[NSS] Update NSS version for release.

Add (UXP) to the version display string to signify this is our variant of
NSS 3.90 to avoid confusion with the 3.90 branch used in Firefox 115 ESR.
This version has backported considerably more fixes than Mozilla's NSS.

accessible/base/AccIterator.h

@@ -55,7 +55,7 @@ private:
   {
     explicit IteratorState(Accessible* aParent, IteratorState* mParentState = nullptr);
 
-    Accessible* mParent;
+    RefPtr<Accessible> mParent;
     int32_t mIndex;
     IteratorState* mParentState;
   };

dom/base/Element.cpp

@@ -304,12 +304,18 @@ Element::TabIndex()
 }
 
 void
-Element::Focus(mozilla::ErrorResult& aError)
+Element::Focus(const FocusOptions& aOptions, ErrorResult& aError)
 {
   nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(this);
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+  // Also other browsers seem to have the hack to not re-focus (and flush) when
+  // the element is already focused.
+  // Until https://github.com/whatwg/html/issues/4512 is clarified, we'll
+  // maintain interoperatibility by not re-focusing, independent of aOptions.
+  // I.e., `focus({ preventScroll: true})` followed by `focus( { preventScroll:
+  // false })` won't re-focus.
   if (fm && domElement) {
-    aError = fm->SetFocus(domElement, 0);
+    aError = fm->SetFocus(domElement, nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions));
   }
 }
 

dom/base/Element.h

@@ -216,7 +216,7 @@ public:
   /**
    * Make focus on this element.
    */
-  virtual void Focus(mozilla::ErrorResult& aError);
+  virtual void Focus(const FocusOptions& aOptions, ErrorResult& aError);
 
   /**
    * Show blur and clear focus.

dom/base/ImageEncoder.cpp

@@ -400,6 +400,7 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
       layers::PlanarYCbCrImage* ycbcrImage = static_cast<layers::PlanarYCbCrImage*> (aImage);
       gfxImageFormat format = SurfaceFormat::A8R8G8B8_UINT32;
       uint32_t stride = GetAlignedStride<16>(aSize.width, 4);
+      auto size = stride * aSize.height;
       size_t length = BufferSizeFromStrideAndHeight(stride, aSize.height);
       if (length == 0) {
         return NS_ERROR_INVALID_ARG;
@@ -413,10 +414,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
                         stride);
 
       rv = aEncoder->InitFromData(data.Elements(),
-                                  aSize.width * aSize.height * 4,
+                                  size,
                                   aSize.width,
                                   aSize.height,
-                                  aSize.width * 4,
+                                  stride,
                                   imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                   aOptions);
     } else {
@@ -433,10 +434,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
         return NS_ERROR_INVALID_ARG;
       }
       rv = aEncoder->InitFromData(map.mData,
-                                  aSize.width * aSize.height * 4,
+                                  map.mStride * aSize.height,
                                   aSize.width,
                                   aSize.height,
-                                  aSize.width * 4,
+                                  map.mStride,
                                   imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                   aOptions);
       dataSurface->Unmap();
@@ -467,10 +468,10 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
       return NS_ERROR_INVALID_ARG;
     }
     rv = aEncoder->InitFromData(map.mData,
-                                aSize.width * aSize.height * 4,
+                                map.mStride * aSize.height,
                                 aSize.width,
                                 aSize.height,
-                                aSize.width * 4,
+                                map.mStride,
                                 imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                 aOptions);
     emptyCanvas->Unmap();

dom/base/nsContentList.cpp

@@ -523,7 +523,8 @@ nsContentList::NamedItem(const nsAString& aName, bool aDoFlush)
 }
 
 void
-nsContentList::GetSupportedNames(nsTArray<nsString>& aNames)
+nsContentList::GetSupportedNames(nsTArray<nsString>& aNames,
+                                 FilterElementWithName aFilter)
 {
   BringSelfUpToDate(true);
 
@@ -546,7 +547,8 @@ nsContentList::GetSupportedNames(nsTArray<nsString>& aNames)
       // Note: nsINode::HasName means the name is exposed on the document,
       // which is false for options, so we don't check it here.
       const nsAttrValue* val = el->GetParsedAttr(nsGkAtoms::name);
-      if (val && val->Type() == nsAttrValue::eAtom) {
+      if (val && val->Type() == nsAttrValue::eAtom &&
+          (!aFilter || aFilter(el))) {
         nsIAtom* name = val->GetAtomValue();
         MOZ_ASSERT(name != nsGkAtoms::_empty,
                    "Empty names don't get atomized");

dom/base/nsContentList.h

@@ -295,7 +295,9 @@ public:
     aFound = !!item;
     return item;
   }
-  virtual void GetSupportedNames(nsTArray<nsString>& aNames) override;
+  virtual void GetSupportedNames(nsTArray<nsString>& aNames) override {
+    GetSupportedNames(aNames, nullptr);
+  }
 
   // nsContentList public methods
   uint32_t Length(bool aDoFlush);
@@ -303,6 +305,12 @@ public:
   mozilla::dom::Element*
   NamedItem(const nsAString& aName, bool aDoFlush);
 
+  // Used by HTMLAllCollection to limit the elements whose name attribute is
+  // considered. The filter MUST NOT cause any flushes.
+  using FilterElementWithName = bool (*)(nsIContent*);
+  void GetSupportedNames(nsTArray<nsString>& aNames,
+                         FilterElementWithName aFilter);
+
   // nsIMutationObserver
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED

dom/base/nsContentUtils.cpp

@@ -2259,6 +2259,31 @@ nsContentUtils::IsCallerContentXBL()
     return xpc::IsContentXBLScope(c);
 }
 
+bool
+nsContentUtils::IsSystemCaller(JSContext* aCx)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // This is similar to what SubjectPrincipal() does, except we do in fact
+  // assume that we're in a compartment here; anyone who calls this function in
+  // situations where that's not the case is doing it wrong.
+  JSCompartment *compartment = js::GetContextCompartment(aCx);
+  MOZ_ASSERT(compartment);
+
+  JSPrincipals *principals = JS_GetCompartmentPrincipals(compartment);
+  return nsJSPrincipals::get(principals) == sSystemPrincipal;
+}
+
+bool
+nsContentUtils::ThreadsafeIsSystemCaller(JSContext* aCx)
+{
+  if (NS_IsMainThread()) {
+    return IsSystemCaller(aCx);
+  }
+
+  return workers::GetWorkerPrivateFromContext(aCx)->UsesSystemPrincipal();
+}
+
 // static
 bool
 nsContentUtils::LookupBindingMember(JSContext* aCx, nsIContent *aContent,
@@ -7336,6 +7361,17 @@ nsContentUtils::HasDistributedChildren(nsIContent* aContent)
   return false;
 }
 
+// static
+bool nsContentUtils::IsNodeInEditableRegion(nsINode* aNode) {
+  while (aNode) {
+    if (aNode->IsEditable()) {
+      return true;
+    }
+    aNode = aNode->GetParent();
+  }
+  return false;
+}
+
 // static
 bool
 nsContentUtils::IsForbiddenRequestHeader(const nsACString& aHeader,

dom/base/nsContentUtils.h

@@ -202,6 +202,23 @@ public:
   static bool     ThreadsafeIsCallerChrome();
   static bool     IsCallerContentXBL();
 
+  // The APIs for checking whether the caller is system (in the sense of system
+  // principal) should only be used when the JSContext is known to accurately
+  // represent the caller.  In practice, that means you should only use them in
+  // two situations at the moment:
+  //
+  // 1) Functions used in WebIDL Func annotations.
+  // 2) Bindings code.
+  //
+  // Use pretty much anywhere else is almost certainly wrong and should be
+  // replaced with [NeedsCallerType] annotations in bindings.
+
+  // Check whether the caller is system if you know you're on the main thread.
+  static bool IsSystemCaller(JSContext* aCx);
+
+  // Check whether the caller is system if you might be on a worker thread.
+  static bool ThreadsafeIsSystemCaller(JSContext* aCx);
+
   // In the traditional Gecko architecture, both C++ code and untrusted JS code
   // needed to rely on the same XPCOM method/getter/setter to get work done.
   // This required lots of security checks in the various exposed methods, which
@@ -2550,6 +2567,13 @@ public:
    */
   static bool GPCEnabled();
 
+  /**
+   * Returns whether a node has an editable ancestor.
+   *
+   * @param aNode The node to test.
+   */
+  static bool IsNodeInEditableRegion(nsINode* aNode);
+
   /**
    * Returns a LogModule that dump calls from content script are logged to.
    * This can be enabled with the 'Dump' module, and is useful for synchronizing

dom/base/nsFocusManager.cpp

@@ -48,6 +48,7 @@
 
 #include "mozilla/ContentEvents.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/ElementBinding.h"
 #include "mozilla/dom/ShadowRoot.h"
 #include "mozilla/dom/HTMLInputElement.h"
 #include "mozilla/dom/HTMLSlotElement.h"
@@ -2999,6 +3000,11 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindowOuter* aWindow,
   return NS_OK;
 }
 
+uint32_t nsFocusManager::FocusOptionsToFocusManagerFlags(
+    const mozilla::dom::FocusOptions& aOptions) {
+  return aOptions.mPreventScroll ? nsIFocusManager::FLAG_NOSCROLL : 0;
+}
+
 static bool
 IsHostOrSlot(nsIContent* aContent)
 {

dom/base/nsFocusManager.h

@@ -26,6 +26,7 @@ class nsIMessageBroadcaster;
 
 namespace mozilla {
 namespace dom {
+struct FocusOptions;
 class TabParent;
 }
 }
@@ -110,6 +111,9 @@ public:
   static nsIContent* GetFocusedDescendant(nsPIDOMWindowOuter* aWindow, bool aDeep,
                                           nsPIDOMWindowOuter** aFocusedWindow);
 
+  static uint32_t FocusOptionsToFocusManagerFlags(
+      const mozilla::dom::FocusOptions& aOptions);
+
   /**
    * Returns the content node that focus will be redirected to if aContent was
    * focused. This is used for the special case of certain XUL elements such

dom/base/nsGlobalWindow.cpp

@@ -7395,9 +7395,10 @@ nsGlobalWindow::Confirm(const nsAString& aMessage,
 
 already_AddRefed<Promise>
 nsGlobalWindow::Fetch(const RequestOrUSVString& aInput,
-                      const RequestInit& aInit, ErrorResult& aRv)
+                      const RequestInit& aInit,
+                      CallerType aCallerType, ErrorResult& aRv)
 {
-  return FetchRequest(this, aInput, aInit, aRv);
+  return FetchRequest(this, aInput, aInit, aCallerType, aRv);
 }
 
 void

dom/base/nsGlobalWindow.h

@@ -929,6 +929,7 @@ public:
   already_AddRefed<mozilla::dom::cache::CacheStorage> GetCaches(mozilla::ErrorResult& aRv);
   already_AddRefed<mozilla::dom::Promise> Fetch(const mozilla::dom::RequestOrUSVString& aInput,
                                                 const mozilla::dom::RequestInit& aInit,
+                                                mozilla::dom::CallerType aCallerType,
                                                 mozilla::ErrorResult& aRv);
   void PrintOuter(mozilla::ErrorResult& aError);
   void Print(mozilla::ErrorResult& aError);

dom/base/nsIImageLoadingContent.idl

@@ -37,7 +37,7 @@ native Visibility(mozilla::Visibility);
  * observers to check which request they are getting notifications for.
  *
  * Please make sure to update the MozImageLoadingContent WebIDL
- * interface to mirror this interface when changing it.
+ * mixin to mirror this interface when changing it.
  */
 
 [scriptable, builtinclass, uuid(0357123d-9224-4d12-a47e-868c32689777)]

dom/base/nsWrapperCache.cpp

@@ -33,17 +33,29 @@ nsWrapperCache::HoldJSObjects(void* aScriptObjectHolder,
   }
 }
 
+static inline bool
+IsNurseryWrapper(JSObject* aWrapper) {
+  return aWrapper && !JS::ObjectIsTenured(aWrapper);
+}
+
 void
-nsWrapperCache::SetWrapperJSObject(JSObject* aWrapper)
-{
-  mWrapper = aWrapper;
+nsWrapperCache::SetWrapperJSObject(JSObject* aNewWrapper) {
+  JSObject* oldWrapper = mWrapper;
+  mWrapper = aNewWrapper;
   UnsetWrapperFlags(kWrapperFlagsMask & ~WRAPPER_IS_NOT_DOM_BINDING);
 
