Bump NSS (UXP) patch level.

Bug 2043887 - guard against integer overflow in CERT_Hexify.
Bug 2027353 - clamp input.len to testString size in pk11_mergeSecretKey.
2026-07-28 15:51:54 +02:00 · 2026-07-28 15:51:45 +02:00 · 2026-07-28 15:51:41 +02:00 · 2026-07-28 15:51:34 +02:00 · 2026-07-28 15:51:29 +02:00 · 2026-07-28 15:51:24 +02:00
765 changed files with 45608 additions and 3660 deletions
@@ -18,6 +18,10 @@
 #endif
 #include <gtk/gtk.h>

+#if (MOZ_WIDGET_GTK == 3)
+extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
+#endif
+
 using namespace mozilla;
 using namespace mozilla::a11y;

@@ -29,20 +33,12 @@ extern "C" {
 typedef GType (* AtkGetTypeType) (void);
 typedef void (*GnomeAccessibilityInit) (void);
 typedef void (*GnomeAccessibilityShutdown) (void);
-#if (MOZ_WIDGET_GTK == 3)
-typedef int (*AtkBridgeAdaptorInit) (int*, char***);
-#endif
 }

 static PRLibrary* sATKLib = nullptr;
 static const char sATKLibName[] = "libatk-1.0.so.0";
 static const char sATKHyperlinkImplGetTypeSymbol[] =
  "atk_hyperlink_impl_get_type";
-#if (MOZ_WIDGET_GTK == 3)
-static PRLibrary* sAtkBridgeAdaptorLib = nullptr;
-static const char sAtkBridgeAdaptorLibName[] = "libatk-bridge-2.0.so.0";
-static const char sAtkBridgeAdaptorInitSymbol[] = "atk_bridge_adaptor_init";
-#endif

 gboolean toplevel_event_watcher(GSignalInvocationHint*, guint, const GValue*,
                                gpointer);
@@ -131,38 +127,6 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
    return NS_OK;
 }

-#if (MOZ_WIDGET_GTK == 3)
-static bool
-InitAtkBridgeAdaptor()
-{
-  AtkBridgeAdaptorInit initBridge =
-    reinterpret_cast<AtkBridgeAdaptorInit>(
-      PR_FindFunctionSymbolAndLibrary(sAtkBridgeAdaptorInitSymbol,
-                                      &sAtkBridgeAdaptorLib));
-
-  if (!initBridge) {
-    sAtkBridgeAdaptorLib = PR_LoadLibrary(sAtkBridgeAdaptorLibName);
-    if (sAtkBridgeAdaptorLib) {
-      initBridge =
-        reinterpret_cast<AtkBridgeAdaptorInit>(
-          PR_FindFunctionSymbol(sAtkBridgeAdaptorLib,
-                                sAtkBridgeAdaptorInitSymbol));
-      if (!initBridge) {
-        PR_UnloadLibrary(sAtkBridgeAdaptorLib);
-        sAtkBridgeAdaptorLib = nullptr;
-      }
-    }
-  }
-
-  if (!initBridge) {
-    return false;
-  }
-
-  initBridge(nullptr, nullptr);
-  return true;
-}
-#endif
-
 void
 a11y::PlatformInit()
 {
@@ -217,7 +181,9 @@ a11y::PlatformInit()
  // Init atk-bridge now
  PR_SetEnv("NO_AT_BRIDGE=0");
 #if (MOZ_WIDGET_GTK == 3)
-  if (!InitAtkBridgeAdaptor())
+  if (atk_bridge_adaptor_init) {
+    atk_bridge_adaptor_init(nullptr, nullptr);
+  } else
 #endif
  {
    nsresult rv = LoadGtkModule(sAtkBridge);
@@ -262,13 +228,6 @@ a11y::PlatformShutdown()
        sAtkBridge.init = nullptr;
        sAtkBridge.shutdown = nullptr;
    }
-#if (MOZ_WIDGET_GTK == 3)
-    if (sAtkBridgeAdaptorLib) {
-        // Do not shutdown/unload atk-bridge; an exit function registered by
-        // the bridge will take care of it.
-        sAtkBridgeAdaptorLib = nullptr;
-    }
-#endif
 #if (MOZ_WIDGET_GTK == 2)
    if (sGail.lib) {
        // Do not shutdown gail because
@@ -43,6 +43,8 @@ gyp_vars.update({
    'arm_neon': 0,
    'arm_neon_optional': 1,

+    'moz_webrtc_omx': 0,
+    'moz_webrtc_mediacodec': 0,

    # Turn off multi monitor screen share
    'multi_monitor_screenshare%' : 0,
@@ -344,7 +344,7 @@ def split_triplet(triplet):
    if cpu.endswith('86') or (cpu.startswith('i') and '86' in cpu):
        canonical_cpu = 'x86'
        endianness = 'little'
-    elif cpu == 'x86_64':
+    elif cpu in ('x86_64', 'ia64'):
        canonical_cpu = cpu
        endianness = 'little'
    elif cpu in ('s390', 's390x'):
@@ -164,7 +164,6 @@ def old_configure_options(*options):
    '--enable-negotiateauth',
    '--enable-nfc',
    '--enable-npapi',
-    '--enable-npapi-gtk2',
    '--enable-nspr-build',
    '--enable-official-branding',
    '--enable-official-vendor',
@@ -290,6 +290,11 @@ fi
 if [ -n "$LD_LIBRARY_PATH_64" ]; then
 	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64:+":$LD_LIBRARY_PATH_64"}
 fi
+#
+#
+## Set SHLIB_PATH for HPUX
+SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH:+":$SHLIB_PATH"}
+#
 ## Set LIBPATH for AIX
 LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH:+":$LIBPATH"}
 #
@@ -334,6 +339,7 @@ then
  fi
  echo "DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH"
  echo "     LIBRARY_PATH=$LIBRARY_PATH"
+  echo "       SHLIB_PATH=$SHLIB_PATH"
  echo "          LIBPATH=$LIBPATH"
  echo "       ADDON_PATH=$ADDON_PATH"
  echo "      MOZ_PROGRAM=$MOZ_PROGRAM"
@@ -344,7 +350,7 @@ then
 fi
 #
 export MOZILLA_FIVE_HOME LD_LIBRARY_PATH
-export LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH
+export SHLIB_PATH LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH

 if [ $moz_debug -eq 1 ]
 then
@@ -448,6 +448,7 @@ gtk/gtkx.h
 gtk/gtkunixprint.h
 HIToolbox/HIToolbox.h
 hlink.h
+ia64/sys/inline.h
 Icons.h
 iconv.h
 ieeefp.h
@@ -143,8 +143,7 @@ TooltipsOverlay.prototype = {
    // Font preview tooltip
    if (type === VIEW_NODE_VALUE_TYPE && prop.property === "font-family") {
      let value = prop.value.toLowerCase();
-      if (value !== "inherit" && value !== "unset" && value !== "initial" &&
-          value !== "revert" && value !== "revert-layer") {
+      if (value !== "inherit" && value !== "unset" && value !== "initial" && value !== "revert") {
        tooltipType = TOOLTIP_FONTFAMILY_TYPE;
      }
    }
@@ -204,22 +204,21 @@ function initialHTML(doc) {
    os = "linux";
  }

-  // The appRoot URI is prepended to all URIs instead of using a <base> element
-  // because the latter can cause spurious network requests (UXP Issue #3122)
-  let appRoot = "resource://devtools/client/jsonview/";
+  let base = doc.createElement("base");
+  base.href = "resource://devtools/client/jsonview/";

  let style = doc.createElement("link");
  style.rel = "stylesheet";
  style.type = "text/css";
-  style.href = appRoot +"css/main.css";
+  style.href = base.href +"css/main.css";

  let script = doc.createElement("script");
-  script.src = appRoot + "lib/require.js";
-  script.dataset.main = appRoot + "viewer-config.js";
+  script.src = base.href + "lib/require.js";
+  script.dataset.main = "viewer-config";
  script.defer = true;

  let head = doc.createElement("head");
-  head.append(style, script);
+  head.append(base, style, script);

  return "<!DOCTYPE html>\n" +
    startTag("html", {
@@ -4,8 +4,6 @@ subsuite = devtools
 support-files =
  array_json.json
  array_json.json^headers^
-  csp_json.json
-  csp_json.json^headers^
  doc_frame_script.js
  head.js
  invalid_json.json
@@ -24,7 +22,6 @@ subsuite = clipboard
 subsuite = clipboard
 [browser_jsonview_copy_rawdata.js]
 subsuite = clipboard
-[browser_jsonview_csp_json.js]
 [browser_jsonview_filter.js]
 [browser_jsonview_invalid_json.js]
 [browser_jsonview_valid_json.js]
@@ -1,17 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/ */
-
-"use strict";
-
-const TEST_JSON_URL = URL_ROOT + "csp_json.json";
-
-add_task(function* () {
-  info("Test CSP JSON started");
-
-  yield addJsonViewTab(TEST_JSON_URL);
-
-  let count = yield getElementCount(".jsonPanelBox .treeTable .treeRow");
-  is(count, 1, "There must be one row");
-});
@@ -1 +0,0 @@
-{"csp": true}
@@ -1,2 +0,0 @@
-Content-Type: application/json
-Content-Security-Policy: default-src 'none'; base-uri 'none';
@@ -23,7 +23,7 @@
 * of the code base, so it's consistent and modules can be easily reused.
 */
 require.config({
-  baseUrl: "resource://devtools/client/jsonview/",
+  baseUrl: ".",
  paths: {
    "devtools/client/shared": "resource://devtools/client/shared",
    "devtools/shared": "resource://devtools/shared",
@@ -10,8 +10,7 @@ const SPECIALVALUES = new Set([
  "initial",
  "inherit",
  "unset",
-  "revert",
-  "revert-layer"
+  "revert"
 ]);

 const {getCSSLexer} = require("devtools/shared/css/lexer");
@@ -99,14 +99,7 @@ const filterList = [
 ];

 // Valid values that shouldn't be parsed for filters.
-const SPECIAL_VALUES = new Set([
-  "none",
-  "unset",
-  "initial",
-  "inherit",
-  "revert",
-  "revert-layer"
-]);
+const SPECIAL_VALUES = new Set(["none", "unset", "initial", "inherit", "revert"]);

 /**
 * A CSS Filter editor widget used to add/remove/modify
@@ -20,8 +20,7 @@ const SPECIALVALUES = new Set([
  "inherit",
  "transparent",
  "unset",
-  "revert",
-  "revert-layer"
+  "revert"
 ]);

 /**
@@ -43,7 +43,7 @@ class MachCommands(MachCommandBase):
        if not os.path.exists(generated_dir):
            generated_dir = mozpath.join(self.topsrcdir, 'platform',
                'devtools/shared/css/generated')
-        if not os.path.exists(generated_dir):
+        else:
            raise Exception('Directory expected at %s does not exist.' % generated_dir)
        self.generated_dir = generated_dir

@@ -75,9 +75,6 @@ class MachCommands(MachCommandBase):
        contents = subprocess.check_output([xpcshell_path, '-g', gre_path,
                                            '-a', browser_path, script_path],
                                           env = sub_env)
-        if not isinstance(contents, str):
-            contents = contents.decode('utf-8')
-
        # Extract just the output between the delimiters as the xpcshell output can
        # have extra output that we don't want.
        contents = contents.split('DEVTOOLS_CSS_DB_DELIMITER')[1]
@@ -91,13 +88,13 @@ class MachCommands(MachCommandBase):
        destination_path = mozpath.join(self.generated_dir,
            'properties-db.js')

-        with open(js_template_path, 'r') as handle:
+        with open(js_template_path, 'rb') as handle:
            js_template = handle.read()

        preamble = '/* THIS IS AN AUTOGENERATED FILE.  DO NOT EDIT */\n\n'
        contents = string.Template(js_template).substitute(substitutions)

-        with open(destination_path, 'w') as destination:
+        with open(destination_path, 'wb') as destination:
            destination.write(preamble + contents)

        print(('The database was successfully generated at ' + destination_path))
@@ -274,7 +274,7 @@ public:
    }

    template<typename T,
-             typename = typename std::enable_if_t<std::is_enum_v<T>>>
+             typename = typename std::enable_if<std::is_enum<T>::value>::type>
    EnumTable(const char* aTag, T aValue)
      : tag(aTag)
      , value(static_cast<int16_t>(aValue))
@@ -97,7 +97,7 @@ ToJSValue(JSContext* aCx,
  return true;
 }

-// accept floating point types
+// Accept floating point types
 inline bool
 ToJSValue(JSContext* aCx,
          float aArgument,
@@ -106,7 +106,7 @@ ToJSValue(JSContext* aCx,
  // Make sure we're called in a compartment
  MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));

-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(double(aArgument)));
  return true;
 }

@@ -876,20 +876,12 @@ HTMLImageElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
  return HTMLImageElementBinding::Wrap(aCx, this, aGivenProto);
 }

-#ifdef DEBUG
-nsIDOMHTMLFormElement*
-HTMLImageElement::GetForm() const
-{
-  return mForm;
-}
-#endif
-
 void
 HTMLImageElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  NS_ASSERTION(!mForm,
-               "We don't support switching from one non-null form to another.");
+  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
+             "We don't support switching from one non-null form to another.");

  mForm = static_cast<HTMLFormElement*>(aForm);
 }
@@ -216,9 +216,8 @@ public:
    SetHTMLAttr(nsGkAtoms::lowsrc, aLowsrc, aError);
  }

-#ifdef DEBUG
-  nsIDOMHTMLFormElement* GetForm() const;
-#endif
+  HTMLFormElement* GetForm() const { return mForm; };
+
  void SetForm(nsIDOMHTMLFormElement* aForm);
  void ClearForm(bool aRemoveFromForm);

@@ -1824,8 +1824,8 @@ void
 nsGenericHTMLFormElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  NS_ASSERTION(!mForm,
-               "We don't support switching from one non-null form to another.");
+  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
+             "We don't support switching from one non-null form to another.");

  // keep a *weak* ref to the form here
  mForm = static_cast<HTMLFormElement*>(aForm);
@@ -367,12 +367,13 @@ public:
  {
  }

+  static const uint32_t MIN_RATE = 8000;
  static const uint32_t MAX_RATE = 640000;

  bool IsValid() const override
  {
    return mChannels > 0 && mChannels <= MAX_AUDIO_CHANNELS
-           && mRate > 0 && mRate <= MAX_RATE;
+           && mRate >= MIN_RATE && mRate <= MAX_RATE;
  }

  AudioInfo* GetAsAudioInfo() override
@@ -179,12 +179,18 @@ IsValidVideoRegion(const nsIntSize& aFrame, const nsIntRect& aPicture,
    aFrame.height <= PlanarYCbCrImage::MAX_DIMENSION &&
    aFrame.width * aFrame.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aFrame.width * aFrame.height != 0 &&
+    aPicture.width > 0 &&
    aPicture.width <= PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.x >= 0 &&
    aPicture.x < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.x + aPicture.width < PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.XMost() <= aFrame.width &&
+    aPicture.height > 0 &&
    aPicture.height <= PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.y >= 0 &&
    aPicture.y < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.y + aPicture.height < PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.YMost() <= aFrame.height &&
    aPicture.width * aPicture.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aPicture.width * aPicture.height != 0 &&
    aDisplay.width <= PlanarYCbCrImage::MAX_DIMENSION &&
@@ -439,7 +439,7 @@ private:
    Maybe<size_t> mInitOffset;
    Maybe<size_t> mMediaOffset;
    bool mValid = true;
-    char mLastInvalidBox[5];
+    char mLastInvalidBox[5]{};
  };

 public:
@@ -20,6 +20,7 @@
 #include "WebMBufferedParser.h"
 #include "gfx2DGlue.h"
 #include "mozilla/Atomics.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/SharedThreadPool.h"
@@ -352,19 +353,27 @@ WebMDemuxer::ReadMetadata()
          mInfo.mVideo.mExtraData = new MediaByteBuffer(length);
          mInfo.mVideo.mExtraData->AppendElements(data, length);
          break;
-	}
+        }
        default:
          NS_WARNING("Unknown WebM video codec");
          return NS_ERROR_FAILURE;
      }
      // Picture region, taking into account cropping, before scaling
      // to the display size.
-      unsigned int cropH = params.crop_right + params.crop_left;
-      unsigned int cropV = params.crop_bottom + params.crop_top;
+      CheckedInt<uint32_t> cropH = CheckedInt<uint32_t>(params.crop_left) + params.crop_right;
+      CheckedInt<uint32_t> cropV = CheckedInt<uint32_t>(params.crop_top) + params.crop_bottom;
+      if (!cropH.isValid() || !cropV.isValid() ||
+          cropH.value() >= params.width || cropV.value() >= params.height) {
+        WEBM_DEBUG("Invalid crop values left: {} right: {} top: {} bottom: {}",
+                   params.crop_left, params.crop_right, params.crop_top,
+                   params.crop_bottom);
+        // Ignore invalid crop parameters.
+        continue;
+      }
      nsIntRect pictureRect(params.crop_left,
                            params.crop_top,
-                            params.width - cropH,
-                            params.height - cropV);
+                            params.width - cropH.value(),
+                            params.height - cropV.value());

      // If the cropping data appears invalid then use the frame data
      if (pictureRect.width <= 0 ||
@@ -29,7 +29,8 @@ enum {
 * Abstract interface for managing audio and video devices. Each platform
 * must implement a concrete class that will map these classes and methods
 * to the appropriate backend. For example, on Desktop platforms, these will
- * correspond to equivalent webrtc (GIPS) calls.
+ * correspond to equivalent webrtc (GIPS) calls, and on B2G they will map to
+ * a Gonk interface.
 */
 class MediaEngineVideoSource;
 class MediaEngineAudioSource;
@@ -301,6 +302,7 @@ public:

  /* If implementation of MediaEngineSource supports TakePhoto(), the picture
   * should be return via aCallback object. Otherwise, it returns NS_ERROR_NOT_IMPLEMENTED.
+   * Currently, only Gonk MediaEngineSource implementation supports it.
   */
  virtual nsresult TakePhoto(MediaEnginePhotoCallback* aCallback) = 0;

@@ -36,8 +36,8 @@ bool MediaEngineCameraVideoSource::AppendToTrack(SourceMediaStream* aSource,
  return aSource->AppendToTrack(aID, &(segment));
 }

-// Subclasses should overload one or both of these methods to provide
-// capabilities.
+// Sub-classes (B2G or desktop) should overload one of both of these two methods
+// to provide capabilities
 size_t
 MediaEngineCameraVideoSource::NumCapabilities() const
 {
@@ -324,6 +324,21 @@ MediaEngineCameraVideoSource::SetName(nsString aName)
  bool hasFacingMode = false;
  VideoFacingModeEnum facingMode = VideoFacingModeEnum::User;

+  // Set facing mode based on device name.
+#if defined(ANDROID)
+  // Names are generated. Example: "Camera 0, Facing back, Orientation 90"
+  //
+  // See media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/
+  // webrtc/videoengine/VideoCaptureDeviceInfoAndroid.java
+
+  if (aName.Find(NS_LITERAL_STRING("Facing back")) != kNotFound) {
+    hasFacingMode = true;
+    facingMode = VideoFacingModeEnum::Environment;
+  } else if (aName.Find(NS_LITERAL_STRING("Facing front")) != kNotFound) {
+    hasFacingMode = true;
+    facingMode = VideoFacingModeEnum::User;
+  }
+#endif // ANDROID
 #ifdef XP_MACOSX
  // Kludge to test user-facing cameras on OSX.
  if (aName.Find(NS_LITERAL_STRING("Face")) != -1) {
@@ -108,7 +108,7 @@ protected:
  nsTArray<PrincipalHandle> mPrincipalHandles; // Directly mapped to mSources.
  RefPtr<layers::Image> mImage;
  RefPtr<layers::ImageContainer> mImageContainer;
-  int mWidth, mHeight; // protected with mMonitor
+  int mWidth, mHeight; // protected with mMonitor on Gonk due to different threading
  // end of data protected by mMonitor


@@ -15,7 +15,7 @@
 #ifdef FF
 #undef FF
 #endif
-#include "SingleRwFifo.h"
+#include "webrtc/modules/audio_device/opensl/single_rw_fifo.h"

