addons: an add-on naming both the AppCompat GUID and the toolkit is matched by the entry that fits

matchingTargetApplication prefers, in order: this application's own id, the AppCompat GUID (extensions.guid.appCompatId, the Firefox GUID), the toolkit. The AppCompat entry was taken whenever present, whatever its version range. An add-on can name both for different reasons: the GUID entry for the application that owns that GUID, at that application's versions (Basilisk is {ec8030f7-...} at 52.9.x), and a toolkit entry meaning "any other application on this platform". For an application that is neither, with an AppCompat version of 56.9, the GUID entry "52.9.0 - 52.9.*" under strict compatibility does not fit - and because it was preferred, the toolkit entry that does describe the application was never looked at. The add-on was installed and immediately disabled as incompatible. Now the AppCompat entry is used only if it admits the AppCompat version (both bounds under strict compatibility, the lower bound otherwise - the rule isCompatibleWith applies) or if there is no toolkit entry to fall back to. Nothing changes for an add-on that names one of the two, or whose GUID entry fits. Found with Palefill 1.30 (toolkit@mozilla.org 4.8.2 - 10.*, platform 6.9.0), which now installs enabled and applies its fixes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LcrVQFRMC2ANGDfVaRG9Ed
plugin-container: do not hand the bundled library path to what the plugin runs
2026-10-05 18:11:17 -04:00 · 2026-10-05 15:46:38 -04:00 · 2026-10-05 15:30:05 -04:00 · 2026-10-01 13:22:49 -04:00 · 2026-10-01 09:12:50 -04:00 · 2026-08-17 10:15:19 -04:00
1414 changed files with 353019 additions and 55838 deletions
@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.

-Clobber for Python 3 migration
+Clobber for Idle GC backout
@@ -0,0 +1,8 @@
+TRADEMARK NOTICE
+================
+
+The name "Goanna" and visual representations (logo) have not been
+registered by the Copyright owners as a trademark in any jurisdiction.
+However, because Goanna has been distributed and maintained world-wide,
+continually since 2015, the Copyright owners claim "common-law trademark
+protection" in any jurisdiction where common-law trademark is recognized.
@@ -18,10 +18,6 @@
 #endif
 #include <gtk/gtk.h>

-#if (MOZ_WIDGET_GTK == 3)
-extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
-#endif
-
 using namespace mozilla;
 using namespace mozilla::a11y;

@@ -33,12 +29,20 @@ extern "C" {
 typedef GType (* AtkGetTypeType) (void);
 typedef void (*GnomeAccessibilityInit) (void);
 typedef void (*GnomeAccessibilityShutdown) (void);
+#if (MOZ_WIDGET_GTK == 3)
+typedef int (*AtkBridgeAdaptorInit) (int*, char***);
+#endif
 }

 static PRLibrary* sATKLib = nullptr;
 static const char sATKLibName[] = "libatk-1.0.so.0";
 static const char sATKHyperlinkImplGetTypeSymbol[] =
  "atk_hyperlink_impl_get_type";
+#if (MOZ_WIDGET_GTK == 3)
+static PRLibrary* sAtkBridgeAdaptorLib = nullptr;
+static const char sAtkBridgeAdaptorLibName[] = "libatk-bridge-2.0.so.0";
+static const char sAtkBridgeAdaptorInitSymbol[] = "atk_bridge_adaptor_init";
+#endif

 gboolean toplevel_event_watcher(GSignalInvocationHint*, guint, const GValue*,
                                gpointer);
@@ -127,6 +131,38 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
    return NS_OK;
 }

+#if (MOZ_WIDGET_GTK == 3)
+static bool
+InitAtkBridgeAdaptor()
+{
+  AtkBridgeAdaptorInit initBridge =
+    reinterpret_cast<AtkBridgeAdaptorInit>(
+      PR_FindFunctionSymbolAndLibrary(sAtkBridgeAdaptorInitSymbol,
+                                      &sAtkBridgeAdaptorLib));
+
+  if (!initBridge) {
+    sAtkBridgeAdaptorLib = PR_LoadLibrary(sAtkBridgeAdaptorLibName);
+    if (sAtkBridgeAdaptorLib) {
+      initBridge =
+        reinterpret_cast<AtkBridgeAdaptorInit>(
+          PR_FindFunctionSymbol(sAtkBridgeAdaptorLib,
+                                sAtkBridgeAdaptorInitSymbol));
+      if (!initBridge) {
+        PR_UnloadLibrary(sAtkBridgeAdaptorLib);
+        sAtkBridgeAdaptorLib = nullptr;
+      }
+    }
+  }
+
+  if (!initBridge) {
+    return false;
+  }
+
+  initBridge(nullptr, nullptr);
+  return true;
+}
+#endif
+
 void
 a11y::PlatformInit()
 {
@@ -181,9 +217,7 @@ a11y::PlatformInit()
  // Init atk-bridge now
  PR_SetEnv("NO_AT_BRIDGE=0");
 #if (MOZ_WIDGET_GTK == 3)
-  if (atk_bridge_adaptor_init) {
-    atk_bridge_adaptor_init(nullptr, nullptr);
-  } else
+  if (!InitAtkBridgeAdaptor())
 #endif
  {
    nsresult rv = LoadGtkModule(sAtkBridge);
@@ -228,6 +262,13 @@ a11y::PlatformShutdown()
        sAtkBridge.init = nullptr;
        sAtkBridge.shutdown = nullptr;
    }
+#if (MOZ_WIDGET_GTK == 3)
+    if (sAtkBridgeAdaptorLib) {
+        // Do not shutdown/unload atk-bridge; an exit function registered by
+        // the bridge will take care of it.
+        sAtkBridgeAdaptorLib = nullptr;
+    }
+#endif
 #if (MOZ_WIDGET_GTK == 2)
    if (sGail.lib) {
        // Do not shutdown gail because
@@ -43,8 +43,6 @@ gyp_vars.update({
    'arm_neon': 0,
    'arm_neon_optional': 1,

-    'moz_webrtc_omx': 0,
-    'moz_webrtc_mediacodec': 0,

    # Turn off multi monitor screen share
    'multi_monitor_screenshare%' : 0,
@@ -344,7 +344,7 @@ def split_triplet(triplet):
    if cpu.endswith('86') or (cpu.startswith('i') and '86' in cpu):
        canonical_cpu = 'x86'
        endianness = 'little'
-    elif cpu in ('x86_64', 'ia64'):
+    elif cpu == 'x86_64':
        canonical_cpu = cpu
        endianness = 'little'
    elif cpu in ('s390', 's390x'):
@@ -152,6 +152,7 @@ def old_configure_options(*options):
    '--enable-jitspew',
    '--enable-js-lto',
    '--enable-leak-sanitizer',
+    '--enable-libaom',
    '--enable-libjpeg-turbo',
    '--enable-libproxy',
    '--enable-llvm-hacks',
@@ -163,6 +164,7 @@ def old_configure_options(*options):
    '--enable-negotiateauth',
    '--enable-nfc',
    '--enable-npapi',
+    '--enable-npapi-gtk2',
    '--enable-nspr-build',
    '--enable-official-branding',
    '--enable-official-vendor',
@@ -61,6 +61,44 @@ set_config('HAVE_YASM', have_yasm)
 # Until the YASM variable is not necessary in old-configure.
 add_old_configure_assignment('YASM', have_yasm)

+# nasm detection
+# ==============================================================
+nasm = check_prog('NASM', ['nasm'], allow_missing=True)
+
+@depends_if(nasm)
+@checking('nasm version')
+def nasm_version(nasm):
+    version = check_cmd_output(
+        nasm, '-v',
+        onerror=lambda: die('Failed to get nasm version.')
+    ).splitlines()[0].split()[2]
+    return Version(version)
+
+@depends(nasm, nasm_version)
+def have_nasm(nasm, version):
+    if nasm and version >= Version('2.14'):
+        return True
+
+set_config('HAVE_NASM', have_nasm)
+
+@depends(have_nasm, target)
+def nasm_asflags(have_nasm, target):
+    if have_nasm:
+        asflags = {
+            ('OSX', 'x86'): '-f macho32',
+            ('OSX', 'x86_64'): '-f macho64',
+            ('WINNT', 'x86'): '-f win32',
+            ('WINNT', 'x86_64'): '-f win64',
+        }.get((target.os, target.cpu), None)
+        if asflags is None:
+            if target.cpu == 'x86':
+                asflags = '-f elf32'
+            elif target.cpu == 'x86_64':
+                asflags = '-f elf64'
+        return asflags
+
+set_config('NASM_ASFLAGS', nasm_asflags)
+
 # MacOS deployment target version
 # ==============================================================
 # This needs to happen before any compilation test is done.
@@ -88,6 +88,11 @@ check_and_add_gcc_warning('-Wno-error=deprecated-declarations')
 # false positives depending on optimization
 check_and_add_gcc_warning('-Wno-error=array-bounds')

+# GCC 9+ value-range analysis trips -Wformat-overflow on null %s args in debug
+# spew (e.g. js/src/jit/x64/BaseAssembler-x64.h:595); harmless for our build,
+# and js/src forces -Werror=format so this must be downgraded here to reach it.
+check_and_add_gcc_warning('-Wno-error=format-overflow')
+
 # can't get rid of those PGO warnings
 check_and_add_gcc_warning('-Wno-error=coverage-mismatch', when='MOZ_PGO')

@@ -290,11 +290,6 @@ fi
 if [ -n "$LD_LIBRARY_PATH_64" ]; then
 	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64:+":$LD_LIBRARY_PATH_64"}
 fi
-#
-#
-## Set SHLIB_PATH for HPUX
-SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH:+":$SHLIB_PATH"}
-#
 ## Set LIBPATH for AIX
 LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH:+":$LIBPATH"}
 #
@@ -339,7 +334,6 @@ then
  fi
  echo "DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH"
  echo "     LIBRARY_PATH=$LIBRARY_PATH"
-  echo "       SHLIB_PATH=$SHLIB_PATH"
  echo "          LIBPATH=$LIBPATH"
  echo "       ADDON_PATH=$ADDON_PATH"
  echo "      MOZ_PROGRAM=$MOZ_PROGRAM"
@@ -350,7 +344,7 @@ then
 fi
 #
 export MOZILLA_FIVE_HOME LD_LIBRARY_PATH
-export SHLIB_PATH LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH
+export LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH

 if [ $moz_debug -eq 1 ]
 then
@@ -29,7 +29,10 @@ if CONFIG['MOZ_WEBM_ENCODER']:
 external_dirs += ['media/libvpx']

 if CONFIG['MOZ_AV1']:
-    external_dirs += ['media/libaom']
+    if CONFIG['AV1_USE_AOM']:
+        external_dirs += ['media/libaom']
+    else:
+        external_dirs += ['media/libdav1d']

 external_dirs += ['media/libpng']

@@ -448,7 +448,6 @@ gtk/gtkx.h
 gtk/gtkunixprint.h
 HIToolbox/HIToolbox.h
 hlink.h
-ia64/sys/inline.h
 Icons.h
 iconv.h
 ieeefp.h
@@ -204,21 +204,22 @@ function initialHTML(doc) {
    os = "linux";
  }

-  let base = doc.createElement("base");
-  base.href = "resource://devtools/client/jsonview/";
+  // The appRoot URI is prepended to all URIs instead of using a <base> element
+  // because the latter can cause spurious network requests (UXP Issue #3122)
+  let appRoot = "resource://devtools/client/jsonview/";

  let style = doc.createElement("link");
  style.rel = "stylesheet";
  style.type = "text/css";
-  style.href = "css/main.css";
+  style.href = appRoot +"css/main.css";

  let script = doc.createElement("script");
-  script.src = "lib/require.js";
-  script.dataset.main = "viewer-config";
+  script.src = appRoot + "lib/require.js";
+  script.dataset.main = appRoot + "viewer-config.js";
  script.defer = true;

  let head = doc.createElement("head");
-  head.append(base, style, script);
+  head.append(style, script);

  return "<!DOCTYPE html>\n" +
    startTag("html", {
@@ -4,6 +4,8 @@ subsuite = devtools
 support-files =
  array_json.json
  array_json.json^headers^
+  csp_json.json
+  csp_json.json^headers^
  doc_frame_script.js
  head.js
  invalid_json.json
@@ -22,6 +24,7 @@ subsuite = clipboard
 subsuite = clipboard
 [browser_jsonview_copy_rawdata.js]
 subsuite = clipboard
+[browser_jsonview_csp_json.js]
 [browser_jsonview_filter.js]
 [browser_jsonview_invalid_json.js]
 [browser_jsonview_valid_json.js]
@@ -0,0 +1,17 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const TEST_JSON_URL = URL_ROOT + "csp_json.json";
+
+add_task(function* () {
+  info("Test CSP JSON started");
+
+  yield addJsonViewTab(TEST_JSON_URL);
+
+  let count = yield getElementCount(".jsonPanelBox .treeTable .treeRow");
+  is(count, 1, "There must be one row");
+});
@@ -0,0 +1 @@
+{"csp": true}
@@ -0,0 +1,2 @@
+Content-Type: application/json
+Content-Security-Policy: default-src 'none'; base-uri 'none';
@@ -23,7 +23,7 @@
 * of the code base, so it's consistent and modules can be easily reused.
 */
 require.config({
-  baseUrl: ".",
+  baseUrl: "resource://devtools/client/jsonview/",
  paths: {
    "devtools/client/shared": "resource://devtools/client/shared",
    "devtools/shared": "resource://devtools/shared",
@@ -103,12 +103,6 @@ function StyleSheetEditor(styleSheet, win, file, isNew, walker, highlighter) {
    }
  };

-  this._styleSheetFilePath = null;
-  if (styleSheet.href &&
-      Services.io.extractScheme(this.styleSheet.href) == "file") {
-    this._styleSheetFilePath = this.styleSheet.href;
-  }
-
  this._onPropertyChange = this._onPropertyChange.bind(this);
  this._onError = this._onError.bind(this);
  this._onMediaRuleMatchesChange = this._onMediaRuleMatchesChange.bind(this);
@@ -664,8 +658,7 @@ StyleSheetEditor.prototype = {
    if (this._friendlyName) {
      defaultName = OS.Path.basename(this._friendlyName);
    }
-    showFilePicker(file || this._styleSheetFilePath, true, this._window,
-                   onFile, defaultName);
+    showFilePicker(file, true, this._window, onFile, defaultName);
  },

  /**
@@ -1,98 +1,112 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/ */
-"use strict";
-
-// Test that 'Save' function works.
-
-const TESTCASE_URI_HTML = TEST_BASE_HTTP + "simple.html";
-const TESTCASE_URI_CSS = TEST_BASE_HTTP + "simple.css";
-
-var tempScope = {};
-Components.utils.import("resource://gre/modules/FileUtils.jsm", tempScope);
-Components.utils.import("resource://gre/modules/NetUtil.jsm", tempScope);
-var FileUtils = tempScope.FileUtils;
-var NetUtil = tempScope.NetUtil;
-
-add_task(function* () {
-  let htmlFile = yield copy(TESTCASE_URI_HTML, "simple.html");
-  yield copy(TESTCASE_URI_CSS, "simple.css");
-  let uri = Services.io.newFileURI(htmlFile);
-  let filePath = uri.resolve("");
-
-  let { ui } = yield openStyleEditorForURL(filePath);
-
-  let editor = ui.editors[0];
-  yield editor.getSourceEditor();
-
-  info("Editing the style sheet.");
-  let dirty = editor.sourceEditor.once("dirty-change");
-  let beginCursor = {line: 0, ch: 0};
-  editor.sourceEditor.replaceText("DIRTY TEXT", beginCursor, beginCursor);
-
-  yield dirty;
-
-  is(editor.sourceEditor.isClean(), false, "Editor is dirty.");
-  ok(editor.summary.classList.contains("unsaved"),
-     "Star icon is present in the corresponding summary.");
-
-  info("Saving the changes.");
-  dirty = editor.sourceEditor.once("dirty-change");
-
-  editor.saveToFile(null, function (file) {
-    ok(file, "file should get saved directly when using a file:// URI");
-  });
-
-  yield dirty;
-
-  is(editor.sourceEditor.isClean(), true, "Editor is clean.");
-  ok(!editor.summary.classList.contains("unsaved"),
-     "Star icon is not present in the corresponding summary.");
-});
-
-function copy(srcChromeURL, destFileName) {
-  let deferred = defer();
-  let destFile = FileUtils.getFile("ProfD", [destFileName]);
-  write(read(srcChromeURL), destFile, deferred.resolve);
-
-  return deferred.promise;
-}
-
-function read(srcChromeURL) {
-  let scriptableStream = Cc["@mozilla.org/scriptableinputstream;1"]
-    .getService(Ci.nsIScriptableInputStream);
-
-  let channel = NetUtil.newChannel({
-    uri: srcChromeURL,
-    loadUsingSystemPrincipal: true
-  });
-  let input = channel.open2();
-  scriptableStream.init(input);
-
-  let data = "";
-  while (input.available()) {
-    data = data.concat(scriptableStream.read(input.available()));
-  }
-  scriptableStream.close();
-  input.close();
-
-  return data;
-}
-
-function write(data, file, callback) {
-  let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
-    .createInstance(Ci.nsIScriptableUnicodeConverter);
-
-  converter.charset = "UTF-8";
-
-  let istream = converter.convertToInputStream(data);
-  let ostream = FileUtils.openSafeFileOutputStream(file);
-
-  NetUtil.asyncCopy(istream, ostream, function (status) {
-    if (!Components.isSuccessCode(status)) {
-      info("Couldn't write to " + file.path);
-      return;
-    }
-
-    callback(file);
-  });
-}
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+"use strict";
+
+// Test that 'Save' function works.
+
+const TESTCASE_URI_HTML = TEST_BASE_HTTP + "simple.html";
+const TESTCASE_URI_CSS = TEST_BASE_HTTP + "simple.css";
+
+var tempScope = {};
+Components.utils.import("resource://gre/modules/FileUtils.jsm", tempScope);
+Components.utils.import("resource://gre/modules/NetUtil.jsm", tempScope);
+var FileUtils = tempScope.FileUtils;
+var NetUtil = tempScope.NetUtil;
+
+add_task(function* () {
+  let htmlFile = yield copy(TESTCASE_URI_HTML, "simple.html");
+  const cssFile = await copy(TESTCASE_URI_CSS, "simple.css");
+  let uri = Services.io.newFileURI(htmlFile);
+  let filePath = uri.resolve("");
+
+  let { ui } = yield openStyleEditorForURL(filePath);
+
+  let editor = ui.editors[0];
+  yield editor.getSourceEditor();
+
+  is(
+    editor.savedFile,
+    null,
+    "savedFile should not be pre-populated from the source file"
+  );
+
+  info("Editing the style sheet.");
+  let dirty = editor.sourceEditor.once("dirty-change");
+  let beginCursor = {line: 0, ch: 0};
+  editor.sourceEditor.replaceText("DIRTY TEXT", beginCursor, beginCursor);
+
+  yield dirty;
+
+  is(editor.sourceEditor.isClean(), false, "Editor is dirty.");
+  ok(editor.summary.classList.contains("unsaved"),
+     "Star icon is present in the corresponding summary.");
+
+  info(
+    "Saving the changes with an explicit file (simulating a user-chosen save location)."
+  );
+  dirty = editor.sourceEditor.once("dirty-change");
+
+  editor.saveToFile(cssFile, function (file) {
+    ok(file, "file should get saved when explicitly passing a file");
+  });
+
+  yield dirty;
+
+  is(editor.sourceEditor.isClean(), true, "Editor is clean.");
+  ok(!editor.summary.classList.contains("unsaved"),
+     "Star icon is not present in the corresponding summary.");
+
+  is(
+    editor.savedFile?.path,
+    cssFile.path,
+    "savedFile should now be set on the editor"
+  );
+});
+
+function copy(srcChromeURL, destFileName) {
+  let deferred = defer();
+  let destFile = FileUtils.getFile("ProfD", [destFileName]);
+  write(read(srcChromeURL), destFile, deferred.resolve);
+
+  return deferred.promise;
+}
+
+function read(srcChromeURL) {
+  let scriptableStream = Cc["@mozilla.org/scriptableinputstream;1"]
+    .getService(Ci.nsIScriptableInputStream);
+
+  let channel = NetUtil.newChannel({
+    uri: srcChromeURL,
+    loadUsingSystemPrincipal: true
+  });
+  let input = channel.open2();
+  scriptableStream.init(input);
+
+  let data = "";
+  while (input.available()) {
+    data = data.concat(scriptableStream.read(input.available()));
+  }
+  scriptableStream.close();
+  input.close();
+
+  return data;
+}
+
+function write(data, file, callback) {
+  let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
+    .createInstance(Ci.nsIScriptableUnicodeConverter);
+
+  converter.charset = "UTF-8";
+
+  let istream = converter.convertToInputStream(data);
+  let ostream = FileUtils.openSafeFileOutputStream(file);
+
+  NetUtil.asyncCopy(istream, ostream, function (status) {
+    if (!Components.isSuccessCode(status)) {
+      info("Couldn't write to " + file.path);
+      return;
+    }
+
+    callback(file);
+  });
+}
@@ -28,7 +28,10 @@ add_task(function* () {
  let HTMLFile = yield copy(TESTCASE_URI_HTML, ["sourcemaps.html"]);
  let CSSFile = yield copy(TESTCASE_URI_CSS,
    ["sourcemap-css", "sourcemaps.css"]);
-  yield copy(TESTCASE_URI_SCSS, ["sourcemap-sass", "sourcemaps.scss"]);
+  const SCSSFile = await copy(TESTCASE_URI_SCSS, [
+    "sourcemap-sass",
+    "sourcemaps.scss",
+  ]);
  yield copy(TESTCASE_URI_MAP, ["sourcemap-css", "sourcemaps.css.map"]);
  yield copy(TESTCASE_URI_REG_CSS, ["simple.css"]);

@@ -59,7 +62,7 @@ add_task(function* () {

  // Edit and save Sass in the editor. This will start off a file-watching
  // process waiting for the CSS file to change.
-  yield editSCSS(editor);
+  yield editSCSS(SCSSFile, editor);

  // We can't run Sass or another compiler, so we fake it by just
  // directly changing the CSS file.
@@ -73,12 +76,12 @@ add_task(function* () {
  is(color, "rgb(0, 0, 255)", "div is blue after saving file");
 });

-function editSCSS(editor) {
+function editSCSS(SCSSFile, editor) {
  let deferred = defer();

  editor.sourceEditor.setText(CSS_TEXT);

-  editor.saveToFile(null, function (file) {
+  editor.saveToFile(SCSSFile, function (file) {
    ok(file, "Scss file should be saved");
    deferred.resolve();
  });
@@ -52,7 +52,7 @@ static RedirEntry kRedirMap[] = {
  { "config", "chrome://global/content/config.xul", 0 },
  { "console", "chrome://global/content/console.xul", 0 },
  {
-    "credits", "http://www.palemoon.org/Contributors.shtml",
+    "credits", "https://net.riverstonerelay.jihad-browser/credits",
    nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
    nsIAboutModule::MAKE_LINKABLE
  },
@@ -199,6 +199,7 @@
 #include "nsICommandManager.h"
 #include "nsIDOMNode.h"
 #include "nsIDocShellTreeOwner.h"
+#include "nsIBadCertListener2.h"   // JIHAD: route cert errors to the embedder chrome
 #include "nsIHttpChannel.h"
 #include "nsIIDNService.h"
 #include "nsIInputStreamChannel.h"
@@ -1074,6 +1075,33 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
  } else if (aIID.Equals(NS_GET_IID(nsITabChild))) {
    *aSink = GetTabChild().take();
    return *aSink ? NS_OK : NS_ERROR_FAILURE;
+  } else if (aIID.Equals(NS_GET_IID(nsIBadCertListener2))) {
+    // JIHAD: hand the embedder's chrome the certificate error.
+    //
+    // NSS asks the channel's notification callbacks for nsIBadCertListener2
+    // (SSLServerCertVerification.cpp, CertErrorRunnable::CheckCertOverrides) and passes
+    // it the nsISSLStatus carrying the SERVER CERTIFICATE. That call is the one and only
+    // place an embedder is handed the cert while it still exists — the same shape the
+    // Atlas browser gets for free from WebKit's load-failed-with-tls-errors signal, which
+    // delivers the GTlsCertificate as a signal argument.
+    //
+    // Without this hop nothing answers: the docShell's fallthrough is
+    // nsDocLoader::GetInterface, which Queries the docloader ITSELF, so the request never
+    // reaches nsIWebBrowserChrome. The embedder is then left trying to recover the cert
+    // afterwards, and there is no way to: the failed channel's securityInfo has a null
+    // SSLStatus, and UXP has no nsIRecentBadCerts service. Measured 2026-08-04 — the
+    // SSL-confirm dialog worked, the user accepted, and the accept could do nothing
+    // because RememberValidityOverride had no nsIX509Cert to take.
+    //
+    // Routed through the tree owner, exactly as nsIWebBrowserChromeFocus and nsIPrompt
+    // already are (nsDocShellTreeOwner::GetInterface).
+    nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+    GetTreeOwner(getter_AddRefs(treeOwner));
+    nsCOMPtr<nsIInterfaceRequestor> req(do_QueryInterface(treeOwner));
+    if (req) {
+      return req->GetInterface(aIID, aSink);
+    }
+    return NS_NOINTERFACE;
  } else if (aIID.Equals(NS_GET_IID(nsIContentFrameMessageManager))) {
    nsCOMPtr<nsITabChild> tabChild =
      do_GetInterface(static_cast<nsIDocShell*>(this));
@@ -196,7 +196,7 @@ public:
  {
    MOZ_ASSERT(!NS_IsMainThread());

