOZ_PLATFORM_HILDON
-  /* the flash plugin(s) need to have thier visiblity poked */
-  PRBool UpdateVisibility(PRBool aForce = PR_FALSE);
-#endif
-
   nsEventStatus ProcessEvent(const nsGUIEvent & anEvent);
 
 #ifdef XP_MACOSX
@@ -405,6 +413,12 @@ public:
     return strncmp(GetPluginName(), aPluginName, strlen(aPluginName)) == 0;
   }
 
+#ifdef MOZ_PLATFORM_HILDON
+  nsresult SetAbsoluteScreenPosition(nsIDOMElement* element,
+                                     nsIDOMClientRect* position,
+                                     nsIDOMClientRect* clip);
+#endif
+
 private:
   void FixUpURLS(const nsString &name, nsAString &value);
 
@@ -498,15 +512,34 @@ private:
 #ifdef MOZ_PLATFORM_HILDON
 
   // On hildon, we attempt to use NPImageExpose which allows us faster
-  // painting.  We hold a memory buffer to avoid reallocations on
-  // every plugin invalidate.
-  unsigned char*  mImageExposeBuffer;
-  gfxIntSize mImageExposeBufferSize;
+  // painting.
+
+  // used to keep track of how big our buffer is.
+  nsIntSize mPluginSize;
+
+  // the scale between the actual instance plugin window and what
+  // we want to scale it to.
+  float mPluginScale;
+
+  // the element that was passed into SetAbsoluteScreenPosition().
+  // This will be the element we use to determine which Window we draw into.
+  nsCOMPtr<nsIDOMElement> mBlitParentElement;
+
+  // The absolute position on the screen to draw to.
+  nsIntRect mAbsolutePosition;
+
+  // The clip region that we should draw into.
+  nsIntRect mAbsolutePositionClip;
+
+  Window mBlitWindow;
+  XImage *mSharedXImage;
+  XShmSegmentInfo mSharedSegmentInfo;
+
+  PRBool SetupXShm();
+  void ReleaseXShm();
+  nsresult NativeImageDraw();
+  PRBool UpdateVisibility();
 
-  nsresult NativeImageDraw(gfxContext *aContext,
-                           NPWindow* mWindow,
-                           const nsIntSize& mPluginSize,
-                           const nsIntRect& mDirtyRect);
 #endif
 };
 
@@ -570,7 +603,12 @@ nsObjectFrame::Init(nsIContent*      aContent,
   PR_LOG(nsObjectFrameLM, PR_LOG_DEBUG,
          ("Initializing nsObjectFrame %p for content %p\n", this, aContent));
 
-  return nsObjectFrameSuper::Init(aContent, aParent, aPrevInFlow);
+  nsresult rv = nsObjectFrameSuper::Init(aContent, aParent, aPrevInFlow);
+
+  if (NS_SUCCEEDED(rv)) {
+    NotifyPluginEventObservers(NS_LITERAL_STRING("init").get());
+  }
+  return rv;
 }
 
 void
@@ -580,6 +618,8 @@ nsObjectFrame::Destroy()
                (mContent && mContent->GetCurrentDoc()->GetDisplayDocument()),
                "about to crash due to bug 136927");
 
+  NotifyPluginEventObservers(NS_LITERAL_STRING("destroy").get());
+
   PresContext()->RootPresContext()->UnregisterPluginForGeometryUpdates(this);
 
   // we need to finish with the plugin before native window is destroyed
@@ -931,10 +971,6 @@ nsObjectFrame::FixupWindow(const nsSize& aSize)
 
   NS_ENSURE_TRUE(window, /**/);
 
-#ifdef MOZ_PLATFORM_HILDON
-  mInstanceOwner->UpdateVisibility(PR_TRUE);
-#endif
-
 #ifdef XP_MACOSX
   mInstanceOwner->FixUpPluginWindow(ePluginPaintDisable);
 #endif
@@ -961,6 +997,7 @@ nsObjectFrame::FixupWindow(const nsSize& aSize)
   window->clipRect.bottom = presContext->AppUnitsToDevPixels(aSize.height);
   window->clipRect.right = presContext->AppUnitsToDevPixels(aSize.width);
 #endif
+  NotifyPluginEventObservers(NS_LITERAL_STRING("reflow").get());
 }
 
 void
@@ -978,11 +1015,6 @@ nsObjectFrame::CallSetWindow()
     return;
 
   nsPluginNativeWindow *window = (nsPluginNativeWindow *)win;
-
-#ifdef MOZ_PLATFORM_HILDON
-  mInstanceOwner->UpdateVisibility(PR_TRUE);
-#endif
-
 #ifdef XP_MACOSX
   mInstanceOwner->FixUpPluginWindow(ePluginPaintDisable);
 #endif
@@ -1190,6 +1222,29 @@ nsObjectFrame::ComputeWidgetGeometry(const nsRegion& aRegion,
   }
 }
 
+nsresult
+nsObjectFrame::SetAbsoluteScreenPosition(nsIDOMElement* element,
+                                         nsIDOMClientRect* position,
+                                         nsIDOMClientRect* clip)
+{
+#ifdef MOZ_PLATFORM_HILDON
+  NS_ASSERTION(mInstanceOwner, "failed to get mInstanceOwner");
+  return mInstanceOwner->SetAbsoluteScreenPosition(element, position, clip);
+#else
+  return NS_ERROR_NOT_IMPLEMENTED;
+#endif
+}
+
+void
+nsObjectFrame::NotifyPluginEventObservers(const PRUnichar *eventType)
+{
+  nsCOMPtr<nsIDOMElement> e = do_QueryInterface(mContent);
+  if (!e)
+    return;
+  nsCOMPtr<nsIObserverService> obsSvc = do_GetService("@mozilla.org/observer-service;1");
+  obsSvc->NotifyObservers(e, "plugin-changed-event", eventType);
+}
+
 void
 nsObjectFrame::DidSetWidgetGeometry()
 {
@@ -2363,9 +2418,12 @@ nsPluginInstanceOwner::nsPluginInstanceOwner()
 #endif
 
 #ifdef MOZ_PLATFORM_HILDON
-  mImageExposeBuffer = nsnull;
-  mImageExposeBufferSize = gfxIntSize(0,0);
+  mPluginSize = nsIntSize(0,0);
+  mPluginScale = 1.0;
+  mSharedXImage = nsnull;
+  mSharedSegmentInfo.shmaddr = nsnull;
 #endif
+
 #ifdef XP_MACOSX
 #ifndef NP_NO_QUICKDRAW
   mEventModel = NPEventModelCarbon;
@@ -2428,11 +2486,8 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
   }
 
 #ifdef MOZ_PLATFORM_HILDON
-  if (mImageExposeBuffer)
-    free(mImageExposeBuffer);
-  mImageExposeBuffer = nsnull;
+  ReleaseXShm();
 #endif
-
 }
 
 /*
@@ -2649,6 +2704,11 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetDocument(nsIDocument* *aDocument)
 
 NS_IMETHODIMP nsPluginInstanceOwner::InvalidateRect(NPRect *invalidRect)
 {
+#ifdef MOZ_PLATFORM_HILDON
+  if (mObjectFrame && mBlitWindow && NS_SUCCEEDED(NativeImageDraw()))
+    return NS_OK;
+#endif
+
   if (!mObjectFrame || !invalidRect || !mWidgetVisible)
     return NS_ERROR_FAILURE;
 
@@ -3485,10 +3545,6 @@ nsPluginInstanceOwner::GetEventloopNestingLevel()
 
 nsresult nsPluginInstanceOwner::ScrollPositionWillChange(nsIScrollableView* aScrollable, nscoord aX, nscoord aY)
 {
-#ifdef MOZ_PLATFORM_HILDON
-  CancelTimer();
-#endif
-
 #if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
   if (GetEventModel() != NPEventModelCarbon)
     return NS_OK;
@@ -4735,7 +4791,18 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
   if (!mInstance || !mObjectFrame)
     return;
 