 #define CHANNELS 1
 #define ENCODING "L16"
@@ -1,99 +0,0 @@
-/*
- *  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
- *
- *  Use of this source code is governed by a BSD-style license
- *  that can be found in the LICENSE file in the root of the source
- *  tree. An additional intellectual property rights grant can be found
- *  in the file PATENTS.  All contributing project authors may
- *  be found in the AUTHORS file in the root of the source tree.
- */
-
-#include "SingleRwFifo.h"
-
-#include <assert.h>
-
-#if defined(_MSC_VER)
-#include <windows.h>
-#endif
-
-static int
-UpdatePos(int pos, int capacity)
-{
-  return (pos + 1) % capacity;
-}
-
-namespace webrtc {
-
-namespace subtle {
-
-#if defined(_MSC_VER)
-inline void
-MemoryBarrier()
-{
-  ::MemoryBarrier();
-}
-#elif defined(__GNUC__) || defined(__clang__)
-inline void
-MemoryBarrier()
-{
-  __sync_synchronize();
-}
-#else
-#error Add an implementation of MemoryBarrier() for this platform!
-#endif
-
-}  // namespace subtle
-
-SingleRwFifo::SingleRwFifo(int capacity)
-  : capacity_(capacity)
-  , size_(0)
-  , read_pos_(0)
-  , write_pos_(0)
-{
-  queue_.reset(new int8_t*[capacity_]);
-}
-
-SingleRwFifo::~SingleRwFifo()
-{
-}
-
-void
-SingleRwFifo::Push(int8_t* mem)
-{
-  assert(mem);
-
-  // Ensure that there is space for the new data in the FIFO. There is only one
-  // writer, so the other thread is guaranteed only to decrease the size.
-  const int free_slots = capacity() - size();
-  if (free_slots <= 0) {
-    // Size can be queried outside of Push. The caller is expected to ensure
-    // that Push will be successful before calling it.
-    assert(false);
-    return;
-  }
-  queue_[write_pos_] = mem;
-  // Ensure that |size_| is updated after the stored pointer is visible.
-  subtle::MemoryBarrier();
-  ++size_;
-  write_pos_ = UpdatePos(write_pos_, capacity());
-}
-
-int8_t*
-SingleRwFifo::Pop()
-{
-  int8_t* ret_val = nullptr;
-  if (size() <= 0) {
-    // Size can be queried outside of Pop. The caller is expected to ensure
-    // that Pop will be successful before calling it.
-    assert(false);
-    return ret_val;
-  }
-  ret_val = queue_[read_pos_];
-  // Ensure that |size_| is updated after the stored pointer is read.
-  subtle::MemoryBarrier();
-  --size_;
-  read_pos_ = UpdatePos(read_pos_, capacity());
-  return ret_val;
-}
-
-}  // namespace webrtc
@@ -38,7 +38,6 @@ if CONFIG['MOZ_WEBRTC']:
    # MediaEngineWebRTC.cpp needs to be built separately.
    SOURCES += [
        'MediaEngineWebRTC.cpp',
-        'SingleRwFifo.cpp',
    ]
    LOCAL_INCLUDES += [
        '/dom/base',
@@ -69,7 +68,8 @@ include('/ipc/chromium/chromium-config.mozbuild')

 # Suppress some GCC/clang warnings being treated as errors:
 #  - about attributes on forward declarations for types that are already
-#    defined, which complains about important MOZ_EXPORT attributes.
+#    defined, which complains about important MOZ_EXPORT attributes for
+#    android API types
 if CONFIG['GNU_CC'] or CONFIG['CLANG_CL']:
    CXXFLAGS += [
        '-Wno-error=attributes',
@@ -194,7 +194,7 @@ static void FreeStringArray(uint32_t variants, char ** array)

 static bool CanLoadPlugin(char16ptr_t aBinaryPath)
 {
-#if defined(_M_IX86) || defined(_M_X64)
+#if defined(_M_IX86) || defined(_M_X64) || defined(_M_IA64)
  bool canLoad = false;

  HANDLE file = CreateFileW(aBinaryPath, GENERIC_READ,
@@ -214,6 +214,8 @@ static bool CanLoadPlugin(char16ptr_t aBinaryPath)
            canLoad = (arch == IMAGE_FILE_MACHINE_I386);
 #elif defined(_M_X64)
            canLoad = (arch == IMAGE_FILE_MACHINE_AMD64);
+#elif defined(_M_IA64)
+            canLoad = (arch == IMAGE_FILE_MACHINE_IA64);
 #endif
          }
        }
@@ -55,12 +55,7 @@ using namespace std;
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
-#if (GTK_MAJOR_VERSION == 3)
-#include <gtk/gtkx.h>
-#endif
-#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
-#endif

 #elif defined(OS_WIN)

@@ -213,9 +208,7 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
    memset(&mWsInfo, 0, sizeof(mWsInfo));
 #ifdef MOZ_WIDGET_GTK
    mWsInfo.display = nullptr;
-#ifdef MOZ_ENABLE_NPAPI_GTK2
    mXtClient.top_widget = nullptr;
-#endif
 #else
    mWsInfo.display = DefaultXDisplay();
 #endif
@@ -627,17 +620,15 @@ PluginInstanceChild::NPN_SetValue(NPPVariable aVar, void* aValue)
        NPWindowType newWindowType = windowed ? NPWindowTypeWindow : NPWindowTypeDrawable;
 #ifdef MOZ_WIDGET_GTK
        if (mWindow.type != newWindowType && mWsInfo.display) {
-            // plugin type has been changed but we already have a valid display
-            // so update it for the recent plugin mode
-#ifdef MOZ_ENABLE_NPAPI_GTK2
-            if (!mXEmbed && windowed) {
-                mWsInfo.display = xt_client_get_display();
-            } else
-#endif
-            {
-                // Use default GTK display for XEmbed and windowless plugins.
-                mWsInfo.display = DefaultXDisplay();
-            }
+           // plugin type has been changed but we already have a valid display
+           // so update it for the recent plugin mode
+           if (mXEmbed || !windowed) {
+               // Use default GTK display for XEmbed and windowless plugins
+               mWsInfo.display = DefaultXDisplay();
+           }
+           else {
+               mWsInfo.display = xt_client_get_display();
+           }
        }
 #endif
        mWindow.type = newWindowType;
@@ -1223,18 +1214,12 @@ bool PluginInstanceChild::CreateWindow(const NPRemoteWindow& aWindow)
    if (mXEmbed) {
        mWindow.window = reinterpret_cast<void*>(aWindow.window);
    }
-#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        Window browserSocket = (Window)(aWindow.window);
        xt_client_init(&mXtClient, mWsInfo.visual, mWsInfo.colormap, mWsInfo.depth);
        xt_client_create(&mXtClient, browserSocket, mWindow.width, mWindow.height); 
        mWindow.window = (void *)XtWindow(mXtClient.child_widget);
-    }
-#else
-    else {
-        mWindow.window = reinterpret_cast<void*>(aWindow.window);
-    }
-#endif
+    }  
 #else
    mWindow.window = reinterpret_cast<void*>(aWindow.window);
 #endif
@@ -1254,7 +1239,7 @@ void PluginInstanceChild::DeleteWindow()
  if (!mWindow.window)
      return;

-#ifdef MOZ_ENABLE_NPAPI_GTK2
+#ifdef MOZ_WIDGET_GTK
  if (mXtClient.top_widget) {     
      xt_client_unrealize(&mXtClient);
      xt_client_destroy(&mXtClient); 
@@ -1336,7 +1321,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
        CreateWindow(aWindow);
    }

-#ifdef MOZ_ENABLE_NPAPI_GTK2
+#ifdef MOZ_WIDGET_GTK
    if (mXEmbed && gtk_check_version(2,18,7) != nullptr) { // older
        if (aWindow.type == NPWindowTypeWindow) {
            GdkWindow* socket_window = gdk_window_lookup(static_cast<GdkNativeWindow>(aWindow.window));
@@ -1471,27 +1456,19 @@ PluginInstanceChild::Initialize()
    if (mWindow.type == NPWindowTypeWindow) {
        AnswerNPP_GetValue_NPPVpluginNeedsXEmbed(&mXEmbed, &rv);

-#ifdef MOZ_ENABLE_NPAPI_GTK2
        // Set up Xt loop for windowed plugins without XEmbed support
        if (!mXEmbed) {
           xt_client_xloop_create();
        }
-#endif
    }

-    // Use default GTK display for XEmbed and windowless plugins.
+    // Use default GTK display for XEmbed and windowless plugins
    if (mXEmbed || mWindow.type != NPWindowTypeWindow) {
        mWsInfo.display = DefaultXDisplay();
    }
-#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        mWsInfo.display = xt_client_get_display();
    }
-#else
-    else {
-        mWsInfo.display = DefaultXDisplay();
-    }
-#endif
 #endif 

    return true;
@@ -4679,7 +4656,7 @@ PluginInstanceChild::Destroy()

    mPendingAsyncCalls.Clear();
    
-#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
+#ifdef MOZ_WIDGET_GTK
    if (mWindow.type == NPWindowTypeWindow && !mXEmbed) {
      xt_client_xloop_destroy();
    }
@@ -36,7 +36,7 @@

 #include <map>

-#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
+#ifdef MOZ_WIDGET_GTK
 #include "gtk2xtbin.h"
 #endif

@@ -462,8 +462,6 @@ private:
    NPSetWindowCallbackStruct mWsInfo;
 #ifdef MOZ_WIDGET_GTK
    bool mXEmbed;
-#endif
-#ifdef MOZ_ENABLE_NPAPI_GTK2
    XtClient mXtClient;
 #endif
 #elif defined(OS_WIN)
@@ -12,9 +12,6 @@

 #ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
-#if (GTK_MAJOR_VERSION == 3)
-#include <gtk/gtkx.h>
-#endif
 #endif

 #include "nsIFile.h"
@@ -1104,11 +1101,7 @@ _getvalue(NPP aNPP,
                return InstCast(aNPP)->NPN_GetValue(aVariable, aValue);
            } 
            else {
-#ifdef MOZ_ENABLE_NPAPI_GTK2
                *(void **)aValue = xt_client_get_display();
-#else
-                *(void **)aValue = DefaultXDisplay();
-#endif
            }          
            return NPERR_NO_ERROR;
        }
@@ -143,13 +143,11 @@ LOCAL_INCLUDES += [

 DEFINES['FORCE_PR_LOG'] = True

-if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk3' and
-        CONFIG['MOZ_ENABLE_NPAPI'] and
-        CONFIG['MOZ_ENABLE_NPAPI_GTK2']):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gtk3':
+    CXXFLAGS += CONFIG['TK_CFLAGS']
+else:
    # Force build against gtk+2 for struct offsets and such.
    CXXFLAGS += CONFIG['MOZ_GTK2_CFLAGS']
-else:
-    CXXFLAGS += CONFIG['TK_CFLAGS']

 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

@@ -301,7 +301,6 @@ LoadContextOptions(const char* aPrefName, void* /* aClosure */)
                .setAsyncStack(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asyncstack")))
                .setWerror(GetWorkerPref<bool>(NS_LITERAL_CSTRING("werror")))
                .setStreams(GetWorkerPref<bool>(NS_LITERAL_CSTRING("streams")))
-                .setWeakRefs(GetWorkerPref<bool>(NS_LITERAL_CSTRING("weakrefs")))
                .setExtraWarnings(GetWorkerPref<bool>(NS_LITERAL_CSTRING("strict")))
                .setArrayProtoValues(GetWorkerPref<bool>(
                      NS_LITERAL_CSTRING("array_prototype_values")));
@@ -35,7 +35,6 @@ WORKER_SIMPLE_PREF("dom.serviceWorkers.openWindow.enabled", OpenWindowEnabled, O
 WORKER_SIMPLE_PREF("dom.storageManager.enabled", StorageManagerEnabled, STORAGEMANAGER_ENABLED)
 WORKER_SIMPLE_PREF("dom.push.enabled", PushEnabled, PUSH_ENABLED)
 WORKER_SIMPLE_PREF("dom.streams.enabled", StreamsEnabled, STREAMS_ENABLED)
-WORKER_SIMPLE_PREF("javascript.options.weakrefs", WeakRefsEnabled, WEAKREFS_ENABLED)
 WORKER_SIMPLE_PREF("dom.requestcontext.enabled", RequestContextEnabled, REQUESTCONTEXT_ENABLED)
 WORKER_SIMPLE_PREF("gfx.offscreencanvas.enabled", OffscreenCanvasEnabled, OFFSCREENCANVAS_ENABLED)
 WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPickerEnabled, DOM_WEBKITBLINK_DIRPICKER_WEBKITBLINK)
@@ -1117,7 +1117,6 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                        kCGImageAlphaOnly :
                        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host;

-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
  mCG = CGBitmapContextCreateWithData(mCanvasData,
                                      mCGSize.width,
                                      mCGSize.height,
@@ -1127,15 +1126,6 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                                      bitmapInfo,
                                      NULL, /* Callback when released */
                                      NULL);
-#else
-  mCG = CGBitmapContextCreate(mCanvasData,
-                              mCGSize.width,
-                              mCGSize.height,
-                              8, /* bits per component */
-                              stride,
-                              mColorSpace,
-                              bitmapInfo);
-#endif
  if (!mCG) {
    ReleaseBits(mCanvasData);
    NS_WARNING("Could not create bitmap around skia data\n");
@@ -115,7 +115,7 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
  return ScaledFontBase::GetPathForGlyphs(aBuffer, aTarget);
 }

-#ifndef USE_SKIA
+#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
 void
 ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
 {
@@ -32,7 +32,7 @@ public:
  virtual SkTypeface* GetSkTypeface();
 #endif
  virtual already_AddRefed<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-#ifndef USE_SKIA
+#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
 #endif
  virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);
@@ -24,21 +24,15 @@
 *  Skia's 32bit backend only supports 1 sizzle order at a time (compile-time).
 *  This is specified by 4 defines SK_A32_SHIFT, SK_R32_SHIFT, ... for G and B.
 *
- *  For easier compatibility with Skia's GPU backend, Skia normally restricts
- *  these to either (in memory-byte-order) RGBA or BGRA. Mozilla's big-endian
- *  PowerPC port uses CoreGraphics' native ARGB pixels, so we also accept ARGB.
- *  Note that this "order" does not directly correspond to the same shift-order,
- *  since we have to take endianess into account.
+ *  For easier compatibility with Skia's GPU backend, we further restrict these
+ *  to either (in memory-byte-order) RGBA or BGRA. Note that this "order" does
+ *  not directly correspond to the same shift-order, since we have to take endianess
+ *  into account.
 *
 *  Here we enforce this constraint.
 */

 #ifdef SK_CPU_BENDIAN
-    #define SK_ARGB_A32_SHIFT   24
-    #define SK_ARGB_R32_SHIFT   16
-    #define SK_ARGB_G32_SHIFT   8
-    #define SK_ARGB_B32_SHIFT   0
-
    #define SK_RGBA_R32_SHIFT   24
    #define SK_RGBA_G32_SHIFT   16
    #define SK_RGBA_B32_SHIFT   8
@@ -49,11 +43,6 @@
    #define SK_BGRA_R32_SHIFT   8
    #define SK_BGRA_A32_SHIFT   0
 #else
-    #define SK_ARGB_A32_SHIFT   0
-    #define SK_ARGB_R32_SHIFT   8
-    #define SK_ARGB_G32_SHIFT   16
-    #define SK_ARGB_B32_SHIFT   24
-
    #define SK_RGBA_R32_SHIFT   0
    #define SK_RGBA_G32_SHIFT   8
    #define SK_RGBA_B32_SHIFT   16
@@ -65,18 +54,10 @@
    #define SK_BGRA_A32_SHIFT   24
 #endif

-#if (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)) || \
-    (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_ARGB)) || \
-    (defined(SK_PMCOLOR_IS_BGRA) && defined(SK_PMCOLOR_IS_ARGB))
-    #error "can't define PMCOLOR to more than one byte order"
+#if defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)
+    #error "can't define PMCOLOR to be RGBA and BGRA"
 #endif

-#define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB  \
-    (SK_A32_SHIFT == SK_ARGB_A32_SHIFT &&    \
-     SK_R32_SHIFT == SK_ARGB_R32_SHIFT &&    \
-     SK_G32_SHIFT == SK_ARGB_G32_SHIFT &&    \
-     SK_B32_SHIFT == SK_ARGB_B32_SHIFT)
-
 #define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA  \
    (SK_A32_SHIFT == SK_RGBA_A32_SHIFT &&    \
     SK_R32_SHIFT == SK_RGBA_R32_SHIFT &&    \
@@ -95,10 +76,6 @@
 #define SK_G_INDEX  (SK_G32_SHIFT/8)
 #define SK_B_INDEX  (SK_B32_SHIFT/8)

-#if defined(SK_PMCOLOR_IS_ARGB) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
-    #error "SK_PMCOLOR_IS_ARGB does not match SK_*32_SHIFT values"
-#endif
-
 #if defined(SK_PMCOLOR_IS_RGBA) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
    #error "SK_PMCOLOR_IS_RGBA does not match SK_*32_SHIFT values"
 #endif
@@ -107,22 +84,19 @@
    #error "SK_PMCOLOR_IS_BGRA does not match SK_*32_SHIFT values"
 #endif

-#if !defined(SK_PMCOLOR_IS_ARGB) && !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
+#if !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
    // deduce which to define from the _SHIFT defines

-    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
-        #define SK_PMCOLOR_IS_ARGB
-    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
+    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
        #define SK_PMCOLOR_IS_RGBA
    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
        #define SK_PMCOLOR_IS_BGRA
    #else
-        #error "need 32bit packing to be either ARGB, RGBA, or BGRA"
+        #error "need 32bit packing to be either RGBA or BGRA"
    #endif
 #endif

 // hide these now that we're done
-#undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA

@@ -157,38 +131,19 @@ static inline uint32_t SkPackARGB_as_BGRA(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
           (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
 }

-static inline SkPMColor SkPackARGB_as_PMColor(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    SkASSERT_IS_BYTE(a);
-    SkASSERT_IS_BYTE(r);
-    SkASSERT_IS_BYTE(g);
-    SkASSERT_IS_BYTE(b);
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
-}
-
 static inline SkPMColor SkSwizzle_RGBA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_RGBA
    return c;
-#elif defined(SK_PMCOLOR_IS_BGRA)
-    return SkSwizzle_RB(c);
 #else
-    return SkPackARGB_as_PMColor((c >> SK_RGBA_A32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_R32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_G32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_B32_SHIFT) & 0xFF);
+    return SkSwizzle_RB(c);
 #endif
 }

 static inline SkPMColor SkSwizzle_BGRA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_BGRA
    return c;
-#elif defined(SK_PMCOLOR_IS_RGBA)
-    return SkSwizzle_RB(c);
 #else
-    return SkPackARGB_as_PMColor((c >> SK_BGRA_A32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_R32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_G32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_B32_SHIFT) & 0xFF);
+    return SkSwizzle_RB(c);
 #endif
 }

@@ -457,7 +412,8 @@ static inline SkPMColor SkPackARGB32(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
    SkASSERT(g <= a);
    SkASSERT(b <= a);

-    return SkPackARGB_as_PMColor(a, r, g, b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
 }

 static inline uint32_t SkPackPMColor_as_RGBA(SkPMColor c) {
@@ -591,7 +547,8 @@ static inline SkPMColor SkFastFourByteInterp(SkPMColor src,
 *  values are premultiplied in the debug version.
 */
 static inline SkPMColor SkPackARGB32NoCheck(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    return SkPackARGB_as_PMColor(a, r, g, b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
 }

 static inline
@@ -82,13 +82,8 @@ enum SkColorType {
    kN32_SkColorType = kBGRA_8888_SkColorType,
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    kN32_SkColorType = kRGBA_8888_SkColorType,
-#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
-    // Big-endian PowerPC Mozilla surfaces use native uint32 ARGB memory.
-    // Moz2D's legacy A8R8G8B8_UINT32 format aliases to B8G8R8A8, so keep
-    // kN32 on Skia's BGRA path while the channel shifts above describe ARGB.
-    kN32_SkColorType = kBGRA_8888_SkColorType,
 #else
-    #error "SK_*32_SHIFT values must correspond to BGRA, RGBA, or Mozilla ARGB byte order"
+    #error "SK_*32_SHFIT values must correspond to BGRA or RGBA byte order"
 #endif
 };

@@ -275,19 +275,17 @@ enum GrPixelConfig {
 static const int kGrPixelConfigCnt = kLast_GrPixelConfig + 1;

 // Aliases for pixel configs that match skia's byte order.
+#ifndef SK_CPU_LENDIAN
+    #error "Skia gpu currently assumes little endian"
+#endif
 #if SK_PMCOLOR_BYTE_ORDER(B,G,R,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kRGBA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSRGBA_8888_GrPixelConfig;
-#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
-    // Mozilla's big-endian PowerPC path stores native 32-bit pixels as ARGB,
-    // while Moz2D routes those surfaces through Skia's BGRA color type.
-    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
-    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #else
-    #error "SK_*32_SHIFT values must correspond to GL_BGRA, GL_RGBA, or Mozilla ARGB format."
+    #error "SK_*32_SHIFT values must correspond to GL_BGRA or GL_RGBA format."
 #endif