-  if (aWrapper && !JS::ObjectIsTenured(aWrapper)) {
+  if (IsNurseryWrapper(aNewWrapper) && !IsNurseryWrapper(oldWrapper)) {
     CycleCollectedJSContext::Get()->NurseryWrapperAdded(this);
   }
 }
 
+void nsWrapperCache::ClearWrapperOnWrapFailure() {
+  if (IsNurseryWrapper(mWrapper)) {
+    CycleCollectedJSContext::Get()->NurseryWrapperRemovedSlow(this);
+  }
+  ClearWrapper();
+}
+
 void
 nsWrapperCache::ReleaseWrapper(void* aScriptObjectHolder)
 {

dom/base/nsWrapperCache.h

@@ -131,6 +131,8 @@ public:
     SetWrapperJSObject(nullptr);
   }
 
+  void ClearWrapperOnWrapFailure();
+
   /**
    * Update the wrapper if the object it contains is moved.
    *

dom/bindings/BindingUtils.cpp

@@ -2210,11 +2210,6 @@ ReparentWrapper(JSContext* aCx, JS::Handle<JSObject*> aObjArg, ErrorResult& aErr
                                     js::GetReservedOrProxyPrivateSlot(aObj, DOM_OBJECT_SLOT));
   js::SetReservedOrProxyPrivateSlot(aObj, DOM_OBJECT_SLOT, JS::PrivateValue(nullptr));
 
-  aObj = xpc::TransplantObject(aCx, aObj, newobj);
-  if (!aObj) {
-    MOZ_CRASH();
-  }
-
   nsWrapperCache* cache = nullptr;
   CallQueryInterface(native, &cache);
   bool preserving = cache->PreservingWrapper();
@@ -2222,6 +2217,20 @@ ReparentWrapper(JSContext* aCx, JS::Handle<JSObject*> aObjArg, ErrorResult& aErr
   cache->SetWrapper(aObj);
   cache->SetPreservingWrapper(preserving);
 
+  aObj = xpc::TransplantObject(aCx, aObj, newobj);
+  if (!aObj) {
+    MOZ_CRASH();
+  }
+
+  // Update the wrapper cache again if transplanting didn't use newobj but
+  // returned some other object.
+  if (aObj != newobj) {
+    preserving = cache->PreservingWrapper();
+    cache->SetPreservingWrapper(false);
+    cache->SetWrapper(aObj);
+    cache->SetPreservingWrapper(preserving);
+  }
+
   if (propertyHolder) {
     JS::Rooted<JSObject*> copyTo(aCx);
     if (isProxy) {

dom/bindings/Codegen.py

@@ -3711,7 +3711,7 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         failureCode = dedent(
             """
             aCache->ReleaseWrapper(aObject);
-            aCache->ClearWrapper();
+            aCache->ClearWrapperOnWrapFailure();
             return false;
             """)
 
@@ -4464,9 +4464,6 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                                 isOptional=False,
                                 invalidEnumValueFatal=True,
                                 defaultValue=None,
-                                treatNullAs="Default",
-                                isEnforceRange=False,
-                                isClamp=False,
                                 isNullOrUndefined=False,
                                 exceptionCode=None,
                                 lenientFloatCode=None,
@@ -4544,6 +4541,12 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
     # And we can't both be an object and be null or undefined
     assert not isDefinitelyObject or not isNullOrUndefined
 
+    # Types can also have extended attributes, copy them over
+    isClamp = type.clamp
+    isEnforceRange = type.enforceRange
+    if type.treatNullAsEmpty:
+        treatNullAs = "EmptyString"
+
     # If exceptionCode is not set, we'll just rethrow the exception we got.
     # Note that we can't just set failureCode to exceptionCode, because setting
     # failureCode will prevent pending exceptions from being set in cases when
@@ -5648,6 +5651,10 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             undefinedBehavior = "eNull"
         else:
             undefinedBehavior = "eStringify"
+            if type.treatNullAsEmpty:
+                treatNullAs = "EmptyString"
+            else:
+                treatNullAs = "Default"
         nullBehavior = treatAs[treatNullAs]
 
         def getConversionCode(varName):
@@ -6297,9 +6304,6 @@ class CGArgumentConverter(CGThing):
                         not self.argument.variadic),
             invalidEnumValueFatal=self.invalidEnumValueFatal,
             defaultValue=self.argument.defaultValue,
-            treatNullAs=self.argument.treatNullAs,
-            isEnforceRange=self.argument.enforceRange,
-            isClamp=self.argument.clamp,
             lenientFloatCode=self.lenientFloatCode,
             isMember="Variadic" if self.argument.variadic else False,
             allowTreatNonCallableAsNull=self.argument.allowTreatNonCallableAsNull(),
@@ -8370,18 +8374,6 @@ class FakeArgument():
         self.variadic = False
         self.defaultValue = None
         self._allowTreatNonCallableAsNull = allowTreatNonCallableAsNull
-        # For FakeArguments generated by maplike/setlike convenience functions,
-        # we won't have an interfaceMember to pass in.
-        if interfaceMember:
-            self.treatNullAs = interfaceMember.treatNullAs
-        else:
-            self.treatNullAs = "Default"
-        if isinstance(interfaceMember, IDLAttribute):
-            self.enforceRange = interfaceMember.enforceRange
-            self.clamp = interfaceMember.clamp
-        else:
-            self.enforceRange = False
-            self.clamp = False
 
         self.identifier = FakeIdentifier(name)
 
@@ -11063,7 +11055,6 @@ class CGProxySpecialOperation(CGPerSignatureCall):
             argument = arguments[1]
             info = getJSToNativeConversionInfo(
                 argument.type, descriptor,
-                treatNullAs=argument.treatNullAs,
                 sourceDescription=("value being assigned to %s setter" %
                                    descriptor.interface.identifier.name))
             if argumentHandleValue is None:
@@ -12694,8 +12685,6 @@ class CGDictionary(CGThing):
              getJSToNativeConversionInfo(
                  member.type,
                  descriptorProvider,
-                 isEnforceRange=member.enforceRange,
-                 isClamp=member.clamp,
                  isMember="Dictionary",
                  isOptional=member.canHaveMissingValue(),
                  defaultValue=member.defaultValue,
@@ -15575,7 +15564,6 @@ class CGCallbackInterface(CGCallback):
 
 class FakeMember():
     def __init__(self, name=None):
-        self.treatNullAs = "Default"
         if name is not None:
             self.identifier = FakeIdentifier(name)
 

dom/bindings/Configuration.py

@@ -45,7 +45,8 @@ class Configuration(DescriptorProvider):
                 # Our build system doesn't support dep build involving
                 # addition/removal of "implements" statements that appear in a
                 # different .webidl file than their LHS interface.  Make sure we
-                # don't have any of those.
+                # don't have any of those.  See similar block below for partial
+                # interfaces!
                 #
                 # But whitelist a RHS that is LegacyQueryInterface,
                 # since people shouldn't be adding any of those.
@@ -66,6 +67,33 @@ class Configuration(DescriptorProvider):
             if not thing.isInterface() and not thing.isNamespace():
                 continue
             iface = thing
+            # Our build system doesn't support dep builds involving
+            # addition/removal of partial interfaces that appear in a different
+            # .webidl file than the interface they are extending.  Make sure we
+            # don't have any of those.  See similar block above for "implements"
+            # statements!
+            if not iface.isExternal():
+                for partialIface in iface.getPartials():
+                    if (partialIface.filename() != iface.filename() and
+                        # Unfortunately, NavigatorProperty does exactly the
+                        # thing we're trying to prevent here.  I'm not sure how
+                        # to deal with that, short of effectively requiring a
+                        # clobber when NavigatorProperty is added/removed and
+                        # whitelisting the things it outputs here as
+                        # restrictively as I can.
+                        (partialIface.identifier.name != "Navigator" or
+                         len(partialIface.members) != 1 or
+                         partialIface.members[0].location != partialIface.location or
+                         partialIface.members[0].identifier.location.filename() !=
+                           "<builtin>")):
+                        raise TypeError(
+                            "The binding build system doesn't really support "
+                            "partial interfaces which don't appear in the "
+                            "file in which the interface they are extending is "
+                            "defined.  Don't do this.\n"
+                            "%s\n"
+                            "%s" %
+                            (partialIface.location, iface.location))
             self.interfaces[iface.identifier.name] = iface
             if iface.identifier.name not in config:
                 # Completely skip consequential interfaces with no descriptor

dom/bindings/ErrorResult.h

@@ -164,6 +164,7 @@ public:
 
   void Throw(nsresult rv) {
     MOZ_ASSERT(NS_FAILED(rv), "Please don't try throwing success");
+    ClearUnionData();
     AssignErrorCode(rv);
   }
 
@@ -324,6 +325,7 @@ public:
   // Throw() here because people can easily pass success codes to
   // this.
   void operator=(nsresult rv) {
+    ClearUnionData();
     AssignErrorCode(rv);
   }
 
@@ -393,6 +395,7 @@ private:
   }
 
   void AssignErrorCode(nsresult aRv) {
+    MOZ_ASSERT(mUnionState == HasNothing);
     MOZ_ASSERT(aRv != NS_ERROR_TYPE_ERR, "Use ThrowTypeError()");
     MOZ_ASSERT(aRv != NS_ERROR_RANGE_ERR, "Use ThrowRangeError()");
     MOZ_ASSERT(!IsErrorWithMessage(), "Don't overwrite errors with message");

dom/bindings/GenerateCSS2PropertiesWebIDL.py

@@ -13,7 +13,7 @@ from mozbuild import shellutil
 # (whether camelCase, _underscorePrefixed, etc.) and the given array of
 # extended attributes.
 def generateLine(propName, extendedAttrs):
-    return "  [%s] attribute DOMString %s;\n" % (", ".join(extendedAttrs),
+    return "  [%s] attribute [TreatNullAs=EmptyString] DOMString %s;\n" % (", ".join(extendedAttrs),
                                                  propName)
 def generate(output, idlFilename, preprocessorHeader):
     print(idlFilename)
@@ -30,7 +30,7 @@ def generate(output, idlFilename, preprocessorHeader):
             continue
         # Unfortunately, even some of the getters here are fallible
         # (e.g. on nsComputedDOMStyle).
-        extendedAttrs = ["Throws", "TreatNullAs=EmptyString"]
+        extendedAttrs = ["Throws"]
         if pref is not "":
             extendedAttrs.append('Pref="%s"' % pref)
 

dom/cache/Cache.cpp

@@ -311,7 +311,7 @@ Cache::MatchAll(JSContext* aCx, const Optional<RequestOrUSVString>& aRequest,
 
 already_AddRefed<Promise>
 Cache::Add(JSContext* aContext, const RequestOrUSVString& aRequest,
-           ErrorResult& aRv)
+           CallerType aCallerType, ErrorResult& aRv)
 {
   if (NS_WARN_IF(!mActor)) {
     aRv.Throw(NS_ERROR_UNEXPECTED);
@@ -341,12 +341,13 @@ Cache::Add(JSContext* aContext, const RequestOrUSVString& aRequest,
   }
 
   requestList.AppendElement(Move(request));
-  return AddAll(global, Move(requestList), aRv);
+  return AddAll(global, Move(requestList), aCallerType, aRv);
 }
 
 already_AddRefed<Promise>
 Cache::AddAll(JSContext* aContext,
               const Sequence<OwningRequestOrUSVString>& aRequestList,
+              CallerType aCallerType,
               ErrorResult& aRv)
 {
   if (NS_WARN_IF(!mActor)) {
@@ -390,7 +391,7 @@ Cache::AddAll(JSContext* aContext,
     requestList.AppendElement(Move(request));
   }
 