-  // Align to device pixels where sensible
+#ifdef MOZ_PLATFORM_HILDON
+  PRBool simpleImageRender = PR_FALSE;
+  mInstance->GetValueFromPlugin(NPPVpluginWindowlessLocalBool,
+                                &simpleImageRender);
+  if (simpleImageRender) {    
+    gfxMatrix matrix = aContext->CurrentMatrix();
+    if (!matrix.HasNonAxisAlignedTransform() &&
+        NS_SUCCEEDED(NativeImageDraw()))
+      return;
+  }
+#endif
+
   // to provide crisper and faster drawing.
   gfxRect pluginRect = aFrameRect;
   if (aContext->UserToDevicePixelSnapped(pluginRect)) {
@@ -4788,15 +4855,6 @@ void nsPluginInstanceOwner::Paint(gfxContext* aContext,
   gfxContextAutoSaveRestore autoSR(aContext);
   aContext->Translate(pluginRect.pos);
 
-#ifdef MOZ_PLATFORM_HILDON
-  PRBool simpleImageRender = PR_FALSE;
-  mInstance->GetValueFromPlugin(NPPVpluginWindowlessLocalBool, (void *)&simpleImageRender);
-
-  if (simpleImageRender && NS_SUCCEEDED(NativeImageDraw(aContext, window, pluginSize, pluginDirtyRect)))
-    return;
-
-#endif
-
   Renderer renderer(window, mInstance, pluginSize, pluginDirtyRect);
   renderer.Draw(aContext, window->width, window->height,
                 rendererFlags, nsnull);
@@ -4821,6 +4879,103 @@ DepthOfVisual(const Screen* screen, const Visual* visual)
 
 #ifdef MOZ_PLATFORM_HILDON
 
+static GdkWindow* GetClosestWindow(nsIDOMElement *element)
+{
+  nsCOMPtr<nsIDOMDocument> domDocument;
+  element->GetOwnerDocument(getter_AddRefs(domDocument));
+
+  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDocument);  
+  if (!doc)
+    return nsnull;
+
+  nsIPresShell *presShell = doc->GetPrimaryShell();
+  if (!presShell)
+    return nsnull;
+
+  nsCOMPtr<nsIContent> content = do_QueryInterface(element);
+  nsIFrame* frame = presShell->GetPrimaryFrameFor(content);
+  if (!frame)
+    return nsnull;
+
+  nsIWidget* win = frame->GetWindow();
+  if (!win)
+    return nsnull;
+
+  GdkWindow* w = static_cast<GdkWindow*>(win->GetNativeData(NS_NATIVE_WINDOW));
+  return w;
+}
+
+void
+nsPluginInstanceOwner::ReleaseXShm()
+{
+  if (mSharedSegmentInfo.shmaddr) {
+    XShmDetach(gdk_x11_get_default_xdisplay(), &mSharedSegmentInfo);
+    shmdt(mSharedSegmentInfo.shmaddr);
+    mSharedSegmentInfo.shmaddr = nsnull;
+  }
+
+  if (mSharedXImage) {
+    XDestroyImage(mSharedXImage);
+    mSharedXImage = nsnull;
+  }
+}
+
+PRBool
+nsPluginInstanceOwner::SetupXShm()
+{
+  mBlitWindow = GDK_WINDOW_XWINDOW(GetClosestWindow(mBlitParentElement));
+  if (!mBlitWindow)
+    return PR_FALSE;
+
+  ReleaseXShm();
+
+  // we use 16 as the default depth because that is the value of the
+  // screen, but not the default X default depth.
+  XVisualInfo vinfo;
+  int foundVisual = XMatchVisualInfo(gdk_x11_get_default_xdisplay(),
+                                     gdk_x11_get_default_screen(),
+                                     16,
+                                     TrueColor,
+                                     &vinfo);
+  if (!foundVisual) 
+    return PR_FALSE;
+
+  memset(&mSharedSegmentInfo, 0, sizeof(XShmSegmentInfo));
+  mSharedXImage = XShmCreateImage(gdk_x11_get_default_xdisplay(),
+                                  vinfo.visual,
+                                  16,
+                                  ZPixmap,
+                                  0,
+                                  &mSharedSegmentInfo,
+                                  mPluginSize.width,
+                                  mPluginSize.height);
+  if (!mSharedXImage)
+    return PR_FALSE;
+
+  mSharedSegmentInfo.shmid = shmget(IPC_PRIVATE,
+                                    mSharedXImage->bytes_per_line * mSharedXImage->height,
+                                    IPC_CREAT | 0777);
+
+  mSharedXImage->data = static_cast<char*>(shmat(mSharedSegmentInfo.shmid, 0, 0));
+  mSharedSegmentInfo.shmaddr = mSharedXImage->data;
+  mSharedSegmentInfo.readOnly = False;
+
+  Status s = XShmAttach(gdk_x11_get_default_xdisplay(), &mSharedSegmentInfo);
+  XSync(gdk_x11_get_default_xdisplay(), False);
+  shmctl(mSharedSegmentInfo.shmid, IPC_RMID, 0);
+  if (!s) {
+    // attach failed, call shmdt and null shmaddr before calling
+    // ReleaseXShm().
+    shmdt(mSharedSegmentInfo.shmaddr);
+    mSharedSegmentInfo.shmaddr = nsnull;
+    ReleaseXShm();
+    return PR_FALSE;
+  }
+
+  return PR_TRUE;
+}
+
+
 // NativeImageDraw
 //
 // This method supports the NPImageExpose API which is specific to the
@@ -4840,65 +4995,53 @@ DepthOfVisual(const Screen* screen, const Visual* visual)
 // Hopefully this API can die off in favor of a more robust plugin API.
 
 nsresult
-nsPluginInstanceOwner::NativeImageDraw(gfxContext *aContext,
-                                       NPWindow* mWindow,
-                                       const nsIntSize& mPluginSize,
-                                       const nsIntRect& mDirtyRect)
+nsPluginInstanceOwner::NativeImageDraw()
 {
-  PRBool doupdatewindow = PR_FALSE;
+  // if we haven't been positioned yet, ignore
+  if (!mBlitParentElement)
+    return NS_OK;
 
-  if (mWindow->x || mWindow->y) {
-    mWindow->x = 0;
-    mWindow->y = 0;
-    doupdatewindow = PR_TRUE;
+  // if the clip rect is zero, we have nothing to do.
+  if (mAbsolutePositionClip.width == 0 || mAbsolutePositionClip.height == 0)
+    return NS_OK;
+
+  // if we haven't been setup before, or if the size of the plugin increased.
+  if (!mSharedXImage ||
+      mPluginSize.width != mAbsolutePosition.width ||
+      mPluginSize.height != mAbsolutePosition.height) {
+
+    mPluginSize = nsIntSize(mAbsolutePosition.width, mAbsolutePosition.height);
+
+    if (NS_FAILED(SetupXShm()))
+      return NS_ERROR_FAILURE;
   }  
   
-  if (nsIntSize(mWindow->width, mWindow->height) != mPluginSize) {
-    mWindow->width = mPluginSize.width;
-    mWindow->height = mPluginSize.height;
-    doupdatewindow = PR_TRUE;
-  }
+  NPWindow* window;
+  GetWindow(window);
+  NS_ASSERTION(window, "Window can not be null");
 
-  // The clip rect is relative to drawable top-left.
-  nsIntRect clipRect;
-  clipRect.x = 0;
-  clipRect.y = 0;
-  clipRect.width  = mWindow->width;
-  clipRect.height = mWindow->height;
+  // setup window such that it knows about the size and clip.  This
+  // is to work around a flash clipping bug when using the Image
+  // Expose API.
   
