Issue #1459 - De-templatize array accessor methods.

This removes the main class and functions for unboxed arrays.
For debugging caller purposes, a number of implementation
blocks have been replaced with MOZ_CRASH() calls.
Without using Unboxed Arrays, these should never be hit,
and if they do that's a bug.

.gitignore

@@ -49,9 +49,11 @@ js/src/autom4te.cache
 js/src/tests/results-*.html
 js/src/tests/results-*.txt
 
-# Java HTML5 parser classes
-parser/html/java/htmlparser/
-parser/html/java/javaparser/
+# Java HTML5 parser codegen artifacts
+parser/html/java/htmlparser/bin/
+parser/html/java/javaparser/bin/
+parser/html/java/*.jar
+parser/html/javasrc/
 
 # Ignore the files and directory that Eclipse IDE creates
 .project

CLOBBER

@@ -22,5 +22,5 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Clobber for NSS Update
+Clobber for incremental customElements v1 landing
 

Makefile.in

@@ -47,6 +47,12 @@ ifndef MOZ_PROFILE_USE
 # We need to explicitly put BUILD_BACKEND_FILES here otherwise the rule in
 # rules.mk doesn't run early enough.
 $(TIERS) binaries:: CLOBBER $(configure_dir)/configure config.status $(BUILD_BACKEND_FILES)
+
+# While our mozbuild backend has some kind of crazy install_manfests junk to
+# try and make this not have to happen, we actually want dist/bin to be
+# completely removed regardless.
+default alldep all::
+	@$(RM) -r $(DIST)/bin
 ifndef JS_STANDALONE
 ifdef COMPILE_ENVIRONMENT
 $(TIERS) binaries:: $(topsrcdir)/js/src/configure js/src/config.status

README.md

@@ -18,7 +18,7 @@ directory. This will contain relevant documentation regarding contributing,
 using and distributing this code and its binaries.
 
 If you are interested in the development and building side of things, some
-information will be available on the [Pale Moon developer wiki](http://developer.palemoon.org).
+information will be available on the [Pale Moon developer site](http://developer.palemoon.org).
 You are also always welcome to get in touch with our community on the [Pale Moon forum](https://forum.palemoon.org/).
 
 ### A note about trademarks and branding
@@ -34,3 +34,6 @@ and other community members.
 If you fork this repository to perform your own work on it, please consider offering
 improvement patches upstream to its origin to mutually improve the platform and build
 a future for XUL.
+
+## Looking for Pale Moon and Basilisk?
+As of [`Issue #969`](https://github.com/MoonchildProductions/UXP/issues/969), release versions `28.9.0` and `2020.03.04` respectively, they have been split off into their own dedicated repositories located at [`MoonchildProductions/Pale-Moon`](https://github.com/MoonchildProductions/Pale-Moon) and [`MoonchildProductions/Basilisk`](https://github.com/MoonchildProductions/Basilisk).

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## What is or is not a vulnerability?
+
+In general, vulnerabilities are those bugs that can actually be exploited to perform malicious tasks. 
+Most _crashes_ are not security vulnerabilities. Although important to fix, they don't inherently cause a problem for the 
+browser's security.
+
+What should be considered vulnerabilities or security hazards by default:
+- Use-after-free crashes, since those can potentially be used for remote code execution;
+- Spoofing issues in the UI;
+- File security issues, like out-of-bounds access to arbitrary files or locations;
+- Type confusion issues;
+- Bypass of security measures like CSP or the various mechanisms around HTTPS.
+
+Generally not security vulnerabilities:
+- Null dereferencing crashes;
+- Malware extensions (but please do report those on the forum in the extensions board!);
+- Denial-of-service (AKA "evil trap sites")
+- Browser hangs
+- Issues with non-standard manual configuration (either at build time or by manipulating about:config directly)
+
+## Reporting a Vulnerability
+
+If you find an issue in UXP or the applications it builds on that could impact the security or safety of users please **do not**
+make an issue on GitHub about it. GitHub does not support restricted viewability for security sensitive bugs.
+
+If you want to report a security-sensitive issue then please go to the [forum](https://forum.palemoon.org) and report the issue
+via a **private message** to **Moonchild** (the founder and prime responsible for security issues).
+The forum's private message system is fully secure since your visits are encrypted and private messages are not available to anyone
+except the recipient (not even moderators!).
+
+You will be informed via private message if the vulnerability report is accepted or declined, with reasoning.
+Security updates occur regularly and are given priority over most other development tasks. In general, they can be solved
+relatively quickly and will be included in the next point release (third digit if not rolled into a more major one).
+

accessible/base/ARIAMap.cpp

@@ -347,16 +347,6 @@ static const nsRoleMapEntry sWAIRoleMaps[] =
     eLandmark,
     kNoReqStates
   },
-  { // marquee
-    &nsGkAtoms::marquee,
-    roles::ANIMATION,
-    kUseMapRole,
-    eNoValue,
-    eNoAction,
-    eOffLiveAttr,
-    kGenericAccType,
-    kNoReqStates
-  },
   { // math
     &nsGkAtoms::math,
     roles::FLAT_EQUATION,

accessible/html/HTMLTableAccessible.cpp

@@ -175,23 +175,17 @@ HTMLTableCellAccessible::Table() const
 uint32_t
 HTMLTableCellAccessible::ColIdx() const
 {
-  nsITableCellLayout* cellLayout = GetCellLayout();
-  NS_ENSURE_TRUE(cellLayout, 0);
-
-  int32_t colIdx = 0;
-  cellLayout->GetColIndex(colIdx);
-  return colIdx > 0 ? static_cast<uint32_t>(colIdx) : 0;
+  nsTableCellFrame* cellFrame = GetCellFrame();
+  NS_ENSURE_TRUE(cellFrame, 0);
+  return cellFrame->ColIndex();
 }
 
 uint32_t
 HTMLTableCellAccessible::RowIdx() const
 {
-  nsITableCellLayout* cellLayout = GetCellLayout();
-  NS_ENSURE_TRUE(cellLayout, 0);
-
-  int32_t rowIdx = 0;
-  cellLayout->GetRowIndex(rowIdx);
-  return rowIdx > 0 ? static_cast<uint32_t>(rowIdx) : 0;
+  nsTableCellFrame* cellFrame = GetCellFrame();
+  NS_ENSURE_TRUE(cellFrame, 0);
+  return cellFrame->RowIndex();
 }
 
 uint32_t
@@ -285,6 +279,12 @@ HTMLTableCellAccessible::GetCellLayout() const
   return do_QueryFrame(mContent->GetPrimaryFrame());
 }
 
+nsTableCellFrame*
+HTMLTableCellAccessible::GetCellFrame() const
+{
+  return do_QueryFrame(mContent->GetPrimaryFrame());
+}
+
 nsresult
 HTMLTableCellAccessible::GetCellIndexes(int32_t& aRowIdx, int32_t& aColIdx) const
 {
@@ -520,11 +520,9 @@ HTMLTableAccessible::SelectedCellCount()
       if (!cellFrame || !cellFrame->IsSelected())
         continue;
 
-      int32_t startRow = -1, startCol = -1;
-      cellFrame->GetRowIndex(startRow);
-      cellFrame->GetColIndex(startCol);
-      if (startRow >= 0 && (uint32_t)startRow == rowIdx &&
-          startCol >= 0 && (uint32_t)startCol == colIdx)
+      uint32_t startRow = cellFrame->RowIndex();
+      uint32_t startCol = cellFrame->ColIndex();
+      if (startRow == rowIdx && startCol == colIdx)
         count++;
     }
   }
@@ -570,11 +568,9 @@ HTMLTableAccessible::SelectedCells(nsTArray<Accessible*>* aCells)
       if (!cellFrame || !cellFrame->IsSelected())
         continue;
 
-      int32_t startCol = -1, startRow = -1;
-      cellFrame->GetRowIndex(startRow);
-      cellFrame->GetColIndex(startCol);
-      if ((startRow >= 0 && (uint32_t)startRow != rowIdx) ||
-          (startCol >= 0 && (uint32_t)startCol != colIdx))
+      uint32_t startRow = cellFrame->RowIndex();
+      uint32_t startCol = cellFrame->ColIndex();
+      if (startRow != rowIdx || startCol != colIdx)
         continue;
 
       Accessible* cell = mDoc->GetAccessible(cellFrame->GetContent());
@@ -597,11 +593,9 @@ HTMLTableAccessible::SelectedCellIndices(nsTArray<uint32_t>* aCells)
       if (!cellFrame || !cellFrame->IsSelected())
         continue;
 
-      int32_t startRow = -1, startCol = -1;
-      cellFrame->GetColIndex(startCol);
-      cellFrame->GetRowIndex(startRow);
-      if (startRow >= 0 && (uint32_t)startRow == rowIdx &&
-          startCol >= 0 && (uint32_t)startCol == colIdx)
+      uint32_t startCol = cellFrame->ColIndex();
+      uint32_t startRow = cellFrame->RowIndex();
+      if (startRow == rowIdx && startCol == colIdx)
         aCells->AppendElement(CellIndexAt(rowIdx, colIdx));
     }
   }

accessible/html/HTMLTableAccessible.h

@@ -11,6 +11,7 @@
 #include "TableCellAccessible.h"
 
 class nsITableCellLayout;
+class nsTableCellFrame;
 
 namespace mozilla {
 namespace a11y {
@@ -53,6 +54,11 @@ protected:
    */
   nsITableCellLayout* GetCellLayout() const;
 
+  /**
+   * Return the table cell frame.
+   */
+  nsTableCellFrame* GetCellFrame() const;
+
   /**
    * Return row and column indices of the cell.
    */

accessible/mac/mozAccessible.mm

@@ -732,8 +732,6 @@ using namespace mozilla::a11y;
       return @"AXDocument";
     if (roleAtom == nsGkAtoms::log_)
       return @"AXApplicationLog";
-    if (roleAtom == nsGkAtoms::marquee)
-      return @"AXApplicationMarquee";
     if (roleAtom == nsGkAtoms::math)
       return @"AXDocumentMath";
     if (roleAtom == nsGkAtoms::note_)
@@ -869,7 +867,6 @@ static const RoleDescrMap sRoleDescrMap[] = {
   { @"AXApplicationAlert", NS_LITERAL_STRING("alert") },
   { @"AXApplicationAlertDialog", NS_LITERAL_STRING("alertDialog") },
   { @"AXApplicationLog", NS_LITERAL_STRING("log") },
-  { @"AXApplicationMarquee", NS_LITERAL_STRING("marquee") },
   { @"AXApplicationStatus", NS_LITERAL_STRING("status") },
   { @"AXApplicationTimer", NS_LITERAL_STRING("timer") },
   { @"AXContentSeparator", NS_LITERAL_STRING("separator") },

accessible/tests/mochitest/attributes/test_obj.html

@@ -62,7 +62,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
       testAbsentAttrs("live3", {"live" : ""});
       testAttrs("log", {"live" : "polite"}, true);
       testAttrs("logAssertive", {"live" : "assertive"}, true);
-      testAttrs("marquee", {"live" : "off"}, true);
       testAttrs("status", {"live" : "polite"}, true);
       testAttrs("timer", {"live" : "off"}, true);
       testAbsentAttrs("tablist", {"live" : "polite"});
@@ -72,7 +71,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
       testAttrs("live2Child", {"container-live" : "polite"}, true);
       testAttrs("logChild", {"container-live" : "polite"}, true);
       testAttrs("logAssertiveChild", {"container-live" : "assertive"}, true);
-      testAttrs("marqueeChild", {"container-live" : "off"}, true);
       testAttrs("statusChild", {"container-live" : "polite"}, true);
       testAttrs("timerChild", {"container-live" : "off"}, true);
       testAbsentAttrs("tablistChild", {"container-live" : "polite"});
@@ -80,13 +78,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
       // container-live-role object attribute
       testAttrs("log", {"container-live-role" : "log"}, true);
       testAttrs("logAssertive", {"container-live-role" : "log"}, true);
-      testAttrs("marquee", {"container-live-role" : "marquee"}, true);
       testAttrs("status", {"container-live-role" : "status"}, true);
       testAttrs("timer", {"container-live-role" : "timer"}, true);
       testAttrs("logChild", {"container-live-role" : "log"}, true);
       testAttrs("logAssertive", {"container-live-role" : "log"}, true);
       testAttrs("logAssertiveChild", {"container-live-role" : "log"}, true);
-      testAttrs("marqueeChild", {"container-live-role" : "marquee"}, true);
       testAttrs("statusChild", {"container-live-role" : "status"}, true);
       testAttrs("timerChild", {"container-live-role" : "timer"}, true);
       testAbsentAttrs("tablistChild", {"container-live-role" : "tablist"});
@@ -230,11 +226,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
 
   <!-- back to aria -->
   <div id="live" aria-live="polite">excuse <div id="liveChild">me</div></div>
-  <div id="live2" role="marquee" aria-live="polite">excuse <div id="live2Child">me</div></div>
   <div id="live3" role="region">excuse</div>
   <div id="log" role="log">excuse <div id="logChild">me</div></div>
   <div id="logAssertive" role="log" aria-live="assertive">excuse <div id="logAssertiveChild">me</div></div>
-  <div id="marquee" role="marquee">excuse <div id="marqueeChild">me</div></div>
   <div id="status" role="status">excuse <div id="statusChild">me</div></div>
   <div id="tablist" role="tablist">tablist <div id="tablistChild">tab</div></div>
   <div id="timer" role="timer">excuse <div id="timerChild">me</div></div>

accessible/tests/mochitest/elm/test_HTMLSpec.html

@@ -421,7 +421,7 @@
       //////////////////////////////////////////////////////////////////////////
       // HTML:dialog
 