 // Returns true if the pixel config is a GPU-specific compressed format
@@ -306,11 +306,7 @@ static inline SkPMColor premultiply_argb_as_bgra(U8CPU a, U8CPU r, U8CPU g, U8CP
        b = SkMulDiv255Round(b, a);
    }

-#ifdef SK_PMCOLOR_IS_ARGB
-    return SkPackARGB_as_PMColor(a, r, g, b);
-#else
    return SkPackARGB_as_BGRA(a, r, g, b);
-#endif
 }

 static inline bool is_rgba(SkColorType colorType) {
@@ -51,16 +51,10 @@ struct SkPM4f {
    Sk4f to4f_pmorder() const { return swizzle_rb_if_bgra(this->to4f()); }

    SkPMColor toPMColor() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-        Sk4f value = this->to4f();
-        Sk4b bytes = SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f));
-        return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
-#else
        Sk4f value = swizzle_rb_if_bgra(this->to4f());
        SkPMColor result;
        SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f)).store(&result);
        return result;
-#endif
    }

    void toF16(uint16_t[4]) const;
@@ -22,50 +22,29 @@ static inline float get_alpha(const Sk4f& px) {


 static inline Sk4f Sk4f_fromL32(uint32_t px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk4f(SkGetPackedR32(px), SkGetPackedG32(px),
-                SkGetPackedB32(px), SkGetPackedA32(px)) * (1/255.0f);
-#else
    return SkNx_cast<float>(Sk4b::Load(&px)) * (1/255.0f);
-#endif
 }

 static inline Sk4f Sk4f_fromS32(uint32_t px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return { sk_linear_from_srgb[SkGetPackedR32(px)],
-             sk_linear_from_srgb[SkGetPackedG32(px)],
-             sk_linear_from_srgb[SkGetPackedB32(px)],
-                    (1/255.0f) * SkGetPackedA32(px) };
-#else
    return { sk_linear_from_srgb[(px >>  0) & 0xff],
             sk_linear_from_srgb[(px >>  8) & 0xff],
             sk_linear_from_srgb[(px >> 16) & 0xff],
                    (1/255.0f) * (px >> 24)          };
-#endif
 }

 static inline uint32_t Sk4f_toL32(const Sk4f& px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    Sk4b bytes = SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f));
-    return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
-#else
    uint32_t l32;
    SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f)).store(&l32);
    return l32;
-#endif
 }

 static inline uint32_t Sk4f_toS32(const Sk4f& px) {
    Sk4i  rgb = sk_linear_to_srgb(px),
         srgb = { rgb[0], rgb[1], rgb[2], (int)(255.0f * px[3] + 0.5f) };

-#ifdef SK_PMCOLOR_IS_ARGB
-    return SkPackARGB_as_PMColor(srgb[3], srgb[0], srgb[1], srgb[2]);
-#else
    uint32_t s32;
    SkNx_cast<uint8_t>(srgb).store(&s32);
    return s32;
-#endif
 }


@@ -121,10 +121,9 @@ SkDEBUGCODE(static const unsigned kRunRecordMagic = 0xb10bcafe;)
 namespace {
 struct RunRecordStorageEquivalent {
    RunFont  fFont;
-    uint32_t fCount;
    SkPoint  fOffset;
-    SkTextBlob::GlyphPositioning fPositioning;
-    bool     fExtended;
+    uint32_t fCount;
+    uint32_t fFlags;
    SkDEBUGCODE(unsigned fMagic;)
 };
 }
@@ -44,25 +44,6 @@ static Sk4x4f load_4_srgb(const void* vptr) {

    Sk4x4f rgba;

-#ifdef SK_PMCOLOR_IS_ARGB
-    rgba.r = { sk_linear_from_srgb[SkGetPackedR32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[3])] };
-
-    rgba.g = { sk_linear_from_srgb[SkGetPackedG32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[3])] };
-
-    rgba.b = { sk_linear_from_srgb[SkGetPackedB32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[3])] };
-
-    rgba.a = SkNx_cast<float>(Sk4i(SkGetPackedA32(ptr[0]), SkGetPackedA32(ptr[1]),
-                                   SkGetPackedA32(ptr[2]), SkGetPackedA32(ptr[3]))) * (1/255.0f);
-#else
    rgba.r = { sk_linear_from_srgb[(ptr[0] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[1] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[2] >>  0) & 0xff],
@@ -79,28 +60,15 @@ static Sk4x4f load_4_srgb(const void* vptr) {
               sk_linear_from_srgb[(ptr[3] >> 16) & 0xff] };

    rgba.a = SkNx_cast<float>((Sk4i::Load(ptr) >> 24) & 0xff) * (1/255.0f);
-#endif

    return rgba;
 }

 static void store_4_srgb(void* ptr, const Sk4x4f& p) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    uint32_t* dst = (uint32_t*)ptr;
-    Sk4i r = sk_linear_to_srgb(p.r);
-    Sk4i g = sk_linear_to_srgb(p.g);
-    Sk4i b = sk_linear_to_srgb(p.b);
-    Sk4i a = Sk4f_round(255.0f*p.a);
-    dst[0] = SkPackARGB_as_PMColor(a[0], r[0], g[0], b[0]);
-    dst[1] = SkPackARGB_as_PMColor(a[1], r[1], g[1], b[1]);
-    dst[2] = SkPackARGB_as_PMColor(a[2], r[2], g[2], b[2]);
-    dst[3] = SkPackARGB_as_PMColor(a[3], r[3], g[3], b[3]);
-#else
    ( sk_linear_to_srgb(p.r) <<  0
    | sk_linear_to_srgb(p.g) <<  8
    | sk_linear_to_srgb(p.b) << 16
    | Sk4f_round(255.0f*p.a) << 24).store(ptr);
-#endif
 }

 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -423,7 +391,7 @@ SkXfermode::D32Proc SkXfermode::GetD32Proc(SkXfermode* xfer, uint32_t flags) {
 #include "SkColorPriv.h"

 static Sk4f lcd16_to_unit_4f(uint16_t rgb) {
-#if defined(SK_PMCOLOR_IS_RGBA) || defined(SK_PMCOLOR_IS_ARGB)
+#ifdef SK_PMCOLOR_IS_RGBA
    Sk4i rgbi = Sk4i(SkGetPackedR16(rgb), SkGetPackedG16(rgb), SkGetPackedB16(rgb), 0);
 #else
    Sk4i rgbi = Sk4i(SkGetPackedB16(rgb), SkGetPackedG16(rgb), SkGetPackedR16(rgb), 0);
@@ -251,7 +251,7 @@ bool GrDrawTarget::drawBatches(GrBatchFlushState* flushState) {
            if (currentRT) {
                static const GrGpuCommandBuffer::LoadAndStoreInfo kBasicLoadStoreInfo
                    { GrGpuCommandBuffer::LoadOp::kLoad,GrGpuCommandBuffer::StoreOp::kStore,
-                      static_cast<GrColor>(GrColor_ILLEGAL) };
+                      GrColor_ILLEGAL };
                commandBuffer.reset(fGpu->createCommandBuffer(currentRT,
                                                              kBasicLoadStoreInfo,   // Color
                                                              kBasicLoadStoreInfo)); // Stencil
@@ -69,18 +69,11 @@ inline Sk4px Sk4px::Wide::div255() const {
 }

 inline Sk4px Sk4px::alphas() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b((*this)[ 0], (*this)[ 0], (*this)[ 0], (*this)[ 0],
-                 (*this)[ 4], (*this)[ 4], (*this)[ 4], (*this)[ 4],
-                 (*this)[ 8], (*this)[ 8], (*this)[ 8], (*this)[ 8],
-                 (*this)[12], (*this)[12], (*this)[12], (*this)[12]);
-#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 3], (*this)[ 3], (*this)[ 3], (*this)[ 3],
                 (*this)[ 7], (*this)[ 7], (*this)[ 7], (*this)[ 7],
                 (*this)[11], (*this)[11], (*this)[11], (*this)[11],
                 (*this)[15], (*this)[15], (*this)[15], (*this)[15]);
-#endif
 }

 inline Sk4px Sk4px::Load4Alphas(const SkAlpha a[4]) {
@@ -98,33 +91,19 @@ inline Sk4px Sk4px::Load2Alphas(const SkAlpha a[2]) {
 }

 inline Sk4px Sk4px::zeroAlphas() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b(0, (*this)[ 1], (*this)[ 2], (*this)[ 3],
-                 0, (*this)[ 5], (*this)[ 6], (*this)[ 7],
-                 0, (*this)[ 9], (*this)[10], (*this)[11],
-                 0, (*this)[13], (*this)[14], (*this)[15]);
-#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 0], (*this)[ 1], (*this)[ 2], 0,
                 (*this)[ 4], (*this)[ 5], (*this)[ 6], 0,
                 (*this)[ 8], (*this)[ 9], (*this)[10], 0,
                 (*this)[12], (*this)[13], (*this)[14], 0);
-#endif
 }

 inline Sk4px Sk4px::zeroColors() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b((*this)[ 0], 0,0,0,
-                 (*this)[ 4], 0,0,0,
-                 (*this)[ 8], 0,0,0,
-                 (*this)[12], 0,0,0);
-#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b(0,0,0, (*this)[ 3],
                 0,0,0, (*this)[ 7],
                 0,0,0, (*this)[11],
                 0,0,0, (*this)[15]);
-#endif
 }

 }  // namespace
@@ -72,10 +72,6 @@ static void color_cube_filter_span(const SkPMColor src[],
        // color is BGRA (SkColor order), dst is SkPMColor order, so may need to swap R+B.
    #if defined(SK_PMCOLOR_IS_RGBA)
        color = SkNx_shuffle<2,1,0,3>(color);
-    #elif defined(SK_PMCOLOR_IS_ARGB)
-        Sk4b bytes = SkNx_cast<uint8_t>(color);
-        dst[i] = SkPackARGB32NoCheck(a, bytes[2], bytes[1], bytes[0]);
-        continue;
    #endif
        uint8_t* dstBytes = (uint8_t*)(dst+i);
        SkNx_cast<uint8_t>(color).store(dstBytes);
@@ -73,39 +73,7 @@ static CFArrayRef SkCTFontManagerCopyAvailableFontFamilyNames() {
 #ifdef SK_BUILD_FOR_IOS
    return CFArrayCreate(nullptr, nullptr, 0, nullptr);
 #else
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    return CTFontManagerCopyAvailableFontFamilyNames();
-#else
-    CFMutableArrayRef familyNames =
-            CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
-    if (!familyNames) {
-        return nullptr;
-    }
-
-    ATSFontFamilyIterator iterator;
-    OSStatus status = ATSFontFamilyIteratorCreate(kATSFontContextGlobal,
-                                                  nullptr,
-                                                  nullptr,
-                                                  kATSOptionFlagsDefaultScope,
-                                                  &iterator);
-    if (status != noErr) {
-        CFRelease(familyNames);
-        return nullptr;
-    }
-
-    ATSFontFamilyRef family;
-    while (ATSFontFamilyIteratorNext(iterator, &family) == noErr) {
-        CFStringRef familyName = nullptr;
-        if (ATSFontFamilyGetName(family, kATSOptionFlagsDefault, &familyName) == noErr &&
-            familyName) {
-            CFArrayAppendValue(familyNames, familyName);
-            CFRelease(familyName);
-        }
-    }
-
-    ATSFontFamilyIteratorRelease(&iterator);
-    return familyNames;
-#endif
 #endif
 }

@@ -940,7 +908,6 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&

        // Skia handles quantization and subpixel positioning,
        // so disable quantization and enabe subpixel positioning in CG.
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
        CGContextSetAllowsFontSubpixelQuantization(fCG, false);
        CGContextSetShouldSubpixelQuantizeFonts(fCG, false);

@@ -949,7 +916,6 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
        // then CG cannot draw the glyph in the correct location without subpixel positioning.
        CGContextSetAllowsFontSubpixelPositioning(fCG, true);
        CGContextSetShouldSubpixelPositionFonts(fCG, true);
-#endif

        CGContextSetTextDrawingMode(fCG, kCGTextFill);

@@ -1005,13 +971,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
    // So always make the font transform identity and place the transform on the context.
    point = CGPointApplyAffineTransform(point, context.fInvTransform);

-#if defined(MAC_OS_X_VERSION_10_7) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7)
    CTFontDrawGlyphs(context.fCTFont, &glyphID, &point, 1, fCG);
-#else
-    CGContextSetFont(fCG, CTFontCopyGraphicsFont(context.fCTFont, NULL));
-    CGContextSetFontSize(fCG, CTFontGetSize(context.fCTFont));
-    CGContextShowGlyphsAtPositions(fCG, &glyphID, &point, 1);
-#endif

    SkASSERT(rowBytesPtr);
    *rowBytesPtr = rowBytes;
@@ -1722,7 +1682,6 @@ SkAdvancedTypefaceMetrics* SkTypeface_Mac::onGetAdvancedTypefaceMetrics(

 static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
    CTFontRef ctFont = typeface->fFontRef.get();
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    AutoCFRelease<CFNumberRef> fontFormatRef(
            static_cast<CFNumberRef>(CTFontCopyAttribute(ctFont, kCTFontFormatAttribute)));
    if (!fontFormatRef) {
@@ -1752,35 +1711,6 @@ static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
            //Just the presence of the FontForge 'FFTM' table seems to throw it off.
            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
    }
-#else
-    AutoCFRelease<CFStringRef> postScriptName(CTFontCopyPostScriptName(ctFont));
-    if (!postScriptName) {
-        return 0;
-    }
-
-    ATSFontRef atsFont =
-            ATSFontFindFromPostScriptName(postScriptName, kATSOptionFlagsDefault);
-    if (atsFont == kInvalidFont) {
-        return 0;
-    }
-
-    SkSFNTHeader header;
-    ByteCount headerSize = sizeof(header);
-    if (ATSFontGetTableDirectory(atsFont, headerSize, &header, &headerSize) != noErr ||
-        headerSize < sizeof(header.fontType)) {
-        return 0;
-    }
-
-    switch (header.fontType) {
-        case SkSFNTHeader::fontType_OpenTypeCFF::TAG:
-        case SkSFNTHeader::fontType_WindowsTrueType::TAG:
-        case SkSFNTHeader::fontType_MacTrueType::TAG:
-        case SkSFNTHeader::fontType_PostScript::TAG:
-            return header.fontType;
-        default:
-            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
-    }
-#endif
 }

 SkStreamAsset* SkTypeface_Mac::onOpenStream(int* ttcIndex) const {
@@ -336,7 +336,20 @@ gfxGraphiteShaper::SetGlyphsFromSegment(DrawTarget      *aDrawTarget,
            // not a one-to-one mapping with simple metrics: use DetailedGlyph
            AutoTArray<gfxShapedText::DetailedGlyph,8> details;
            float clusterLoc;
-            for (uint32_t j = c.baseGlyph; j < c.baseGlyph + c.nGlyphs; ++j) {
+
+            uint32_t glyph_start = c.baseGlyph;
+            uint32_t glyph_end = glyph_start + c.nGlyphs;
+            if (glyph_end < glyph_start) {
+                return NS_ERROR_ILLEGAL_VALUE;
+            }
+            if (glyph_end - glyph_start > 0xFFFF) {
+                return NS_ERROR_ILLEGAL_VALUE;
+            }
+            if (!details.SetCapacity(glyph_end - glyph_start, fallible)) {
+                return NS_ERROR_OUT_OF_MEMORY;
+            }
+
+            for (uint32_t j = glyph_start; j < glyph_end; ++j) {
                gfxShapedText::DetailedGlyph* d = details.AppendElement();
                d->mGlyphID = gids[j];
                d->mYOffset = roundY ? NSToIntRound(-yLocs[j]) * dev2appUnits :
@@ -231,11 +231,13 @@ gfxTextRun::ComputeLigatureData(Range aPartRange,
    LigatureData result;
    const CompressedGlyph *charGlyphs = mCharacterGlyphs;

-    uint32_t i;
-    for (i = aPartRange.start; !charGlyphs[i].IsLigatureGroupStart(); --i) {
-        NS_ASSERTION(i > 0, "Ligature at the start of the run??");
+    uint32_t i = aPartRange.start;
+    while (i && !charGlyphs[i].IsLigatureGroupStart()) {
+        --i;
    }
+    NS_ASSERTION(charGlyphs[i].IsLigatureGroupStart(), "Ligature at run start?");
    result.mRange.start = i;
+
    for (i = aPartRange.start + 1;
         i < GetLength() && !charGlyphs[i].IsLigatureGroupStart(); ++i) {
    }
@@ -1704,21 +1706,27 @@ gfxFontGroup::GetFontAt(int32_t i, uint32_t aCh)

    RefPtr<gfxFont> font = ff.Font();
    if (!font) {
-        gfxFontEntry* fe = mFonts[i].FontEntry();
-        gfxCharacterMap* unicodeRangeMap = nullptr;
+        RefPtr<gfxFontEntry> fe = ff.FontEntry();
+        if (!fe) {
+            return nullptr;
+        }
+        RefPtr<gfxCharacterMap> unicodeRangeMap;
        if (fe->mIsUserFontContainer) {
-            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe);
+            // This raw pointer is OK because fe holds a strong ref to the object.
+            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe.get());
            if (ufe->LoadState() == gfxUserFontEntry::STATUS_NOT_LOADED &&
                ufe->CharacterInUnicodeRange(aCh) &&
                !FontLoadingForFamily(ff.Family(), aCh)) {
                ufe->Load();
                ff.CheckState(mSkipDrawing);
            }
+            unicodeRangeMap = ufe->GetUnicodeRangeMap();
+            // Update fe to refer to the actual platform font entry, rather than the
+            // webfont wrapper. After this, we no longer have a strong ref to ufe.
            fe = ufe->GetPlatformFontEntry();
            if (!fe) {
                return nullptr;
            }
-            unicodeRangeMap = ufe->GetUnicodeRangeMap();
        }
        font = fe->FindOrMakeFont(&mStyle, mFonts[i].NeedsBold(),
                                  unicodeRangeMap);
@@ -1637,10 +1637,13 @@ RasterImage::NotifyDecodeComplete(const DecoderFinalStatus& aStatus,

  if (!(aDecoderFlags & DecoderFlags::FIRST_FRAME_ONLY) &&
      mHasBeenDecoded && mAnimationState) {
-    // We've finished a full decode of all animation frames and our AnimationState
-    // has been notified about them all, so let it know not to expect anymore.
-    mAnimationState->NotifyDecodeComplete();
-    mAnimationState->UpdateState(mAnimationFinished, this, mSize);
+    // If we've successfully finished a full decode of all animation frames
+    // then let our animation state know it's complete and to not to expect
+    // any more frames.
+    if (aStatus.mFinished && !aStatus.mHadError) {
+      mAnimationState->NotifyDecodeComplete();
+      mAnimationState->UpdateState(mAnimationFinished, this, mSize);
+    }
  }

  // Only act on errors if we have no usable frames from the decoder.
@@ -66,28 +66,10 @@ struct WeakCell {
    WeakCellKind kind;
    WeakRef<JSObject*> object;
    WeakRef<JS::Symbol*> symbol;
-    bool enabled;

-    WeakCell()
-        : kind(WeakCellKind::Empty)
-        , object(nullptr)
-        , symbol(nullptr)
-        , enabled(true)
-    {}
-
-    explicit WeakCell(JSObject* obj, bool enabled)
-        : kind(WeakCellKind::Object)
-        , object(obj)
-        , symbol(nullptr)
-        , enabled(enabled)
-    {}
-
-    explicit WeakCell(JS::Symbol* sym, bool enabled)
-        : kind(WeakCellKind::Symbol)
-        , object(nullptr)
-        , symbol(sym)
-        , enabled(enabled)
-    {}
+    WeakCell() : kind(WeakCellKind::Empty), object(nullptr), symbol(nullptr) {}
+    explicit WeakCell(JSObject* obj) : kind(WeakCellKind::Object), object(obj), symbol(nullptr) {}
+    explicit WeakCell(JS::Symbol* sym) : kind(WeakCellKind::Symbol), object(nullptr), symbol(sym) {}

    void clear() {
        kind = WeakCellKind::Empty;
@@ -119,9 +101,7 @@ struct WeakCell {
            if (!target)
                return;

-            if (!enabled) {
-              // Do nothing
-            } else if (IsInsideNursery(target)) {
+            if (IsInsideNursery(target)) {
                TraceManuallyBarrieredEdge(trc, object.unsafeGet(), name);
            } else {
                if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
@@ -130,7 +110,7 @@ struct WeakCell {
            }
        } else if (kind == WeakCellKind::Symbol) {
            JS::Symbol* target = symbol.unbarrieredGet();
-            if (enabled && target) {
+            if (target) {
                if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
                    return;
                TraceWeakEdge(trc, &symbol, name);
@@ -144,16 +124,14 @@ struct WeakCell {
            if (!target)
                return;