   NPRect newClipRect;
-  newClipRect.left = clipRect.x;
-  newClipRect.top = clipRect.y;
-  newClipRect.right = clipRect.XMost();
-  newClipRect.bottom = clipRect.YMost();
-  if (mWindow->clipRect.left    != newClipRect.left   ||
-      mWindow->clipRect.top     != newClipRect.top    ||
-      mWindow->clipRect.right   != newClipRect.right  ||
-      mWindow->clipRect.bottom  != newClipRect.bottom) {
-    mWindow->clipRect = newClipRect;
-    doupdatewindow = PR_TRUE;
-  }
+  newClipRect.left = 0;
+  newClipRect.top = 0;
+  newClipRect.right = window->width;
+  newClipRect.bottom = window->height;
+  
+  window->clipRect = newClipRect; 
+  window->x = 0;
+  window->y = 0;
     
   NPSetWindowCallbackStruct* ws_info =
-    static_cast<NPSetWindowCallbackStruct*>(mWindow->ws_info);
+    static_cast<NPSetWindowCallbackStruct*>(window->ws_info);
   ws_info->visual = 0;
   ws_info->colormap = 0;
-  if (ws_info->depth != 24) {
-    ws_info->depth = 24;
-    doupdatewindow = PR_TRUE;
-  }
+  ws_info->depth = 16;
+  mInstance->SetWindow(window);
 
-  if (doupdatewindow)
-    mInstance->SetWindow(mWindow);
-
-  nsIntRect dirtyRect = mDirtyRect;
-
-  // Intersect the dirty rect with the clip rect to ensure that it lies within
-  // the drawable.
-  if (!dirtyRect.IntersectRect(mDirtyRect, clipRect))
-    return NS_ERROR_FAILURE;
-
-  XEvent pluginEvent;
+  NPEvent pluginEvent;
   NPImageExpose imageExpose;
   XGraphicsExposeEvent& exposeEvent = pluginEvent.xgraphicsexpose;
 
@@ -4908,71 +5051,82 @@ nsPluginInstanceOwner::NativeImageDraw(gfxContext *aContext,
 
   // Store imageExpose structure pointer as drawable member
   exposeEvent.drawable = (Drawable)&imageExpose;
-  exposeEvent.x = mDirtyRect.x;
-  exposeEvent.y = mDirtyRect.y;
-  exposeEvent.width = mDirtyRect.width;
-  exposeEvent.height = mDirtyRect.height;
   exposeEvent.count = 0;
-
-  // information not set:
   exposeEvent.serial = 0;
   exposeEvent.send_event = False;
   exposeEvent.major_code = 0;
   exposeEvent.minor_code = 0;
 
-  // defaults for NPImageExpose
-  imageExpose.depth = 24;
-  imageExpose.translateX = 1;
-  imageExpose.translateY = 1;
-  imageExpose.scaleX = 1;
-  imageExpose.scaleY = 1;
+  exposeEvent.x = 0;
+  exposeEvent.y = 0;
+  exposeEvent.width  = window->width;
+  exposeEvent.height = window->height;
 
-  // only have the plugin draw what is dirty
-  imageExpose.x = mDirtyRect.x;
-  imageExpose.y = mDirtyRect.y;
-  imageExpose.width = mDirtyRect.width;
-  imageExpose.height = mDirtyRect.height;
+  imageExpose.x = 0;
+  imageExpose.y = 0;
+  imageExpose.width  = window->width;
+  imageExpose.height = window->height;
 
-  // reallocate buffer if there is a size change or if we haven't allocated one yet.  We probably can do this
-  // somewhere else.
-  if (!mImageExposeBuffer ||
-      (mImageExposeBufferSize.width * mImageExposeBufferSize.height < mWindow->width * mWindow->height)) {
-    if (mImageExposeBuffer)
-      free(mImageExposeBuffer);
+  imageExpose.depth = 16;
 
-    mImageExposeBuffer = (unsigned char*) malloc (mWindow->width * mWindow->height * 4);
-    mImageExposeBufferSize = gfxIntSize(mWindow->width, mWindow->height);
-  }
+  imageExpose.translateX = 0;
+  imageExpose.translateY = 0;
 
-  NS_ENSURE_TRUE(mImageExposeBuffer, NS_ERROR_OUT_OF_MEMORY);
+  imageExpose.scaleX = mPluginScale;
+  imageExpose.scaleY = mPluginScale;
 
-  // Because we are reusing mImageExposeBuffer, there might be old bytes.  The API NPImageExpose
-  // expects that the buffer be zero'ed out.  
-  memset(mImageExposeBuffer, 0, mImageExposeBufferSize.height * mImageExposeBufferSize.width * 4);
-
-  nsRefPtr<gfxImageSurface> surf = new gfxImageSurface(mImageExposeBuffer,
-                                                       mImageExposeBufferSize,
-                                                       mImageExposeBufferSize.width * 4,
-                                                       gfxASurface::ImageFormatRGB24);
-  NS_ENSURE_TRUE(surf, NS_ERROR_OUT_OF_MEMORY);
-
-  // Setup temporary context scaled size
-  imageExpose.stride = surf->Stride();
-  imageExpose.data = reinterpret_cast<char*>(surf->Data());
-  imageExpose.dataSize.width = surf->Width();
-  imageExpose.dataSize.height = surf->Height(); 
+  imageExpose.stride          = mPluginSize.width * 2;
+  imageExpose.data            = mSharedXImage->data;
+  imageExpose.dataSize.width  = mPluginSize.width;
+  imageExpose.dataSize.height = mPluginSize.height; 
 
   PRBool eventHandled = PR_FALSE;
-  // Get Image surface from original context
-  // Draw plugin content to temp surface
   mInstance->HandleEvent(&pluginEvent, &eventHandled);
 
-  if (eventHandled) {
-    nsRefPtr<gfxPattern> pat = new gfxPattern(surf);
-    aContext->NewPath();
-    aContext->PixelSnappedRectangleAndSetPattern(gfxRect(0, 0, mWindow->width, mWindow->height), pat);
-    aContext->Fill();
+  if (!eventHandled) {
+    // XXX we should set a flag that the plugin didn't handle this event,
+    // and we should deallocate the SHM surface and just skip trying to
+    // draw this way
+    return NS_ERROR_FAILURE;
   }
+
+  // Setup the clip rectangle
+  XRectangle rect;
+  rect.x = mAbsolutePositionClip.x;
+  rect.y = mAbsolutePositionClip.y;
+  rect.width = mAbsolutePositionClip.width;
+  rect.height = mAbsolutePositionClip.height;
+
+  GC gc = XCreateGC(gdk_x11_get_default_xdisplay(),
+                    mBlitWindow,
+                    0,
+                    0);
+  if (!gc)
+    return NS_ERROR_FAILURE;
+
+  XSetClipRectangles(gdk_x11_get_default_xdisplay(),
+                     gc,
+                     mAbsolutePosition.x,
+                     mAbsolutePosition.y, 
+                     &rect, 1,
+                     Unsorted);
+
+  XShmPutImage(gdk_x11_get_default_xdisplay(),
+               mBlitWindow,
+               gc,
+               mSharedXImage,
+               0,
+               0,
+               mAbsolutePosition.x,
+               mAbsolutePosition.y,
+               mPluginSize.width,
+               mPluginSize.height,
+               PR_FALSE);
+  
+  XSetClipRectangles(gdk_x11_get_default_xdisplay(), gc, 0, 0, nsnull, 0, Unsorted);  
+
+  XFreeGC(gdk_x11_get_default_xdisplay(), gc);
+  XFlush(gdk_x11_get_default_xdisplay());
   return NS_OK;
 }
 #endif
@@ -5149,11 +5303,6 @@ nsPluginInstanceOwner::Renderer::NativeDraw(QWidget * drawable,
 
