[gfx] Add sanity checks in ANGLE D3D11 renderer.

Note: `vbr.NumAudioFrames()` is already checked in `vbr.IsComplete()`

accessible/base/AccIterator.h

@@ -55,7 +55,7 @@ private:
   {
     explicit IteratorState(Accessible* aParent, IteratorState* mParentState = nullptr);
 
-    Accessible* mParent;
+    RefPtr<Accessible> mParent;
     int32_t mIndex;
     IteratorState* mParentState;
   };

dom/base/Element.cpp

@@ -304,12 +304,18 @@ Element::TabIndex()
 }
 
 void
-Element::Focus(mozilla::ErrorResult& aError)
+Element::Focus(const FocusOptions& aOptions, ErrorResult& aError)
 {
   nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(this);
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+  // Also other browsers seem to have the hack to not re-focus (and flush) when
+  // the element is already focused.
+  // Until https://github.com/whatwg/html/issues/4512 is clarified, we'll
+  // maintain interoperatibility by not re-focusing, independent of aOptions.
+  // I.e., `focus({ preventScroll: true})` followed by `focus( { preventScroll:
+  // false })` won't re-focus.
   if (fm && domElement) {
-    aError = fm->SetFocus(domElement, 0);
+    aError = fm->SetFocus(domElement, nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions));
   }
 }
 

dom/base/Element.h

@@ -216,7 +216,7 @@ public:
   /**
    * Make focus on this element.
    */
-  virtual void Focus(mozilla::ErrorResult& aError);
+  virtual void Focus(const FocusOptions& aOptions, ErrorResult& aError);
 
   /**
    * Show blur and clear focus.

dom/base/FileReader.cpp

@@ -395,8 +395,14 @@ FileReader::ReadFileContent(Blob& aBlob,
     return;
   }
 
+  CheckedInt<size_t> size(mTotal);
+  if (!size.isValid()) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
   if (mDataFormat == FILE_AS_ARRAYBUFFER) {
-    mFileData = js_pod_malloc<char>(mTotal);
+    mFileData = js_pod_malloc<char>(size.value());
     if (!mFileData) {
       NS_WARNING("Preallocation failed for ReadFileData");
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);

dom/base/ImageEncoder.cpp

@@ -400,6 +400,7 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
       layers::PlanarYCbCrImage* ycbcrImage = static_cast<layers::PlanarYCbCrImage*> (aImage);
       gfxImageFormat format = SurfaceFormat::A8R8G8B8_UINT32;
       uint32_t stride = GetAlignedStride<16>(aSize.width, 4);
+      auto size = stride * aSize.height;
       size_t length = BufferSizeFromStrideAndHeight(stride, aSize.height);
       if (length == 0) {
         return NS_ERROR_INVALID_ARG;
@@ -413,10 +414,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
                         stride);
 
       rv = aEncoder->InitFromData(data.Elements(),
-                                  aSize.width * aSize.height * 4,
+                                  size,
                                   aSize.width,
                                   aSize.height,
-                                  aSize.width * 4,
+                                  stride,
                                   imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                   aOptions);
     } else {
@@ -433,10 +434,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
         return NS_ERROR_INVALID_ARG;
       }
       rv = aEncoder->InitFromData(map.mData,
-                                  aSize.width * aSize.height * 4,
+                                  map.mStride * aSize.height,
                                   aSize.width,
                                   aSize.height,
-                                  aSize.width * 4,
+                                  map.mStride,
                                   imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                   aOptions);
       dataSurface->Unmap();
@@ -467,10 +468,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
       return NS_ERROR_INVALID_ARG;
     }
     rv = aEncoder->InitFromData(map.mData,
-                                aSize.width * aSize.height * 4,
+                                map.mStride * aSize.height,
                                 aSize.width,
                                 aSize.height,
-                                aSize.width * 4,
+                                map.mStride,
                                 imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                 aOptions);
     emptyCanvas->Unmap();

dom/base/nsContentList.cpp

@@ -523,7 +523,8 @@ nsContentList::NamedItem(const nsAString& aName, bool aDoFlush)
 }
 
 void
-nsContentList::GetSupportedNames(nsTArray<nsString>& aNames)
+nsContentList::GetSupportedNames(nsTArray<nsString>& aNames,
+                                 FilterElementWithName aFilter)
 {
   BringSelfUpToDate(true);
 
@@ -546,7 +547,8 @@ nsContentList::GetSupportedNames(nsTArray<nsString>& aNames)
       // Note: nsINode::HasName means the name is exposed on the document,
       // which is false for options, so we don't check it here.
       const nsAttrValue* val = el->GetParsedAttr(nsGkAtoms::name);
-      if (val && val->Type() == nsAttrValue::eAtom) {
+      if (val && val->Type() == nsAttrValue::eAtom &&
+          (!aFilter || aFilter(el))) {
         nsIAtom* name = val->GetAtomValue();
         MOZ_ASSERT(name != nsGkAtoms::_empty,
                    "Empty names don't get atomized");

dom/base/nsContentList.h

@@ -295,7 +295,9 @@ public:
     aFound = !!item;
     return item;
   }
-  virtual void GetSupportedNames(nsTArray<nsString>& aNames) override;
+  virtual void GetSupportedNames(nsTArray<nsString>& aNames) override {
+    GetSupportedNames(aNames, nullptr);
+  }
 
   // nsContentList public methods
   uint32_t Length(bool aDoFlush);
@@ -303,6 +305,12 @@ public:
   mozilla::dom::Element*
   NamedItem(const nsAString& aName, bool aDoFlush);
 
+  // Used by HTMLAllCollection to limit the elements whose name attribute is
+  // considered. The filter MUST NOT cause any flushes.
+  using FilterElementWithName = bool (*)(nsIContent*);
+  void GetSupportedNames(nsTArray<nsString>& aNames,
+                         FilterElementWithName aFilter);
+
   // nsIMutationObserver
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED

dom/base/nsContentUtils.cpp

@@ -2259,6 +2259,31 @@ nsContentUtils::IsCallerContentXBL()
     return xpc::IsContentXBLScope(c);
 }
 
+bool
+nsContentUtils::IsSystemCaller(JSContext* aCx)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // This is similar to what SubjectPrincipal() does, except we do in fact
+  // assume that we're in a compartment here; anyone who calls this function in
+  // situations where that's not the case is doing it wrong.
+  JSCompartment *compartment = js::GetContextCompartment(aCx);
+  MOZ_ASSERT(compartment);
+
+  JSPrincipals *principals = JS_GetCompartmentPrincipals(compartment);
+  return nsJSPrincipals::get(principals) == sSystemPrincipal;
+}
+
+bool
+nsContentUtils::ThreadsafeIsSystemCaller(JSContext* aCx)
+{
+  if (NS_IsMainThread()) {
+    return IsSystemCaller(aCx);
+  }
+
+  return workers::GetWorkerPrivateFromContext(aCx)->UsesSystemPrincipal();
+}
+
 // static
 bool
 nsContentUtils::LookupBindingMember(JSContext* aCx, nsIContent *aContent,
@@ -7336,6 +7361,17 @@ nsContentUtils::HasDistributedChildren(nsIContent* aContent)
   return false;
 }
 
+// static
+bool nsContentUtils::IsNodeInEditableRegion(nsINode* aNode) {
+  while (aNode) {
+    if (aNode->IsEditable()) {
+      return true;
+    }
+    aNode = aNode->GetParent();
+  }
+  return false;
+}
+
 // static
 bool
 nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader,

dom/base/nsContentUtils.h

@@ -202,6 +202,23 @@ public:
   static bool     ThreadsafeIsCallerChrome();
   static bool     IsCallerContentXBL();
 
+  // The APIs for checking whether the caller is system (in the sense of system
+  // principal) should only be used when the JSContext is known to accurately
+  // represent the caller.  In practice, that means you should only use them in
+  // two situations at the moment:
+  //
+  // 1) Functions used in WebIDL Func annotations.
+  // 2) Bindings code.
+  //
+  // Use pretty much anywhere else is almost certainly wrong and should be
+  // replaced with [NeedsCallerType] annotations in bindings.
+
+  // Check whether the caller is system if you know you're on the main thread.
+  static bool IsSystemCaller(JSContext* aCx);
+
+  // Check whether the caller is system if you might be on a worker thread.
+  static bool ThreadsafeIsSystemCaller(JSContext* aCx);
+
   // In the traditional Gecko architecture, both C++ code and untrusted JS code
   // needed to rely on the same XPCOM method/getter/setter to get work done.
   // This required lots of security checks in the various exposed methods, which
@@ -2550,6 +2567,13 @@ public:
    */
   static bool GPCEnabled();
 
+  /**
+   * Returns whether a node has an editable ancestor.
+   *
+   * @param aNode The node to test.
+   */
+  static bool IsNodeInEditableRegion(nsINode* aNode);
+
   /**
    * Returns a LogModule that dump calls from content script are logged to.
    * This can be enabled with the 'Dump' module, and is useful for synchronizing

dom/base/nsFocusManager.cpp

@@ -48,6 +48,7 @@
 
 #include "mozilla/ContentEvents.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/ElementBinding.h"
 #include "mozilla/dom/ShadowRoot.h"
 #include "mozilla/dom/HTMLInputElement.h"
 #include "mozilla/dom/HTMLSlotElement.h"
@@ -2999,6 +3000,11 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindowOuter* aWindow,
   return NS_OK;
 }
 
+uint32_t nsFocusManager::FocusOptionsToFocusManagerFlags(
+    const mozilla::dom::FocusOptions& aOptions) {
+  return aOptions.mPreventScroll ? nsIFocusManager::FLAG_NOSCROLL : 0;
+}
+
 static bool
 IsHostOrSlot(nsIContent* aContent)
 {

dom/base/nsFocusManager.h

@@ -26,6 +26,7 @@ class nsIMessageBroadcaster;
 
 namespace mozilla {
 namespace dom {
+struct FocusOptions;
 class TabParent;
 }
 }
@@ -110,6 +111,9 @@ public:
   static nsIContent* GetFocusedDescendant(nsPIDOMWindowOuter* aWindow, bool aDeep,
                                           nsPIDOMWindowOuter** aFocusedWindow);
 
+  static uint32_t FocusOptionsToFocusManagerFlags(
+      const mozilla::dom::FocusOptions& aOptions);
+
   /**
    * Returns the content node that focus will be redirected to if aContent was
    * focused. This is used for the special case of certain XUL elements such

dom/base/nsGlobalWindow.cpp

@@ -7395,9 +7395,10 @@ nsGlobalWindow::Confirm(const nsAString& aMessage,
 
 already_AddRefed<Promise>
 nsGlobalWindow::Fetch(const RequestOrUSVString& aInput,
-                      const RequestInit& aInit, ErrorResult& aRv)
+                      const RequestInit& aInit,
+                      CallerType aCallerType, ErrorResult& aRv)
 {
-  return FetchRequest(this, aInput, aInit, aRv);
+  return FetchRequest(this, aInput, aInit, aCallerType, aRv);
 }
 
 void

dom/base/nsGlobalWindow.h

@@ -929,6 +929,7 @@ public:
   already_AddRefed<mozilla::dom::cache::CacheStorage> GetCaches(mozilla::ErrorResult& aRv);
   already_AddRefed<mozilla::dom::Promise> Fetch(const mozilla::dom::RequestOrUSVString& aInput,
                                                 const mozilla::dom::RequestInit& aInit,
+                                                mozilla::dom::CallerType aCallerType,
                                                 mozilla::ErrorResult& aRv);
   void PrintOuter(mozilla::ErrorResult& aError);
   void Print(mozilla::ErrorResult& aError);

dom/base/nsIImageLoadingContent.idl

@@ -37,7 +37,7 @@ native Visibility(mozilla::Visibility);
  * observers to check which request they are getting notifications for.
  *
  * Please make sure to update the MozImageLoadingContent WebIDL
- * interface to mirror this interface when changing it.
+ * mixin to mirror this interface when changing it.
  */
 
 [scriptable, builtinclass, uuid(0357123d-9224-4d12-a47e-868c32689777)]

dom/base/nsWrapperCache.cpp

@@ -33,17 +33,29 @@ nsWrapperCache::HoldJSObjects(void* aScriptObjectHolder,
   }
 }
 