-    int32_t written = PR_Write(mFD, mData, mLength);
+    int32_t written = mLength < INT32_MAX ? PR_Write(mFD, mData, mLength) : -1;
    if (NS_WARN_IF(written < 0 || uint32_t(written) != mLength)) {
      return NS_DispatchToMainThread(
        new ErrorPropagationRunnable(mBlobStorage, NS_ERROR_FAILURE));
@@ -1004,6 +1004,7 @@ GK_ATOM(parameter, "parameter")
 GK_ATOM(parent, "parent")
 GK_ATOM(parentfocused, "parentfocused")
 GK_ATOM(parsetype, "parsetype")
+GK_ATOM(part, "part")
 GK_ATOM(password, "password")
 GK_ATOM(pattern, "pattern")
 GK_ATOM(patternSeparator, "pattern-separator")
@@ -787,6 +787,12 @@ nsresult
 nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
 {
 #ifdef MOZ_ENABLE_NPAPI
+  // JIHAD DIAGNOSTIC (R7): entry + the four early-out conditions. If this line never appears the
+  // plugin was never asked for at all (no nsPluginFrame -> no HasNewFrame), which is a different
+  // bug from being asked for and refused.
+  fprintf(stderr, "[jihad-npapi] InstantiatePluginInstance(aIsLoading=%d) owner=%d type=%d "
+          "mIsLoading=%d instantiating=%d\n", (int)aIsLoading, (int)!!mInstanceOwner,
+          (int)mType, (int)mIsLoading, (int)mInstantiating);
  if (mInstanceOwner || mType != eType_Plugin || (mIsLoading != aIsLoading) ||
      mInstantiating) {
    // If we hit this assertion it's probably because LoadObject re-entered :(
@@ -822,10 +828,12 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
  NS_ENSURE_TRUE(mInstantiating, NS_OK);

  if (!thisContent->GetPrimaryFrame()) {
+    // JIHAD DIAGNOSTIC (R7): a silent NS_OK return — the single most likely place for a plugin
+    // to "do nothing" with no error anywhere.
+    fprintf(stderr, "[jihad-npapi] NO PRIMARY FRAME -> not instantiating\n");
    LOG(("OBJLC [%p]: Not instantiating plugin with no frame", this));
    return NS_OK;
  }
-
  nsresult rv = NS_ERROR_FAILURE;
  RefPtr<nsPluginHost> pluginHost = nsPluginHost::GetInst();

@@ -846,6 +854,8 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
  rv = pluginHost->InstantiatePluginInstance(mContentType,
                                             mURI.get(), this,
                                             getter_AddRefs(newOwner));
+  fprintf(stderr, "[jihad-npapi] pluginHost->InstantiatePluginInstance rv=0x%x owner=%d\n",
+          (unsigned)rv, (int)!!newOwner);

  // XXX(johns): We don't suspend native inside stopping plugins...
  if (appShell) {
@@ -2378,6 +2388,11 @@ nsObjectLoadingContent::LoadObject(bool aNotify,
  FallbackType clickToPlayReason;
  if (!mActivated && (mType == eType_Null || mType == eType_Plugin) &&
      !ShouldPlay(clickToPlayReason, false)) {
+    // JIHAD DIAGNOSTIC (R7): this is where a plugin that resolved fine is silently demoted to
+    // eType_Null. Every path out of ShouldPlay that returns false lands here, so one line here
+    // names the reason instead of instrumenting each exit.
+    fprintf(stderr, "[jihad-npapi] demoted to fallback: mType=%d fallbackReason=%d\n",
+            (int)mType, (int)clickToPlayReason);
    LOG(("OBJLC [%p]: Marking plugin as click-to-play", this));
    mType = eType_Null;
    fallbackType = clickToPlayReason;
@@ -2887,9 +2902,16 @@ nsObjectLoadingContent::GetTypeOfContent(const nsCString& aMIMEType)

 #ifdef MOZ_ENABLE_NPAPI
  RefPtr<nsPluginHost> pluginHost = nsPluginHost::GetInst();
-  if ((caps & eSupportPlugins) &&
-      pluginHost &&
-      pluginHost->HavePluginForType(aMIMEType, nsPluginHost::eExcludeNone)) {
+  bool jihadHave = pluginHost &&
+      pluginHost->HavePluginForType(aMIMEType, nsPluginHost::eExcludeNone);
+  // JIHAD DIAGNOSTIC (R7 windowless port): says, for one MIME type, whether the element
+  // advertised plugin capability and whether the host has a plugin — the two facts that decide
+  // if the NPAPI subsystem is entered at all. Added because a plugin that never instantiates
+  // produces NO plugin logging whatsoever, which is indistinguishable from one that was never
+  // asked for.
+  fprintf(stderr, "[jihad-npapi] GetTypeOfContent mime=%s caps=0x%x supportsPlugins=%d have=%d\n",
+          nsCString(aMIMEType).get(), caps, (int)!!(caps & eSupportPlugins), (int)jihadHave);
+  if ((caps & eSupportPlugins) && jihadHave) {
    // ShouldPlay will handle checking for disabled plugins
    return eType_Plugin;
  }
@@ -3486,9 +3508,15 @@ nsObjectLoadingContent::ShouldPlay(FallbackType &aReason, bool aIgnoreCurrentTyp
  aReason = eFallbackClickToPlay;

  uint32_t enabledState = nsIPluginTag::STATE_DISABLED;
-  pluginHost->GetStateForType(mContentType, nsPluginHost::eExcludeNone,
+  nsresult jihadStateRv = pluginHost->GetStateForType(mContentType, nsPluginHost::eExcludeNone,
                              &enabledState);
+  // JIHAD DIAGNOSTIC (R7): note that enabledState is pre-set to STATE_DISABLED and the rv of
+  // GetStateForType is NOT checked upstream, so a failing lookup silently blocks the plugin
+  // with no other trace. Log the rv as well as the value.
+  fprintf(stderr, "[jihad-npapi] ShouldPlay type=%s enabledState=%u rv=0x%x\n",
+          mContentType.get(), enabledState, (unsigned)jihadStateRv);
  if (nsIPluginTag::STATE_DISABLED == enabledState) {
+    fprintf(stderr, "[jihad-npapi] ShouldPlay -> FALSE (eFallbackDisabled)\n");
    aReason = eFallbackDisabled;
    return false;
  }
@@ -39,6 +39,44 @@ WebGLTransformFeedback::Delete()

 ////////////////////////////////////////

+// Validation helper for beginning/resuming the TF and computing the
+// vertex capacity.
+bool
+WebGLTransformFeedback::PrepareTransformFeedback() {
+    const auto& prog = mContext->mCurrentProgram;
+    if (!prog ||
+        !prog->IsLinked() ||
+        !prog->LinkInfo()->componentsPerTFVert.size()) {
+        mContext->ErrorInvalidOperation("Current program not valid for transform feedback.");
+        return false;
+    }
+
+    const auto& linkInfo = prog->LinkInfo();
+    const auto& componentsPerTFVert = linkInfo->componentsPerTFVert;
+    
+    mActive_VertCapacity = 0;
+
+    size_t minVertCapacity = SIZE_MAX;
+    for (size_t i = 0; i < componentsPerTFVert.size(); i++) {
+        const auto& indexedBinding = mIndexedBindings[i];
+        const auto& componentsPerVert = componentsPerTFVert[i];
+
+        const auto& buffer = indexedBinding.mBufferBinding;
+        if (!buffer) {
+            mContext->ErrorInvalidOperation("No buffer attached to required transform feedback index %u.",
+                                            (uint32_t)i);
+            return false;
+        }
+
+        const size_t vertCapacity = buffer->ByteLength() / 4 / componentsPerVert;
+        minVertCapacity = std::min(minVertCapacity, vertCapacity);
+    }
+    
+    mActive_VertCapacity = minVertCapacity;
+    
+    return true;
+}
+
 void
 WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
 {
@@ -59,37 +97,10 @@ WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
        return;
    }

-    const auto& prog = mContext->mCurrentProgram;
-    if (!prog ||
-        !prog->IsLinked() ||
-        !prog->LinkInfo()->componentsPerTFVert.size())
-    {
-        mContext->ErrorInvalidOperation("%s: Current program not valid for transform"
-                                        " feedback.",
-                                        funcName);
+    if (!PrepareTransformFeedback()) {
        return;
    }

-    const auto& linkInfo = prog->LinkInfo();
-    const auto& componentsPerTFVert = linkInfo->componentsPerTFVert;
-
-    size_t minVertCapacity = SIZE_MAX;
-    for (size_t i = 0; i < componentsPerTFVert.size(); i++) {
-        const auto& indexedBinding = mIndexedBindings[i];
-        const auto& componentsPerVert = componentsPerTFVert[i];
-
-        const auto& buffer = indexedBinding.mBufferBinding;
-        if (!buffer) {
-            mContext->ErrorInvalidOperation("%s: No buffer attached to required transform"
-                                            " feedback index %u.",
-                                            funcName, (uint32_t)i);
-            return;
-        }
-
-        const size_t vertCapacity = buffer->ByteLength() / 4 / componentsPerVert;
-        minVertCapacity = std::min(minVertCapacity, vertCapacity);
-    }
-
    ////

    const auto& gl = mContext->gl;
@@ -101,10 +112,9 @@ WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
    mIsActive = true;
    MOZ_ASSERT(!mIsPaused);

-    mActive_Program = prog;
+    mActive_Program = mContext->mCurrentProgram;
    mActive_PrimMode = primMode;
    mActive_VertPosition = 0;
-    mActive_VertCapacity = minVertCapacity;

    ////

@@ -173,6 +183,12 @@ WebGLTransformFeedback::ResumeTransformFeedback()
        return;
    }

+    // Re-run prepare in case some of the buffers have been modified
+    // while the TF was paused.
+    if (!PrepareTransformFeedback()) {
+        return;
+    }
+
    ////

    const auto& gl = mContext->gl;
@@ -44,6 +44,7 @@ public:
    WebGLTransformFeedback(WebGLContext* webgl, GLuint tf);
 private:
    ~WebGLTransformFeedback();
+    bool PrepareTransformFeedback();

 public:
    NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(WebGLTransformFeedback)
@@ -26,7 +26,6 @@ support-files =
  image_yellow75.png
  imagebitmap_bug1239300.js
  imagebitmap_bug1239752.js
-  imagebitmap_extensions.html
  imagebitmap_on_worker.js
  imagebitmap_structuredclone.js
  imagebitmap_structuredclone_iframe.html
@@ -63,6 +63,7 @@ EncodingUtils::IsAsciiCompatible(const nsACString& aPreferredName)
           aPreferredName.LowerCaseEqualsLiteral("utf-16be") ||
           aPreferredName.LowerCaseEqualsLiteral("utf-16le") ||
           aPreferredName.LowerCaseEqualsLiteral("replacement") ||
+           aPreferredName.LowerCaseEqualsLiteral("iso-2022-jp") ||
           aPreferredName.LowerCaseEqualsLiteral("hz-gb-2312") ||
           aPreferredName.LowerCaseEqualsLiteral("utf-7") ||
           aPreferredName.LowerCaseEqualsLiteral("x-imap4-modified-utf7"));
@@ -652,7 +652,7 @@ nsresult nsGeolocationService::Init()
 #endif

 #ifdef MOZ_WIDGET_COCOA
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_6)
  if (Preferences::GetBool("geo.provider.use_corelocation", true)) {
    mProvider = new CoreLocationLocationProvider();
  }
@@ -18,6 +18,8 @@
 #include "nsContentUtils.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIURI.h"
+#include "nsNetUtil.h"
+#include "nsIProtocolHandler.h"

 NS_IMPL_NS_NEW_HTML_ELEMENT(Shared)

@@ -186,6 +188,8 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocument* aDocument, nsIContent* aMustMatch)
        newBaseURI = nullptr;
      }
      if (csp && newBaseURI) {
+        bool isLocalResource = false;
+        rv = NS_URIChainHasFlags(newBaseURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &isLocalResource);
        // base-uri is only enforced if explicitly defined in the
        // policy - do *not* consult default-src, see:
        // http://www.w3.org/TR/CSP2/#directive-default-src
@@ -193,7 +197,7 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocument* aDocument, nsIContent* aMustMatch)
        rv = csp->Permits(newBaseURI, nsIContentSecurityPolicy::BASE_URI_DIRECTIVE,
                          true /* aSpecific */, true /* aSendViolationReports */,
                          &cspPermitsBaseURI);
-        if (NS_FAILED(rv) || !cspPermitsBaseURI) {
+        if ((NS_FAILED(rv) || !cspPermitsBaseURI) && !isLocalResource) {
          newBaseURI = nullptr;
        }
      }
@@ -105,8 +105,6 @@ gDownMixMatrices[CUSTOM_CHANNEL_LAYOUTS*(CUSTOM_CHANNEL_LAYOUTS - 1)/2] =
 * Given an array of input channels, downmix to aOutputChannelCount, and copy
 * the results to the channel buffers in aOutputChannels.  Don't call this with
 * input count <= output count.
- * Each of aOutputChannels must be non-null.
- * aChannelArray elements may be null.
 */
 template<typename T>
 void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
@@ -121,11 +119,7 @@ void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
  if (inputChannelCount > 6) {
    // Just drop the unknown channels.
    for (uint32_t o = 0; o < aOutputChannelCount; ++o) {
-      if (inputChannels[o]) {
-        PodCopy(aOutputChannels[o], inputChannels[o], aDuration);
-      } else {
-        std::fill_n(aOutputChannels[o], aDuration, static_cast<T>(0));
-      }
+      PodCopy(aOutputChannels[o], inputChannels[o], aDuration);
    }
    return;
  }
@@ -144,19 +138,13 @@ void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
    // want an input channel to contribute to nothing
    T outputChannels[CUSTOM_CHANNEL_LAYOUTS + 1] = {0};
    for (uint32_t c = 0; c < inputChannelCount; ++c) {
-      if (inputChannels[c]) {
-        outputChannels[m.mInputDestination[c]] +=
-            m.mInputCoefficient[c] *
-            (static_cast<const T*>(inputChannels[c]))[s];
-      }
+      outputChannels[m.mInputDestination[c]] +=
+        m.mInputCoefficient[c]*(static_cast<const T*>(inputChannels[c]))[s];
    }
    // Utilize the fact that in every layout, C is the third channel.
    if (m.mCExtraDestination != IGNORE) {
-      if (inputChannels[SURROUND_C]) {
-        outputChannels[m.mCExtraDestination] +=
-            m.mInputCoefficient[SURROUND_C] *
-            (static_cast<const T*>(inputChannels[SURROUND_C]))[s];
-      }
+      outputChannels[m.mCExtraDestination] +=
+        m.mInputCoefficient[SURROUND_C]*(static_cast<const T*>(inputChannels[SURROUND_C]))[s];
    }

    for (uint32_t c = 0; c < aOutputChannelCount; ++c) {
@@ -7,6 +7,7 @@
 #include <speex/speex_resampler.h>
 #include <string.h>
 #include <cmath>
+#include "mozilla/CheckedInt.h"

 /*
 *  Parts derived from MythTV AudioConvert Class
@@ -262,8 +263,15 @@ AudioConverter::ResampleAudio(void* aOut, const void* aIn, size_t aFrames)
  if (!mResampler) {
    return 0;
  }
-  uint32_t outframes = ResampleRecipientFrames(aFrames);
-  uint32_t inframes = aFrames;
+  uint32_t outframes;
+  if (!ResampleRecipientFrames(aFrames, &outframes)) {
+    return 0;
+  }
+  CheckedUint32 inframesChecked(aFrames);
+  if (!inframesChecked.isValid()) {
+    return 0;
+  }
+  uint32_t inframes = inframesChecked.value();

  int error;
  if (mOut.Format() == AudioConfig::FORMAT_FLT) {
@@ -288,7 +296,7 @@ AudioConverter::ResampleAudio(void* aOut, const void* aIn, size_t aFrames)
    mResampler = nullptr;
    return 0;
  }
-  MOZ_ASSERT(inframes == aFrames, "Some frames will be dropped");
+  MOZ_ASSERT(static_cast<size_t>(inframes) == aFrames, "Some frames will be dropped");
  return outframes;
 }

@@ -373,17 +381,27 @@ AudioConverter::UpmixAudio(void* aOut, const void* aIn, size_t aFrames) const
  return aFrames;
 }

-size_t
-AudioConverter::ResampleRecipientFrames(size_t aFrames) const
-{
+bool AudioConverter::ResampleRecipientFrames(size_t aFrames,
+                                             uint32_t* aOutFrames) const {
  if (!aFrames && mIn.Rate() != mOut.Rate()) {
    if (!mResampler) {
-      return 0;
+      *aOutFrames = 0;
+      return true;
    }
    // We drain by pushing in get_input_latency() samples of 0
    aFrames = speex_resampler_get_input_latency(mResampler);
  }
-  return (uint64_t)aFrames * mOut.Rate() / mIn.Rate() + 1;
+  CheckedInt<uint64_t> numerator = CheckedInt<uint64_t>(aFrames) * mOut.Rate();
+  if (!numerator.isValid()) {
+    return false;
+  }
+  CheckedUint32 outFrames(numerator.value() / mIn.Rate());
+  outFrames += 1u;
+  if (!outFrames.isValid()) {
+    return false;
+  }
+  *aOutFrames = outFrames.value();
+  return true;
 }

 size_t
@@ -7,6 +7,7 @@
 #define AudioConverter_h

 #include "MediaInfo.h"
+#include "mozilla/CheckedInt.h"

 // Forward declaration
 typedef struct SpeexResamplerState_ SpeexResamplerState;
@@ -163,9 +164,15 @@ public:
    AlignedBuffer<Value>* outputBuffer = &temp1;
    AlignedBuffer<Value> temp2;
    if (!frames || mOut.Rate() > mIn.Rate()) {
+      uint32_t resampledFrames;
      // We are upsampling or about to drain, we can't work in place.
      // Allocate another temporary buffer where the upsampling will occur.
-      if (!temp2.SetLength(FramesOutToSamples(ResampleRecipientFrames(frames)))) {
+      if (!ResampleRecipientFrames(frames, &resampledFrames)) {
+        return AudioDataBuffer<Format, Value>(std::move(temp2));
+      }
+      CheckedInt<size_t> outputSamples =
+          CheckedInt<size_t>(resampledFrames) * mOut.Channels();
+      if (!outputSamples.isValid() || !temp2.SetLength(outputSamples.value())) {
        return AudioDataBuffer<Format, Value>(Move(temp2));
      }
      outputBuffer = &temp2;
@@ -229,7 +236,7 @@ private:
  // Resampler context.
  SpeexResamplerState* mResampler;
  size_t ResampleAudio(void* aOut, const void* aIn, size_t aFrames);
-  size_t ResampleRecipientFrames(size_t aFrames) const;
+  bool ResampleRecipientFrames(size_t aFrames, uint32_t* aOutFrames) const;
  void RecreateResampler();
  size_t DrainResampler(void* aOut);
 };
@@ -121,19 +121,13 @@ AudioSegment::Mix(AudioMixer& aMixer, uint32_t aOutputChannels,
      }
      if (channelData.Length() < aOutputChannels) {
        // Up-mix.
-        AudioChannelsUpMix(&channelData, aOutputChannels, static_cast<const AudioDataValue*>(nullptr));
+        AudioChannelsUpMix(&channelData, aOutputChannels, SilentChannel::ZeroChannel<AudioDataValue>());
        for (uint32_t channel = 0; channel < aOutputChannels; channel++) {
          AudioDataValue* ptr =
            PointerForOffsetInChannel(buf.Elements(), outBufferLength,
                                      aOutputChannels, channel, offsetSamples);
-          if (channelData[channel]) {
-            PodCopy(
-                ptr,
-                reinterpret_cast<const AudioDataValue*>(channelData[channel]),
-                frames);
-          } else {
-            PodZero(ptr, frames);
-          }
+          PodCopy(ptr, reinterpret_cast<const AudioDataValue*>(channelData[channel]),
+                  frames);
        }
        MOZ_ASSERT(channelData.Length() == aOutputChannels);
      } else if (channelData.Length() > aOutputChannels) {
@@ -61,22 +61,15 @@ template <typename SrcT, typename DestT>
 static void
 InterleaveAndConvertBuffer(const SrcT* const* aSourceChannels,
                           uint32_t aLength, float aVolume,
-                           uint32_t aChannelCount,
+                           uint32_t aChannels,
                           DestT* aOutput)
 {
-  for (size_t channel = 0; channel < aChannelCount; ++channel) {
-    DestT* output = aOutput;
-    if (aSourceChannels[channel]) {
-      for (size_t i = 0; i < aLength; ++i) {
-        float v = AudioSampleToFloat(aSourceChannels[channel][i])*aVolume;
-        *output = FloatToAudioSample<DestT>(v);
-        output += aChannelCount;
-      }
-    } else {
-      for (size_t i = 0; i < aLength; ++i) {
-        *output = static_cast<DestT>(0);
-        output += aChannelCount;
-      }
+  DestT* output = aOutput;
+  for (size_t i = 0; i < aLength; ++i) {
+    for (size_t channel = 0; channel < aChannels; ++channel) {
+      float v = AudioSampleToFloat(aSourceChannels[channel][i])*aVolume;
+      *output = FloatToAudioSample<DestT>(v);
+      ++output;
    }
  }
 }
@@ -100,7 +93,7 @@ DeinterleaveAndConvertBuffer(const SrcT* aSourceBuffer,
 class SilentChannel
 {
 public:
-  static const int AUDIO_PROCESSING_FRAMES = 640; /* > 10ms of 48KHz audio */
+  static const int AUDIO_PROCESSING_FRAMES = 4096; /* > 10ms of 48KHz audio */
  static const uint8_t gZeroChannel[MAX_AUDIO_SAMPLE_SIZE*AUDIO_PROCESSING_FRAMES];
  // We take advantage of the fact that zero in float and zero in int have the
  // same all-zeros bit layout.
@@ -415,7 +408,7 @@ void WriteChunk(AudioChunk& aChunk,
  if (channelData.Length() < aOutputChannels) {
    // Up-mix. Note that this might actually make channelData have more
    // than aOutputChannels temporarily.
-    AudioChannelsUpMix(&channelData, aOutputChannels, static_cast<const SrcT*>(nullptr));
+    AudioChannelsUpMix(&channelData, aOutputChannels, SilentChannel::ZeroChannel<SrcT>());
  }
  if (channelData.Length() > aOutputChannels) {
    // Down-mix.
@@ -111,7 +111,7 @@ private:
  DECL_MEDIA_PREF("media.ffvpx.enabled",                      PDMFFVPXEnabled, bool, true);
 #endif
 #ifdef MOZ_AV1
-  DECL_MEDIA_PREF("media.av1.enabled",                        AV1Enabled, bool, false);
+  DECL_MEDIA_PREF("media.av1.enabled",                        AV1Enabled, bool, true);
 #endif
 #ifdef XP_WIN
  DECL_MEDIA_PREF("media.wmf.enabled",                        PDMWMFEnabled, bool, true);
@@ -13,7 +13,11 @@
 #include "TheoraDecoder.h"