 NS_IMETHODIMP nsPluginInstanceOwner::Notify(nsITimer* timer)
 {
-#ifdef MOZ_PLATFORM_HILDON
-  if (mInstance)
-    UpdateVisibility();
-#endif
-
 #if defined(XP_MACOSX) && !defined(NP_NO_CARBON)
   if (GetEventModel() != NPEventModelCarbon)
     return NS_OK;
@@ -5204,20 +5353,6 @@ void nsPluginInstanceOwner::StartTimer(unsigned int aDelay)
     mPluginTimer->InitWithCallback(this, aDelay, nsITimer::TYPE_REPEATING_SLACK);
   }
 #endif
-
-#ifdef MOZ_PLATFORM_HILDON
-  if (!mTimerCanceled)
-    return;
-
-  // start a periodic timer to provide null events to the plugin instance.
-  if (!mPluginTimer)
-    mPluginTimer = do_CreateInstance("@mozilla.org/timer;1");
-
-  if (mPluginTimer) {
-    mTimerCanceled = PR_FALSE;
-    mPluginTimer->InitWithCallback(this, aDelay, nsITimer::TYPE_ONE_SHOT);
-  }
-#endif
 }
 
 void nsPluginInstanceOwner::CancelTimer()
@@ -5423,28 +5558,21 @@ void nsPluginInstanceOwner::SetPluginHost(nsIPluginHost* aHost)
 }
 
 #ifdef MOZ_PLATFORM_HILDON
-PRBool nsPluginInstanceOwner::UpdateVisibility(PRBool aForce)
+PRBool nsPluginInstanceOwner::UpdateVisibility()
 {
-  if (!mPluginWindow || !mInstance || !mObjectFrame)
-    return PR_FALSE;
+  NS_ASSERTION(mInstance, "mInstance should never be null");
   
-  // first, check our view for CSS visibility style
-  PRBool isVisible =
-    mObjectFrame->GetView()->GetVisibility() == nsViewVisibility_kShow;
-
-  if (aForce || mWidgetVisible != isVisible) {
   PRBool handled;
   NPEvent pluginEvent;
   XVisibilityEvent& visibilityEvent = pluginEvent.xvisibility;
   visibilityEvent.type = VisibilityNotify;
   visibilityEvent.display = 0;
-    visibilityEvent.state = isVisible ? VisibilityUnobscured : VisibilityFullyObscured;
+  visibilityEvent.state = VisibilityUnobscured;
   mInstance->HandleEvent(&pluginEvent, &handled);
-    mWidgetVisible = isVisible;
+
+  mWidgetVisible = PR_TRUE;
   return PR_TRUE;
 }
-  return PR_FALSE;
-}
 #endif
 
   // Mac specific code to fix up the port location and clipping region
@@ -5584,3 +5712,50 @@ void nsPluginInstanceOwner::FixUpURLS(const nsString &name, nsAString &value)
       value = newURL;
   }
 }
+
+#ifdef MOZ_PLATFORM_HILDON
+nsresult
+nsPluginInstanceOwner::SetAbsoluteScreenPosition(nsIDOMElement* element,
+                                                 nsIDOMClientRect* position,
+                                                 nsIDOMClientRect* clip)
+{
+  if ((mBlitParentElement && (mBlitParentElement != element)) ||
+      !position || !clip)
+    return NS_ERROR_FAILURE;
+  
+  // convert to a int rect.
+  float left, top, width, height;
+  position->GetLeft(&left);
+  position->GetTop(&top);
+  position->GetWidth(&width);
+  position->GetHeight(&height);
+  
+  NPWindow  *window;
+  GetWindow(window);
+  NS_ASSERTION(window, "Must have a window here");
+  
+  mPluginScale = width / window->width;
+  
+  // The flash plugin on Maemo n900 requires the width/height to be
+  // even.
+  mAbsolutePosition = nsIntRect(NSToIntFloor(left),
+                                NSToIntFloor(top),
+                                NSToIntCeil(width) / 2 * 2,
+                                NSToIntCeil(height) / 2 * 2);
+  clip->GetLeft(&left);
+  clip->GetTop(&top);
+  clip->GetWidth(&width);
+  clip->GetHeight(&height);
+  
+  mAbsolutePositionClip = nsIntRect(NSToIntFloor(left),
+                                    NSToIntFloor(top),
+                                    NSToIntCeil(width),
+                                    NSToIntCeil(height));
+  mBlitParentElement = element;
+    
+  // The hildon plugin needs to have it visibility poked
+  UpdateVisibility();
+  return NS_OK;
+}
+#endif
+

layout/generic/nsObjectFrame.h

@@ -58,6 +58,7 @@ class nsIPluginHost;
 class nsIPluginInstance;
 class nsPresContext;
 class nsDisplayPlugin;
+class nsIDOMElement;
 
 #define nsObjectFrameSuper nsFrame
 
@@ -220,6 +221,12 @@ protected:
 
   nsIWidget* GetWidget() { return mWidget; }
 
+  nsresult SetAbsoluteScreenPosition(nsIDOMElement* element,
+                                     nsIDOMClientRect* position,
+                                     nsIDOMClientRect* clip);
+
+  void NotifyPluginEventObservers(const PRUnichar *eventType);
+
   friend class nsPluginInstanceOwner;
   friend class nsDisplayPlugin;
 

layout/style/test/test_value_cloning.html

@@ -22,6 +22,7 @@ var iframe = document.getElementById("iframe");
 var current_item;
 
 SimpleTest.waitForExplicitFinish();
+SimpleTest.requestLongerTimeout(3);
 
 for (var prop in gCSSProperties) {
   var info = gCSSProperties[prop];

layout/xul/base/src/nsPopupSetFrame.cpp

@@ -267,11 +267,15 @@ nsPopupSetFrame::RemovePopupFrame(nsIFrame* aPopup)
 nsresult
 nsPopupSetFrame::AddPopupFrameList(nsFrameList& aPopupFrameList)
 {
-  for (nsFrameList::Enumerator e(aPopupFrameList); !e.AtEnd(); e.Next()) {
-    nsresult rv = AddPopupFrame(e.get());
+  while (!aPopupFrameList.IsEmpty()) {
+    nsIFrame* f = aPopupFrameList.FirstChild();
+    // Clears out prev/next sibling points appropriately. Every frame
+    // in our popup list has null next and prev pointers, they're logically
+    // each in their own list.
+    aPopupFrameList.RemoveFrame(f);
+    nsresult rv = AddPopupFrame(f);
     NS_ENSURE_SUCCESS(rv, rv);
   }
-  aPopupFrameList.Clear();
   return NS_OK;
 }
 

modules/libpr0n/src/imgContainer.cpp

@@ -2359,7 +2359,6 @@ NS_IMETHODIMP imgContainer::Draw(gfxContext *aContext, gfxPattern::GraphicsFilte
 
   imgFrame *frame = GetCurrentDrawableImgFrame();
   if (!frame) {
-    NS_ABORT_IF_FALSE(!mDecoded, "Decoded but frame not available?");
     return NS_OK; // Getting the frame (above) touches the image and kicks off decoding
   }
 

modules/libpr0n/test/crashtests/crashtests.list

@@ -8,6 +8,5 @@ load invalid-size.gif
 load invalid-size-second-frame.gif
 
 # Animated gifs with a very large canvas, but tiny actual content.
-# Disabled temporarily until fatal assertion is removed
-#load delaytest.html?523528-1.gif
-#load delaytest.html?523528-2.gif
+load delaytest.html?523528-1.gif
+load delaytest.html?523528-2.gif

modules/libpref/src/init/all.js

@@ -822,6 +822,15 @@ pref("network.auth.use-sspi", true);
 