-            if (!enabled) {
-              // Do nothing
-            } else if (IsInsideNursery(target)) {
+            if (IsInsideNursery(target)) {
                TraceManuallyBarrieredEdge(trc, object.unsafeGet(), name);
            } else if (target->asTenured().zone()->isCollecting()) {
                TraceWeakEdge(trc, &object, name);
            }
        } else if (kind == WeakCellKind::Symbol) {
            JS::Symbol* target = symbol.unbarrieredGet();
-            if (enabled && target && target->asTenured().zone()->isCollecting())
+            if (target && target->asTenured().zone()->isCollecting())
                TraceWeakEdge(trc, &symbol, name);
        }
    }
@@ -165,24 +143,22 @@ struct FinalizationRecord {
    WeakCell unregisterToken;
    bool active;
    bool queued;
-    bool enabled;

    FinalizationRecord(HandleValue targetValue, HandleValue heldValue,
-                       HandleValue unregisterTokenValue, bool enabled)
+                       HandleValue unregisterTokenValue)
      : heldValue(heldValue),
        active(true),
-        queued(false),
-        enabled(enabled)
+        queued(false)
    {
        if (targetValue.isObject())
-            target = WeakCell(NormalizeWeakObject(&targetValue.toObject()), enabled);
+            target = WeakCell(NormalizeWeakObject(&targetValue.toObject()));
        else
-            target = WeakCell(targetValue.toSymbol(), enabled);
+            target = WeakCell(targetValue.toSymbol());

        if (unregisterTokenValue.isObject())
-            unregisterToken = WeakCell(NormalizeWeakObject(&unregisterTokenValue.toObject()), enabled);
+            unregisterToken = WeakCell(NormalizeWeakObject(&unregisterTokenValue.toObject()));
        else if (unregisterTokenValue.isSymbol())
-            unregisterToken = WeakCell(unregisterTokenValue.toSymbol(), enabled);
+            unregisterToken = WeakCell(unregisterTokenValue.toSymbol());
    }

    void trace(JSTracer* trc) {
@@ -241,15 +217,13 @@ struct FinalizationRegistryObject::Data {
    FinalizationRecordVector records;
    FinalizationRecordVector cleanupQueue;
    bool queuedForCleanup;
-    bool enabled;

-    explicit Data(JSObject* cleanupCallback, bool enabled)
+    explicit Data(JSObject* cleanupCallback)
      : cleanupCallback(cleanupCallback),
        cleanupJob(nullptr),
        records(SystemAllocPolicy()),
        cleanupQueue(SystemAllocPolicy()),
-        queuedForCleanup(false),
-        enabled(enabled)
+        queuedForCleanup(false)
    {}

    ~Data() {
@@ -258,13 +232,11 @@ struct FinalizationRegistryObject::Data {
    }

    void trace(JSTracer* trc) {
-        if (enabled) {
-          JS::TraceEdge(trc, &cleanupCallback, "FinalizationRegistry cleanup callback");
-          if (cleanupJob.unbarrieredGet())
-              JS::TraceEdge(trc, &cleanupJob, "FinalizationRegistry cleanup job");
-          for (size_t i = 0; i < records.length(); i++)
-              records[i]->trace(trc);
-        }
+        JS::TraceEdge(trc, &cleanupCallback, "FinalizationRegistry cleanup callback");
+        if (cleanupJob.unbarrieredGet())
+            JS::TraceEdge(trc, &cleanupJob, "FinalizationRegistry cleanup job");
+        for (size_t i = 0; i < records.length(); i++)
+            records[i]->trace(trc);
    }

    bool appendRecord(FinalizationRecord* record) {
@@ -345,7 +317,7 @@ FinalizationRegistry_register_impl(JSContext* cx, const CallArgs& args)
        unregisterToken.setUndefined();
    }

-    FinalizationRecord* record = cx->new_<FinalizationRecord>(target, heldValue, unregisterToken, cx->options().weakRefs());
+    FinalizationRecord* record = cx->new_<FinalizationRecord>(target, heldValue, unregisterToken);
    if (!record)
        return false;

@@ -429,7 +401,7 @@ FinalizationRegistryObject::create(JSContext* cx, HandleObject cleanupCallback,
    if (!obj)
        return nullptr;

-    Data* data = cx->new_<Data>(cleanupCallback, cx->options().weakRefs());
+    Data* data = cx->new_<Data>(cleanupCallback);
    if (!data)
        return nullptr;

@@ -8,8 +8,11 @@
 #include "mozilla/CheckedInt.h"
 #include "mozilla/TypeTraits.h"

+#include <algorithm>
+
 #include "jscntxt.h"

+#include "builtin/SelfHostingDefines.h"
 #include "irregexp/RegExpParser.h"
 #include "jit/InlinableNatives.h"
 #include "vm/RegExpStatics.h"
@@ -1754,7 +1757,9 @@ js::RegExpGetSubstitution(JSContext* cx, HandleArrayObject matchResult, HandleLi
    // Step 6.
    MOZ_ASSERT(position <= string->length());

-    uint32_t nCaptures = matchResultLength - 1;
+    // String substitutions can only reference $1 through $99.
+    uint32_t nCaptures = std::min<uint32_t>(matchResultLength - 1,
+                                            REGEXP_MAX_SUBSTITUTION_CAPTURES);
    Rooted<CapturesVector> captures(cx, CapturesVector(cx));
    if (!captures.reserve(nCaptures))
        return false;
@@ -463,6 +463,12 @@ function RegExpGetComplexReplacement(result, matched, S, position,
    // Step 14.k.i (reordered).
    _DefineDataProperty(captures, capturesLength++, matched);

+    // String substitutions can only reference $1 through $99. Keep getting and
+    // stringifying all captures because those operations are observable.
+    var storedCaptures = functionalReplace ?
+                           nCaptures :
+                           std_Math_min(nCaptures, REGEXP_MAX_SUBSTITUTION_CAPTURES);
+
    // Step 14.g, 14.i, 14.i.iv.
    for (var n = 1; n <= nCaptures; n++) {
        // Step 14.i.i.
@@ -473,7 +479,9 @@ function RegExpGetComplexReplacement(result, matched, S, position,
            capN = ToString(capN);

        // Step 14.i.iii.
-        _DefineDataProperty(captures, capturesLength++, capN);
+        if (n <= storedCaptures) {
+            _DefineDataProperty(captures, capturesLength++, capN);
+        }
    }

    // Step 14.j.
@@ -79,6 +79,8 @@

 #define REGEXP_FLAGS_SLOT 2

+#define REGEXP_MAX_SUBSTITUTION_CAPTURES 99
+
 #define REGEXP_IGNORECASE_FLAG  0x01
 #define REGEXP_GLOBAL_FLAG      0x02
 #define REGEXP_MULTILINE_FLAG   0x04
@@ -140,9 +140,9 @@ WeakRefObject::create(JSContext* cx, HandleValue target, HandleObject proto /* =

    Referent* data;
    if (target.isObject())
-        data = cx->new_<Referent>(&target.toObject(), cx->options().weakRefs());
+        data = cx->new_<Referent>(&target.toObject());
    else
-        data = cx->new_<Referent>(target.toSymbol(), cx->options().weakRefs());
+        data = cx->new_<Referent>(target.toSymbol());

    if (!data)
        return nullptr;
@@ -210,9 +210,7 @@ WeakRefObject::trace(JSTracer* trc, JSObject* obj)
            if (!target)
                return;

-            if (!data->enabled) {
-                // Pref disabled, don't do anything.
-            } else if (IsInsideNursery(target)) {
+            if (IsInsideNursery(target)) {
                // Weak edges must be tenured; trace strongly while referent is in the nursery.
                TraceManuallyBarrieredEdge(trc, data->objectTarget.unsafeGet(),
                                           "WeakRef nursery referent");
@@ -222,7 +220,7 @@ WeakRefObject::trace(JSTracer* trc, JSObject* obj)
        } else {
            MOZ_ASSERT(data->isSymbol());
            JS::Symbol* target = data->symbolTarget.unbarrieredGet();
-            if (data->enabled && target)
+            if (target)
                TraceWeakEdge(trc, &data->symbolTarget, "WeakRef symbol referent");
        }
    }
@@ -22,27 +22,17 @@ class WeakRefObject : public NativeObject
            Symbol
        };

-        explicit Referent(JSObject* obj, bool enabled)
-          : kind(Kind::Object)
-          , objectTarget(obj)
-          , symbolTarget(nullptr)
-          , enabled(enabled)
-        {}
-        
-        explicit Referent(JS::Symbol* sym, bool enabled)
-          : kind(Kind::Symbol)
-          , objectTarget(nullptr)
-          , symbolTarget(sym)
-          , enabled(enabled)
-        {}
-        
+        explicit Referent(JSObject* obj)
+          : kind(Kind::Object), objectTarget(obj), symbolTarget(nullptr) {}
+        explicit Referent(JS::Symbol* sym)
+          : kind(Kind::Symbol), objectTarget(nullptr), symbolTarget(sym) {}
+
        bool isObject() const { return kind == Kind::Object; }
        bool isSymbol() const { return kind == Kind::Symbol; }

        Kind kind;
        WeakRef<JSObject*> objectTarget;
        WeakRef<JS::Symbol*> symbolTarget;
-        bool enabled;
    };

    static const Class class_;
@@ -416,13 +416,13 @@ MapMemoryAt(void* desired, size_t length, int prot = PROT_READ | PROT_WRITE,
            int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)

 // Solaris manages 64-bit address space in a different manner from every other
-// AMD64 operating system, but fortunately the fix is the same one
-// required for every operating system on 64-bit SPARC and ARM.
+// AMD64 operating system, but fortunately the fix is the same one 
+// required for every operating system on 64-bit SPARC, Itanium, and ARM. 
 // Most people's intuition failed them here and they thought this couldn't
 // possibly be correct on AMD64, but for Solaris/illumos it is.	
 	
 {
-#if defined(__aarch64__) || (defined(__sun) && defined(__x86_64__)) || (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
+#if defined(__ia64__) || defined(__aarch64__) || (defined(__sun) && defined(__x86_64__)) || (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
    MOZ_ASSERT((0xffff800000000000ULL & (uintptr_t(desired) + length - 1)) == 0);
 #endif
    void* region = mmap(desired, length, prot, flags, fd, offset);
@@ -445,14 +445,14 @@ static inline void*
 MapMemory(size_t length, int prot = PROT_READ | PROT_WRITE,
          int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)
 {
-#if defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__)
+#if defined(__ia64__) || (defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__))
    /*
     * The JS engine assumes that all allocated pointers have their high 17 bits clear,
-     * which mmap on this platform doesn't support directly. However, we can emulate it
-     * by passing mmap an "addr" parameter with those bits clear. The mmap will return
-     * that address, or the nearest available memory above that address, providing a
-     * near-guarantee that those bits are clear. If they are not, we return nullptr below
-     * to indicate out-of-memory.
+     * which ia64's mmap doesn't support directly. However, we can emulate it by passing
+     * mmap an "addr" parameter with those bits clear. The mmap will return that address,
+     * or the nearest available memory above that address, providing a near-guarantee
+     * that those bits are clear. If they are not, we return nullptr below to indicate
+     * out-of-memory.
     *
     * The addr is chosen as 0x0000070000000000, which still allows about 120TB of virtual
     * address space.
@@ -479,7 +479,7 @@ MapMemory(size_t length, int prot = PROT_READ | PROT_WRITE,
    * different due to the different mmap behavior.
    *
    * TODO: Merge with the above code block if this implementation works for
-    * sparc64.
+    * ia64 and sparc64.
    */
    const uintptr_t start = UINT64_C(0x0000070000000000);
    const uintptr_t end   = UINT64_C(0x0000800000000000);
@@ -8185,7 +8185,7 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleT(T* lir)
 {
-    static_assert(std::is_same_v<T, LStoreElementHoleT> || std::is_same_v<T, LFallibleStoreElementT>,
+    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
                  "emitStoreElementHoleT called with unexpected argument type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -8244,7 +8244,7 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleV(T* lir)
 {
-    static_assert(std::is_same_v<T, LStoreElementHoleV> || std::is_same_v<T, LFallibleStoreElementV>,
+    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
                  "emitStoreElementHoleV called with unexpected parameter type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -494,6 +494,9 @@ OnLeaveBaselineFrame(JSContext* cx, const JitFrameIterator& frame, jsbytecode* p
 {
    BaselineFrame* baselineFrame = frame.baselineFrame();
    if (jit::DebugEpilogue(cx, baselineFrame, pc, frameOk)) {
+        if (!baselineFrame->hasReturnValue()) {
+            baselineFrame->setReturnValue(UndefinedValue());
+        }
        rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
        rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
        rfe->stackPointer = reinterpret_cast<uint8_t*>(baselineFrame);
@@ -320,6 +320,7 @@ size_t AssemblerLOONGARCH64::bytesNeeded() const {

 // write a blob of binary into the instruction stream
 BufferOffset AssemblerLOONGARCH64::writeInst(uint32_t x, uint32_t* dest) {
+  MOZ_ASSERT(hasCreator());
  if (dest == nullptr) {
    return m_buffer.putInt(x);
  }
@@ -212,8 +212,6 @@ static constexpr Register WasmTableCallIndexReg = ABINonArgReg3;
 static constexpr Register WasmIonExitRegCallee = t0;
 static constexpr Register WasmIonExitRegE0 = a0;
 static constexpr Register WasmIonExitRegE1 = a1;
-static constexpr Register WasmIonExitRegReturnData = JSReturnReg_Data;
-static constexpr Register WasmIonExitRegReturnType = JSReturnReg_Type;
 static constexpr Register WasmIonExitRegD0 = a0;
 static constexpr Register WasmIonExitRegD1 = a1;
 static constexpr Register WasmIonExitRegD2 = t0;
@@ -1013,8 +1013,8 @@ CodeGeneratorLoongArch64::visitTestI64AndBranch(LTestI64AndBranch* lir)
 void
 CodeGeneratorLoongArch64::setReturnDoubleRegs(LiveRegisterSet* regs)
 {
-    MOZ_ASSERT(ReturnFloat32Reg.encoding() == FloatRegisters::f0);
-    MOZ_ASSERT(ReturnDoubleReg.encoding() == FloatRegisters::f0);
+    MOZ_ASSERT(ReturnFloat32Reg.reg_ == FloatRegisters::f0);
+    MOZ_ASSERT(ReturnDoubleReg.reg_ == FloatRegisters::f0);
    FloatRegister f1 = { FloatRegisters::f1, FloatRegisters::Single };
    regs->add(ReturnFloat32Reg);
    regs->add(f1);
@@ -2395,7 +2395,7 @@ void MacroAssemblerLOONGARCH64::wasmLoadImpl(const wasm::MemoryAccessDesc& acces
                                         Register ptrScratch,
                                         AnyRegister output, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
+  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2442,7 +2442,7 @@ void MacroAssemblerLOONGARCH64::wasmStoreImpl(const wasm::MemoryAccessDesc& acce
                                          Register memoryBase, Register ptr,
                                          Register ptrScratch, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
+  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2488,7 +2488,7 @@ void MacroAssemblerLOONGARCH64Compat::wasmLoadI64Impl(
    const wasm::MemoryAccessDesc& access, Register memoryBase, Register ptr,
    Register ptrScratch, Register64 output, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
+  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2534,7 +2534,7 @@ void MacroAssemblerLOONGARCH64Compat::wasmStoreI64Impl(
    const wasm::MemoryAccessDesc& access, Register64 value, Register memoryBase,
    Register ptr, Register ptrScratch, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
+  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2774,13 +2774,12 @@ CodeOffset MacroAssembler::nopPatchableToNearJump() {
 }

 void MacroAssembler::patchNopToNearJump(uint8_t* jump, uint8_t* target) {
-  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->encode() == NopInst);
+  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->is<InstNOP>());
  new (jump) InstJump(op_b, JOffImm26(target - jump));
 }

 void MacroAssembler::patchNearJumpToNop(uint8_t* jump) {
-  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->extractBitField(31, 26) ==
-             (uint32_t)op_b >> 26);
+  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->is<InstJump>());
  new (jump) InstNOP();
 }

@@ -301,7 +301,7 @@ void unmapPages(void* p, size_t size) { }
 void*
 mapMemoryAt(void* desired, size_t length)
 {
-#if defined(__aarch64__) || \
+#if defined(__ia64__) || defined(__aarch64__) || \
    (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
    MOZ_RELEASE_ASSERT(0xffff800000000000ULL & (uintptr_t(desired) + length - 1) == 0);
 #endif
@@ -324,7 +324,7 @@ mapMemory(size_t length)
    int fd = -1;
    off_t offset = 0;
    // The test code must be aligned with the implementation in gc/Memory.cpp.
-#if defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__)
+#if defined(__ia64__) || (defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__))
    void* region = mmap((void*)0x0000070000000000, length, prot, flags, fd, offset);
    if (region == MAP_FAILED)
        return nullptr;
@@ -999,8 +999,7 @@ class JS_PUBLIC_API(ContextOptions) {
        strictMode_(false),
        extraWarnings_(false),
        arrayProtoValues_(true),
-        streams_(false),
-        weakRefs_(false)
+        streams_(false)
    {
    }

@@ -1140,13 +1139,12 @@ class JS_PUBLIC_API(ContextOptions) {
        return *this;
    }

-    bool weakRefs() const { return weakRefs_; }
+    bool weakRefs() const { return true; }
    ContextOptions& setWeakRefs(bool flag) {
-        weakRefs_ = flag;
+        (void) flag;
        return *this;
    }
    ContextOptions& toggleWeakRefs() {
-        weakRefs_ = !weakRefs_;
        return *this;
    }

@@ -1167,7 +1165,6 @@ class JS_PUBLIC_API(ContextOptions) {
    bool extraWarnings_ : 1;
    bool arrayProtoValues_ : 1;
    bool streams_ : 1;
-    bool weakRefs_ : 1;
 };

 JS_PUBLIC_API(ContextOptions&)
@@ -312,12 +312,13 @@ cvt_s(SprintfState* ss, const char* s, int width, int prec, int flags)
        s = generic_null_str(s);

    // Limit string length by precision value
-    int slen = int(generic_strlen(s));
-    if (0 < prec && prec < slen)
-        slen = prec;
+    size_t slen = strnlen(s, size_t(prec));
+    if (slen > INT_MAX) {
+        return false;
+    }

    // and away we go
-    return fill2(ss, s, slen, width, flags);
+    return fill2(ss, s, int(slen), width, flags);
 }

 /*
@@ -976,12 +976,6 @@ CanUpperCaseSpecialCasing(Latin1Char charCode)
 static inline bool
 CanUpperCaseSpecialCasing(char16_t charCode)
 {
-    // Update mapping for U+00DF LATIN SMALL LETTER SHARP S inline,
-    // overriding Unicode data files to force the use of
-    // U+1E9E LATIN CAPITAL LETTER SHARP S.
-    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S)
-        return true;
-
    return unicode::CanUpperCaseSpecialCasing(charCode);
 }

@@ -997,11 +991,6 @@ LengthUpperCaseSpecialCasing(Latin1Char charCode)
 static inline size_t
 LengthUpperCaseSpecialCasing(char16_t charCode)
 {
-    // U+00DF LATIN SMALL LETTER SHARP S is uppercased according to ICU or
-    // to U+1E9E LATIN CAPITAL LETTER SHARP S.
-    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S)
-        return 1;
-
    MOZ_ASSERT(CanUpperCaseSpecialCasing(charCode));

    return unicode::LengthUpperCaseSpecialCasing(charCode);
@@ -1021,13 +1010,6 @@ AppendUpperCaseSpecialCasing(char16_t charCode, Latin1Char* elements, size_t* in
 static inline void
 AppendUpperCaseSpecialCasing(char16_t charCode, char16_t* elements, size_t* index)
 {
-    // U+00DF LATIN SMALL LETTER SHARP S is uppercased according to ICU or
-    // to U+1E9E LATIN CAPITAL LETTER SHARP S.
-    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S) {
-        elements[(*index)++] = 0x1E9E;
-        return;
-    }
-
    unicode::AppendUpperCaseSpecialCasing(charCode, elements, index);
 }

@@ -1043,7 +1025,6 @@ ToUpperCaseImpl(DestChar* destChars, const SrcChar* srcChars, size_t startIndex,
    MOZ_ASSERT(srcLength <= destLength);

    size_t j = startIndex;
-    size_t upperLength = srcLength;
    for (size_t i = startIndex; i < srcLength; i++) {
        char16_t c = srcChars[i];
        if (!IsSame<DestChar, Latin1Char>::value) {
@@ -1059,10 +1040,9 @@ ToUpperCaseImpl(DestChar* destChars, const SrcChar* srcChars, size_t startIndex,
            }
        }