-      todo(isAccessible("dialog"), "dialog element is not accessible");
+      ok(isAccessible("dialog"), "dialog element is not accessible");
 
       //////////////////////////////////////////////////////////////////////////
       // HTML:div

accessible/tests/mochitest/jsat/test_traversal.html

@@ -83,7 +83,7 @@
                               'listitem-2-3']);
 
       queueTraversalSequence(gQueue, docAcc, TraversalRules.Graphic, null,
-                             ['image-2', 'image-3']);
+                             ['image-1', 'image-2', 'image-3']);
 
       queueTraversalSequence(gQueue, docAcc, TraversalRules.Link, null,
                              ['link-0', 'link-1', 'link-2', 'link-3']);
@@ -117,7 +117,7 @@
                               '1. Scheme', '2. Racket', '3. Clojure',
                               '4. Standard Lisp', 'link-0', ' Lisp',
                               'checkbox-1-5', ' LeLisp', '• JavaScript',
-                              'heading-5', 'image-2', 'image-3',
+                              'heading-5', 'image-1', 'image-2', 'image-3',
                               'Not actually an image', 'link-1', 'anchor-1',
                               'link-2', 'anchor-2', 'link-3', '3', '1', '4',
                               '1', 'Sunday', 'M', 'Week 1', '3', '4', '7', '2',

accessible/tests/mochitest/role/test_aria.html

@@ -41,7 +41,6 @@
       testRole("aria_listbox", ROLE_LISTBOX);
       testRole("aria_listitem", ROLE_LISTITEM);
       testRole("aria_log", ROLE_TEXT); // weak role
-      testRole("aria_marquee", ROLE_ANIMATION);
       testRole("aria_math", ROLE_FLAT_EQUATION);
       testRole("aria_menu", ROLE_MENUPOPUP);
       testRole("aria_menubar", ROLE_MENUBAR);
@@ -89,9 +88,6 @@
       testRole("log_table", ROLE_TABLE);
       testRole("timer_div", ROLE_SECTION);
 
-      // other roles that are forms of "live regions"
-      testRole("marquee_h1", ROLE_ANIMATION);
-
       // strong landmark
       testRole("application", ROLE_APPLICATION);
       testRole("form", ROLE_FORM);
@@ -219,7 +215,6 @@
   <span id="aria_listbox" role="listbox"/>
   <span id="aria_listitem" role="listitem"/>
   <span id="aria_log" role="log"/>
-  <span id="aria_marquee" role="marquee"/>
   <span id="aria_math" role="math"/>
   <span id="aria_menu" role="menu"/>
   <span id="aria_menubar" role="menubar"/>
@@ -263,7 +258,6 @@
   <table role="log" id="log_table">
     <tr><td>Table based log</td></tr>
   </table>
-  <h1 role="marquee" id="marquee_h1">marquee</h1>
   <div role="timer" id="timer_div">timer</div>
 
   <!-- landmarks -->

accessible/tests/mochitest/tree/test_invalid_img.xhtml

@@ -20,8 +20,8 @@
       document.getElementsByTagName("img")[0].firstChild.data = "2";
 
       var accTree = {
-        role: ROLE_TEXT,
-        children: [ { role: ROLE_TEXT_LEAF } ]
+        role: ROLE_GRAPHIC,
+        children: []
       };
       testAccessibleTree("the_img", accTree);
       SimpleTest.finish();

build/autoconf/config.guess

@@ -381,11 +381,14 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	eval $set_cc_for_build
 	SUN_ARCH=i386
-	# If there is a compiler, see if it is configured for 64-bit objects.
-	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
-	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
-	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
+  _ISAINFO=`isainfo -k 2>/dev/null`
+  if [ "$_ISAINFO" = "amd64" ]; then
+    SUN_ARCH=x86_64
+  elif [ "$CC_FOR_BUILD" != no_compiler_found ]; then
+    # If there is a compiler, see if it is configured for 64-bit objects.
+    # Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
+    # This test works for both compilers.
+      if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
 		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
@@ -842,6 +845,13 @@ EOF
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
+    *:MINGW32_NT*:*)
+  if [ "$PLATFORM" = "X64" ]; then
+    echo x86_64-pc-mingw32
+  else
+    echo ${UNAME_MACHINE}-pc-mingw32
+  fi
+  exit ;;
     *:MINGW64*:*)
 	echo ${UNAME_MACHINE}-pc-mingw64
 	exit ;;

build/autoconf/icu.m4

@@ -8,19 +8,6 @@ dnl ICU library, as well as a few other things.
 AC_DEFUN([MOZ_CONFIG_ICU], [
 
 ICU_LIB_NAMES=
-MOZ_SYSTEM_ICU=
-MOZ_ARG_WITH_BOOL(system-icu,
-[  --with-system-icu
-                          Use system ICU (located with pkgconfig)],
-    MOZ_SYSTEM_ICU=1)
-
-if test -n "$MOZ_SYSTEM_ICU"; then
-    PKG_CHECK_MODULES(MOZ_ICU, icu-i18n >= 58.1)
-    CFLAGS="$CFLAGS $MOZ_ICU_CFLAGS"
-    CXXFLAGS="$CXXFLAGS $MOZ_ICU_CFLAGS"
-fi
-
-AC_SUBST(MOZ_SYSTEM_ICU)
 
 dnl We always use ICU.
 USE_ICU=1
@@ -51,7 +38,7 @@ if test -n "$USE_ICU"; then
     dnl We also don't do it on Windows because sometimes the file goes
     dnl missing -- possibly due to overzealous antivirus software? --
     dnl which prevents the browser from starting up :(
-    if test -z "$JS_STANDALONE" -a -z "$MOZ_SYSTEM_ICU" -a "$OS_TARGET" != WINNT -a "$MOZ_WIDGET_TOOLKIT" != "android"; then
+    if test -z "$JS_STANDALONE"; then
         MOZ_ICU_DATA_ARCHIVE=1
     else
         MOZ_ICU_DATA_ARCHIVE=
@@ -64,7 +51,7 @@ AC_SUBST(USE_ICU)
 AC_SUBST(ICU_DATA_FILE)
 AC_SUBST(MOZ_ICU_DATA_ARCHIVE)
 
-if test -n "$USE_ICU" -a -z "$MOZ_SYSTEM_ICU"; then
+if test -n "$USE_ICU"; then
     if test -z "$YASM" -a -z "$GNU_AS" -a "$COMPILE_ENVIRONMENT"; then
       AC_MSG_ERROR([Building ICU requires either yasm or a GNU assembler. If you do not have either of those available for this platform you must use --without-intl-api])
     fi

build/autoconf/nspr-build.m4

@@ -42,15 +42,6 @@ if test "$MOZ_BUILD_APP" != js || test -n "$JS_STANDALONE"; then
   _IS_OUTER_CONFIGURE=1
 fi
 
-MOZ_ARG_WITH_BOOL(system-nspr,
-[  --with-system-nspr      Use an NSPR that is already built and installed.
-                          Use the 'nspr-config' script in the current path,
-                          or look for the script in the directories given with
-                          --with-nspr-exec-prefix or --with-nspr-prefix.
-                          (Those flags are only checked if you specify
-                          --with-system-nspr.)],
-    _USE_SYSTEM_NSPR=1 )
-
 JS_POSIX_NSPR=unset
 ifdef([CONFIGURING_JS],[
     if test -n "$JS_STANDALONE"; then
@@ -71,7 +62,6 @@ ifdef([CONFIGURING_JS],[
 ])
 
 dnl Pass at most one of
-dnl   --with-system-nspr
 dnl   --with-nspr-cflags/libs
 dnl   --enable-nspr-build
 dnl   --enable-posix-nspr-emulation
@@ -79,10 +69,6 @@ dnl   --enable-posix-nspr-emulation
 AC_MSG_CHECKING([NSPR selection])
 nspr_opts=
 which_nspr=default
-if test -n "$_USE_SYSTEM_NSPR"; then
-    nspr_opts="x$nspr_opts"
-    which_nspr="system"
-fi
 if test -n "$NSPR_CFLAGS" -o -n "$NSPR_LIBS"; then
     nspr_opts="x$nspr_opts"
     which_nspr="command-line"
@@ -136,11 +122,7 @@ fi
 # anything itself.
 if test -n "$_IS_OUTER_CONFIGURE"; then
 
-if test -n "$_USE_SYSTEM_NSPR"; then
-    AM_PATH_NSPR($NSPR_MINVER, [MOZ_SYSTEM_NSPR=1], [AC_MSG_ERROR([you do not have NSPR installed or your version is older than $NSPR_MINVER.])])
-fi
-
-if test -n "$MOZ_SYSTEM_NSPR" -o -n "$NSPR_CFLAGS" -o -n "$NSPR_LIBS"; then
+if test -n "$NSPR_CFLAGS" -o -n "$NSPR_LIBS"; then
     _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $NSPR_CFLAGS"
     AC_TRY_COMPILE([#include "prtypes.h"],
@@ -178,19 +160,7 @@ AC_SUBST(NSPR_INCLUDE_DIR)
 AC_SUBST(NSPR_LIB_DIR)
 
 PKGCONF_REQUIRES_PRIVATE="Requires.private: nspr"
-if test -n "$MOZ_SYSTEM_NSPR"; then
-    _SAVE_CFLAGS=$CFLAGS
-    CFLAGS="$CFLAGS $NSPR_CFLAGS"
-    AC_TRY_COMPILE([#include "prlog.h"],
-                [#ifndef PR_STATIC_ASSERT
-                 #error PR_STATIC_ASSERT not defined
-                 #endif],
-                ,
-                AC_MSG_ERROR([system NSPR does not support PR_STATIC_ASSERT]))
-    CFLAGS=$_SAVE_CFLAGS
-    # piggy back on $MOZ_SYSTEM_NSPR to set a variable for the nspr check for js.pc
-    PKGCONF_REQUIRES_PRIVATE="Requires.private: nspr >= $NSPR_MINVER"
-elif test -n "$JS_POSIX_NSPR"; then
+if test -n "$JS_POSIX_NSPR"; then
     PKGCONF_REQUIRES_PRIVATE=
 fi
 AC_SUBST([PKGCONF_REQUIRES_PRIVATE])

build/defines.sh

@@ -1,3 +0,0 @@
-# Define indicating that this build is prior to one of the early betas. To be
-# unset mid-way through the beta cycle.
-EARLY_BETA_OR_EARLIER=

build/directive4.py

@@ -33,15 +33,9 @@ if ('MOZ_OFFICIAL_BRANDING' in listConfig) or (strBrandingDirectory.endswith("br
     # Applies to Pale Moon and Basilisk
     if ('MC_BASILISK' in listConfig) or ('MC_PALEMOON' in listConfig):
         listViolations += [
-            'MOZ_SYSTEM_LIBEVENT',
-            'MOZ_SYSTEM_NSS',
-            'MOZ_SYSTEM_NSPR',
             'MOZ_SYSTEM_JPEG',
             'MOZ_SYSTEM_ZLIB',
             'MOZ_SYSTEM_BZ2',
-            'MOZ_SYSTEM_PNG',
-            'MOZ_SYSTEM_LIBVPX',
-            'MOZ_SYSTEM_SQLITE',
             'MOZ_SYSTEM_JEMALLOC'
         ]
         

build/moz.configure/init.configure

@@ -610,7 +610,7 @@ imply_option('--enable-project', application)
 def default_project(build_env, help):
     if build_env.topobjdir.endswith('/js/src'):
         return 'js'
-    return 'browser'
+    return 'application/xulrunner'
 
 option('--enable-project', nargs=1, default=default_project,
        help='Project to build')
@@ -618,28 +618,22 @@ option('--enable-project', nargs=1, default=default_project,
 option('--with-external-source-dir', env='EXTERNAL_SOURCE_DIR', nargs=1,
        help='External directory containing additional build files')
 
-@depends('--enable-project', '--with-external-source-dir',
-         check_build_environment, '--help')
+@depends('--enable-project', '--with-external-source-dir', check_build_environment, '--help')
 @imports(_from='os.path', _import='exists')
 def include_project_configure(project, external_source_dir, build_env, help):
-    if not project:
-        die('--enable-project is required.')
-
     base_dir = build_env.topsrcdir
+
     if external_source_dir:
         base_dir = os.path.join(base_dir, external_source_dir[0])
-
+    
     build_app = project[0]
 
-    if not external_source_dir and build_app not in ('xulrunner', 'js'):
-        die('Cannot find project %s', build_app)
-
     path_project_src_dir_root = os.path.join(base_dir, build_app, 'moz.configure')
     
     if exists(path_project_src_dir_root):
         return path_project_src_dir_root
     else:
-        die('Cannot find project %s', build_app)
+        return os.path.join(build_env.topsrcdir, 'toolkit', 'moz.configure')
 
 @depends('--with-external-source-dir')
 def external_source_dir(value):
@@ -649,12 +643,29 @@ def external_source_dir(value):
 set_config('EXTERNAL_SOURCE_DIR', external_source_dir)
 add_old_configure_assignment('EXTERNAL_SOURCE_DIR', external_source_dir)
 
+@depends('--enable-project', '--with-external-source-dir', check_build_environment, '--help')
+@imports(_from='os.path', _import='exists')
+def build_project(project, external_source_dir, build_env, help):
+    if not project:
+        die('--enable-project is required.')
+
+    base_dir = build_env.topsrcdir
+
+    if external_source_dir:
+        base_dir = os.path.join(base_dir, external_source_dir[0])
+
+    build_app = project[0]
+
+    if not external_source_dir and build_app not in ('xulrunner', 'js'):
+        die('Cannot find project %s', build_app)
+
+    build_app_abspath = os.path.join(base_dir, build_app)
+
+    if exists(build_app_abspath):
+        return os.path.relpath(build_app_abspath, build_env.topsrcdir)
+    else:
+        die('Cannot find project %s', build_app)
 