 #ifdef MOZ_AV1
+#ifdef AV1_USE_AOM
 #include "AOMDecoder.h"
+#else
+#include "Dav1dDecoder.h"
+#endif
 #endif

 namespace mozilla {
@@ -30,7 +34,11 @@ AgnosticDecoderModule::SupportsMimeType(const nsACString& aMimeType,
    TheoraDecoder::IsTheora(aMimeType);
 #ifdef MOZ_AV1
  if (MediaPrefs::AV1Enabled()) {
+#ifdef AV1_USE_AOM
    supports |= AOMDecoder::IsAV1(aMimeType);
+#else
+    supports |= Dav1dDecoder::IsAV1(aMimeType);
+#endif
  }
 #endif
  MOZ_LOG(sPDMLog, LogLevel::Debug, ("Agnostic decoder %s requested type",
@@ -47,10 +55,17 @@ AgnosticDecoderModule::CreateVideoDecoder(const CreateDecoderParams& aParams)
    m = new VPXDecoder(aParams);
  }
 #ifdef MOZ_AV1
+#ifdef AV1_USE_AOM
  else if (AOMDecoder::IsAV1(aParams.mConfig.mMimeType) &&
           MediaPrefs::AV1Enabled()) {
    m = new AOMDecoder(aParams);
  }
+#else
+  else if (Dav1dDecoder::IsAV1(aParams.mConfig.mMimeType) &&
+           MediaPrefs::AV1Enabled()) {
+    m = new Dav1dDecoder(aParams);
+  }
+#endif
 #endif
  else if (TheoraDecoder::IsTheora(aParams.mConfig.mMimeType)) {
    m = new TheoraDecoder(aParams);
@@ -0,0 +1,376 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Dav1dDecoder.h"
+#include "MediaResult.h"
+#include "TimeUnits.h"
+#include "dav1d/dav1d.h"
+#include "mozilla/CheckedInt.h"
+#include "mozilla/PodOperations.h"
+#include "mozilla/SyncRunnable.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
+#include "nsError.h"
+#include "prsystem.h"
+
+#include <algorithm>
+#include <errno.h>
+#include <string.h>
+
+#undef LOG
+#define LOG(arg, ...) MOZ_LOG(sPDMLog, mozilla::LogLevel::Debug, ("Dav1dDecoder(%p)::%s: " arg, this, __func__, ##__VA_ARGS__))
+
+namespace mozilla {
+
+using namespace gfx;
+using namespace layers;
+
+Dav1dDecoder::Dav1dDecoder(const CreateDecoderParams& aParams)
+  : mImageContainer(aParams.mImageContainer)
+  , mTaskQueue(aParams.mTaskQueue)
+  , mCallback(aParams.mCallback)
+  , mIsFlushing(false)
+  , mDecoder(nullptr)
+  , mInfo(aParams.VideoConfig())
+{
+}
+
+Dav1dDecoder::~Dav1dDecoder()
+{
+}
+
+void
+Dav1dDecoder::Shutdown()
+{
+  if (mDecoder) {
+    dav1d_close(&mDecoder);
+  }
+}
+
+RefPtr<MediaDataDecoder::InitPromise>
+Dav1dDecoder::Init()
+{
+  int decodeThreads = 2;
+  if (mInfo.mDisplay.width >= 2048) {
+    decodeThreads = 8;
+  } else if (mInfo.mDisplay.width >= 1024) {
+    decodeThreads = 4;
+  }
+  decodeThreads = std::min(decodeThreads, PR_GetNumberOfProcessors());
+
+  Dav1dSettings settings;
+  dav1d_default_settings(&settings);
+  settings.n_threads = decodeThreads;
+  settings.logger.callback = nullptr;
+
+  if (dav1d_open(&mDecoder, &settings) < 0) {
+    return InitPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_FATAL_ERR, __func__);
+  }
+  return InitPromise::CreateAndResolve(TrackInfo::kVideoTrack, __func__);
+}
+
+void
+Dav1dDecoder::Flush()
+{
+  MOZ_ASSERT(mCallback->OnReaderTaskQueue());
+  mIsFlushing = true;
+  nsCOMPtr<nsIRunnable> r = NS_NewRunnableFunction([this] () {
+    if (mDecoder) {
+      dav1d_flush(mDecoder);
+    }
+  });
+  SyncRunnable::DispatchToThread(mTaskQueue, r);
+  mIsFlushing = false;
+}
+
+static bool
+GetPlaneSize(int aWidth, int aHeight, size_t* aSize)
+{
+  CheckedInt<size_t> size = aWidth;
+  size *= aHeight;
+  if (!size.isValid()) {
+    return false;
+  }
+  *aSize = size.value();
+  return true;
+}
+
+static void
+DownshiftPlane(uint8_t* aDst, int aDstStride, const uint8_t* aSrc,
+               ptrdiff_t aSrcStride, int aWidth, int aHeight, int aShift)
+{
+  for (int y = 0; y < aHeight; y++) {
+    const uint16_t* src =
+      reinterpret_cast<const uint16_t*>(aSrc + y * aSrcStride);
+    uint8_t* dst = aDst + y * aDstStride;
+    for (int x = 0; x < aWidth; x++) {
+      dst[x] = (src[x] >> aShift) & 0xff;
+    }
+  }
+}
+
+MediaResult
+Dav1dDecoder::OutputPicture(const Dav1dPicture& aPicture)
+{
+  const int width = aPicture.p.w;
+  const int height = aPicture.p.h;
+  if (width <= 0 || height <= 0) {
+    return MediaResult(NS_ERROR_DOM_MEDIA_DECODE_ERR,
+                       RESULT_DETAIL("dav1d returned invalid AV1 picture size"));
+  }
+
+  int chromaWidth = width;
+  int chromaHeight = height;
+  switch (aPicture.p.layout) {
+    case DAV1D_PIXEL_LAYOUT_I420:
+      chromaWidth = (width + 1) >> 1;
+      chromaHeight = (height + 1) >> 1;
+      break;
+    case DAV1D_PIXEL_LAYOUT_I422:
+      chromaWidth = (width + 1) >> 1;
+      chromaHeight = height;
+      break;
+    case DAV1D_PIXEL_LAYOUT_I444:
+      break;
+    default:
+      return MediaResult(NS_ERROR_DOM_MEDIA_DECODE_ERR,
+                         RESULT_DETAIL("dav1d returned unsupported AV1 pixel layout: %d",
+                                       int(aPicture.p.layout)));
+  }
+
+  const int planeWidths[3] = { width, chromaWidth, chromaWidth };
+  const int planeHeights[3] = { height, chromaHeight, chromaHeight };
+  const ptrdiff_t srcStrides[3] = {
+    aPicture.stride[0],
+    aPicture.stride[1],
+    aPicture.stride[1]
+  };
+  uint8_t* planeData[3] = {
+    static_cast<uint8_t*>(aPicture.data[0]),
+    static_cast<uint8_t*>(aPicture.data[1]),
+    static_cast<uint8_t*>(aPicture.data[2])
+  };
+  uint32_t planeStrides[3] = { 0, 0, 0 };
+  UniquePtr<uint8_t[]> downshifted[3];
+
+  if (aPicture.p.bpc > 8) {
+    const int shift = aPicture.p.bpc - 8;
+    for (int plane = 0; plane < 3; plane++) {
+      size_t planeSize;
+      if (!GetPlaneSize(planeWidths[plane], planeHeights[plane], &planeSize)) {
+        return MediaResult(NS_ERROR_OUT_OF_MEMORY,
+                           RESULT_DETAIL("AV1 downshift plane size overflow"));
+      }
+      downshifted[plane] = MakeUniqueFallible<uint8_t[]>(planeSize);
+      if (!downshifted[plane]) {
+        return MediaResult(NS_ERROR_OUT_OF_MEMORY,
+                           RESULT_DETAIL("Couldn't allocate AV1 conversion buffer"));
+      }
+      DownshiftPlane(downshifted[plane].get(), planeWidths[plane],
+                     planeData[plane], srcStrides[plane],
+                     planeWidths[plane], planeHeights[plane], shift);
+      planeData[plane] = downshifted[plane].get();
+      planeStrides[plane] = planeWidths[plane];
+    }
+  } else {
+    for (int plane = 0; plane < 3; plane++) {
+      CheckedInt<uint32_t> stride(srcStrides[plane]);
+      if (srcStrides[plane] < 0 || !stride.isValid()) {
+        return MediaResult(NS_ERROR_DOM_MEDIA_DECODE_ERR,
+                           RESULT_DETAIL("dav1d returned invalid AV1 stride"));
+      }
+      planeStrides[plane] = stride.value();
+    }
+  }
+
+  VideoData::YCbCrBuffer b;
+  for (int plane = 0; plane < 3; plane++) {
+    b.mPlanes[plane].mData = planeData[plane];
+    b.mPlanes[plane].mStride = planeStrides[plane];
+    b.mPlanes[plane].mHeight = planeHeights[plane];
+    b.mPlanes[plane].mWidth = planeWidths[plane];
+    b.mPlanes[plane].mOffset = 0;
+    b.mPlanes[plane].mSkip = 0;
+  }
+
+  if (aPicture.seq_hdr) {
+    switch (aPicture.seq_hdr->mtrx) {
+      case DAV1D_MC_BT601:
+      case DAV1D_MC_BT470BG:
+        b.mYUVColorSpace = YUVColorSpace::BT601;
+        break;
+      case DAV1D_MC_BT709:
+        b.mYUVColorSpace = YUVColorSpace::BT709;
+        break;
+      case DAV1D_MC_IDENTITY:
+        b.mYUVColorSpace = YUVColorSpace::IDENTITY;
+        break;
+      default:
+        LOG("Unhandled colorspace %d", aPicture.seq_hdr->mtrx);
+        break;
+    }
+    b.mColorRange = aPicture.seq_hdr->color_range ? ColorRange::FULL
+                                                  : ColorRange::LIMITED;
+  }
+
+  const int64_t time =
+    aPicture.m.timestamp == INT64_MIN ? 0 : aPicture.m.timestamp;
+  const int64_t duration = aPicture.m.duration;
+  const int64_t offset = aPicture.m.offset;
+  const bool keyframe =
+    aPicture.frame_hdr &&
+    aPicture.frame_hdr->frame_type == DAV1D_FRAME_TYPE_KEY;
+
+  RefPtr<VideoData> v =
+    VideoData::CreateAndCopyData(mInfo,
+                                 mImageContainer,
+                                 offset,
+                                 time,
+                                 duration,
+                                 b,
+                                 keyframe,
+                                 time,
+                                 mInfo.ScaledImageRect(width, height));
+
+  if (!v) {
+    LOG("Image allocation error source %dx%d display %ux%u picture %ux%u",
+        width, height, mInfo.mDisplay.width, mInfo.mDisplay.height,
+        mInfo.mImage.width, mInfo.mImage.height);
+    return MediaResult(NS_ERROR_OUT_OF_MEMORY, __func__);
+  }
+  mCallback->Output(v);
+  return NS_OK;
+}
+
+MediaResult
+Dav1dDecoder::DrainOutput()
+{
+  while (true) {
+    Dav1dPicture picture;
+    PodZero(&picture);
+    const int res = dav1d_get_picture(mDecoder, &picture);
+    if (res == DAV1D_ERR(EAGAIN)) {
+      return NS_OK;
+    }
+    if (res < 0) {
+      return MediaResult(NS_ERROR_DOM_MEDIA_DECODE_ERR,
+                         RESULT_DETAIL("dav1d error getting AV1 picture: %d",
+                                       res));
+    }
+
+    MediaResult rv = OutputPicture(picture);
+    dav1d_picture_unref(&picture);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+}
+
+MediaResult
+Dav1dDecoder::DoDecode(MediaRawData* aSample)
+{
+  MOZ_ASSERT(mTaskQueue->IsCurrentThreadIn());
+
+  Dav1dData data;
+  PodZero(&data);
+  uint8_t* dst = dav1d_data_create(&data, aSample->Size());
+  if (!dst) {
+    return MediaResult(NS_ERROR_OUT_OF_MEMORY,
+                       RESULT_DETAIL("Couldn't allocate dav1d AV1 input buffer"));
+  }
+  memcpy(dst, aSample->Data(), aSample->Size());
+  data.m.timestamp = aSample->mTime;
+  data.m.duration = aSample->mDuration;
+  data.m.offset = aSample->mOffset;
+  data.m.size = aSample->Size();
+
+  while (data.sz) {
+    const int res = dav1d_send_data(mDecoder, &data);
+    if (res == DAV1D_ERR(EAGAIN)) {
+      MediaResult rv = DrainOutput();
+      if (NS_FAILED(rv)) {
+        dav1d_data_unref(&data);
+        return rv;
+      }
+      continue;
+    }
+    if (res < 0) {
+      dav1d_data_unref(&data);
+      return MediaResult(NS_ERROR_DOM_MEDIA_DECODE_ERR,
+                         RESULT_DETAIL("dav1d error decoding AV1 sample: %d",
+                                       res));
+    }
+  }
+
+  dav1d_data_unref(&data);
+  return DrainOutput();
+}
+
+void
+Dav1dDecoder::ProcessDecode(MediaRawData* aSample)
+{
+  MOZ_ASSERT(mTaskQueue->IsCurrentThreadIn());
+  if (mIsFlushing) {
+    return;
+  }
+  MediaResult rv = DoDecode(aSample);
+  if (NS_FAILED(rv)) {
+    mCallback->Error(rv);
+  } else {
+    mCallback->InputExhausted();
+  }
+}
+
+void
+Dav1dDecoder::Input(MediaRawData* aSample)
+{
+  MOZ_ASSERT(mCallback->OnReaderTaskQueue());
+  mTaskQueue->Dispatch(NewRunnableMethod<RefPtr<MediaRawData>>(
+                       this, &Dav1dDecoder::ProcessDecode, aSample));
+}
+
+void
+Dav1dDecoder::ProcessDrain()
+{
+  MOZ_ASSERT(mTaskQueue->IsCurrentThreadIn());
+  MediaResult rv = DrainOutput();
+  if (NS_FAILED(rv)) {
+    mCallback->Error(rv);
+  } else {
+    mCallback->DrainComplete();
+  }
+}
+
+void
+Dav1dDecoder::Drain()
+{
+  MOZ_ASSERT(mCallback->OnReaderTaskQueue());
+  mTaskQueue->Dispatch(NewRunnableMethod(this, &Dav1dDecoder::ProcessDrain));
+}
+
+/* static */
+bool
+Dav1dDecoder::IsAV1(const nsACString& aMimeType)
+{
+  return aMimeType.EqualsLiteral("video/webm; codecs=av1") ||
+         aMimeType.EqualsLiteral("video/av1");
+}
+
+/* static */
+nsIntSize
+Dav1dDecoder::GetFrameSize(Span<const uint8_t> aBuffer)
+{
+  Dav1dSequenceHeader seqHdr;
+  PodZero(&seqHdr);
+  if (dav1d_parse_sequence_header(&seqHdr,
+                                  aBuffer.Elements(),
+                                  aBuffer.Length()) < 0) {
+    return nsIntSize(0, 0);
+  }
+  return nsIntSize(seqHdr.max_width, seqHdr.max_height);
+}
+
+} // namespace mozilla
+#undef LOG
@@ -0,0 +1,61 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(Dav1dDecoder_h_)
+#define Dav1dDecoder_h_
+
+#include "PlatformDecoderModule.h"
+#include "mozilla/Span.h"
+
+#include <stdint.h>
+
+typedef struct Dav1dContext Dav1dContext;
+typedef struct Dav1dPicture Dav1dPicture;
+
+namespace mozilla {
+
+class Dav1dDecoder : public MediaDataDecoder
+{
+public:
+  explicit Dav1dDecoder(const CreateDecoderParams& aParams);
+
+  RefPtr<InitPromise> Init() override;
+  void Input(MediaRawData* aSample) override;
+  void Flush() override;
+  void Drain() override;
+  void Shutdown() override;
+  const char* GetDescriptionName() const override
+  {
+    return "dav1d (AV1) video decoder";
+  }
+
+  // Return true if aMimeType is a one of the strings used
+  // by our demuxers to identify AV1 streams.
+  static bool IsAV1(const nsACString& aMimeType);
+
+  // Return the frame dimensions from a sequence header, when one is present.
+  static nsIntSize GetFrameSize(Span<const uint8_t> aBuffer);
+
+private:
+  ~Dav1dDecoder();
+  void ProcessDecode(MediaRawData* aSample);
+  MediaResult DoDecode(MediaRawData* aSample);
+  MediaResult DrainOutput();
+  MediaResult OutputPicture(const Dav1dPicture& aPicture);
+  void ProcessDrain();
+
+  const RefPtr<layers::ImageContainer> mImageContainer;
+  const RefPtr<TaskQueue> mTaskQueue;
+  MediaDataDecoderCallback* mCallback;
+  Atomic<bool> mIsFlushing;
+
+  Dav1dContext* mDecoder;
+
+  const VideoInfo& mInfo;
+};
+
+} // namespace mozilla
+
+#endif // Dav1dDecoder_h_
@@ -55,12 +55,20 @@ if CONFIG['MOZ_FFMPEG']:
    ]

 if CONFIG['MOZ_AV1']:
-    EXPORTS += [
-        'agnostic/AOMDecoder.h',
-    ]
-    UNIFIED_SOURCES += [
-        'agnostic/AOMDecoder.cpp',
-    ]
+    if CONFIG['AV1_USE_AOM']:
+        EXPORTS += [
+            'agnostic/AOMDecoder.h',
+        ]
+        UNIFIED_SOURCES += [
+            'agnostic/AOMDecoder.cpp',
+        ]
+    else:
+        EXPORTS += [
+            'agnostic/Dav1dDecoder.h',
+        ]
+        UNIFIED_SOURCES += [
+            'agnostic/Dav1dDecoder.cpp',
+        ]

 if CONFIG['MOZ_APPLEMEDIA']:
  EXPORTS += [
@@ -26,7 +26,7 @@ ThreadSharedFloatArrayBufferList::Create(uint32_t aChannelCount,
    new ThreadSharedFloatArrayBufferList(aChannelCount);

  for (uint32_t i = 0; i < aChannelCount; ++i) {
-    float* channelData = js_pod_malloc<float>(aLength);
+    float* channelData = js_pod_calloc<float>(aLength);
    if (!channelData) {
      return nullptr;
    }
@@ -40,8 +40,8 @@ public:
  }
  /**
   * Create with buffers suitable for transfer to
-   * JS_NewArrayBufferWithContents().  The buffer contents are uninitialized
-   * and so should be set using GetDataForWrite().
+   * JS_NewArrayBufferWithContents().  The buffer contents are
+   * zero-initialized; callers should set them using GetDataForWrite().
   */
  static already_AddRefed<ThreadSharedFloatArrayBufferList>
  Create(uint32_t aChannelCount, size_t aLength, const mozilla::fallible_t&);
@@ -4,7 +4,7 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 #include "mozilla/Preferences.h"
-#ifdef MOZ_AV1
+#if defined(MOZ_AV1) && defined(AV1_USE_AOM)
 #include "AOMDecoder.h"
 #endif
 #include "MediaPrefs.h"
@@ -136,4 +136,3 @@ WebMDecoder::GetMozDebugReaderData(nsAString& aString)
 }

 } // namespace mozilla
-
@@ -24,6 +24,11 @@ if CONFIG['MOZ_WEBM_ENCODER']:
        'WebMWriter.cpp',
    ]

+if CONFIG['MOZ_AV1']:
+    LOCAL_INCLUDES += [
+        '/dom/media/platforms/agnostic',
+    ]
+
 CXXFLAGS += CONFIG['MOZ_LIBVPX_CFLAGS']

 FINAL_LIBRARY = 'xul'
@@ -29,8 +29,7 @@ enum {
 * Abstract interface for managing audio and video devices. Each platform
 * must implement a concrete class that will map these classes and methods
 * to the appropriate backend. For example, on Desktop platforms, these will
- * correspond to equivalent webrtc (GIPS) calls, and on B2G they will map to
- * a Gonk interface.
+ * correspond to equivalent webrtc (GIPS) calls.
 */
 class MediaEngineVideoSource;
 class MediaEngineAudioSource;
@@ -302,7 +301,6 @@ public:

  /* If implementation of MediaEngineSource supports TakePhoto(), the picture
   * should be return via aCallback object. Otherwise, it returns NS_ERROR_NOT_IMPLEMENTED.
-   * Currently, only Gonk MediaEngineSource implementation supports it.
   */
  virtual nsresult TakePhoto(MediaEnginePhotoCallback* aCallback) = 0;

@@ -36,8 +36,8 @@ bool MediaEngineCameraVideoSource::AppendToTrack(SourceMediaStream* aSource,
  return aSource->AppendToTrack(aID, &(segment));
 }

-// Sub-classes (B2G or desktop) should overload one of both of these two methods
-// to provide capabilities
+// Subclasses should overload one or both of these methods to provide
+// capabilities.
 size_t
 MediaEngineCameraVideoSource::NumCapabilities() const
 {
@@ -324,21 +324,6 @@ MediaEngineCameraVideoSource::SetName(nsString aName)
  bool hasFacingMode = false;
  VideoFacingModeEnum facingMode = VideoFacingModeEnum::User;

-  // Set facing mode based on device name.
-#if defined(ANDROID)
-  // Names are generated. Example: "Camera 0, Facing back, Orientation 90"
-  //
-  // See media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/
-  // webrtc/videoengine/VideoCaptureDeviceInfoAndroid.java
-
-  if (aName.Find(NS_LITERAL_STRING("Facing back")) != kNotFound) {
-    hasFacingMode = true;
-    facingMode = VideoFacingModeEnum::Environment;
-  } else if (aName.Find(NS_LITERAL_STRING("Facing front")) != kNotFound) {
-    hasFacingMode = true;
-    facingMode = VideoFacingModeEnum::User;
-  }
-#endif // ANDROID
 #ifdef XP_MACOSX
  // Kludge to test user-facing cameras on OSX.
  if (aName.Find(NS_LITERAL_STRING("Face")) != -1) {
@@ -108,7 +108,7 @@ protected:
  nsTArray<PrincipalHandle> mPrincipalHandles; // Directly mapped to mSources.
  RefPtr<layers::Image> mImage;
  RefPtr<layers::ImageContainer> mImageContainer;
-  int mWidth, mHeight; // protected with mMonitor on Gonk due to different threading
+  int mWidth, mHeight; // protected with mMonitor
  // end of data protected by mMonitor


@@ -15,7 +15,7 @@
 #ifdef FF
 #undef FF
 #endif
-#include "webrtc/modules/audio_device/opensl/single_rw_fifo.h"
+#include "SingleRwFifo.h"

 #define CHANNELS 1
 #define ENCODING "L16"
@@ -0,0 +1,99 @@
+/*
+ *  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "SingleRwFifo.h"
+
+#include <assert.h>
+
+#if defined(_MSC_VER)
+#include <windows.h>
+#endif
+
+static int
+UpdatePos(int pos, int capacity)
+{
+  return (pos + 1) % capacity;
+}
+
+namespace webrtc {
+
+namespace subtle {
+
+#if defined(_MSC_VER)
+inline void
+MemoryBarrier()
+{
+  ::MemoryBarrier();
+}
+#elif defined(__GNUC__) || defined(__clang__)
+inline void
+MemoryBarrier()
+{
+  __sync_synchronize();
+}
+#else
+#error Add an implementation of MemoryBarrier() for this platform!
+#endif
+
+}  // namespace subtle
+
+SingleRwFifo::SingleRwFifo(int capacity)
+  : capacity_(capacity)
+  , size_(0)
+  , read_pos_(0)
+  , write_pos_(0)
+{
+  queue_.reset(new int8_t*[capacity_]);
+}
+
+SingleRwFifo::~SingleRwFifo()
+{
+}
+
+void
+SingleRwFifo::Push(int8_t* mem)
+{
+  assert(mem);
+
+  // Ensure that there is space for the new data in the FIFO. There is only one
+  // writer, so the other thread is guaranteed only to decrease the size.
+  const int free_slots = capacity() - size();
+  if (free_slots <= 0) {
+    // Size can be queried outside of Push. The caller is expected to ensure
+    // that Push will be successful before calling it.
+    assert(false);
+    return;
+  }
+  queue_[write_pos_] = mem;
+  // Ensure that |size_| is updated after the stored pointer is visible.
+  subtle::MemoryBarrier();
+  ++size_;
+  write_pos_ = UpdatePos(write_pos_, capacity());
+}
+
+int8_t*
+SingleRwFifo::Pop()
+{
+  int8_t* ret_val = nullptr;
+  if (size() <= 0) {
+    // Size can be queried outside of Pop. The caller is expected to ensure
+    // that Pop will be successful before calling it.
+    assert(false);
+    return ret_val;
+  }
+  ret_val = queue_[read_pos_];
+  // Ensure that |size_| is updated after the stored pointer is read.
+  subtle::MemoryBarrier();
+  --size_;
+  read_pos_ = UpdatePos(read_pos_, capacity());
+  return ret_val;
+}
+
+}  // namespace webrtc
@@ -8,8 +8,8 @@
 *  be found in the AUTHORS file in the root of the source tree.
 */

-#ifndef WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
-#define WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
+#ifndef DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_
+#define DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_