-        if (MOZ_UNLIKELY(c > 0x7f && CanUpperCaseSpecialCasing(static_cast<DestChar>(c)))) {
+        if (MOZ_UNLIKELY(c > 0x7f && CanUpperCaseSpecialCasing(static_cast<SrcChar>(c)))) {
            // Return if the output buffer is too small.
-            upperLength += (LengthUpperCaseSpecialCasing(static_cast<DestChar>(c)) - 1);
-            if (upperLength > destLength)
+            if (srcLength == destLength)
                return i;

            AppendUpperCaseSpecialCasing(c, destChars, &j);
@@ -1091,18 +1071,14 @@ ToUpperCaseImpl(Latin1Char* destChars, const char16_t* srcChars, size_t startInd

 template <typename CharT>
 static size_t
-ToUpperCaseLength(const CharT* chars, size_t startIndex, size_t length, bool force16)
+ToUpperCaseLength(const CharT* chars, size_t startIndex, size_t length)
 {
    size_t upperLength = length;
    for (size_t i = startIndex; i < length; i++) {
        char16_t c = chars[i];

-        if (c > 0x7f &&
-            (force16 && CanUpperCaseSpecialCasing(c) ||
-             CanUpperCaseSpecialCasing(static_cast<CharT>(c))))
-            upperLength += (force16
-                ? LengthUpperCaseSpecialCasing(c)
-                : LengthUpperCaseSpecialCasing(static_cast<CharT>(c))) - 1;
+        if (c > 0x7f && CanUpperCaseSpecialCasing(static_cast<CharT>(c)))
+            upperLength += LengthUpperCaseSpecialCasing(static_cast<CharT>(c)) - 1;
    }
    return upperLength;
 }
@@ -1141,7 +1117,7 @@ ToUpperCase(JSContext* cx, const SrcChar* chars, size_t startIndex, size_t lengt

    size_t readChars = ToUpperCaseImpl(buf.get(), chars, startIndex, length, length);
    if (readChars < length) {
-        size_t actualLength = ToUpperCaseLength(chars, readChars, length, !IsSame<DestChar, Latin1Char>::value);
+        size_t actualLength = ToUpperCaseLength(chars, readChars, length);

        *resultLength = actualLength;
        DestCharPtr buf2 = ReallocChars(cx, Move(buf), length + 1, actualLength + 1);
@@ -1202,8 +1178,7 @@ ToUpperCase(JSContext* cx, JSLinearString* str)
        //
        // If the original string is Latin-1, it can -- unless the string
        // contains U+00B5 MICRO SIGN or U+00FF SMALL LETTER Y WITH DIAERESIS,
-        // the only Latin-1 codepoints that don't uppercase within Latin-1, or
-        // it contains U+00DF LATIN SMALL LETTER SHARP S, which we override.
+        // the only Latin-1 codepoints that don't uppercase within Latin-1.
        // Search for those codepoints to decide whether the new string can be
        // Latin-1.
        // If the original string is a two-byte string, its uppercase form is
@@ -1220,9 +1195,6 @@ ToUpperCase(JSContext* cx, JSLinearString* str)
                    MOZ_ASSERT(unicode::ToUpperCase(c) > JSString::MAX_LATIN1_CHAR);
                    resultIsLatin1 = false;
                    break;
-                } else if (c == unicode::LATIN_SMALL_LETTER_SHARP_S) {
-                    resultIsLatin1 = false;
-                    break;
                } else {
                    MOZ_ASSERT(unicode::ToUpperCase(c) <= JSString::MAX_LATIN1_CHAR);
                }
@@ -2871,8 +2843,8 @@ static JSString* ReplaceAll(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same_v<StrChar, char16_t> ||
-      std::is_same_v<RepChar, char16_t>) {
+    if (std::is_same<StrChar, char16_t>::value ||
+      std::is_same<RepChar, char16_t>::value) {
        if (!result.ensureTwoByteChars()) {
          return nullptr;
        }
@@ -2954,8 +2926,8 @@ static JSString* ReplaceAllInterleave(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same_v<StrChar, char16_t> ||
-        std::is_same_v<RepChar, char16_t>) {
+    if (std::is_same<StrChar, char16_t>::value ||
+        std::is_same<RepChar, char16_t>::value) {
        if (!result.ensureTwoByteChars()) {
            return nullptr;
        }
@@ -309,26 +309,26 @@ InflateUTF8StringToBuffer(ContextT* cx, const UTF8Chars src, CharT* dst, size_t*
            while (v & (0x80 >> n))
                n++;

-        #define INVALID(report, arg, n2)                                  \
-            do {                                                          \
-                if (Action == CountAndReportInvalids) {                   \
-                    report(cx, arg);                                      \
-                    return false;                                         \
-                } else if (Action == AssertNoInvalids) {                  \
-                    MOZ_CRASH("invalid UTF-8 string: " # report);         \
-                } else {                                                  \
-                    if (Action == Copy) {                                 \
-                        if (std::is_same_v<decltype(dst[0]), Latin1Char>) \
-                            dst[j] = CharT(REPLACE_UTF8_LATIN1);          \
-                        else                                              \
-                            dst[j] = CharT(REPLACE_UTF8);                 \
-                    } else {                                              \
-                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||    \
-                                   Action == FindEncoding);               \
-                    }                                                     \
-                    n = n2;                                               \
-                    goto invalidMultiByteCodeUnit;                        \
-                }                                                         \
+        #define INVALID(report, arg, n2)                                \
+            do {                                                        \
+                if (Action == CountAndReportInvalids) {                 \
+                    report(cx, arg);                                    \
+                    return false;                                       \
+                } else if (Action == AssertNoInvalids) {                \
+                    MOZ_CRASH("invalid UTF-8 string: " # report);       \
+                } else {                                                \
+                    if (Action == Copy) {                               \
+                        if (std::is_same<decltype(dst[0]), Latin1Char>::value) \
+                            dst[j] = CharT(REPLACE_UTF8_LATIN1);        \
+                        else                                            \
+                            dst[j] = CharT(REPLACE_UTF8);               \
+                    } else {                                            \
+                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||  \
+                                   Action == FindEncoding);             \
+                    }                                                   \
+                    n = n2;                                             \
+                    goto invalidMultiByteCodeUnit;                      \
+                }                                                       \
            } while (0)

            // Check the leading byte.
@@ -1138,7 +1138,7 @@ class StaticStrings
    }

    template <typename CharT,
-              typename = typename std::enable_if_t<!std::is_const_v<CharT>>>
+              typename = typename std::enable_if<!std::is_const<CharT>::value>::type>
    MOZ_ALWAYS_INLINE JSAtom* lookup(CharT* chars, size_t length) {
        // Collapse the remaining |CharT*| to |const CharT*| to avoid excess
        // instantiations.
@@ -677,12 +677,12 @@ class ElementSpecific
            return true;
        }

-        if (std::is_same_v<T, int64_t>) {
+        if (std::is_same<T, int64_t>::value) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigInt64(cx, v));
            return true;
        }

-        if (std::is_same_v<T, uint64_t>) {
+        if (std::is_same<T, uint64_t>::value) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigUint64(cx, v));
            return true;
        }
@@ -839,7 +839,7 @@ wasm::ToggleProfiling(const Code& code, const CallSite& callSite, bool enabled)
 #elif defined(JS_CODEGEN_LOONGARCH64)
    uint8_t* caller = callerRetAddr - sizeof(uint32_t);
    Instruction* callerInsn = reinterpret_cast<Instruction*>(caller);
-    MOZ_ASSERT(callerInsn->extractBitField(31, 26) == ((uint32_t)op_bl >> 26));
+    MOZ_ASSERT(callerInsn->extractOpcode() == ((uint32_t)op_bl >> OpcodeShift));
    int32_t calleeOffset =
        int32_t(reinterpret_cast<InstJump*>(callerInsn)->extractImm26Value() << 8) >> 6;
    void* callee = caller + calleeOffset;
@@ -1442,7 +1442,6 @@ ReloadPrefsCallback(const char* pref, void* data)
    bool extraWarnings = Preferences::GetBool(JS_OPTIONS_DOT_STR "strict");
    
    bool streams = Preferences::GetBool(JS_OPTIONS_DOT_STR "streams");
-    bool weakRefs = Preferences::GetBool(JS_OPTIONS_DOT_STR "weakrefs");

    bool unboxedObjects = Preferences::GetBool(JS_OPTIONS_DOT_STR "unboxed_objects");
    
@@ -1469,8 +1468,7 @@ ReloadPrefsCallback(const char* pref, void* data)
                             .setWerror(werror)
                             .setExtraWarnings(extraWarnings)
                             .setArrayProtoValues(arrayProtoValues)
-                             .setStreams(streams)
-                             .setWeakRefs(weakRefs);
+                             .setStreams(streams);

    JS_SetParallelParsingEnabled(cx, parallelParsing);
    JS_SetOffthreadIonCompilationEnabled(cx, offthreadIonCompilation);
@@ -411,6 +411,13 @@ DottedCornerFinder::FindBestOverlap(Float aMinR, Float aMinBorderRadius,
        mCount = mMaxCount;
        break;
      }
+      // GetCountAndLastOverlap() failed without writing |count| and
+      // |actualOverlap|: the walk needed more than mMaxCount circles, i.e.
+      // this overlap produces too many circles.  Narrow the search toward
+      // smaller overlaps.
+      upper = overlap;
+      overlap = (upper + lower) / 2.0f;
+      continue;
    }

    if (j == 0) {
@@ -318,7 +318,11 @@ nsHTMLFramesetFrame::Init(nsIContent*       aContent,
        mChildFrameborder[mChildCount] = GetFrameBorder(child);
        mChildBorderColors[mChildCount].Set(GetBorderColor(child));
      }
-      child->SetPrimaryFrame(frame);
+      if (MOZ_LIKELY(!child->GetPrimaryFrame())) {
+        // Child might have a pre-existing primary frame if we're doing fixed-pos
+        // replication... So, only set it if there is no primary frame yet.
+        child->SetPrimaryFrame(frame);
+      }

      mFrames.AppendFrame(nullptr, frame);

@@ -318,7 +318,7 @@ nsCaseTransformTextRunFactory::TransformString(
                                     // in the output string
  uint32_t irishMarkSrc = uint32_t(-1); // corresponding location in source
                                        // string (may differ from output due to
-                                        // expansions)
+                                        // expansions like eszet -> 'SS')

  for (uint32_t i = 0; i < length; ++i, ++aOffsetInTextRun) {
    uint32_t ch = str[i];
@@ -604,13 +604,6 @@ nsCaseTransformTextRunFactory::TransformString(
        // to check for special uppercase (ß)
      }

-      // Updated mapping for Germen eszett, not currently reflected in the
-      // Unicode data files.
-      if (ch == 0x00DF) {
-        ch = 0x1E9E;
-        break;
-      }
-
      mcm = mozilla::unicode::SpecialUpper(ch);
      if (mcm) {
        int j = 0;
@@ -665,12 +658,6 @@ nsCaseTransformTextRunFactory::TransformString(
            }
          }

-          // Updated mapping for Germen eszett as a capital letter.
-          if (ch == 0x00DF) {
-            ch = 0x1E9E;
-            break;
-          }
-
          mcm = mozilla::unicode::SpecialTitle(ch);
          if (mcm) {
            int j = 0;
@@ -953,12 +953,11 @@ inDOMUtils::GetCSSValuesForProperty(const nsAString& aProperty,
      GetOtherValuesForProperty(propertyParserVariant, array);
    }
  }
-  // All CSS properties take initial, inherit, unset, revert, and revert-layer.
+  // All CSS properties take initial, inherit, unset, and revert.
  InsertNoDuplicates(array, NS_LITERAL_STRING("initial"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("inherit"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("unset"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("revert"));
-  InsertNoDuplicates(array, NS_LITERAL_STRING("revert-layer"));

  *aLength = array.Length();
  char16_t** ret =
@@ -8,227 +8,19 @@
 #include "CSSVariableDeclarations.h"

 #include "CSSVariableResolver.h"
-#include "CSSVariableValues.h"
 #include "nsCSSScanner.h"
 #include "nsRuleData.h"

-// These special string values are used to represent specified values of
-// CSS-wide keywords.  (Note that none of these are valid variable values.)
+// These four special string values are used to represent specified values of
+// 'initial', 'inherit', 'unset', and 'revert'.  (Note that none of these are
+// valid variable values.)
 #define INITIAL_VALUE "!"
 #define INHERIT_VALUE ";"
 #define UNSET_VALUE   ")"
 #define REVERT_VALUE  ">"
-#define REVERT_LAYER_VALUE  "]"
-
-static const int32_t kRevertLayerMask = 0x000fffff;
-static const int32_t kRevertLayerImportant = 0x00100000;
-static const int32_t kRevertLayerOriginShift = 21;
-static const int32_t kLayerIndexMax = 0x000fffff;
-static const int32_t kCascadeRankStride = kLayerIndexMax + 1;

 namespace mozilla {

-static bool
-IsRevertLayerValue(const nsString& aValue)
-{
-  return StringBeginsWith(aValue, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
-}
-
-static bool
-ValueMightResolveToRevertLayer(const nsString& aValue)
-{
-  return IsRevertLayerValue(aValue) ||
-         aValue.Find(NS_LITERAL_STRING("revert-layer")) != kNotFound;
-}
-
-static int32_t
-PackRevertLayerData(SheetType aLevel, bool aIsImportant,
-                    int32_t aLayerIndex)
-{
-  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask);
-  return (uint32_t(aLevel) << kRevertLayerOriginShift) |
-         (aIsImportant ? kRevertLayerImportant : 0) |
-         (aLayerIndex & kRevertLayerMask);
-}
-
-static void
-SetRevertLayerData(nsString& aValue, const nsRuleData* aRuleData)
-{
-  aValue.AssignLiteral(REVERT_LAYER_VALUE);
-  aValue.AppendInt(PackRevertLayerData(aRuleData->mLevel,
-                                       aRuleData->mIsImportantRule,
-                                       aRuleData->mLayerIndex));
-}
-
-static bool
-UnpackRevertLayerData(const nsString& aValue, SheetType& aLevel,
-                      bool& aIsImportant, int32_t& aLayerIndex)
-{
-  if (!IsRevertLayerValue(aValue) ||
-      aValue.Length() == NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()) {
-    return false;
-  }
-
-  nsresult rv;
-  nsAutoString metadata;
-  metadata.Assign(Substring(aValue,
-                            NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()));
-  int32_t packed = metadata.ToInteger(&rv);
-  if (NS_FAILED(rv)) {
-    return false;
-  }
-
-  aLevel = SheetType(uint32_t(packed) >> kRevertLayerOriginShift);
-  aIsImportant = (packed & kRevertLayerImportant) != 0;
-  aLayerIndex = packed & kRevertLayerMask;
-  return true;
-}
-
-static int32_t
-LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
-{
-  MOZ_ASSERT(aLayerIndex >= 0);
-  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
-  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
-}
-
-static int32_t
-CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
-                      int32_t aLayerIndex)
-{
-  int32_t bucket = 0;
-  bool isLayeredOrigin = false;
-
-  switch (aLevel) {
-    case SheetType::Agent:
-      bucket = aIsImportant ? 14 : 0;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::User:
-      bucket = aIsImportant ? 13 : 1;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::PresHint:
-      bucket = 2;
-      break;
-    case SheetType::SVGAttrAnimation:
-      bucket = 3;
-      break;
-    case SheetType::Doc:
-      bucket = aIsImportant ? 10 : 4;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::ScopedDoc:
-      bucket = aIsImportant ? 9 : 5;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::StyleAttr:
-      bucket = aIsImportant ? 11 : 6;
-      break;
-    case SheetType::Override:
-      bucket = aIsImportant ? 12 : 7;
-      break;
-    case SheetType::Animation:
-      bucket = 8;
-      break;
-    case SheetType::Transition:
-      bucket = 15;
-      break;
-    default:
-      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
-      break;
-  }
-
-  return bucket * kCascadeRankStride +
-         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
-}
-
-static bool
-ShouldIgnoreForRevertLayerData(SheetType aSourceLevel,
-                               bool aSourceImportant,
-                               int32_t aSourceLayerIndex,
-                               SheetType aCandidateLevel,
-                               bool aCandidateImportant,
-                               int32_t aCandidateLayerIndex)
-{
-  int32_t candidateRank =
-    CascadePrecedenceRank(aCandidateLevel, aCandidateImportant,
-                          aCandidateLayerIndex);
-  int32_t sourceRank =
-    CascadePrecedenceRank(aSourceLevel, aSourceImportant, aSourceLayerIndex);
-
-  if (candidateRank >= sourceRank) {
-    return true;
-  }
-
-  if (!aSourceImportant) {
-    return false;
-  }
-
-  if (aSourceLevel == SheetType::StyleAttr) {
-    return aCandidateLevel == SheetType::StyleAttr ||
-           aCandidateLevel == SheetType::Animation;
-  }
-
-  int32_t normalBoundary =
-    CascadePrecedenceRank(aSourceLevel, false, aSourceLayerIndex);
-  return candidateRank >= normalBoundary;
-}
-
-static bool
-ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
-                                SheetType aCandidateLevel,
-                                bool aCandidateImportant,
-                                int32_t aCandidateLayerIndex)
-{
-  SheetType sourceLevel;
-  bool sourceImportant;
-  int32_t sourceLayerIndex;
-  if (!UnpackRevertLayerData(aTargetValue, sourceLevel, sourceImportant,
-                             sourceLayerIndex)) {
-    return false;
-  }
-
-  return ShouldIgnoreForRevertLayerData(sourceLevel, sourceImportant,
-                                        sourceLayerIndex, aCandidateLevel,
-                                        aCandidateImportant,
-                                        aCandidateLayerIndex);
-}
-
-static bool
-ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
-                                const nsRuleData* aRuleData)
-{
-  return ShouldIgnoreForRevertLayerValue(aTargetValue, aRuleData->mLevel,
-                                         aRuleData->mIsImportantRule,
-                                         aRuleData->mLayerIndex);
-}
-
-static bool
-ShouldIgnoreForRevertLayerSourceValue(const nsString& aTargetValue,
-                                      const nsString& aCandidateValue)
-{
-  SheetType candidateLevel;
-  bool candidateImportant;
-  int32_t candidateLayerIndex;
-  if (!UnpackRevertLayerData(aCandidateValue, candidateLevel,
-                             candidateImportant, candidateLayerIndex)) {
-    return false;
-  }
-
-  return ShouldIgnoreForRevertLayerValue(aTargetValue, candidateLevel,
-                                         candidateImportant,
-                                         candidateLayerIndex);
-}
-
-static bool
-IsComputedRevertLayerValue(const nsString& aValue)
-{
-  nsAutoString trimmed(aValue);
-  trimmed.CompressWhitespace(true, true);
-  return trimmed.EqualsLiteral("revert-layer");
-}
-
 CSSVariableDeclarations::CSSVariableDeclarations()
 {
  MOZ_COUNT_CTOR(CSSVariableDeclarations);
@@ -255,8 +47,6 @@ CSSVariableDeclarations::operator=(const CSSVariableDeclarations& aOther)
  }

  mVariables.Clear();
-  mRevertLayerSources.Clear();
-  mRevertLayerFallbacks.Clear();
  CopyVariablesFrom(aOther);
  return *this;
 }
@@ -267,15 +57,6 @@ CSSVariableDeclarations::CopyVariablesFrom(const CSSVariableDeclarations& aOther
  for (auto iter = aOther.mVariables.ConstIter(); !iter.Done(); iter.Next()) {
    mVariables.Put(iter.Key(), iter.UserData());
  }
-  for (auto iter = aOther.mRevertLayerSources.ConstIter();
-       !iter.Done(); iter.Next()) {
-    mRevertLayerSources.Put(iter.Key(), iter.UserData());
-  }
-  for (auto iter = aOther.mRevertLayerFallbacks.ConstIter();
-       !iter.Done(); iter.Next()) {
-    RevertLayerFallbackList* list = mRevertLayerFallbacks.LookupOrAdd(iter.Key());
-    list->mItems = iter.UserData()->mItems;
-  }
 }

 bool
@@ -306,9 +87,6 @@ CSSVariableDeclarations::Get(const nsAString& aName,
  } else if (value.EqualsLiteral(REVERT_VALUE)) {
    aType = eRevert;
    aTokenStream.Truncate();
-  } else if (IsRevertLayerValue(value)) {
-    aType = eRevertLayer;
-    aTokenStream.Truncate();
  } else {
    aType = eTokenStream;
    aTokenStream = value;
@@ -323,8 +101,7 @@ CSSVariableDeclarations::PutTokenStream(const nsAString& aName,
  MOZ_ASSERT(!aTokenStream.EqualsLiteral(INITIAL_VALUE) &&
             !aTokenStream.EqualsLiteral(INHERIT_VALUE) &&
             !aTokenStream.EqualsLiteral(UNSET_VALUE) &&
-             !aTokenStream.EqualsLiteral(REVERT_VALUE) &&
-             !aTokenStream.EqualsLiteral(REVERT_LAYER_VALUE));
+             !aTokenStream.EqualsLiteral(REVERT_VALUE));
  mVariables.Put(aName, aTokenStream);
 }