 #endif
 
+// Controls which NTLM authentication implementation we default to. True forces
+// the use of our generic (internal) NTLM authentication implementation vs. any
+// native implementation provided by the os. This pref is for diagnosing issues
+// with native NTLM. (See bug 520607 for details.) Using generic NTLM authentication
+// can expose the user to reflection attack vulnerabilities. Do not change this
+// unless you know what you're doing!
+// This pref should be removed 6 months after the release of firefox 3.6. 
+pref("network.auth.force-generic-ntlm", false);
+
 // The following prefs are used to enable automatic use of the operating
 // system's NTLM implementation to silently authenticate the user with their
 // Window's domain logon.  The trusted-uris pref follows the format of the

netwerk/protocol/http/src/nsHttpNTLMAuth.cpp

@@ -21,6 +21,7 @@
  *
  * Contributor(s):
  *   Darin Fisher <darin@meer.net>
+ *   Jim Mathies <jmathies@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -54,6 +55,7 @@
 
 static const char kAllowProxies[] = "network.automatic-ntlm-auth.allow-proxies";
 static const char kTrustedURIs[]  = "network.automatic-ntlm-auth.trusted-uris";
+static const char kForceGeneric[] = "network.auth.force-generic-ntlm";
 
 // XXX MatchesBaseURI and TestPref are duplicated in nsHttpNegotiateAuth.cpp,
 // but since that file lives in a separate library we cannot directly share it.
@@ -169,32 +171,43 @@ TestPref(nsIURI *uri, const char *pref)
     return PR_FALSE;
 }
 
+// Check to see if we should use our generic (internal) NTLM auth module.
 static PRBool
-CanUseSysNTLM(nsIHttpChannel *channel, PRBool isProxyAuth)
+ForceGenericNTLM()
 {
-    // check prefs
+    nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+    if (!prefs)
+        return PR_FALSE;
+    PRBool flag = PR_FALSE;
 
+    if (NS_FAILED(prefs->GetBoolPref(kForceGeneric, &flag)))
+        flag = PR_FALSE;
+
+    LOG(("Force use of generic ntlm auth module: %d\n", flag));
+    return flag;
+}
+
+// Check to see if we should use default credentials for this host or proxy.
+static PRBool
+CanUseDefaultCredentials(nsIHttpChannel *channel, PRBool isProxyAuth)
+{
     nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
     if (!prefs)
         return PR_FALSE;
 
-    PRBool val;
     if (isProxyAuth) {
+        PRBool val;
         if (NS_FAILED(prefs->GetBoolPref(kAllowProxies, &val)))
             val = PR_FALSE;
-        LOG(("sys-ntlm allowed for proxy: %d\n", val));
+        LOG(("Default credentials allowed for proxy: %d\n", val));
         return val;
     }
-    else {
+
     nsCOMPtr<nsIURI> uri;
     channel->GetURI(getter_AddRefs(uri));
-        if (uri && TestPref(uri, kTrustedURIs)) {
-            LOG(("sys-ntlm allowed for host\n"));
-            return PR_TRUE;
-        }
-    }
-
-    return PR_FALSE;
+    PRBool isTrustedHost = (uri && TestPref(uri, kTrustedURIs));
+    LOG(("Default credentials allowed for host: %d\n", isTrustedHost));
+    return isTrustedHost;
 }
 
 // Dummy class for session state object.  This class doesn't hold any data.
@@ -221,40 +234,58 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpChannel *channel,
     LOG(("nsHttpNTLMAuth::ChallengeReceived [ss=%p cs=%p]\n",
          *sessionState, *continuationState));
 
-    // NOTE: we don't define any session state
+    // NOTE: we don't define any session state, but we do use the pointer.
 
     *identityInvalid = PR_FALSE;
-    // start new auth sequence if challenge is exactly "NTLM"
+
+    // Start a new auth sequence if the challenge is exactly "NTLM".
+    // If native NTLM auth apis are available and enabled through prefs,
+    // try to use them.
     if (PL_strcasecmp(challenge, "NTLM") == 0) {
         nsCOMPtr<nsISupports> module;
-        //
-        // our session state is non-null to indicate that we've flagged
-        // this auth domain as not accepting the system's default login.
-        //
-        PRBool trySysNTLM = (*sessionState == nsnull);
 
-        //
-        // we may have access to a built-in SSPI library,
-        // which could be used to authenticate the user without prompting.
-        // 
-        // if the continuationState is null, then we may want to try using
-        // the SSPI NTLM module.  however, we need to take care to only use
-        // that module when speaking to a trusted host.  because the SSPI
-        // may send a weak LMv1 hash of the user's password, we cannot just
-        // send it to any server.
-        //
-        if (trySysNTLM && !*continuationState && CanUseSysNTLM(channel, isProxyAuth)) {
+        // Check to see if we should default to our generic NTLM auth module
+        // through UseGenericNTLM. (We use native auth by default if the
+        // system provides it.) If *sessionState is non-null, we failed to
+        // instantiate a native NTLM module the last time, so skip trying again.
+        PRBool forceGeneric = ForceGenericNTLM();
+        if (!forceGeneric && !*sessionState) {
+            // Check for approved default credentials hosts and proxies. If 
+            // *continuationState is non-null, the last authentication attempt
+            // failed so skip default credential use.
+            if (!*continuationState && CanUseDefaultCredentials(channel, isProxyAuth)) {
+                // Try logging in with the user's default credentials. If
+                // successful, |identityInvalid| is false, which will trigger
+                // a default credentials attempt once we return.
                 module = do_CreateInstance(NS_AUTH_MODULE_CONTRACTID_PREFIX "sys-ntlm");
+            }
+#ifdef XP_WIN
+            else {
+                // Try to use native NTLM and prompt the user for their domain,
+                // username, and password. (only supported by windows nsAuthSSPI module.)
+                // Note, for servers that use LMv1 a weak hash of the user's password
+                // will be sent. We rely on windows internal apis to decide whether
+                // we should support this older, less secure version of the protocol.
+                module = do_CreateInstance(NS_AUTH_MODULE_CONTRACTID_PREFIX "sys-ntlm");
+                *identityInvalid = PR_TRUE;
+            }
+#endif // XP_WIN
 #ifdef PR_LOGGING
             if (!module)
-                LOG(("failed to load sys-ntlm module\n"));
+                LOG(("Native sys-ntlm auth module not found.\n"));
 #endif
         }
 
-        // it's possible that there is no ntlm-sspi auth module...
+#ifdef XP_WIN
+        // On windows, never fall back unless the user has specifically requested so.
+        if (!forceGeneric && !module)
+            return NS_ERROR_UNEXPECTED;
+#endif
+
+        // If no native support was available. Fall back on our internal NTLM implementation.
         if (!module) {
             if (!*sessionState) {
-                // remember the fact that we cannot use the "sys-ntlm" module,
+                // Remember the fact that we cannot use the "sys-ntlm" module,
                 // so we don't ever bother trying again for this auth domain.
                 *sessionState = new nsNTLMSessionState();
                 if (!*sessionState)
@@ -262,18 +293,23 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpChannel *channel,
                 NS_ADDREF(*sessionState);
             }
 
+            // Use our internal NTLM implementation. Note, this is less secure,
+            // see bug 520607 for details.
+            LOG(("Trying to fall back on internal ntlm auth.\n"));
             module = do_CreateInstance(NS_AUTH_MODULE_CONTRACTID_PREFIX "ntlm");
 
-            // prompt user for domain, username, and password...
+            // Prompt user for domain, username, and password.
             *identityInvalid = PR_TRUE;
         }
 
-        // if this fails, then it means that we cannot do NTLM auth.
-        if (!module)
+        // If this fails, then it means that we cannot do NTLM auth.
+        if (!module) {
+            LOG(("No ntlm auth modules available.\n"));
             return NS_ERROR_UNEXPECTED;
+        }
 