 #include "webrtc/base/scoped_ptr.h"
 #include "webrtc/system_wrappers/interface/atomic32.h"
@@ -17,10 +17,9 @@

 namespace webrtc {

-// Implements a lock-free FIFO losely based on
+// Implements a lock-free FIFO loosely based on
 // http://src.chromium.org/viewvc/chrome/trunk/src/media/base/audio_fifo.cc
-// Note that this class assumes there is one producer (writer) and one
-// consumer (reader) thread.
+// This class assumes there is one producer and one consumer thread.
 class SingleRwFifo {
 public:
  explicit SingleRwFifo(int capacity);
@@ -29,8 +28,6 @@ class SingleRwFifo {
  void Push(int8_t* mem);
  int8_t* Pop();

-  void Clear();
-
  int size() { return size_.Value(); }
  int capacity() const { return capacity_; }

@@ -46,4 +43,4 @@ class SingleRwFifo {

 }  // namespace webrtc

-#endif  // WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
+#endif  // DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_
@@ -38,6 +38,7 @@ if CONFIG['MOZ_WEBRTC']:
    # MediaEngineWebRTC.cpp needs to be built separately.
    SOURCES += [
        'MediaEngineWebRTC.cpp',
+        'SingleRwFifo.cpp',
    ]
    LOCAL_INCLUDES += [
        '/dom/base',
@@ -68,8 +69,7 @@ include('/ipc/chromium/chromium-config.mozbuild')

 # Suppress some GCC/clang warnings being treated as errors:
 #  - about attributes on forward declarations for types that are already
-#    defined, which complains about important MOZ_EXPORT attributes for
-#    android API types
+#    defined, which complains about important MOZ_EXPORT attributes.
 if CONFIG['GNU_CC'] or CONFIG['CLANG_CL']:
    CXXFLAGS += [
        '-Wno-error=attributes',
@@ -293,6 +293,12 @@ SpeechSynthesis::ForceEnd()
  }
 }

+void SpeechSynthesis::DisconnectFromOwner() {
+  Pause();
+  Cancel();
+  DOMEventTargetHelper::DisconnectFromOwner();
+}
+
 NS_IMETHODIMP
 SpeechSynthesis::Observe(nsISupports* aSubject, const char* aTopic,
                         const char16_t* aData)
@@ -58,6 +58,8 @@ public:
  void GetVoices(nsTArray< RefPtr<SpeechSynthesisVoice> >& aResult);

  void ForceEnd();
+  
+  void DisconnectFromOwner() override;

  IMPL_EVENT_HANDLER(voiceschanged)

@@ -325,12 +325,12 @@ nsSynthVoiceRegistry::RemoveVoice(nsISpeechService* aService,
       (XRE_IsContentProcess()) ? "child" : "parent"));

  bool found = false;
-  VoiceData* retval = mUriVoiceMap.GetWeak(aUri, &found);
+  RefPtr<VoiceData> retval = mUriVoiceMap.GetWeak(aUri, &found);

-  if(NS_WARN_IF(!(found))) {
+  if(NS_WARN_IF(!found)) {
    return NS_ERROR_NOT_AVAILABLE;
  }
-  if(NS_WARN_IF(!(aService == retval->mService))) {
+  if(NS_WARN_IF(aService != retval->mService)) {
    return NS_ERROR_INVALID_ARG;
  }

@@ -294,7 +294,7 @@ UDPSocketParent::DoConnect(nsCOMPtr<nsIUDPSocket>& aSocket,
                           const UDPAddressInfo& aAddressInfo)
 {
  UDPSOCKET_LOG(("%s: %s:%u", __FUNCTION__, aAddressInfo.addr().get(), aAddressInfo.port()));
-  if (NS_FAILED(ConnectInternal(aAddressInfo.addr(), aAddressInfo.port()))) {
+  if (NS_FAILED(ConnectInternal(aSocket, aAddressInfo.addr(), aAddressInfo.port()))) {
    SendInternalError(aReturnThread, __LINE__);
    return;
  }
@@ -320,13 +320,15 @@ UDPSocketParent::DoConnect(nsCOMPtr<nsIUDPSocket>& aSocket,
 }

 nsresult
-UDPSocketParent::ConnectInternal(const nsCString& aHost, const uint16_t& aPort)
+UDPSocketParent::ConnectInternal(const nsCOMPtr<nsIUDPSocket>& aSocket,
+                                 const nsCString& aHost,
+                                 const uint16_t& aPort)
 {
  nsresult rv;

  UDPSOCKET_LOG(("%s: %s:%u", __FUNCTION__, nsCString(aHost).get(), aPort));

-  if (!mSocket) {
+  if (!aSocket) {
    return NS_ERROR_NOT_AVAILABLE;
  }

@@ -340,7 +342,7 @@ UDPSocketParent::ConnectInternal(const nsCString& aHost, const uint16_t& aPort)
  mozilla::net::NetAddr addr;
  PRNetAddrToNetAddr(&prAddr, &addr);

-  rv = mSocket->Connect(&addr);
+  rv = aSocket->Connect(&addr);
  if (NS_WARN_IF(NS_FAILED(rv))) {
    return rv;
  }
@@ -62,7 +62,9 @@ private:
                        const bool& aAddressReuse, const bool& aLoopback,
                        const uint32_t& recvBufferSize,
                        const uint32_t& sendBufferSize);
-  nsresult ConnectInternal(const nsCString& aHost, const uint16_t& aPort);
+  nsresult ConnectInternal(const nsCOMPtr<nsIUDPSocket>& aSocket,
+                           const nsCString& aHost,
+                           const uint16_t& aPort);
  void FireInternalError(uint32_t aLineNo);
  void SendInternalError(nsIEventTarget *aThread,
                         uint32_t aLineNo);
@@ -577,6 +577,166 @@ typedef struct _NPEvent
 } NPEvent;
 #elif defined(XP_UNIX) && defined(MOZ_X11)
 typedef XEvent NPEvent;
+#elif defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+/*
+ * JIHAD (webOS, cavekit-addons-extensions.md R7) — THE PALM EVENT PROTOCOL.
+ *
+ * webOS plugins do not speak X11. Palm's own npapi.h defines NPEvent, under XP_WEBOS, as the
+ * union below; the device's Adobe Flash was compiled against exactly that header and its
+ * NPP_HandleEvent reads these fields. Reproduced here from the webOS WebKit fork's
+ * WebCore/plugins/npapi.h (the XP_WEBOS block, NpPalmEventsEnum through the NPEvent union),
+ * so that the shape crossing our NPAPI boundary is the shape the plugin was built to read.
+ *
+ * This replaces `typedef void* NPEvent` for the headless toolkit, and that arm was not merely
+ * a placeholder — it was load-bearing in the wrong direction. NPRemoteEvent is a raw memcpy of
+ * sizeof(NPEvent) (dom/plugins/ipc/NPEventUnix.h), so with a void* NPEvent the parent shipped
+ * four bytes of its own address space to the child and the child handed the plugin a pointer
+ * into a foreign process. No event could ever have carried a payload. Making NPEvent a real
+ * POD is what lets the whole existing NPP_HandleEvent path work unmodified, parent to child.
+ *
+ * Gated on MOZ_WIDGET_HEADLESS because that is precisely the configuration this port builds
+ * (--enable-default-toolkit=cairo-headless, no X anywhere in the bundle) and the only one that
+ * reaches this arm. A non-webOS headless embedding would get these structs too; that is
+ * harmless, since the alternative it loses is an NPEvent that could not carry an event.
+ *
+ * POINTER-BEARING MEMBERS DO NOT SURVIVE IPC. dstBuffer/graphicsContext (draw),
+ * touches (touch) and reserved (system) are process-local. Pen, key and system events use
+ * none of them; the draw event is built inside the child (PluginInstanceChild.cpp) and never
+ * crosses the boundary, which is why it stays valid.
+ *
+ * One deliberate omission from Palm's union: NpPalmAccelerometerEvent. It is 16 bytes against
+ * NpPalmDrawEvent's 44, so leaving it out changes sizeof(NPEvent) by nothing — and the union
+ * is only ever read through the plugin's OWN copy of this declaration, so an unused member
+ * here is unobservable. It is left out rather than copied because it carries a struct-scoped
+ * `enum Orientation` whose tag would leak to file scope, for no gain.
+ */
+typedef enum NpPalmEventsEnum
+{
+  npPalmPenDownEvent        = 1 << 0,
+  npPalmPenUpEvent          = 1 << 1,
+  npPalmPenMoveEvent        = 1 << 2,
+  npPalmKeyDownEvent        = 1 << 3,
+  npPalmKeyUpEvent          = 1 << 4,
+  npPalmKeyRepeatEvent      = 1 << 5,
+  npPalmKeyPressEvent       = 1 << 6,
+  npPalmDrawEvent           = 1 << 7,
+  npPalmSystemEvent         = 1 << 8,
+  npPalmGestureEvent        = 1 << 9,
+  npPalmAccelerometerEvent  = 1 << 10,
+  npPalmTouchStartEvent     = 1 << 11,
+  npPalmTouchMoveEvent      = 1 << 12,
+  npPalmTouchEndEvent       = 1 << 13,
+  npPalmTouchCancelledEvent = 1 << 14,
+  npPalmPenDoubleClickEvent = 1 << 15,
+  npPalmPenClickEvent       = 1 << 16
+} NpPalmEventsEnum;
+
+typedef enum NpPalmSystemEventsEnum
+{
+  npPalmPauseEvent            = 1,
+  npPalmResumeEvent           = 2,
+  npPalmGainFocusEvent        = 3,
+  npPalmLoseFocusEvent        = 4,
+  npPalmDimmedEvent           = 5,
+  npPalmSetFullScreenEvent    = 6,
+  npPalmUnsetFullScreenEvent  = 7,
+  npPalmPageLoadingEvent      = 8,
+  npPalmPageLoadCompleteEvent = 9,
+  npPalmViewPortChangedEvent  = 10,
+  npPalmSpotlightStartEvent   = 11,
+  npPalmSpotlightEndEvent     = 12
+} NpPalmSystemEventsEnum;
+
+typedef enum NpPalmKeyModifiersEnum
+{
+  npPalmCtrlKeyModifier  = 1 << 0,
+  npPalmAltKeyModifier   = 1 << 1,
+  npPalmShiftKeyModifier = 1 << 2,
+  npPalmMetaKeyModifier  = 1 << 3
+} NpPalmKeyModifiersEnum;
+
+typedef struct NpPalmKeyEvent
+{
+  int32_t chr;         /* 32-bit so any Unicode character fits */
+  int32_t modifiers;
+  int32_t rawkeyCode;
+  int32_t rawModifier;
+} NpPalmKeyEvent;
+
+typedef struct NpPalmPenEvent
+{
+  int32_t xCoord, yCoord;   /* plugin-local, in the plugin's own unscaled pixels */
+  int32_t modifiers;
+} NpPalmPenEvent;
+
+typedef struct NpPalmTouchPoint
+{
+  int32_t xCoord, yCoord;
+} NpPalmTouchPoint;
+
+typedef struct NpPalmTouchEvent
+{
+  int32_t           touchCount;
+  NpPalmTouchPoint* touches;   /* process-local — never send over IPC */
+  int32_t           modifiers;
+} NpPalmTouchEvent;
+
+typedef struct NpPalmDrawEvent
+{
+  void*    dstBuffer;        /* process-local; API 1.0 raster destination */
+  uint32_t dstRowBytes;
+  int32_t  srcLeft;
+  int32_t  srcRight;
+  int32_t  srcTop;
+  int32_t  srcBottom;
+  void*    graphicsContext;  /* process-local; the Piranha PGContext, API 2.0 */
+  int32_t  dstLeft;
+  int32_t  dstRight;
+  int32_t  dstTop;
+  int32_t  dstBottom;
+} NpPalmDrawEvent;
+
+typedef struct NpPalmSystemEvent
+{
+  NpPalmSystemEventsEnum type;
+  int32_t  value;
+  int32_t  viewLeft;
+  int32_t  viewRight;
+  int32_t  viewTop;
+  int32_t  viewBottom;
+  void*    reserved;         /* process-local */
+} NpPalmSystemEvent;
+
+typedef enum NpPalmGestureEventEnum
+{
+  npPalmGestureStartEvent     = 1,
+  npPalmGestureChangeEvent    = 2,
+  npPalmGestureEndEvent       = 3,
+  npPalmGestureSingleTapEvent = 4
+} NpPalmGestureEventEnum;
+
+typedef struct NpPalmGestureEvent
+{
+  NpPalmGestureEventEnum type;
+  int32_t x, y;
+  float   scale, rotate;
+  int32_t center_x, center_y;
+  int32_t modifiers;
+} NpPalmGestureEvent;
+
+typedef struct NPEvent
+{
+  NpPalmEventsEnum eventType;
+
+  union {
+    NpPalmKeyEvent     keyEvent;
+    NpPalmPenEvent     penEvent;
+    NpPalmDrawEvent    drawEvent;
+    NpPalmSystemEvent  systemEvent;
+    NpPalmGestureEvent gestureEvent;
+    NpPalmTouchEvent   touchEvent;
+  } data;
+} NPEvent;
 #else
 typedef void*  NPEvent;
 #endif
@@ -341,6 +341,10 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
  RefPtr<nsNPAPIPlugin> plugin = new nsNPAPIPlugin();

  PluginLibrary* pluginLib = GetNewPluginLibrary(aPluginTag);
+  // JIHAD DIAGNOSTIC (R7): GetNewPluginLibrary is where the OOP decision is made —
+  // RunPluginOOP() ? PluginModuleParent::LoadModule (launches plugin-container) : a
+  // PluginPRLibrary loaded in-process. A null here is the plugin-container launch failing.
+  fprintf(stderr, "[jihad-npapi] GetNewPluginLibrary lib=%d\n", (int)!!pluginLib);
  if (!pluginLib) {
    return NS_ERROR_FAILURE;
  }
@@ -386,6 +390,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
 #else
  NPError pluginCallError;
  nsresult rv = pluginLib->NP_Initialize(&sBrowserFuncs, &plugin->mPluginFuncs, &pluginCallError);
+  fprintf(stderr, "[jihad-npapi] NP_Initialize rv=0x%x npErr=%d\n", (unsigned)rv, (int)pluginCallError);
  if (rv != NS_OK || pluginCallError != NPERR_NO_ERROR) {
    return NS_ERROR_FAILURE;
  }
@@ -1939,7 +1944,16 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
  }

  case NPNVSupportsWindowless: {
-#if defined(XP_WIN) || defined(XP_MACOSX) || \
+    // MOZ_WIDGET_HEADLESS added for Jihad Browser. This list enumerates the toolkits that can
+    // host a windowless plugin, and it was written before a headless toolkit existed — so a
+    // cairo-headless build answered "windowless unsupported" to every plugin, which is the
+    // opposite of the truth. Headless is the toolkit that MOST needs windowless: there is no X
+    // server, no Drawable and no XEmbed, so windowed hosting is impossible and drawing into a
+    // memory bitmap we own is the only thing that can work. gfxPlatformHeadless already returns
+    // true from SupportsPluginDirectBitmapDrawing(), i.e. the drawing model this unlocks
+    // (NPDrawingModelAsyncBitmapSurface) is implemented for this platform; only this
+    // advertisement was missing, and with it false no plugin would ever choose windowless.
+#if defined(XP_WIN) || defined(XP_MACOSX) || defined(MOZ_WIDGET_HEADLESS) || \
    (defined(MOZ_X11) && defined(MOZ_WIDGET_GTK))
    *(NPBool*)result = true;
 #else
@@ -843,6 +843,9 @@ nsPluginHost::InstantiatePluginInstance(const nsACString& aMimeType, nsIURI* aUR
  }

  rv = SetUpPluginInstance(aMimeType, aURL, instanceOwner);
+  // JIHAD DIAGNOSTIC (R7): the real rv is flattened to NS_ERROR_FAILURE below, which is what
+  // made this failure opaque from the caller's side.
+  fprintf(stderr, "[jihad-npapi] SetUpPluginInstance rv=0x%x\n", (unsigned)rv);
  if (NS_FAILED(rv)) {
    instanceOwner->Destroy();
    return NS_ERROR_FAILURE;
@@ -961,7 +964,12 @@ nsPluginHost::TrySetUpPluginInstance(const nsACString &aMimeType,
 #endif

  RefPtr<nsNPAPIPlugin> plugin;
-  GetPlugin(aMimeType, getter_AddRefs(plugin));
+  nsresult jihadGetRv = GetPlugin(aMimeType, getter_AddRefs(plugin));
+  // JIHAD DIAGNOSTIC (R7): GetPlugin -> CreateNPAPIPlugin -> nsNPAPIPlugin::CreatePlugin, which
+  // for an OOP build is PluginModuleParent::LoadModule (the plugin-container launch). Its rv is
+  // DISCARDED here; only the null check survives, so a launch failure is invisible.
+  fprintf(stderr, "[jihad-npapi] GetPlugin rv=0x%x plugin=%d\n",
+          (unsigned)jihadGetRv, (int)!!plugin);
  if (!plugin) {
    return NS_ERROR_FAILURE;
  }
@@ -987,6 +995,7 @@ nsPluginHost::TrySetUpPluginInstance(const nsACString &aMimeType,
  // except in some cases not Java, see bug 140931
  // our COM pointer will free the peer
  nsresult rv = instance->Initialize(plugin.get(), aOwner, aMimeType);
+  fprintf(stderr, "[jihad-npapi] instance->Initialize rv=0x%x\n", (unsigned)rv);
  if (NS_FAILED(rv)) {
    mInstances.RemoveElement(instance.get());
    aOwner->SetInstance(nullptr);
@@ -4201,3 +4210,62 @@ PluginDestructionGuard::DelayDestroy(nsNPAPIPluginInstance *aInstance)

  return false;
 }
+
+// ── JIHAD (webOS, cavekit-addons-extensions.md R7) ────────────────────────────────────────
+//
+// A C entry point for the render daemon, following the jihad_offscreen_* precedent in
+// widget/PuppetWidget.cpp: the daemon links against libxul but cannot see internal classes,
+// and nsNPAPIPluginInstance::HandleEvent is neither exported nor virtual, so there is no
+// other way to reach a plugin from outside.
+//
+// This exists for the frozen YAP command pair asyncCmdPluginSpotlightStart/End. The card
+// scrims and smart-zooms to a plugin, then tells the server the rect it settled on; the
+// server's job is to pass that on to the plugin as Palm's npPalmSpotlightStartEvent(11) /
+// npPalmSpotlightEndEvent(12). It is not cosmetic: Flash routes 11 to the same handler as
+// npPalmSetFullScreenEvent(6) and 12 to the same as npPalmUnsetFullScreenEvent(7)
+// (libflashplayer.so jump table at 0x44e0c — entries 10 and 11 target 0x44fa0/0x44e80,
+// identical to entries 5 and 6), so this is how a plugin is told it went fullscreen.
+//
+// Broadcast to every running instance rather than targeting one: the spotlight is a
+// page-level, one-plugin-at-a-time state, this daemon serves a single card, and the
+// alternative — matching the rect against each instance's frame — would invent a
+// disambiguation rule that the contract does not define. Returns how many instances were
+// told, so a caller can tell "no plugin" from "delivered".
+extern "C" MOZ_EXPORT int
+jihad_plugin_palm_spotlight(int aOn, int aLeft, int aTop, int aRight, int aBottom)
+{
+#ifdef MOZ_ENABLE_NPAPI
+  RefPtr<nsPluginHost> host = nsPluginHost::GetInst();
+  if (!host) {
+    return 0;
+  }
+
+  NPEvent ev;
+  memset(&ev, 0, sizeof(ev));
+  ev.eventType = npPalmSystemEvent;
+  ev.data.systemEvent.type = aOn ? npPalmSpotlightStartEvent : npPalmSpotlightEndEvent;
+  // Palm's host leaves systemEvent.value uninitialised here and fills only the rect
+  // (libWebKitLuna handlePluginSpotlightStart 0x4e6cec-0x4e6d24, which never writes [sp+8]).
+  // The memset above zeroes it, which is strictly tidier and observably the same.
+  ev.data.systemEvent.viewLeft   = aLeft;
+  ev.data.systemEvent.viewTop    = aTop;
+  ev.data.systemEvent.viewRight  = aRight;
+  ev.data.systemEvent.viewBottom = aBottom;
+
+  int delivered = 0;
+  // Copy the instance list first: HandleEvent re-enters the plugin, which may run script and
+  // tear an instance down underneath us.
+  nsTArray<RefPtr<nsNPAPIPluginInstance>> instances(host->JihadRunningInstances());
+  for (uint32_t i = 0; i < instances.Length(); ++i) {
+    int16_t response = kNPEventNotHandled;
+    if (NS_SUCCEEDED(instances[i]->HandleEvent(&ev, &response,
+                                               NS_PLUGIN_CALL_SAFE_TO_REENTER_GECKO))) {
+      delivered++;
+    }
+  }
+  return delivered;
+#else
+  (void)aOn; (void)aLeft; (void)aTop; (void)aRight; (void)aBottom;
+  return 0;
+#endif
+}
@@ -274,6 +274,13 @@ public:
                             InfallibleTArray<nsCString>& result,
                             bool firstMatchOnly);

+  // Jihad R7 (webOS): a snapshot of the live instances, for jihad_plugin_palm_spotlight.
+  // A COPY, not a reference: dispatching an event re-enters the plugin, which can run script
+  // and destroy an instance, and mInstances is mutated by that teardown.
+  const nsTArray<RefPtr<nsNPAPIPluginInstance>>& JihadRunningInstances() const {
+    return mInstances;
+  }
+
 private:
  friend class nsPluginUnloadRunnable;

@@ -569,6 +569,75 @@ NS_IMETHODIMP nsPluginInstanceOwner::InvalidateRect(NPRect *invalidRect)
  GetContentsScaleFactor(&scaleFactor);
  rect.ScaleRoundOut(scaleFactor);
  mPluginFrame->InvalidateLayer(nsDisplayItem::TYPE_PLUGIN, &rect);
+
+  // JIHAD (2026-08-09): drive the offscreen daemon's re-capture for WINDOWLESS plugins.
+  //
+  // A windowless plugin has no mWidget, so the mWidget->Invalidate() branch above (which is what
+  // ultimately reaches PuppetWidget::Invalidate and sets the daemon's mJihadDirty flag) never
+  // runs. InvalidateLayer() alone only marks the plugin's ImageLayer for recomposition; with the
+  // in-process BasicLayerManager and no separate compositor, that repaints the widget's own layer
+  // backbuffer but never triggers jihad_offscreen_render_region, the path that actually renders a
+  // frame into the adapter's shared buffer for the card. Measured: Flash pushes a fresh magenta
+  // frame into its ImageContainer ~15x/s and BasicImageLayer::Paint runs on each, yet
+  // render_region fired ONCE (at load) so the card froze on the pre-content frame. The control
+  // plugin only appeared to work because its static fill was already present at that single
+  // capture. Invalidate the nearest real widget here so every async plugin frame marks the daemon
+  // dirty and gets composited to the card.
+  //
+  // THE RECT MATTERS, and the first version of this got it wrong. It invalidated
+  // nearest->GetBounds() — the WIDGET's bounds, i.e. the whole viewport — on the reasoning
+  // that the daemon re-renders the whole document per capture anyway. That reasoning stopped
+  // being true when the daemon learned to repaint only the damaged rows: a whole-viewport
+  // software render costs ~40 ms on this hardware against ~4 ms for a 320x240 plugin box, and
+  // a full-viewport damage box silently forced the expensive path on every single frame.
+  // Measured: an animated SWF ran at 19 fps with 1 partial repaint in 39, and the damage box
+  // logged as 768x942 with the plugin's own 320x240 unioned uselessly into it.
+  //
+  // So invalidate the plugin's own area, translated from plugin-local into the widget's
+  // coordinates the same way the rest of this file does it: content-box origin relative to the
+  // frame, offset to the widget, in device px.
+  if (!mWidget) {
+    nsIWidget* nearest = mPluginFrame->GetNearestWidget();
+    if (nearest) {
+      nsIntRect widgetRect = rect;
+      nsPresContext* pc = mPluginFrame->PresContext();
+      // Offset to the ROOT frame, which is what the widget's coordinates are relative to.
+      // GetReferenceFrame() was the first attempt and it is wrong here: for a plugin it
+      // resolves to a frame that makes the offset come out 0, so every invalidation landed at
+      // the viewport's top-left corner instead of on the plugin. That is not a small error —
+      // the damage-only repaint then faithfully refreshed the wrong 320x240 box and the
+      // plugin's own area never updated again, which reads on screen as the animation
+      // freezing after its first frame. This is the same offset nsPluginFrame itself uses to
+      // build NPWindow.x/y.
+      nsIFrame* rootFrame = nullptr;
+      if (nsIPresShell* ps = mPluginFrame->PresContext()->GetPresShell()) {
+        rootFrame = ps->GetRootFrame();
+      }
+      nsPoint origin = mPluginFrame->GetContentRectRelativeToSelf().TopLeft() +
+                       (rootFrame ? mPluginFrame->GetOffsetToCrossDoc(rootFrame) : nsPoint());
+      widgetRect.MoveBy(pc->AppUnitsToDevPixels(origin.x),
+                        pc->AppUnitsToDevPixels(origin.y));
+      // A plugin is entitled to report an invalid rect larger than itself, and an empty one
+      // would invalidate nothing at all; clamp to the plugin's own box, and fall back to the
+      // widget bounds if that leaves nothing (correctness before speed).
+      nsIntRect pluginBox(pc->AppUnitsToDevPixels(origin.x),
+                          pc->AppUnitsToDevPixels(origin.y),
+                          pc->AppUnitsToDevPixels(
+                              mPluginFrame->GetContentRectRelativeToSelf().width),
+                          pc->AppUnitsToDevPixels(
+                              mPluginFrame->GetContentRectRelativeToSelf().height));
+      widgetRect = widgetRect.Intersect(pluginBox);
+      if (widgetRect.IsEmpty()) {
+        widgetRect = pluginBox;
+      }
+      if (widgetRect.IsEmpty()) {
+        nearest->Invalidate(nearest->GetBounds());
+      } else {
+        nearest->Invalidate(LayoutDeviceIntRect(widgetRect.x, widgetRect.y,
+                                                widgetRect.width, widgetRect.height));
+      }
+    }
+  }
  return NS_OK;
 }