@@ -352,12 +129,6 @@ CSSVariableDeclarations::PutRevert(const nsAString& aName)
  mVariables.Put(aName, NS_LITERAL_STRING(REVERT_VALUE));
 }

-void
-CSSVariableDeclarations::PutRevertLayer(const nsAString& aName)
-{
-  mVariables.Put(aName, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
-}
-
 void
 CSSVariableDeclarations::Remove(const nsAString& aName)
 {
@@ -372,49 +143,16 @@ CSSVariableDeclarations::MapRuleInfoInto(nsRuleData* aRuleData)
  }

  if (!aRuleData->mVariables) {
-    aRuleData->mVariables = new CSSVariableDeclarations;
-  }
-
-  for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
-    nsDataHashtable<nsStringHashKey, nsString>& variables =
-      aRuleData->mVariables->mVariables;
-    const nsAString& name = iter.Key();
-    nsString value = iter.UserData();
-    nsString valueSource;
-    SetRevertLayerData(valueSource, aRuleData);
-    if (value.EqualsLiteral(REVERT_LAYER_VALUE)) {
-      value = valueSource;
-      aRuleData->mConditions.SetUncacheable();
-    }
-
-    nsString existingValue;
-    if (variables.Get(name, &existingValue)) {
-      if (IsRevertLayerValue(existingValue)) {
-        if (ShouldIgnoreForRevertLayerValue(existingValue, aRuleData)) {
-          continue;
-        }
-      } else {
-        nsString sourceValue;
-        if (aRuleData->mVariables->mRevertLayerSources.Get(name,
-                                                           &sourceValue) &&
-            !ShouldIgnoreForRevertLayerValue(sourceValue, aRuleData)) {
-          RevertLayerFallbackList* fallbacks =
-            aRuleData->mVariables->mRevertLayerFallbacks.LookupOrAdd(name);
-          RevertLayerFallback* fallback = fallbacks->mItems.AppendElement();
-          fallback->mValue = value;
-          fallback->mSource = valueSource;
-        }
-        continue;
+    aRuleData->mVariables = new CSSVariableDeclarations(*this);
+  } else {
+    for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
+      nsDataHashtable<nsStringHashKey, nsString>& variables =
+        aRuleData->mVariables->mVariables;
+      const nsAString& aName = iter.Key();
+      if (!variables.Contains(aName)) {
+        variables.Put(aName, iter.UserData());
      }
    }
-
-    variables.Put(name, value);
-    if (ValueMightResolveToRevertLayer(value)) {
-      aRuleData->mVariables->mRevertLayerSources.Put(name, valueSource);
-    } else {
-      aRuleData->mVariables->mRevertLayerSources.Remove(name);
-      aRuleData->mVariables->mRevertLayerFallbacks.Remove(name);
-    }
  }
 }

@@ -434,9 +172,8 @@ CSSVariableDeclarations::AddVariablesToResolver(
                     false);
    } else if (value.EqualsLiteral(INHERIT_VALUE) ||
               value.EqualsLiteral(UNSET_VALUE) ||
-               value.EqualsLiteral(REVERT_VALUE) ||
-               IsRevertLayerValue(value)) {
-      // Values of 'inherit', 'unset', 'revert', and 'revert-layer' don't need any handling,
+               value.EqualsLiteral(REVERT_VALUE)) {
+      // Values of 'inherit', 'unset', and 'revert' don't need any handling,
      // since it means we just need to keep whatever value is currently in
      // the resolver.  This is because the specified variable declarations
      // already have only the winning declaration for the variable and no
@@ -453,83 +190,6 @@ CSSVariableDeclarations::AddVariablesToResolver(
  }
 }

-void
-CSSVariableDeclarations::ResolveRevertLayerFallbacks(
-                                             const CSSVariableValues* aInherited,
-                                             CSSVariableValues* aOutput) const
-{
-  for (auto iter = mRevertLayerSources.ConstIter();
-       !iter.Done(); iter.Next()) {
-    const nsAString& name = iter.Key();
-    nsString value;
-    nsCSSTokenSerializationType firstToken, lastToken;
-    if (!aOutput->Get(name, value, firstToken, lastToken)) {
-      continue;
-    }
-
-    if (!IsComputedRevertLayerValue(value)) {
-      continue;
-    }
-
-    const RevertLayerFallbackList* fallbacks = mRevertLayerFallbacks.Get(name);
-    if (fallbacks) {
-      nsString sourceValue = iter.UserData();
-      bool foundFallback = false;
-      for (uint32_t i = 0, n = fallbacks->mItems.Length(); i < n; i++) {
-        const RevertLayerFallback& fallback = fallbacks->mItems[i];
-        if (ShouldIgnoreForRevertLayerSourceValue(sourceValue,
-                                                 fallback.mSource)) {
-          continue;
-        }
-
-        if (IsRevertLayerValue(fallback.mValue)) {
-          sourceValue = fallback.mSource;
-          continue;
-        }
-
-        CSSVariableValues inheritedValues(*aOutput);
-        if (aInherited->Get(name, value, firstToken, lastToken)) {
-          inheritedValues.Put(name, value, firstToken, lastToken);
-        } else {
-          inheritedValues.Remove(name);
-        }
-
-        CSSVariableDeclarations fallbackDeclarations;
-        fallbackDeclarations.mVariables.Put(name, fallback.mValue);
-
-        CSSVariableValues fallbackValues;
-        CSSVariableResolver resolver(&fallbackValues);
-        resolver.Resolve(&inheritedValues, &fallbackDeclarations);
-
-        if (!fallbackValues.Get(name, value, firstToken, lastToken)) {
-          aOutput->Remove(name);
-          foundFallback = true;
-          break;
-        }
-
-        if (IsComputedRevertLayerValue(value)) {
-          sourceValue = fallback.mSource;
-          continue;
-        }
-
-        aOutput->Put(name, value, firstToken, lastToken);
-        foundFallback = true;
-        break;
-      }
-
-      if (foundFallback) {
-        continue;
-      }
-    }
-
-    if (aInherited->Get(name, value, firstToken, lastToken)) {
-      aOutput->Put(name, value, firstToken, lastToken);
-    } else {
-      aOutput->Remove(name);
-    }
-  }
-}
-
 size_t
 CSSVariableDeclarations::SizeOfIncludingThis(
                                      mozilla::MallocSizeOf aMallocSizeOf) const
@@ -540,22 +200,6 @@ CSSVariableDeclarations::SizeOfIncludingThis(
    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
    n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
  }
-  n += mRevertLayerSources.ShallowSizeOfExcludingThis(aMallocSizeOf);
-  for (auto iter = mRevertLayerSources.ConstIter(); !iter.Done(); iter.Next()) {
-    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
-    n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
-  }
-  n += mRevertLayerFallbacks.ShallowSizeOfExcludingThis(aMallocSizeOf);
-  for (auto iter = mRevertLayerFallbacks.ConstIter(); !iter.Done(); iter.Next()) {
-    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
-    const RevertLayerFallbackList* list = iter.UserData();
-    n += aMallocSizeOf(list);
-    n += list->mItems.ShallowSizeOfExcludingThis(aMallocSizeOf);
-    for (uint32_t i = 0, len = list->mItems.Length(); i < len; i++) {
-      n += list->mItems[i].mValue.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
-      n += list->mItems[i].mSource.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
-    }
-  }
  return n;
 }

@@ -7,13 +7,10 @@
 #ifndef mozilla_CSSVariableDeclarations_h
 #define mozilla_CSSVariableDeclarations_h

-#include "nsClassHashtable.h"
 #include "nsDataHashtable.h"
-#include "nsTArray.h"

 namespace mozilla {
 class CSSVariableResolver;
-class CSSVariableValues;
 } // namespace mozilla
 struct nsRuleData;

@@ -46,8 +43,7 @@ public:
    eInitial,      // 'initial'
    eInherit,      // 'inherit'
    eUnset,        // 'unset'
-    eRevert,       // 'revert'
-    eRevertLayer   // 'revert-layer'
+    eRevert        // 'revert'
  };

  /**
@@ -101,15 +97,6 @@ public:
   */
  void PutRevert(const nsAString& aName);

-  /**
-   * Adds or modifies an existing entry in this set of variable declarations
-   * to have the value 'revert-layer'.
-   *
-   * @param aName The variable name (not including any "--" prefix that would
-   *   be part of the custom property name) whose value is to be set.
-   */
-  void PutRevertLayer(const nsAString& aName);
-
  /**
   * Adds or modifies an existing entry in this set of variable declarations
   * to have a token stream value.
@@ -145,36 +132,15 @@ public:
   */
  void AddVariablesToResolver(CSSVariableResolver* aResolver) const;

-  /**
-   * Applies stored lower-priority declarations for custom property values that
-   * resolved to 'revert-layer'.
-   */
-  void ResolveRevertLayerFallbacks(const CSSVariableValues* aInherited,
-                                   CSSVariableValues* aOutput) const;
-
  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;

 private:
-  struct RevertLayerFallback
-  {
-    nsString mValue;
-    nsString mSource;
-  };
-
-  struct RevertLayerFallbackList
-  {
-    nsTArray<RevertLayerFallback> mItems;
-  };
-
  /**
   * Adds all the variable declarations from aOther into this object.
   */
  void CopyVariablesFrom(const CSSVariableDeclarations& aOther);

  nsDataHashtable<nsStringHashKey, nsString> mVariables;
-  nsDataHashtable<nsStringHashKey, nsString> mRevertLayerSources;
-  nsClassHashtable<nsStringHashKey, RevertLayerFallbackList>
-    mRevertLayerFallbacks;
 };

 } // namespace mozilla
@@ -121,21 +121,6 @@ CSSVariableValues::Put(const nsAString& aName,
  }
 }

-void
-CSSVariableValues::Remove(const nsAString& aName)
-{
-  size_t id;
-  if (!mVariableIDs.Get(aName, &id)) {
-    return;
-  }
-
-  mVariables.RemoveElementAt(id);
-  mVariableIDs.Clear();
-  for (size_t i = 0, n = mVariables.Length(); i < n; i++) {
-    mVariableIDs.Put(mVariables[i].mVariableName, i);
-  }
-}
-
 void
 CSSVariableValues::CopyVariablesFrom(const CSSVariableValues& aOther)
 {
@@ -94,11 +94,6 @@ public:
           nsCSSTokenSerializationType aFirstToken,
           nsCSSTokenSerializationType aLastToken);

-  /**
-   * Removes an entry in this set of variable values.
-   */
-  void Remove(const nsAString& aName);
-
  /**
   * Copies the variables from this object into aResolver, marking them as
   * computed, inherited values.
@@ -576,7 +576,6 @@ Declaration::GetPropertyValueInternal(
  const nsCSSValue* tokenStream = nullptr;
  uint32_t totalCount = 0, importantCount = 0,
           initialCount = 0, inheritCount = 0, unsetCount = 0, revertCount = 0,
-           revertLayerCount = 0,
           matchingTokenStreamCount = 0, nonMatchingTokenStreamCount = 0;
  CSSPROPS_FOR_SHORTHAND_SUBPROPERTIES(p, aProperty,
                                       CSSEnabledState::eForAllContent) {
@@ -604,8 +603,6 @@ Declaration::GetPropertyValueInternal(
      ++unsetCount;
    } else if (val->GetUnit() == eCSSUnit_Revert) {
      ++revertCount;
-    } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
-      ++revertLayerCount;
    } else if (val->GetUnit() == eCSSUnit_TokenStream) {
      if (val->GetTokenStreamValue()->mShorthandPropertyID == aProperty) {
        tokenStream = val;
@@ -643,19 +640,9 @@ Declaration::GetPropertyValueInternal(
                                              nsCSSValue::eNormalized);
    return;
  }
-  if (revertLayerCount == totalCount) {
-    // Simplify serialization below by serializing revert-layer up-front.
-    nsCSSValue revertLayer;
-    revertLayer.SetRevertLayerValue();
-    revertLayer.AppendToString(eCSSProperty_UNKNOWN, aValue,
-                               nsCSSValue::eNormalized);
-    return;
-  }
  if (initialCount != 0 || inheritCount != 0 || unsetCount != 0 ||
-      revertCount != 0 || revertLayerCount != 0 ||
-      nonMatchingTokenStreamCount != 0) {
-    // Case (2): partially initial, inherit, unset, revert, revert-layer,
-    // or token stream.
+      revertCount != 0 || nonMatchingTokenStreamCount != 0) {
+    // Case (2): partially initial, inherit, unset, revert, or token stream.
    return;
  }
  if (tokenStream) {
@@ -1548,7 +1535,6 @@ Declaration::GetPropertyValueInternal(
          case eCSSUnit_Initial:
          case eCSSUnit_Unset:
          case eCSSUnit_Revert:
-          case eCSSUnit_RevertLayer:
            return true;
          case eCSSUnit_Enumerated:
            // return false if there is a fallback value or <overflow-position>
@@ -1763,10 +1749,6 @@ Declaration::AppendVariableAndValueToString(const nsAString& aName,
      aResult.AppendLiteral("revert");
      break;

-    case CSSVariableDeclarations::eRevertLayer:
-      aResult.AppendLiteral("revert-layer");
-      break;
-
    default:
      MOZ_ASSERT(false, "unexpected variable value type");
  }
@@ -2007,10 +1989,6 @@ Declaration::GetVariableValue(const nsAString& aName, nsAString& aValue) const
        aValue.AppendLiteral("revert");
        break;

-      case CSSVariableDeclarations::eRevertLayer:
-        aValue.AppendLiteral("revert-layer");
-        break;
-
      default:
        MOZ_ASSERT(false, "unexpected variable value type");
    }
@@ -2081,11 +2059,6 @@ Declaration::AddVariable(const nsAString& aName,
      variables->PutRevert(aName);
      break;

-    case CSSVariableDeclarations::eRevertLayer:
-      MOZ_ASSERT(aValue.IsEmpty());
-      variables->PutRevertLayer(aName);
-      break;
-
    default:
      MOZ_ASSERT(false, "unexpected aType value");
  }
@@ -489,7 +489,7 @@ public:
  void SetNoneValue();
  void SetIntValue(int32_t aInt, Unit aUnit);
  template<typename T,
-           typename = typename std::enable_if_t<std::is_enum_v<T>>>
+           typename = typename std::enable_if<std::is_enum<T>::value>::type>
  void SetIntValue(T aInt, Unit aUnit)
  {
    static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,
@@ -48,102 +48,6 @@ ShouldIgnoreColors(nsRuleData *aRuleData)
         !aRuleData->mPresContext->UseDocumentColors();
 }

-static const int32_t kLayerIndexMax = 0x000fffff;
-static const int32_t kCascadeRankStride = kLayerIndexMax + 1;
-
-static int32_t
-LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
-{
-  MOZ_ASSERT(aLayerIndex >= 0);
-  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
-  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
-}
-
-static int32_t
-CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
-                      int32_t aLayerIndex)
-{
-  int32_t bucket = 0;
-  bool isLayeredOrigin = false;
-
-  switch (aLevel) {
-    case SheetType::Agent:
-      bucket = aIsImportant ? 14 : 0;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::User:
-      bucket = aIsImportant ? 13 : 1;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::PresHint:
-      bucket = 2;
-      break;
-    case SheetType::SVGAttrAnimation:
-      bucket = 3;
-      break;
-    case SheetType::Doc:
-      bucket = aIsImportant ? 10 : 4;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::ScopedDoc:
-      bucket = aIsImportant ? 9 : 5;
-      isLayeredOrigin = true;
-      break;
-    case SheetType::StyleAttr:
-      bucket = aIsImportant ? 11 : 6;
-      break;
-    case SheetType::Override:
-      bucket = aIsImportant ? 12 : 7;
-      break;
-    case SheetType::Animation:
-      bucket = 8;
-      break;
-    case SheetType::Transition:
-      bucket = 15;
-      break;
-    default:
-      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
-      break;
-  }
-
-  return bucket * kCascadeRankStride +
-         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
-}
-
-static bool
-ShouldIgnoreForRevertLayer(const nsCSSValue& aTargetValue,
-                           const nsRuleData* aRuleData)
-{
-  SheetType sourceLevel = aTargetValue.GetRevertLayerOriginValue();
-  bool sourceImportant = aTargetValue.GetRevertLayerImportanceValue();
-  int32_t sourceLayerIndex = aTargetValue.GetRevertLayerLayerIndexValue();
-  MOZ_ASSERT(sourceLevel != SheetType::Unknown,
-             "revert-layer should have cascade metadata before mapping");
-
-  int32_t candidateRank =
-    CascadePrecedenceRank(aRuleData->mLevel, aRuleData->mIsImportantRule,
-                          aRuleData->mLayerIndex);
-  int32_t sourceRank =
-    CascadePrecedenceRank(sourceLevel, sourceImportant, sourceLayerIndex);
-
-  if (candidateRank >= sourceRank) {
-    return true;
-  }
-
-  if (!sourceImportant) {
-    return false;
-  }
-
-  if (sourceLevel == SheetType::StyleAttr) {
-    return aRuleData->mLevel == SheetType::StyleAttr ||
-           aRuleData->mLevel == SheetType::Animation;
-  }
-
-  int32_t normalBoundary =
-    CascadePrecedenceRank(sourceLevel, false, sourceLayerIndex);
-  return candidateRank >= normalBoundary;
-}
-
 /**
 * Tries to call |nsCSSValue::StartImageLoad()| on an image source.
 * Image sources are specified by |url()| or |-moz-image-rect()| function.
@@ -271,8 +175,7 @@ MapSinglePropertyInto(nsCSSPropertyID aTargetProp,
  // CSSVariableImageTable, to give them the appropriate lifetime.
  MOZ_ASSERT(aTargetValue->GetUnit() == eCSSUnit_TokenStream ||
             aTargetValue->GetUnit() == eCSSUnit_Null ||
-             aTargetValue->GetUnit() == eCSSUnit_Revert ||
-             aTargetValue->GetUnit() == eCSSUnit_RevertLayer,
+             aTargetValue->GetUnit() == eCSSUnit_Revert,
             "aTargetValue must only be a token stream (when re-parsing "
             "properties with variable references) or null");

@@ -462,10 +365,6 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
        if (aRuleData->mLevel >= target->GetCascadeOriginValue()) {
          continue;
        }
-      } else if (target->GetUnit() == eCSSUnit_RevertLayer) {
-        if (ShouldIgnoreForRevertLayer(*target, aRuleData)) {
-          continue;
-        }
      } else if (target->GetUnit() != eCSSUnit_Null) {
        continue;
      }
@@ -478,18 +377,8 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
      // the rule walking will have just updated aRuleData.
      if (val->GetUnit() == eCSSUnit_TokenStream) {
        val->GetTokenStreamValue()->mLevel = aRuleData->mLevel;
-        val->GetTokenStreamValue()->mIsImportant = aRuleData->mIsImportantRule;
-        val->GetTokenStreamValue()->mLayerIndex = aRuleData->mLayerIndex;
      } else if (val->GetUnit() == eCSSUnit_Revert) {
        aRuleData->mConditions.SetUncacheable();
-      } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
-        nsCSSValue revertLayer;
-        revertLayer.SetRevertLayerValue(aRuleData->mLevel,
-                                        aRuleData->mIsImportantRule,
-                                        aRuleData->mLayerIndex);
-        aRuleData->mConditions.SetUncacheable();
-        MapSinglePropertyInto(iProp, &revertLayer, target, aRuleData);
-        continue;
      }
      MapSinglePropertyInto(iProp, val, target, aRuleData);
    }
@@ -930,17 +819,6 @@ nsCSSExpandedDataBlock::MapRuleInfoInto(nsCSSPropertyID aPropID,
  MOZ_ASSERT(dest->GetUnit() == eCSSUnit_TokenStream &&
             dest->GetTokenStreamValue()->mPropertyID == aPropID);