-@depends(include_project_configure, check_build_environment, '--help')
-def build_project(include_project_configure, build_env, help):
-    ret = os.path.dirname(os.path.relpath(include_project_configure,
-                                          build_env.topsrcdir))
-    return ret
 
 set_config('MOZ_BUILD_APP', build_project)
 set_define('MOZ_BUILD_APP', build_project)

build/moz.configure/old.configure

@@ -157,6 +157,7 @@ def old_configure_options(*options):
     '--enable-accessibility',
     '--enable-address-sanitizer',
     '--enable-alsa',
+    '--enable-av1',
     '--enable-b2g-bt',
     '--enable-b2g-camera',
     '--enable-b2g-ril',
@@ -166,6 +167,7 @@ def old_configure_options(*options):
     '--enable-cookies',
     '--enable-cpp-rtti',
     '--enable-crashreporter',
+    '--enable-dbm',
     '--enable-dbus',
     '--enable-debug-js-modules',
     '--enable-jetpack',
@@ -222,6 +224,7 @@ def old_configure_options(*options):
     '--enable-release',
     '--enable-safe-browsing',
     '--enable-sandbox',
+    '--enable-security-sqlstore',
     '--enable-signmar',
     '--enable-simulator',
     '--enable-small-chunk-size',
@@ -233,7 +236,6 @@ def old_configure_options(*options):
     '--enable-system-cairo',
     '--enable-system-extension-dirs',
     '--enable-system-pixman',
-    '--enable-system-sqlite',
     '--enable-tasktracer',
     '--enable-tests',
     '--enable-thread-sanitizer',
@@ -287,13 +289,7 @@ def old_configure_options(*options):
     '--with-sixgill',
     '--with-soft-float',
     '--with-system-bz2',
-    '--with-system-icu',
     '--with-system-jpeg',
-    '--with-system-libevent',
-    '--with-system-libvpx',
-    '--with-system-nspr',
-    '--with-system-nss',
-    '--with-system-png',
     '--with-system-zlib',
     '--with-thumb',
     '--with-thumb-interwork',

build/mozconfig.common

@@ -16,11 +16,6 @@ ac_add_options --enable-crashreporter
 
 ac_add_options --enable-release
 
-# Disable checking that add-ons are signed by the trusted root
-MOZ_ADDON_SIGNING=${MOZ_ADDON_SIGNING-0}
-# Disable enforcing that add-ons are signed by the trusted root
-MOZ_REQUIRE_SIGNING=${MOZ_REQUIRE_SIGNING-0}
-
 ac_add_options --enable-js-shell
 
 . "$topsrcdir/build/mozconfig.automation"

build/ppCheck.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python
+
+from __future__ import print_function
+import os, sys
+
+if not len(sys.argv) is 2 or not os.path.exists(sys.argv[1]):
+  print("\nYou did not supply a valid path to check.")
+  exit(1)
+else:
+  print("\nChecking for un-preprocessed files...", end = ' ')
+  DIST_PATH = sys.argv[1]
+
+PP_FILE_TYPES = (
+  '.css',
+  '.dtd',
+  '.html',
+  '.js',
+  '.jsm',
+  '.xhtml',
+  '.xml',
+  '.xul',
+  '.manifest',
+  '.properties',
+  '.rdf'
+)
+
+PP_SPECIAL_TYPES = ('.css')
+
+PP_DIRECTIVES = [
+  'define',
+  'if',
+  'ifdef',
+  'ifndef',
+  'elif',
+  'elifdef',
+  'endif',
+  'error',
+  'expand',
+  'filter',
+  'include',
+  'literal',
+  'undef',
+  'unfilter'
+]
+
+PP_FILES = []
+PP_BAD_FILES = []
+
+for root, directories, filenames in os.walk(DIST_PATH):
+  for filename in filenames: 
+    if filename.endswith(PP_FILE_TYPES):
+      PP_FILES += [ os.path.join(root, filename).replace(os.sep, '/') ]
+
+for file in PP_FILES:
+  with open(file) as fp:
+    marker = '%' if file.endswith(PP_SPECIAL_TYPES) else '#'
+    directives = tuple(marker + directive for directive in PP_DIRECTIVES)
+    for line in fp:
+      if line.startswith(directives):
+        PP_BAD_FILES += [ file.replace(DIST_PATH + '/', '') ]
+  fp.close()
+
+PP_BAD_FILES = list(dict.fromkeys(PP_BAD_FILES))
+
+print('Done!')
+
+if len(PP_BAD_FILES) > 0:
+  print("\nWARNING: The following {0} file(s) in {1} may require preprocessing:\n".format(len(PP_BAD_FILES), DIST_PATH))
+  for file in PP_BAD_FILES:
+    print(file)
+
+exit(0)

chrome/nsChromeRegistry.cpp

@@ -436,23 +436,22 @@ nsresult nsChromeRegistry::RefreshWindow(nsPIDOMWindowOuter* aWindow)
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  int32_t count = document->GetNumberOfStyleSheets();
+  size_t count = document->SheetCount();
 
   // Build an array of style sheets we need to reload.
   nsTArray<RefPtr<StyleSheet>> oldSheets(count);
   nsTArray<RefPtr<StyleSheet>> newSheets(count);
 
   // Iterate over the style sheets.
-  for (int32_t i = 0; i < count; i++) {
+  for (size_t i = 0; i < count; i++) {
     // Get the style sheet
-    StyleSheet* styleSheet = document->GetStyleSheetAt(i);
-    oldSheets.AppendElement(styleSheet);
+    oldSheets.AppendElement(document->SheetAt(i));
   }
 
   // Iterate over our old sheets and kick off a sync load of the new
   // sheet if and only if it's a non-inline sheet with a chrome URL.
   for (StyleSheet* sheet : oldSheets) {
-    MOZ_ASSERT(sheet, "GetStyleSheetAt shouldn't return nullptr for "
+    MOZ_ASSERT(sheet, "SheetAt shouldn't return nullptr for "
                       "in-range sheet indexes");
     nsIURI* uri = sheet->GetSheetURI();
 

config/Makefile.in

@@ -44,11 +44,7 @@ export:: $(export-preqs)
 		-DMOZ_SYSTEM_HUNSPELL=$(MOZ_SYSTEM_HUNSPELL) \
 		-DMOZ_SYSTEM_BZ2=$(MOZ_SYSTEM_BZ2) \
 		-DMOZ_SYSTEM_ZLIB=$(MOZ_SYSTEM_ZLIB) \
-		-DMOZ_SYSTEM_PNG=$(MOZ_SYSTEM_PNG) \
 		-DMOZ_SYSTEM_JPEG=$(MOZ_SYSTEM_JPEG) \
-		-DMOZ_SYSTEM_LIBEVENT=$(MOZ_SYSTEM_LIBEVENT) \
-		-DMOZ_SYSTEM_LIBVPX=$(MOZ_SYSTEM_LIBVPX) \
-		-DMOZ_SYSTEM_ICU=$(MOZ_SYSTEM_ICU) \
 		$(srcdir)/system-headers $(srcdir)/stl-headers | $(PERL) $(topsrcdir)/nsprpub/config/make-system-wrappers.pl system_wrappers
 	$(INSTALL) system_wrappers $(DIST)
 

config/external/icu/moz.build

@@ -6,16 +6,14 @@
 
 Library('icu')
 
-if CONFIG['MOZ_SYSTEM_ICU']:
-    OS_LIBS += CONFIG['MOZ_ICU_LIBS']
+DIRS += [
+    'common',
+    'data',
+    'i18n',
+]
+
+if CONFIG['MOZ_ICU_DATA_ARCHIVE']:
+    DIRS += ['stubdata']
+    USE_LIBS += ['icustubdata']
 else:
-    DIRS += [
-        'common',
-        'data',
-        'i18n',
-    ]
-    if CONFIG['MOZ_ICU_DATA_ARCHIVE']:
-        DIRS += ['stubdata']
-        USE_LIBS += ['icustubdata']
-    else:
-        USE_LIBS += ['icudata']
+    USE_LIBS += ['icudata']

config/external/moz.build

@@ -6,10 +6,8 @@
 
 external_dirs = []
 
-DIRS += [
-    'lgpllibs',
-    'sqlite',
-]
+DIRS += ['lgpllibs']
+
 if not CONFIG['MOZ_SYSTEM_JPEG']:
     external_dirs += ['media/libjpeg']
 
@@ -30,26 +28,18 @@ if CONFIG['MOZ_TREMOR']:
 if CONFIG['MOZ_WEBM_ENCODER']:
     external_dirs += ['media/libmkv']
 
-if not CONFIG['MOZ_SYSTEM_LIBVPX']:
-    external_dirs += ['media/libvpx']
+external_dirs += ['media/libvpx']
 
 if CONFIG['MOZ_AV1']:
     external_dirs += ['media/libaom']
 
-if not CONFIG['MOZ_SYSTEM_PNG']:
-    external_dirs += ['media/libpng']
+external_dirs += ['media/libpng']
 
 external_dirs += ['media/libwebp']
 
 if CONFIG['CPU_ARCH'] == 'arm':
     external_dirs += ['media/openmax_dl']
 
-if CONFIG['MOZ_WEBSPEECH_POCKETSPHINX']:
-    external_dirs += [
-        'media/sphinxbase',
-        'media/pocketsphinx',
-    ]
-
 if CONFIG['MOZ_FFVPX']:
     external_dirs += ['media/ffvpx']
 

config/external/nss/Makefile.in

@@ -3,8 +3,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-ifndef MOZ_SYSTEM_NSS
-
 CC_WRAPPER =
 CXX_WRAPPER =
 
@@ -121,15 +119,9 @@ DEFAULT_GMAKE_FLAGS += NSS_ENABLE_TLS_1_3=1
 ifeq ($(OS_ARCH)_$(GNU_CC),WINNT_1)
 DEFAULT_GMAKE_FLAGS += OS_DLLFLAGS='-static-libgcc' NSPR31_LIB_PREFIX=lib
 endif
-ifndef MOZ_SYSTEM_SQLITE
-ifdef MOZ_FOLD_LIBS
-DEFAULT_GMAKE_FLAGS += SQLITE_LIB_NAME=nss3
-else
 DEFAULT_GMAKE_FLAGS += SQLITE_LIB_NAME=mozsqlite3
-DEFAULT_GMAKE_FLAGS += SQLITE_LIB_DIR=$(ABS_DIST)/../config/external/sqlite
-endif # MOZ_FOLD_LIBS
+DEFAULT_GMAKE_FLAGS += SQLITE_LIB_DIR=$(ABS_DIST)/../db/sqlite3/src
 DEFAULT_GMAKE_FLAGS += SQLITE_INCLUDE_DIR=$(ABS_DIST)/include
-endif
 ifdef NSS_DISABLE_DBM 
 DEFAULT_GMAKE_FLAGS += NSS_DISABLE_DBM=1
 endif
@@ -475,4 +467,3 @@ endif # MOZ_FOLD_LIBS
 # security/nss/lib/ckfw/builtins. See bug #836220.
 libs-nss/lib$(if $(MOZ_FOLD_LIBS),/ckfw): $(call mkdir_deps,$(DEPTH)/security/nss/lib/ckfw/builtins)
 
-endif

config/external/nss/crmf/moz.build

@@ -6,14 +6,11 @@
 
 Library('crmf')
 
-if CONFIG['MOZ_SYSTEM_NSS']:
-    OS_LIBS += [l for l in CONFIG['NSS_LIBS'] if l.startswith('-L')]
-else:
-    USE_LIBS += [
-        # The dependency on nss is not real, but is required to force the
-        # parent directory being built before this one. This has no
-        # practical effect on linkage, since the only thing linking crmf
-        # will need nss anyways.
-        'nss',
-        'static:/security/nss/lib/crmf/crmf',
-    ]
+USE_LIBS += [
+    # The dependency on nss is not real, but is required to force the
+    # parent directory being built before this one. This has no
+    # practical effect on linkage, since the only thing linking crmf
+    # will need nss anyways.
+    'nss',
+    'static:/security/nss/lib/crmf/crmf',
+]

config/external/nss/moz.build

@@ -6,10 +6,7 @@
 
 DIRS += ['crmf']
 
-if CONFIG['MOZ_SYSTEM_NSS']:
-    Library('nss')
-    OS_LIBS += CONFIG['NSS_LIBS']
-elif CONFIG['MOZ_FOLD_LIBS']:
+if CONFIG['MOZ_FOLD_LIBS']:
     GeckoSharedLibrary('nss', linkage=None)
     # TODO: The library name can be changed when bug 845217 is fixed.
     SHARED_LIBRARY_NAME = 'nss3'
@@ -32,9 +29,10 @@ else:
         '/security/nss/lib/smime/smime3',
         '/security/nss/lib/ssl/ssl3',
         '/security/nss/lib/util/nssutil3',
-        'sqlite',
     ]
 