@@ -2530,6 +2599,122 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
    rv = nsEventStatus_eConsumeNoDefault;
 #endif

+// Guard MUST match the one npapi.h uses to define NPEvent as Palm's union. Any other
+// predicate compiles this against `typedef void* NPEvent` and does not build.
+#if defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+  // JIHAD (webOS, cavekit-addons-extensions.md R7) — DELIVER INPUT IN THE PALM PROTOCOL.
+  //
+  // Everything above this point is a platform arm: XP_MACOSX, XP_WIN, MOZ_X11. A
+  // cairo-headless build matches none of them, so this function used to reduce to
+  // `return nsEventStatus_eIgnore;` and a windowless plugin received no mouse, key, focus or
+  // blur event in its whole lifetime. Measured on the TouchPad before this branch existed: a
+  // tap hit-tested the <EMBED>, the daemon logged `mouseSend <EMBED> ... : down`, and the
+  // plugin's NPP_HandleEvent was called exactly once ever — for the child's own gain-focus
+  // injection. Nothing upstream is at fault; the DOM listeners, the hit test, the windowless
+  // guards and the IPC hop are all live and correct (see the Dispatch*ToPlugin callers).
+  //
+  // The event shape is Palm's, because NPEvent on this platform IS Palm's union (npapi.h) and
+  // the device's Flash was compiled against that declaration.
+  {
+    NPEvent pluginEvent;
+    memset(&pluginEvent, 0, sizeof(pluginEvent));
+
+    if (anEvent.mClass == eMouseEventClass) {
+      const WidgetMouseEvent& mouseEvent = *anEvent.AsMouseEvent();
+
+      switch (anEvent.mMessage) {
+        case eMouseDown:   pluginEvent.eventType = npPalmPenDownEvent; break;
+        case eMouseUp:     pluginEvent.eventType = npPalmPenUpEvent;   break;
+        case eMouseMove:   pluginEvent.eventType = npPalmPenMoveEvent; break;
+        // The synthesized click/dblclick that follows a down/up pair. Palm's host sends these
+        // as their own event types rather than swallowing them (libWebKitLuna
+        // handleMouseEvent 0x4e946c-0x4e94d8 maps click -> 65536 and dblclick -> 32768, in
+        // ADDITION to the down/up pair, not instead of it), so this is what a plugin written
+        // for webOS was built to see. The X11 arm above drops them instead, which is right
+        // for X11 and wrong here.
+        //
+        // Flash itself ignores both: its NPP_HandleEvent jump table (libflashplayer.so
+        // 0x4514c-0x4522c) compares only against 1/2/4/8/16/64/128/256/512, and anything
+        // else falls through to "not handled" — confirmed on device, where a tap logs
+        // `palm event 0x10000 ... handled=0` between two handled pen events. Sending them
+        // anyway is deliberate: the contract is the host's, not this one plugin's, and a
+        // plugin that acts only on the click is otherwise silently unusable.
+        case eMouseClick:       pluginEvent.eventType = npPalmPenClickEvent;       break;
+        case eMouseDoubleClick: pluginEvent.eventType = npPalmPenDoubleClickEvent; break;
+        default: break;   // over/out/wheel/aux: no Palm equivalent, drop
+      }
+
+      if (pluginEvent.eventType) {
+        // The plugin-local point, computed exactly as the MOZ_X11 arm above computes it. This
+        // is also what Palm's own host does — PluginView's webOS block uses the renderer's
+        // absoluteToLocal() on the same absolute location — so the two hosts agree on the
+        // space without either being ported to the other.
+        //
+        // Deliberately NO zoom or scroll arithmetic here. The card's fit-zoom is not an engine
+        // zoom (it is applied when the daemon scales the capture context), layout.css.
+        // devPixelsPerPx is pinned to 1.0, and the daemon has already mapped card px to CSS
+        // viewport px before dispatching. Adding a factor here is how plugin input drifts away
+        // from where page content thinks it was clicked; the criterion is that both go through
+        // the same transform, and they do precisely because this arm adds none.
+        const nsPresContext* presContext = mPluginFrame->PresContext();
+        nsPoint appPoint =
+          nsLayoutUtils::GetEventCoordinatesRelativeTo(&anEvent, mPluginFrame) -
+          mPluginFrame->GetContentRectRelativeToSelf().TopLeft();
+        pluginEvent.data.penEvent.xCoord =
+          presContext->AppUnitsToDevPixels(appPoint.x);
+        pluginEvent.data.penEvent.yCoord =
+          presContext->AppUnitsToDevPixels(appPoint.y);
+        pluginEvent.data.penEvent.modifiers =
+          (mouseEvent.IsControl() ? npPalmCtrlKeyModifier  : 0) |
+          (mouseEvent.IsAlt()     ? npPalmAltKeyModifier   : 0) |
+          (mouseEvent.IsShift()   ? npPalmShiftKeyModifier : 0) |
+          (mouseEvent.IsMeta()    ? npPalmMetaKeyModifier  : 0);
+      }
+    } else if (anEvent.mClass == eKeyboardEventClass) {
+      const WidgetKeyboardEvent& keyEvent = *anEvent.AsKeyboardEvent();
+
+      switch (anEvent.mMessage) {
+        case eKeyDown:  pluginEvent.eventType = npPalmKeyDownEvent;  break;
+        case eKeyUp:    pluginEvent.eventType = npPalmKeyUpEvent;    break;
+        case eKeyPress: pluginEvent.eventType = npPalmKeyPressEvent; break;
+        default: break;
+      }
+
+      if (pluginEvent.eventType) {
+        // There is no native key event to copy from on this platform (mPluginEvent is a
+        // Windows concept), so the Palm fields are synthesized from the widget event.
+        // rawkeyCode/rawModifier are Palm's "pass the unprocessed event through" pair, which
+        // for a synthesized event is the same key code and modifier set.
+        int32_t mods =
+          (keyEvent.IsControl() ? npPalmCtrlKeyModifier  : 0) |
+          (keyEvent.IsAlt()     ? npPalmAltKeyModifier   : 0) |
+          (keyEvent.IsShift()   ? npPalmShiftKeyModifier : 0) |
+          (keyEvent.IsMeta()    ? npPalmMetaKeyModifier  : 0);
+        pluginEvent.data.keyEvent.chr =
+          static_cast<int32_t>(keyEvent.PseudoCharCode());
+        pluginEvent.data.keyEvent.modifiers   = mods;
+        pluginEvent.data.keyEvent.rawkeyCode  = static_cast<int32_t>(keyEvent.mKeyCode);
+        pluginEvent.data.keyEvent.rawModifier = mods;
+      }
+    } else if (anEvent.mMessage == eFocus || anEvent.mMessage == eBlur) {
+      // Focus arrives as a bare WidgetGUIEvent with a null widget (see DispatchFocusToPlugin),
+      // so it must not touch the coordinate path above.
+      pluginEvent.eventType = npPalmSystemEvent;
+      pluginEvent.data.systemEvent.type =
+        (anEvent.mMessage == eFocus) ? npPalmGainFocusEvent : npPalmLoseFocusEvent;
+    }
+
+    if (pluginEvent.eventType) {
+      int16_t response = kNPEventNotHandled;
+      mInstance->HandleEvent(&pluginEvent, &response,
+                             NS_PLUGIN_CALL_SAFE_TO_REENTER_GECKO);
+      if (response == kNPEventHandled) {
+        rv = nsEventStatus_eConsumeNoDefault;
+      }
+    }
+  }
+#endif
+
  return rv;
 }

@@ -2977,23 +3162,40 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
    if (!mWidget) {
      // native (single process)
      mWidget = do_CreateInstance(kWidgetCID, &rv);
-      nsWidgetInitData initData;
-      initData.mWindowType = eWindowType_plugin;
-      initData.mUnicode = false;
-      initData.clipChildren = true;
-      initData.clipSiblings = true;
-      rv = mWidget->Create(parentWidget.get(), nullptr,
-                           LayoutDeviceIntRect(0, 0, 0, 0), &initData);
-      if (NS_FAILED(rv)) {
-        mWidget->Destroy();
-        mWidget = nullptr;
-        return rv;
+      if (!mWidget) {
+        // JIHAD (2026-10-05): A BUILD WITH NO CHILD-WINDOW WIDGET HAS NO WINDOWED PLUGINS.
+        // The offscreen embedding registers no widget for kWidgetCID, so this came back
+        // null and the Create() call below dereferenced it: the daemon died with SIGSEGV on
+        // every page whose Flash movie was embedded the ordinary way. A plugin is windowed
+        // unless it asks otherwise, and Flash asks only for wmode=opaque/transparent — the
+        // default, wmode=window, is what most of the web uses (found on two "Flash test"
+        // sites; every test page of ours had wmode=opaque). webOS's own browser never had
+        // plugin windows either and handed every plugin a drawable; its Flash build draws
+        // through the Palm window structure in both modes. So do the same: with no window
+        // to give, the instance is windowless.
+        mInstance->SetWindowless(true);
+        windowless = true;
+      } else {
+        nsWidgetInitData initData;
+        initData.mWindowType = eWindowType_plugin;
+        initData.mUnicode = false;
+        initData.clipChildren = true;
+        initData.clipSiblings = true;
+        rv = mWidget->Create(parentWidget.get(), nullptr,
+                             LayoutDeviceIntRect(0, 0, 0, 0), &initData);
+        if (NS_FAILED(rv)) {
+          mWidget->Destroy();
+          mWidget = nullptr;
+          return rv;
+        }
      }
    }

-    mWidget->EnableDragDrop(true);
-    mWidget->Show(false);
-    mWidget->Enable(false);
+    if (mWidget) {
+      mWidget->EnableDragDrop(true);
+      mWidget->Show(false);
+      mWidget->Enable(false);
+    }
  }

  if (mPluginFrame) {
@@ -194,7 +194,7 @@ static void FreeStringArray(uint32_t variants, char ** array)

 static bool CanLoadPlugin(char16ptr_t aBinaryPath)
 {
-#if defined(_M_IX86) || defined(_M_X64) || defined(_M_IA64)
+#if defined(_M_IX86) || defined(_M_X64)
  bool canLoad = false;

  HANDLE file = CreateFileW(aBinaryPath, GENERIC_READ,
@@ -214,8 +214,6 @@ static bool CanLoadPlugin(char16ptr_t aBinaryPath)
            canLoad = (arch == IMAGE_FILE_MACHINE_I386);
 #elif defined(_M_X64)
            canLoad = (arch == IMAGE_FILE_MACHINE_AMD64);
-#elif defined(_M_IA64)
-            canLoad = (arch == IMAGE_FILE_MACHINE_IA64);
 #endif
          }
        }
@@ -133,6 +133,12 @@ BrowserStreamChild::RecvNPP_DestroyStream(const NPReason& reason)
 {
  PLUGIN_LOG_DEBUG_METHOD;

+  // Jihad R7: end-of-stream is what tells a Flash player the movie is complete. A player that
+  // is never told stops on frame zero, which looks exactly like a player that cannot draw.
+  fprintf(stderr, "[jihad-npapi-child] RecvNPP_DestroyStream reason=%d state=%d\n",
+          (int)reason, (int)mState);
+  fflush(stderr);
+
  if (ALIVE != mState)
    NS_RUNTIMEABORT("Unexpected state: recevied NPP_DestroyStream twice?");

@@ -232,8 +238,12 @@ BrowserStreamChild::Deliver()
    if (kStreamOpen == mStreamStatus)
      mStreamStatus = NPRES_DONE;

-    (void) mInstance->mPluginIface
+    NPError dsrv = mInstance->mPluginIface
      ->destroystream(&mInstance->mData, &mStream, mStreamStatus);
+    // Jihad R7: the delivery site, as opposed to RecvNPP_DestroyStream which only queues it.
+    fprintf(stderr, "[jihad-npapi-child] NPP_DestroyStream status=%d rv=%d\n",
+            (int)mStreamStatus, (int)dsrv);
+    fflush(stderr);
  }
  if (DESTROYED == mDestroyPending && mNotifyPending) {
    NS_ASSERTION(mStreamNotify, "mDestroyPending but no mStreamNotify?");
@@ -0,0 +1,74 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * NPN entry points exported as GLOBAL SYMBOLS, for plugins that expect the old Netscape
+ * convention where the host browser exports them rather than only passing an NPNetscapeFuncs
+ * table to NP_Initialize.
+ *
+ * WHY THIS IS ITS OWN TRANSLATION UNIT. The obvious place for these is PluginModuleChild.cpp,
+ * and it does not work: npapi.h already declares NPN_InvalidateRect, and every header in this
+ * build is compiled under `-include config/gcc_hidden.h`, which pushes hidden visibility. GCC
+ * takes visibility from the FIRST declaration it sees, so a later definition carrying
+ * __attribute__((visibility("default"))) is silently ignored and the symbol lands in the
+ * object as GLOBAL HIDDEN — present to `nm`, absent from the dynamic table, and therefore
+ * impossible to interpose. Verified with readelf. This file deliberately includes no NPAPI
+ * headers at all and describes the functions with void* so there is no prior declaration to
+ * inherit hidden visibility from.
+ *
+ * WHY IT MATTERS. webOS's Flash imports NPN_CreateObject and NPN_InvalidateRect as undefined
+ * dynamic symbols. Left alone they bind into libWebKitLuna.so — another browser engine that
+ * is in this process because Flash (and our Piranha drawing path) pull it in. Two consequences,
+ * both measured:
+ *   1. Flash's repaint requests go to LunaSysMgr's WebKit and never reach our engine, so the
+ *      plugin is only ever painted when something else happens to invalidate it. That alone
+ *      makes an animating plugin look frozen.
+ *   2. It is a latent crash: UXP stores a PluginInstanceChild* in NPP::ndata, while
+ *      libWebKitLuna's NPN_InvalidateRect casts that same field to a WebCore::PluginView* and
+ *      makes a virtual call on it — a wild vtable dispatch on the first repaint.
+ *
+ * The forwarding pointers are installed by PluginModuleChild once the browser function table
+ * exists; until then these are safe no-ops.
+ */
+
+#include <stdio.h>
+
+extern "C" {
+
+void  (*gJihadNPNInvalidateRect)(void* aNPP, void* aRect) = 0;
+void* (*gJihadNPNCreateObject)(void* aNPP, void* aClass)  = 0;
+
+// Read by the host repaint clock in PluginInstanceChild.cpp: while this is zero the plugin has
+// never asked to be repainted, so the host has to drive it.
+unsigned gJihadNPNInvalidateRectCalls = 0;
+
+__attribute__((visibility("default"))) void
+NPN_InvalidateRect(void* aNPP, void* aRect)
+{
+    // The first call is the signal that the plugin's frame clock is finally running; without
+    // it the plugin is only ever painted by an unrelated invalidation, which is
+    // indistinguishable on screen from a plugin that draws nothing. Log it once, and log the
+    // no-forwarder case too — arriving before PluginModuleChild installs the pointers is a
+    // dropped repaint, not a no-op.
+    gJihadNPNInvalidateRectCalls++;
+    static int sLogged = 0;
+    if (sLogged < 8) {
+        sLogged++;
+        fprintf(stderr, "[jihad-npapi-child] NPN_InvalidateRect npp=%p rect=%p fwd=%p\n",
+                aNPP, aRect, (void*)gJihadNPNInvalidateRect);
+        fflush(stderr);
+    }
+    if (gJihadNPNInvalidateRect) {
+        gJihadNPNInvalidateRect(aNPP, aRect);
+    }
+}
+
+__attribute__((visibility("default"))) void*
+NPN_CreateObject(void* aNPP, void* aClass)
+{
+    return gJihadNPNCreateObject ? gJihadNPNCreateObject(aNPP, aClass) : 0;
+}
+
+} // extern "C"
@@ -125,6 +125,29 @@ child:
  // of its parent has changed
  async ContentsScaleFactorChanged(double aContentsScaleFactor);

+  // Jihad (webOS, cavekit-addons-extensions.md R7): ask the plugin for ONE frame, now.
+  //
+  // Palm's host issued npPalmDrawEvent every time the PAGE painted, so Flash can sit on its own
+  // frame clock and expect to be asked. Patch 0026 got it drawing by giving the CHILD a timer,
+  // but that timer free-runs against the daemon's tick, so a frame lands at a drifting phase and
+  // waits up to a whole tick to be published. Measured on device with a 30 fps SWF: 1:1 delivery
+  // and a 31-34 ms average, but a gap spread of 9-62 ms, which is what the eye reads as stutter.
+  //
+  // CAUTION, measured 2026-08-10 and it contradicts what 0026 assumed: the plugin DOES invalidate
+  // itself, ~22 times a second, alongside our ~27. The counter 0026 reads to conclude otherwise
+  // (gJihadNPNInvalidateRectCalls) only sees calls that bind the NPN_InvalidateRect SYMBOL, and
+  // an ordinary NPAPI plugin goes through the NPNetscapeFuncs table instead. So this message is
+  // currently a SECOND producer rather than the only one, and whether it should exist at all for
+  // a self-invalidating plugin is open — see the R7 frame-rate criterion.
+  //
+  // This is the pull that removes the second clock. ASYNC on purpose: the stock host pulls the
+  // plugin synchronously inside its page paint (PluginViewPalm), but out-of-process that shape
+  // is intr NPP_HandleEvent, which would block the daemon's main thread — and therefore its
+  // tick and its YAP socket — for a full IPC round trip plus a Flash paint on every frame.
+  // Async keeps the phase lock and costs nothing: the child coalesces duplicate requests via
+  // mCurrentInvalidateTask, so an extra request while one is in flight is a no-op.
+  async JihadRequestFrame();
+
  // ********************** Async plugins rendering
  // see https://wiki.mozilla.org/Gecko:AsyncPluginPainting
  // **********************
@@ -36,7 +36,7 @@

 #include <map>

-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
 #endif

@@ -141,6 +141,10 @@ protected:
    virtual bool
    RecvContentsScaleFactorChanged(const double& aContentsScaleFactor) override;

+    // Jihad: the host is driving the frame clock — draw one now. See PPluginInstance.ipdl.
+    virtual bool
+    RecvJihadRequestFrame() override;
+
    virtual bool
    AnswerNPP_Destroy(NPError* result) override;

@@ -462,6 +466,8 @@ private:
    NPSetWindowCallbackStruct mWsInfo;
 #ifdef MOZ_WIDGET_GTK
    bool mXEmbed;
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    XtClient mXtClient;
 #endif
 #elif defined(OS_WIN)
@@ -639,6 +645,22 @@ private:
    // and p->getvalue return always false
    bool mIsTransparent;

+    // Jihad R7 (webOS): npPalmGainFocusEvent is a once-per-instance startup signal, but the
+    // setwindow that carries it runs again on every resize and scroll.
+    bool mJihadSentPalmGainFocus;
+
+    // Jihad R7 (webOS): cap on the input-delivery breadcrumb in AnswerNPP_HandleEvent. A
+    // pen-move stream is unbounded; the daemon log is the only field-debug channel there is.
+    uint32_t mJihadInputEventsLogged;
+
+public:
+    // Jihad R7 (webOS): repaint this instance from the host's own clock. See
+    // JihadGlibPumpTask::Run — a webOS plugin is not obliged to ask for repaints, because the
+    // host it was written for painted it as part of every page paint.
+    void JihadPalmRepaintTick();
+
+private:
+
    // Surface type optimized of parent process
    gfxSurfaceType mSurfaceType;

@@ -115,6 +115,16 @@ PluginInstanceParent::LookupPluginInstanceByID(uintptr_t aId)
 }
 #endif

+// Jihad: every live instance, so a C entry point can reach one. jihad_plugin_frame_seq needs no
+// instance because it only counts; a frame REQUEST has to be sent on an actual actor.
+//
+// A plain file-static array maintained in the ctor/dtor below, not a hashtable: this is at most a
+// couple of entries on a single-card embedding, it is only ever touched on the main thread (the
+// daemon calls the export from inside its own tick, on that same thread), and the alternative —
+// walking nsPluginHost's nsNPAPIPluginInstance list the way jihad_plugin_palm_spotlight does —
+// would still have to get from there to the PluginInstanceParent actor to call Send on it.
+static nsTArray<PluginInstanceParent*>* gJihadLiveInstances = nullptr;
+
 PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
                                           NPP npp,
                                           const nsCString& aMimeType,
@@ -145,10 +155,24 @@ PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
        sPluginInstanceList = new nsClassHashtable<nsVoidPtrHashKey, PluginInstanceParent>();
    }
 #endif
+    // Jihad: join the live list that jihad_plugin_request_frame walks. Leaked on purpose — it
+    // outlives every instance and there is no shutdown hook here that is guaranteed to run
+    // after the last dtor.
+    if (!gJihadLiveInstances) {
+        gJihadLiveInstances = new nsTArray<PluginInstanceParent*>();
+    }
+    gJihadLiveInstances->AppendElement(this);
 }

 PluginInstanceParent::~PluginInstanceParent()
 {
+    // Jihad: leave the live list FIRST. Anything below can run script or spin the loop, and a
+    // frame request delivered to a half-destroyed actor is a use-after-free rather than a
+    // dropped frame.
+    if (gJihadLiveInstances) {
+        gJihadLiveInstances->RemoveElement(this);
+    }
+
    if (mNPP)
        mNPP->pdata = nullptr;

@@ -269,6 +293,8 @@ PluginInstanceParent::AnswerNPN_GetValue_NPNVnetscapeWindow(NativeWindowHandle*
    XID id;
 #elif defined(XP_DARWIN)
    intptr_t id;
+#elif defined(MOZ_WIDGET_HEADLESS)
+    intptr_t id; // Jihad headless: no native window id
 #else
 #warning Implement me
 #endif
@@ -769,6 +795,51 @@ PluginInstanceParent::RecvShowDirectBitmap(Shmem&& buffer,
        return false;
    }

+    // NO COMPOSITOR PROCESS: composite the plugin's bitmap directly.
+    //
+    // Everything below this point routes the plugin's pixels through a TextureClient to a
+    // compositor, and that requires ImageBridgeChild — which only exists with off-main-thread
+    // composition. This embedder deliberately runs OMTC off (the offscreen renderer uses the
+    // in-process BasicLayerManager and hands finished frames to the browser adapter itself),
+    // so ImageBridgeChild::GetSingleton() is null and TextureClientRecycleAllocator is built
+    // around a null KnowsCompositor. The first plugin paint then dereferenced it and took the
+    // whole daemon down with it — upstream never sees this because the DXGI path a few
+    // hundred lines up checks the forwarder and the direct-bitmap path does not.
+    //
+    // A BasicLayerManager does not need a TextureClient at all: it draws an ImageLayer from
+    // the image's own SourceSurface. So wrap the pixels in a plain SourceSurfaceImage and
+    // hand that to the container.
+    //
+    // The pixels are COPIED, not wrapped. `source` above wraps the shmem the plugin drew
+    // into, and the plugin owns that buffer and may draw the next frame into it as soon as
+    // this call returns; the texture path's UpdateFromSurface copies for the same reason.
+    if (!ImageBridgeChild::GetSingleton()) {
+        RefPtr<gfx::DataSourceSurface> copy =
+            gfx::Factory::CreateDataSourceSurface(size, format);
+        if (!copy) {
+            NS_WARNING("Could not allocate a surface for plugin bitmap!");
+            return false;
+        }
+        {
+            gfx::DataSourceSurface::ScopedMap srcMap(source, gfx::DataSourceSurface::READ);
+            gfx::DataSourceSurface::ScopedMap dstMap(copy, gfx::DataSourceSurface::WRITE);
+            if (!srcMap.IsMapped() || !dstMap.IsMapped()) {
+                return false;
+            }
+            const int32_t bpp = BytesPerPixel(format);
+            const int32_t rowBytes = size.width * bpp;
+            for (int32_t y = 0; y < size.height; y++) {
+                memcpy(dstMap.GetData() + (ptrdiff_t)y * dstMap.GetStride(),
+                       srcMap.GetData() + (ptrdiff_t)y * srcMap.GetStride(),
+                       rowBytes);
+            }
+        }
+
+        RefPtr<SourceSurfaceImage> image = new SourceSurfaceImage(size, copy);
+        SetCurrentImage(image);
+        return true;
+    }
+
    // Allocate a texture for the compositor.
    RefPtr<TextureClientRecycleAllocator> allocator = mParent->EnsureTextureAllocatorForDirectBitmap();
    RefPtr<TextureClient> texture = allocator->CreateOrRecycle(
@@ -864,6 +935,55 @@ PluginInstanceParent::RecvShowDirectDXGISurface(const WindowsHandle& handle,
 }
 #endif // MOZ_ENABLE_NPAPI