-  if (src->GetUnit() == eCSSUnit_RevertLayer) {
-    nsCSSValueTokenStream* tokenStream = dest->GetTokenStreamValue();
-    nsCSSValue revertLayer;
-    revertLayer.SetRevertLayerValue(tokenStream->mLevel,
-                                    tokenStream->mIsImportant,
-                                    tokenStream->mLayerIndex);
-    aRuleData->mConditions.SetUncacheable();
-    MapSinglePropertyInto(physicalProp, &revertLayer, dest, aRuleData);
-    return;
-  }
-
  CSSVariableImageTable::ReplaceAll(aRuleData->mStyleContext, aPropID, [=] {
    MapSinglePropertyInto(physicalProp, src, dest, aRuleData);
  });
@@ -481,7 +481,6 @@ CSS_KEY(repeat-x, repeat_x)
 CSS_KEY(repeat-y, repeat_y)
 CSS_KEY(reverse, reverse)
 CSS_KEY(revert, revert)
-CSS_KEY(revert-layer, revert_layer)
 CSS_KEY(ridge, ridge)
 CSS_KEY(right, right)
 CSS_KEY(rl, rl)
@@ -815,3 +814,4 @@ CSS_KEY(text-before-edge, text_before_edge)
 CSS_KEY(use-script, use_script)
 CSS_KEY(-moz-crisp-edges, _moz_crisp_edges)
 CSS_KEY(space, space)
+
@@ -9126,10 +9126,6 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
          aValue.SetRevertValue(mLevel);
          return CSSParseResult::Ok;
        }
-        else if (eCSSKeyword_revert_layer == keyword) {
-          aValue.SetRevertLayerValue();
-          return CSSParseResult::Ok;
-        }
      }
      if ((aVariantMask & VARIANT_NONE) != 0) {
        if (eCSSKeyword_none == keyword) {
@@ -9334,8 +9330,7 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
         tk->mIdent.LowerCaseEqualsLiteral("initial") ||
         (tk->mIdent.LowerCaseEqualsLiteral("unset") &&
          nsLayoutUtils::UnsetValueEnabled()) ||
-         tk->mIdent.LowerCaseEqualsLiteral("revert") ||
-         tk->mIdent.LowerCaseEqualsLiteral("revert-layer")))) {
+         tk->mIdent.LowerCaseEqualsLiteral("revert")))) {
    aValue.SetStringValue(tk->mIdent, eCSSUnit_Ident);
    return CSSParseResult::Ok;
  }
@@ -9411,7 +9406,6 @@ CSSParserImpl::ParseCustomIdent(nsCSSValue& aValue,
      keyword == eCSSKeyword_initial ||
      keyword == eCSSKeyword_unset ||
      keyword == eCSSKeyword_revert ||
-      keyword == eCSSKeyword_revert_layer ||
      keyword == eCSSKeyword_default ||
      (aPropertyKTable &&
        nsCSSProps::FindIndexOfKeyword(keyword, aPropertyKTable) >= 0)) {
@@ -12601,12 +12595,6 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
        }
        found = ((1 << aNumIDs) - 1);
      }
-      else if (eCSSUnit_RevertLayer == aValues[0].GetUnit()) { // one revert-layer, all revert-layer
-        for (loop = 1; loop < aNumIDs; loop++) {
-          aValues[loop].SetRevertLayerValue();
-        }
-        found = ((1 << aNumIDs) - 1);
-      }
    }
    else {  // more than one value, verify no inherits, initials, unsets, or reverts
      for (loop = 0; loop < aNumIDs; loop++) {
@@ -12622,8 +12610,7 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
          found = -1;
          break;
        }
-        else if (eCSSUnit_Revert == aValues[loop].GetUnit() ||
-                 eCSSUnit_RevertLayer == aValues[loop].GetUnit()) {
+        else if (eCSSUnit_Revert == aValues[loop].GetUnit()) {
          found = -1;
          break;
        }
@@ -12671,8 +12658,7 @@ CSSParserImpl::ParseBoxProperties(const nsCSSPropertyID aPropIDs[])
      if (eCSSUnit_Inherit == unit ||
          eCSSUnit_Initial == unit ||
          eCSSUnit_Unset == unit ||
-          eCSSUnit_Revert == unit ||
-          eCSSUnit_RevertLayer == unit) {
+          eCSSUnit_Revert == unit) {
        return false;
      }
    }
@@ -12780,8 +12766,7 @@ CSSParserImpl::ParseBoxCornerRadius(nsCSSPropertyID aPropID)
  if (dimenX.GetUnit() != eCSSUnit_Inherit &&
      dimenX.GetUnit() != eCSSUnit_Initial &&
      dimenX.GetUnit() != eCSSUnit_Unset &&
-      dimenX.GetUnit() != eCSSUnit_Revert &&
-      dimenX.GetUnit() != eCSSUnit_RevertLayer) {
+      dimenX.GetUnit() != eCSSUnit_Revert) {
    if (ParseNonNegativeVariant(dimenY, VARIANT_LP | VARIANT_CALC, nullptr) ==
        CSSParseResult::Error) {
      return false;
@@ -12846,8 +12831,7 @@ CSSParserImpl::ParseBoxCornerRadiiInternals(nsCSSValue array[])
    if (eCSSUnit_Inherit == unit ||
        eCSSUnit_Initial == unit ||
        eCSSUnit_Unset == unit ||
-        eCSSUnit_Revert == unit ||
-        eCSSUnit_RevertLayer == unit)
+        eCSSUnit_Revert == unit)
      return false;
  }

@@ -13658,7 +13642,6 @@ CSSParserImpl::ParseFontDescriptorValue(nsCSSFontDesc aDescID,
            aValue.GetUnit() != eCSSUnit_Initial &&
            aValue.GetUnit() != eCSSUnit_Unset &&
            aValue.GetUnit() != eCSSUnit_Revert &&
-            aValue.GetUnit() != eCSSUnit_RevertLayer &&
            (aValue.GetUnit() != eCSSUnit_Enumerated ||
             (aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_BOLDER &&
              aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_LIGHTER)));
@@ -13922,8 +13905,7 @@ CSSParserImpl::ParseImageLayersItem(
      if (keyword == eCSSKeyword_inherit ||
          keyword == eCSSKeyword_initial ||
          keyword == eCSSKeyword_unset ||
-          keyword == eCSSKeyword_revert ||
-          keyword == eCSSKeyword_revert_layer) {
+          keyword == eCSSKeyword_revert) {
        return false;
      } else if (keyword == eCSSKeyword_none) {
        if (haveImage)
@@ -14280,8 +14262,7 @@ bool CSSParserImpl::ParseBoxPositionValues(nsCSSValuePair &aOut,
    if (eCSSUnit_Inherit == xValue.GetUnit() ||
        eCSSUnit_Initial == xValue.GetUnit() ||
        eCSSUnit_Unset == xValue.GetUnit() ||
-        eCSSUnit_Revert == xValue.GetUnit() ||
-        eCSSUnit_RevertLayer == xValue.GetUnit()) {
+        eCSSUnit_Revert == xValue.GetUnit()) {  // both are inherit, initial, unset, or revert
      yValue = xValue;
      return true;
    }
@@ -15113,7 +15094,6 @@ CSSParserImpl::ParseBorderSide(const nsCSSPropertyID aPropIDs[],
    case eCSSUnit_Initial:
    case eCSSUnit_Unset:
    case eCSSUnit_Revert:
-    case eCSSUnit_RevertLayer:
      extraValue = values[0];
      // Set value of border-image properties to initial/inherit/unset/revert
      AppendValue(eCSSProperty_border_image_source, extraValue);
@@ -15880,8 +15860,7 @@ CSSParserImpl::ParseFont()
    if (eCSSUnit_Inherit == family.GetUnit() ||
        eCSSUnit_Initial == family.GetUnit() ||
        eCSSUnit_Unset == family.GetUnit() ||
-        eCSSUnit_Revert == family.GetUnit() ||
-        eCSSUnit_RevertLayer == family.GetUnit()) {
+        eCSSUnit_Revert == family.GetUnit()) {
      AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
      AppendValue(eCSSProperty_font_family, family);
      AppendValue(eCSSProperty_font_style, family);
@@ -15950,8 +15929,7 @@ CSSParserImpl::ParseFont()
      eCSSUnit_Inherit == values[kFontStyleIndex].GetUnit() ||
      eCSSUnit_Initial == values[kFontStyleIndex].GetUnit() ||
      eCSSUnit_Unset == values[kFontStyleIndex].GetUnit() ||
-      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ||
-      eCSSUnit_RevertLayer == values[kFontStyleIndex].GetUnit() ) { // illegal data
+      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ) { // illegal data
    return false;
  }
  if ((found & (1 << kFontStyleIndex)) == 0) {
@@ -16010,8 +15988,7 @@ CSSParserImpl::ParseFont()
    if (eCSSUnit_Inherit != family.GetUnit() &&
        eCSSUnit_Initial != family.GetUnit() &&
        eCSSUnit_Unset != family.GetUnit() &&
-        eCSSUnit_Revert != family.GetUnit() &&
-        eCSSUnit_RevertLayer != family.GetUnit()) {
+        eCSSUnit_Revert != family.GetUnit()) {
      AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
      AppendValue(eCSSProperty_font_family, family);
      AppendValue(eCSSProperty_font_style, values[kFontStyleIndex]);
@@ -16057,8 +16034,7 @@ CSSParserImpl::ParseFontSynthesis(nsCSSValue& aValue)
      eCSSUnit_Initial == aValue.GetUnit() ||
      eCSSUnit_Inherit == aValue.GetUnit() ||
      eCSSUnit_Unset == aValue.GetUnit() ||
-      eCSSUnit_Revert == aValue.GetUnit() ||
-      eCSSUnit_RevertLayer == aValue.GetUnit() )
+      eCSSUnit_Revert == aValue.GetUnit() )
  {
    return true;
  }
@@ -16681,9 +16657,6 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
      case eCSSKeyword_revert:
        aValue.SetRevertValue(mLevel);
        return true;
-      case eCSSKeyword_revert_layer:
-        aValue.SetRevertLayerValue();
-        return true;
      case eCSSKeyword__moz_use_system_font:
        if (!IsParsingCompoundProperty()) {
          aValue.SetSystemFontValue();
@@ -16718,7 +16691,6 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
        case eCSSKeyword_initial:
        case eCSSKeyword_default:
        case eCSSKeyword_revert:
-        case eCSSKeyword_revert_layer:
        case eCSSKeyword__moz_use_system_font:
          return false;
        case eCSSKeyword_unset:
@@ -18368,8 +18340,7 @@ bool CSSParserImpl::ParseTransformOrigin(bool aPerspective)
  if (position.mXValue.GetUnit() == eCSSUnit_Inherit ||
      position.mXValue.GetUnit() == eCSSUnit_Initial ||
      position.mXValue.GetUnit() == eCSSUnit_Unset ||
-      position.mXValue.GetUnit() == eCSSUnit_Revert ||
-      position.mXValue.GetUnit() == eCSSUnit_RevertLayer) {
+      position.mXValue.GetUnit() == eCSSUnit_Revert) {
    MOZ_ASSERT(position.mXValue == position.mYValue,
               "inherit/initial/unset/revert only half?");
    AppendValue(prop, position.mXValue);
@@ -18593,15 +18564,14 @@ CSSParserImpl::ParseTransitionProperty()
      }
      if (cur->mValue.GetUnit() == eCSSUnit_Ident) {
        nsDependentString str(cur->mValue.GetStringBufferValue());
-        // Exclude CSS-wide keywords and 'none' according to the same rules
-        // as for 'counter-reset' in CSS 2.1.
+        // Exclude 'none', 'inherit', 'initial', 'unset', and 'revert'
+        // according to the same rules as for 'counter-reset' in CSS 2.1.
        if (str.LowerCaseEqualsLiteral("none") ||
            str.LowerCaseEqualsLiteral("inherit") ||
            str.LowerCaseEqualsLiteral("initial") ||
            (str.LowerCaseEqualsLiteral("unset") &&
             nsLayoutUtils::UnsetValueEnabled()) ||
-            str.LowerCaseEqualsLiteral("revert") ||
-            str.LowerCaseEqualsLiteral("revert-layer")) {
+            str.LowerCaseEqualsLiteral("revert")) {
          return false;
        }
      }
@@ -19514,7 +19484,8 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
    }
  }

-  // Look for CSS-wide keywords as the first non-white space token.
+  // Look for 'initial', 'inherit', 'unset', or 'revert' as the first
+  // non-white space token.
  CSSVariableDeclarations::Type type = CSSVariableDeclarations::eTokenStream;
  if (mToken.mType == eCSSToken_Ident) {
    if (mToken.mIdent.LowerCaseEqualsLiteral("initial")) {
@@ -19525,8 +19496,6 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
      type = CSSVariableDeclarations::eUnset;
    } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert")) {
      type = CSSVariableDeclarations::eRevert;
-    } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert-layer")) {
-      type = CSSVariableDeclarations::eRevertLayer;
    }
  }

@@ -44,7 +44,7 @@
 // 'inherit' and 'initial'
 #define VARIANT_OPACITY         0x008000  // Take floats and percents as input, output float.
 #define VARIANT_AUTO            0x010000  // A
-#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert, eCSSUnit_RevertLayer
+#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert
 #define VARIANT_NONE            0x040000  // O
 #define VARIANT_NORMAL          0x080000  // M
 #define VARIANT_SYSFONT         0x100000  // eCSSUnit_System_Font
@@ -364,7 +364,7 @@ public:
    }

    template<typename T,
-             typename = typename std::enable_if_t<std::is_enum_v<T>>>
+             typename = typename std::enable_if<std::is_enum<T>::value>::type>
    KTableEntry(nsCSSKeyword aKeyword, T aValue)
      : mKeyword(aKeyword)
      , mValue(static_cast<int16_t>(aValue))
@@ -451,7 +451,7 @@ public:
  static nsCSSKeyword ValueToKeywordEnum(int32_t aValue,
                                         const KTableEntry aTable[]);
  template<typename T,
-           typename = typename std::enable_if_t<std::is_enum_v<T>>>
+           typename = typename std::enable_if<std::is_enum<T>::value>::type>
  static nsCSSKeyword ValueToKeywordEnum(T aValue,
                                         const KTableEntry aTable[])
  {
@@ -463,7 +463,7 @@ public:
  static const nsAFlatCString& ValueToKeyword(int32_t aValue,
                                              const KTableEntry aTable[]);
  template<typename T,
-           typename = typename std::enable_if_t<std::is_enum_v<T>>>
+           typename = typename std::enable_if<std::is_enum<T>::value>::type>
  static const nsAFlatCString& ValueToKeyword(T aValue,
                                              const KTableEntry aTable[])
  {
@@ -192,9 +192,6 @@ nsCSSValue::nsCSSValue(const nsCSSValue& aCopy)
  else if (eCSSUnit_Revert == mUnit) {
    mValue.mCascadeOrigin = aCopy.mValue.mCascadeOrigin;
  }
-  else if (eCSSUnit_RevertLayer == mUnit) {
-    mValue.mInt = aCopy.mValue.mInt;
-  }
  else if (UnitHasArrayValue()) {
    mValue.mArray = aCopy.mValue.mArray;
    mValue.mArray->AddRef();
@@ -319,9 +316,6 @@ bool nsCSSValue::operator==(const nsCSSValue& aOther) const
    else if (eCSSUnit_Revert == mUnit) {
      return mValue.mCascadeOrigin == aOther.mValue.mCascadeOrigin;
    }
-    else if (eCSSUnit_RevertLayer == mUnit) {
-      return mValue.mInt == aOther.mValue.mInt;
-    }
    else if (UnitHasArrayValue()) {
      return *mValue.mArray == *aOther.mValue.mArray;
    }
@@ -599,31 +593,6 @@ nsCSSValue::SetCascadeOriginValue(mozilla::SheetType aValue, nsCSSUnit aUnit)
  mValue.mCascadeOrigin = aValue;
 }

-static const int32_t kRevertLayerMask = 0x000fffff;
-static const int32_t kRevertLayerImportant = 0x00100000;
-static const int32_t kRevertLayerOriginShift = 21;
-
-mozilla::SheetType
-nsCSSValue::GetRevertLayerOriginValue() const
-{
-  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
-  return mozilla::SheetType(uint32_t(mValue.mInt) >> kRevertLayerOriginShift);
-}
-
-bool
-nsCSSValue::GetRevertLayerImportanceValue() const
-{
-  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
-  return (mValue.mInt & kRevertLayerImportant) != 0;
-}
-
-int32_t
-nsCSSValue::GetRevertLayerLayerIndexValue() const
-{
-  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
-  return mValue.mInt & kRevertLayerMask;
-}
-
 void nsCSSValue::SetArrayValue(nsCSSValue::Array* aValue, nsCSSUnit aUnit)
 {
  Reset();
@@ -694,9 +663,7 @@ void nsCSSValue::SetPairValue(const nsCSSValuePair* aValue)
             aValue->mXValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mYValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
-             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer,
+             aValue->mYValue.GetUnit() != eCSSUnit_Revert,
             "missing or inappropriate pair value");
  Reset();
  mUnit = eCSSUnit_Pair;
@@ -716,9 +683,7 @@ void nsCSSValue::SetPairValue(const nsCSSValue& xValue,
             xValue.GetUnit() != eCSSUnit_Unset &&
             yValue.GetUnit() != eCSSUnit_Unset &&
             xValue.GetUnit() != eCSSUnit_Revert &&
-             yValue.GetUnit() != eCSSUnit_Revert &&
-             xValue.GetUnit() != eCSSUnit_RevertLayer &&
-             yValue.GetUnit() != eCSSUnit_RevertLayer,
+             yValue.GetUnit() != eCSSUnit_Revert,
             "inappropriate pair value");
  Reset();
  mUnit = eCSSUnit_Pair;
@@ -744,10 +709,7 @@ void nsCSSValue::SetTripletValue(const nsCSSValueTriplet* aValue)
             aValue->mZValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
             aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mZValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
-             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer &&
-             aValue->mZValue.GetUnit() != eCSSUnit_RevertLayer,
+             aValue->mZValue.GetUnit() != eCSSUnit_Revert,
             "missing or inappropriate triplet value");
  Reset();
  mUnit = eCSSUnit_Triplet;
@@ -773,10 +735,7 @@ void nsCSSValue::SetTripletValue(const nsCSSValue& xValue,
             zValue.GetUnit() != eCSSUnit_Unset &&
             xValue.GetUnit() != eCSSUnit_Revert &&
             yValue.GetUnit() != eCSSUnit_Revert &&
-             zValue.GetUnit() != eCSSUnit_Revert &&
-             xValue.GetUnit() != eCSSUnit_RevertLayer &&
-             yValue.GetUnit() != eCSSUnit_RevertLayer &&
-             zValue.GetUnit() != eCSSUnit_RevertLayer,
+             zValue.GetUnit() != eCSSUnit_Revert,
             "inappropriate triplet value");
  Reset();
  mUnit = eCSSUnit_Triplet;
@@ -892,26 +851,6 @@ nsCSSValue::SetRevertValue(mozilla::SheetType aValue)
  SetCascadeOriginValue(aValue, eCSSUnit_Revert);
 }

-void
-nsCSSValue::SetRevertLayerValue()
-{
-  SetRevertLayerValue(mozilla::SheetType::Unknown, false, 0);
-}
-
-void
-nsCSSValue::SetRevertLayerValue(mozilla::SheetType aLevel,
-                                bool aIsImportant,
-                                int32_t aLayerIndex)
-{
-  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask,
-             "cascade layer index is out of range");
-  Reset();
-  mUnit = eCSSUnit_RevertLayer;
-  mValue.mInt = (uint32_t(aLevel) << kRevertLayerOriginShift) |
-                (aIsImportant ? kRevertLayerImportant : 0) |
-                (aLayerIndex & kRevertLayerMask);
-}
-
 void nsCSSValue::SetNoneValue()
 {
  Reset();
@@ -2295,7 +2234,6 @@ nsCSSValue::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
    case eCSSUnit_Initial:      aResult.AppendLiteral("initial");  break;
    case eCSSUnit_Unset:        aResult.AppendLiteral("unset");    break;
    case eCSSUnit_Revert:       aResult.AppendLiteral("revert");   break;
-    case eCSSUnit_RevertLayer:  aResult.AppendLiteral("revert-layer"); break;
    case eCSSUnit_None:         aResult.AppendLiteral("none");     break;
    case eCSSUnit_Normal:       aResult.AppendLiteral("normal");   break;
    case eCSSUnit_System_Font:  aResult.AppendLiteral("-moz-use-system-font"); break;
@@ -2573,7 +2511,6 @@ nsCSSValue::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const

    // Cascade Origin: nothing extra to measure.
    case eCSSUnit_Revert:
-    case eCSSUnit_RevertLayer:
      break;