-        // non-null continuation state implies that we failed to authenticate.
-        // blow away the old authentication state, and use the new one.
+        // A non-null continuation state implies that we failed to authenticate.
+        // Blow away the old authentication state, and use the new one.
         module.swap(*continuationState);
     }
     return NS_OK;
@@ -332,16 +368,16 @@ nsHttpNTLMAuth::GenerateCredentials(nsIHttpChannel  *httpChannel,
         challenge += 5;
         len -= 5;
 
+        // strip off any padding (see bug 230351)
+        while (challenge[len - 1] == '=')
+          len--;
+
         // decode into the input secbuffer
         inBufLen = (len * 3)/4;      // sufficient size (see plbase64.h)
         inBuf = nsMemory::Alloc(inBufLen);
         if (!inBuf)
             return NS_ERROR_OUT_OF_MEMORY;
 
-        // strip off any padding (see bug 230351)
-        while (challenge[len - 1] == '=')
-          len--;
-
         if (PL_Base64Decode(challenge, len, (char *) inBuf) == nsnull) {
             nsMemory::Free(inBuf);
             return NS_ERROR_UNEXPECTED; // improper base64 encoding

parser/html/nsHtml5Module.cpp

@@ -59,8 +59,6 @@ nsHtml5Module::InitializeStatics()
 {
   nsContentUtils::AddBoolPrefVarCache("html5.enable", &sEnabled);
   nsContentUtils::AddBoolPrefVarCache("html5.offmainthread", &sOffMainThread);
-  NS_NewThread(&sStreamParserThread);
-  NS_GetMainThread(&sMainThread);
   nsHtml5Atoms::AddRefAtoms();
   nsHtml5AttributeName::initializeStatics();
   nsHtml5ElementName::initializeStatics();
@@ -92,7 +90,9 @@ nsHtml5Module::ReleaseStatics()
   nsHtml5Tokenizer::releaseStatics();
   nsHtml5TreeBuilder::releaseStatics();
   nsHtml5UTF16Buffer::releaseStatics();
+  if (sStreamParserThread) {
     sStreamParserThread->Shutdown();
+  }
   NS_IF_RELEASE(sStreamParserThread);
   NS_IF_RELEASE(sMainThread);
 }
@@ -120,7 +120,18 @@ nsHtml5Module::Initialize(nsIParser* aParser, nsIDocument* aDoc, nsIURI* aURI, n
 nsIThread*
 nsHtml5Module::GetStreamParserThread()
 {
-  return sOffMainThread ? sStreamParserThread : sMainThread;
+  if (sOffMainThread) {
+    if (!sStreamParserThread) {
+      NS_NewThread(&sStreamParserThread);
+      NS_ASSERTION(sStreamParserThread, "Thread creation failed!");
+    }
+    return sStreamParserThread;
+  }
+  if (!sMainThread) {
+    NS_GetMainThread(&sMainThread);
+    NS_ASSERTION(sMainThread, "Main thread getter failed");
+  }
+  return sMainThread;
 }
 
 #ifdef DEBUG

parser/htmlparser/tests/mochitest/Makefile.in

@@ -57,7 +57,6 @@ _TEST_FILES =	parser_datreader.js \
 		test_bug396568.html \
 		test_bug418464.html \
 		test_bug460437.xhtml \
-		test_bug502091.html \
 		bug_502091_iframe.html \
 		test_compatmode.html \
 		regressions.txt \
@@ -66,3 +65,6 @@ _TEST_FILES =	parser_datreader.js \
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
+
+# Disabled due to bug 529544
+#		test_bug502091.html \

parser/htmlparser/tests/mochitest/test_compatmode.html

@@ -77,12 +77,12 @@ function finishTest() {
 function test(mode,i){
   is(mode,doctypes[i],doctypes[i+1]);
   if (i == doctypes.length - 2) {
-    if (typeof(gOriginalHtml5Pref) == "undefined") {
-      doTestHtml5();
-    }
-    else {
+//    if (typeof(gOriginalHtml5Pref) == "undefined") {
+//      doTestHtml5(); Disabled due to bug 529544
+//    }
+//    else {
       finishTest();
-    }
+//    }
   }
 }
 

security/manager/ssl/src/nsNTLMAuthModule.cpp

@@ -802,7 +802,6 @@ nsNTLMAuthModule::Init(const char      *serviceName,
                        const PRUnichar *username,
                        const PRUnichar *password)
 {
-  NS_ASSERTION(serviceName == nsnull, "unexpected service name");
   NS_ASSERTION(serviceFlags == nsIAuthModule::REQ_DEFAULT, "unexpected service flags");
 
   mDomain = domain;

testing/mochitest/tests/SimpleTest/SimpleTest.js

@@ -217,6 +217,20 @@ SimpleTest.waitForExplicitFinish = function () {
     SimpleTest._stopOnLoad = false;
 };
 
+/**
+ * Multiply the timeout the parent runner uses for this test by the
+ * given factor.
+ *
+ * For example, in a test that may take a long time to complete, using
+ * "SimpleTest.requestLongerTimeout(5)" will give it 5 times as long to
+ * finish.
+ */
+SimpleTest.requestLongerTimeout = function (factor) {
+    if (parentRunner) {
+        parentRunner.requestLongerTimeout(factor);
+    }
+}
+
 SimpleTest.waitForFocus_started = false;
 SimpleTest.waitForFocus_loaded = false;
 SimpleTest.waitForFocus_focused = false;

testing/mochitest/tests/SimpleTest/TestRunner.js

@@ -20,11 +20,12 @@ TestRunner.maxTimeouts = 4; // halt testing after too many timeouts
 **/
 TestRunner._numTimeouts = 0;
 TestRunner._currentTestStartTime = new Date().valueOf();
+TestRunner._timeoutFactor = 1;
 
 TestRunner._checkForHangs = function() {
   if (TestRunner._currentTest < TestRunner._urls.length) {
     var runtime = new Date().valueOf() - TestRunner._currentTestStartTime;
-    if (runtime >= TestRunner.timeout) {
+    if (runtime >= TestRunner.timeout * TestRunner._timeoutFactor) {
       var frameWindow = $('testframe').contentWindow.wrappedJSObject ||
                           $('testframe').contentWindow;
       frameWindow.SimpleTest.ok(false, "Test timed out.");
@@ -50,6 +51,10 @@ TestRunner._checkForHangs = function() {
   }
 }
 
+TestRunner.requestLongerTimeout = function(factor) {
+    TestRunner._timeoutFactor = factor;
+}
+
 /**
  * This function is called after generating the summary.
 **/
@@ -134,6 +139,7 @@ TestRunner.runNextTest = function() {
         $("current-test-path").innerHTML = url;
 
         TestRunner._currentTestStartTime = new Date().valueOf();
+        TestRunner._timeoutFactor = 1;
 
         if (TestRunner.logEnabled)
             TestRunner.logger.log("Running " + url + "...");

toolkit/components/filepicker/src/nsFilePicker.js.in

@@ -165,7 +165,7 @@ nsFilePicker.prototype = {
     }
     if (filterMask & nsIFilePicker.filterImages) {
       this.appendFilter(bundle.GetStringFromName("imageTitle"),
-                   bundle.GetStringFromName("imageFilter"));
+                   "*.jpg; *.jpeg; *.gif; *.png; *.bmp; *.ico"); // XXX 528755
     }
     if (filterMask & nsIFilePicker.filterXML) {
       this.appendFilter(bundle.GetStringFromName("xmlTitle"),

toolkit/components/places/src/nsPlacesDBFlush.js

@@ -176,20 +176,6 @@ nsPlacesDBFlush.prototype = {
           // Flush any remaining change to disk tables.
           this._self._flushWithQueries([kQuerySyncPlacesId, kQuerySyncHistoryVisitsId]);
 