+USE_LIBS += ['sqlite']
+
 # XXX: We should fix these warnings.
 ALLOW_COMPILER_WARNINGS = True
 

config/external/nss/nss.symbols

@@ -13,7 +13,6 @@
 PR_*
 PL_*
 #endif
-#include ../../../db/sqlite3/src/sqlite.symbols
 ATOB_AsciiToData
 ATOB_AsciiToData_Util
 ATOB_ConvertAsciiToItem
@@ -113,6 +112,7 @@ CERT_GetCertChainFromCert
 CERT_GetCertEmailAddress
 CERT_GetCertificateDer
 CERT_GetCertificateRequestExtensions
+CERT_GetCertKeyType
 CERT_GetCertTimes
 CERT_GetCertTrust
 CERT_GetCommonName
@@ -271,6 +271,7 @@ NSS_Init
 NSS_Initialize
 NSS_InitWithMerge
 NSS_IsInitialized
+NSS_OptionGet
 NSS_OptionSet
 NSS_NoDB_Init
 NSS_SecureMemcmp
@@ -384,6 +385,7 @@ PK11_GetNextSymKey
 PK11_GetPadMechanism
 PK11_GetPrivateKeyNickname
 PK11_GetPrivateModulusLen
+PK11_GetSlotFromPrivateKey
 PK11_GetSlotID
 PK11_GetSlotInfo
 PK11_GetSlotName

config/external/sqlite/moz.build

@@ -1,22 +0,0 @@
-# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-if CONFIG['MOZ_SYSTEM_SQLITE']:
-    Library('sqlite')
-    OS_LIBS += CONFIG['SQLITE_LIBS']
-else:
-    DIRS += ['../../../db/sqlite3/src']
-    if CONFIG['MOZ_FOLD_LIBS']:
-        Library('sqlite')
-        # When folding libraries, sqlite is actually in the nss library.
-        USE_LIBS += [
-            'nss',
-        ]
-    else:
-        SharedLibrary('sqlite')
-        SHARED_LIBRARY_NAME = 'mozsqlite3'
-
-        SYMBOLS_FILE = '/db/sqlite3/src/sqlite.symbols'

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-4.5.0
+4.6.0

config/moz.build

@@ -29,9 +29,6 @@ if CONFIG['HOST_OS_ARCH'] != 'WINNT':
     # while the program here is in C.
     HostProgram('nsinstall_real', c_only=True)
 
-if CONFIG['MOZ_SYSTEM_ICU']:
-    DEFINES['MOZ_SYSTEM_ICU'] = True
-
 PYTHON_UNIT_TESTS += [
     'tests/test_mozbuild_reading.py',
     'tests/unit-expandlibs.py',

config/recurse.mk

@@ -172,7 +172,7 @@ ifeq ($(MOZ_REPLACE_MALLOC_LINKAGE),dummy library)
 mozglue/build/target memory/replace/logalloc/replay/target: memory/replace/dummy/target
 endif
 endif
-ifeq (,$(MOZ_SYSTEM_NSPR)$(MOZ_SYSTEM_NSS)$(MOZ_FOLD_LIBS))
+ifeq (,$(MOZ_FOLD_LIBS))
 config/external/nss/target: config/external/nspr/pr/target config/external/nspr/ds/target config/external/nspr/libc/target
 endif
 # Most things are built during compile (target/host), but some things happen during export

config/system-headers

@@ -1253,9 +1253,6 @@ soundtouch/SoundTouchFactory.h
 #if MOZ_LIBAV_FFT==1
 libavcodec/avfft.h
 #endif
-#if MOZ_SYSTEM_PNG==1
-png.h
-#endif
 #if MOZ_SYSTEM_ZLIB==1
 zlib.h
 #endif
@@ -1276,11 +1273,7 @@ bzlib.h
 #ifdef MOZ_ENABLE_GIO
 gio/gio.h
 #endif
-#if MOZ_SYSTEM_LIBEVENT==1
-event.h
-#else
 sys/event.h
-#endif
 #ifdef MOZ_ENABLE_LIBPROXY
 proxy.h
 #endif
@@ -1295,15 +1288,6 @@ QtSparql/qsparqlresult.h
 #if MOZ_TREE_PIXMAN!=1
 pixman.h
 #endif
-#if MOZ_SYSTEM_LIBVPX==1
-vpx/svc_context.h
-vpx/vpx_codec.h
-vpx/vpx_decoder.h
-vpx/vpx_encoder.h
-vpx/vp8cx.h
-vpx/vp8dx.h
-vpx_mem/vpx_mem.h
-#endif
 gst/gst.h
 gst/app/gstappsink.h
 gst/app/gstappsrc.h
@@ -1316,22 +1300,6 @@ kvm.h
 spawn.h
 err.h
 xlocale.h
-#ifdef MOZ_SYSTEM_ICU
-unicode/locid.h
-unicode/numsys.h
-unicode/timezone.h
-unicode/ucal.h
-unicode/uchar.h
-unicode/uclean.h
-unicode/ucol.h
-unicode/udat.h
-unicode/udatpg.h
-unicode/uenum.h
-unicode/unorm.h
-unicode/unum.h
-unicode/ustring.h
-unicode/utypes.h
-#endif
 libutil.h
 unwind.h
 fenv.h

config/version_win.pl

@@ -93,7 +93,7 @@ if (!defined($official)) {$official="";}
 if (!defined($milestone)) {$milestone="";}
 if (!defined($module)) {$module="";}
 if (!defined($binary)) {$binary="";}
-if (!defined($displayname)) {$displayname="Mozilla";}
+if (!defined($displayname)) {$displayname="UXP";}
 if (!defined($appversion)) {$appversion=$milestone;}
 if (!defined($depth)) {$depth=".";}
 if (!defined($rcinclude)) {$rcinclude="";}
@@ -234,10 +234,10 @@ for ($j = 1; $j < 4; $j++)
 }
 my $winappversion = "$appver[0],$appver[1],$appver[2],$appver[3]";
 
-my $copyright = "License: MPL 2";
-my $company = "Mozilla Foundation";
-my $trademarks = "Mozilla";
-my $productname = $displayname;
+my $copyright = "License: MPL 2.0";
+my $company = "Moonchild Productions";
+my $trademarks = "Moonchild";
+my $productname = "UXP";
 
 
 if (defined($override_comment)){$override_comment =~ s/\@MOZ_APP_DISPLAYNAME\@/$displayname/g; $comment=$override_comment;}

db/mork/moz.build

@@ -3,9 +3,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-if not CONFIG['NSS_DISABLE_DBM'] and CONFIG['MOZ_MORK']:
-    DIRS += [
-        'public',
-        'src',
-        'build',
-    ]
+DIRS += [
+    'public',
+    'src',
+    'build',
+]

db/moz.build

@@ -1,11 +0,0 @@
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-if not CONFIG['NSS_DISABLE_DBM'] and CONFIG['MOZ_MORK']:
-    DIRS += [
-        'mork/public',
-        'mork/src',
-        'mork/build',
-    ]

db/sqlite3/src/moz.build

@@ -3,25 +3,18 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
-NO_VISIBILITY_FLAGS = True
 
-EXPORTS += [
-    'sqlite3.h',
-]
+NO_VISIBILITY_FLAGS = True
 
 # We allow warnings for third-party code that can be updated from upstream.
 ALLOW_COMPILER_WARNINGS = True
 
-if CONFIG['MOZ_FOLD_LIBS']:
-    # When folding libraries, sqlite is actually in the nss library.
-    FINAL_LIBRARY = 'nss'
-else:
-    # The final library is in config/external/sqlite
-    FINAL_LIBRARY = 'sqlite'
+GeckoSharedLibrary('sqlite', linkage=None, mozglue='library')
+SHARED_LIBRARY_NAME = 'mozsqlite3'
+SYMBOLS_FILE = 'sqlite.symbols'
 
-SOURCES += [
-    'sqlite3.c',
-]
+EXPORTS += ['sqlite3.h']
+SOURCES += ['sqlite3.c']
 
 # -DSQLITE_SECURE_DELETE=1 will cause SQLITE to 0-fill delete data so we
 # don't have to vacuum to make sure the data is not visible in the file.
@@ -34,8 +27,11 @@ SOURCES += [
 # hidden preference.  If that preference is missing or invalid then this value
 # will be used.
 # Note: Be sure to update the configure.in checks when these change!
-for var in ('SQLITE_SECURE_DELETE', 'SQLITE_THREADSAFE', 'SQLITE_CORE',
-            'SQLITE_ENABLE_FTS3', 'SQLITE_ENABLE_UNLOCK_NOTIFY',
+for var in ('SQLITE_SECURE_DELETE',
+            'SQLITE_THREADSAFE',
+            'SQLITE_CORE',
+            'SQLITE_ENABLE_FTS3',
+            'SQLITE_ENABLE_UNLOCK_NOTIFY',
             'SQLITE_ENABLE_DBSTAT_VTAB'):
     DEFINES[var] = 1
 
@@ -67,10 +63,6 @@ if CONFIG['MOZ_DEBUG']:
     DEFINES['SQLITE_DEBUG'] = 1
     DEFINES['SQLITE_ENABLE_API_ARMOR'] = True
 
-if CONFIG['OS_TARGET'] == 'Android':
-    # default to user readable only to fit Android security model
-    DEFINES['SQLITE_DEFAULT_FILE_PERMISSIONS'] = '0600'
-
 # Force using malloc_usable_size when building with jemalloc because _msize
 # causes assertions on Win64. See bug 719579.
 if CONFIG['OS_ARCH'] == 'WINNT' and CONFIG['MOZ_MEMORY']:
@@ -86,10 +78,7 @@ DEFINES['SQLITE_OMIT_DECLTYPE'] = True
 # performance and doesn't suffer from a full separate tmp partition.
 # Exclude 32bit platforms due to address space fragmentation issues.
 # System Sqlite is managed through a PRAGMA instead.
-if CONFIG['OS_TARGET'] == 'Android':
-    # On Android there's no tmp partition, so always use a MEMORY temp store.
-    DEFINES['SQLITE_TEMP_STORE'] = 3
-elif CONFIG['HAVE_64BIT_BUILD']:
+if CONFIG['HAVE_64BIT_BUILD']:
     # On 64bit platforms default to a MEMORY temp store for performance.
     DEFINES['SQLITE_TEMP_STORE'] = 2
 

devtools/client/debugger/new/bundle.js

@@ -9828,7 +9828,7 @@ var Debugger =
 	        var host = httpActivity.hostname;
 	
 	        info.hsts = sss.isSecureHost(sss.HEADER_HSTS, host, flags);
-	        info.hpkp = sss.isSecureHost(sss.HEADER_HPKP, host, flags);
+	        info.hpkp = false;
 	      } else {
 	        DevToolsUtils.reportException("NetworkHelper.parseSecurityInfo", "Could not get HSTS/HPKP status as hostname is not available.");
 	        info.hsts = false;

devtools/client/inspector/computed/test/browser_computed_pseudo-element_01.js

@@ -33,7 +33,7 @@ function* testTopLeft(inspector, view) {
   let afterElement = children.nodes[children.nodes.length - 1];
   yield selectNode(afterElement, inspector);
   top = getComputedViewPropertyValue(view, "top");
-  is(top, "50%", "The computed view shows the correct top");
+  is(top, "96px", "The computed view shows the correct top");
   left = getComputedViewPropertyValue(view, "left");
-  is(left, "50%", "The computed view shows the correct left");
+  is(left, "96px", "The computed view shows the correct left");
 }

devtools/client/shared/curl.js

@@ -58,9 +58,21 @@ const Curl = {
    *         A cURL command.
    */
   generateCommand: function (data) {
-    let utils = CurlUtils;
+    const utils = CurlUtils;
 
     let command = ["curl"];
+
+    // Make sure to use the following helpers to sanitize arguments before execution.
+    const addParam = value => {
+      const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
+      command.push(safe);
+    };
+
+    const addPostData = value => {
+      const safe = /^[a-zA-Z-]+$/.test(value) ? value : escapeString(value);
+      postData.push(safe);
+    };
+
     let ignoredHeaders = new Set();
 
     // The cURL command is expected to run on the same platform that Firefox runs
@@ -69,7 +81,7 @@ const Curl = {
                        utils.escapeStringWin : utils.escapeStringPosix;
 
     // Add URL.
-    command.push(escapeString(data.url));
+    addParam(data.url);
 
     let postDataText = null;
     let multipartRequest = utils.isMultipartRequest(data);
@@ -79,15 +91,15 @@ const Curl = {
     if (utils.isUrlEncodedRequest(data) ||
           ["PUT", "POST", "PATCH"].includes(data.method)) {
       postDataText = data.postDataText;
-      postData.push("--data");
-      postData.push(escapeString(utils.writePostDataTextParams(postDataText)));
+      addPostData("--data-raw");
+      addPostData(utils.writePostDataTextParams(postDataText));
       ignoredHeaders.add("content-length");
     } else if (multipartRequest) {
       postDataText = data.postDataText;
-      postData.push("--data-binary");
+      addPostData("--data-binary");
       let boundary = utils.getMultipartBoundary(data);
       let text = utils.removeBinaryDataFromMultipartText(postDataText, boundary);
-      postData.push(escapeString(text));
+      addPostData(text);
       ignoredHeaders.add("content-length");
     }
 
@@ -95,15 +107,15 @@ const Curl = {
     // For GET and POST requests this is not necessary as GET is the
     // default. If --data or --binary is added POST is the default.
     if (!(data.method == "GET" || data.method == "POST")) {
-      command.push("-X");
-      command.push(data.method);
+      addParam("-X");
+      addParam(data.method);
     }
 
     // Add -I (HEAD)
     // For servers that supports HEAD.
     // This will fetch the header of a document only.
     if (data.method == "HEAD") {
-      command.push("-I");
+      addParam("-I");
     }
 
     // Add http version.
@@ -114,7 +126,7 @@ const Curl = {
       // data.httpVersion are HTTP/1.0, HTTP/1.1 and HTTP/2.0
       // So in case of HTTP/2.0 (which should ideally be HTTP/2) we are using
       // only major version, and full version in other cases
-      command.push("--http" + (version == "2.0" ? version.split(".")[0] : version));
+      addParam("--http" + (version == "2.0" ? version.split(".")[0] : version));
     }
 
     // Add request headers.
@@ -126,14 +138,14 @@ const Curl = {
     for (let i = 0; i < headers.length; i++) {
       let header = headers[i];
       if (header.name.toLowerCase() === "accept-encoding") {
-        command.push("--compressed");
+        addParam("--compressed");
         continue;
       }
       if (ignoredHeaders.has(header.name.toLowerCase())) {
         continue;
       }
-      command.push("-H");
-      command.push(escapeString(header.name + ": " + header.value));
+      addParam("-H");
+      addParam(header.name + ": " + header.value);
     }
 
     // Add post data.
@@ -388,7 +400,12 @@ const CurlUtils = {
    * Credit: Google DevTools
    */
   escapeStringWin: function (str) {
-    /* Replace quote by double quote (but not by \") because it is
+    /* 
+       Replace dollar sign because of commands (e.g $(cmd.exe)) in
+       powershell when using double quotes.
+       Useful details http://www.rlmueller.net/PowerShellEscape.htm
+
+       Replace quote by double quote (but not by \") because it is
        recognized by both cmd.exe and MS Crt arguments parser.
 