-  return AddAll(global, Move(requestList), aRv);
+  return AddAll(global, Move(requestList), aCallerType, aRv);
 }
 
 already_AddRefed<Promise>
@@ -579,7 +580,8 @@ Cache::ExecuteOp(AutoChildOpArgs& aOpArgs, ErrorResult& aRv)
 
 already_AddRefed<Promise>
 Cache::AddAll(const GlobalObject& aGlobal,
-              nsTArray<RefPtr<Request>>&& aRequestList, ErrorResult& aRv)
+              nsTArray<RefPtr<Request>>&& aRequestList,
+              CallerType aCallerType, ErrorResult& aRv)
 {
   MOZ_DIAGNOSTIC_ASSERT(mActor);
 
@@ -605,7 +607,7 @@ Cache::AddAll(const GlobalObject& aGlobal,
     RequestOrUSVString requestOrString;
     requestOrString.SetAsRequest() = aRequestList[i];
     RefPtr<Promise> fetch = FetchRequest(mGlobal, requestOrString,
-                                           RequestInit(), aRv);
+                                         RequestInit(), aCallerType, aRv);
     if (NS_WARN_IF(aRv.Failed())) {
       return nullptr;
     }

dom/cache/Cache.h

@@ -28,6 +28,7 @@ class RequestOrUSVString;
 class Response;
 template<typename T> class Optional;
 template<typename T> class Sequence;
+enum class CallerType : uint32_t;
 
 namespace cache {
 
@@ -50,10 +51,11 @@ public:
            const CacheQueryOptions& aOptions, ErrorResult& aRv);
   already_AddRefed<Promise>
   Add(JSContext* aContext, const RequestOrUSVString& aRequest,
-      ErrorResult& aRv);
+      CallerType aCallerType, ErrorResult& aRv);
   already_AddRefed<Promise>
   AddAll(JSContext* aContext,
-         const Sequence<OwningRequestOrUSVString>& aRequests, ErrorResult& aRv);
+         const Sequence<OwningRequestOrUSVString>& aRequests,
+         CallerType aCallerType, ErrorResult& aRv);
   already_AddRefed<Promise>
   Put(JSContext* aCx, const RequestOrUSVString& aRequest, Response& aResponse,
       ErrorResult& aRv);
@@ -97,7 +99,7 @@ private:
 
   already_AddRefed<Promise>
   AddAll(const GlobalObject& aGlobal, nsTArray<RefPtr<Request>>&& aRequestList,
-         ErrorResult& aRv);
+         CallerType aCallerType, ErrorResult& aRv);
 
   already_AddRefed<Promise>
   PutAll(JSContext* aCx, const nsTArray<RefPtr<Request>>& aRequestList,

dom/canvas/CanvasRenderingContext2D.cpp

@@ -4356,6 +4356,9 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
     textToDraw.Truncate();
   }
 
+  // This is only needed to know if we can know the drawing bounding box easily.
+  const bool doCalculateBounds = NeedToCalculateBounds();
+  
   // for now, default to ltr if not in doc
   bool isRTL = false;
 
@@ -4376,8 +4379,6 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
     isRTL = GET_BIDI_OPTION_DIRECTION(document->GetBidiOptions()) == IBMBIDI_TEXTDIRECTION_RTL;
   }
 
-  // This is only needed to know if we can know the drawing bounding box easily.
-  const bool doCalculateBounds = NeedToCalculateBounds();
   if (presShell->IsDestroying()) {
     return NS_ERROR_FAILURE;
   }

dom/canvas/CanvasRenderingContext2D.h

@@ -890,7 +890,9 @@ protected:
    * last call to UpdateFilter and now.
    */
   const gfx::FilterDescription& EnsureUpdatedFilter() {
-    bool isWriteOnly = mCanvasElement && mCanvasElement->IsWriteOnly();
+    bool isWriteOnly = IsWriteOnly() ||
+                       (mCanvasElement && mCanvasElement->IsWriteOnly()) ||
+                       (mOffscreenCanvas && mOffscreenCanvas->IsWriteOnly());
     if (CurrentState().filterSourceGraphicTainted != isWriteOnly) {
       UpdateFilter();
       EnsureTarget();

dom/console/Console.cpp

@@ -753,6 +753,7 @@ private:
     }
 
     Sequence<JS::Value> arguments;
+    SequenceRooter<JS::Value> rooter(aCx, &arguments);
 
     for (uint32_t i = 0; i < length; ++i) {
       JS::Rooted<JS::Value> value(aCx);

dom/crypto/WebCryptoTask.cpp

@@ -1118,6 +1118,11 @@ public:
       }
 
       mSaltLength = params.mSaltLength;
+      // Reject absurdly large salt values.
+      if (mSaltLength > 8192) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
     } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_ECDSA)) {
       mAlgorithm = Algorithm::ECDSA;
       CHECK_KEY_ALGORITHM(aKey.Algorithm(), WEBCRYPTO_ALG_ECDSA);

dom/events/EventListenerManager.cpp

@@ -1632,8 +1632,12 @@ EventListenerManager::GetTypedEventHandler(nsIAtom* aEventName,
 
   JSEventHandler* jsEventHandler = listener->GetJSEventHandler();
 
+  Maybe<RefPtr<JSEventHandler>> pin;
   if (listener->mHandlerIsString) {
-    CompileEventHandlerInternal(listener, nullptr, nullptr);
+    pin.emplace(jsEventHandler);
+    if (NS_FAILED(CompileEventHandlerInternal(listener, nullptr, nullptr))) {
+      listener = nullptr;
+    }
   }
 
   const TypedEventHandler& typedHandler =

dom/fetch/Fetch.cpp

@@ -21,6 +21,7 @@
 #include "nsProxyRelease.h"
 
 #include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/BodyUtil.h"
 #include "mozilla/dom/DOMError.h"
 #include "mozilla/dom/Exceptions.h"
@@ -317,7 +318,7 @@ public:
 
 already_AddRefed<Promise>
 FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
-             const RequestInit& aInit, ErrorResult& aRv)
+             const RequestInit& aInit, CallerType aCallerType, ErrorResult& aRv)
 {
   RefPtr<Promise> p = Promise::Create(aGlobal, aRv);
   if (NS_WARN_IF(aRv.Failed())) {
@@ -325,12 +326,10 @@ FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
   }
 
   // Double check that we have chrome privileges if the Request's content
-  // policy type has been overridden.  Note, we must do this before
-  // entering the global below.  Otherwise the IsCallerChrome() will
-  // always fail.
+  // policy type has been overridden.
   MOZ_ASSERT_IF(aInput.IsRequest() &&
                 aInput.GetAsRequest().IsContentPolicyTypeOverridden(),
-                nsContentUtils::IsCallerChrome());
+                aCallerType == CallerType::System);
 
   AutoJSAPI jsapi;
   if (!jsapi.Init(aGlobal)) {

dom/fetch/Fetch.h

@@ -35,6 +35,7 @@ class InternalRequest;
 class OwningBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString;
 struct ReadableStream;
 class RequestOrUSVString;
+enum class CallerType : uint32_t;
 
 namespace workers {
 class WorkerPrivate;
@@ -42,7 +43,8 @@ class WorkerPrivate;
 
 already_AddRefed<Promise>
 FetchRequest(nsIGlobalObject* aGlobal, const RequestOrUSVString& aInput,
-             const RequestInit& aInit, ErrorResult& aRv);
+             const RequestInit& aInit, CallerType aCallerType,
+             ErrorResult& aRv);
 
 nsresult
 UpdateRequestReferrer(nsIGlobalObject* aGlobal, InternalRequest* aRequest);

dom/html/HTMLAllCollection.cpp

@@ -162,42 +162,7 @@ HTMLAllCollection::NamedGetter(const nsAString& aID,
 void
 HTMLAllCollection::GetSupportedNames(nsTArray<nsString>& aNames)
 {
-  // XXXbz this is very similar to nsContentList::GetSupportedNames,
-  // but has to check IsAllNamedElement for the name case.
-  AutoTArray<nsIAtom*, 8> atoms;
-  for (uint32_t i = 0; i < Length(); ++i) {
-    nsIContent *content = Item(i);
-    if (content->HasID()) {
-      nsIAtom* id = content->GetID();
-      MOZ_ASSERT(id != nsGkAtoms::_empty,
-                 "Empty ids don't get atomized");
-      if (!atoms.Contains(id)) {
-        atoms.AppendElement(id);
-      }
-    }
-
-    nsGenericHTMLElement* el = nsGenericHTMLElement::FromContent(content);
-    if (el) {
-      // Note: nsINode::HasName means the name is exposed on the document,
-      // which is false for options, so we don't check it here.
-      const nsAttrValue* val = el->GetParsedAttr(nsGkAtoms::name);
-      if (val && val->Type() == nsAttrValue::eAtom &&
-          IsAllNamedElement(content)) {
-        nsIAtom* name = val->GetAtomValue();
-        MOZ_ASSERT(name != nsGkAtoms::_empty,
-                   "Empty names don't get atomized");
-        if (!atoms.Contains(name)) {
-          atoms.AppendElement(name);
-        }
-      }
-    }
-  }
-
-  uint32_t atomsLen = atoms.Length();
-  nsString* names = aNames.AppendElements(atomsLen);
-  for (uint32_t i = 0; i < atomsLen; ++i) {
-    atoms[i]->ToString(names[i]);
-  }
+  Collection()->GetSupportedNames(aNames, IsAllNamedElement);
 }
 
 

dom/html/HTMLInputElement.cpp

@@ -3590,7 +3590,7 @@ HTMLInputElement::Blur(ErrorResult& aError)
 } 
 
 void
-HTMLInputElement::Focus(ErrorResult& aError)
+HTMLInputElement::Focus(const FocusOptions& aOptions, ErrorResult& aError)
 {
   if (mType == NS_FORM_INPUT_NUMBER) {
     // Focus our anonymous text control, if we have one.
@@ -3600,7 +3600,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
       RefPtr<HTMLInputElement> textControl =
         numberControlFrame->GetAnonTextControl();
       if (textControl) {
-        textControl->Focus(aError);
+        textControl->Focus(aOptions, aError);
         return;
       }
     }
@@ -3616,7 +3616,7 @@ HTMLInputElement::Focus(ErrorResult& aError)
   }
 
   if (mType != NS_FORM_INPUT_FILE) {
-    nsGenericHTMLElement::Focus(aError);
+    nsGenericHTMLElement::Focus(aOptions, aError);
     return;
   }
 

dom/html/HTMLInputElement.h

@@ -134,7 +134,8 @@ public:
   virtual int32_t TabIndexDefault() override;
   using nsGenericHTMLElement::Focus;
   virtual void Blur(ErrorResult& aError) override;
-  virtual void Focus(ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   // nsINode
 #if !defined(XP_MACOSX)

dom/html/HTMLLabelElement.cpp

@@ -93,14 +93,15 @@ HTMLLabelElement::GetForm() const
 }
 
 void
-HTMLLabelElement::Focus(ErrorResult& aError)
+HTMLLabelElement::Focus(const FocusOptions& aOptions,
+                        ErrorResult& aError)
 {
   // retarget the focus method at the for content
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
   if (fm) {
     nsCOMPtr<nsIDOMElement> elem = do_QueryObject(GetLabeledElement());
     if (elem)
-      fm->SetFocus(elem, 0);
+      fm->SetFocus(elem, nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions));
   }
 }
 

dom/html/HTMLLabelElement.h

@@ -56,7 +56,8 @@ public:
   }
 
   using nsGenericHTMLElement::Focus;
-  virtual void Focus(mozilla::ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   virtual bool IsDisabled() const override { return false; }
 

dom/html/HTMLLegendElement.cpp

@@ -86,7 +86,8 @@ HTMLLegendElement::UnbindFromTree(bool aDeep, bool aNullParent)
 }
 
 void
-HTMLLegendElement::Focus(ErrorResult& aError)
+HTMLLegendElement::Focus(const FocusOptions& aOptions,
+                         ErrorResult& aError)
 {
   nsIFrame* frame = GetPrimaryFrame();
   if (!frame) {
@@ -95,7 +96,7 @@ HTMLLegendElement::Focus(ErrorResult& aError)
 
   int32_t tabIndex;
   if (frame->IsFocusable(&tabIndex, false)) {
-    nsGenericHTMLElement::Focus(aError);
+    nsGenericHTMLElement::Focus(aOptions, aError);
     return;
   }
 