-          // Ensure we won't act anymore as a category observer, so we stop
-          // being notified.
-          // This should not be needed but due to bug 522353 we leak in tests
-          // if we don't manually remove the entries.
-          // WARNING: These changes must NOT be persistent!
-          let catMan = Cc["@mozilla.org/categorymanager;1"].
-                       getService(Ci.nsICategoryManager);
-          catMan.deleteCategoryEntry("bookmark-observers",
-                                     this._self.classDescription,
-                                     false); // Only for this session!
-          catMan.deleteCategoryEntry("history-observers",
-                                     this._self.classDescription,
-                                     false); // Only for this session!
-
           // Close the database connection, this was the last sync and we can't
           // ensure database coherence from now on.
           this._self._finalizeInternalStatements();

toolkit/components/places/tests/unit/test_419731.js

@@ -139,7 +139,7 @@ function run_test() {
   root = result.root;
 
   root.containerOpen = true;
-  cc = root.childCount;
+  var cc = root.childCount;
   do_check_eq(cc, 1);
   node = root.getChild(0);
   do_check_eq(node.title, "new title 2");

toolkit/content/tests/widgets/Makefile.in

@@ -127,8 +127,7 @@ _TEST_FILES = 	test_bug360220.xul \
 		videocontrols_direction-2e.html \
 		videocontrols_direction_test.js \
 		use_large_cache.js \
-		audio.oga \
-		black.ogv \
+		audio.wav \
 		video.ogg \
 		videomask.css \
 		$(NULL)

toolkit/content/tests/widgets/videocontrols_direction-1-ref.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<video controls autobuffer id="av" source="black.ogv"></video>
+<video controls autobuffer id="av" source="audio.wav"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-1a.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body>
-<video controls autobuffer id="av" source="black.ogv"></video>
+<video controls autobuffer id="av" source="audio.wav"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-1b.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body>
-<video controls autobuffer id="av" source="black.ogv"></video>
+<video controls autobuffer id="av" source="audio.wav"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-1c.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="direction: rtl">
-<video controls autobuffer id="av" source="black.ogv"></video>
+<video controls autobuffer id="av" source="audio.wav"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-1d.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<video controls autobuffer id="av" source="black.ogv" dir="rtl"></video>
+<video controls autobuffer id="av" source="audio.wav" dir="rtl"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-1e.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<video controls autobuffer id="av" source="black.ogv" style="direction: rtl;"></video>
+<video controls autobuffer id="av" source="audio.wav" style="direction: rtl;"></video>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2-ref.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<audio controls autobuffer id="av" source="audio.oga"></audio>
+<audio controls autobuffer id="av" source="audio.wav"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2a.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body>
-<audio controls autobuffer id="av" source="audio.oga"></audio>
+<audio controls autobuffer id="av" source="audio.wav"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2b.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body>
-<audio controls autobuffer id="av" source="audio.oga"></audio>
+<audio controls autobuffer id="av" source="audio.wav"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2c.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="direction: rtl">
-<audio controls autobuffer id="av" source="audio.oga"></audio>
+<audio controls autobuffer id="av" source="audio.wav"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2d.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<audio controls autobuffer id="av" source="audio.oga" dir="rtl"></audio>
+<audio controls autobuffer id="av" source="audio.wav" dir="rtl"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction-2e.html

@@ -4,7 +4,7 @@
 <link rel="stylesheet" type="text/css" href="videomask.css">
 </head>
 <body style="text-align: right;">
-<audio controls autobuffer id="av" source="audio.oga" style="direction: rtl;"></audio>
+<audio controls autobuffer id="av" source="audio.wav" style="direction: rtl;"></audio>
 <div id="mask"></div>
 </body>
 </html>

toolkit/content/tests/widgets/videocontrols_direction_test.js

@@ -20,10 +20,9 @@ RemoteCanvas.prototype.load = function(callback) {
   var me = this;
   iframe.addEventListener("load", function() {
     var m = iframe.contentDocument.getElementById("av");
-    m.addEventListener("suspend", function(aEvent) {
-      if (m.readyState == m.HAVE_ENOUGH_DATA &&
-          aEvent.loaded == aEvent.total) {
-        m.removeEventListener("suspend", arguments.callee, false);
+    m.addEventListener("progress", function(aEvent) {
+      if (aEvent.loaded == aEvent.total) {
+        m.removeEventListener("progress", arguments.callee, false);
         setTimeout(function() {
           me.remotePageLoaded(callback);
         }, 0);

toolkit/mozapps/update/content/updates.js

@@ -762,6 +762,13 @@ var gManualUpdatePage = {
     manualUpdateLinkLabel.value = manualURL;
     manualUpdateLinkLabel.setAttribute("url", manualURL);
 
+    // Prevent multiple notifications for the same update when the user is
+    // unable to apply updates.
+    // Encode version since it could be a non-ascii string (bug 359093)
+    var neverPrefName = PREF_UPDATE_NEVER_BRANCH +
+                        encodeURIComponent(gUpdates.update.version);
+    gPref.setBoolPref(neverPrefName, true);
+
     gUpdates.setButtons(null, null, "okButton", true);
     gUpdates.wiz.getButton("finish").focus();
   }

toolkit/mozapps/update/src/nsUpdateService.js.in

@@ -1325,6 +1325,21 @@ UpdateService.prototype = {
     // Encode version since it could be a non-ascii string (bug 359093)
     var neverPrefName = PREF_UPDATE_NEVER_BRANCH +
                         encodeURIComponent(update.version);
+
+    if (!gCanApplyUpdates) {
+      if (getPref("getBoolPref", neverPrefName, false)) {
+        LOG("Checker:_selectAndInstallUpdate - the user is unable to apply " +
+            "updates. Not prompting because the preference " + neverPrefName + 
+            " is true");
+      }
+      else {
+        LOG("Checker:_selectAndInstallUpdate - the user is unable to apply " +
+            "updates... prompting");
+        this._showPrompt(update);
+      }
+      return;
+    }
+
     if (update.type == "major" &&
         getPref("getBoolPref", neverPrefName, false)) {
       LOG("Checker:_selectAndInstallUpdate - not prompting because this is a " +
@@ -1357,13 +1372,6 @@ UpdateService.prototype = {
       return;
     }
 
-    if (!gCanApplyUpdates) {
-      LOG("Checker:_selectAndInstallUpdate - prompting because the user is " +
-          "unable to apply updates");
-      this._showPrompt(update);
-      return;
-    }
-
     if (!getPref("getBoolPref", PREF_APP_UPDATE_AUTO, true)) {
       LOG("Checker:_selectAndInstallUpdate - prompting because silent " +
           "install is disabled");

toolkit/xre/nsWindowsDllBlocklist.h

@@ -42,6 +42,11 @@
 
 #define ALL_VERSIONS   ((unsigned long long)-1LL)
 
+// Convert the 4 (decimal) components of a DLL version number into a
+// single unsigned long long, as needed by the blocklist
+#define MAKE_VERSION(a,b,c,d)\
+  ((a##ULL << 48) + (b##ULL << 32) + (c##ULL << 16) + d##ULL)
+
 struct DllBlockInfo {
   // The name of the DLL -- in LOWERCASE!  It will be compared to
   // a lowercase version of the DLL name only.
@@ -64,6 +69,12 @@ static DllBlockInfo sWindowsDllBlocklist[] = {
   // { "uxtheme.dll", 0x0000123400000000ULL },
   // The DLL name must be in lowercase!
   