+static inline bool
+IsNurseryWrapper(JSObject* aWrapper) {
+  return aWrapper && !JS::ObjectIsTenured(aWrapper);
+}
+
 void
-nsWrapperCache::SetWrapperJSObject(JSObject* aWrapper)
-{
-  mWrapper = aWrapper;
+nsWrapperCache::SetWrapperJSObject(JSObject* aNewWrapper) {
+  JSObject* oldWrapper = mWrapper;
+  mWrapper = aNewWrapper;
   UnsetWrapperFlags(kWrapperFlagsMask & ~WRAPPER_IS_NOT_DOM_BINDING);
 
-  if (aWrapper && !JS::ObjectIsTenured(aWrapper)) {
+  if (IsNurseryWrapper(aNewWrapper) && !IsNurseryWrapper(oldWrapper)) {
     CycleCollectedJSContext::Get()->NurseryWrapperAdded(this);
   }
 }
 
+void nsWrapperCache::ClearWrapperOnWrapFailure() {
+  if (IsNurseryWrapper(mWrapper)) {
+    CycleCollectedJSContext::Get()->NurseryWrapperRemovedSlow(this);
+  }
+  ClearWrapper();
+}
+
 void
 nsWrapperCache::ReleaseWrapper(void* aScriptObjectHolder)
 {

dom/base/nsWrapperCache.h

@@ -131,6 +131,8 @@ public:
     SetWrapperJSObject(nullptr);
   }
 
+  void ClearWrapperOnWrapFailure();
+
   /**
    * Update the wrapper if the object it contains is moved.
    *

dom/bindings/Codegen.py

@@ -3711,7 +3711,7 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         failureCode = dedent(
             """
             aCache->ReleaseWrapper(aObject);
-            aCache->ClearWrapper();
+            aCache->ClearWrapperOnWrapFailure();
             return false;
             """)
 
@@ -4464,9 +4464,6 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                                 isOptional=False,
                                 invalidEnumValueFatal=True,
                                 defaultValue=None,
-                                treatNullAs="Default",
-                                isEnforceRange=False,
-                                isClamp=False,
                                 isNullOrUndefined=False,
                                 exceptionCode=None,
                                 lenientFloatCode=None,
@@ -4544,6 +4541,12 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
     # And we can't both be an object and be null or undefined
     assert not isDefinitelyObject or not isNullOrUndefined
 
+    # Types can also have extended attributes, copy them over
+    isClamp = type.clamp
+    isEnforceRange = type.enforceRange
+    if type.treatNullAsEmpty:
+        treatNullAs = "EmptyString"
+
     # If exceptionCode is not set, we'll just rethrow the exception we got.
     # Note that we can't just set failureCode to exceptionCode, because setting
     # failureCode will prevent pending exceptions from being set in cases when
@@ -5648,6 +5651,10 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             undefinedBehavior = "eNull"
         else:
             undefinedBehavior = "eStringify"
+            if type.treatNullAsEmpty:
+                treatNullAs = "EmptyString"
+            else:
+                treatNullAs = "Default"
         nullBehavior = treatAs[treatNullAs]
 
         def getConversionCode(varName):
@@ -6297,9 +6304,6 @@ class CGArgumentConverter(CGThing):
                         not self.argument.variadic),
             invalidEnumValueFatal=self.invalidEnumValueFatal,
             defaultValue=self.argument.defaultValue,
-            treatNullAs=self.argument.treatNullAs,
-            isEnforceRange=self.argument.enforceRange,
-            isClamp=self.argument.clamp,
             lenientFloatCode=self.lenientFloatCode,
             isMember="Variadic" if self.argument.variadic else False,
             allowTreatNonCallableAsNull=self.argument.allowTreatNonCallableAsNull(),
@@ -8370,18 +8374,6 @@ class FakeArgument():
         self.variadic = False
         self.defaultValue = None
         self._allowTreatNonCallableAsNull = allowTreatNonCallableAsNull
-        # For FakeArguments generated by maplike/setlike convenience functions,
-        # we won't have an interfaceMember to pass in.
-        if interfaceMember:
-            self.treatNullAs = interfaceMember.treatNullAs
-        else:
-            self.treatNullAs = "Default"
-        if isinstance(interfaceMember, IDLAttribute):
-            self.enforceRange = interfaceMember.enforceRange
-            self.clamp = interfaceMember.clamp
-        else:
-            self.enforceRange = False
-            self.clamp = False
 
         self.identifier = FakeIdentifier(name)
 
@@ -11063,7 +11055,6 @@ class CGProxySpecialOperation(CGPerSignatureCall):
             argument = arguments[1]
             info = getJSToNativeConversionInfo(
                 argument.type, descriptor,
-                treatNullAs=argument.treatNullAs,
                 sourceDescription=("value being assigned to %s setter" %
                                    descriptor.interface.identifier.name))
             if argumentHandleValue is None:
@@ -12694,8 +12685,6 @@ class CGDictionary(CGThing):
              getJSToNativeConversionInfo(
                  member.type,
                  descriptorProvider,
-                 isEnforceRange=member.enforceRange,
-                 isClamp=member.clamp,
                  isMember="Dictionary",
                  isOptional=member.canHaveMissingValue(),
                  defaultValue=member.defaultValue,
@@ -15575,7 +15564,6 @@ class CGCallbackInterface(CGCallback):
 
 class FakeMember():
     def __init__(self, name=None):
-        self.treatNullAs = "Default"
         if name is not None:
             self.identifier = FakeIdentifier(name)
 

dom/bindings/Configuration.py

@@ -45,7 +45,8 @@ class Configuration(DescriptorProvider):
                 # Our build system doesn't support dep build involving
                 # addition/removal of "implements" statements that appear in a
                 # different .webidl file than their LHS interface.  Make sure we
-                # don't have any of those.
+                # don't have any of those.  See similar block below for partial
+                # interfaces!
                 #
                 # But whitelist a RHS that is LegacyQueryInterface,
                 # since people shouldn't be adding any of those.
@@ -66,6 +67,33 @@ class Configuration(DescriptorProvider):
             if not thing.isInterface() and not thing.isNamespace():
                 continue
             iface = thing
+            # Our build system doesn't support dep builds involving
+            # addition/removal of partial interfaces that appear in a different
+            # .webidl file than the interface they are extending.  Make sure we
+            # don't have any of those.  See similar block above for "implements"
+            # statements!
+            if not iface.isExternal():
+                for partialIface in iface.getPartials():
+                    if (partialIface.filename() != iface.filename() and
+                        # Unfortunately, NavigatorProperty does exactly the
+                        # thing we're trying to prevent here.  I'm not sure how
+                        # to deal with that, short of effectively requiring a
+                        # clobber when NavigatorProperty is added/removed and
+                        # whitelisting the things it outputs here as
+                        # restrictively as I can.
+                        (partialIface.identifier.name != "Navigator" or
+                         len(partialIface.members) != 1 or
+                         partialIface.members[0].location != partialIface.location or
+                         partialIface.members[0].identifier.location.filename() !=
+                           "<builtin>")):
+                        raise TypeError(
+                            "The binding build system doesn't really support "
+                            "partial interfaces which don't appear in the "
+                            "file in which the interface they are extending is "
+                            "defined.  Don't do this.\n"
+                            "%s\n"
+                            "%s" %
+                            (partialIface.location, iface.location))
             self.interfaces[iface.identifier.name] = iface
             if iface.identifier.name not in config:
                 # Completely skip consequential interfaces with no descriptor

dom/bindings/ErrorResult.h

@@ -164,6 +164,7 @@ public:
 
   void Throw(nsresult rv) {
     MOZ_ASSERT(NS_FAILED(rv), "Please don't try throwing success");
+    ClearUnionData();
     AssignErrorCode(rv);
   }
 
@@ -324,6 +325,7 @@ public:
   // Throw() here because people can easily pass success codes to
   // this.
   void operator=(nsresult rv) {
+    ClearUnionData();
     AssignErrorCode(rv);
   }
 
@@ -393,6 +395,7 @@ private:
   }
 
   void AssignErrorCode(nsresult aRv) {
+    MOZ_ASSERT(mUnionState == HasNothing);
     MOZ_ASSERT(aRv != NS_ERROR_TYPE_ERR, "Use ThrowTypeError()");
     MOZ_ASSERT(aRv != NS_ERROR_RANGE_ERR, "Use ThrowRangeError()");
     MOZ_ASSERT(!IsErrorWithMessage(), "Don't overwrite errors with message");

dom/bindings/GenerateCSS2PropertiesWebIDL.py

@@ -13,7 +13,7 @@ from mozbuild import shellutil
 # (whether camelCase, _underscorePrefixed, etc.) and the given array of
 # extended attributes.
 def generateLine(propName, extendedAttrs):
-    return "  [%s] attribute DOMString %s;\n" % (", ".join(extendedAttrs),
+    return "  [%s] attribute [TreatNullAs=EmptyString] DOMString %s;\n" % (", ".join(extendedAttrs),
                                                  propName)
 def generate(output, idlFilename, preprocessorHeader):
     print(idlFilename)
@@ -30,7 +30,7 @@ def generate(output, idlFilename, preprocessorHeader):
             continue
         # Unfortunately, even some of the getters here are fallible
         # (e.g. on nsComputedDOMStyle).
-        extendedAttrs = ["Throws", "TreatNullAs=EmptyString"]
+        extendedAttrs = ["Throws"]
         if pref is not "":
             extendedAttrs.append('Pref="%s"' % pref)
 

dom/cache/Cache.cpp

@@ -311,7 +311,7 @@ Cache::MatchAll(JSContext* aCx, const Optional<RequestOrUSVString>& aRequest,
 
 already_AddRefed<Promise>
 Cache::Add(JSContext* aContext, const RequestOrUSVString& aRequest,
-           ErrorResult& aRv)
+           CallerType aCallerType, ErrorResult& aRv)
 {
   if (NS_WARN_IF(!mActor)) {
     aRv.Throw(NS_ERROR_UNEXPECTED);
@@ -341,12 +341,13 @@ Cache::Add(JSContext* aContext, const RequestOrUSVString& aRequest,
   }
 
   requestList.AppendElement(Move(request));
-  return AddAll(global, Move(requestList), aRv);
+  return AddAll(global, Move(requestList), aCallerType, aRv);
 }
 
 already_AddRefed<Promise>
 Cache::AddAll(JSContext* aContext,
               const Sequence<OwningRequestOrUSVString>& aRequestList,
+              CallerType aCallerType,
               ErrorResult& aRv)
 {
   if (NS_WARN_IF(!mActor)) {
@@ -390,7 +391,7 @@ Cache::AddAll(JSContext* aContext,
     requestList.AppendElement(Move(request));
   }
 
-  return AddAll(global, Move(requestList), aRv);
+  return AddAll(global, Move(requestList), aCallerType, aRv);
 }
 
 already_AddRefed<Promise>
@@ -579,7 +580,8 @@ Cache::ExecuteOp(AutoChildOpArgs& aOpArgs, ErrorResult& aRv)
 
 already_AddRefed<Promise>
 Cache::AddAll(const GlobalObject& aGlobal,
-              nsTArray<RefPtr<Request>>&& aRequestList, ErrorResult& aRv)
+              nsTArray<RefPtr<Request>>&& aRequestList,
+              CallerType aCallerType, ErrorResult& aRv)
 {
   MOZ_DIAGNOSTIC_ASSERT(mActor);
 