        Replace % by "%" because it could be expanded to an environment
@@ -402,7 +419,8 @@ const CurlUtils = {
        Replace new line outside of quotes since cmd.exe doesn't let
        to do it inside.
     */
-    return "\"" + str.replace(/"/g, "\"\"")
+    return "\"" + str.replace(/\$/g, "`$")
+                     .replace(/"/g, "\"\"")
                      .replace(/%/g, "\"%\"")
                      .replace(/\\/g, "\\\\")
                      .replace(/[\r\n]+/g, "\"^$&\"") + "\"";

devtools/moz.build

@@ -4,20 +4,14 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+DIRS += [
+    'server',
+    'shared',
+]
+
 if CONFIG['MOZ_DEVTOOLS']:
     DIRS += ['client']
 
-if CONFIG['MOZ_DEVTOOLS_SERVER']:
-    DIRS += [
-        'server',
-        'shared',
-    ]
-else:
-  DIRS += [
-      'shared/heapsnapshot',
-      'shared/jsinspector',
-  ]
-
 # /browser uses DIST_SUBDIR.  We opt-in to this treatment when building
 # DevTools for the browser to keep the root omni.ja slim for use by external XUL
 # apps.  Mulet also uses this since it includes /browser.

devtools/shared/heapsnapshot/moz.build

@@ -4,60 +4,12 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-with Files('**'):
-    BUG_COMPONENT = ('Firefox', 'Developer Tools: Memory')
-
-if CONFIG['ENABLE_TESTS']:
-    DIRS += ['tests/gtest']
-
-XPCSHELL_TESTS_MANIFESTS += [ 'tests/unit/xpcshell.ini' ]
-MOCHITEST_MANIFESTS += [ 'tests/mochitest/mochitest.ini' ]
-MOCHITEST_CHROME_MANIFESTS += [ 'tests/mochitest/chrome.ini' ]
-
-EXPORTS.mozilla.devtools += [
-    'AutoMemMap.h',
-    'CoreDump.pb.h',
-    'DeserializedNode.h',
-    'DominatorTree.h',
-    'FileDescriptorOutputStream.h',
-    'HeapSnapshot.h',
-    'HeapSnapshotTempFileHelperChild.h',
-    'HeapSnapshotTempFileHelperParent.h',
-    'ZeroCopyNSIOutputStream.h',
-]
-
-IPDL_SOURCES += [
-    'PHeapSnapshotTempFileHelper.ipdl',
-]
-
-include('/ipc/chromium/chromium-config.mozbuild')
-
-SOURCES += [
-    'AutoMemMap.cpp',
-    'CoreDump.pb.cc',
-    'DeserializedNode.cpp',
-    'DominatorTree.cpp',
-    'FileDescriptorOutputStream.cpp',
-    'HeapSnapshot.cpp',
-    'HeapSnapshotTempFileHelperParent.cpp',
-    'ZeroCopyNSIOutputStream.cpp',
-]
-
-# Disable RTTI in google protocol buffer
-DEFINES['GOOGLE_PROTOBUF_NO_RTTI'] = True
-
-FINAL_LIBRARY = 'xul'
-
-if CONFIG['MOZ_DEVTOOLS_SERVER']:
-    DevToolsModules(
-        'census-tree-node.js',
-        'CensusUtils.js',
-        'DominatorTreeNode.js',
-        'HeapAnalysesClient.js',
-        'HeapAnalysesWorker.js',
-        'HeapSnapshotFileUtils.js',
-        'shortest-paths.js',
-    )
-
-if CONFIG['GNU_CXX']:
-    CXXFLAGS += ['-Wno-error=shadow']
+DevToolsModules(
+    'census-tree-node.js',
+    'CensusUtils.js',
+    'DominatorTreeNode.js',
+    'HeapAnalysesClient.js',
+    'HeapAnalysesWorker.js',
+    'HeapSnapshotFileUtils.js',
+    'shortest-paths.js',
+)

devtools/shared/moz.build

@@ -17,7 +17,6 @@ DIRS += [
     'heapsnapshot',
     'inspector',
     'jsbeautify',
-    'jsinspector',
     'layout',
     'locales',
     'node-properties',

devtools/shared/webconsole/network-helper.js

@@ -668,7 +668,8 @@ var NetworkHelper = {
         let host = httpActivity.hostname;
 
         info.hsts = sss.isSecureHost(sss.HEADER_HSTS, host, flags);
-        info.hpkp = sss.isSecureHost(sss.HEADER_HPKP, host, flags);
+        // HPKP is no longer supported.
+        info.hpkp = false;
       } else {
         DevToolsUtils.reportException("NetworkHelper.parseSecurityInfo",
           "Could not get HSTS/HPKP status as hostname is not available.");

docs/Component docs/HTML Parser updates.md

@@ -0,0 +1,63 @@
+# Updating HTML5 parser code
+
+Our html5 parser is based on the java html5 parser from [Validator.nu](http://about.validator.nu/htmlparser/) by Henri Sivonen. It has been adopted by Mozilla and further updated, and has been imported as a whole into the UXP tree to have an independent and maintainable source of it that doesn't rely on external sources.
+
+## Stages
+Updating the parser code consists of 3 stages:
+- Make updates to the html parser source in java
+- Let the java parser regenerate part of its own code after the change
+- Translate the java source to C++
+
+This process was best explained in the [following Bugzilla comment](https://bugzilla.mozilla.org/show_bug.cgi?id=1378079#c6), which explain how to add a new attribute name ("is") to html5, inserted in this document for convenience:
+
+>> Is
+>> there any documentation on how to add a new nsHtml5AttributeName?
+>
+> I don't recall. I should get around to writing it.
+>
+>> Looks like
+>> I need to clone hg.mozilla.org/projects/htmlparser/ and generate a hash with
+>> it?
+>
+> Yes. Here's how:
+>
+> `cd parser/html/java/`
+> `make sync`
+>
+> Now you have a clone of [https://hg.mozilla.org/projects/htmlparser/](https://hg.mozilla.org/projects/htmlparser/) in > parser/html/java/htmlparser/
+>
+> `cd htmlparser/src/`
+> `$EDITOR nu/validator/htmlparser/impl/AttributeName.java`
+>
+> Search for the word "uncomment" and uncomment stuff according to the two comments that talk about uncommenting
+> Duplicate the declaration a normal attribute (nothings special in SVG mode, etc.). Let's use "alt", since it's the first one.
+> In the duplicate, replace ALT with IS and "alt" with "is".
+> Search for "ALT,", duplicate that line and change the duplicate to say "IS,"
+> Save.
+>
+> `javac nu/validator/htmlparser/impl/AttributeName.java`
+> `java nu.validator.htmlparser.impl.AttributeName`
+>
+> Copy and paste the output into nu/validator/htmlparser/impl/AttributeName.java replacing the text below the comment "START GENERATED CODE" and above the very last "}".
+> Recomment the bits that you uncommented earlier.
+> Save.
+>
+> `cd ../..` - Back to parser/html/java/
+> `make translate`
+
+## Organizing commits
+
+**The html5 parser code is fragile due to its generation and translation before being used as C++ in our tree. Do not touch or commit anything without a code peer nearby with knowledge of the parser and the commit process (at this moment that means Gaming4JC (@g4jc)), and communicate the changes thoroughly.**
+
+To organize this properly in our repo, commits should be split up when making these kinds of changes:
+1. Commit your code edits to the html parser
+2. Regenerate java into a translation-ready source
+3. Commit
+4. Translate and regenerate C++ code
+5. Check a build to make sure the changes have the intended result
+6. Commit
+
+This is needed because the source edit will sometimes be in parts that are self-generated and may otherwise be lost in generation noise, and because we want to keep a strict separation between commits resulting from developer work and those resulting from running scripts/automated processes.
+
+
+

docs/UXP Coding Style.md

@@ -1,4 +1,4 @@
-# UXP Coding Style Guide
+# UXP Coding Style Guide
 While our source tree is currently in a number of different Coding Styles and the general rule applies to adhere to style of surrounding code when you are making changes, it is our goal to unify the style of our source tree and making it adhere to a single style.
 This document describes the preferred style for new source code files and the preferred style to convert existing files to.
 
@@ -11,9 +11,9 @@ Our own managed and maintained code should adhere to this guide where possible o
 ## General formatting rules
 The following formatting rules apply to all code:
 - Always use spaces for indentation, never use tabs!
-- Put a space between a keyword and parenthesis, e.g. `if (`.
+- Put a space between a keyword and parenthesis, e.g. `if (`. Do _not_ put a space between a function/type-assignment name and its parenthesis, e.g. `function(somevar)` or `int32_t(somevar)`.
 - Put a space between variables and operators, e.g. `a == b`.
-- Put a space after a comma or semicolon in variable lists, e.g. `function (a, b, c)` or `for (i = 1; i < 10; i++)`.
+- Put a space after a comma or semicolon in variable lists, e.g. `function(a, b, c)` or `for (i = 1; i < 10; i++)`.
 - Indentation of scopes is 2 spaces.
 - Indentation of long lines is variable-aligned or expression-aligned (see "long line wrapping")
 - Conditional defines are always placed on column 1. This is also true for nested defines.
@@ -126,7 +126,7 @@ switch (variable) {
     code_for_1;
     code_for_1;
     break;
-  case value2:
+  case value2: // Comment describing 2 (alternative)
     code_for_2;
     code_for_2;
     // fallthrough
@@ -225,15 +225,251 @@ somelongvariable = somelongexpression ?
  