+  // NPFFAddon - Known malware
+  { "npffaddon.dll", ALL_VERSIONS},
+
+  // AVG 8 - Antivirus vendor AVG, old version, plugin already blocklisted
+  {"avgrsstx.dll", MAKE_VERSION(8,5,0,401)},
+
   // leave these two in always for tests
   { "mozdllblockingtest.dll", ALL_VERSIONS },
   { "mozdllblockingtest_versioned.dll", 0x0000000400000000ULL },

tools/performance/startup/open10Windows.xul

@@ -5,7 +5,7 @@
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         id="open10Windows"
         onload="onload();">
-    <script type="application/x-javascript">
+    <script type="application/javascript">
         <![CDATA[
             const n = 11;
             var sub = [];

tools/update-packaging/make_incremental_update.sh

@@ -48,7 +48,7 @@ if [ $# = 0 ]; then
   exit 1
 fi
 
-requested_forced_updates=''
+requested_forced_updates='components/components.list Contents/MacOS/components/components.list'
 
 while getopts "hf:" flag
 do
@@ -109,6 +109,15 @@ for ((i=0; $i<$num_oldfiles; i=$i+1)); do
 
   # If this file exists in the new directory as well, then check if it differs.
   if [ -f "$newdir/$f" ]; then
+
+    if check_for_forced_update "$requested_forced_updates" "$f"; then
+      echo 1>&2 "  FORCING UPDATE for file '$f'..."
+      $BZIP2 -cz9 "$newdir/$f" > "$workdir/$f"
+      make_add_instruction "$f" >> $manifest
+      archivefiles="$archivefiles \"$f\""
+      continue 1
+    fi
+
     if ! diff "$olddir/$f" "$newdir/$f" > /dev/null; then
       # Compute both the compressed binary diff and the compressed file, and
       # compare the sizes.  Then choose the smaller of the two to package.
@@ -122,14 +131,6 @@ for ((i=0; $i<$num_oldfiles; i=$i+1)); do
       patchsize=$(get_file_size "$patchfile")
       fullsize=$(get_file_size "$workdir/$f")
 
-      if check_for_forced_update "$requested_forced_updates" "$f"; then
-        echo 1>&2 "  FORCING UPDATE for file '$f'..."
-        make_add_instruction "$f" >> $manifest
-        rm -f "$patchfile"
-        archivefiles="$archivefiles \"$f\""
-        continue 1
-      fi
-
       if [ $patchsize -lt $fullsize -a "$f" != "removed-files" ]; then
         make_patch_instruction "$f" >> $manifest
         mv -f "$patchfile" "$workdir/$f.patch"

widget/src/windows/nsWindow.cpp

@@ -5173,8 +5173,9 @@ PRBool nsWindow::OnMouseWheel(UINT msg, WPARAM wParam, LPARAM lParam, PRBool& ge
 
   // The mousewheel event will be dispatched to the toplevel
   // window.  We need to give it to the child window
-  if (!HandleScrollingPlugins(msg, wParam, lParam, result))
-    return result; // return immediately if its not our window
+  PRBool quit;
+  if (!HandleScrollingPlugins(msg, wParam, lParam, result, aRetValue, quit))
+    return quit; // return immediately if its not our window
 
   // We should cancel the surplus delta if the current window is not
   // same as previous.
@@ -5907,13 +5908,16 @@ void nsWindow::OnSettingsChange(WPARAM wParam, LPARAM lParam)
 
 // Scrolling helper function for handling plugins.  
 // Return value indicates whether the calling function should handle this
-// result indicates whether this was handled at all
+// aHandled indicates whether this was handled at all
+// aQuitProcessing tells whether or not to continue processing the message
 PRBool nsWindow::HandleScrollingPlugins(UINT aMsg, WPARAM aWParam,
-                                        LPARAM aLParam, PRBool& aHandled)
+                                        LPARAM aLParam, PRBool& aHandled,
+                                        LRESULT* aRetValue,
+                                        PRBool& aQuitProcessing)
 {
   // The scroll event will be dispatched to the toplevel
   // window.  We need to give it to the child window
-  aHandled = PR_FALSE; // default is to have not handled
+  aQuitProcessing = PR_FALSE; // default is to not stop processing
   POINT point;
   DWORD dwPoints = ::GetMessagePos();
   point.x = GET_X_LPARAM(dwPoints);
@@ -5953,7 +5957,7 @@ PRBool nsWindow::HandleScrollingPlugins(UINT aMsg, WPARAM aWParam,
 
   if (!destWnd) {
     // No window is under the pointer
-    return PR_FALSE; // break
+    return PR_FALSE; // break, but continue processing
   }
   // We don't care about windows belonging to other processes.
   DWORD processId = 0;
@@ -5961,7 +5965,7 @@ PRBool nsWindow::HandleScrollingPlugins(UINT aMsg, WPARAM aWParam,
   if (processId != GetCurrentProcessId())
   {
     // Somebody elses window
-    return PR_FALSE; // break
+    return PR_FALSE; // break, but continue processing
   }
   nsWindow* destWindow = GetNSWindowPtr(destWnd);
   if (!destWindow || destWindow->mWindowType == eWindowType_plugin) {
@@ -5997,7 +6001,7 @@ PRBool nsWindow::HandleScrollingPlugins(UINT aMsg, WPARAM aWParam,
           destWnd = nsnull;
           mInScrollProcessing = PR_FALSE;
         }
-        return PR_FALSE; // break; // stop parent search
+        return PR_FALSE; // break, but continue processing
       }
       parentWnd = ::GetParent(parentWnd);
     } // while parentWnd
@@ -6006,10 +6010,9 @@ PRBool nsWindow::HandleScrollingPlugins(UINT aMsg, WPARAM aWParam,
     return PR_FALSE;
   if (destWnd != mWnd) {
     if (destWindow) {
-      LRESULT aRetValue;
-      destWindow->ProcessMessage(aMsg, aWParam, aLParam, &aRetValue);
-      aHandled = PR_TRUE;
-      return PR_FALSE; // return result immediately
+      aHandled = destWindow->ProcessMessage(aMsg, aWParam, aLParam, aRetValue);
+      aQuitProcessing = PR_TRUE;
+      return PR_FALSE; // break, and stop processing
     }
   #ifdef DEBUG
     else
@@ -6025,10 +6028,11 @@ PRBool nsWindow::OnScroll(UINT aMsg, WPARAM aWParam, LPARAM aLParam)
   {
     // Scroll message generated by Thinkpad Trackpoint Driver or similar
     // Treat as a mousewheel message and scroll appropriately
+    PRBool quit, result;
+    LRESULT retVal;
 
-    PRBool result;
-    if (!HandleScrollingPlugins(aMsg, aWParam, aLParam, result))
-      return result;  // Return if it's not our message or has been dispatched
+    if (!HandleScrollingPlugins(aMsg, aWParam, aLParam, result, &retVal, quit))
+      return quit;  // Return if it's not our message or has been dispatched
 
     nsMouseScrollEvent scrollevent(PR_TRUE, NS_MOUSE_SCROLL, this);
     scrollevent.scrollFlags = (aMsg == WM_VSCROLL) 

widget/src/windows/nsWindow.h

@@ -304,7 +304,9 @@ protected:
   static void             PostSleepWakeNotification(const char* aNotification);
   PRBool                  HandleScrollingPlugins(UINT aMsg, WPARAM aWParam, 
                                                  LPARAM aLParam,
-                                                 PRBool& aResult);
+                                                 PRBool& aResult,
+                                                 LRESULT* aRetValue,
+                                                 PRBool& aQuitProcessing);
 
   /**
    * Event handlers

widget/tests/TestWinTSF.cpp

@@ -47,6 +47,7 @@
  * test program to access and test every aspect of the Mozilla implementation.
  */
 
+#include <ole2.h>
 #include <msctf.h>
 #include <textstor.h>
 #include <richedit.h>
@@ -144,7 +145,7 @@ protected:
   PRBool TestContentEvents(void);
   PRBool TestEditMessages(void);
 
-  PRBool TestApp::TestSelectionInternal(char* aTestName,
+  PRBool TestSelectionInternal(char* aTestName,
                                         LONG aStart,
                                         LONG aEnd,
                                         TsActiveSelEnd aSelEnd);