@@ -108,7 +109,8 @@ HTMLLegendElement::Focus(ErrorResult& aError)
 
   nsCOMPtr<nsIDOMElement> result;
   aError = fm->MoveFocus(nullptr, this, nsIFocusManager::MOVEFOCUS_FORWARD,
-                         nsIFocusManager::FLAG_NOPARENTFRAME,
+                         nsIFocusManager::FLAG_NOPARENTFRAME |
+                         nsFocusManager::FocusOptionsToFocusManagerFlags(aOptions),
                          getter_AddRefs(result));
 }
 
@@ -116,9 +118,10 @@ bool
 HTMLLegendElement::PerformAccesskey(bool aKeyCausesActivation,
                                     bool aIsTrustedEvent)
 {
-  // just use the same behaviour as the focus method
+  FocusOptions options;
   ErrorResult rv;
-  Focus(rv);
+
+  Focus(options, rv);
   return NS_SUCCEEDED(rv.StealNSResult());
 }
 

dom/html/HTMLLegendElement.h

@@ -24,7 +24,8 @@ public:
   NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLLegendElement, legend)
 
   using nsGenericHTMLElement::Focus;
-  virtual void Focus(ErrorResult& aError) override;
+  virtual void Focus(const FocusOptions& aOptions,
+                     ErrorResult& aError) override;
 
   virtual bool PerformAccesskey(bool aKeyCausesActivation,
                                 bool aIsTrustedEvent) override;

dom/html/TextTrackManager.cpp

@@ -211,6 +211,7 @@ TextTrackManager::AddCues(TextTrack* aTextTrack)
     for (uint32_t i = 0; i < cueList->Length(); ++i) {
       mNewCues->AddCue(*cueList->IndexedGetter(i, dummy));
     }
+    RefPtr<TextTrackManager> kungFuDeathGrip(this);
     DispatchTimeMarchesOn();
   }
 }
@@ -236,6 +237,7 @@ TextTrackManager::RemoveTextTrack(TextTrack* aTextTrack, bool aPendingListOnly)
     for (uint32_t i = 0; i < removeCueList->Length(); ++i) {
       mNewCues->RemoveCue(*((*removeCueList)[i]));
     }
+    RefPtr<TextTrackManager> kungFuDeathGrip(this);
     DispatchTimeMarchesOn();
   }
 }
@@ -305,6 +307,7 @@ TextTrackManager::NotifyCueAdded(TextTrackCue& aCue)
   if (mNewCues) {
     mNewCues->AddCue(aCue);
   }
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
 }
 
@@ -315,6 +318,7 @@ TextTrackManager::NotifyCueRemoved(TextTrackCue& aCue)
   if (mNewCues) {
     mNewCues->RemoveCue(aCue);
   }
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
   if (aCue.GetActive()) {
     // We remove an active cue, need to update the display.
@@ -824,6 +828,7 @@ TextTrackManager::NotifyCueUpdated(TextTrackCue *aCue)
 {
   // TODO: Add/Reorder the cue to mNewCues if we have some optimization?
   WEBVTT_LOG("NotifyCueUpdated");
+  RefPtr<TextTrackManager> kungFuDeathGrip(this);
   DispatchTimeMarchesOn();
 }
 

dom/html/nsGenericHTMLElement.cpp

@@ -150,8 +150,9 @@ public:
     // If something is focused in the same document, ignore autofocus.
     if (!fm->GetFocusedContent() ||
         fm->GetFocusedContent()->OwnerDoc() != document) {
-      mozilla::ErrorResult rv;
-      mElement->Focus(rv);
+      FocusOptions options;
+      ErrorResult rv;
+      mElement->Focus(options, rv);
       return rv.StealNSResult();
     }
 

dom/html/nsGenericHTMLElement.h

@@ -434,8 +434,9 @@ public:
     return rv.StealNSResult();
   }
   NS_IMETHOD Focus() final override {
+    mozilla::dom::FocusOptions options;
     mozilla::ErrorResult rv;
-    Focus(rv);
+    Focus(options, rv);
     return rv.StealNSResult();
   }
   NS_IMETHOD GetDraggable(bool* aDraggable) final override {

dom/mathml/MathMLElement.cpp

@@ -4,10 +4,12 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "nsMathMLElement.h"
+#include "mozilla/dom/MathMLElement.h"
+
 #include "base/compiler_specific.h"
 #include "mozilla/ArrayUtils.h"
 #include "nsGkAtoms.h"
+#include "nsIContentInlines.h"
 #include "nsITableCellLayout.h" // for MAX_COLSPAN / MAX_ROWSPAN
 #include "nsCRT.h"
 #include "nsLayoutStylesheetCache.h"
@@ -26,7 +28,8 @@
 
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/EventStates.h"
-#include "mozilla/dom/ElementBinding.h"
+#include "mozilla/EventListenerManager.h" // for EventListenerManager
+#include "mozilla/dom/MathMLElementBinding.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -34,7 +37,7 @@ using namespace mozilla::dom;
 //----------------------------------------------------------------------
 // nsISupports methods:
 
-NS_IMPL_ISUPPORTS_INHERITED(nsMathMLElement, nsMathMLElementBase,
+NS_IMPL_ISUPPORTS_INHERITED(MathMLElement, MathMLElementBase,
                             nsIDOMElement, nsIDOMNode, Link)
 
 static nsresult
@@ -75,28 +78,28 @@ ReportParseErrorNoTag(const nsString& aValue,
                          "AttributeParsingErrorNoTag", argv, 2);
 }
 
-nsMathMLElement::nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-: nsMathMLElementBase(aNodeInfo),
+MathMLElement::MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+: MathMLElementBase(aNodeInfo),
   ALLOW_THIS_IN_INITIALIZER_LIST(Link(this)),
   mIncrementScriptLevel(false)
 {
 }
 
-nsMathMLElement::nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
-: nsMathMLElementBase(aNodeInfo),
+MathMLElement::MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
+: MathMLElementBase(aNodeInfo),
   ALLOW_THIS_IN_INITIALIZER_LIST(Link(this)),
   mIncrementScriptLevel(false)
 {
 }
 
 nsresult
-nsMathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
-                            nsIContent* aBindingParent,
-                            bool aCompileEventHandlers)
+MathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                          nsIContent* aBindingParent,
+                          bool aCompileEventHandlers)
 {
   Link::ResetLinkState(false, Link::ElementHasHref());
 
-  nsresult rv = nsMathMLElementBase::BindToTree(aDocument, aParent,
+  nsresult rv = MathMLElementBase::BindToTree(aDocument, aParent,
                                                 aBindingParent,
                                                 aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -130,7 +133,7 @@ nsMathMLElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
 }
 
 void
-nsMathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
+MathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   // If this link is ever reinserted into a document, it might
   // be under a different xml:base, so forget the cached state now.
@@ -141,14 +144,14 @@ nsMathMLElement::UnbindFromTree(bool aDeep, bool aNullParent)
     doc->UnregisterPendingLinkUpdate(this);
   }
 
-  nsMathMLElementBase::UnbindFromTree(aDeep, aNullParent);
+  MathMLElementBase::UnbindFromTree(aDeep, aNullParent);
 }
 
 bool
-nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult)
+MathMLElement::ParseAttribute(int32_t aNamespaceID,
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult)
 {
   MOZ_ASSERT(IsMathMLElement());
   if (aNamespaceID == kNameSpaceID_None) {
@@ -166,6 +169,9 @@ nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
         aAttribute == nsGkAtoms::mathbackground_) {
       return aResult.ParseColor(aValue);
     }
+    if (aAttribute == nsGkAtoms::tabindex) {
+      return aResult.ParseIntValue(aValue);
+    }
     if (mNodeInfo->Equals(nsGkAtoms::mtd_)) {
       if (aAttribute == nsGkAtoms::columnspan_) {
         aResult.ParseClampedNonNegativeInt(aValue, 1, 1, MAX_COLSPAN);
@@ -178,8 +184,8 @@ nsMathMLElement::ParseAttribute(int32_t aNamespaceID,
     }
   }
 
-  return nsMathMLElementBase::ParseAttribute(aNamespaceID, aAttribute,
-                                             aValue, aResult);
+  return MathMLElementBase::ParseAttribute(aNamespaceID, aAttribute,
+                                           aValue, aResult);
 }
 
 static Element::MappedAttributeEntry sMtableStyles[] = {
@@ -218,7 +224,7 @@ static Element::MappedAttributeEntry sDirStyles[] = {
 };
 
 bool
-nsMathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
+MathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 {
   MOZ_ASSERT(IsMathMLElement());
 
@@ -287,7 +293,7 @@ nsMathMLElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 }
 
 nsMapRuleToAttributesFunc
-nsMathMLElement::GetAttributeMappingFunction() const
+MathMLElement::GetAttributeMappingFunction() const
 {
   // It doesn't really matter what our tag is here, because only attributes
   // that satisfy IsAttributeMapped will be stored in the mapped attributes
@@ -296,9 +302,9 @@ nsMathMLElement::GetAttributeMappingFunction() const
 }
 
 /* static */ bool
-nsMathMLElement::ParseNamedSpaceValue(const nsString& aString,
-                                      nsCSSValue&     aCSSValue,
-                                      uint32_t        aFlags)
+MathMLElement::ParseNamedSpaceValue(const nsString& aString,
+                                    nsCSSValue&     aCSSValue,
+                                    uint32_t        aFlags)
 {
    int32_t i = 0;
    // See if it is one of the 'namedspace' (ranging -7/18em, -6/18, ... 7/18em)
@@ -378,10 +384,10 @@ nsMathMLElement::ParseNamedSpaceValue(const nsString& aString,
 //   number)"
 //
 /* static */ bool
-nsMathMLElement::ParseNumericValue(const nsString& aString,
-                                   nsCSSValue&     aCSSValue,
-                                   uint32_t        aFlags,
-                                   nsIDocument*    aDocument)
+MathMLElement::ParseNumericValue(const nsString& aString,
+                                 nsCSSValue&     aCSSValue,
+                                 uint32_t        aFlags,
+                                 nsIDocument*    aDocument)
 {
   nsAutoString str(aString);
   str.CompressWhitespace(); // aString is const in this code...
@@ -429,6 +435,13 @@ nsMathMLElement::ParseNumericValue(const nsString& aString,
     number.Append(c);
   }
 
+  if (gotDot && str[i - 1] == '.') {
+    if (!(aFlags & PARSE_SUPPRESS_WARNINGS)) {
+      ReportLengthParseError(aString, aDocument);
+    }
+    return false;  // Number ending with a dot.
+  }
+
   // Convert number to floating point
   nsresult errorCode;
   float floatValue = number.ToFloat(&errorCode);
@@ -499,8 +512,8 @@ nsMathMLElement::ParseNumericValue(const nsString& aString,
 }
 
 void
-nsMathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
-                                         nsRuleData* aData)
+MathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
+                                       nsRuleData* aData)
 {
   if (aData->mSIDs & NS_STYLE_INHERIT_BIT(Font)) {
     // scriptsizemultiplier
@@ -918,7 +931,7 @@ nsMathMLElement::MapMathMLAttributesInto(const nsMappedAttributes* aAttributes,
 }
 
 nsresult
-nsMathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
+MathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 {
   nsresult rv = Element::GetEventTargetParent(aVisitor);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -927,30 +940,30 @@ nsMathMLElement::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 }
 
 nsresult
-nsMathMLElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
+MathMLElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
 {
   return PostHandleEventForLinks(aVisitor);
 }
 
-NS_IMPL_ELEMENT_CLONE(nsMathMLElement)
+NS_IMPL_ELEMENT_CLONE(MathMLElement)
 
 EventStates
-nsMathMLElement::IntrinsicState() const
+MathMLElement::IntrinsicState() const
 {
-  return Link::LinkState() | nsMathMLElementBase::IntrinsicState() |
+  return Link::LinkState() | MathMLElementBase::IntrinsicState() |
     (mIncrementScriptLevel ?
        NS_EVENT_STATE_INCREMENT_SCRIPT_LEVEL : EventStates());
 }
 
 bool
-nsMathMLElement::IsNodeOfType(uint32_t aFlags) const
+MathMLElement::IsNodeOfType(uint32_t aFlags) const
 {
   return !(aFlags & ~eCONTENT);
 }
 
 void
-nsMathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
-                                         bool aNotify)
+MathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
+                                       bool aNotify)
 {
   if (aIncrementScriptLevel == mIncrementScriptLevel)
     return;
@@ -961,26 +974,55 @@ nsMathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
   UpdateState(true);
 }
 