+// Jihad: monotonic count of plugin frames that have reached the parent. Process-wide rather
+// than per-instance, matching how the daemon consumes it — the embedding is single-page and the
+// question it answers is "has ANY plugin produced a new frame since I last published". A plain
+// uint32_t incremented and read on the same (main) thread; the daemon reads it from the same
+// thread inside its tick, so no atomics are needed and none are used elsewhere in this bridge.
+static uint32_t gJihadPluginFrameSeq = 0;
+
+extern "C" {
+// Weak-linked from the daemon (render/goanna/GoannaRenderPage.cpp), the same way
+// jihad_offscreen_take_dirty is: an older libxul simply does not export it, and the daemon then
+// falls back to its dirty-flag behaviour instead of failing to load.
+MOZ_EXPORT uint32_t jihad_plugin_frame_seq(void)
+{
+    return gJihadPluginFrameSeq;
+}
+}
+
+extern "C" {
+// Ask every live plugin for one frame. Returns how many were asked, so the daemon can tell "no
+// plugin" from "delivered" — the same contract as jihad_plugin_palm_spotlight.
+//
+// WEAK on the daemon side: a libxul without this symbol keeps the child's own timer as the frame
+// clock (patch 0026 behaviour), which is slower to settle but never wrong.
+MOZ_EXPORT int jihad_plugin_request_frame(void)
+{
+#ifdef MOZ_ENABLE_NPAPI
+    if (!gJihadLiveInstances) {
+        return 0;
+    }
+    // Copy first: SendJihadRequestFrame can fail and tear the actor down, which would mutate the
+    // array underneath the loop. Same reasoning as the instance-list copy in
+    // jihad_plugin_palm_spotlight (nsPluginHost.cpp).
+    nsTArray<PluginInstanceParent*> snap(*gJihadLiveInstances);
+    int asked = 0;
+    for (uint32_t i = 0; i < snap.Length(); ++i) {
+        if (!gJihadLiveInstances->Contains(snap[i])) {
+            continue;   // torn down by an earlier Send in this same loop
+        }
+        if (snap[i]->SendJihadRequestFrame()) {
+            asked++;
+        }
+    }
+    return asked;
+#else
+    return 0;
+#endif
+}
+}
+
 bool
 PluginInstanceParent::RecvShow(const NPRect& updatedRect,
                               const SurfaceDescriptor& newSurface,
@@ -877,6 +997,27 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,

    MOZ_ASSERT(!IsUsingDirectDrawing());

+    // FRAME-RATE READOUT, parent side. Paired with the child's `palm draw:` line: the child
+    // reports how often the plugin was ASKED to draw, this reports how many of those frames
+    // actually crossed the process boundary. A gap between the two numbers is the difference
+    // between "the plugin is slow" and "we are dropping its frames", which are opposite bugs.
+    {
+        static uint32_t sShows = 0;
+        static uint32_t sLastReport = 0;
+        sShows++;
+        uint32_t nowMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+        if (!sLastReport) {
+            sLastReport = nowMs;
+        } else if (nowMs - sLastReport >= 2000) {
+            fprintf(stderr, "[jihad-npapi] RecvShow: %u in %ums (%.1f fps)\n",
+                    sShows, nowMs - sLastReport,
+                    sShows * 1000.0 / double(nowMs - sLastReport));
+            fflush(stderr);
+            sShows = 0;
+            sLastReport = nowMs;
+        }
+    }
+
    // XXXjwatt rewrite to use Moz2D
    RefPtr<gfxASurface> surface;
    if (newSurface.type() == SurfaceDescriptor::TShmem) {
@@ -959,14 +1100,75 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
                   updatedRect.bottom - updatedRect.top);
        surface->MarkDirty(ur);

-        bool isPlugin = true;
-        RefPtr<gfx::SourceSurface> sourceSurface =
-            gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(nullptr, surface, isPlugin);
-        RefPtr<SourceSurfaceImage> image = new SourceSurfaceImage(surface->GetSize(), sourceSurface);
+        // JIHAD (2026-08-09): route the legacy windowless show through the SAME
+        // representation the direct-bitmap path uses, for the SAME reasons.
+        //
+        // Background: the webOS npPalmDrawEvent path (PaintRectToPlatformSurface) makes Flash
+        // blit its stage into mCurrentSurface — measured full-magenta in the child — and ships
+        // it here via SendShow. The control plugin's pixels reach the screen through
+        // RecvShowDirectBitmap; Flash's did not, although both feed the one mImageContainer the
+        // BasicLayerManager reads. Two concrete differences made the legacy path invisible:
+        //   1. It WRAPPED the shmem (GetSourceSurfaceForSurface(nullptr,…)) instead of copying.
+        //      The child double-buffers and SwapSurfaces() immediately after SendShow returns,
+        //      so a wrapped front buffer is the very buffer the child repaints next — the image
+        //      the layer later samples is racing the child. RecvShowDirectBitmap copies for
+        //      exactly this reason ("the plugin owns that buffer and may draw the next frame
+        //      into it as soon as this call returns").
+        //   2. It stamped no frameID. SetCurrentImage() on the working path assigns a monotonic
+        //      ++mFrameID; the ImageContainer/ImageLayer treats a repeated frameID as "no new
+        //      frame". A fixed 0 can be coalesced away.
+        // Copying into a fresh DataSourceSurface and stamping a monotonic frameID makes this
+        // path identical in substance to the one already proven to composite here.
+        IntSize ssize = surface->GetSize();
+        RefPtr<Image> image;
+        RefPtr<gfxImageSurface> imgSurf = surface->GetAsImageSurface();
+        if (imgSurf) {
+            // Always present the copy as B8G8R8A8, and force the alpha channel opaque when the
+            // source carries no alpha (RGB24 / B8G8R8X8). This is Bug 1196927 in this file's own
+            // words (see PluginInstanceChild::PaintRectToSurface): Cairo/Skia leave the X byte of
+            // a BGRX surface zeroed, and a BasicImageLayer then composites those pixels multiplied
+            // by alpha 0 — i.e. fully transparent. That is exactly why Flash's magenta stage
+            // arrived here (RecvShow logged px0=0xffff00ff) yet BasicImageLayer::Paint drew
+            // nothing visible, while the control plugin — which ships B8G8R8A8 — composited fine
+            // through the identical layer path. webOS windowless plugins are opaque
+            // (wmode=opaque forces the windowless instance in the first place), so forcing alpha
+            // opaque is correct here.
+            const SurfaceFormat srcFmt = surface->GetSurfaceFormat();
+            const bool srcHasAlpha =
+                srcFmt != SurfaceFormat::B8G8R8X8 &&
+                srcFmt != SurfaceFormat::R8G8B8X8;
+            RefPtr<gfx::DataSourceSurface> copy =
+                gfx::Factory::CreateDataSourceSurface(ssize, SurfaceFormat::B8G8R8A8);
+            if (copy) {
+                gfx::DataSourceSurface::ScopedMap dstMap(copy, gfx::DataSourceSurface::WRITE);
+                if (dstMap.IsMapped()) {
+                    const int32_t rowBytes = ssize.width * 4;
+                    for (int32_t y = 0; y < ssize.height; y++) {
+                        uint8_t* dstRow = dstMap.GetData() + (ptrdiff_t)y * dstMap.GetStride();
+                        memcpy(dstRow, imgSurf->Data() + (ptrdiff_t)y * imgSurf->Stride(),
+                               rowBytes);
+                        if (!srcHasAlpha) {
+                            for (int32_t x = 0; x < ssize.width; x++) {
+                                dstRow[x * 4 + 3] = 0xff;  // BGRA: byte 3 is alpha
+                            }
+                        }
+                    }
+                    image = new SourceSurfaceImage(ssize, copy);
+                }
+            }
+        }
+        if (!image) {
+            // Fallback to the original wrap if the copy path could not be taken.
+            bool isPlugin = true;
+            RefPtr<gfx::SourceSurface> sourceSurface =
+                gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(nullptr, surface, isPlugin);
+            image = new SourceSurfaceImage(ssize, sourceSurface);
+        }

+        ImageContainer::NonOwningImage holder(image);
+        holder.mFrameID = ++mFrameID;
        AutoTArray<ImageContainer::NonOwningImage,1> imageList;
-        imageList.AppendElement(
-            ImageContainer::NonOwningImage(image));
+        imageList.AppendElement(holder);

        ImageContainer *container = GetImageContainer();
        container->SetCurrentImages(imageList);
@@ -976,6 +1178,17 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
    }

    mFrontSurface = surface;
+    // Jihad: count DELIVERED plugin frames so the embedder can tell a new one from a repeat.
+    // The daemon's only frame signal is PuppetWidget's sticky dirty boolean, which carries no
+    // identity: the refresh driver and ordinary page damage set the same flag, so "there is
+    // damage" cannot answer "did the plugin draw again". Measured 2026-08-10 on a 30 fps SWF,
+    // that ambiguity is what made both available policies wrong — publishing on every dirty
+    // tick sent ~78 card frames for ~60 plugin frames (duplicates, and 22-44 deferred because
+    // the adapter could not drain them), while pacing on a fixed 33 ms grid sent ~57 for ~68
+    // (dropped frames, so the animation stepped two positions at once). The stock webOS host
+    // never had to choose: it pulls the plugin synchronously inside the page paint, so it is
+    // 1:1 by construction. This counter is what lets the daemon be 1:1 too.
+    ++gJihadPluginFrameSeq;
    RecvNPN_InvalidateRect(updatedRect);

    PLUGIN_LOG_DEBUG(("   (RecvShow invalidated for surface %p)",
@@ -1301,7 +1514,11 @@ PluginInstanceParent::GetImageContainer()
    return mImageContainer;
  }

-  if (IsUsingDirectDrawing()) {
+  if (IsUsingDirectDrawing() && ImageBridgeChild::GetSingleton()) {
+      // ASYNCHRONOUS means "shared with the compositor through ImageBridge". Without an
+      // ImageBridge the async container silently gets no image client and never publishes
+      // anything, so with OMTC off this has to be an ordinary local container — which is
+      // what the BasicLayerManager reads from. See RecvShowDirectBitmap.
      mImageContainer = LayerManager::CreateImageContainer(ImageContainer::ASYNCHRONOUS);
  } else {
      mImageContainer = LayerManager::CreateImageContainer();
@@ -117,6 +117,8 @@ typedef HWND NativeWindowHandle;
 typedef XID NativeWindowHandle;
 #elif defined(XP_DARWIN)
 typedef intptr_t NativeWindowHandle; // never actually used, will always be 0
+#elif defined(MOZ_WIDGET_HEADLESS)
+typedef intptr_t NativeWindowHandle; // Jihad headless: no native window handle
 #else
 #error Need NativeWindowHandle for this platform
 #endif
@@ -12,6 +12,9 @@

 #ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
 #endif

 #include "nsIFile.h"
@@ -57,6 +60,9 @@ using namespace mozilla::ipc;
 using namespace mozilla::plugins;
 using namespace mozilla::widget;

+// Defined at the bottom of this file; see the NPN SYMBOL INTERPOSITION block there.
+namespace mozilla { namespace plugins { void JihadInstallNPNInterposition(); } }
+
 #if defined(XP_WIN)
 const wchar_t * kFlashFullscreenClass = L"ShockwaveFlashFullScreen";
 const wchar_t * kMozillaWindowClass = L"MozillaWindowClass";
@@ -229,6 +235,10 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
 {
    NS_ASSERTION(aChannel, "need a channel");

+    // Point the exported NPN_* globals at the real implementations before any plugin can be
+    // loaded, so a plugin that resolves them as symbols reaches us rather than libWebKitLuna.
+    JihadInstallNPNInterposition();
+
    if (!InitGraphics())
        return false;

@@ -248,7 +258,11 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
    nsPluginFile pluginFile(localFile);

    nsPluginInfo info = nsPluginInfo();
-    if (NS_FAILED(pluginFile.GetPluginInfo(info, &mLibrary))) {
+    nsresult jihadRv = pluginFile.GetPluginInfo(info, &mLibrary);
+    fprintf(stderr, "[jihad-npapi-child] GetPluginInfo rv=0x%x lib=%d\n",
+            (unsigned)jihadRv, (int)!!mLibrary);
+    fflush(stderr);
+    if (NS_FAILED(jihadRv)) {
        return false;
    }

@@ -1101,7 +1115,11 @@ _getvalue(NPP aNPP,
                return InstCast(aNPP)->NPN_GetValue(aVariable, aValue);
            } 
            else {
+#ifdef MOZ_ENABLE_NPAPI_GTK2
                *(void **)aValue = xt_client_get_display();
+#else
+                *(void **)aValue = DefaultXDisplay();
+#endif
            }          
            return NPERR_NO_ERROR;
        }
@@ -1836,6 +1854,8 @@ bool
 PluginModuleChild::AnswerNP_Initialize(const PluginSettings& aSettings, NPError* rv)
 {
    *rv = DoNP_Initialize(aSettings);
+    fprintf(stderr, "[jihad-npapi-child] AnswerNP_Initialize rv=%d\n", (int)*rv);
+    fflush(stderr);
    return true;
 }

@@ -1875,6 +1895,8 @@ PluginModuleChild::DoNP_Initialize(const PluginSettings& aSettings)
 #  error Please implement me for your platform
 #endif

+    fprintf(stderr, "[jihad-npapi-child] DoNP_Initialize plugin returned %d\n", (int)result);
+    fflush(stderr);
    return result;
 }

@@ -2610,3 +2632,31 @@ PluginModuleChild::RecvNPP_SetValue_NPNVaudioDeviceChangeDetails(
 #endif
 }
 #endif // MOZ_ENABLE_NPAPI
+
+// ── NPN SYMBOL INTERPOSITION (Jihad, addons R7) ──────────────────────────────────────────
+//
+// The exported NPN_* globals themselves live in JihadNPNInterpose.cpp (they must, to escape
+// hidden visibility — see the long comment there). All that is needed here is to point them
+// at the same implementations the browser function table uses, which is done once the table
+// exists. Installed from a static initializer-free helper called by the child at startup.
+extern "C" {
+extern void  (*gJihadNPNInvalidateRect)(void*, void*);
+extern void* (*gJihadNPNCreateObject)(void*, void*);
+}
+
+namespace mozilla {
+namespace plugins {
+
+void JihadInstallNPNInterposition()
+{
+    const NPNetscapeFuncs& f = PluginModuleChild::sBrowserFuncs;
+    gJihadNPNInvalidateRect = (void(*)(void*, void*))f.invalidaterect;
+    gJihadNPNCreateObject   = (void*(*)(void*, void*))f.createobject;
+    fprintf(stderr, "[jihad-npapi-child] NPN interposition installed invalidaterect=%p "
+                    "createobject=%p\n",
+            (void*)f.invalidaterect, (void*)f.createobject);
+    fflush(stderr);
+}
+
+} // namespace plugins
+} // namespace mozilla
@@ -444,6 +444,8 @@ PluginModuleChromeParent::LoadModule(const char* aFilePath, uint32_t aPluginId,
    parent->mSubprocess->SetCallRunnableImmediately(!parent->mIsStartingAsync);
    bool launched = parent->mSubprocess->Launch(Move(onLaunchedRunnable),
                                                aPluginTag->mSandboxLevel);
+    fprintf(stderr, "[jihad-npapi] LoadModule path=%s async=%d launched=%d\n",
+            aFilePath, (int)parent->mIsStartingAsync, (int)launched);
    if (!launched) {
        // We never reached open
        parent->mShutdown = true;
@@ -455,7 +457,10 @@ PluginModuleChromeParent::LoadModule(const char* aFilePath, uint32_t aPluginId,
    parent->mIsBlocklisted = NS_FAILED(rv) || blocklistState != 0;
    if (!parent->mIsStartingAsync) {
        int32_t launchTimeoutSecs = Preferences::GetInt(kLaunchTimeoutPref, 0);
-        if (!parent->mSubprocess->WaitUntilConnected(launchTimeoutSecs * 1000)) {
+        bool connected = parent->mSubprocess->WaitUntilConnected(launchTimeoutSecs * 1000);
+        fprintf(stderr, "[jihad-npapi] LoadModule WaitUntilConnected(%ds) = %d\n",
+                (int)launchTimeoutSecs, (int)connected);
+        if (!connected) {
            parent->mShutdown = true;
            return nullptr;
        }
@@ -1134,9 +1139,20 @@ PluginModuleChromeParent::OnHangUIContinue()
 }
 #endif // XP_WIN

+// Defined with the rest of the Jihad CPU-boost helpers further down this file.
+namespace { void JihadCpuBoostReleaseAll(); }
+
 void
 PluginModuleParent::ActorDestroy(ActorDestroyReason why)
 {
+    // Release the CPU boost here as well as in NPP_Destroy, because on this port NPP_Destroy is
+    // NOT the path a plugin usually leaves by: navigating away from a Flash page ends in the
+    // child's own mozalloc_abort, so the instance never gets an orderly destroy and the boost
+    // would leak — device-observed 2026-08-10, tunables still at 40/50000 after navigation with
+    // no release logged. This runs for every ActorDestroyReason, normal and abnormal, which also
+    // covers a plugin crash.
+    JihadCpuBoostReleaseAll();
+
    switch (why) {
    case AbnormalShutdown: {
        mShutdown = true;
@@ -1271,6 +1287,172 @@ NP_BEGIN_MACRO                                                                 \
    return i->func;                                                            \
 NP_END_MACRO

+// ── Jihad: hold a CPU-frequency boost while a plugin instance is alive ──────────────────────
+//
+// WHY. The TouchPad's governor is Palm's `ondemandtcl`, whose stock `up_threshold` is 95 — it
+// only raises the clock when a single core exceeds 95% load. Flash never gets there: measured on
+// device, the daemon runs ~26% and plugin-container ~11% of two cores, so a passively-watched
+// animation sits at the FLOOR. Sampling `scaling_cur_freq` once a second during playback gave
+// 192000-384000 out of a 1188000 maximum, snapping back to 1188000 the moment the page was
+// navigated away. The whole system was only 69% busy, so this was never a capacity wall.
+//
+// Dropping `up_threshold` to 40 and `sampling_rate` to 50000 pins 1188000 and lifts the card
+// composite from 20.4-27.5 fps to 30.7-35.2, daemon paints 24.0-28.7 to 31.4-33.0, and the frame
+// gap MAXIMUM — the number that reads as stutter — from 63-81 ms to 49-56. It also clears the
+// audio xruns, because MP3 decode at 192 MHz underruns.
+//
+// NEVER WRITE `scaling_governor`. Switching away from `ondemandtcl` DEADLOCKS cpufreq in the
+// kernel: every later reader of any cpufreq node blocks in unkillable D state — the daemon,
+// `powerlog`, and the restore path itself — so the boost is never released and only a reboot
+// clears it (and a clean `reboot` will not run, because init waits on those D-state tasks).
+// Governor TUNABLE writes, which is all this does, are safe and return instantly.
+//
+// These are SYSTEM-WIDE tunables, so they are held only while a plugin instance exists and the
+// ORIGINAL values are read back and restored on teardown. The upstart job restores them again
+// from `post-stop`, because a daemon that dies holding the boost would otherwise leave the whole
+// device tuned for battery burn. Both hooks run on the main thread, so the counter needs no lock.
+namespace {
+
+const char kJihadOndemandDir[] = "/sys/devices/system/cpu/cpufreq/ondemandtcl";
+
+// The stock values, used ONLY as the restore fallback when the current value already equals what
+// we are about to write — which happens when another variant's daemon is holding the boost.
+// Saving the boosted value as "original" there would make the last release pin the device.
+const char kJihadStockUpThreshold[]  = "95";
+const char kJihadStockSamplingRate[] = "200000";
+
+// The instances that actually TOOK a boost, not a bare count. NPP_Destroy also runs for instances
+// that failed before the boost was taken, and decrementing a count there would release the boost
+// out from under a plugin that is still playing.
+nsTArray<NPP> gJihadBoostedInstances;
+bool gJihadBoostHeld = false;
+char gJihadSavedUpThreshold[32];
+char gJihadSavedSamplingRate[32];
+
+bool
+JihadReadTunable(const char* aName, char* aOut, size_t aOutLen)
+{
+    char path[256];
+    snprintf(path, sizeof(path), "%s/%s", kJihadOndemandDir, aName);
+    FILE* f = fopen(path, "r");
+    if (!f) return false;
+    char* got = fgets(aOut, aOutLen, f);
+    fclose(f);
+    if (!got) return false;
+    // Trim the trailing newline so a value read back can be compared and rewritten verbatim.
+    size_t n = strlen(aOut);
+    while (n > 0 && (aOut[n - 1] == '\n' || aOut[n - 1] == '\r')) aOut[--n] = '\0';
+    return n > 0;
+}
+
+bool
+JihadWriteTunable(const char* aName, const char* aValue)
+{
+    char path[256];
+    snprintf(path, sizeof(path), "%s/%s", kJihadOndemandDir, aName);
+    FILE* f = fopen(path, "w");
+    if (!f) return false;
+    bool ok = fputs(aValue, f) >= 0;
+    ok = (fclose(f) == 0) && ok;
+    return ok;
+}
+
+// Env-tunable for the same reason the repaint divisor is: the right value is a property of the
+// device under load, not of the source, and a rebuild per candidate costs a 44 MB push.
+void
+JihadCpuBoostTargets(const char** aUpThreshold, const char** aSamplingRate)
+{
+    static char sUp[32]   = "40";
+    static char sRate[32] = "50000";
+    static bool sInit = false;
+    if (!sInit) {
+        sInit = true;
+        const char* e = getenv("JIHAD_PLUGIN_CPU_UP_THRESHOLD");
+        if (e && *e) {
+            int v = atoi(e);
+            if (v >= 5 && v <= 95) snprintf(sUp, sizeof(sUp), "%d", v);
+        }
+        e = getenv("JIHAD_PLUGIN_CPU_SAMPLING_RATE");
+        if (e && *e) {
+            int v = atoi(e);
+            if (v >= 10000 && v <= 1000000) snprintf(sRate, sizeof(sRate), "%d", v);
+        }
+    }
+    *aUpThreshold = sUp;
+    *aSamplingRate = sRate;
+}
+
+bool
+JihadCpuBoostEnabled()
+{
+    const char* e = getenv("JIHAD_PLUGIN_CPU_BOOST");
+    return !(e && e[0] == '0' && e[1] == '\0');
+}
+
+void
+JihadCpuBoostAcquire(NPP aInstance)
+{
+    if (!JihadCpuBoostEnabled() || gJihadBoostedInstances.Contains(aInstance)) return;
+    gJihadBoostedInstances.AppendElement(aInstance);
+    if (gJihadBoostedInstances.Length() != 1 || gJihadBoostHeld) return;
+
+    const char* wantUp;
+    const char* wantRate;
+    JihadCpuBoostTargets(&wantUp, &wantRate);
+
+    if (!JihadReadTunable("up_threshold", gJihadSavedUpThreshold,
+                          sizeof(gJihadSavedUpThreshold)) ||
+        !strcmp(gJihadSavedUpThreshold, wantUp)) {
+        strcpy(gJihadSavedUpThreshold, kJihadStockUpThreshold);
+    }
+    if (!JihadReadTunable("sampling_rate", gJihadSavedSamplingRate,
+                          sizeof(gJihadSavedSamplingRate)) ||
+        !strcmp(gJihadSavedSamplingRate, wantRate)) {
+        strcpy(gJihadSavedSamplingRate, kJihadStockSamplingRate);
+    }
+
+    bool ok = JihadWriteTunable("up_threshold", wantUp);
+    ok = JihadWriteTunable("sampling_rate", wantRate) && ok;
+    gJihadBoostHeld = ok;
+    fprintf(stderr, "[jihad-npapi] cpu boost acquire: up_threshold %s->%s sampling_rate %s->%s%s\n",
+            gJihadSavedUpThreshold, wantUp, gJihadSavedSamplingRate, wantRate,
+            ok ? "" : "  FAILED (not root, or no ondemandtcl)");
+    fflush(stderr);
+}
+
+void
+JihadCpuBoostRelease(NPP aInstance)
+{
+    if (!gJihadBoostedInstances.RemoveElement(aInstance)) return;
+    if (!gJihadBoostedInstances.IsEmpty() || !gJihadBoostHeld) return;
+
+    JihadWriteTunable("up_threshold", gJihadSavedUpThreshold);
+    JihadWriteTunable("sampling_rate", gJihadSavedSamplingRate);
+    gJihadBoostHeld = false;
+    fprintf(stderr, "[jihad-npapi] cpu boost release: up_threshold=%s sampling_rate=%s\n",
+            gJihadSavedUpThreshold, gJihadSavedSamplingRate);
+    fflush(stderr);
+}
+
+// Drop every outstanding boost at once. Used when the plugin module itself goes away, which on
+// this port is the NORMAL exit path (see ActorDestroy), not just the crash path.
+void
+JihadCpuBoostReleaseAll()
+{
+    if (gJihadBoostedInstances.IsEmpty()) return;
+    gJihadBoostedInstances.Clear();
+    if (!gJihadBoostHeld) return;
+
+    JihadWriteTunable("up_threshold", gJihadSavedUpThreshold);
+    JihadWriteTunable("sampling_rate", gJihadSavedSamplingRate);
+    gJihadBoostHeld = false;
+    fprintf(stderr, "[jihad-npapi] cpu boost release (module gone): up_threshold=%s sampling_rate=%s\n",
+            gJihadSavedUpThreshold, gJihadSavedSamplingRate);
+    fflush(stderr);
+}
+
+} // anonymous namespace
+
 NPError
 PluginModuleParent::NPP_Destroy(NPP instance,
                                NPSavedData** saved)
@@ -1296,6 +1478,7 @@ PluginModuleParent::NPP_Destroy(NPP instance,
    instance->pdata = nullptr;