@@ -605,7 +607,7 @@ Cache::AddAll(const GlobalObject& aGlobal,
     RequestOrUSVString requestOrString;
     requestOrString.SetAsRequest() = aRequestList[i];
     RefPtr<Promise> fetch = FetchRequest(mGlobal, requestOrString,
-                                           RequestInit(), aRv);
+                                         RequestInit(), aCallerType, aRv);
     if (NS_WARN_IF(aRv.Failed())) {
       return nullptr;
     }

dom/cache/Cache.h

@@ -28,6 +28,7 @@ class RequestOrUSVString;
 class Response;
 template<typename T> class Optional;
 template<typename T> class Sequence;
+enum class CallerType : uint32_t;
 
 namespace cache {
 
@@ -50,10 +51,11 @@ public:
            const CacheQueryOptions& aOptions, ErrorResult& aRv);
   already_AddRefed<Promise>
   Add(JSContext* aContext, const RequestOrUSVString& aRequest,
-      ErrorResult& aRv);
+      CallerType aCallerType, ErrorResult& aRv);
   already_AddRefed<Promise>
   AddAll(JSContext* aContext,
-         const Sequence<OwningRequestOrUSVString>& aRequests, ErrorResult& aRv);
+         const Sequence<OwningRequestOrUSVString>& aRequests,
+         CallerType aCallerType, ErrorResult& aRv);
   already_AddRefed<Promise>
   Put(JSContext* aCx, const RequestOrUSVString& aRequest, Response& aResponse,
       ErrorResult& aRv);
@@ -97,7 +99,7 @@ private:
 
   already_AddRefed<Promise>
   AddAll(const GlobalObject& aGlobal, nsTArray<RefPtr<Request>>&& aRequestList,
-         ErrorResult& aRv);
+         CallerType aCallerType, ErrorResult& aRv);
 
   already_AddRefed<Promise>
   PutAll(JSContext* aCx, const nsTArray<RefPtr<Request>>& aRequestList,

dom/canvas/CanvasRenderingContext2D.cpp

@@ -4356,6 +4356,9 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
     textToDraw.Truncate();
   }
 
+  // This is only needed to know if we can know the drawing bounding box easily.
+  const bool doCalculateBounds = NeedToCalculateBounds();
+  
   // for now, default to ltr if not in doc
   bool isRTL = false;
 
@@ -4376,8 +4379,6 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
     isRTL = GET_BIDI_OPTION_DIRECTION(document->GetBidiOptions()) == IBMBIDI_TEXTDIRECTION_RTL;
   }
 
-  // This is only needed to know if we can know the drawing bounding box easily.
-  const bool doCalculateBounds = NeedToCalculateBounds();
   if (presShell->IsDestroying()) {
     return NS_ERROR_FAILURE;
   }

dom/canvas/CanvasRenderingContext2D.h

@@ -890,7 +890,9 @@ protected:
    * last call to UpdateFilter and now.
    */
   const gfx::FilterDescription& EnsureUpdatedFilter() {
-    bool isWriteOnly = mCanvasElement && mCanvasElement->IsWriteOnly();
+    bool isWriteOnly = IsWriteOnly() ||
+                       (mCanvasElement && mCanvasElement->IsWriteOnly()) ||
+                       (mOffscreenCanvas && mOffscreenCanvas->IsWriteOnly());
     if (CurrentState().filterSourceGraphicTainted != isWriteOnly) {
       UpdateFilter();
       EnsureTarget();

dom/console/Console.cpp

@@ -753,6 +753,7 @@ private:
     }
 
     Sequence<JS::Value> arguments;
+    SequenceRooter<JS::Value> rooter(aCx, &arguments);
 
     for (uint32_t i = 0; i < length; ++i) {
       JS::Rooted<JS::Value> value(aCx);

dom/crypto/WebCryptoTask.cpp

@@ -1118,6 +1118,11 @@ public:
       }
 
       mSaltLength = params.mSaltLength;
+      // Reject absurdly large salt values.
+      if (mSaltLength > 8192) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
     } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_ECDSA)) {
       mAlgorithm = Algorithm::ECDSA;
       CHECK_KEY_ALGORITHM(aKey.Algorithm(), WEBCRYPTO_ALG_ECDSA);

dom/events/EventListenerManager.cpp

@@ -1632,8 +1632,12 @@ EventListenerManager::GetTypedEventHandler(nsIAtom* aEventName,
 
   JSEventHandler* jsEventHandler = listener->GetJSEventHandler();
 
+  Maybe<RefPtr<JSEventHandler>> pin;
   if (listener->mHandlerIsString) {
-    CompileEventHandlerInternal(listener, nullptr, nullptr);
+    pin.emplace(jsEventHandler);
+    if (NS_FAILED(CompileEventHandlerInternal(listener, nullptr, nullptr))) {
+      listener = nullptr;
+    }
   }
 
   const TypedEventHandler& typedHandler =

dom/fetch/Fetch.cpp

@@ -21,6 +21,7 @@
 #include "nsProxyRelease.h"
 
 #include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/BodyUtil.h"
 #include "mozilla/dom/DOMError.h"
 #include "mozilla/dom/Exceptions.h"
@@ -317,7 +318,7 @@ public:
 
 already_AddRefed<Promise>
 FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
-             const RequestInit& aInit, ErrorResult& aRv)
+             const RequestInit& aInit, CallerType aCallerType, ErrorResult& aRv)
 {
   RefPtr<Promise> p = Promise::Create(aGlobal, aRv);
   if (NS_WARN_IF(aRv.Failed())) {
@@ -325,12 +326,10 @@ FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
   }
 
   // Double check that we have chrome privileges if the Request's content
-  // policy type has been overridden.  Note, we must do this before
-  // entering the global below.  Otherwise the IsCallerChrome() will
-  // always fail.
+  // policy type has been overridden.
   MOZ_ASSERT_IF(aInput.IsRequest() &&
                 aInput.GetAsRequest().IsContentPolicyTypeOverridden(),
-                nsContentUtils::IsCallerChrome());
+                aCallerType == CallerType::System);
 
   AutoJSAPI jsapi;
   if (!jsapi.Init(aGlobal)) {

dom/fetch/Fetch.h

@@ -35,6 +35,7 @@ class InternalRequest;
 class OwningBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString;
 struct ReadableStream;
 class RequestOrUSVString;
+enum class CallerType : uint32_t;
 
 namespace workers {
 class WorkerPrivate;
@@ -42,7 +43,8 @@ class WorkerPrivate;
 
 already_AddRefed<Promise>
 FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
-             const RequestInit& aInit, ErrorResult& aRv);
+             const RequestInit& aInit, CallerType aCallerType,
+             ErrorResult& aRv);
 
 nsresult
 UpdateRequestReferrer(nsIGlobalObject* aGlobal, InternalRequest* aRequest);

dom/html/HTMLAllCollection.cpp

@@ -162,42 +162,7 @@ HTMLAllCollection::NamedGetter(const nsAString& aID,
 void
 HTMLAllCollection::GetSupportedNames(nsTArray<nsString>& aNames)
 {
-  // XXXbz this is very similar to nsContentList::GetSupportedNames,
-  // but has to check IsAllNamedElement for the name case.
-  AutoTArray<nsIAtom*, 8> atoms;
-  for (uint32_t i = 0; i < Length(); ++i) {
-    nsIContent *content = Item(i);
-    if (content->HasID()) {
-      nsIAtom* id = content->GetID();
-      MOZ_ASSERT(id != nsGkAtoms::_empty,
-                 "Empty ids don't get atomized");
-      if (!atoms.Contains(id)) {
-        atoms.AppendElement(id);
-      }
-    }
-
-    nsGenericHTMLElement* el = nsGenericHTMLElement::FromContent(content);
-    if (el) {
-      // Note: nsINode::HasName means the name is exposed on the document,
-      // which is false for options, so we don't check it here.
-      const nsAttrValue* val = el->GetParsedAttr(nsGkAtoms::name);
-      if (val && val->Type() == nsAttrValue::eAtom &&
-          IsAllNamedElement(content)) {
-        nsIAtom* name = val->GetAtomValue();
-        MOZ_ASSERT(name != nsGkAtoms::_empty,
-                   "Empty names don't get atomized");
-        if (!atoms.Contains(name)) {
-          atoms.AppendElement(name);
-        }
-      }
-    }
-  }
-
-  uint32_t atomsLen = atoms.Length();
-  nsString* names = aNames.AppendElements(atomsLen);
-  for (uint32_t i = 0; i < atomsLen; ++i) {
-    atoms[i]->ToString(names[i]);
-  }
+  Collection()->GetSupportedNames(aNames, IsAllNamedElement);
 }
 
 

dom/html/HTMLInputElement.cpp

@@ -3590,7 +3590,7 @@ HTMLInputElement::Blur(ErrorResult& aError)
 } 
 
 void
-HTMLInputElement::Focus(ErrorResult& aError)
+HTMLInputElement::Focus(const FocusOptions& aOptions, ErrorResult& aError)
 {
   if (mType == NS_FORM_INPUT_NUMBER) {
     // Focus our anonymous text control, if we have one.
@@ -3600,7 +3600,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
       RefPtr<HTMLInputElement> textControl =
         numberControlFrame->GetAnonTextControl();
       if (textControl) {
-        textControl->Focus(aError);
+        textControl->Focus(aOptions, aError);
         return;
       }
     }
@@ -3616,7 +3616,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
   }
 
   if (mType != NS_FORM_INPUT_FILE) {
-    nsGenericHTMLElement::Focus(aError);
+    nsGenericHTMLElement::Focus(aOptions, aError);
     return;
   }
 

dom/html/HTMLInputElement.h

@@ -134,7 +134,8 @@ public:
   virtual int32_t TabIndexDefault() override;
   using nsGenericHTMLElement::Focus;
   virtual void Blur(ErrorResult& aError) override;
-  virtual void Focus(ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   // nsINode
 #if !defined(XP_MACOSX)

dom/html/HTMLLabelElement.cpp

@@ -93,14 +93,15 @@ HTMLLabelElement::GetForm() const
 }
 
 void
-HTMLLabelElement::Focus(ErrorResult& aError)
+HTMLLabelElement::Focus(const FocusOptions& aOptions,
+                        ErrorResult& aError)
 {
   // retarget the focus method at the for content
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
   if (fm) {
     nsCOMPtr<nsIDOMElement> elem = do_QueryObject(GetLabeledElement());
     if (elem)
-      fm->SetFocus(elem, 0);
+      fm->SetFocus(elem, nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions));
   }
 }
 

dom/html/HTMLLabelElement.h

@@ -56,7 +56,8 @@ public:
   }
 
   using nsGenericHTMLElement::Focus;
-  virtual void Focus(mozilla::ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   virtual bool IsDisabled() const override { return false; }
 

dom/html/HTMLLegendElement.cpp

@@ -86,7 +86,8 @@ HTMLLegendElement::UnbindFromTree(bool aDeep, bool aNullParent)
 }
 
 void
-HTMLLegendElement::Focus(ErrorResult& aError)
+HTMLLegendElement::Focus(const FocusOptions& aOptions,
+                         ErrorResult& aError)
 {
   nsIFrame* frame = GetPrimaryFrame();
   if (!frame) {
@@ -95,7 +96,7 @@ HTMLLegendElement::Focus(ErrorResult& aError)
 
   int32_t tabIndex;
   if (frame->IsFocusable(&tabIndex, false)) {
-    nsGenericHTMLElement::Focus(aError);
+    nsGenericHTMLElement::Focus(aOptions, aError);
     return;
   }
 
@@ -108,7 +109,8 @@ HTMLLegendElement::Focus(ErrorResult& aError)
 
   nsCOMPtr<nsIDOMElement> result;
   aError = fm->MoveFocus(nullptr, this, nsIFocusManager::MOVEFOCUS_FORWARD,
-                         nsIFocusManager::FLAG_NOPARENTFRAME,
+                         nsIFocusManager::FLAG_NOPARENTFRAME |
+                         nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions),
                          getter_AddRefs(result));
 }
 
@@ -116,9 +118,10 @@ bool
 HTMLLegendElement::PerformAccesskey(bool aKeyCausesActivation,
                                     bool aIsTrustedEvent)
 {
-  // just use the same behaviour as the focus method
+  FocusOptions options;
   ErrorResult rv;
-  Focus(rv);
+
+  Focus(options, rv);
   return NS_SUCCEEDED(rv.StealNSResult());
 }
 

dom/html/HTMLLegendElement.h

@@ -24,7 +24,8 @@ public:
   NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLLegendElement, legend)
 
   using nsGenericHTMLElement::Focus;
-  virtual void Focus(ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   virtual bool PerformAccesskey(bool aKeyCausesActivation,
                                 bool aIsTrustedEvent) override;

dom/html/TextTrackManager.cpp

@@ -211,6 +211,7 @@ TextTrackManager::AddCues(TextTrack* aTextTrack)
     for (uint32_t i = 0; i < cueList->Length(); ++i) {
       mNewCues->AddCue(*cueList->IndexedGetter(i, dummy));
     }
+    RefPtr<TextTrackManager> kungFuDeathGrip(this);
     DispatchTimeMarchesOn();
   }
 }
@@ -236,6 +237,7 @@ TextTrackManager::RemoveTextTrack(TextTrack* aTextTrack, bool aPendingListOnly)
     for (uint32_t i = 0; i < removeCueList->Length(); ++i) {
       mNewCues->RemoveCue(*((*removeCueList)[i]));
     }
+    RefPtr<TextTrackManager> kungFuDeathGrip(this);
     DispatchTimeMarchesOn();
   }
 }
@@ -305,6 +307,7 @@ TextTrackManager::NotifyCueAdded(TextTrackCue& aCue)
   if (mNewCues) {
     mNewCues->AddCue(aCue);
   }
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
 }
 