-bool
-nsMathMLElement::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
+int32_t
+MathMLElement::TabIndexDefault()
 {
   nsCOMPtr<nsIURI> uri;
-  if (IsLink(getter_AddRefs(uri))) {
+  return IsLink(getter_AddRefs(uri)) ? 0 : -1;
+}
+
+// XXX Bug 1586011: Share logic with other element classes.
+bool
+MathMLElement::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
+{
+  nsIDocument* doc = GetComposedDoc();
+  if (!doc || doc->HasFlag(NODE_IS_EDITABLE)) {
+    // In designMode documents we only allow focusing the document.
     if (aTabIndex) {
-      *aTabIndex = ((sTabFocusModel & eTabFocus_linksMask) == 0 ? -1 : 0);
+      *aTabIndex = -1;
     }
-    return true;
+    return false;
   }
 
+  int32_t tabIndex = TabIndex();
   if (aTabIndex) {
+    *aTabIndex = tabIndex;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  if (!IsLink(getter_AddRefs(uri))) {
+    // If a tabindex is specified at all we're focusable
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::tabindex);
+  }
+
+  // Links that are in an editable region should never be focusable, even if
+  // they are in a contenteditable="false" region.
+  if (nsContentUtils::IsNodeInEditableRegion(this)) {
+    if (aTabIndex) {
+      *aTabIndex = -1;
+    }
+    return false;
+  }
+
+  if (aTabIndex && (sTabFocusModel & eTabFocus_linksMask) == 0) {
     *aTabIndex = -1;
   }
 
-  return false;
+  return true;
 }
 
 bool
-nsMathMLElement::IsLink(nsIURI** aURI) const
+MathMLElement::IsLink(nsIURI** aURI) const
 {
   // http://www.w3.org/TR/2010/REC-MathML3-20101021/chapter6.html#interf.link
   // The REC says that the following elements should not be linking elements:
@@ -1051,7 +1093,7 @@ nsMathMLElement::IsLink(nsIURI** aURI) const
 }
 
 void
-nsMathMLElement::GetLinkTarget(nsAString& aTarget)
+MathMLElement::GetLinkTarget(nsAString& aTarget)
 {
   const nsAttrValue* target = mAttrsAndChildren.GetAttr(nsGkAtoms::target,
                                                         kNameSpaceID_XLink);
@@ -1077,14 +1119,59 @@ nsMathMLElement::GetLinkTarget(nsAString& aTarget)
 }
 
 already_AddRefed<nsIURI>
-nsMathMLElement::GetHrefURI() const
+MathMLElement::GetHrefURI() const
 {
   nsCOMPtr<nsIURI> hrefURI;
   return IsLink(getter_AddRefs(hrefURI)) ? hrefURI.forget() : nullptr;
 }
 
+// XXX Bug 1586014: Share logic with other element classes.
+void
+MathMLElement::RecompileScriptEventListeners() {
+  int32_t i, count = mAttrsAndChildren.AttrCount();
+  for (i = 0; i < count; ++i) {
+    const nsAttrName* name = mAttrsAndChildren.AttrNameAt(i);
+
+    // Eventlistenener-attributes are always in the null namespace
+    if (!name->IsAtom()) {
+      continue;
+    }
+
+    nsIAtom* attr = name->Atom();
+    if (!IsEventAttributeName(attr)) {
+      continue;
+    }
+
+    nsAutoString value;
+    GetAttr(kNameSpaceID_None, attr, value);
+    SetEventHandler(attr, value, true);
+  }
+}
+
+bool
+MathMLElement::IsEventAttributeNameInternal(nsIAtom* aName) {
+  // The intent is to align MathML event attributes on HTML5, so the flag
+  // EventNameType_HTML is used here.
+  return nsContentUtils::IsEventAttributeName(aName, EventNameType_HTML);
+}
+
 nsresult
-nsMathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+MathMLElement::BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+                             const nsAttrValueOrString* aValue,
+                             bool aNotify) {
+  if (aNamespaceID == kNameSpaceID_None) {
+    if (!aValue && IsEventAttributeName(aName)) {
+      if (EventListenerManager* manager = GetExistingListenerManager()) {
+        manager->RemoveEventHandler(aName, EmptyString());
+      }
+    }
+  }
+
+  return MathMLElementBase::BeforeSetAttr(aNamespaceID, aName, aValue, aNotify);
+}
+
+nsresult
+MathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                               const nsAttrValue* aValue,
                               const nsAttrValue* aOldValue,
                               nsIPrincipal* aSubjectPrincipal,
@@ -1105,13 +1192,22 @@ nsMathMLElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
     Link::ResetLinkState(aNotify, aValue || Link::ElementHasHref());
   }
 
-  return nsMathMLElementBase::AfterSetAttr(aNameSpaceID, aName, aValue,
-                                           aOldValue, aSubjectPrincipal,
-                                           aNotify);
+  if (aNameSpaceID == kNameSpaceID_None) {
+    if (IsEventAttributeName(aName) && aValue) {
+      MOZ_ASSERT(aValue->Type() == nsAttrValue::eString,
+                 "Expected string value for script body");
+      nsresult rv = SetEventHandler(aName, aValue->GetStringValue());
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+  }
+
+  return MathMLElementBase::AfterSetAttr(aNameSpaceID, aName, aValue,
+                                         aOldValue, aSubjectPrincipal,
+                                         aNotify);
 }
 
 JSObject*
-nsMathMLElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
+MathMLElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
-  return ElementBinding::Wrap(aCx, this, aGivenProto);
+  return MathMLElementBinding::Wrap(aCx, this, aGivenProto);
 }

dom/mathml/MathMLElement.h

@@ -3,8 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef nsMathMLElement_h
-#define nsMathMLElement_h
+#ifndef mozilla_dom_MathMLElement_h_
+#define mozilla_dom_MathMLElement_h_
 
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/ElementInlines.h"
@@ -15,28 +15,30 @@
 
 class nsCSSValue;
 
-typedef nsMappedAttributeElement nsMathMLElementBase;
-
 namespace mozilla {
 class EventChainPostVisitor;
 class EventChainPreVisitor;
-} // namespace mozilla
+namespace dom {
+
+typedef nsMappedAttributeElement MathMLElementBase;
 
 /*
  * The base class for MathML elements.
  */
-class nsMathMLElement final : public nsMathMLElementBase,
-                              public nsIDOMElement,
-                              public mozilla::dom::Link
+class MathMLElement final : public MathMLElementBase,
+                            public nsIDOMElement,
+                            public mozilla::dom::Link
 {
 public:
-  explicit nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
-  explicit nsMathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
+  explicit MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit MathMLElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-  // Implementation of nsISupports is inherited from nsMathMLElementBase
+  // Implementation of nsISupports is inherited from MathMLElementBase
   NS_DECL_ISUPPORTS_INHERITED
 
-  // Forward implementations of parent interfaces of nsMathMLElement to 
+  NS_IMPL_FROMCONTENT(MathMLElement, kNameSpaceID_MathML)
+
+  // Forward implementations of parent interfaces of MathMLElement to 
   // our base class
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
@@ -88,6 +90,7 @@ public:
     return mIncrementScriptLevel;
   }
 
+  int32_t TabIndexDefault() final;
   virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse) override;
   virtual bool IsLink(nsIURI** aURI) const override;
   virtual void GetLinkTarget(nsAString& aTarget) override;
@@ -95,11 +98,16 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() override { return this; }
 
+  void RecompileScriptEventListeners() override;
+  bool IsEventAttributeNameInternal(nsIAtom* aName);
+
 protected:
-  virtual ~nsMathMLElement() {}
+  virtual ~MathMLElement() {}
 
   virtual JSObject* WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) override;
 
+  nsresult BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+                         const nsAttrValueOrString* aValue, bool aNotify) override;
   virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
@@ -110,4 +118,7 @@ private:
   bool mIncrementScriptLevel;
 };
 
-#endif // nsMathMLElement_h
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // mozilla_dom_MathMLElement_h_

dom/mathml/MathMLElementFactory.cpp

@@ -5,7 +5,7 @@
 
 #include "nsContentCreatorFunctions.h"
 #include "nsGkAtoms.h"
-#include "nsMathMLElement.h"
+#include "mozilla/dom/MathMLElement.h"
 
 using namespace mozilla::dom;
 
@@ -13,6 +13,6 @@ using namespace mozilla::dom;
 nsresult
 NS_NewMathMLElement(Element** aResult, already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
 {
-  NS_ADDREF(*aResult = new nsMathMLElement(aNodeInfo));
+  NS_ADDREF(*aResult = new MathMLElement(aNodeInfo));
   return NS_OK;
 }

dom/mathml/moz.build

@@ -3,9 +3,13 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+EXPORTS.mozilla.dom += [
+    'MathMLElement.h',
+]
+
 UNIFIED_SOURCES += [
-    'nsMathMLElement.cpp',
-    'nsMathMLElementFactory.cpp',
+    'MathMLElement.cpp',
+    'MathMLElementFactory.cpp',
 ]
 
 include('/ipc/chromium/chromium-config.mozbuild')

dom/media/MediaResource.cpp

@@ -1547,26 +1547,29 @@ void BaseMediaResource::SetLoadInBackground(bool aLoadInBackground) {
 
 void BaseMediaResource::ModifyLoadFlags(nsLoadFlags aFlags)
 {
+  RefPtr<BaseMediaResource> kungFuDeathGrip(this);
+  nsCOMPtr<nsIChannel> channel = mChannel;
+
   nsCOMPtr<nsILoadGroup> loadGroup;
-  nsresult rv = mChannel->GetLoadGroup(getter_AddRefs(loadGroup));
+  nsresult rv = channel->GetLoadGroup(getter_AddRefs(loadGroup));
   MOZ_ASSERT(NS_SUCCEEDED(rv), "GetLoadGroup() failed!");
 
   nsresult status;
-  mChannel->GetStatus(&status);
+  channel->GetStatus(&status);
 
   bool inLoadGroup = false;
   if (loadGroup) {
-    rv = loadGroup->RemoveRequest(mChannel, nullptr, status);
+    rv = loadGroup->RemoveRequest(channel, nullptr, status);
     if (NS_SUCCEEDED(rv)) {
       inLoadGroup = true;
     }
   }
 
-  rv = mChannel->SetLoadFlags(aFlags);
+  rv = channel->SetLoadFlags(aFlags);
   MOZ_ASSERT(NS_SUCCEEDED(rv), "SetLoadFlags() failed!");
 
   if (inLoadGroup) {
-    rv = loadGroup->AddRequest(mChannel, nullptr);
+    rv = loadGroup->AddRequest(channel, nullptr);
     MOZ_ASSERT(NS_SUCCEEDED(rv), "AddRequest() failed!");
   }
 }

dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp

@@ -67,7 +67,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
   } else if (aFrame->format == AV_SAMPLE_FMT_FLTP) {
     // Planar audio data. Pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    AudioDataValue** data = reinterpret_cast<AudioDataValue**>(aFrame->data);
+    AudioDataValue** data = reinterpret_cast<AudioDataValue**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = data[channel][frame];
@@ -86,7 +86,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
     // Planar audio data. Convert it from S16 to 32 bits float
     // and pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    int16_t** data = reinterpret_cast<int16_t**>(aFrame->data);
+    int16_t** data = reinterpret_cast<int16_t**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = AudioSampleToFloat(data[channel][frame]);
@@ -105,7 +105,7 @@ CopyAndPackAudio(AVFrame* aFrame, uint32_t aNumChannels, uint32_t aNumAFrames)
     // Planar audio data. Convert it from S32 to 32 bits float
     // and pack it into something we can understand.
     AudioDataValue* tmp = audio.get();
-    int32_t** data = reinterpret_cast<int32_t**>(aFrame->data);
+    int32_t** data = reinterpret_cast<int32_t**>(aFrame->extended_data);
     for (uint32_t frame = 0; frame < aNumAFrames; frame++) {
       for (uint32_t channel = 0; channel < aNumChannels; channel++) {
         *tmp++ = AudioSampleToFloat(data[channel][frame]);

dom/media/platforms/wmf/WMFVideoMFTManager.cpp

@@ -15,6 +15,7 @@
 #include "DXVA2Manager.h"
 #include "nsThreadUtils.h"
 #include "Layers.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "MediaInfo.h"
@@ -760,6 +761,10 @@ WMFVideoMFTManager::CreateBasicVideoFrame(IMFSample* aSample,
     NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
     stride = mVideoStride;
   }
+  if (stride <= 0) {
+    LOG("CreateBasicVideoFrame: invalid stride %ld", stride);
+    return E_FAIL;
+  }
 