 ## JavaScript
 Applies to `*.js` and `*.jsm`.
+### General formatting guidelines
+- Place function signatures on the same line as js object identifiers, and do not use named function syntax in that case:
+  ```JavaScript
+  var myObject = {
+    myIdentifier: function(var1, var2) {
+      ...
+    },
+    myIdentifier2: function() {
+      ...
+    }
+  }
+  ```
+- Variable initializers should be placed on the variable declaration line if needed.
+  ```JavaScript
+  var fwdCommand = document.getElementById("Browser:Forward");
+  ```
+  ```JavaScript
+  var myObject = {
+    myVariable: null,
+    myString: "Something"
+  }
+  ```
+- Avoid placing executed code on the expression line. Preferably brace executed code.
+
+  WRONG:
+  ```JavaScript
+  if (a == b) do_something();
+  if (a == b) { do_something(); }
+  ```
+  DISCOURAGED:
+  ```JavaScript
+  if (a == b)
+    do_something();
+  ```
+  CORRECT:
+  ```JavaScript
+  if (a == b) {
+    do_something();
+  }
+  ```
+- Format in-lined variable functions as if you would format normal functions with the exception of closure: break with the opening brace, followed by code, and closing brace on its own line, followed immediately by any other variables passed in-line.
+  ```JavaScript
+  appMenuButton.addEventListener("mousedown", function(event) {
+      if (event.button == 0) {
+        appMenuOpening = new Date();
+      }
+    }, false);
+  ```
+- Don't use a space between `{` `}` braces in empty js objects, `{` `}` braces in empty function scopes, or `[` `]` brackets in empty arrays.
+
+### Flow control
+Flow control expressions should follow the following guidelines:
+- Scopes have their opening braces on the expression line
+- Scopes have their closing braces on a separate line, indent-aligned with the flow control expression
+- Any alternative flow control paths are generally started with an expression on the closing brace line. The logic behind this is that you should keep the flow control level visually the same for the executed code blocks with no breaks (a closing brace on its own line means "done").
+- Case statements are indented by 2 on a new line with the case expression on its own line.
+- Flow control default scopes are always placed at the bottom.
+
+#### if..else
+`if..else` statements example:
+```JavaScript
+if (something == somethingelse) {
+  true_case_code here;
+} else {
+  false_case_code here;
+}
+
+if (case1) {
+  case1_code here;
+} else if (case2) {
+  case2_code here;
+} else {
+  other_case_code here;
+}
+
+if (case1) {
+  case1_code here;
+} else {
+  if (case2) {
+    case2_code here;
+  }
+  case2_and_other_code here;
+}
+```
+#### for
+`for` loop example:
+```JavaScript
+for (let i = 1; i < max; i++) {
+  loop_code here;
+}
+
+for (let i = 0;; i++) {
+   do_something_with(i);
+   if (i > max) break;
+   ...
+}
+```
+#### while
+`while` loop example:
+```JavaScript
+while (something == true) {
+  loop_code here;
+}
+
+do {
+  execute_me_at_least_once();
+  ...
+} while (something == true);
+```
+#### switch..case
+`switch..case` flow control example:
+```JavaScript
+switch (variable) {
+  case value1:
+    // Comment describing 1
+    code_for_1;
+    code_for_1;
+    break;
+  case value2: // Comment describing 2 (alternative)
+    code_for_2;
+    code_for_2;
+    // fallthrough
+  case value3:
+  case value4:
+    code_for_3_and_4;
+    break;
+  default:
+    code_for_default;
+    code_for_default;
+}
+```
+Alternatively (braced):
+```JavaScript
+switch (variable) {
+  case value1: {
+    // Comment describing 1
+    code_for_1;
+    code_for_1;
+    break;
+  }
+  case value2: {
+    code_for_2;
+    code_for_2;
+    // fallthrough
+  }
+  case value3:
+  case value4: {
+    code_for_3_and_4;
+    break;
+  }
+  default: {
+    code_for_default;
+    code_for_default;
+  }
+}
+```
+
+#### try..catch
+- When using `try..catch` blocks, the use of optional catch binding is discouraged. Please always include the error variable.
+
+`try..catch` flow control examples:
+```JavaScript
+try {
+  do_something();
+} catch(e) {
+  handle_error(e);
+} finally {
+  always();
+}
+
+try {
+  do_something();
+} catch(e) {}
+
+try {
+  do_something();
+} finally {
+  always();
+}
+```
+DISCOURAGED
+```JavaScript
+try {
+  do_something();
+} catch {
+  // No error processing
+  do_something_else();
+}
+```
+
+### Long line wrapping
+If statements on a single line become overly long, they should be split into multiple lines:
+- Binary operators (including ternary) must be left on their original lines if the line break happens around the operator. The second line should start in the same column as the start of the expression in the first line.
+- Lists of variables (e.g. when calling or declaring a function) should be split at the wrapping column.
+- Long OOP calls should be split at the period with the period on the start of the new line, indented to the column of the first object, filling to the wrapping column where possible, including additional terms.
+- When breaking assignments/operations/logic, break right after the operator (`=`, `+`, `&&`, `||`, etc.)
+- **Don't break too rigorously**; short additions should be kept on the same line to keep things legible - use common sense and context for flexibility.
+
+WRONG:
+```JavaScript
+somelongobjectname.somelongfunction(
+  var1, var2, var3, var4, var5);
+
+if (somelongvariable == somelongothervariable
+  || somelongvariable2 == somelongothervariable2) {
+
+somelongvariable = somelongexpression ? somevalue1
+  : somevalue2;
+
+var iShouldntBeUsingThisLongOfAVarName
+  = someValueToAdd + someValueToAdd + someValueToAdd
+    + someValueToAdd;
+
+Cu.import("resource:///modules/DownloadsCommon.jsm", {}).
+          DownloadsCommon.initializeAllDataLinks();
+```
+CORRECT:
+```JavaScript
+somelongobjectname.somelongfunction(var1, var2, var3,
+                                    var4, var5);
+
+if (somelongvariable == somelongothervariable ||
+    somelongvariable2 == somelongothervariable2) {
+
+somelongvariable = somelongexpression ?
+                   somevalue1 :
+                   somevalue2;
+
+var iShouldntBeUsingThisLongOfAVarName =
+  someValueToAdd + someValueToAdd + someValueToAdd +
+  someValueToAdd;
+
+Cu.import("resource:///modules/DownloadsCommon.jsm", {})
+  .DownloadsCommon.initializeAllDataLinks();
+
+let sessionStartup = Cc["@mozilla.org/browser/sessionstartup;1"]
+                       .getService(Ci.nsISessionStartup);
+```
+
 ## XUL and other XML-derivatives 
 Applies to `*.xul`, `*.html`, `*.xhtml`.
+TODO
 ## IDL
 Applies to `*.idl`, `*.xpidl` and `*.webidl`.
-
-<!--stackedit_data:
-eyJoaXN0b3J5IjpbMjUzODYzMzMsMjg5MjUwODIsLTQzMjMzNz
-ExMSw4MzQ2MjYwNDksLTE5MDMyNzE5OTYsLTEwMTIwMjc3ODMs
-LTE4MzgzODM5MDIsODA5MjEzNTEyLC01Mzg0MjM4MDAsMzgyNj
-I3NDYzLDIwODYwMjIwODUsLTE1MjU5MjE2MjIsLTY1OTMzMTA0
-MCwtNzQwOTE5MDQ1LDE4Njc1NTQxNDJdfQ==
--->
+TODO
+## Python-esque
+Applies to `*.py`, `mozbuild` etc.
+TODO

docshell/base/nsAboutRedirector.cpp

@@ -119,12 +119,10 @@ static RedirEntry kRedirMap[] = {
     nsIAboutModule::URI_MUST_LOAD_IN_CHILD |
     nsIAboutModule::ALLOW_SCRIPT
   },
-#ifndef ANDROID
   {
     "profiles", "chrome://global/content/aboutProfiles.xhtml",
     nsIAboutModule::ALLOW_SCRIPT
   },
-#endif
   // about:srcdoc is unresolvable by specification.  It is included here
   // because the security manager would disallow srcdoc iframes otherwise.
   {

docshell/base/nsDocShell.cpp

@@ -860,6 +860,12 @@ nsDocShell::~nsDocShell()
     shPrivate->SetRootDocShell(nullptr);
   }
 
+  if (mContentViewer) {
+    mContentViewer->Close(nullptr);
+    mContentViewer->Destroy();
+    mContentViewer = nullptr;
+  }
+
   if (--gDocShellCount == 0) {
     NS_IF_RELEASE(sURIFixup);
   }
@@ -4943,13 +4949,11 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
       if (errorClass == nsINSSErrorsService::ERROR_CLASS_BAD_CERT) {
         error.AssignLiteral("nssBadCert");
 
-        // If this is an HTTP Strict Transport Security host or a pinned host
-        // and the certificate is bad, don't allow overrides (RFC 6797 section
-        // 12.1, HPKP draft spec section 2.6).
+        // If this is an HTTP Strict Transport Security host, don't allow
+        // overrides (RFC 6797 section 12.1).
         uint32_t flags =
           UsePrivateBrowsing() ? nsISocketProvider::NO_PERMANENT_STORAGE : 0;
         bool isStsHost = false;
-        bool isPinnedHost = false;
         if (XRE_IsParentProcess()) {
           nsCOMPtr<nsISiteSecurityService> sss =
             do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
@@ -4957,9 +4961,6 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
           rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aURI,
                                 flags, nullptr, &isStsHost);
           NS_ENSURE_SUCCESS(rv, rv);
-          rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HPKP, aURI,
-                                flags, nullptr, &isPinnedHost);
-          NS_ENSURE_SUCCESS(rv, rv);
         } else {
           mozilla::dom::ContentChild* cc =
             mozilla::dom::ContentChild::GetSingleton();
@@ -4967,8 +4968,6 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
           SerializeURI(aURI, uri);
           cc->SendIsSecureURI(nsISiteSecurityService::HEADER_HSTS, uri, flags,
                               &isStsHost);
-          cc->SendIsSecureURI(nsISiteSecurityService::HEADER_HPKP, uri, flags,
-                              &isPinnedHost);
         }
 
         if (Preferences::GetBool(
@@ -4976,11 +4975,9 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI,
           cssClass.AssignLiteral("expertBadCert");
         }
 
-        // HSTS/pinning takes precedence over the expert bad cert pref. We
+        // HSTS takes precedence over the expert bad cert pref. We
         // never want to show the "Add Exception" button for these sites.
-        // In the future we should differentiate between an HSTS host and a
-        // pinned host and display a more informative message to the user.
-        if (isStsHost || isPinnedHost) {
+        if (isStsHost) {
           cssClass.AssignLiteral("badStsCert");
         }
 
@@ -13356,24 +13353,9 @@ nsDocShell::EnsureScriptEnvironment()
   uint32_t chromeFlags;
   browserChrome->GetChromeFlags(&chromeFlags);
 
-  bool isModalContentWindow =
-    (mItemType == typeContent) &&
-    (chromeFlags & nsIWebBrowserChrome::CHROME_MODAL_CONTENT_WINDOW);
-  // There can be various other content docshells associated with the
-  // top-level window, like sidebars. Make sure that we only create an
-  // nsGlobalModalWindow for the primary content shell.
-  if (isModalContentWindow) {
-    nsCOMPtr<nsIDocShellTreeItem> primaryItem;
-    nsresult rv =
-      mTreeOwner->GetPrimaryContentShell(getter_AddRefs(primaryItem));
-    NS_ENSURE_SUCCESS(rv, rv);
-    isModalContentWindow = (primaryItem == this);
-  }
-
   // If our window is modal and we're not opened as chrome, make
   // this window a modal content window.
-  mScriptGlobal =
-    NS_NewScriptGlobalObject(mItemType == typeChrome, isModalContentWindow);
+  mScriptGlobal = NS_NewScriptGlobalObject(mItemType == typeChrome);
   MOZ_ASSERT(mScriptGlobal);
 
   mScriptGlobal->SetDocShell(this);

docshell/build/nsDocShellModule.cpp

@@ -25,10 +25,6 @@
 #ifdef MOZ_ENABLE_DBUS
 #include "nsDBusHandlerApp.h"
 #endif
-#if defined(MOZ_WIDGET_ANDROID)
-#include "nsExternalSharingAppService.h"
-#include "nsExternalURLHandlerService.h"
-#endif
 
 // session history
 #include "nsSHEntry.h"
@@ -85,10 +81,6 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(PlatformLocalHandlerApp_t)
 #ifdef MOZ_ENABLE_DBUS
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDBusHandlerApp)
 #endif
-#if defined(MOZ_WIDGET_ANDROID)
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsExternalSharingAppService)
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsExternalURLHandlerService)
-#endif
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(ContentHandlerService, Init)
 
 // session history
@@ -114,10 +106,6 @@ NS_DEFINE_NAMED_CID(NS_LOCALHANDLERAPP_CID);
 #ifdef MOZ_ENABLE_DBUS
 NS_DEFINE_NAMED_CID(NS_DBUSHANDLERAPP_CID);
 #endif
-#if defined(MOZ_WIDGET_ANDROID)
-NS_DEFINE_NAMED_CID(NS_EXTERNALSHARINGAPPSERVICE_CID);
-NS_DEFINE_NAMED_CID(NS_EXTERNALURLHANDLERSERVICE_CID);
-#endif
 NS_DEFINE_NAMED_CID(NS_SHENTRY_CID);
 NS_DEFINE_NAMED_CID(NS_SHTRANSACTION_CID);
 NS_DEFINE_NAMED_CID(NS_SHISTORY_CID);
@@ -142,10 +130,6 @@ const mozilla::Module::CIDEntry kDocShellCIDs[] = {
   { &kNS_LOCALHANDLERAPP_CID, false, nullptr, PlatformLocalHandlerApp_tConstructor },
 #ifdef MOZ_ENABLE_DBUS
   { &kNS_DBUSHANDLERAPP_CID, false, nullptr, nsDBusHandlerAppConstructor },
-#endif
-#if defined(MOZ_WIDGET_ANDROID)
-  { &kNS_EXTERNALSHARINGAPPSERVICE_CID, false, nullptr, nsExternalSharingAppServiceConstructor },
-  { &kNS_EXTERNALURLHANDLERSERVICE_CID, false, nullptr, nsExternalURLHandlerServiceConstructor },
 #endif
   { &kNS_SHENTRY_CID, false, nullptr, nsSHEntryConstructor },
   { &kNS_SHTRANSACTION_CID, false, nullptr, nsSHTransactionConstructor },
@@ -183,9 +167,7 @@ const mozilla::Module::ContractIDEntry kDocShellContracts[] = {
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "performance", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "plugins", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "serviceworkers", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
-#ifndef ANDROID
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "profiles", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
-#endif
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "srcdoc", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "support", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "telemetry", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
@@ -205,10 +187,6 @@ const mozilla::Module::ContractIDEntry kDocShellContracts[] = {
   { NS_LOCALHANDLERAPP_CONTRACTID, &kNS_LOCALHANDLERAPP_CID },
 #ifdef MOZ_ENABLE_DBUS
   { NS_DBUSHANDLERAPP_CONTRACTID, &kNS_DBUSHANDLERAPP_CID },
-#endif
-#if defined(MOZ_WIDGET_ANDROID)
-  { NS_EXTERNALSHARINGAPPSERVICE_CONTRACTID, &kNS_EXTERNALSHARINGAPPSERVICE_CID },
-  { NS_EXTERNALURLHANDLERSERVICE_CONTRACTID, &kNS_EXTERNALURLHANDLERSERVICE_CID },
 #endif
   { NS_SHENTRY_CONTRACTID, &kNS_SHENTRY_CID },
   { NS_SHTRANSACTION_CONTRACTID, &kNS_SHTRANSACTION_CID },

dom/abort/AbortController.cpp

@@ -0,0 +1,98 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "AbortController.h"
+#include "AbortSignal.h"
+#include "mozilla/dom/AbortControllerBinding.h"
+#include "WorkerPrivate.h"
+
+namespace mozilla {
+namespace dom {
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(AbortController, mGlobal, mSignal)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(AbortController)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(AbortController)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AbortController)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+/* static */ bool
+AbortController::IsEnabled(JSContext* aCx, JSObject* aGlobal)
+{
+  if (NS_IsMainThread()) {
+    return Preferences::GetBool("dom.abortController.enabled", false);
+  }
+
+  using namespace workers;
+
+  // Otherwise, check the pref via the WorkerPrivate
+  WorkerPrivate* workerPrivate = GetWorkerPrivateFromContext(aCx);
+  if (!workerPrivate) {
+    return false;
+  }
+
+  return workerPrivate->AbortControllerEnabled();
+}
+
+/* static */ already_AddRefed<AbortController>
+AbortController::Constructor(const GlobalObject& aGlobal, ErrorResult& aRv)
+{
+  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aGlobal.GetAsSupports());
+  if (!global) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  RefPtr<AbortController> abortController = new AbortController(global);
+  return abortController.forget();
+}
+
+AbortController::AbortController(nsIGlobalObject* aGlobal)
+  : mGlobal(aGlobal)
+  , mAborted(false)
+{}
+
+JSObject*
+AbortController::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
+{
+  return AbortControllerBinding::Wrap(aCx, this, aGivenProto);
+}
+
+nsIGlobalObject*
+AbortController::GetParentObject() const
+{
+  return mGlobal;
+}
+
+AbortSignal*
+AbortController::Signal()
+{
+  if (!mSignal) {
+    mSignal = new AbortSignal(this, mAborted);
+  }
+
+  return mSignal;
+}
+
+void
+AbortController::Abort()
+{
+  if (mAborted) {
+    return;
+  }
+
+  mAborted = true;
+
+  if (mSignal) {
+    mSignal->Abort();
+  }
+}
+
+} // dom namespace
+} // mozilla namespace