    Unused << PluginInstanceParent::Call__delete__(parentInstance);
+    JihadCpuBoostRelease(instance);
    return retval;
 }

@@ -2292,6 +2475,12 @@ PluginModuleParent::NPP_NewInternal(NPMIMEType pluginType, NPP instance,

    UpdatePluginTimeout();

+    // Taken ONLY here, on the single success path, and released in NPP_Destroy. Every failure
+    // return above this point either deletes |parentInstance| itself or hands it to NPP_Destroy,
+    // and a boost acquired on one of those paths would never be released — which on this device
+    // means leaving the WHOLE system tuned for battery burn with nothing owning it.
+    JihadCpuBoostAcquire(instance);
+
    return NS_OK;
 }

@@ -111,9 +111,14 @@ PluginProcessChild::Init()
      return false;
    }

+    fprintf(stderr, "[jihad-npapi-child] InitForChrome plugin=%s parentPid=%d\n",
+            pluginFilename.c_str(), (int)ParentPid());
+    fflush(stderr);
    bool retval = mPlugin.InitForChrome(pluginFilename, ParentPid(),
                                        IOThreadChild::message_loop(),
                                        IOThreadChild::channel());
+    fprintf(stderr, "[jihad-npapi-child] InitForChrome = %d\n", (int)retval);
+    fflush(stderr);
 #if defined(XP_MACOSX)
    if (nsCocoaFeatures::OnYosemiteOrLater()) {
      // Explicitly turn off CGEvent logging.  This works around bug 1092855.
@@ -88,6 +88,10 @@ UNIFIED_SOURCES += [
 ]

 SOURCES += [
+    # Jihad: must NOT be unified — it deliberately includes no NPAPI headers so its exported
+    # NPN_* symbols escape the hidden-visibility pragma. Merging it with a TU that includes
+    # npapi.h would reintroduce the prior hidden declaration and silently un-export them.
+    'JihadNPNInterpose.cpp',
    'PluginInstanceChild.cpp', # 'PluginThreadCallback' : ambiguous symbol
    'PluginModuleChild.cpp',   # Redefinition of mozilla::WindowsDllInterceptor sUser32Intercept
 ]
@@ -143,11 +147,13 @@ LOCAL_INCLUDES += [

 DEFINES['FORCE_PR_LOG'] = True

-if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gtk3':
-    CXXFLAGS += CONFIG['TK_CFLAGS']
-else:
+if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk3' and
+        CONFIG['MOZ_ENABLE_NPAPI'] and
+        CONFIG['MOZ_ENABLE_NPAPI_GTK2']):
    # Force build against gtk+2 for struct offsets and such.
    CXXFLAGS += CONFIG['MOZ_GTK2_CFLAGS']
+else:
+    CXXFLAGS += CONFIG['TK_CFLAGS']

 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

@@ -13,6 +13,7 @@ enum CSSStyleSheetParsingMode {
  "agent"
 };

+[Constructor]
 interface CSSStyleSheet : StyleSheet {
  [Pure]
  readonly attribute CSSRule? ownerRule;
@@ -34,7 +34,6 @@ interface Element : Node {

  [SameObject]
  readonly attribute NamedNodeMap attributes;
-  [Pure]
  sequence<DOMString> getAttributeNames();
  [Pure]
  DOMString? getAttribute(DOMString name);
@@ -159,7 +158,7 @@ interface Element : Node {
   * this property returns an object with computed values for grid
   * tracks and lines.
   */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
  sequence<Grid> getGridFragments();
 };

@@ -23,7 +23,7 @@ interface HTMLElement : Element {
  [CEReactions, SetterThrows, Pure]
           attribute DOMString dir;

-  [CEReactions, GetterThrows, Pure]
+  [CEReactions, GetterThrows]
           attribute [TreatNullAs=EmptyString] DOMString innerText;

  // user interaction
@@ -51,7 +51,7 @@ interface HTMLInputElement : HTMLElement {
           attribute boolean formNoValidate;
  [CEReactions, Pure, SetterThrows]
           attribute DOMString formTarget;
-  [CEReactions, Pure, SetterThrows]
+  [CEReactions, SetterThrows]
           attribute unsigned long height;
  [Pure]
           attribute boolean indeterminate;
@@ -823,16 +823,37 @@ nsBindingManager::WalkAllRules(nsIStyleRuleProcessor::EnumFunc aFunc,
  }
 }

-// The approach in WalkAllShadowRootHostRules seems reasonable on the surface and reminds me of what is done with mScopedRoot elsewhere. But something important is missing, either here or in the code that would normally use it.
-
 void
 nsBindingManager::WalkAllShadowRootHostRules(nsIStyleRuleProcessor::EnumFunc aFunc,
                                         ElementDependentRuleProcessorData* aData)
- {
-   aData->mTreeMatchContext.mOnlyMatchHostPseudo = true;
-   WalkAllRules(aFunc, aData, true);
-   aData->mTreeMatchContext.mOnlyMatchHostPseudo = false;
- }
+{
+  if (!mBoundContentSet) {
+    return;
+  }
+
+  bool oldOnlyMatchHostPseudo = aData->mTreeMatchContext.mOnlyMatchHostPseudo;
+  nsIContent* oldScopedRoot = aData->mTreeMatchContext.mScopedRoot;
+  aData->mTreeMatchContext.mOnlyMatchHostPseudo = true;
+
+  for (auto iter = mBoundContentSet->Iter(); !iter.Done(); iter.Next()) {
+    nsIContent* boundContent = iter.Get()->GetKey();
+    ShadowRoot* shadowRoot = boundContent->GetShadowRoot();
+    if (!shadowRoot) {
+      continue;
+    }
+
+    nsXBLBinding* binding = shadowRoot->GetAssociatedBinding();
+    if (!binding) {
+      continue;
+    }
+
+    aData->mTreeMatchContext.mScopedRoot = boundContent;
+    binding->WalkRules(aFunc, aData);
+  }
+
+  aData->mTreeMatchContext.mScopedRoot = oldScopedRoot;
+  aData->mTreeMatchContext.mOnlyMatchHostPseudo = oldOnlyMatchHostPseudo;
+}

 nsresult
 nsBindingManager::MediumFeaturesChanged(nsPresContext* aPresContext,
@@ -5,6 +5,7 @@

 // Local Includes
 #include "nsDocShellTreeOwner.h"
+#include "nsIBadCertListener2.h"   // JIHAD: route cert errors to the embedder chrome
 #include "nsWebBrowser.h"

 // Helper Classes
@@ -143,6 +144,15 @@ nsDocShellTreeOwner::GetInterface(const nsIID& aIID, void** aSink)
    return NS_OK;
  }

+  if (aIID.Equals(NS_GET_IID(nsIBadCertListener2))) {
+    // JIHAD: the embedder's chrome is what implements this — see the matching comment in
+    // nsDocShell::GetInterface. Same forwarding shape as nsIWebBrowserChromeFocus below.
+    if (mWebBrowserChromeWeak != nullptr) {
+      return mWebBrowserChromeWeak->QueryReferent(aIID, aSink);
+    }
+    return mOwnerWin ? mOwnerWin->QueryInterface(aIID, aSink) : NS_NOINTERFACE;
+  }
+
  if (aIID.Equals(NS_GET_IID(nsIWebBrowserChromeFocus))) {
    if (mWebBrowserChromeWeak != nullptr) {
      return mWebBrowserChromeWeak->QueryReferent(aIID, aSink);
@@ -390,6 +390,14 @@ nsWebBrowserFind::SetSelectionAndScroll(nsPIDOMWindowOuter* aWindow,

  nsCOMPtr<nsISelection> selection;

+  // JIHAD: frame->GetSelectionController can leave selCon NULL, and this dereferenced it
+  // unconditionally — a null deref that took the whole process down. It is reachable in an
+  // offscreen embedding with no chrome: this is the ONLY thing that made find-in-page
+  // unusable there (faultaddr=0x0, measured repeatedly). Guarding costs nothing and the
+  // rest of the function already tolerates a null `selection`.
+  if (!selCon) {
+    return;
+  }
  selCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
                       getter_AddRefs(selection));
@@ -707,7 +715,24 @@ nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping,
    return NS_ERROR_FAILURE;
  }

-  if (!nsContentUtils::SubjectPrincipal()->Subsumes(theDoc->NodePrincipal())) {
+  // JIHAD: this same-origin check is why find-in-page took the whole process down in this
+  // embedding, and the engine says why itself. nsContentUtils::SubjectPrincipal() begins:
+  //     JSContext* cx = GetCurrentJSContext();
+  //     if (!cx) {
+  //       MOZ_CRASH("Accessing the Subject Principal without an AutoJSAPI on the stack is forbidden");
+  //     }
+  // An EMBEDDER calls nsIWebBrowserFind::FindNext from C++ with no script on the stack, so
+  // there is no JSContext and MOZ_CRASH fires — a deliberate abort that presents as SIGSEGV at
+  // address 0, which is precisely the fault this port recorded for two weeks and attributed to
+  // "a frame-selection controller the offscreen browser doesn't set up". That was wrong: the
+  // selection machinery is fine and the crash happens BEFORE any of it, on the security check.
+  //
+  // The check is meaningful only when there IS a caller to check. With no JS on the stack the
+  // caller is native embedding code, which is already fully trusted — it is inside libxul's own
+  // process, holding the nsIWebBrowserFind for that very docShell. So: consult the subject
+  // principal only when a JSContext exists, and otherwise proceed.
+  if (nsContentUtils::GetCurrentJSContext() &&
+      !nsContentUtils::SubjectPrincipal()->Subsumes(theDoc->NodePrincipal())) {
    return NS_ERROR_DOM_PROP_ACCESS_DENIED;
  }

@@ -809,8 +834,11 @@ nsWebBrowserFind::GetFrameSelection(nsPIDOMWindowOuter* aWindow)
  nsCOMPtr<nsISelection> sel;
  if (frame) {
    frame->GetSelectionController(presContext, getter_AddRefs(selCon));
-    selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
-                         getter_AddRefs(sel));
+    // JIHAD: same unguarded deref as above — GetSelectionController can yield null.
+    if (selCon) {
+      selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
+                           getter_AddRefs(sel));
+    }
    if (sel) {
      int32_t count = -1;
      sel->GetRangeCount(&count);
@@ -820,7 +848,12 @@ nsWebBrowserFind::GetFrameSelection(nsPIDOMWindowOuter* aWindow)
    }
  }

+  // JIHAD: and the fallback QI is not guaranteed either — if the presShell does not answer
+  // nsISelectionController we must return nothing rather than crash.
  selCon = do_QueryInterface(presShell);
+  if (!selCon) {
+    return nullptr;
+  }
  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
                       getter_AddRefs(sel));
  return sel.forget();
@@ -12,5 +12,6 @@ if CONFIG['NS_PRINTING']:
        DIRS += ['win']
    elif toolkit == 'cocoa':
        DIRS += ['mac']
-    elif CONFIG['MOZ_PDF_PRINTING']:
+    elif CONFIG['MOZ_PDF_PRINTING'] or toolkit == 'headless':
+        # Jihad headless: reuse the gtk-free PDF printing prompt service.
        DIRS += ['unixshared']
@@ -7,8 +7,6 @@ UNIFIED_SOURCES += [
    'CharDistribution.cpp',
    'JpCntx.cpp',
    'nsCharSetProber.cpp',
-    'nsEscCharsetProber.cpp',
-    'nsEscSM.cpp',
    'nsEUCJPProber.cpp',
    'nsLatin1Prober.cpp',
    'nsMBCSGroupProber.cpp',
@@ -1,46 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-
-#include "nsEscCharsetProber.h"
-#include "nsUniversalDetector.h"
-
-nsEscCharSetProber::nsEscCharSetProber()
-{
-  mCodingSM = new nsCodingStateMachine(&ISO2022JPSMModel);
-  mState = eDetecting;
-  mDetectedCharset = nullptr;
-}
-
-nsEscCharSetProber::~nsEscCharSetProber(void)
-{
-}
-
-void nsEscCharSetProber::Reset(void)
-{
-  mState = eDetecting;
-  mCodingSM->Reset();
-  mDetectedCharset = nullptr;
-}
-
-nsProbingState nsEscCharSetProber::HandleData(const char* aBuf, uint32_t aLen)
-{
-  nsSMState codingState;
-  uint32_t i;
-
-  for ( i = 0; i < aLen && mState == eDetecting; i++)
-  {
-    codingState = mCodingSM->NextState(aBuf[i]);
-    if (codingState == eItsMe)
-    {
-      mState = eFoundIt;
-      mDetectedCharset = mCodingSM->GetCodingStateMachine();
-      return mState;
-    }
-  }
-
-  return mState;
-}
-
@@ -1,32 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsEscCharSetProber_h__
-#define nsEscCharSetProber_h__
-
-#include "nsCharSetProber.h"
-#include "nsCodingStateMachine.h"
-#include "nsAutoPtr.h"
-
-class nsEscCharSetProber: public nsCharSetProber {
-public:
-  nsEscCharSetProber();
-  virtual ~nsEscCharSetProber(void);
-  nsProbingState HandleData(const char* aBuf, uint32_t aLen);
-  const char* GetCharSetName() {return mDetectedCharset;}
-  nsProbingState GetState(void) {return mState;}
-  void      Reset(void);
-  float     GetConfidence(void){return (float)0.99;}
-
-protected:
-  void      GetDistribution(uint32_t aCharLen, const char* aStr);
-  
-  nsAutoPtr<nsCodingStateMachine> mCodingSM;
-  nsProbingState mState;
-  const char *  mDetectedCharset;
-};
-
-#endif /* nsEscCharSetProber_h__ */
-
@@ -1,63 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-#include "nsCodingStateMachine.h"
-
-static const uint32_t ISO2022JP_cls [ 256 / 8 ] = {
-PCK4BITS(2,0,0,0,0,0,0,0),  // 00 - 07 
-PCK4BITS(0,0,0,0,0,0,2,2),  // 08 - 0f 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 10 - 17 
-PCK4BITS(0,0,0,1,0,0,0,0),  // 18 - 1f 
-PCK4BITS(0,0,0,0,7,0,0,0),  // 20 - 27 
-PCK4BITS(3,0,0,0,0,0,0,0),  // 28 - 2f 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 30 - 37 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 38 - 3f 
-PCK4BITS(6,0,4,0,8,0,0,0),  // 40 - 47 
-PCK4BITS(0,9,5,0,0,0,0,0),  // 48 - 4f 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 50 - 57 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 58 - 5f 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 60 - 67 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 68 - 6f 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 70 - 77 
-PCK4BITS(0,0,0,0,0,0,0,0),  // 78 - 7f 
-PCK4BITS(2,2,2,2,2,2,2,2),  // 80 - 87 
-PCK4BITS(2,2,2,2,2,2,2,2),  // 88 - 8f 
-PCK4BITS(2,2,2,2,2,2,2,2),  // 90 - 97 
-PCK4BITS(2,2,2,2,2,2,2,2),  // 98 - 9f 
-PCK4BITS(2,2,2,2,2,2,2,2),  // a0 - a7 
-PCK4BITS(2,2,2,2,2,2,2,2),  // a8 - af 
-PCK4BITS(2,2,2,2,2,2,2,2),  // b0 - b7 
-PCK4BITS(2,2,2,2,2,2,2,2),  // b8 - bf 
-PCK4BITS(2,2,2,2,2,2,2,2),  // c0 - c7 
-PCK4BITS(2,2,2,2,2,2,2,2),  // c8 - cf 
-PCK4BITS(2,2,2,2,2,2,2,2),  // d0 - d7 
-PCK4BITS(2,2,2,2,2,2,2,2),  // d8 - df 
-PCK4BITS(2,2,2,2,2,2,2,2),  // e0 - e7 
-PCK4BITS(2,2,2,2,2,2,2,2),  // e8 - ef 
-PCK4BITS(2,2,2,2,2,2,2,2),  // f0 - f7 
-PCK4BITS(2,2,2,2,2,2,2,2)   // f8 - ff 
-};
-
-
-static const uint32_t ISO2022JP_st [ 9] = {
-PCK4BITS(eStart,     3,eError,eStart,eStart,eStart,eStart,eStart),//00-07 
-PCK4BITS(eStart,eStart,eError,eError,eError,eError,eError,eError),//08-0f 
-PCK4BITS(eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe),//10-17 
-PCK4BITS(eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eError,eError),//18-1f 
-PCK4BITS(eError,     5,eError,eError,eError,     4,eError,eError),//20-27 
-PCK4BITS(eError,eError,eError,     6,eItsMe,eError,eItsMe,eError),//28-2f 
-PCK4BITS(eError,eError,eError,eError,eError,eError,eItsMe,eItsMe),//30-37 
-PCK4BITS(eError,eError,eError,eItsMe,eError,eError,eError,eError),//38-3f 
-PCK4BITS(eError,eError,eError,eError,eItsMe,eError,eStart,eStart) //40-47 
-};
-
-static const uint32_t ISO2022JPCharLenTable[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-
-const SMModel ISO2022JPSMModel = {
-  {eIdxSft4bits, eSftMsk4bits, eBitSft4bits, eUnitMsk4bits, ISO2022JP_cls },
-  10,
-  {eIdxSft4bits, eSftMsk4bits, eBitSft4bits, eUnitMsk4bits, ISO2022JP_st },
-  CHAR_LEN_TABLE(ISO2022JPCharLenTable),
-  "ISO-2022-JP",
-};
@@ -8,7 +8,6 @@
 #include "nsUniversalDetector.h"

 #include "nsMBCSGroupProber.h"
-#include "nsEscCharsetProber.h"
 #include "nsLatin1Prober.h"

 nsUniversalDetector::nsUniversalDetector()
@@ -16,7 +15,6 @@ nsUniversalDetector::nsUniversalDetector()
  mDone = false;
  mBestGuess = -1;   //illegal value as signal
  mInTag = false;
-  mEscCharSetProber = nullptr;

  mStart = true;
  mDetectedCharset = nullptr;
@@ -33,8 +31,6 @@ nsUniversalDetector::~nsUniversalDetector()
 {
  for (int32_t i = 0; i < NUM_OF_CHARSET_PROBERS; i++)
    delete mCharSetProbers[i];
-
-  delete mEscCharSetProber;
 }

 void 
@@ -50,9 +46,6 @@ nsUniversalDetector::Reset()
  mInputState = ePureAscii;
  mLastChar = '\0';

-  if (mEscCharSetProber)
-    mEscCharSetProber->Reset();
-
  uint32_t i;
  for (i = 0; i < NUM_OF_CHARSET_PROBERS; i++)
    if (mCharSetProbers[i])
@@ -117,12 +110,6 @@ nsresult nsUniversalDetector::HandleData(const char* aBuf, uint32_t aLen)
        //adjust state
        mInputState = eHighbyte;

-        //kill mEscCharSetProber if it is active
-        if (mEscCharSetProber) {
-          delete mEscCharSetProber;
-          mEscCharSetProber = nullptr;
-        }
-
        //start multibyte and singlebyte charset prober
        if (nullptr == mCharSetProbers[0])
        {
@@ -140,12 +127,6 @@ nsresult nsUniversalDetector::HandleData(const char* aBuf, uint32_t aLen)
    }
    else
    {
-      //ok, just pure ascii so far
-      if ((ePureAscii == mInputState) && (aBuf[i] == '\033'))
-      {
-        //found escape character
-        mInputState = eEscAscii;
-      }
      mLastChar = aBuf[i];
    }
  }
@@ -153,19 +134,6 @@ nsresult nsUniversalDetector::HandleData(const char* aBuf, uint32_t aLen)
  nsProbingState st;
  switch (mInputState)
  {
-  case eEscAscii:
-    if (nullptr == mEscCharSetProber) {
-      mEscCharSetProber = new nsEscCharSetProber();
-      if (nullptr == mEscCharSetProber)
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
-    st = mEscCharSetProber->HandleData(aBuf, aLen);
-    if (st == eFoundIt)
-    {
-      mDone = true;
-      mDetectedCharset = mEscCharSetProber->GetCharSetName();
-    }
-    break;
  case eHighbyte:
    for (i = 0; i < NUM_OF_CHARSET_PROBERS; i++)
    {
@@ -231,8 +199,6 @@ void nsUniversalDetector::DataEnd()
        Report(mCharSetProbers[maxProber]->GetCharSetName());
    }
    break;
-  case eEscAscii:
-    break;
  default:
    ;
  }
@@ -12,8 +12,7 @@ class nsCharSetProber;

 typedef enum {
  ePureAscii = 0,
-  eEscAscii  = 1,
-  eHighbyte  = 2
+  eHighbyte  = 1
 } nsInputState;

 class nsUniversalDetector {
@@ -37,7 +36,6 @@ protected:
   uint32_t mLanguageFilter;

   nsCharSetProber  *mCharSetProbers[NUM_OF_CHARSET_PROBERS];
-   nsCharSetProber  *mEscCharSetProber;
 };

 #endif
@@ -1374,7 +1374,7 @@ public:
  static already_AddRefed<ScaledFont>
    CreateScaledFontForNativeFont(const NativeFont &aNativeFont, Float aSize);

-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
  static already_AddRefed<ScaledFont>
    CreateScaledFontForFontconfigFont(cairo_scaled_font_t* aScaledFont, FcPattern* aPattern, Float aSize);
 #endif
@@ -30,7 +30,7 @@
 #include "NativeFontResourceMac.h"
 #endif

-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
 #include "ScaledFontFontconfig.h"
 #endif

@@ -584,7 +584,7 @@ Factory::CreateScaledFontWithCairo(const NativeFont& aNativeFont, Float aSize, c
 #endif
 }

-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
 already_AddRefed<ScaledFont>
 Factory::CreateScaledFontForFontconfigFont(cairo_scaled_font_t* aScaledFont, FcPattern* aPattern, Float aSize)
 {
@@ -91,7 +91,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'windows':
        'JobScheduler_posix.cpp',
    ]

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
    SOURCES += [
        'ScaledFontFontconfig.cpp',
    ]
@@ -209,12 +209,12 @@ FINAL_LIBRARY = 'xul'
 for var in ('USE_CAIRO', 'MOZ2D_HAS_MOZ_CAIRO'):
    DEFINES[var] = True

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
    DEFINES['MOZ_ENABLE_FREETYPE'] = True

 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
    CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']