   // YV12, planar format: [YYYY....][VVVV....][UUUU....]
   // i.e., Y, then V, then U.
@@ -782,9 +787,16 @@ WMFVideoMFTManager::CreateBasicVideoFrame(IMFSample* aSample,
   if (videoHeight % 16 != 0) {
     padding = 16 - (videoHeight % 16);
   }
-  uint32_t y_size = stride * (videoHeight + padding);
-  uint32_t v_size = stride * (videoHeight + padding) / 4;
-  uint32_t halfStride = (stride + 1) / 2;
+  mozilla::CheckedInt<uint32_t> y_size_checked =
+      mozilla::CheckedInt<uint32_t>(static_cast<uint32_t>(stride)) *
+      (videoHeight + padding);
+  if (!y_size_checked.isValid()) {
+    LOG("CreateBasicVideoFrame: plane size too large");
+    return E_FAIL;
+  }
+  uint32_t y_size = y_size_checked.value();
+  uint32_t v_size = y_size / 4;
+  uint32_t halfStride = static_cast<uint32_t>((static_cast<int64_t>(stride) + 1) / 2);
   uint32_t halfHeight = (videoHeight + 1) / 2;
   uint32_t halfWidth = (videoWidth + 1) / 2;
 

dom/media/webaudio/AudioBufferSourceNode.cpp

@@ -181,9 +181,13 @@ public:
       if (mResamplerOutRate == aOutRate) {
         return;
       }
-      if (speex_resampler_set_rate(mResampler, mBufferSampleRate, aOutRate) != RESAMPLER_ERR_SUCCESS) {
-        NS_ASSERTION(false, "speex_resampler_set_rate failed");
-        return;
+      int result = speex_resampler_set_rate(mResampler, mBufferSampleRate, aOutRate);
+      if (result != RESAMPLER_ERR_SUCCESS) {
+        WEB_AUDIO_API_LOG("speex_resampler_set_rate failed: %i", result);
+        // mResampler den_rate and num_rate might have been updated, despite
+        // the error, in which case the resampler will output zeros but
+        // still consume input.  Continue below to update mBeginProcessing
+        // for any change in resampler behavior.
       }
     }
 

dom/media/webm/WebMDemuxer.cpp

@@ -751,7 +751,7 @@ WebMDemuxer::GetNextPacket(TrackInfo::TrackType aType, MediaRawDataQueue *aSampl
     WEBM_DEBUG("push sample tstamp: %ld next_tstamp: %ld length: %ld kf: %d",
                tstamp, next_tstamp, length, isKeyframe);
     RefPtr<MediaRawData> sample;
-    if (mInfo.mVideo.HasAlpha() && alphaLength != 0) {
+    if (mInfo.mVideo.HasAlpha() && alphaData != 0) {
       sample = new MediaRawData(data, length, alphaData, alphaLength);
       if (length && !sample->Data() || (alphaLength && !sample->AlphaData())) {
         // OOM.

dom/network/UDPSocket.cpp

@@ -172,6 +172,8 @@ UDPSocket::CloseWithReason(nsresult aReason)
     return;
   }
 
+  RefPtr<UDPSocket> kungFuDeathGrip(this);
+
   if (mOpened) {
     if (mReadyState == SocketReadyState::Opening) {
       // reject openedPromise with AbortError if socket is closed without error

dom/webidl/AbstractWorker.webidl

@@ -4,7 +4,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-[NoInterfaceObject, Exposed=(Window,Worker,System)]
-interface AbstractWorker {
+[Exposed=(Window,Worker)]
+interface mixin AbstractWorker {
     attribute EventHandler onerror;
 };

dom/webidl/AnalyserNode.webidl

@@ -45,4 +45,4 @@ interface AnalyserNode : AudioNode {
 };
 
 // Mozilla extension
-AnalyserNode implements AudioNodePassThrough;
+AnalyserNode includes AudioNodePassThrough;

dom/webidl/Animatable.webidl

@@ -18,8 +18,7 @@ dictionary AnimationFilter {
   boolean subtree = false;
 };
 
-[NoInterfaceObject]
-interface Animatable {
+interface mixin Animatable {
   [Func="nsDocument::IsElementAnimateEnabled", Throws]
   Animation animate(object? keyframes,
                     optional UnrestrictedDoubleOrKeyframeAnimationOptions options);

dom/webidl/AudioBufferSourceNode.webidl

@@ -42,4 +42,4 @@ interface AudioBufferSourceNode : AudioNode {
 };
 
 // Mozilla extensions
-AudioBufferSourceNode implements AudioNodePassThrough;
+AudioBufferSourceNode includes AudioNodePassThrough;

dom/webidl/AudioNode.webidl

@@ -67,8 +67,7 @@ partial interface AudioNode {
   [ChromeOnly]
   readonly attribute unsigned long id;
 };
-[NoInterfaceObject]
-interface AudioNodePassThrough {
+interface mixin AudioNodePassThrough {
   [ChromeOnly]
   attribute boolean passThrough;
 };

dom/webidl/BiquadFilterNode.webidl

@@ -46,5 +46,5 @@ interface BiquadFilterNode : AudioNode {
 };
 
 // Mozilla extension
-BiquadFilterNode implements AudioNodePassThrough;
+BiquadFilterNode includes AudioNodePassThrough;
 

dom/webidl/Blob.webidl

@@ -27,8 +27,8 @@ interface Blob {
   //slice Blob into byte-ranged chunks
 
   [Throws]
-  Blob slice([Clamp] optional long long start,
-             [Clamp] optional long long end,
+  Blob slice(optional [Clamp] long long start,
+             optional [Clamp] long long end,
              optional DOMString contentType = "");
 
   // void close(); TODO bug 1048325

dom/webidl/BrowserElement.webidl

@@ -19,15 +19,7 @@ dictionary BrowserElementExecuteScriptOptions {
   DOMString? origin;
 };
 
-[NoInterfaceObject]
-interface BrowserElement {
-};
-
-BrowserElement implements BrowserElementCommon;
-BrowserElement implements BrowserElementPrivileged;
-
-[NoInterfaceObject]
-interface BrowserElementCommon {
+interface mixin BrowserElementCommon {
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]
@@ -60,7 +52,7 @@ interface BrowserElementCommon {
 };
 
 [NoInterfaceObject]
-interface BrowserElementPrivileged {
+interface BrowserElement {
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]
@@ -176,3 +168,6 @@ interface BrowserElementPrivileged {
   DOMRequest getWebManifest();
 
 };
+
+BrowserElement includes BrowserElementCommon;
+

dom/webidl/BrowserElementAudioChannel.webidl

@@ -29,7 +29,7 @@ interface BrowserElementAudioChannel : EventTarget {
   DOMRequest isActive();
 };
 
-partial interface BrowserElementPrivileged {
+interface mixin BrowserElementPrivileged {
   [Pure, Cached, Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]

dom/webidl/BrowserElementProxy.webidl

@@ -11,5 +11,5 @@
  ChromeOnly]
 interface BrowserElementProxy : EventTarget {
 };
-BrowserElementProxy implements BrowserElementCommon;
-BrowserElementProxy implements BrowserElementPrivileged;
+BrowserElementProxy includes BrowserElementCommon;
+BrowserElementProxy includes BrowserElementPrivileged;

dom/webidl/CSSPseudoElement.webidl

@@ -22,4 +22,4 @@ interface CSSPseudoElement {
 };
 
 // https://w3c.github.io/web-animations/#extensions-to-the-pseudoelement-interface
-CSSPseudoElement implements Animatable;
+CSSPseudoElement includes Animatable;

dom/webidl/CSSStyleDeclaration.webidl

@@ -21,7 +21,7 @@ interface CSSStyleDeclaration {
   CSSValue? getPropertyCSSValue(DOMString property);
   DOMString getPropertyPriority(DOMString property);
   [CEReactions, Throws]
-  void setProperty(DOMString property, [TreatNullAs=EmptyString] DOMString value, [TreatNullAs=EmptyString] optional DOMString priority = "");
+  void setProperty(DOMString property, [TreatNullAs=EmptyString] DOMString value, optional [TreatNullAs=EmptyString] DOMString priority = "");
   [CEReactions, Throws]
   DOMString removeProperty(DOMString property);
 

dom/webidl/Cache.webidl

@@ -17,9 +17,9 @@ interface Cache {
   Promise<Response> match(RequestInfo request, optional CacheQueryOptions options);
   [NewObject]
   Promise<sequence<Response>> matchAll(optional RequestInfo request, optional CacheQueryOptions options);
-  [NewObject]
+  [NewObject, NeedsCallerType]
   Promise<void> add(RequestInfo request);
-  [NewObject]
+  [NewObject, NeedsCallerType]
   Promise<void> addAll(sequence<RequestInfo> requests);
   [NewObject]
   Promise<void> put(RequestInfo request, Response response);

dom/webidl/CanvasRenderingContext2D.webidl

@@ -59,7 +59,7 @@ interface CanvasRenderingContext2D {
   DOMMatrix getTransform();
   [Throws, LenientFloat]
   void setTransform(double a, double b, double c, double d, double e, double f);
-  [Throws, LenientFloat]
+  [Throws]
   void setTransform(optional DOMMatrix2DInit transform);
   [Throws]
   void resetTransform();
@@ -239,11 +239,10 @@ interface CanvasRenderingContext2D {
   [ChromeOnly]
   void demote();
 };
-CanvasRenderingContext2D implements CanvasDrawingStyles;
-CanvasRenderingContext2D implements CanvasPathMethods;
+CanvasRenderingContext2D includes CanvasDrawingStyles;
+CanvasRenderingContext2D includes CanvasPathMethods;
 
-[NoInterfaceObject]
-interface CanvasDrawingStyles {
+interface mixin CanvasDrawingStyles {
   // line caps/joins
            [LenientFloat]
            attribute double lineWidth; // (default 1)
@@ -265,8 +264,7 @@ interface CanvasDrawingStyles {
            attribute DOMString textBaseline; // "top", "hanging", "middle", "alphabetic", "ideographic", "bottom" (default: "alphabetic")
 };
 
-[NoInterfaceObject]
-interface CanvasPathMethods {
+interface mixin CanvasPathMethods {
   // shared path API methods
   void closePath();
   [LenientFloat]
@@ -342,4 +340,4 @@ interface Path2D
 {
   [Throws] void addPath(Path2D path, optional DOMMatrix2DInit transformation);
 };
-Path2D implements CanvasPathMethods;
+Path2D includes CanvasPathMethods;

dom/webidl/CharacterData.webidl

@@ -11,8 +11,8 @@
  */
 
 interface CharacterData : Node {
-  [TreatNullAs=EmptyString, Pure, SetterThrows]
-  attribute DOMString data;
+  [Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString data;
   [Pure]
   readonly attribute unsigned long length;
   [Throws]
@@ -27,5 +27,5 @@ interface CharacterData : Node {
   void replaceData(unsigned long offset, unsigned long count, DOMString data);
 };
 
-CharacterData implements ChildNode;
-CharacterData implements NonDocumentTypeChildNode;
+CharacterData includes ChildNode;
+CharacterData includes NonDocumentTypeChildNode;

dom/webidl/ChildNode.webidl

@@ -7,8 +7,7 @@
  * http://dom.spec.whatwg.org/#interface-childnode
  */
 
-[NoInterfaceObject]
-interface ChildNode {
+interface mixin ChildNode {
   [CEReactions, Throws, Unscopable]
   void before((Node or DOMString)... nodes);
   [CEReactions, Throws, Unscopable]
@@ -19,8 +18,7 @@ interface ChildNode {
   void remove();
 };
 