@@ -315,6 +318,7 @@ TextTrackManager::NotifyCueRemoved(TextTrackCue& aCue)
   if (mNewCues) {
     mNewCues->RemoveCue(aCue);
   }
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
   if (aCue.GetActive()) {
     // We remove an active cue, need to update the display.
@@ -824,6 +828,7 @@ TextTrackManager::NotifyCueUpdated(TextTrackCue *aCue)
 {
   // TODO: Add/Reorder the cue to mNewCues if we have some optimization?
   WEBVTT_LOG("NotifyCueUpdated");
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
 }
 

dom/html/nsGenericHTMLElement.cpp

@@ -150,8 +150,9 @@ public:
     // If something is focused in the same document, ignore autofocus.
     if (!fm->GetFocusedContent() ||
         fm->GetFocusedContent()->OwnerDoc() != document) {
-      mozilla::ErrorResult rv;
-      mElement->Focus(rv);
+      FocusOptions options;
+      ErrorResult rv;
+      mElement->Focus(options, rv);
       return rv.StealNSResult();
     }
 

dom/html/nsGenericHTMLElement.h

@@ -434,8 +434,9 @@ public:
     return rv.StealNSResult();
   }
   NS_IMETHOD Focus() final override {
+    mozilla::dom::FocusOptions options;
     mozilla::ErrorResult rv;
-    Focus(rv);
+    Focus(options, rv);
     return rv.StealNSResult();
   }
   NS_IMETHOD GetDraggable(bool* aDraggable) final override {

dom/mathml/MathMLElement.cpp

@@ -4,10 +4,12 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "nsMathMLElement.h"
+#include "mozilla/dom/MathMLElement.h"
+
 #include "base/compiler_specific.h"
 #include "mozilla/ArrayUtils.h"
 #include "nsGkAtoms.h"
+#include "nsIContentInlines.h"
 #include "nsITableCellLayout.h" // for MAX_COLSPAN / MAX_ROWSPAN
 #include "nsCRT.h"
 #include "nsLayoutStylesheetCache.h"
@@ -26,7 +28,8 @@
 
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/EventStates.h"
-#include "mozilla/dom/ElementBinding.h"
+#include "mozilla/EventListenerManager.h" // for EventListenerManager
+#include "mozilla/dom/MathMLElementBinding.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -34,7 +37,7 @@ using namespace mozilla::dom;
 //----------------------------------------------------------------------
 // nsISupports methods:
 
-NS_IMPL_ISUPPORTS_INHERITED(nsMathMLElement, nsMathMLElementBase,
+NS_IMPL_ISUPPORTS_INHERITED(MathMLElement, MathMLElementBase,
                             nsIDOMElement, nsIDOMNode, Link)
 
 static nsresult
@@ -75,28 +78,28 @@ ReportParseErrorNoTag(const nsString& aValue,
                          "AttributeParsingErrorNoTag", argv, 2);
 }
 
-nsMathMLElement::nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-: nsMathMLElementBase(aNodeInfo),
+MathMLElement::MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+: MathMLElementBase(aNodeInfo),
   ALLOW_THIS_IN_INITIALIZER_LIST(Link(this)),
   mIncrementScriptLevel(false)
 {
 }
 
-nsMathMLElement::nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
-: nsMathMLElementBase(aNodeInfo),
+MathMLElement::MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
+: MathMLElementBase(aNodeInfo),
   ALLOW_THIS_IN_INITIALIZER_LIST(Link(this)),
   mIncrementScriptLevel(false)
 {
 }
 
 nsresult
-nsMathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
-                            nsIContent* aBindingParent,
-                            bool aCompileEventHandlers)
+MathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                          nsIContent* aBindingParent,
+                          bool aCompileEventHandlers)
 {
   Link::ResetLinkState(false, Link::ElementHasHref());
 
-  nsresult rv = nsMathMLElementBase::BindToTree(aDocument, aParent,
+  nsresult rv = MathMLElementBase::BindToTree(aDocument, aParent,
                                                 aBindingParent,
                                                 aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -130,7 +133,7 @@ nsMathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
 }
 
 void
-nsMathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
+MathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
@@ -141,14 +144,14 @@ nsMathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
     doc->UnregisterPendingLinkUpdate(this);
   }
 
-  nsMathMLElementBase::UnbindFromTree(aDeep, aNullParent);
+  MathMLElementBase::UnbindFromTree(aDeep, aNullParent);
 }
 
 bool
-nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult)
+MathMLElement::ParseAttribute(int32_t aNamespaceID,
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult)
 {
   MOZ_ASSERT(IsMathMLElement());
   if (aNamespaceID == kNameSpaceID_None) {
@@ -166,6 +169,9 @@ nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
         aAttribute == nsGkAtoms::mathbackground_) {
       return aResult.ParseColor(aValue);
     }
+    if (aAttribute == nsGkAtoms::tabindex) {
+      return aResult.ParseIntValue(aValue);
+    }
     if (mNodeInfo->Equals(nsGkAtoms::mtd_)) {
       if (aAttribute == nsGkAtoms::columnspan_) {
         aResult.ParseClampedNonNegativeInt(aValue, 1, 1, MAX_COLSPAN);
@@ -178,8 +184,8 @@ nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
     }
   }
 
-  return nsMathMLElementBase::ParseAttribute(aNamespaceID, aAttribute,
-                                             aValue, aResult);
+  return MathMLElementBase::ParseAttribute(aNamespaceID, aAttribute,
+                                           aValue, aResult);
 }
 
 static Element::MappedAttributeEntry sMtableStyles[] = {
@@ -218,7 +224,7 @@ static Element::MappedAttributeEntry sDirStyles[] = {
 };
 
 bool
-nsMathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
+MathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 {
   MOZ_ASSERT(IsMathMLElement());
 
@@ -287,7 +293,7 @@ nsMathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 }
 
 nsMapRuleToAttributesFunc
-nsMathMLElement::GetAttributeMappingFunction() const
+MathMLElement::GetAttributeMappingFunction() const
 {
   // It doesn't really matter what our tag is here, because only attributes
   // that satisfy IsAttributeMapped will be stored in the mapped attributes
@@ -296,9 +302,9 @@ nsMathMLElement::GetAttributeMappingFunction() const
 }
 
 /* static */ bool
-nsMathMLElement::ParseNamedSpaceValue(const nsString& aString,
-                                      nsCSSValue&     aCSSValue,
-                                      uint32_t        aFlags)
+MathMLElement::ParseNamedSpaceValue(const nsString& aString,
+                                    nsCSSValue&     aCSSValue,
+                                    uint32_t        aFlags)
 {
    int32_t i = 0;
    // See if it is one of the 'namedspace' (ranging -7/18em, -6/18, ... 7/18em)
@@ -378,10 +384,10 @@ nsMathMLElement::ParseNamedSpaceValue(const nsString& aString,
 //   number)"
 //
 /* static */ bool
-nsMathMLElement::ParseNumericValue(const nsString& aString,
-                                   nsCSSValue&     aCSSValue,
-                                   uint32_t        aFlags,
-                                   nsIDocument*    aDocument)
+MathMLElement::ParseNumericValue(const nsString& aString,
+                                 nsCSSValue&     aCSSValue,
+                                 uint32_t        aFlags,
+                                 nsIDocument*    aDocument)
 {
   nsAutoString str(aString);
   str.CompressWhitespace(); // aString is const in this code...
@@ -429,6 +435,13 @@ nsMathMLElement::ParseNumericValue(const nsString& aString,
     number.Append(c);
   }
 
+  if (gotDot && str[i - 1] == '.') {
+    if (!(aFlags & PARSE_SUPPRESS_WARNINGS)) {
+      ReportLengthParseError(aString, aDocument);
+    }
+    return false;  // Number ending with a dot.
+  }
+
   // Convert number to floating point
   nsresult errorCode;
   float floatValue = number.ToFloat(&errorCode);
@@ -499,8 +512,8 @@ nsMathMLElement::ParseNumericValue(const nsString& aString,
 }
 
 void
-nsMathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
-                                         nsRuleData* aData)
+MathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
+                                       nsRuleData* aData)
 {
   if (aData->mSIDs & NS_STYLE_INHERIT_BIT(Font)) {
     // scriptsizemultiplier
@@ -918,7 +931,7 @@ nsMathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
 }
 
 nsresult
-nsMathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
+MathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 {
   nsresult rv = Element::GetEventTargetParent(aVisitor);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -927,30 +940,30 @@ nsMathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 }
 
 nsresult
-nsMathMLElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
+MathMLElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 {
   return PostHandleEventForLinks(aVisitor);
 }
 
-NS_IMPL_ELEMENT_CLONE(nsMathMLElement)
+NS_IMPL_ELEMENT_CLONE(MathMLElement)
 
 EventStates
-nsMathMLElement::IntrinsicState() const
+MathMLElement::IntrinsicState() const
 {
-  return Link::LinkState() | nsMathMLElementBase::IntrinsicState() |
+  return Link::LinkState() | MathMLElementBase::IntrinsicState() |
     (mIncrementScriptLevel ?
        NS_EVENT_STATE_INCREMENT_SCRIPT_LEVEL : EventStates());
 }
 
 bool
-nsMathMLElement::IsNodeOfType(uint32_t aFlags) const
+MathMLElement::IsNodeOfType(uint32_t aFlags) const
 {
   return !(aFlags & ~eCONTENT);
 }
 
 void
-nsMathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
-                                         bool aNotify)
+MathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
+                                       bool aNotify)
 {
   if (aIncrementScriptLevel == mIncrementScriptLevel)
     return;
@@ -961,26 +974,55 @@ nsMathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
   UpdateState(true);
 }
 
-bool
-nsMathMLElement::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
+int32_t
+MathMLElement::TabIndexDefault()
 {
   nsCOMPtr<nsIURI> uri;
-  if (IsLink(getter_AddRefs(uri))) {
+  return IsLink(getter_AddRefs(uri)) ? 0 : -1;
+}
+
+// XXX Bug 1586011: Share logic with other element classes.
+bool
+MathMLElement::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
+{
+  nsIDocument* doc = GetComposedDoc();
+  if (!doc || doc->HasFlag(NODE_IS_EDITABLE)) {
+    // In designMode documents we only allow focusing the document.
     if (aTabIndex) {
-      *aTabIndex = ((sTabFocusModel & eTabFocus_linksMask) == 0 ? -1 : 0);
+      *aTabIndex = -1;
     }
-    return true;
+    return false;
   }
 
+  int32_t tabIndex = TabIndex();
   if (aTabIndex) {
+    *aTabIndex = tabIndex;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  if (!IsLink(getter_AddRefs(uri))) {
+    // If a tabindex is specified at all we're focusable
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::tabindex);
+  }
+
+  // Links that are in an editable region should never be focusable, even if
+  // they are in a contenteditable="false" region.
+  if (nsContentUtils::IsNodeInEditableRegion(this)) {
+    if (aTabIndex) {
+      *aTabIndex = -1;
+    }
+    return false;
+  }
+
+  if (aTabIndex && (sTabFocusModel & eTabFocus_linksMask) == 0) {
     *aTabIndex = -1;
   }
 