    // Float: nothing extra to measure.
@@ -2899,8 +2836,7 @@ nsCSSRect::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
             mTop.GetUnit() != eCSSUnit_Inherit &&
             mTop.GetUnit() != eCSSUnit_Initial &&
             mTop.GetUnit() != eCSSUnit_Unset &&
-             mTop.GetUnit() != eCSSUnit_Revert &&
-             mTop.GetUnit() != eCSSUnit_RevertLayer,
+             mTop.GetUnit() != eCSSUnit_Revert,
             "parser should have used a bare value");

  if (eCSSProperty_border_image_slice == aProperty ||
@@ -3071,7 +3007,6 @@ nsCSSValuePairList::AppendToString(nsCSSPropertyID aProperty,
        item->mXValue.GetUnit() != eCSSUnit_Initial &&
        item->mXValue.GetUnit() != eCSSUnit_Unset &&
        item->mXValue.GetUnit() != eCSSUnit_Revert &&
-        item->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
        item->mYValue.GetUnit() != eCSSUnit_Null) {
      aResult.Append(char16_t(' '));
      item->mYValue.AppendToString(aProperty, aResult, aSerialization);
@@ -3508,8 +3443,6 @@ nsCSSValueTokenStream::nsCSSValueTokenStream()
  : mPropertyID(eCSSProperty_UNKNOWN)
  , mShorthandPropertyID(eCSSProperty_UNKNOWN)
  , mLevel(SheetType::Count)
-  , mIsImportant(false)
-  , mLayerIndex(0)
 {
  MOZ_COUNT_CTOR(nsCSSValueTokenStream);
 }
@@ -490,7 +490,6 @@ enum nsCSSUnit {
  eCSSUnit_GridTemplateAreas   = 44,   // (GridTemplateAreasValue*)
                                       // for grid-template-areas
  eCSSUnit_Revert       = 45,     // (SheetType) value is the current cascade origin
-  eCSSUnit_RevertLayer  = 46,     // (int32_t) packed cascade layer rollback data

  eCSSUnit_Pair         = 50,     // (nsCSSValuePair*) pair of values
  eCSSUnit_Triplet      = 51,     // (nsCSSValueTriplet*) triplet of values
@@ -940,9 +939,6 @@ public:
    MOZ_ASSERT(mUnit == eCSSUnit_Revert, "not a cascade origin value");
    return mValue.mCascadeOrigin;
  }
-  mozilla::SheetType GetRevertLayerOriginValue() const;
-  bool GetRevertLayerImportanceValue() const;
-  int32_t GetRevertLayerLayerIndexValue() const;

  void Reset()  // sets to null
  {
@@ -955,7 +951,7 @@ private:
 public:
  void SetIntValue(int32_t aValue, nsCSSUnit aUnit);
  template<typename T,
-           typename = typename std::enable_if_t<std::is_enum_v<T>>>
+           typename = typename std::enable_if<std::is_enum<T>::value>::type>
  void SetIntValue(T aValue, nsCSSUnit aUnit)
  {
    static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,
@@ -998,10 +994,6 @@ public:
  void SetInitialValue();
  void SetUnsetValue();
  void SetRevertValue(mozilla::SheetType aValue);
-  void SetRevertLayerValue();
-  void SetRevertLayerValue(mozilla::SheetType aLevel,
-                           bool aIsImportant,
-                           int32_t aLayerIndex);
  void SetNoneValue();
  void SetAllValue();
  void SetNormalValue();
@@ -1845,8 +1837,6 @@ public:
           mShorthandPropertyID == aOther.mShorthandPropertyID &&
           mTokenStream.Equals(aOther.mTokenStream) &&
           mLevel == aOther.mLevel &&
-           mIsImportant == aOther.mIsImportant &&
-           mLayerIndex == aOther.mLayerIndex &&
           (mBaseURI == aOther.mBaseURI ||
            (mBaseURI && aOther.mBaseURI &&
             NS_SUCCEEDED(mBaseURI->Equals(aOther.mBaseURI, &eq)) &&
@@ -1896,8 +1886,6 @@ public:
  uint32_t mLineNumber;
  uint32_t mLineOffset;
  mozilla::SheetType mLevel;
-  bool mIsImportant;
-  int32_t mLayerIndex;

 private:
  nsCSSValueTokenStream(const nsCSSValueTokenStream& aOther) = delete;
@@ -28,9 +28,6 @@ nsRuleData::GetPoisonOffset()
 nsRuleData::nsRuleData(uint32_t aSIDs, nsCSSValue* aValueStorage,
                       nsPresContext* aContext, nsStyleContext* aStyleContext)
  : mSIDs(aSIDs),
-    mIsImportantRule(false),
-    mLevel(mozilla::SheetType::Unknown),
-    mLayerIndex(0),
    mPresContext(aContext),
    mStyleContext(aStyleContext),
    mValueStorage(aValueStorage)
@@ -31,7 +31,6 @@ struct nsRuleData
  mozilla::RuleNodeCacheConditions mConditions;
  bool mIsImportantRule;
  mozilla::SheetType mLevel;
-  int32_t mLayerIndex;
  nsPresContext* const mPresContext;
  nsStyleContext* const mStyleContext;

@@ -188,10 +188,9 @@ nsRuleNode::ChildrenHashHashKey(const void *aKey)
 {
  const nsRuleNode::Key *key =
    static_cast<const nsRuleNode::Key*>(aKey);
-  return PLDHashTable::HashVoidPtrKeyStub(key->mRule) ^
-         (uint32_t(key->mLayerIndex) << 4) ^
-         (uint32_t(key->mLevel) << 1) ^
-         (key->mIsImportantRule ? 1 : 0);
+  // Disagreement on importance and level for the same rule is extremely
+  // rare, so hash just on the rule.
+  return PLDHashTable::HashVoidPtrKeyStub(key->mRule);
 }

 /* static */ bool
@@ -2271,19 +2270,18 @@ already_AddRefed<nsRuleNode>
 nsRuleNode::CreateRootNode(nsPresContext* aPresContext)
 {
  return do_AddRef(new (aPresContext)
-    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false, 0));
+    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false));
 }

 nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,
                       nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportant, int32_t aLayerIndex)
+                       bool aIsImportant)
  : mPresContext(aContext),
    mParent(aParent),
    mRule(aRule),
    mNextSibling(nullptr),
    mDependentBits((uint32_t(aLevel) << NS_RULE_NODE_LEVEL_SHIFT) |
                   (aIsImportant ? NS_RULE_NODE_IS_IMPORTANT : 0)),
-    mLayerIndex(aLayerIndex),
    mNoneBits(aParent ? aParent->mNoneBits & NS_RULE_NODE_HAS_ANIMATION_DATA :
                        0),
    mRefCnt(0)
@@ -2297,8 +2295,6 @@ nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,

  NS_ASSERTION(IsRoot() || GetLevel() == aLevel, "not enough bits");
  NS_ASSERTION(IsRoot() || IsImportantRule() == aIsImportant, "yikes");
-  NS_ASSERTION(IsRoot() || GetLayerIndex() == aLayerIndex,
-               "bad layer index");
  aContext->StyleSet()->RuleNodeUnused(this, /* aMayGC = */ false);

  // nsStyleSet::GetContext depends on there being only one animation
@@ -2323,7 +2319,7 @@ nsRuleNode::~nsRuleNode()

 nsRuleNode*
 nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportantRule, int32_t aLayerIndex)
+                       bool aIsImportantRule)
 {
 #ifdef DEBUG
  {
@@ -2334,7 +2330,7 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
 #endif

  nsRuleNode* next = nullptr;
-  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule, aLayerIndex);
+  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule);

  if (HaveChildren() && !ChildrenAreHashed()) {
    int32_t numKids = 0;
@@ -2361,14 +2357,12 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
      next = entry->mRuleNode;
    } else {
      next = entry->mRuleNode = new (mPresContext)
-        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
-                   aLayerIndex);
+        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
    }
  } else if (!next) {
    // Create the new entry in our list.
    next = new (mPresContext)
-      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
-                 aLayerIndex);
+      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
    next->mNextSibling = ChildrenList();
    SetChildrenList(next);
  }
@@ -2551,8 +2545,7 @@ ExamineCSSValue(const nsCSSValue& aValue,
      ++aInheritedCount;
    } else if (aValue.GetUnit() == eCSSUnit_Unset) {
      ++aUnsetCount;
-    } else if (aValue.GetUnit() == eCSSUnit_Revert ||
-               aValue.GetUnit() == eCSSUnit_RevertLayer) {
+    } else if (aValue.GetUnit() == eCSSUnit_Revert) {
      ++aRevertCount;
    }
  }
@@ -3028,11 +3021,7 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
               "Token stream should have a defined level");

    AutoRestore<SheetType> saveLevel(aRuleData->mLevel);
-    AutoRestore<bool> saveImportant(aRuleData->mIsImportantRule);
-    AutoRestore<int32_t> saveLayerIndex(aRuleData->mLayerIndex);
    aRuleData->mLevel = tokenStream->mLevel;
-    aRuleData->mIsImportantRule = tokenStream->mIsImportant;
-    aRuleData->mLayerIndex = tokenStream->mLayerIndex;

    // Note that ParsePropertyWithVariableReferences relies on the fact
    // that the nsCSSValue in aRuleData for the property we are re-parsing
@@ -3056,114 +3045,6 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
  return anyTokenStreams;
 }

-static nsCSSPropertyID
-PropertyAtIndexInStruct(nsStyleStructID aSID, size_t aIndex)
-{
-  for (int32_t prop = 0; prop < eCSSProperty_COUNT_no_shorthands; prop++) {
-    nsCSSPropertyID property = nsCSSPropertyID(prop);
-    if (nsCSSProps::kSIDTable[property] == aSID &&
-        nsCSSProps::PropertyIndexInStruct(property) == aIndex) {
-      return property;
-    }
-  }
-  MOZ_ASSERT_UNREACHABLE("no property for style struct index");
-  return eCSSProperty_UNKNOWN;
-}
-
-/* static */ bool
-nsRuleNode::ResolveRevertLayerValues(const nsStyleStructID aSID,
-                                     nsRuleData* aRuleData,
-                                     nsStyleContext* aContext,
-                                     nsRuleNode* aStartRuleNode)
-{
-  MOZ_ASSERT(aSID != eStyleStruct_Variables);
-
-  size_t nprops = nsCSSProps::PropertyCountInStruct(aSID);
-  bool resolvedAny = false;
-
-  for (size_t pass = 0; pass <= nprops; pass++) {
-    bool resolvedThisPass = false;
-    bool needsVariableResolution = false;
-
-    for (size_t index = 0; index < nprops; index++) {
-      nsCSSValue* target = aRuleData->mValueStorage + index;
-      if (target->GetUnit() != eCSSUnit_RevertLayer) {
-        continue;
-      }
-
-      nsCSSPropertyID property = PropertyAtIndexInStruct(aSID, index);
-      if (property == eCSSProperty_UNKNOWN) {
-        continue;
-      }
-
-      AutoTArray<nsCSSValue, 64> tempValues;
-      tempValues.SetLength(nprops);
-      for (size_t i = 0; i < nprops; i++) {
-        tempValues[i].SetDummyValue();
-      }
-      tempValues[index] = *target;
-
-      nsRuleData tempRuleData(nsCachedStyleData::GetBitForSID(aSID),
-                              tempValues.Elements(),
-                              aStartRuleNode->mPresContext, aContext);
-      tempRuleData.mValueOffsets[aSID] = 0;
-
-      uint32_t bit = nsCachedStyleData::GetBitForSID(aSID);
-      for (nsRuleNode* ruleNode = aStartRuleNode; ruleNode;
-           ruleNode = ruleNode->GetParent()) {
-        if (ruleNode->mNoneBits & bit) {
-          break;
-        }
-
-        nsIStyleRule* rule = ruleNode->mRule;
-        if (rule) {
-          tempRuleData.mLevel = ruleNode->GetLevel();
-          tempRuleData.mIsImportantRule = ruleNode->IsImportantRule();
-          tempRuleData.mLayerIndex = ruleNode->GetLayerIndex();
-          rule->MapRuleInfoInto(&tempRuleData);
-        }
-
-        if (tempValues[index].GetUnit() != eCSSUnit_RevertLayer) {
-          break;
-        }
-      }
-
-      if (tempValues[index].GetUnit() == eCSSUnit_RevertLayer) {
-        tempValues[index].SetRevertValue(
-          target->GetRevertLayerOriginValue());
-      } else if (tempValues[index].GetUnit() == eCSSUnit_TokenStream) {
-        needsVariableResolution = true;
-      }
-
-      *target = tempValues[index];
-      aRuleData->mConditions.SetUncacheable();
-      resolvedThisPass = true;
-      resolvedAny = true;
-    }
-
-    if (!resolvedThisPass) {
-      break;
-    }
-
-    if (needsVariableResolution &&
-        ResolveVariableReferences(aSID, aRuleData, aContext)) {
-      resolvedAny = true;
-      continue;
-    }
-  }
-
-  for (size_t index = 0; index < nprops; index++) {
-    nsCSSValue* target = aRuleData->mValueStorage + index;
-    if (target->GetUnit() == eCSSUnit_RevertLayer) {
-      target->SetRevertValue(target->GetRevertLayerOriginValue());
-      aRuleData->mConditions.SetUncacheable();
-      resolvedAny = true;
-    }
-  }
-
-  return resolvedAny;
-}
-
 const void*
 nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
                         nsStyleContext* aContext)
@@ -3237,7 +3118,6 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
    if (rule) {
      ruleData.mLevel = ruleNode->GetLevel();
      ruleData.mIsImportantRule = ruleNode->IsImportantRule();
-      ruleData.mLayerIndex = ruleNode->GetLayerIndex();
      rule->MapRuleInfoInto(&ruleData);
    }

@@ -3274,11 +3154,6 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
    recomputeDetail = ResolveVariableReferences(aSID, &ruleData, aContext);
  }

-  if (aSID != eStyleStruct_Variables &&
-      ResolveRevertLayerValues(aSID, &ruleData, aContext, this)) {
-    recomputeDetail = true;
-  }
-
  // If needed, unset the properties that don't have a flag that allows
  // them to be set for this style context.  (For example, only some
  // properties apply to :first-line and :first-letter.)
@@ -5014,7 +4889,6 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
      if (rule) {
        ruleData.mLevel = ruleNode->GetLevel();
        ruleData.mIsImportantRule = ruleNode->IsImportantRule();
-        ruleData.mLayerIndex = ruleNode->GetLayerIndex();
        rule->MapRuleInfoInto(&ruleData);
      }
    }
@@ -5028,8 +4902,6 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
    }

    ResolveVariableReferences(eStyleStruct_Font, &ruleData, aContext);
-    ResolveRevertLayerValues(eStyleStruct_Font, &ruleData, aContext,
-                             context->RuleNode());

    RuleNodeCacheConditions dummy;
    nsRuleNode::SetFont(aPresContext, context,
@@ -11209,8 +11081,6 @@ nsRuleNode::ComputeVariablesData(void* aStartStruct,
  CSSVariableResolver resolver(&variables->mVariables);
  resolver.Resolve(&parentVariables->mVariables,
                   aRuleData->mVariables);
-  aRuleData->mVariables->ResolveRevertLayerFallbacks(&parentVariables->mVariables,
-                                                     &variables->mVariables);
  conditions.SetUncacheable();

  COMPUTE_END_INHERITED(Variables, variables)
@@ -11603,7 +11473,6 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
      if (rule) {
        ruleData.mLevel = ruleNode->GetLevel();
        ruleData.mIsImportantRule = ruleNode->IsImportantRule();
-        ruleData.mLayerIndex = ruleNode->GetLayerIndex();

        rule->MapRuleInfoInto(&ruleData);

@@ -11616,13 +11485,11 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
            nsCSSUnit unit = values[i]->GetUnit();
            if (unit != eCSSUnit_Null &&
                unit != eCSSUnit_Revert &&
-                unit != eCSSUnit_RevertLayer &&
                unit != eCSSUnit_Dummy &&
                unit != eCSSUnit_DummyInherit) {
              if (unit == eCSSUnit_Inherit ||
                  (i >= inheritedOffset && unit == eCSSUnit_Unset) ||
-                  (i >= inheritedOffset && unit == eCSSUnit_Revert) ||
-                  (i >= inheritedOffset && unit == eCSSUnit_RevertLayer)) {
+                  (i >= inheritedOffset && unit == eCSSUnit_Revert)) {
                haveExplicitUAInherit = true;
                values[i]->SetDummyInheritValue();
              } else {
@@ -11637,8 +11504,7 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
            if (values[i]->GetUnit() != eCSSUnit_Null &&
                values[i]->GetUnit() != eCSSUnit_Dummy && // see above
                values[i]->GetUnit() != eCSSUnit_DummyInherit &&
-                values[i]->GetUnit() != eCSSUnit_Revert &&
-                values[i]->GetUnit() != eCSSUnit_RevertLayer) {
+                values[i]->GetUnit() != eCSSUnit_Revert) {
              // If author colors are not allowed, only claim to have
              // author-specified rules if we're looking at a non-color
              // property or if we're looking at the background color and it's
@@ -11730,7 +11596,6 @@ nsRuleNode::ComputePropertiesOverridingAnimation(
    if (rule) {
      ruleData.mLevel = ruleNode->GetLevel();
      ruleData.mIsImportantRule = ruleNode->IsImportantRule();
-      ruleData.mLayerIndex = ruleNode->GetLayerIndex();

      // Transitions are the only non-!important level overriding
      // animations in the cascade ordering.  They also don't actually
@@ -441,20 +441,16 @@ private:
  struct Key {
    nsIStyleRule* mRule;
    mozilla::SheetType mLevel;
-    int32_t mLayerIndex;
    bool mIsImportantRule;

-    Key(nsIStyleRule* aRule, mozilla::SheetType aLevel,
-        bool aIsImportantRule, int32_t aLayerIndex)
-      : mRule(aRule), mLevel(aLevel), mLayerIndex(aLayerIndex),
-        mIsImportantRule(aIsImportantRule)
+    Key(nsIStyleRule* aRule, mozilla::SheetType aLevel, bool aIsImportantRule)
+      : mRule(aRule), mLevel(aLevel), mIsImportantRule(aIsImportantRule)
    {}

    bool operator==(const Key& aOther) const
    {
      return mRule == aOther.mRule &&
             mLevel == aOther.mLevel &&
-             mLayerIndex == aOther.mLayerIndex &&
             mIsImportantRule == aOther.mIsImportantRule;
    }

@@ -473,7 +469,7 @@ private:
  static const PLDHashTableOps ChildrenHashOps;

  Key GetKey() const {
-    return Key(mRule, GetLevel(), IsImportantRule(), GetLayerIndex());
+    return Key(mRule, GetLevel(), IsImportantRule());
  }

  // The children of this node are stored in either a hashtable or list
@@ -532,8 +528,6 @@ private:
  uint32_t mDependentBits; // Used to cache the fact that we can look up
                           // cached data under a parent rule.

-  int32_t mLayerIndex;
-
  uint32_t mNoneBits; // Used to cache the fact that the branch to this
                      // node specifies no non-inherited data for a
                      // given struct type.  (This usually implies that
@@ -591,10 +585,6 @@ protected:
  static bool ResolveVariableReferences(const nsStyleStructID aSID,
                                        nsRuleData* aRuleData,
                                        nsStyleContext* aContext);
-  static bool ResolveRevertLayerValues(const nsStyleStructID aSID,
-                                       nsRuleData* aRuleData,
-                                       nsStyleContext* aContext,
-                                       nsRuleNode* aStartRuleNode);

  const void*
    WalkRuleTree(const nsStyleStructID aSID, nsStyleContext* aContext);
@@ -802,8 +792,7 @@ protected:

 private:
  nsRuleNode(nsPresContext* aPresContext, nsRuleNode* aParent,
-             nsIStyleRule* aRule, mozilla::SheetType aLevel,
-             bool aIsImportant, int32_t aLayerIndex);
+             nsIStyleRule* aRule, mozilla::SheetType aLevel, bool aIsImportant);
  ~nsRuleNode();

 public:
@@ -816,7 +805,7 @@ public:

  // Transition never returns null; on out of memory it'll just return |this|.
  nsRuleNode* Transition(nsIStyleRule* aRule, mozilla::SheetType aLevel,
-                         bool aIsImportantRule, int32_t aLayerIndex);
+                         bool aIsImportantRule);
  nsRuleNode* GetParent() const { return mParent; }
  bool IsRoot() const { return mParent == nullptr; }

@@ -836,10 +825,6 @@ public:
    NS_ASSERTION(!IsRoot(), "can't call on root");
    return (mDependentBits & NS_RULE_NODE_IS_IMPORTANT) != 0;
  }
-  int32_t GetLayerIndex() const {
-    NS_ASSERTION(!IsRoot(), "can't call on root");
-    return mLayerIndex;
-  }

  /**
   * Has this rule node at some time in its lifetime been the mRuleNode