dom/abort/AbortController.h

@@ -0,0 +1,59 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AbortController_h
+#define mozilla_dom_AbortController_h
+
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/AbortSignal.h" 
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+#include "mozilla/ErrorResult.h"
+#include "nsIGlobalObject.h"
+
+namespace mozilla {
+namespace dom {
+
+class AbortController final : public nsISupports
+                            , public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(AbortController)
+
+  static bool
+  IsEnabled(JSContext* aCx, JSObject* aGlobal);
+
+  static already_AddRefed<AbortController>
+  Constructor(const GlobalObject& aGlobal, ErrorResult& aRv);
+
+  explicit AbortController(nsIGlobalObject* aGlobal);
+
+  JSObject*
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
+
+  nsIGlobalObject*
+  GetParentObject() const;
+
+  AbortSignal*
+  Signal();
+
+  void
+  Abort();
+
+private:
+  ~AbortController() = default;
+
+  nsCOMPtr<nsIGlobalObject> mGlobal;
+  RefPtr<AbortSignal> mSignal;
+
+  bool mAborted;
+};
+
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_AbortController_h

dom/abort/AbortSignal.cpp

@@ -0,0 +1,124 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "AbortSignal.h"
+#include "AbortController.h"
+#include "mozilla/dom/Event.h"
+#include "mozilla/dom/AbortSignalBinding.h"
+
+namespace mozilla {
+namespace dom {
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(AbortSignal)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(AbortSignal,
+                                                  DOMEventTargetHelper)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mController)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(AbortSignal,
+                                                DOMEventTargetHelper)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mController)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(AbortSignal)
+NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
+
+NS_IMPL_ADDREF_INHERITED(AbortSignal, DOMEventTargetHelper)
+NS_IMPL_RELEASE_INHERITED(AbortSignal, DOMEventTargetHelper)
+
+AbortSignal::AbortSignal(AbortController* aController,
+                         bool aAborted)
+  : DOMEventTargetHelper(aController->GetParentObject())
+  , mController(aController)
+  , mAborted(aAborted)
+{}
+
+AbortSignal::AbortSignal(bool aAborted)
+  : mAborted(aAborted)
+{}
+
+JSObject*
+AbortSignal::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
+{
+  return AbortSignalBinding::Wrap(aCx, this, aGivenProto);
+}
+
+bool
+AbortSignal::Aborted() const
+{
+  return mAborted;
+}
+
+void
+AbortSignal::Abort()
+{
+  MOZ_ASSERT(!mAborted);
+  mAborted = true;
+
+  // Let's inform the followers.
+  for (uint32_t i = 0; i < mFollowers.Length(); ++i) {
+    mFollowers[i]->Aborted();
+  }
+
+  EventInit init;
+  init.mBubbles = false;
+  init.mCancelable = false;
+
+  RefPtr<Event> event =
+    Event::Constructor(this, NS_LITERAL_STRING("abort"), init);
+  event->SetTrusted(true);
+
+  bool dummy;
+  DispatchEvent(event, &dummy);
+}
+
+void
+AbortSignal::AddFollower(AbortSignal::Follower* aFollower)
+{
+  MOZ_DIAGNOSTIC_ASSERT(aFollower);
+  if (!mFollowers.Contains(aFollower)) {
+    mFollowers.AppendElement(aFollower);
+  }
+}
+
+void
+AbortSignal::RemoveFollower(AbortSignal::Follower* aFollower)
+{
+  MOZ_DIAGNOSTIC_ASSERT(aFollower);
+  mFollowers.RemoveElement(aFollower);
+}
+
+// AbortSignal::Follower
+// ----------------------------------------------------------------------------
+
+AbortSignal::Follower::~Follower()
+{
+  Unfollow();
+}
+
+void
+AbortSignal::Follower::Follow(AbortSignal* aSignal)
+{
+  MOZ_DIAGNOSTIC_ASSERT(aSignal);
+
+  Unfollow();
+
+  mFollowingSignal = aSignal;
+  aSignal->AddFollower(this);
+}
+
+void
+AbortSignal::Follower::Unfollow()
+{
+  if (mFollowingSignal) {
+    mFollowingSignal->RemoveFollower(this);
+    mFollowingSignal = nullptr;
+  }
+}
+
+} // dom namespace
+} // mozilla namespace

dom/abort/AbortSignal.h

@@ -0,0 +1,76 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AbortSignal_h
+#define mozilla_dom_AbortSignal_h
+
+#include "mozilla/DOMEventTargetHelper.h"
+
+namespace mozilla {
+namespace dom {
+
+class AbortController;
+class AbortSignal;
+
+class AbortSignal final : public DOMEventTargetHelper
+{
+public:
+  // This class must be implemented by objects who want to follow a AbortSignal.
+  class Follower
+  {
+  public:
+    virtual void Aborted() = 0;
+
+  protected:
+    virtual ~Follower();
+
+    void
+    Follow(AbortSignal* aSignal);
+
+    void
+    Unfollow();
+
+    RefPtr<AbortSignal> mFollowingSignal;
+  };
+
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(AbortSignal, DOMEventTargetHelper)
+
+  AbortSignal(AbortController* aController, bool aAborted);
+  explicit AbortSignal(bool aAborted);
+
+  JSObject*
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
+
+  bool
+  Aborted() const;
+
+  void
+  Abort();
+
+  IMPL_EVENT_HANDLER(abort);
+
+  void
+  AddFollower(Follower* aFollower);
+
+  void
+  RemoveFollower(Follower* aFollower);
+
+private:
+  ~AbortSignal() = default;
+
+  RefPtr<AbortController> mController;
+
+  // Raw pointers. Follower unregisters itself in the DTOR.
+  nsTArray<Follower*> mFollowers;
+
+  bool mAborted;
+};
+
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_AbortSignal_h

dom/abort/moz.build

@@ -0,0 +1,26 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+with Files("**"):
+    BUG_COMPONENT = ("Core", "DOM")
+
+TEST_DIRS += ['tests']
+
+EXPORTS.mozilla.dom += [
+    'AbortController.h',
+    'AbortSignal.h',
+]
+
+UNIFIED_SOURCES += [
+    'AbortController.cpp',
+    'AbortSignal.cpp',
+]
+
+LOCAL_INCLUDES += [
+    '../workers',
+]
+
+FINAL_LIBRARY = 'xul'

dom/abort/tests/file_abort_controller.html

@@ -0,0 +1,113 @@
+<script>
+function ok(a, msg) {
+  parent.postMessage({ type: "check", status: !!a, message: msg }, "*");
+}
+
+function is(a, b, msg) {
+  ok(a === b, msg);
+}
+
+function testWebIDL() {
+  ok("FetchController" in self, "We have a FetchController prototype");
+  ok("FetchSignal" in self, "We have a FetchSignal prototype");
+
+  var fc = new FetchController();
+  ok(!!fc, "FetchController can be created");
+  ok(fc instanceof FetchController, "FetchController is a FetchController");
+
+  ok(!!fc.signal, "FetchController has a signal");
+  ok(fc.signal instanceof FetchSignal, "fetchSignal is a FetchSignal");
+  is(fc.signal.aborted, false, "By default FetchSignal.aborted is false");
+  next();
+}
+
+function testUpdateData() {
+  var fc = new FetchController();
+ 
+  is(fc.signal.aborted, false, "By default FetchSignal.aborted is false");
+ 
+  fc.abort();
+  is(fc.signal.aborted, true, "Signal is aborted");
+ 
+  next();
+}
+ 
+function testAbortEvent() {
+  var fc = new FetchController();
+  fc.signal.onabort = function(e) {
+    is(e.type, "abort", "Abort received");
+    next();
+  }
+  fc.abort();
+}
+ 
+function testAbortedFetch() {
+  var fc = new FetchController();
+  fc.abort();
+
+  fetch('slow.sjs', { signal: fc.signal }).then(() => {
+    ok(false, "Fetch should not return a resolved promise");
+  }, e => {
+    is(e.name, "AbortError", "We have an abort error");
+  }).then(next);
+}
+
+function testFetchAndAbort() {
+  var fc = new FetchController();
+
+  var p = fetch('slow.sjs', { signal: fc.signal });
+  fc.abort();
+
+  p.then(() => {
+    ok(false, "Fetch should not return a resolved promise");
+  }, e => {
+    is(e.name, "AbortError", "We have an abort error");
+  }).then(next);
+}
+
+function testWorkerAbortedFetch() {
+  var w = new Worker('worker_fetch_controller.js');
+  w.onmessage = function(e) {
+    ok(e.data, "Abort + Fetch works in workers");
+    next();
+  }
+  w.postMessage('testWorkerAbortedFetch');
+}
+
+function testWorkerFetchAndAbort() {
+  var w = new Worker('worker_fetch_controller.js');
+  w.onmessage = function(e) {
+    ok(e.data, "Abort + Fetch works in workers");
+    next();
+  }
+  w.postMessage('testWorkerFetchAndAbort');
+}
+
+var steps = [
+  // Simple stuff
+  testWebIDL,
+  testUpdateData,
+
+  // Event propagation
+  testAbortEvent,
+
+  // fetch + signaling
+  testAbortedFetch,
+  testFetchAndAbort,
+  testWorkerAbortedFetch,
+  testWorkerFetchAndAbort,
+];
+
+function next() {
+  if (!steps.length) {
+    parent.postMessage({ type: "finish" }, "*");
+    return;
+  }
+
+  var step = steps.shift();
+  step();
+}
+
+next();
+
+</script>

dom/abort/tests/mochitest.ini

@@ -0,0 +1,6 @@
+[DEFAULT]
+support-files =
+  file_abort_controller.html
+  worker_fetch_controller.js
+
+[test_abort_controller.html]

dom/abort/tests/moz.build

@@ -0,0 +1,8 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOCHITEST_MANIFESTS += ['mochitest.ini']
+

dom/abort/tests/test_abort_controller.html

@@ -0,0 +1,40 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test FetchController</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<script class="testbody" type="text/javascript">
+
+SpecialPowers.pushPrefEnv({"set": [["dom.fetchController.enabled", true ]]}, () => {
+  let ifr = document.createElement('iframe');
+  ifr.src = "file_fetch_controller.html";
+  document.body.appendChild(ifr);
+
+  onmessage = function(e) {
+    if (e.data.type == "finish") {
+      SimpleTest.finish();
+      return;
+    }
+
+    if (e.data.type == "check") {
+      ok(e.data.status, e.data.message);
+      return;
+    }
+
+    ok(false, "Something when wrong.");
+  }
+});
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+</body>
+</html>
+

dom/abort/tests/worker_abort_controller.js

@@ -0,0 +1,27 @@
+function testWorkerAbortedFetch() {
+  var fc = new AbortController();
+  fc.abort();
+
+  fetch('slow.sjs', { signal: fc.signal }).then(() => {
+    postMessage(false);
+  }, e => {
+    postMessage(e.name == "AbortError");
+  });
+}
+
+function testWorkerFetchAndAbort() {
+  var fc = new AbortController();
+
+  var p = fetch('slow.sjs', { signal: fc.signal });
+  fc.abort();
+
+  p.then(() => {
+    postMessage(false);
+  }, e => {
+    postMessage(e.name == "AbortError");
+  });
+}
+
+onmessage = function(e) {
+  self[e.data]();
+}

dom/animation/AnimationComparator.h

@@ -7,6 +7,8 @@
 #ifndef mozilla_AnimationComparator_h
 #define mozilla_AnimationComparator_h
 
+#include "mozilla/dom/Animation.h"
+
 namespace mozilla {
 
 // Although this file is called AnimationComparator, we don't actually

dom/animation/AnimationEffectReadOnly.cpp

@@ -6,6 +6,7 @@
 
 #include "mozilla/dom/AnimationEffectReadOnly.h"
 #include "mozilla/dom/AnimationEffectReadOnlyBinding.h"
+#include "mozilla/dom/Animation.h"
 #include "mozilla/AnimationUtils.h"
 #include "mozilla/FloatingPoint.h"
 

dom/animation/AnimationPerformanceWarning.h

@@ -9,6 +9,9 @@
 
 #include <initializer_list>
 
+#include "mozilla/Maybe.h"
+#include "nsTArray.h"
+
 class nsXPIDLString;
 
 namespace mozilla {

dom/animation/CSSPseudoElement.cpp

@@ -7,6 +7,7 @@
 #include "mozilla/dom/CSSPseudoElement.h"
 #include "mozilla/dom/CSSPseudoElementBinding.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/KeyframeEffectBinding.h" // for ElementOrCSSPseudoElement class
 #include "mozilla/AnimationComparator.h"
 
 namespace mozilla {

dom/animation/EffectCompositor.cpp

@@ -356,24 +356,16 @@ EffectCompositor::GetElementToRestyle(dom::Element* aElement,
     return aElement;
   }
 