-  return false;
+  return true;
 }
 
 bool
-nsMathMLElement::IsLink(nsIURI** aURI) const
+MathMLElement::IsLink(nsIURI** aURI) const
 {
   // http://www.w3.org/TR/2010/REC-MathML3-20101021/chapter6.html#interf.link
   // The REC says that the following elements should not be linking elements:
@@ -1051,7 +1093,7 @@ nsMathMLElement::IsLink(nsIURI** aURI) const
 }
 
 void
-nsMathMLElement::GetLinkTarget(nsAString& aTarget)
+MathMLElement::GetLinkTarget(nsAString& aTarget)
 {
   const nsAttrValue* target = mAttrsAndChildren.GetAttr(nsGkAtoms::target,
                                                         kNameSpaceID_XLink);
@@ -1077,14 +1119,59 @@ nsMathMLElement::GetLinkTarget(nsAString& aTarget)
 }
 
 already_AddRefed<nsIURI>
-nsMathMLElement::GetHrefURI() const
+MathMLElement::GetHrefURI() const
 {
   nsCOMPtr<nsIURI> hrefURI;
   return IsLink(getter_AddRefs(hrefURI)) ? hrefURI.forget() : nullptr;
 }
 
+// XXX Bug 1586014: Share logic with other element classes.
+void
+MathMLElement::RecompileScriptEventListeners() {
+  int32_t i, count = mAttrsAndChildren.AttrCount();
+  for (i = 0; i < count; ++i) {
+    const nsAttrName* name = mAttrsAndChildren.AttrNameAt(i);
+
+    // Eventlistenener-attributes are always in the null namespace
+    if (!name->IsAtom()) {
+      continue;
+    }
+
+    nsIAtom* attr = name->Atom();
+    if (!IsEventAttributeName(attr)) {
+      continue;
+    }
+
+    nsAutoString value;
+    GetAttr(kNameSpaceID_None, attr, value);
+    SetEventHandler(attr, value, true);
+  }
+}
+
+bool
+MathMLElement::IsEventAttributeNameInternal(nsIAtom* aName) {
+  // The intent is to align MathML event attributes on HTML5, so the flag
+  // EventNameType_HTML is used here.
+  return nsContentUtils::IsEventAttributeName(aName, EventNameType_HTML);
+}
+
 nsresult
-nsMathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+MathMLElement::BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+                             const nsAttrValueOrString* aValue,
+                             bool aNotify) {
+  if (aNamespaceID == kNameSpaceID_None) {
+    if (!aValue && IsEventAttributeName(aName)) {
+      if (EventListenerManager* manager = GetExistingListenerManager()) {
+        manager->RemoveEventHandler(aName, EmptyString());
+      }
+    }
+  }
+
+  return MathMLElementBase::BeforeSetAttr(aNamespaceID, aName, aValue, aNotify);
+}
+
+nsresult
+MathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                               const nsAttrValue* aValue,
                               const nsAttrValue* aOldValue,
                               nsIPrincipal* aSubjectPrincipal,
@@ -1105,13 +1192,22 @@ nsMathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
     Link::ResetLinkState(aNotify, aValue || Link::ElementHasHref());
   }
 
-  return nsMathMLElementBase::AfterSetAttr(aNameSpaceID, aName, aValue,
-                                           aOldValue, aSubjectPrincipal,
-                                           aNotify);
+  if (aNameSpaceID == kNameSpaceID_None) {
+    if (IsEventAttributeName(aName) && aValue) {
+      MOZ_ASSERT(aValue->Type() == nsAttrValue::eString,
+                 "Expected string value for script body");
+      nsresult rv = SetEventHandler(aName, aValue->GetStringValue());
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+  }
+
+  return MathMLElementBase::AfterSetAttr(aNameSpaceID, aName, aValue,
+                                         aOldValue, aSubjectPrincipal,
+                                         aNotify);
 }
 
 JSObject*
-nsMathMLElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
+MathMLElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
-  return ElementBinding::Wrap(aCx, this, aGivenProto);
+  return MathMLElementBinding::Wrap(aCx, this, aGivenProto);
 }

dom/mathml/MathMLElement.h

@@ -3,8 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef nsMathMLElement_h
-#define nsMathMLElement_h
+#ifndef mozilla_dom_MathMLElement_h_
+#define mozilla_dom_MathMLElement_h_
 
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/ElementInlines.h"
@@ -15,28 +15,30 @@
 
 class nsCSSValue;
 
-typedef nsMappedAttributeElement nsMathMLElementBase;
-
 namespace mozilla {
 class EventChainPostVisitor;
 class EventChainPreVisitor;
-} // namespace mozilla
+namespace dom {
+
+typedef nsMappedAttributeElement MathMLElementBase;
 
 /*
  * The base class for MathML elements.
  */
-class nsMathMLElement final : public nsMathMLElementBase,
-                              public nsIDOMElement,
-                              public mozilla::dom::Link
+class MathMLElement final : public MathMLElementBase,
+                            public nsIDOMElement,
+                            public mozilla::dom::Link
 {
 public:
-  explicit nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
-  explicit nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
+  explicit MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-  // Implementation of nsISupports is inherited from nsMathMLElementBase
+  // Implementation of nsISupports is inherited from MathMLElementBase
   NS_DECL_ISUPPORTS_INHERITED
 
-  // Forward implementations of parent interfaces of nsMathMLElement to 
+  NS_IMPL_FROMCONTENT(MathMLElement, kNameSpaceID_MathML)
+
+  // Forward implementations of parent interfaces of MathMLElement to 
   // our base class
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
@@ -88,6 +90,7 @@ public:
     return mIncrementScriptLevel;
   }
 
+  int32_t TabIndexDefault() final;
   virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse) override;
   virtual bool IsLink(nsIURI** aURI) const override;
   virtual void GetLinkTarget(nsAString& aTarget) override;
@@ -95,11 +98,16 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() override { return this; }
 
+  void RecompileScriptEventListeners() override;
+  bool IsEventAttributeNameInternal(nsIAtom* aName);
+
 protected:
-  virtual ~nsMathMLElement() {}
+  virtual ~MathMLElement() {}
 
   virtual JSObject* WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) override;
 
+  nsresult BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+                         const nsAttrValueOrString* aValue, bool aNotify) override;
   virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
@@ -110,4 +118,7 @@ private:
   bool mIncrementScriptLevel;
 };
 
-#endif // nsMathMLElement_h
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // mozilla_dom_MathMLElement_h_

dom/mathml/MathMLElementFactory.cpp

@@ -5,7 +5,7 @@
 
 #include "nsContentCreatorFunctions.h"
 #include "nsGkAtoms.h"
-#include "nsMathMLElement.h"
+#include "mozilla/dom/MathMLElement.h"
 
 using namespace mozilla::dom;
 
@@ -13,6 +13,6 @@ using namespace mozilla::dom;
 nsresult
 NS_NewMathMLElement(Element** aResult, already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
 {
-  NS_ADDREF(*aResult = new nsMathMLElement(aNodeInfo));
+  NS_ADDREF(*aResult = new MathMLElement(aNodeInfo));
   return NS_OK;
 }

dom/mathml/moz.build

@@ -3,9 +3,13 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+EXPORTS.mozilla.dom += [
+    'MathMLElement.h',
+]
+
 UNIFIED_SOURCES += [
-    'nsMathMLElement.cpp',
-    'nsMathMLElementFactory.cpp',
+    'MathMLElement.cpp',
+    'MathMLElementFactory.cpp',
 ]
 
 include('/ipc/chromium/chromium-config.mozbuild')

dom/media/AudioChannelFormat.h

@@ -105,6 +105,8 @@ gDownMixMatrices[CUSTOM_CHANNEL_LAYOUTS*(CUSTOM_CHANNEL_LAYOUTS - 1)/2] =
  * Given an array of input channels, downmix to aOutputChannelCount, and copy
  * the results to the channel buffers in aOutputChannels.  Don't call this with
  * input count <= output count.
+ * Each of aOutputChannels must be non-null.
+ * aChannelArray elements may be null.
  */
 template<typename T>
 void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
@@ -119,7 +121,11 @@ void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
   if (inputChannelCount > 6) {
     // Just drop the unknown channels.
     for (uint32_t o = 0; o < aOutputChannelCount; ++o) {
-      PodCopy(aOutputChannels[o], inputChannels[o], aDuration);
+      if (inputChannels[o]) {
+        PodCopy(aOutputChannels[o], inputChannels[o], aDuration);
+      } else {
+        std::fill_n(aOutputChannels[o], aDuration, static_cast<T>(0));
+      }
     }
     return;
   }
@@ -138,13 +144,19 @@ void AudioChannelsDownMix(const nsTArray<const T*>& aChannelArray,
     // want an input channel to contribute to nothing
     T outputChannels[CUSTOM_CHANNEL_LAYOUTS + 1] = {0};
     for (uint32_t c = 0; c < inputChannelCount; ++c) {
-      outputChannels[m.mInputDestination[c]] +=
-        m.mInputCoefficient[c]*(static_cast<const T*>(inputChannels[c]))[s];
+      if (inputChannels[c]) {
+        outputChannels[m.mInputDestination[c]] +=
+            m.mInputCoefficient[c] *
+            (static_cast<const T*>(inputChannels[c]))[s];
+      }
     }
     // Utilize the fact that in every layout, C is the third channel.
     if (m.mCExtraDestination != IGNORE) {
-      outputChannels[m.mCExtraDestination] +=
-        m.mInputCoefficient[SURROUND_C]*(static_cast<const T*>(inputChannels[SURROUND_C]))[s];
+      if (inputChannels[SURROUND_C]) {
+        outputChannels[m.mCExtraDestination] +=
+            m.mInputCoefficient[SURROUND_C] *
+            (static_cast<const T*>(inputChannels[SURROUND_C]))[s];
+      }
     }
 
     for (uint32_t c = 0; c < aOutputChannelCount; ++c) {

dom/media/AudioSegment.cpp

@@ -121,13 +121,19 @@ AudioSegment::Mix(AudioMixer& aMixer, uint32_t aOutputChannels,
       }
       if (channelData.Length() < aOutputChannels) {
         // Up-mix.
-        AudioChannelsUpMix(&channelData, aOutputChannels, SilentChannel::ZeroChannel<AudioDataValue>());
+        AudioChannelsUpMix(&channelData, aOutputChannels, static_cast<const AudioDataValue*>(nullptr));
         for (uint32_t channel = 0; channel < aOutputChannels; channel++) {
           AudioDataValue* ptr =
             PointerForOffsetInChannel(buf.Elements(), outBufferLength,
                                       aOutputChannels, channel, offsetSamples);
-          PodCopy(ptr, reinterpret_cast<const AudioDataValue*>(channelData[channel]),
-                  frames);
+          if (channelData[channel]) {
+            PodCopy(
+                ptr,
+                reinterpret_cast<const AudioDataValue*>(channelData[channel]),
+                frames);
+          } else {
+            PodZero(ptr, frames);
+          }
         }
         MOZ_ASSERT(channelData.Length() == aOutputChannels);
       } else if (channelData.Length() > aOutputChannels) {

dom/media/AudioSegment.h

@@ -61,15 +61,22 @@ template <typename SrcT, typename DestT>
 static void
 InterleaveAndConvertBuffer(const SrcT* const* aSourceChannels,
                            uint32_t aLength, float aVolume,
-                           uint32_t aChannels,
+                           uint32_t aChannelCount,
                            DestT* aOutput)
 {
-  DestT* output = aOutput;
-  for (size_t i = 0; i < aLength; ++i) {
-    for (size_t channel = 0; channel < aChannels; ++channel) {
-      float v = AudioSampleToFloat(aSourceChannels[channel][i])*aVolume;
-      *output = FloatToAudioSample<DestT>(v);
-      ++output;
+  for (size_t channel = 0; channel < aChannelCount; ++channel) {
+    DestT* output = aOutput;
+    if (aSourceChannels[channel]) {
+      for (size_t i = 0; i < aLength; ++i) {
+        float v = AudioSampleToFloat(aSourceChannels[channel][i])*aVolume;
+        *output = FloatToAudioSample<DestT>(v);
+        output += aChannelCount;
+      }
+    } else {
+      for (size_t i = 0; i < aLength; ++i) {
+        *output = static_cast<DestT>(0);
+        output += aChannelCount;
+      }
     }
   }
 }
@@ -408,7 +415,7 @@ void WriteChunk(AudioChunk& aChunk,
   if (channelData.Length() < aOutputChannels) {
     // Up-mix. Note that this might actually make channelData have more
     // than aOutputChannels temporarily.
-    AudioChannelsUpMix(&channelData, aOutputChannels, SilentChannel::ZeroChannel<SrcT>());
+    AudioChannelsUpMix(&channelData, aOutputChannels, static_cast<const SrcT*>(nullptr));
   }
   if (channelData.Length() > aOutputChannels) {
     // Down-mix.