-[NoInterfaceObject]
-interface NonDocumentTypeChildNode {
+interface mixin NonDocumentTypeChildNode {
   [Pure]
   readonly attribute Element? previousElementSibling;
   [Pure]

dom/webidl/ConvolverNode.webidl

@@ -26,5 +26,5 @@ interface ConvolverNode : AudioNode {
 };
 
 // Mozilla extension
-ConvolverNode implements AudioNodePassThrough;
+ConvolverNode includes AudioNodePassThrough;
 

dom/webidl/Crypto.webidl

@@ -7,8 +7,8 @@
  * https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#crypto-interface
  */
 
-[NoInterfaceObject, Exposed=(Window,Worker)]
-interface GlobalCrypto {
+[Exposed=(Window,Worker)]
+interface mixin GlobalCrypto {
   [Throws] readonly attribute Crypto crypto;
 };
 

dom/webidl/DOMCursor.webidl

@@ -10,4 +10,4 @@ interface DOMCursor : EventTarget {
   void continue();
 };
 
-DOMCursor implements DOMRequestShared;
+DOMCursor includes DOMRequestShared;

dom/webidl/DOMException.webidl

@@ -15,9 +15,7 @@
 
 interface StackFrame;
 
-[NoInterfaceObject,
- Exposed=(Window,Worker)]
-interface ExceptionMembers
+interface mixin ExceptionMembers
 {
   // A custom message set by the thrower.  LenientThis so it can be
   // gotten on the prototype, which Error.prototype.toString will do
@@ -68,7 +66,7 @@ interface Exception {
   stringifier;
 };
 
-Exception implements ExceptionMembers;
+Exception includes ExceptionMembers;
 
 // XXXkhuey this is an 'exception', not an interface, but we don't have any
 // parser or codegen mechanisms for dealing with exceptions.
@@ -107,4 +105,4 @@ interface DOMException {
 
 // XXXkhuey copy all of Gecko's non-standard stuff onto DOMException, but leave
 // the prototype chain sane.
-DOMException implements ExceptionMembers;
+DOMException includes ExceptionMembers;

dom/webidl/DOMRequest.webidl

@@ -5,8 +5,8 @@
 
 enum DOMRequestReadyState { "pending", "done" };
 
-[Exposed=(Window,Worker,System), NoInterfaceObject]
-interface DOMRequestShared {
+[Exposed=(Window,Worker)]
+interface mixin DOMRequestShared {
   readonly attribute DOMRequestReadyState readyState;
 
   readonly attribute any result;
@@ -26,4 +26,4 @@ interface DOMRequest : EventTarget {
            [TreatNonCallableAsNull] optional AnyCallback? rejectCallback = null);
 };
 
-DOMRequest implements DOMRequestShared;
+DOMRequest includes DOMRequestShared;

dom/webidl/DelayNode.webidl

@@ -24,5 +24,5 @@ interface DelayNode : AudioNode {
 };
 
 // Mozilla extension
-DelayNode implements AudioNodePassThrough;
+DelayNode includes AudioNodePassThrough;
 

dom/webidl/Document.webidl

@@ -155,9 +155,6 @@ partial interface Document {
 
   // Gecko extensions?
                 attribute EventHandler onwheel;
-                attribute EventHandler oncopy;
-                attribute EventHandler oncut;
-                attribute EventHandler onpaste;
                 attribute EventHandler onbeforescriptexecute;
                 attribute EventHandler onafterscriptexecute;
 
@@ -440,11 +437,12 @@ partial interface Document {
   [Func="IsChromeOrXBL"] readonly attribute boolean inlineScriptAllowedByCSP;
 };
 
-Document implements XPathEvaluator;
-Document implements GlobalEventHandlers;
-Document implements TouchEventHandlers;
-Document implements ParentNode;
-Document implements OnErrorEventHandlerForNodes;
-Document implements GeometryUtils;
-Document implements FontFaceSource;
-Document implements DocumentOrShadowRoot;
+Document includes XPathEvaluatorMixin;
+Document includes GlobalEventHandlers;
+Document includes DocumentAndElementEventHandlers;
+Document includes TouchEventHandlers;
+Document includes ParentNode;
+Document includes OnErrorEventHandlerForNodes;
+Document includes GeometryUtils;
+Document includes FontFaceSource;
+Document includes DocumentOrShadowRoot;

dom/webidl/DocumentFragment.webidl

@@ -24,4 +24,4 @@ partial interface DocumentFragment {
   NodeList  querySelectorAll(DOMString selectors);
 };
 
-DocumentFragment implements ParentNode;
+DocumentFragment includes ParentNode;

dom/webidl/DocumentOrShadowRoot.webidl

@@ -8,8 +8,7 @@
  * http://w3c.github.io/webcomponents/spec/shadow/#extensions-to-the-documentorshadowroot-mixin
  */
 
-[NoInterfaceObject]
-interface DocumentOrShadowRoot {
+interface mixin DocumentOrShadowRoot {
   // Not implemented yet: bug 1430308.
   // Selection? getSelection();
   Element? elementFromPoint (float x, float y);

dom/webidl/DocumentType.webidl

@@ -16,4 +16,4 @@ interface DocumentType : Node {
   readonly attribute DOMString systemId;
 };
 
-DocumentType implements ChildNode;
+DocumentType includes ChildNode;

dom/webidl/DynamicsCompressorNode.webidl

@@ -32,5 +32,5 @@ interface DynamicsCompressorNode : AudioNode {
 };
 
 // Mozilla extension
-DynamicsCompressorNode implements AudioNodePassThrough;
+DynamicsCompressorNode includes AudioNodePassThrough;
 

dom/webidl/Element.webidl

@@ -163,6 +163,29 @@ interface Element : Node {
   sequence<Grid> getGridFragments();
 };
 
+// https://drafts.csswg.org/cssom/#the-elementcssinlinestyle-mixin
+interface mixin ElementCSSInlineStyle {
+  [SameObject, PutForwards=cssText]
+  readonly attribute CSSStyleDeclaration style;
+};
+
+// https://html.spec.whatwg.org/#focus-management-apis
+dictionary FocusOptions {
+  boolean preventScroll = false;
+};
+
+interface mixin HTMLOrForeignElement {
+  [SameObject] readonly attribute DOMStringMap dataset;
+  // See bug 1389421
+  // attribute DOMString nonce; // intentionally no [CEReactions]
+
+  // See bug 1575154
+  // [CEReactions] attribute boolean autofocus;
+  [CEReactions, SetterThrows, Pure] attribute long tabIndex;
+  [Throws] void focus(optional FocusOptions options);
+  [Throws] void blur();
+};
+
 // http://dev.w3.org/csswg/cssom-view/
 enum ScrollLogicalPosition { "start", "center", "end", "nearest" };
 dictionary ScrollIntoViewOptions : ScrollOptions {
@@ -212,10 +235,10 @@ partial interface Element {
 
 // http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface
 partial interface Element {
-  [CEReactions, Pure,SetterThrows,TreatNullAs=EmptyString]
-  attribute DOMString innerHTML;
-  [CEReactions, Pure,SetterThrows,TreatNullAs=EmptyString]
-  attribute DOMString outerHTML;
+  [CEReactions, Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString innerHTML;
+  [CEReactions, Pure, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString outerHTML;
   [CEReactions, Throws]
   void insertAdjacentHTML(DOMString position, DOMString text);
 };
@@ -246,11 +269,11 @@ partial interface Element {
            attribute DOMString slot;
 };
 
-Element implements ChildNode;
-Element implements NonDocumentTypeChildNode;
-Element implements ParentNode;
-Element implements Animatable;
-Element implements GeometryUtils;
+Element includes ChildNode;
+Element includes NonDocumentTypeChildNode;
+Element includes ParentNode;
+Element includes Animatable;
+Element includes GeometryUtils;
 
 // https://fullscreen.spec.whatwg.org/#api
 partial interface Element {

dom/webidl/EventHandler.webidl

@@ -24,8 +24,7 @@ typedef OnBeforeUnloadEventHandlerNonNull? OnBeforeUnloadEventHandler;
 callback OnErrorEventHandlerNonNull = boolean ((Event or DOMString) event, optional DOMString source, optional unsigned long lineno, optional unsigned long column, optional any error);
 typedef OnErrorEventHandlerNonNull? OnErrorEventHandler;
 
-[NoInterfaceObject]
-interface GlobalEventHandlers {
+interface mixin GlobalEventHandlers {
            attribute EventHandler onabort;
            attribute EventHandler onblur;
 // We think the spec is wrong here. See OnErrorEventHandlerForNodes/Window
@@ -147,8 +146,7 @@ interface GlobalEventHandlers {
            attribute EventHandler onwebkittransitionend;
 };
 
-[NoInterfaceObject]
-interface WindowEventHandlers {
+interface mixin WindowEventHandlers {
            attribute EventHandler onafterprint;
            attribute EventHandler onbeforeprint;
            attribute OnBeforeUnloadEventHandler onbeforeunload;
@@ -166,17 +164,21 @@ interface WindowEventHandlers {
            attribute EventHandler onunload;
 };
 
+interface mixin DocumentAndElementEventHandlers {
+           attribute EventHandler oncopy;
+           attribute EventHandler oncut;
+           attribute EventHandler onpaste;
+};
+
 // The spec has |attribute OnErrorEventHandler onerror;| on
 // GlobalEventHandlers, and calls the handler differently depending on
 // whether an ErrorEvent was fired. We don't do that, and until we do we'll
 // need to distinguish between onerror on Window or on nodes.
 
-[NoInterfaceObject]
-interface OnErrorEventHandlerForNodes {
+interface mixin OnErrorEventHandlerForNodes {
            attribute EventHandler onerror;
 };
 
-[NoInterfaceObject]
-interface OnErrorEventHandlerForWindow {
+interface mixin OnErrorEventHandlerForWindow {
            attribute OnErrorEventHandler onerror;
 };

dom/webidl/Fetch.webidl

@@ -10,8 +10,7 @@
 typedef object JSON;
 typedef (Blob or BufferSource or FormData or URLSearchParams or USVString) BodyInit;
 
-[NoInterfaceObject, Exposed=(Window,Worker)]
-interface Body {
+interface mixin Body {
   readonly attribute boolean bodyUsed;
   [Throws]
   Promise<ArrayBuffer> arrayBuffer();

dom/webidl/FontFaceSource.webidl

@@ -10,8 +10,7 @@
  * liability, trademark and document use rules apply.
  */
 
-[NoInterfaceObject]
-interface FontFaceSource {
+interface mixin FontFaceSource {
 
   [Pref="layout.css.font-loading-api.enabled"]
   readonly attribute FontFaceSet fonts;

dom/webidl/GainNode.webidl

@@ -23,5 +23,5 @@ interface GainNode : AudioNode {
 };
 
 // Mozilla extension
-GainNode implements AudioNodePassThrough;
+GainNode includes AudioNodePassThrough;
 

dom/webidl/GeometryUtils.webidl

@@ -21,8 +21,7 @@ dictionary ConvertCoordinateOptions {
   CSSBoxType toBox = "border";
 };
 
-[NoInterfaceObject]
-interface GeometryUtils {
+interface mixin GeometryUtils {
   [Throws, Func="nsINode::HasBoxQuadsSupport"]
   sequence<DOMQuad> getBoxQuads(optional BoxQuadOptions options);
   [Throws, Pref="layout.css.convertFromNode.enabled"]
@@ -33,6 +32,6 @@ interface GeometryUtils {
   DOMPoint convertPointFromNode(DOMPointInit point, GeometryNode from, optional ConvertCoordinateOptions options);
 };
 
-// PseudoElement implements GeometryUtils;
+// PseudoElement includes GeometryUtils;
 
 typedef (Text or Element /* or PseudoElement */ or Document) GeometryNode;

dom/webidl/HTMLAnchorElement.webidl

@@ -35,7 +35,7 @@ interface HTMLAnchorElement : HTMLElement {
            attribute DOMString text;
 };
 
-HTMLAnchorElement implements HTMLHyperlinkElementUtils;
+HTMLAnchorElement includes HTMLHyperlinkElementUtils;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLAnchorElement {

dom/webidl/HTMLAppletElement.webidl

@@ -38,6 +38,6 @@ interface HTMLAppletElement : HTMLElement {
            attribute DOMString width;
 };
 