 LOCAL_INCLUDES += CONFIG['SKIA_INCLUDES']
@@ -805,6 +805,10 @@ cairo_cff_font_read_cid_fontdict (cairo_cff_font_t *font, unsigned char *ptr)
        }
        operand = decode_integer (operand, &size);
        decode_integer (operand, &offset);
+        if (unlikely (offset < 0 || (unsigned long)offset > font->data_length)) {
+            status = CAIRO_INT_STATUS_UNSUPPORTED;
+            goto fail;
+        }
        status = cff_dict_init (&font->fd_private_dict[i]);
 	if (unlikely (status))
            goto fail;
@@ -866,6 +870,8 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
    operand = cff_dict_get_operands (font->top_dict, CHARSTRINGS_OP, &size);
    decode_integer (operand, &offset);
    p = font->data + offset;
+    if (unlikely (p < font->data || p > font->data_end))
+        return CAIRO_INT_STATUS_UNSUPPORTED;
    status = cff_index_read (&font->charstrings_index, &p, font->data_end);
    if (unlikely (status))
        goto fail;
@@ -874,49 +880,58 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
    if (font->is_cid) {
        operand = cff_dict_get_operands (font->top_dict, FDSELECT_OP, &size);
        decode_integer (operand, &offset);
-        status = cairo_cff_font_read_fdselect (font, font->data + offset);
-	if (unlikely (status))
-	    goto fail;
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
+        status = cairo_cff_font_read_fdselect (font, p);
+        if (unlikely (status))
+            goto fail;

        operand = cff_dict_get_operands (font->top_dict, FDARRAY_OP, &size);
        decode_integer (operand, &offset);
-        status = cairo_cff_font_read_cid_fontdict (font, font->data + offset);
-	if (unlikely (status))
-	    goto fail;
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
+        status = cairo_cff_font_read_cid_fontdict (font, p);
+        if (unlikely (status))
+            goto fail;
    } else {
        operand = cff_dict_get_operands (font->top_dict, PRIVATE_OP, &size);
        operand = decode_integer (operand, &size);
        decode_integer (operand, &offset);
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
        status = cairo_cff_font_read_private_dict (font,
                                                   font->private_dict,
-						   &font->local_sub_index,
-						   font->data + offset,
-						   size);
-	if (unlikely (status))
-	    goto fail;
+                                                   &font->local_sub_index,
+                                                   p,
+                                                   size);
+        if (unlikely (status))
+            goto fail;
    }

    /* Use maximum sized encoding to reserve space for later modification. */
    end_buf = encode_integer_max (buf, 0);
    status = cff_dict_set_operands (font->top_dict,
-	                            CHARSTRINGS_OP, buf, end_buf - buf);
+                                    CHARSTRINGS_OP, buf, end_buf - buf);
    if (unlikely (status))
-	goto fail;
+        goto fail;

    status = cff_dict_set_operands (font->top_dict,
-	                            FDSELECT_OP, buf, end_buf - buf);
+                                    FDSELECT_OP, buf, end_buf - buf);
    if (unlikely (status))
-	goto fail;
+        goto fail;

    status = cff_dict_set_operands (font->top_dict,
-	                            FDARRAY_OP, buf, end_buf - buf);
+                                    FDARRAY_OP, buf, end_buf - buf);
    if (unlikely (status))
-	goto fail;
+        goto fail;

    status = cff_dict_set_operands (font->top_dict,
-	                            CHARSET_OP, buf, end_buf - buf);
+                                    CHARSET_OP, buf, end_buf - buf);
    if (unlikely (status))
-	goto fail;
+        goto fail;

    cff_dict_remove (font->top_dict, ENCODING_OP);
    cff_dict_remove (font->top_dict, PRIVATE_OP);
@@ -985,26 +1000,26 @@ cairo_cff_font_set_ros_strings (cairo_cff_font_t *font)
                                    (unsigned char *)registry,
                                    strlen(registry));
    if (unlikely (status))
-	return status;
+        return status;

    sid2 = NUM_STD_STRINGS + _cairo_array_num_elements (&font->strings_subset_index);
    status = cff_index_append_copy (&font->strings_subset_index,
                                    (unsigned char *)ordering,
-				    strlen(ordering));
+                                    strlen(ordering));
    if (unlikely (status))
-	return status;
+        return status;

    p = encode_integer (buf, sid1);
    p = encode_integer (p, sid2);
    p = encode_integer (p, 0);
    status = cff_dict_set_operands (font->top_dict, ROS_OP, buf, p - buf);
    if (unlikely (status))
-	return status;
+        return status;

    p = encode_integer (buf, font->scaled_font_subset->num_glyphs);
    status = cff_dict_set_operands (font->top_dict, CIDCOUNT_OP, buf, p - buf);
    if (unlikely (status))
-	return status;
+        return status;

    return CAIRO_STATUS_SUCCESS;
 }
@@ -1038,7 +1053,7 @@ cairo_cff_font_subset_dict_string(cairo_cff_font_t   *font,
    p = encode_integer (buf, sid);
    status = cff_dict_set_operands (dict, operator, buf, p - buf);
    if (unlikely (status))
-	return status;
+        return status;

    return CAIRO_STATUS_SUCCESS;
 }
@@ -1101,19 +1116,19 @@ cairo_cff_font_subset_fontdict (cairo_cff_font_t  *font)
    font->fdselect_subset = calloc (font->scaled_font_subset->num_glyphs,
                                     sizeof (int));
    if (unlikely (font->fdselect_subset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    font->fd_subset_map = calloc (font->num_fontdicts, sizeof (int));
    if (unlikely (font->fd_subset_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    font->private_dict_offset = calloc (font->num_fontdicts, sizeof (int));
    if (unlikely (font->private_dict_offset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    reverse_map = calloc (font->num_fontdicts, sizeof (int));
    if (unlikely (reverse_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    for (i = 0; i < font->num_fontdicts; i++)
        reverse_map[i] = -1;
@@ -1143,22 +1158,22 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
    font->num_fontdicts = 1;
    font->fd_dict = malloc (sizeof (cairo_hash_table_t *));
    if (unlikely (font->fd_dict == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    if (cff_dict_init (&font->fd_dict[0])) {
-	free (font->fd_dict);
-	font->fd_dict = NULL;
-	font->num_fontdicts = 0;
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        free (font->fd_dict);
+        font->fd_dict = NULL;
+        font->num_fontdicts = 0;
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
    }

    font->fd_subset_map = malloc (sizeof (int));
    if (unlikely (font->fd_subset_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    font->private_dict_offset = malloc (sizeof (int));
    if (unlikely (font->private_dict_offset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    font->fd_subset_map[0] = 0;
    font->num_subset_fontdicts = 1;
@@ -1169,7 +1184,7 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
    end_buf = encode_integer_max (end_buf, 0);
    status = cff_dict_set_operands (font->fd_dict[0], PRIVATE_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    return CAIRO_STATUS_SUCCESS;
 }
@@ -1208,7 +1223,7 @@ cairo_cff_font_subset_font (cairo_cff_font_t  *font)

    status = cairo_cff_font_set_ros_strings (font);
    if (unlikely (status))
-	return status;
+        return status;

    status = cairo_cff_font_subset_charstrings (font);
    if (unlikely (status))
@@ -1219,7 +1234,7 @@ cairo_cff_font_subset_font (cairo_cff_font_t  *font)
    else
        status = cairo_cff_font_create_cid_fontdict (font);
    if (unlikely (status))
-	return status;
+        return status;

    status = cairo_cff_font_subset_strings (font);
    if (unlikely (status))
@@ -1271,7 +1286,7 @@ cairo_cff_font_write_name (cairo_cff_font_t *font)
                                    (unsigned char *) font->subset_font_name,
                                    strlen(font->subset_font_name));
    if (unlikely (status))
-	goto FAIL;
+        goto FAIL;

    status = cff_index_write (&index, &font->output);
    if (unlikely (status))
@@ -1464,9 +1479,9 @@ cairo_cff_font_write_cid_fontdict (cairo_cff_font_t *font)
        if (unlikely (status))
            return status;

-	offset_array_ptr = (uint32_t *) _cairo_array_index (&font->output, offset_array);
+        offset_array_ptr = (uint32_t *) _cairo_array_index (&font->output, offset_array);
        *offset_array_ptr = cpu_to_be32(_cairo_array_num_elements (&font->output) - offset_base);
-	offset_array += sizeof(uint32_t);
+        offset_array += sizeof(uint32_t);
    }

    return CAIRO_STATUS_SUCCESS;
@@ -1566,15 +1581,15 @@ cairo_cff_font_write_cid_private_dict_and_local_sub (cairo_cff_font_t  *font)
                                                    0,
                                                    font->fd_dict[0],
                                                    font->private_dict);
-	if (unlikely (status))
-	    return status;
+        if (unlikely (status))
+            return status;

        status = cairo_cff_font_write_local_sub (font,
                                                 0,
                                                 font->private_dict,
                                                 &font->local_sub_index);
-	if (unlikely (status))
-	    return status;
+        if (unlikely (status))
+            return status;
    }

    return CAIRO_STATUS_SUCCESS;
@@ -1698,7 +1713,7 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,

    backend = scaled_font_subset->scaled_font->backend;
    if (!backend->load_truetype_table)
-	return CAIRO_INT_STATUS_UNSUPPORTED;
+        return CAIRO_INT_STATUS_UNSUPPORTED;

    data_length = 0;
    status = backend->load_truetype_table( scaled_font_subset->scaled_font,
@@ -1736,12 +1751,12 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
    _cairo_array_init (&font->output, sizeof (char));
    status = _cairo_array_grow_by (&font->output, 4096);
    if (unlikely (status))
-	goto fail2;
+        goto fail2;

    font->subset_font_name = strdup (subset_name);
    if (unlikely (font->subset_font_name == NULL)) {
        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        goto fail2;
    }
    font->x_min = (int16_t) be16_to_cpu (head.x_min);
    font->y_min = (int16_t) be16_to_cpu (head.y_min);
@@ -1755,18 +1770,18 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,

    font->font_name = NULL;
    status = _cairo_truetype_read_font_name (scaled_font_subset->scaled_font,
-					     &font->ps_name,
-					     &font->font_name);
+                                             &font->ps_name,
+                                             &font->font_name);
    if (_cairo_status_is_error (status))
-	goto fail3;
+        goto fail3;

    /* If the PS name is not found, create a CairoFont-x-y name. */
    if (font->ps_name == NULL) {
        font->ps_name = malloc (30);
        if (unlikely (font->ps_name == NULL)) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+            status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
            goto fail3;
-	}
+        }

        snprintf(font->ps_name, 30, "CairoFont-%u-%u",
                 scaled_font_subset->font_id,
@@ -1781,7 +1796,7 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,

    status = cairo_cff_font_create_set_widths (font);
    if (unlikely (status))
-	goto fail5;
+        goto fail5;

    font->data_length = data_length;
    font->data = malloc (data_length);
@@ -1799,11 +1814,11 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,

    status = cff_dict_init (&font->top_dict);
    if (unlikely (status))
-	goto fail6;
+        goto fail6;

    status = cff_dict_init (&font->private_dict);
    if (unlikely (status))
-	goto fail7;
+        goto fail7;

    cff_index_init (&font->strings_index);
    cff_index_init (&font->charstrings_index);
@@ -1831,7 +1846,7 @@ fail5:
    free (font->widths);
 fail4:
    if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
 fail3:
    free (font->subset_font_name);
 fail2:
@@ -1848,7 +1863,7 @@ cairo_cff_font_destroy (cairo_cff_font_t *font)

    free (font->widths);
    if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
    free (font->ps_name);
    free (font->subset_font_name);
    _cairo_array_fini (&font->output);
@@ -1902,7 +1917,7 @@ cairo_cff_font_destroy (cairo_cff_font_t *font)

 cairo_status_t
 _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
-                        const char		    *subset_name,
+                        const char                    *subset_name,
                        cairo_scaled_font_subset_t  *font_subset)
 {
    cairo_cff_font_t *font = NULL; /* squelch bogus compiler warning */
@@ -1913,32 +1928,32 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,

    status = _cairo_cff_font_create (font_subset, &font, subset_name);
    if (unlikely (status))
-	return status;
+        return status;

    status = cairo_cff_font_generate (font, &data, &length);
    if (unlikely (status))
-	goto fail1;
+        goto fail1;

    cff_subset->ps_name = strdup (font->ps_name);
    if (unlikely (cff_subset->ps_name == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail1;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail1;
    }

    if (font->font_name) {
-	cff_subset->font_name = strdup (font->font_name);
-	if (cff_subset->font_name == NULL) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	    goto fail2;
-	}
+        cff_subset->font_name = strdup (font->font_name);
+        if (cff_subset->font_name == NULL) {
+            status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+            goto fail2;
+        }
    } else {
-	cff_subset->font_name = NULL;
+        cff_subset->font_name = NULL;
    }

    cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
    if (unlikely (cff_subset->widths == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail3;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail3;
    }
    for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
        cff_subset->widths[i] = (double)font->widths[i]/font->units_per_em;
@@ -1952,8 +1967,8 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,

    cff_subset->data = malloc (length);
    if (unlikely (cff_subset->data == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail4;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail4;
    }

    memcpy (cff_subset->data, data, length);
@@ -1967,7 +1982,7 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
    free (cff_subset->widths);
 fail3:
    if (cff_subset->font_name)
-	free (cff_subset->font_name);
+        free (cff_subset->font_name);
 fail2:
    free (cff_subset->ps_name);
 fail1:
@@ -1981,7 +1996,7 @@ _cairo_cff_subset_fini (cairo_cff_subset_t *subset)
 {
    free (subset->ps_name);
    if (subset->font_name)
-	free (subset->font_name);
+        free (subset->font_name);
    free (subset->widths);
    free (subset->data);
 }
@@ -1996,7 +2011,7 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset

    font = calloc (1, sizeof (cairo_cff_font_t));
    if (unlikely (font == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);

    font->backend = NULL;
    font->scaled_font_subset = scaled_font_subset;
@@ -2004,18 +2019,18 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset
    _cairo_array_init (&font->output, sizeof (char));
    status = _cairo_array_grow_by (&font->output, 4096);
    if (unlikely (status))
-	goto fail1;
+        goto fail1;

    font->subset_font_name = strdup (subset_name);
    if (unlikely (font->subset_font_name == NULL)) {
        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail1;
+        goto fail1;
    }

    font->ps_name = strdup (subset_name);
    if (unlikely (font->ps_name == NULL)) {
        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        goto fail2;
    }
    font->font_name = NULL;

@@ -2038,11 +2053,11 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset

    status = cff_dict_init (&font->top_dict);
    if (unlikely (status))
-	goto fail4;
+        goto fail4;

    status = cff_dict_init (&font->private_dict);
    if (unlikely (status))
-	goto fail5;
+        goto fail5;

    cff_index_init (&font->strings_index);
    cff_index_init (&font->charstrings_index);
@@ -2068,7 +2083,7 @@ fail4:
    free (font->widths);
 fail3:
    if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
    free (font->ps_name);
 fail2:
    free (font->subset_font_name);
@@ -2105,39 +2120,39 @@ cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,
    end_buf = encode_integer (end_buf, type2_subset->x_max);
    end_buf = encode_integer (end_buf, type2_subset->y_max);
    status = cff_dict_set_operands (font->top_dict,
-	                            FONTBBOX_OP, buf, end_buf - buf);
+                                    FONTBBOX_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    end_buf = encode_integer_max (buf, 0);
    status = cff_dict_set_operands (font->top_dict,
-	                            CHARSTRINGS_OP, buf, end_buf - buf);
+                                    CHARSTRINGS_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    status = cff_dict_set_operands (font->top_dict,
-	                            FDSELECT_OP, buf, end_buf - buf);
+                                    FDSELECT_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    status = cff_dict_set_operands (font->top_dict,
-	                            FDARRAY_OP, buf, end_buf - buf);
+                                    FDARRAY_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    status = cff_dict_set_operands (font->top_dict,
-	                            CHARSET_OP, buf, end_buf - buf);
+                                    CHARSET_OP, buf, end_buf - buf);
    if (unlikely (status))
-	return status;
+        return status;

    status = cairo_cff_font_set_ros_strings (font);
    if (unlikely (status))
-	return status;
+        return status;

    /* Create CID FD dictionary */
    status = cairo_cff_font_create_cid_fontdict (font);
    if (unlikely (status))
-	return status;
+        return status;

    /* Create charstrings */
    for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
@@ -2163,7 +2178,7 @@ cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,

 cairo_status_t
 _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
-                          const char		      *subset_name,
+                          const char                      *subset_name,
                          cairo_scaled_font_subset_t  *font_subset)
 {
    cairo_cff_font_t *font = NULL; /* squelch bogus compiler warning */
@@ -2175,27 +2190,27 @@ _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,

    status = _cairo_cff_font_fallback_create (font_subset, &font, subset_name);
    if (unlikely (status))
-	return status;
+        return status;

    status = _cairo_type2_charstrings_init (&type2_subset, font_subset);
    if (unlikely (status))
-	goto fail1;
+        goto fail1;

    status = cairo_cff_font_fallback_generate (font, &type2_subset, &data, &length);
    if (unlikely (status))
-	goto fail2;
+        goto fail2;

    cff_subset->font_name = NULL;
    cff_subset->ps_name = strdup (font->ps_name);
    if (unlikely (cff_subset->ps_name == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail2;
    }

    cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
    if (unlikely (cff_subset->widths == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail3;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail3;
    }

    for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
@@ -2210,8 +2225,8 @@ _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,

    cff_subset->data = malloc (length);
    if (unlikely (cff_subset->data == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail4;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail4;
    }

    memcpy (cff_subset->data, data, length);
@@ -5,8 +5,6 @@
 #ifndef CAIRO_DEPRECATED_H
 #define CAIRO_DEPRECATED_H

-#define CAIRO_FONT_TYPE_ATSUI CAIRO_FONT_TYPE_QUARTZ
-
 /* Obsolete functions. These definitions exist to coerce the compiler
 * into providing a little bit of guidance with its error
 * messages. The idea is to help users port their old code without
@@ -59,8 +57,6 @@
 #define cairo_ps_surface_set_dpi	cairo_ps_surface_set_dpi_REPLACED_BY_cairo_surface_set_fallback_resolution
 #define cairo_pdf_surface_set_dpi	cairo_pdf_surface_set_dpi_REPLACED_BY_cairo_surface_set_fallback_resolution
 #define cairo_svg_surface_set_dpi	cairo_svg_surface_set_dpi_REPLACED_BY_cairo_surface_set_fallback_resolution
-#define cairo_atsui_font_face_create_for_atsu_font_id  cairo_atsui_font_face_create_for_atsu_font_id_REPLACED_BY_cairo_quartz_font_face_create_for_atsu_font_id
-
 #define cairo_current_path	     cairo_current_path_DEPRECATED_BY_cairo_copy_path
 #define cairo_current_path_flat	     cairo_current_path_flat_DEPRECATED_BY_cairo_copy_path_flat
 #define cairo_get_path		     cairo_get_path_DEPRECATED_BY_cairo_copy_path
@@ -767,45 +767,3 @@ _cairo_quartz_scaled_font_get_ct_font_ref (cairo_scaled_font_t *abstract_font)

    return ffont->ctFont;
 }
-
-#if !defined(__LP64__) && !TARGET_OS_IPHONE
-/*
- * compat with old ATSUI backend
- */
-
-/**
- * cairo_quartz_font_face_create_for_atsu_font_id
- * @font_id: an ATSUFontID for the font.
- *
- * Creates a new font for the Quartz font backend based on an
- * #ATSUFontID. This font can then be used with
- * cairo_set_font_face() or cairo_scaled_font_create().
- *
- * Return value: a newly created #cairo_font_face_t. Free with
- *  cairo_font_face_destroy() when you are done using it.
- *
- * Since: 1.6
- **/
-cairo_font_face_t *
-cairo_quartz_font_face_create_for_atsu_font_id (ATSUFontID font_id)
-{
-    ATSFontRef atsFont = FMGetATSFontRefFromFont (font_id);
-    CGFontRef cgFont = CGFontCreateWithPlatformFont (&atsFont);
-    cairo_font_face_t *ff;
-
-    ff = cairo_quartz_font_face_create_for_cgfont (cgFont);
-
-    CGFontRelease (cgFont);
-
-    return ff;
-}
-
-/* This is the old name for the above function, exported for compat purposes */
-cairo_font_face_t *cairo_atsui_font_face_create_for_atsu_font_id (ATSUFontID font_id);
-
-cairo_font_face_t *
-cairo_atsui_font_face_create_for_atsu_font_id (ATSUFontID font_id)
-{
-    return cairo_quartz_font_face_create_for_atsu_font_id (font_id);
-}
-#endif
@@ -63,11 +63,6 @@ cairo_quartz_surface_get_image (cairo_surface_t *surface);
 cairo_public cairo_font_face_t *
 cairo_quartz_font_face_create_for_cgfont (CGFontRef font);

-#if !defined(__LP64__) && !TARGET_OS_IPHONE
-cairo_public cairo_font_face_t *
-cairo_quartz_font_face_create_for_atsu_font_id (ATSUFontID font_id);
-#endif
-
 #endif /* CAIRO_HAS_QUARTZ_FONT */

 CAIRO_END_DECLS
@@ -213,8 +213,6 @@
 #define cairo_qpainter_surface_create_with_qpixmap _moz_cairo_qpainter_surface_create_with_qpixmap
 #define cairo_qpainter_surface_get_image _moz_cairo_qpainter_surface_get_image
 #define cairo_qpainter_surface_get_qimage _moz_cairo_qpainter_surface_get_qimage
-#define cairo_qpainter_surface_get_qpainter _moz_cairo_qpainter_surface_get_qpainter
-#define cairo_quartz_font_face_create_for_atsu_font_id _moz_cairo_quartz_font_face_create_for_atsu_font_id
 #define cairo_quartz_font_face_create_for_cgfont _moz_cairo_quartz_font_face_create_for_cgfont
 #define cairo_quartz_image_surface_create _moz_cairo_quartz_image_surface_create
 #define cairo_quartz_image_surface_get_image _moz_cairo_quartz_image_surface_get_image
@@ -87,12 +87,19 @@ public:
 bool
 BasicPlanarYCbCrImage::CopyData(const Data& aData)
 {
-  RecyclingPlanarYCbCrImage::CopyData(aData);
-
-  if (mDelayedConversion) {
+  if (!RecyclingPlanarYCbCrImage::CopyData(aData)) {
    return false;
  }

+  // The YCbCr copy above succeeded; delaying the RGB conversion is not a
+  // failure. GetAsSourceSurface() converts on demand when mDecodedBuffer is
+  // null. Returning false here made VideoData::CreateAndCopyData report OOM
+  // (MEDIA_ERR_DECODE) for any frame decoded while BasicImageLayer::Paint had
+  // swapped this factory into the video's ImageContainer.
+  if (mDelayedConversion) {
+    return true;
+  }
+
  // Do some sanity checks to prevent integer overflow
  if (aData.mYSize.width > PlanarYCbCrImage::MAX_DIMENSION ||
      aData.mYSize.height > PlanarYCbCrImage::MAX_DIMENSION) {
@@ -529,7 +529,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in {'cocoa', 'uikit'}:
    SOURCES += [
        'skia/src/ports/SkFontHost_mac.cpp',
    ]
-if 'gtk' in CONFIG['MOZ_WIDGET_TOOLKIT']:
+if 'gtk' in CONFIG['MOZ_WIDGET_TOOLKIT'] or CONFIG['MOZ_WIDGET_TOOLKIT'] == 'headless':
    UNIFIED_SOURCES += [
        'skia/src/ports/SkDebug_stdio.cpp',
        'skia/src/ports/SkOSFile_posix.cpp',
@@ -665,6 +665,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in {
    'cocoa',
    'gtk2',
    'gtk3',
+    'headless',
    'uikit',
  }:
    DEFINES['SK_FONTHOST_DOES_NOT_USE_FONTMGR'] = 1
@@ -738,7 +739,7 @@ if CONFIG['CLANG_CXX'] or CONFIG['CLANG_CL']:
        '-Wno-unused-private-field',
    ]

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
    CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
    CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']

@@ -32,6 +32,9 @@
 #include <gdk/gdk.h>
 #include "gfxPlatformGtk.h"
 #endif
+#ifdef MOZ_WIDGET_HEADLESS
+#include "gfxPlatformHeadless.h"
+#endif

 #ifdef MOZ_X11
 #include "mozilla/X11Util.h"
@@ -1764,7 +1767,11 @@ gfxFcPlatformFontList::FindGenericFamilies(const nsAString& aGeneric,

    // -- select the fonts to be used for the generic
    prefFonts = new PrefFontList; // can be empty but in practice won't happen
+#ifdef MOZ_WIDGET_HEADLESS
+    uint32_t limit = gfxPlatformHeadless::GetPlatform()->MaxGenericSubstitions();
+#else
    uint32_t limit = gfxPlatformGtk::GetPlatform()->MaxGenericSubstitions();
+#endif
    bool foundFontWithLang = false;
    for (int i = 0; i < faces->nfont; i++) {
        FcPattern* font = faces->fonts[i];