dom/media/MediaResource.cpp

@@ -1547,26 +1547,29 @@ void BaseMediaResource::SetLoadInBackground(bool aLoadInBackground) {
 
 void BaseMediaResource::ModifyLoadFlags(nsLoadFlags aFlags)
 {
+  RefPtr<BaseMediaResource> kungFuDeathGrip(this);
+  nsCOMPtr<nsIChannel> channel = mChannel;
+
   nsCOMPtr<nsILoadGroup> loadGroup;
-  nsresult rv = mChannel->GetLoadGroup(getter_AddRefs(loadGroup));
+  nsresult rv = channel->GetLoadGroup(getter_AddRefs(loadGroup));
   MOZ_ASSERT(NS_SUCCEEDED(rv), "GetLoadGroup() failed!");
 
   nsresult status;
-  mChannel->GetStatus(&status);
+  channel->GetStatus(&status);
 
   bool inLoadGroup = false;
   if (loadGroup) {
-    rv = loadGroup->RemoveRequest(mChannel, nullptr, status);
+    rv = loadGroup->RemoveRequest(channel, nullptr, status);
     if (NS_SUCCEEDED(rv)) {
       inLoadGroup = true;
     }
   }
 
-  rv = mChannel->SetLoadFlags(aFlags);
+  rv = channel->SetLoadFlags(aFlags);
   MOZ_ASSERT(NS_SUCCEEDED(rv), "SetLoadFlags() failed!");
 
   if (inLoadGroup) {
-    rv = loadGroup->AddRequest(mChannel, nullptr);
+    rv = loadGroup->AddRequest(channel, nullptr);
     MOZ_ASSERT(NS_SUCCEEDED(rv), "AddRequest() failed!");
   }
 }

dom/media/mp3/MP3Demuxer.cpp

@@ -9,6 +9,7 @@
 #include <algorithm>
 
 #include "mozilla/Assertions.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "nsAutoPtr.h"
 #include "VideoUtils.h"
@@ -602,8 +603,12 @@ MP3TrackDemuxer::OffsetFromFrameIndex(int64_t aFrameIndex) const {
   const auto& vbr = mParser.VBRInfo();
 
   if (vbr.IsComplete()) {
-    offset = mFirstFrameOffset + aFrameIndex * vbr.NumBytes().value() /
-             vbr.NumAudioFrames().value();
+    CheckedInt<int64_t> product = CheckedInt<int64_t>(aFrameIndex) * vbr.NumBytes().value();
+    if (product.isValid()) {
+      offset = mFirstFrameOffset + product.value() / vbr.NumAudioFrames().value();
+    } else {
+      offset = StreamLength();
+    }
   } else if (AverageFrameLength() > 0) {
     offset = mFirstFrameOffset + aFrameIndex * AverageFrameLength();
   }

dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp

@@ -67,7 +67,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
   } else if (aFrame->format == AV_SAMPLE_FMT_FLTP) {
     // Planar audio data. Pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    AudioDataValue** data = reinterpret_cast<AudioDataValue**>(aFrame->data);
+    AudioDataValue** data = reinterpret_cast<AudioDataValue**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = data[channel][frame];
@@ -86,7 +86,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
     // Planar audio data. Convert it from S16 to 32 bits float
     // and pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    int16_t** data = reinterpret_cast<int16_t**>(aFrame->data);
+    int16_t** data = reinterpret_cast<int16_t**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = AudioSampleToFloat(data[channel][frame]);
@@ -105,7 +105,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
     // Planar audio data. Convert it from S32 to 32 bits float
     // and pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    int32_t** data = reinterpret_cast<int32_t**>(aFrame->data);
+    int32_t** data = reinterpret_cast<int32_t**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = AudioSampleToFloat(data[channel][frame]);

dom/media/platforms/wmf/WMFVideoMFTManager.cpp

@@ -15,6 +15,7 @@
 #include "DXVA2Manager.h"
 #include "nsThreadUtils.h"
 #include "Layers.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "MediaInfo.h"
@@ -760,6 +761,10 @@ WMFVideoMFTManager::CreateBasicVideoFrame(IMFSample* aSample,
     NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
     stride = mVideoStride;
   }
+  if (stride <= 0) {
+    LOG("CreateBasicVideoFrame: invalid stride %ld", stride);
+    return E_FAIL;
+  }
 
   // YV12, planar format: [YYYY....][VVVV....][UUUU....]
   // i.e., Y, then V, then U.
@@ -782,9 +787,16 @@ WMFVideoMFTManager::CreateBasicVideoFrame(IMFSample* aSample,
   if (videoHeight % 16 != 0) {
     padding = 16 - (videoHeight % 16);
   }
-  uint32_t y_size = stride * (videoHeight + padding);
-  uint32_t v_size = stride * (videoHeight + padding) / 4;
-  uint32_t halfStride = (stride + 1) / 2;
+  mozilla::CheckedInt<uint32_t> y_size_checked =
+      mozilla::CheckedInt<uint32_t>(static_cast<uint32_t>(stride)) *
+      (videoHeight + padding);
+  if (!y_size_checked.isValid()) {
+    LOG("CreateBasicVideoFrame: plane size too large");
+    return E_FAIL;
+  }
+  uint32_t y_size = y_size_checked.value();
+  uint32_t v_size = y_size / 4;
+  uint32_t halfStride = static_cast<uint32_t>((static_cast<int64_t>(stride) + 1) / 2);
   uint32_t halfHeight = (videoHeight + 1) / 2;
   uint32_t halfWidth = (videoWidth + 1) / 2;
 

dom/media/webaudio/AudioBufferSourceNode.cpp

@@ -181,9 +181,13 @@ public:
       if (mResamplerOutRate == aOutRate) {
         return;
       }
-      if (speex_resampler_set_rate(mResampler, mBufferSampleRate, aOutRate) != RESAMPLER_ERR_SUCCESS) {
-        NS_ASSERTION(false, "speex_resampler_set_rate failed");
-        return;
+      int result = speex_resampler_set_rate(mResampler, mBufferSampleRate, aOutRate);
+      if (result != RESAMPLER_ERR_SUCCESS) {
+        WEB_AUDIO_API_LOG("speex_resampler_set_rate failed: %i", result);
+        // mResampler den_rate and num_rate might have been updated, despite
+        // the error, in which case the resampler will output zeros but
+        // still consume input.  Continue below to update mBeginProcessing
+        // for any change in resampler behavior.
       }
     }
 

dom/media/webm/WebMDemuxer.cpp

@@ -751,7 +751,7 @@ WebMDemuxer::GetNextPacket(TrackInfo::TrackType aType, MediaRawDataQueue *aSampl
     WEBM_DEBUG("push sample tstamp: %ld next_tstamp: %ld length: %ld kf: %d",
                tstamp, next_tstamp, length, isKeyframe);
     RefPtr<MediaRawData> sample;
-    if (mInfo.mVideo.HasAlpha() && alphaLength != 0) {
+    if (mInfo.mVideo.HasAlpha() && alphaData != 0) {
       sample = new MediaRawData(data, length, alphaData, alphaLength);
       if (length && !sample->Data() || (alphaLength && !sample->AlphaData())) {
         // OOM.

dom/network/UDPSocket.cpp

@@ -172,6 +172,8 @@ UDPSocket::CloseWithReason(nsresult aReason)
     return;
   }
 
+  RefPtr<UDPSocket> kungFuDeathGrip(this);
+
   if (mOpened) {
     if (mReadyState == SocketReadyState::Opening) {
       // reject openedPromise with AbortError if socket is closed without error

dom/webidl/AbstractWorker.webidl

@@ -4,7 +4,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-[NoInterfaceObject, Exposed=(Window,Worker,System)]
-interface AbstractWorker {
+[Exposed=(Window,Worker)]
+interface mixin AbstractWorker {
     attribute EventHandler onerror;
 };

dom/webidl/AnalyserNode.webidl

@@ -45,4 +45,4 @@ interface AnalyserNode : AudioNode {
 };
 
 // Mozilla extension
-AnalyserNode implements AudioNodePassThrough;
+AnalyserNode includes AudioNodePassThrough;

dom/webidl/Animatable.webidl

@@ -18,8 +18,7 @@ dictionary AnimationFilter {
   boolean subtree = false;
 };
 
-[NoInterfaceObject]
-interface Animatable {
+interface mixin Animatable {
   [Func="nsDocument::IsElementAnimateEnabled", Throws]
   Animation animate(object? keyframes,
                     optional UnrestrictedDoubleOrKeyframeAnimationOptions options);

dom/webidl/AudioBufferSourceNode.webidl

@@ -42,4 +42,4 @@ interface AudioBufferSourceNode : AudioNode {
 };
 
 // Mozilla extensions
-AudioBufferSourceNode implements AudioNodePassThrough;
+AudioBufferSourceNode includes AudioNodePassThrough;

dom/webidl/AudioNode.webidl

@@ -67,8 +67,7 @@ partial interface AudioNode {
   [ChromeOnly]
   readonly attribute unsigned long id;
 };
-[NoInterfaceObject]
-interface AudioNodePassThrough {
+interface mixin AudioNodePassThrough {
   [ChromeOnly]
   attribute boolean passThrough;
 };

dom/webidl/BiquadFilterNode.webidl

@@ -46,5 +46,5 @@ interface BiquadFilterNode : AudioNode {
 };
 
 // Mozilla extension
-BiquadFilterNode implements AudioNodePassThrough;
+BiquadFilterNode includes AudioNodePassThrough;
 

dom/webidl/Blob.webidl

@@ -27,8 +27,8 @@ interface Blob {
   //slice Blob into byte-ranged chunks
 
   [Throws]
-  Blob slice([Clamp] optional long long start,
-             [Clamp] optional long long end,
+  Blob slice(optional [Clamp] long long start,
+             optional [Clamp] long long end,
              optional DOMString contentType = "");
 
   // void close(); TODO bug 1048325

dom/webidl/BrowserElement.webidl

@@ -19,15 +19,7 @@ dictionary BrowserElementExecuteScriptOptions {
   DOMString? origin;
 };
 
-[NoInterfaceObject]
-interface BrowserElement {
-};
-
-BrowserElement implements BrowserElementCommon;
-BrowserElement implements BrowserElementPrivileged;
-
-[NoInterfaceObject]
-interface BrowserElementCommon {
+interface mixin BrowserElementCommon {
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]
@@ -60,7 +52,7 @@ interface BrowserElementCommon {
 };
 
 [NoInterfaceObject]
-interface BrowserElementPrivileged {
+interface BrowserElement {
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]
@@ -176,3 +168,6 @@ interface BrowserElementPrivileged {
   DOMRequest getWebManifest();
 
 };
+
+BrowserElement includes BrowserElementCommon;
+

dom/webidl/BrowserElementAudioChannel.webidl

@@ -29,7 +29,7 @@ interface BrowserElementAudioChannel : EventTarget {
   DOMRequest isActive();
 };
 
-partial interface BrowserElementPrivileged {
+interface mixin BrowserElementPrivileged {
   [Pure, Cached, Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]

dom/webidl/BrowserElementProxy.webidl

@@ -11,5 +11,5 @@
  ChromeOnly]
 interface BrowserElementProxy : EventTarget {
 };
-BrowserElementProxy implements BrowserElementCommon;
-BrowserElementProxy implements BrowserElementPrivileged;
+BrowserElementProxy includes BrowserElementCommon;
+BrowserElementProxy includes BrowserElementPrivileged;

dom/webidl/CSSPseudoElement.webidl

@@ -22,4 +22,4 @@ interface CSSPseudoElement {
 };
 