-HTMLAppletElement implements MozImageLoadingContent;
-HTMLAppletElement implements MozFrameLoaderOwner;
-HTMLAppletElement implements MozObjectLoadingContent;
+HTMLAppletElement includes MozImageLoadingContent;
+HTMLAppletElement includes MozFrameLoaderOwner;
+HTMLAppletElement includes MozObjectLoadingContent;

dom/webidl/HTMLAreaElement.webidl

@@ -35,7 +35,7 @@ interface HTMLAreaElement : HTMLElement {
   readonly attribute DOMTokenList relList;
 };
 
-HTMLAreaElement implements HTMLHyperlinkElementUtils;
+HTMLAreaElement includes HTMLHyperlinkElementUtils;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLAreaElement {

dom/webidl/HTMLBodyElement.webidl

@@ -16,18 +16,18 @@ interface HTMLBodyElement : HTMLElement {
 };
 
 partial interface HTMLBodyElement {
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString text;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString link;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString vLink;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString aLink;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString bgColor;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString text;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString link;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString vLink;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString aLink;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString bgColor;
   [CEReactions, SetterThrows]
   attribute DOMString background;
 };
 
-HTMLBodyElement implements WindowEventHandlers;
+HTMLBodyElement includes WindowEventHandlers;

dom/webidl/HTMLDocument.webidl

@@ -57,11 +57,11 @@ interface HTMLDocument : Document {
   [Throws]
   DOMString queryCommandValue(DOMString commandId);
 
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString fgColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString linkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString vlinkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString alinkColor;
-  [CEReactions, TreatNullAs=EmptyString] attribute DOMString bgColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString fgColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString linkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString vlinkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString alinkColor;
+  [CEReactions] attribute [TreatNullAs=EmptyString] DOMString bgColor;
 
   [Pure]
   readonly attribute HTMLCollection anchors;

dom/webidl/HTMLElement.webidl

@@ -22,22 +22,14 @@ interface HTMLElement : Element {
   //         attribute boolean translate;
   [CEReactions, SetterThrows, Pure]
            attribute DOMString dir;
-  [Constant]
-  readonly attribute DOMStringMap dataset;
 
-  [CEReactions, GetterThrows, Pure, TreatNullAs=EmptyString]
-           attribute DOMString innerText;
+  [CEReactions, GetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString innerText;
 
   // user interaction
   [CEReactions, SetterThrows, Pure]
            attribute boolean hidden;
   void click();
-  [CEReactions, SetterThrows, Pure]
-           attribute long tabIndex;
-  [Throws]
-  void focus();
-  [Throws]
-  void blur();
   [CEReactions, SetterThrows, Pure]
            attribute DOMString accessKey;
   [Pure]
@@ -61,15 +53,6 @@ interface HTMLElement : Element {
   //readonly attribute boolean? commandHidden;
   //readonly attribute boolean? commandDisabled;
   //readonly attribute boolean? commandChecked;
-
-  // styling
-  [PutForwards=cssText, Constant]
-  readonly attribute CSSStyleDeclaration style;
-
-  // Mozilla specific stuff
-           attribute EventHandler oncopy;
-           attribute EventHandler oncut;
-           attribute EventHandler onpaste;
 };
 
 // http://dev.w3.org/csswg/cssom-view/#extensions-to-the-htmlelement-interface
@@ -89,8 +72,7 @@ partial interface HTMLElement {
            attribute boolean scrollgrab;
 };
 
-[NoInterfaceObject]
-interface TouchEventHandlers {
+interface mixin TouchEventHandlers {
   [Func="nsGenericHTMLElement::TouchEventsEnabled"]
            attribute EventHandler ontouchstart;
   [Func="nsGenericHTMLElement::TouchEventsEnabled"]
@@ -101,8 +83,11 @@ interface TouchEventHandlers {
            attribute EventHandler ontouchcancel;
 };
 
-HTMLElement implements GlobalEventHandlers;
-HTMLElement implements TouchEventHandlers;
-HTMLElement implements OnErrorEventHandlerForNodes;
+HTMLElement includes GlobalEventHandlers;
+HTMLElement includes HTMLOrForeignElement;
+HTMLElement includes DocumentAndElementEventHandlers;
+HTMLElement includes ElementCSSInlineStyle;
+HTMLElement includes TouchEventHandlers;
+HTMLElement includes OnErrorEventHandlerForNodes;
 
 interface HTMLUnknownElement : HTMLElement {};

dom/webidl/HTMLEmbedElement.webidl

@@ -41,6 +41,6 @@ partial interface HTMLEmbedElement {
   Document? getSVGDocument();
 };
 
-HTMLEmbedElement implements MozImageLoadingContent;
-HTMLEmbedElement implements MozFrameLoaderOwner;
-HTMLEmbedElement implements MozObjectLoadingContent;
+HTMLEmbedElement includes MozImageLoadingContent;
+HTMLEmbedElement includes MozFrameLoaderOwner;
+HTMLEmbedElement includes MozObjectLoadingContent;

dom/webidl/HTMLFontElement.webidl

@@ -13,7 +13,7 @@
 
 [HTMLConstructor]
 interface HTMLFontElement : HTMLElement {
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows] attribute DOMString color;
+  [CEReactions, SetterThrows] attribute [TreatNullAs=EmptyString] DOMString color;
   [CEReactions, SetterThrows]                          attribute DOMString face;
   [CEReactions, SetterThrows]                          attribute DOMString size;
 };

dom/webidl/HTMLFrameElement.webidl

@@ -29,10 +29,10 @@ interface HTMLFrameElement : HTMLElement {
   readonly attribute Document? contentDocument;
   readonly attribute WindowProxy? contentWindow;
 
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString marginHeight;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows]
-  attribute DOMString marginWidth;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString marginHeight;
+  [CEReactions, SetterThrows]
+  attribute [TreatNullAs=EmptyString] DOMString marginWidth;
 };
 
-HTMLFrameElement implements MozFrameLoaderOwner;
+HTMLFrameElement includes MozFrameLoaderOwner;

dom/webidl/HTMLFrameSetElement.webidl

@@ -19,4 +19,4 @@ interface HTMLFrameSetElement : HTMLElement {
   attribute DOMString rows;
 };
 
-HTMLFrameSetElement implements WindowEventHandlers;
+HTMLFrameSetElement includes WindowEventHandlers;

dom/webidl/HTMLHyperlinkElementUtils.webidl

@@ -10,8 +10,7 @@
  * and create derivative works of this document.
  */
 
-[NoInterfaceObject]
-interface HTMLHyperlinkElementUtils {
+interface mixin HTMLHyperlinkElementUtils {
   // Bug 824857: no support for stringifier attributes yet.
   //  stringifier attribute USVString href;
 

dom/webidl/HTMLIFrameElement.webidl

@@ -45,10 +45,10 @@ partial interface HTMLIFrameElement {
   [CEReactions, SetterThrows, Pure]
            attribute DOMString longDesc;
 
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows, Pure]
-           attribute DOMString marginHeight;
-  [CEReactions, TreatNullAs=EmptyString, SetterThrows, Pure]
-           attribute DOMString marginWidth;
+  [CEReactions, SetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString marginHeight;
+  [CEReactions, SetterThrows, Pure]
+           attribute [TreatNullAs=EmptyString] DOMString marginWidth;
 };
 
 partial interface HTMLIFrameElement {
@@ -59,9 +59,9 @@ partial interface HTMLIFrameElement {
 
 partial interface HTMLIFrameElement {
   // nsIDOMMozBrowserFrame
-  [ChromeOnly,SetterThrows]
+  [ChromeOnly, SetterThrows]
            attribute boolean mozbrowser;
 };
 
-HTMLIFrameElement implements MozFrameLoaderOwner;
+HTMLIFrameElement includes MozFrameLoaderOwner;
 HTMLIFrameElement implements BrowserElement;

dom/webidl/HTMLImageElement.webidl

@@ -55,7 +55,7 @@ partial interface HTMLImageElement {
            [CEReactions, SetterThrows]
            attribute DOMString longDesc;
 
-  [CEReactions, TreatNullAs=EmptyString,SetterThrows] attribute DOMString border;
+  [CEReactions, SetterThrows] attribute [TreatNullAs=EmptyString] DOMString border;
 };
 
 // [Update me: not in whatwg spec yet]
@@ -77,8 +77,7 @@ partial interface HTMLImageElement {
   readonly attribute long y;
 };
 
-[NoInterfaceObject]
-interface MozImageLoadingContent {
+interface mixin MozImageLoadingContent {
   // Mirrored chrome-only nsIImageLoadingContent methods.  Please make sure
   // to update this list if nsIImageLoadingContent changes.
   [ChromeOnly]
@@ -108,4 +107,4 @@ interface MozImageLoadingContent {
   void forceImageState(boolean aForce, unsigned long long aState);
 };
 
-HTMLImageElement implements MozImageLoadingContent;
+HTMLImageElement includes MozImageLoadingContent;

dom/webidl/HTMLInputElement.webidl

@@ -89,8 +89,8 @@ interface HTMLInputElement : HTMLElement {
            attribute DOMString type;
   [CEReactions, Pure, SetterThrows]
            attribute DOMString defaultValue;
-  [CEReactions, Pure, TreatNullAs=EmptyString, Throws]
-           attribute DOMString value;
+  [CEReactions, Pure, SetterThrows]
+           attribute [TreatNullAs=EmptyString] DOMString value;
   [Throws, Func="HTMLInputElement::ValueAsDateEnabled"]
            attribute Date? valueAsDate;
   [Pure, SetterThrows]
@@ -226,14 +226,13 @@ partial interface HTMLInputElement {
   void chooseDirectory();
 };
 
-[NoInterfaceObject]
-interface MozPhonetic {
+interface mixin MozPhonetic {
   [Pure, ChromeOnly]
   readonly attribute DOMString phonetic;
 };
 
-HTMLInputElement implements MozImageLoadingContent;
-HTMLInputElement implements MozPhonetic;
+HTMLInputElement includes MozImageLoadingContent;
+HTMLInputElement includes MozPhonetic;
 
 // Webkit/Blink
 partial interface HTMLInputElement {

dom/webidl/HTMLLinkElement.webidl

@@ -36,7 +36,7 @@ interface HTMLLinkElement : HTMLElement {
            attribute DOMString referrerPolicy;
   [PutForwards=value] readonly attribute DOMTokenList sizes;
 };
-HTMLLinkElement implements LinkStyle;
+HTMLLinkElement includes LinkStyle;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLLinkElement {

dom/webidl/HTMLObjectElement.webidl

@@ -70,8 +70,8 @@ partial interface HTMLObjectElement {
   [CEReactions, Pure, SetterThrows]
            attribute DOMString codeType;
 
-  [CEReactions, TreatNullAs=EmptyString, Pure, SetterThrows]
-           attribute DOMString border;
+  [CEReactions, Pure, SetterThrows]
+           attribute [TreatNullAs=EmptyString] DOMString border;
 };
 
 partial interface HTMLObjectElement {
@@ -80,8 +80,7 @@ partial interface HTMLObjectElement {
   Document? getSVGDocument();
 };
 
-[NoInterfaceObject]
-interface MozObjectLoadingContent {
+interface mixin MozObjectLoadingContent {
   // Mirrored chrome-only scriptable nsIObjectLoadingContent methods.  Please
   // make sure to update this list if nsIObjectLoadingContent changes.  Also,
   // make sure everything on here is [ChromeOnly].
@@ -222,6 +221,6 @@ dictionary MozPluginParameter {
   DOMString value = "";
 };
 
-HTMLObjectElement implements MozImageLoadingContent;
-HTMLObjectElement implements MozFrameLoaderOwner;
-HTMLObjectElement implements MozObjectLoadingContent;
+HTMLObjectElement includes MozImageLoadingContent;
+HTMLObjectElement includes MozFrameLoaderOwner;
+HTMLObjectElement includes MozObjectLoadingContent;

dom/webidl/HTMLStyleElement.webidl

@@ -21,5 +21,5 @@ interface HTMLStyleElement : HTMLElement {
            [SetterThrows, Pure]
            attribute boolean scoped;
 };
-HTMLStyleElement implements LinkStyle;
+HTMLStyleElement includes LinkStyle;