 // https://w3c.github.io/web-animations/#extensions-to-the-pseudoelement-interface
-CSSPseudoElement implements Animatable;
+CSSPseudoElement includes Animatable;

dom/webidl/CSSStyleDeclaration.webidl

@@ -21,7 +21,7 @@ interface CSSStyleDeclaration {
   CSSValue? getPropertyCSSValue(DOMString property);
   DOMString getPropertyPriority(DOMString property);
   [CEReactions, Throws]
-  void setProperty(DOMString property, [TreatNullAs=EmptyString] DOMString value, [TreatNullAs=EmptyString] optional DOMString priority = "");
+  void setProperty(DOMString property, [TreatNullAs=EmptyString] DOMString value, optional [TreatNullAs=EmptyString] DOMString priority = "");
   [CEReactions, Throws]
   DOMString removeProperty(DOMString property);
 

dom/webidl/Cache.webidl

@@ -17,9 +17,9 @@ interface Cache {
   Promise<Response> match(RequestInfo request, optional CacheQueryOptions options);
   [NewObject]
   Promise<sequence<Response>> matchAll(optional RequestInfo request, optional CacheQueryOptions options);
-  [NewObject]
+  [NewObject, NeedsCallerType]
   Promise<void> add(RequestInfo request);
-  [NewObject]
+  [NewObject, NeedsCallerType]
   Promise<void> addAll(sequence<RequestInfo> requests);
   [NewObject]
   Promise<void> put(RequestInfo request, Response response);

dom/webidl/CanvasRenderingContext2D.webidl

@@ -59,7 +59,7 @@ interface CanvasRenderingContext2D {
   DOMMatrix getTransform();
   [Throws, LenientFloat]
   void setTransform(double a, double b, double c, double d, double e, double f);
-  [Throws, LenientFloat]
+  [Throws]
   void setTransform(optional DOMMatrix2DInit transform);
   [Throws]
   void resetTransform();
@@ -239,11 +239,10 @@ interface CanvasRenderingContext2D {
   [ChromeOnly]
   void demote();
 };
-CanvasRenderingContext2D implements CanvasDrawingStyles;
-CanvasRenderingContext2D implements CanvasPathMethods;
+CanvasRenderingContext2D includes CanvasDrawingStyles;
+CanvasRenderingContext2D includes CanvasPathMethods;
 
-[NoInterfaceObject]
-interface CanvasDrawingStyles {
+interface mixin CanvasDrawingStyles {
   // line caps/joins
            [LenientFloat]
            attribute double lineWidth; // (default 1)
@@ -265,8 +264,7 @@ interface CanvasDrawingStyles {
            attribute DOMString textBaseline; // "top", "hanging", "middle", "alphabetic", "ideographic", "bottom" (default: "alphabetic")
 };
 
-[NoInterfaceObject]
-interface CanvasPathMethods {
+interface mixin CanvasPathMethods {
   // shared path API methods
   void closePath();
   [LenientFloat]
@@ -342,4 +340,4 @@ interface Path2D
 {
   [Throws] void addPath(Path2D path, optional DOMMatrix2DInit transformation);
 };
-Path2D implements CanvasPathMethods;
+Path2D includes CanvasPathMethods;

dom/webidl/CharacterData.webidl

@@ -11,8 +11,8 @@
  */
 
 interface CharacterData : Node {
-  [TreatNullAs=EmptyString, Pure, SetterThrows]
-  attribute DOMString data;
+  [Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString data;
   [Pure]
   readonly attribute unsigned long length;
   [Throws]
@@ -27,5 +27,5 @@ interface CharacterData : Node {
   void replaceData(unsigned long offset, unsigned long count, DOMString data);
 };
 
-CharacterData implements ChildNode;
-CharacterData implements NonDocumentTypeChildNode;
+CharacterData includes ChildNode;
+CharacterData includes NonDocumentTypeChildNode;

dom/webidl/ChildNode.webidl

@@ -7,8 +7,7 @@
  * http://dom.spec.whatwg.org/#interface-childnode
  */
 
-[NoInterfaceObject]
-interface ChildNode {
+interface mixin ChildNode {
   [CEReactions, Throws, Unscopable]
   void before((Node or DOMString)... nodes);
   [CEReactions, Throws, Unscopable]
@@ -19,8 +18,7 @@ interface ChildNode {
   void remove();
 };
 
-[NoInterfaceObject]
-interface NonDocumentTypeChildNode {
+interface mixin NonDocumentTypeChildNode {
   [Pure]
   readonly attribute Element? previousElementSibling;
   [Pure]

dom/webidl/ConvolverNode.webidl

@@ -26,5 +26,5 @@ interface ConvolverNode : AudioNode {
 };
 
 // Mozilla extension
-ConvolverNode implements AudioNodePassThrough;
+ConvolverNode includes AudioNodePassThrough;
 

dom/webidl/Crypto.webidl

@@ -7,8 +7,8 @@
  * https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#crypto-interface
  */
 
-[NoInterfaceObject, Exposed=(Window,Worker)]
-interface GlobalCrypto {
+[Exposed=(Window,Worker)]
+interface mixin GlobalCrypto {
   [Throws] readonly attribute Crypto crypto;
 };
 

dom/webidl/DOMCursor.webidl

@@ -10,4 +10,4 @@ interface DOMCursor : EventTarget {
   void continue();
 };
 
-DOMCursor implements DOMRequestShared;
+DOMCursor includes DOMRequestShared;

dom/webidl/DOMException.webidl

@@ -15,9 +15,7 @@
 
 interface StackFrame;
 
-[NoInterfaceObject,
- Exposed=(Window,Worker)]
-interface ExceptionMembers
+interface mixin ExceptionMembers
 {
   // A custom message set by the thrower.  LenientThis so it can be
   // gotten on the prototype, which Error.prototype.toString will do
@@ -68,7 +66,7 @@ interface Exception {
   stringifier;
 };
 
-Exception implements ExceptionMembers;
+Exception includes ExceptionMembers;
 
 // XXXkhuey this is an 'exception', not an interface, but we don't have any
 // parser or codegen mechanisms for dealing with exceptions.
@@ -107,4 +105,4 @@ interface DOMException {
 
 // XXXkhuey copy all of Gecko's non-standard stuff onto DOMException, but leave
 // the prototype chain sane.
-DOMException implements ExceptionMembers;
+DOMException includes ExceptionMembers;

dom/webidl/DOMRequest.webidl

@@ -5,8 +5,8 @@
 
 enum DOMRequestReadyState { "pending", "done" };
 
-[Exposed=(Window,Worker,System), NoInterfaceObject]
-interface DOMRequestShared {
+[Exposed=(Window,Worker)]
+interface mixin DOMRequestShared {
   readonly attribute DOMRequestReadyState readyState;
 
   readonly attribute any result;
@@ -26,4 +26,4 @@ interface DOMRequest : EventTarget {
            [TreatNonCallableAsNull] optional AnyCallback? rejectCallback = null);
 };
 
-DOMRequest implements DOMRequestShared;
+DOMRequest includes DOMRequestShared;

dom/webidl/DelayNode.webidl

@@ -24,5 +24,5 @@ interface DelayNode : AudioNode {
 };
 
 // Mozilla extension
-DelayNode implements AudioNodePassThrough;
+DelayNode includes AudioNodePassThrough;
 

dom/webidl/Document.webidl

@@ -155,9 +155,6 @@ partial interface Document {
 
   // Gecko extensions?
                 attribute EventHandler onwheel;
-                attribute EventHandler oncopy;
-                attribute EventHandler oncut;
-                attribute EventHandler onpaste;
                 attribute EventHandler onbeforescriptexecute;
                 attribute EventHandler onafterscriptexecute;
 
@@ -440,11 +437,12 @@ partial interface Document {
   [Func="IsChromeOrXBL"] readonly attribute boolean inlineScriptAllowedByCSP;
 };
 
-Document implements XPathEvaluator;
-Document implements GlobalEventHandlers;
-Document implements TouchEventHandlers;
-Document implements ParentNode;
-Document implements OnErrorEventHandlerForNodes;
-Document implements GeometryUtils;
-Document implements FontFaceSource;
-Document implements DocumentOrShadowRoot;
+Document includes XPathEvaluatorMixin;
+Document includes GlobalEventHandlers;
+Document includes DocumentAndElementEventHandlers;
+Document includes TouchEventHandlers;
+Document includes ParentNode;
+Document includes OnErrorEventHandlerForNodes;
+Document includes GeometryUtils;
+Document includes FontFaceSource;
+Document includes DocumentOrShadowRoot;

dom/webidl/DocumentFragment.webidl

@@ -24,4 +24,4 @@ partial interface DocumentFragment {
   NodeList  querySelectorAll(DOMString selectors);
 };
 
-DocumentFragment implements ParentNode;
+DocumentFragment includes ParentNode;

dom/webidl/DocumentOrShadowRoot.webidl

@@ -8,8 +8,7 @@
  * http://w3c.github.io/webcomponents/spec/shadow/#extensions-to-the-documentorshadowroot-mixin
  */
 
-[NoInterfaceObject]
-interface DocumentOrShadowRoot {
+interface mixin DocumentOrShadowRoot {
   // Not implemented yet: bug 1430308.
   // Selection? getSelection();
   Element? elementFromPoint (float x, float y);

dom/webidl/DocumentType.webidl

@@ -16,4 +16,4 @@ interface DocumentType : Node {
   readonly attribute DOMString systemId;
 };
 
-DocumentType implements ChildNode;
+DocumentType includes ChildNode;

dom/webidl/DynamicsCompressorNode.webidl

@@ -32,5 +32,5 @@ interface DynamicsCompressorNode : AudioNode {
 };
 
 // Mozilla extension
-DynamicsCompressorNode implements AudioNodePassThrough;
+DynamicsCompressorNode includes AudioNodePassThrough;
 

dom/webidl/Element.webidl

@@ -163,6 +163,29 @@ interface Element : Node {
   sequence<Grid> getGridFragments();
 };
 
+// https://drafts.csswg.org/cssom/#the-elementcssinlinestyle-mixin
+interface mixin ElementCSSInlineStyle {
+  [SameObject, PutForwards=cssText]
+  readonly attribute CSSStyleDeclaration style;
+};
+
+// https://html.spec.whatwg.org/#focus-management-apis
+dictionary FocusOptions {
+  boolean preventScroll = false;
+};
+
+interface mixin HTMLOrForeignElement {
+  [SameObject] readonly attribute DOMStringMap dataset;
+  // See bug 1389421
+  // attribute DOMString nonce; // intentionally no [CEReactions]
+
+  // See bug 1575154
+  // [CEReactions] attribute boolean autofocus;
+  [CEReactions, SetterThrows, Pure] attribute long tabIndex;
+  [Throws] void focus(optional FocusOptions options);
+  [Throws] void blur();
+};
+
 // http://dev.w3.org/csswg/cssom-view/
 enum ScrollLogicalPosition { "start", "center", "end", "nearest" };
 dictionary ScrollIntoViewOptions : ScrollOptions {
@@ -212,10 +235,10 @@ partial interface Element {
 
 // http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface
 partial interface Element {
-  [CEReactions, Pure,SetterThrows,TreatNullAs=EmptyString]
-  attribute DOMString innerHTML;
-  [CEReactions, Pure,SetterThrows,TreatNullAs=EmptyString]
-  attribute DOMString outerHTML;
+  [CEReactions, Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString innerHTML;
+  [CEReactions, Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString outerHTML;
   [CEReactions, Throws]
   void insertAdjacentHTML(DOMString position, DOMString text);
 };
@@ -246,11 +269,11 @@ partial interface Element {
            attribute DOMString slot;
 };
 
-Element implements ChildNode;
-Element implements NonDocumentTypeChildNode;
-Element implements ParentNode;
-Element implements Animatable;
-Element implements GeometryUtils;
+Element includes ChildNode;
+Element includes NonDocumentTypeChildNode;
+Element includes ParentNode;
+Element includes Animatable;
+Element includes GeometryUtils;
 
 // https://fullscreen.spec.whatwg.org/#api
 partial interface Element {

dom/webidl/EventHandler.webidl

@@ -24,8 +24,7 @@ typedef OnBeforeUnloadEventHandlerNonNull? OnBeforeUnloadEventHandler;
 callback OnErrorEventHandlerNonNull = boolean ((Event or DOMString) event, optional DOMString source, optional unsigned long lineno, optional unsigned long column, optional any error);
 typedef OnErrorEventHandlerNonNull? OnErrorEventHandler;
 
-[NoInterfaceObject]
-interface GlobalEventHandlers {
+interface mixin GlobalEventHandlers {
            attribute EventHandler onabort;
            attribute EventHandler onblur;
 // We think the spec is wrong here. See OnErrorEventHandlerForNodes/Window
@@ -147,8 +146,7 @@ interface GlobalEventHandlers {
            attribute EventHandler onwebkittransitionend;
 };
 
-[NoInterfaceObject]
-interface WindowEventHandlers {
+interface mixin WindowEventHandlers {
            attribute EventHandler onafterprint;
            attribute EventHandler onbeforeprint;
            attribute OnBeforeUnloadEventHandler onbeforeunload;
@@ -166,17 +164,21 @@ interface WindowEventHandlers {
            attribute EventHandler onunload;
 };
 
+interface mixin DocumentAndElementEventHandlers {
+           attribute EventHandler oncopy;
+           attribute EventHandler oncut;
+           attribute EventHandler onpaste;
+};
+
 // The spec has |attribute OnErrorEventHandler onerror;| on
 // GlobalEventHandlers, and calls the handler differently depending on
 // whether an ErrorEvent was fired. We don't do that, and until we do we'll
 // need to distinguish between onerror on Window or on nodes.
 
-[NoInterfaceObject]
-interface OnErrorEventHandlerForNodes {
+interface mixin OnErrorEventHandlerForNodes {
            attribute EventHandler onerror;
 };
 
-[NoInterfaceObject]
-interface OnErrorEventHandlerForWindow {
+interface mixin OnErrorEventHandlerForWindow {
            attribute OnErrorEventHandler onerror;
 };

dom/webidl/Fetch.webidl

@@ -10,8 +10,7 @@
 typedef object JSON;
 typedef (Blob or BufferSource or FormData or URLSearchParams or USVString) BodyInit;
 
-[NoInterfaceObject, Exposed=(Window,Worker)]
-interface Body {
+interface mixin Body {
   readonly attribute boolean bodyUsed;
   [Throws]
   Promise<ArrayBuffer> arrayBuffer();

dom/webidl/FontFaceSource.webidl

@@ -10,8 +10,7 @@
  * liability, trademark and document use rules apply.
  */
 
-[NoInterfaceObject]
-interface FontFaceSource {
+interface mixin FontFaceSource {
 
   [Pref="layout.css.font-loading-api.enabled"]
   readonly attribute FontFaceSet fonts;

dom/webidl/GainNode.webidl

@@ -23,5 +23,5 @@ interface GainNode : AudioNode {
 };
 
 // Mozilla extension
-GainNode implements AudioNodePassThrough;
+GainNode includes AudioNodePassThrough;
 

dom/webidl/GeometryUtils.webidl

@@ -21,8 +21,7 @@ dictionary ConvertCoordinateOptions {
   CSSBoxType toBox = "border";
 };
 
-[NoInterfaceObject]
-interface GeometryUtils {
+interface mixin GeometryUtils {
   [Throws, Func="nsINode::HasBoxQuadsSupport"]
   sequence<DOMQuad> getBoxQuads(optional BoxQuadOptions options);
   [Throws, Pref="layout.css.convertFromNode.enabled"]
@@ -33,6 +32,6 @@ interface GeometryUtils {
   DOMPoint convertPointFromNode(DOMPointInit point, GeometryNode from, optional ConvertCoordinateOptions options);
 };
 
-// PseudoElement implements GeometryUtils;
+// PseudoElement includes GeometryUtils;
 
 typedef (Text or Element /* or PseudoElement */ or Document) GeometryNode;

dom/webidl/HTMLAnchorElement.webidl

@@ -35,7 +35,7 @@ interface HTMLAnchorElement : HTMLElement {
            attribute DOMString text;
 };
 
-HTMLAnchorElement implements HTMLHyperlinkElementUtils;
+HTMLAnchorElement includes HTMLHyperlinkElementUtils;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLAnchorElement {

dom/webidl/HTMLAppletElement.webidl

@@ -38,6 +38,6 @@ interface HTMLAppletElement : HTMLElement {
            attribute DOMString width;
 };
 
-HTMLAppletElement implements MozImageLoadingContent;
-HTMLAppletElement implements MozFrameLoaderOwner;
-HTMLAppletElement implements MozObjectLoadingContent;
+HTMLAppletElement includes MozImageLoadingContent;
+HTMLAppletElement includes MozFrameLoaderOwner;
+HTMLAppletElement includes MozObjectLoadingContent;

dom/webidl/HTMLAreaElement.webidl

@@ -35,7 +35,7 @@ interface HTMLAreaElement : HTMLElement {
   readonly attribute DOMTokenList relList;
 };
 
-HTMLAreaElement implements HTMLHyperlinkElementUtils;
+HTMLAreaElement includes HTMLHyperlinkElementUtils;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLAreaElement {

dom/webidl/HTMLBodyElement.webidl

@@ -16,18 +16,18 @@ interface HTMLBodyElement : HTMLElement {
 };
 
 partial interface HTMLBodyElement {
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString text;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString link;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString vLink;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString aLink;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString bgColor;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString text;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString link;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString vLink;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString aLink;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString bgColor;
   [CEReactions, SetterThrows]
   attribute DOMString background;
 };
 
-HTMLBodyElement implements WindowEventHandlers;
+HTMLBodyElement includes WindowEventHandlers;

dom/webidl/HTMLDocument.webidl

@@ -57,11 +57,11 @@ interface HTMLDocument : Document {
   [Throws]
   DOMString queryCommandValue(DOMString commandId);
 
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString fgColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString linkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString vlinkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString alinkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString bgColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString fgColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString linkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString vlinkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString alinkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString bgColor;
 
   [Pure]
   readonly attribute HTMLCollection anchors;

dom/webidl/HTMLElement.webidl

@@ -22,22 +22,14 @@ interface HTMLElement : Element {
   //         attribute boolean translate;
   [CEReactions, SetterThrows, Pure]
            attribute DOMString dir;
-  [Constant]
-  readonly attribute DOMStringMap dataset;
 
-  [CEReactions, GetterThrows, Pure, TreatNullAs=EmptyString]
-           attribute DOMString innerText;
+  [CEReactions, GetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString innerText;
 
   // user interaction
   [CEReactions, SetterThrows, Pure]
            attribute boolean hidden;
   void click();
-  [CEReactions, SetterThrows, Pure]
-           attribute long tabIndex;
-  [Throws]
-  void focus();
-  [Throws]
-  void blur();
   [CEReactions, SetterThrows, Pure]
            attribute DOMString accessKey;
   [Pure]
@@ -61,15 +53,6 @@ interface HTMLElement : Element {
   //readonly attribute boolean? commandHidden;
   //readonly attribute boolean? commandDisabled;
   //readonly attribute boolean? commandChecked;
-
-  // styling
-  [PutForwards=cssText, Constant]
-  readonly attribute CSSStyleDeclaration style;
-
-  // Mozilla specific stuff
-           attribute EventHandler oncopy;
-           attribute EventHandler oncut;
-           attribute EventHandler onpaste;
 };
 
 // http://dev.w3.org/csswg/cssom-view/#extensions-to-the-htmlelement-interface
@@ -89,8 +72,7 @@ partial interface HTMLElement {
            attribute boolean scrollgrab;
 };
 
-[NoInterfaceObject]
-interface TouchEventHandlers {
+interface mixin TouchEventHandlers {
   [Func="nsGenericHTMLElement::TouchEventsEnabled"]
            attribute EventHandler ontouchstart;
   [Func="nsGenericHTMLElement::TouchEventsEnabled"]
@@ -101,8 +83,11 @@ interface TouchEventHandlers {
            attribute EventHandler ontouchcancel;
 };
 
-HTMLElement implements GlobalEventHandlers;
-HTMLElement implements TouchEventHandlers;
-HTMLElement implements OnErrorEventHandlerForNodes;
+HTMLElement includes GlobalEventHandlers;
+HTMLElement includes HTMLOrForeignElement;
+HTMLElement includes DocumentAndElementEventHandlers;
+HTMLElement includes ElementCSSInlineStyle;
+HTMLElement includes TouchEventHandlers;
+HTMLElement includes OnErrorEventHandlerForNodes;
 
 interface HTMLUnknownElement : HTMLElement {};

dom/webidl/HTMLEmbedElement.webidl

@@ -41,6 +41,6 @@ partial interface HTMLEmbedElement {
   Document? getSVGDocument();
 };
 
-HTMLEmbedElement implements MozImageLoadingContent;
-HTMLEmbedElement implements MozFrameLoaderOwner;
-HTMLEmbedElement implements MozObjectLoadingContent;
+HTMLEmbedElement includes MozImageLoadingContent;
+HTMLEmbedElement includes MozFrameLoaderOwner;
+HTMLEmbedElement includes MozObjectLoadingContent;

dom/webidl/HTMLFontElement.webidl

@@ -13,7 +13,7 @@
 
 [HTMLConstructor]
 interface HTMLFontElement : HTMLElement {
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows] attribute DOMString color;
+  [CEReactions, SetterThrows] attribute [TreatNullAs=EmptyString] DOMString color;
   [CEReactions, SetterThrows]                          attribute DOMString face;
   [CEReactions, SetterThrows]                          attribute DOMString size;
 };

dom/webidl/HTMLFrameElement.webidl

@@ -29,10 +29,10 @@ interface HTMLFrameElement : HTMLElement {
   readonly attribute Document? contentDocument;
   readonly attribute WindowProxy? contentWindow;
 
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString marginHeight;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString marginWidth;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString marginHeight;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString marginWidth;
 };
 
-HTMLFrameElement implements MozFrameLoaderOwner;
+HTMLFrameElement includes MozFrameLoaderOwner;

dom/webidl/HTMLFrameSetElement.webidl

@@ -19,4 +19,4 @@ interface HTMLFrameSetElement : HTMLElement {
   attribute DOMString rows;
 };
 
-HTMLFrameSetElement implements WindowEventHandlers;
+HTMLFrameSetElement includes WindowEventHandlers;

dom/webidl/HTMLHyperlinkElementUtils.webidl

@@ -10,8 +10,7 @@
  * and create derivative works of this document.
  */
 
-[NoInterfaceObject]
-interface HTMLHyperlinkElementUtils {
+interface mixin HTMLHyperlinkElementUtils {
   // Bug 824857: no support for stringifier attributes yet.
   //  stringifier attribute USVString href;
 

dom/webidl/HTMLIFrameElement.webidl

@@ -45,10 +45,10 @@ partial interface HTMLIFrameElement {
   [CEReactions, SetterThrows, Pure]
            attribute DOMString longDesc;
 
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows, Pure]
-           attribute DOMString marginHeight;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows, Pure]
-           attribute DOMString marginWidth;
+  [CEReactions, SetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString marginHeight;
+  [CEReactions, SetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString marginWidth;
 };
 
 partial interface HTMLIFrameElement {
@@ -59,9 +59,9 @@ partial interface HTMLIFrameElement {
 
 partial interface HTMLIFrameElement {
   // nsIDOMMozBrowserFrame
-  [ChromeOnly,SetterThrows]
+  [ChromeOnly, SetterThrows]
            attribute boolean mozbrowser;
 };
 
-HTMLIFrameElement implements MozFrameLoaderOwner;
+HTMLIFrameElement includes MozFrameLoaderOwner;
 HTMLIFrameElement implements BrowserElement;

dom/webidl/HTMLImageElement.webidl

@@ -55,7 +55,7 @@ partial interface HTMLImageElement {
            [CEReactions, SetterThrows]
            attribute DOMString longDesc;
 
-  [CEReactions, TreatNullAs=EmptyString,SetterThrows] attribute DOMString border;
+  [CEReactions, SetterThrows] attribute [TreatNullAs=EmptyString] DOMString border;
 };
 
 // [Update me: not in whatwg spec yet]
@@ -77,8 +77,7 @@ partial interface HTMLImageElement {
   readonly attribute long y;
 };
 
-[NoInterfaceObject]
-interface MozImageLoadingContent {
+interface mixin MozImageLoadingContent {
   // Mirrored chrome-only nsIImageLoadingContent methods.  Please make sure
   // to update this list if nsIImageLoadingContent changes.
   [ChromeOnly]
@@ -108,4 +107,4 @@ interface MozImageLoadingContent {
   void forceImageState(boolean aForce, unsigned long long aState);
 };
 
-HTMLImageElement implements MozImageLoadingContent;
+HTMLImageElement includes MozImageLoadingContent;