-  nsIFrame* primaryFrame = aElement->GetPrimaryFrame();
-  if (!primaryFrame) {
-    return nullptr;
-  }
-  nsIFrame* pseudoFrame;
   if (aPseudoType == CSSPseudoElementType::before) {
-    pseudoFrame = nsLayoutUtils::GetBeforeFrame(primaryFrame);
-  } else if (aPseudoType == CSSPseudoElementType::after) {
-    pseudoFrame = nsLayoutUtils::GetAfterFrame(primaryFrame);
-  } else {
-    NS_NOTREACHED("Should not try to get the element to restyle for a pseudo "
-                  "other that :before or :after");
-    return nullptr;
+    return nsLayoutUtils::GetBeforePseudo(aElement);
   }
-  if (!pseudoFrame) {
-    return nullptr;
+  if (aPseudoType == CSSPseudoElementType::after) {
+    return nsLayoutUtils::GetAfterPseudo(aElement);
   }
-  return pseudoFrame->GetContent()->AsElement();
+
+  NS_NOTREACHED("Should not try to get the element to restyle for a pseudo "
+                "other that :before or :after");
+  return nullptr;
 }
 
 bool

dom/animation/KeyframeEffect.cpp

@@ -11,6 +11,7 @@
 #include "mozilla/dom/AnimationEffectTiming.h"
 #include "mozilla/dom/KeyframeEffectBinding.h"
 #include "mozilla/KeyframeUtils.h"
+#include "nsContentUtils.h"
 #include "nsDOMMutationObserver.h" // For nsAutoAnimationMutationBatch
 #include "nsIScriptError.h"
 

dom/animation/KeyframeEffectReadOnly.cpp

@@ -6,6 +6,7 @@
 
 #include "mozilla/dom/KeyframeEffectReadOnly.h"
 
+#include "mozilla/dom/Animation.h"
 #include "mozilla/dom/KeyframeAnimationOptionsBinding.h"
   // For UnrestrictedDoubleOrKeyframeAnimationOptions;
 #include "mozilla/dom/CSSPseudoElement.h"
@@ -25,6 +26,7 @@
 #include "nsCSSPseudoElements.h" // For CSSPseudoElementType
 #include "nsIPresShell.h"
 #include "nsIScriptError.h"
+#include "nsRefreshDriver.h"
 
 namespace mozilla {
 
@@ -1105,19 +1107,17 @@ KeyframeEffectReadOnly::GetAnimationFrame() const
     return nullptr;
   }
 
-  nsIFrame* frame = mTarget->mElement->GetPrimaryFrame();
-  if (!frame) {
-    return nullptr;
-  }
-
+  nsIFrame* frame;
   if (mTarget->mPseudoType == CSSPseudoElementType::before) {
-    frame = nsLayoutUtils::GetBeforeFrame(frame);
+    frame = nsLayoutUtils::GetBeforeFrame(mTarget->mElement);
   } else if (mTarget->mPseudoType == CSSPseudoElementType::after) {
-    frame = nsLayoutUtils::GetAfterFrame(frame);
+    frame = nsLayoutUtils::GetAfterFrame(mTarget->mElement);
   } else {
+    frame = mTarget->mElement->GetPrimaryFrame();
     MOZ_ASSERT(mTarget->mPseudoType == CSSPseudoElementType::NotPseudo,
                "unknown mTarget->mPseudoType");
   }
+
   if (!frame) {
     return nullptr;
   }

dom/animation/moz.build

@@ -37,6 +37,11 @@ EXPORTS.mozilla += [
 ]
 
 UNIFIED_SOURCES += [
+    'KeyframeEffect.cpp',
+    'KeyframeEffectReadOnly.cpp',
+]
+
+SOURCES += [
     'Animation.cpp',
     'AnimationEffectReadOnly.cpp',
     'AnimationEffectTiming.cpp',
@@ -50,9 +55,7 @@ UNIFIED_SOURCES += [
     'DocumentTimeline.cpp',
     'EffectCompositor.cpp',
     'EffectSet.cpp',
-    'KeyframeEffect.cpp',
     'KeyframeEffectParams.cpp',
-    'KeyframeEffectReadOnly.cpp',
     'KeyframeUtils.cpp',
     'PendingAnimationTracker.cpp',
     'TimingParams.cpp',

dom/archivereader/ArchiveRequest.cpp

@@ -8,10 +8,12 @@
 
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/dom/ArchiveRequestBinding.h"
+#include "mozilla/dom/File.h"
 #include "mozilla/dom/ScriptSettings.h"
 #include "nsContentUtils.h"
 
 using namespace mozilla;
+using namespace mozilla::dom;
 
 USING_ARCHIVEREADER_NAMESPACE
 
@@ -69,10 +71,10 @@ ArchiveRequest::~ArchiveRequest()
 }
 
 nsresult
-ArchiveRequest::PreHandleEvent(EventChainPreVisitor& aVisitor)
+ArchiveRequest::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 {
   aVisitor.mCanHandle = true;
-  aVisitor.mParentTarget = nullptr;
+  aVisitor.SetParentTarget(nullptr, false);
   return NS_OK;
 }
 

dom/archivereader/ArchiveRequest.h

@@ -38,7 +38,8 @@ public:
                  ArchiveReader* aReader);
 
   // nsIDOMEventTarget
-  virtual nsresult PreHandleEvent(EventChainPreVisitor& aVisitor) override;
+  virtual nsresult GetEventTargetParent(
+                     EventChainPreVisitor& aVisitor) override;
 
 public:
   // This is called by the DOMArchiveRequestEvent

dom/archivereader/ArchiveZipFile.cpp

@@ -12,6 +12,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/File.h"
 
+using namespace mozilla;
 using namespace mozilla::dom;
 USING_ARCHIVEREADER_NAMESPACE
 

dom/archivereader/moz.build

@@ -13,7 +13,7 @@ EXPORTS.mozilla.dom.archivereader += [
     'ArchiveZipFile.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'ArchiveEvent.cpp',
     'ArchiveReader.cpp',
     'ArchiveRequest.cpp',

dom/audiochannel/moz.build

@@ -16,14 +16,12 @@ EXPORTS += [
     'AudioChannelService.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'AudioChannelAgent.cpp',
     'AudioChannelService.cpp',
 ]
 
-LOCAL_INCLUDES += [
-    '/dom/base/',
-]
+LOCAL_INCLUDES += ['/dom/base/']
 
 include('/ipc/chromium/chromium-config.mozbuild')
 

dom/base/AnonymousContent.cpp

@@ -7,6 +7,7 @@
 #include "AnonymousContent.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/AnonymousContentBinding.h"
+#include "nsComputedDOMStyle.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIDocument.h"
 #include "nsIDOMHTMLCollection.h"
@@ -208,5 +209,31 @@ AnonymousContent::WrapObject(JSContext* aCx,
   return AnonymousContentBinding::Wrap(aCx, this, aGivenProto, aReflector);
 }
 
+void
+AnonymousContent::GetComputedStylePropertyValue(const nsAString& aElementId,
+                                                const nsAString& aPropertyName,
+                                                DOMString& aResult,
+                                                ErrorResult& aRv)
+{
+  Element* element = GetElementById(aElementId);
+  if (!element) {
+    aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+    return;
+  }
+
+  nsIPresShell* shell = element->OwnerDoc()->GetShell();
+  if (!shell) {
+    aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+    return;
+  }
+
+  RefPtr<nsComputedDOMStyle> cs =
+    new nsComputedDOMStyle(element,
+                           NS_LITERAL_STRING(""),
+                           element->OwnerDoc(),
+                           nsComputedDOMStyle::eAll);
+  aRv = cs->GetPropertyValue(aPropertyName, aResult);
+}
+
 } // namespace dom
 } // namespace mozilla

dom/base/AnonymousContent.h

@@ -68,6 +68,11 @@ public:
                                 const Sequence<OwningNonNull<DOMRect>>& aRects,
                                 ErrorResult& aError);
 
+  void GetComputedStylePropertyValue(const nsAString& aElementId,
+                                     const nsAString& aPropertyName,
+                                     DOMString& aResult,
+                                     ErrorResult& aRv);
+
 private:
   ~AnonymousContent();
   nsCOMPtr<Element> mContentNode;

dom/base/Attr.cpp

@@ -344,7 +344,7 @@ Attr::RemoveChildAt(uint32_t aIndex, bool aNotify)
 }
 
 nsresult
-Attr::PreHandleEvent(EventChainPreVisitor& aVisitor)
+Attr::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 {
   aVisitor.mCanHandle = true;
   return NS_OK;

dom/base/Attr.h

@@ -54,7 +54,7 @@ public:
   // nsIDOMAttr interface
   NS_DECL_NSIDOMATTR
 
-  virtual nsresult PreHandleEvent(EventChainPreVisitor& aVisitor) override;
+  virtual nsresult GetEventTargetParent(EventChainPreVisitor& aVisitor) override;
 
   // nsIAttribute interface
   void SetMap(nsDOMAttributeMap *aMap) override;

dom/base/BlobSet.h

@@ -8,6 +8,9 @@
 #define mozilla_dom_BlobSet_h
 
 #include "mozilla/RefPtr.h"
+#include "jsfriendapi.h"
+#include "nsString.h"
+#include "nsTArray.h"
 
 namespace mozilla {
 namespace dom {

dom/base/CORSMode.h

@@ -4,6 +4,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <stdint.h>
+
 #ifndef CORSMode_h_
 #define CORSMode_h_
 

dom/base/ChildIterator.cpp

@@ -6,61 +6,27 @@
 
 #include "ChildIterator.h"
 #include "nsContentUtils.h"
+#include "mozilla/dom/HTMLSlotElement.h"
 #include "mozilla/dom/XBLChildrenElement.h"
-#include "mozilla/dom/HTMLContentElement.h"
-#include "mozilla/dom/HTMLShadowElement.h"
 #include "mozilla/dom/ShadowRoot.h"
 #include "nsIAnonymousContentCreator.h"
 #include "nsIFrame.h"
 #include "nsCSSAnonBoxes.h"
+#include "nsDocument.h"
 
 namespace mozilla {
 namespace dom {
 
-class MatchedNodes {
-public:
-  explicit MatchedNodes(HTMLContentElement* aInsertionPoint)
-    : mIsContentElement(true), mContentElement(aInsertionPoint) {}
-
-  explicit MatchedNodes(XBLChildrenElement* aInsertionPoint)
-    : mIsContentElement(false), mChildrenElement(aInsertionPoint) {}
-
-  uint32_t Length() const
-  {
-    return mIsContentElement ? mContentElement->MatchedNodes().Length()
-                             : mChildrenElement->InsertedChildrenLength();
-  }
-
-  nsIContent* operator[](int32_t aIndex) const
-  {
-    return mIsContentElement ? mContentElement->MatchedNodes()[aIndex]
-                             : mChildrenElement->InsertedChild(aIndex);
-  }
-
-  bool IsEmpty() const
-  {
-    return mIsContentElement ? mContentElement->MatchedNodes().IsEmpty()
-                             : !mChildrenElement->HasInsertedChildren();
-  }
-protected:
-  bool mIsContentElement;
-  union {
-    HTMLContentElement* mContentElement;
-    XBLChildrenElement* mChildrenElement;
-  };
-};
-
-static inline MatchedNodes
-GetMatchedNodesForPoint(nsIContent* aContent)
+ExplicitChildIterator::ExplicitChildIterator(const nsIContent* aParent,
+                                             bool aStartAtBeginning)
+  : mParent(aParent),
+    mChild(nullptr),
+    mDefaultChild(nullptr),
+    mIsFirst(aStartAtBeginning),
+    mIndexInInserted(0)
 {
-  if (aContent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-    // XBL case
-    return MatchedNodes(static_cast<XBLChildrenElement*>(aContent));
-  }
-
-  // Web components case
-  MOZ_ASSERT(aContent->IsHTMLElement(nsGkAtoms::content));
-  return MatchedNodes(HTMLContentElement::FromContent(aContent));
+  mParentAsSlot = nsDocument::IsWebComponentsEnabled(mParent) ?
+    HTMLSlotElement::FromContent(mParent) : nullptr;
 }
 
 nsIContent*
@@ -69,30 +35,29 @@ ExplicitChildIterator::GetNextChild()
   // If we're already in the inserted-children array, look there first
   if (mIndexInInserted) {
     MOZ_ASSERT(mChild);
-    MOZ_ASSERT(nsContentUtils::IsContentInsertionPoint(mChild));
     MOZ_ASSERT(!mDefaultChild);
 
-    MatchedNodes assignedChildren = GetMatchedNodesForPoint(mChild);
-    if (mIndexInInserted < assignedChildren.Length()) {
-      return assignedChildren[mIndexInInserted++];
-    }
-    mIndexInInserted = 0;
-    mChild = mChild->GetNextSibling();
-  } else if (mShadowIterator) {
-    // If we're inside of a <shadow> element, look through the
-    // explicit children of the projected ShadowRoot via
-    // the mShadowIterator.
-    nsIContent* nextChild = mShadowIterator->GetNextChild();
-    if (nextChild) {
-      return nextChild;
+    if (mParentAsSlot) {
+      const nsTArray<RefPtr<nsINode>>& assignedNodes =
+        mParentAsSlot->AssignedNodes();
+
+      mChild = (mIndexInInserted < assignedNodes.Length()) ?
+        assignedNodes[mIndexInInserted++]->AsContent() : nullptr;
+      return mChild;
     }
 
-    mShadowIterator = nullptr;
+    MOZ_ASSERT(mChild->IsActiveChildrenElement());
+    auto* childrenElement =
+      static_cast<XBLChildrenElement*>(mChild);
+    if (mIndexInInserted < childrenElement->InsertedChildrenLength()) {
+      return childrenElement->InsertedChild(mIndexInInserted++);
+    }
+    mIndexInInserted = 0;
     mChild = mChild->GetNextSibling();
   } else if (mDefaultChild) {
     // If we're already in default content, check if there are more nodes there
     MOZ_ASSERT(mChild);
-    MOZ_ASSERT(nsContentUtils::IsContentInsertionPoint(mChild));
+    MOZ_ASSERT(mChild->IsActiveChildrenElement());
 
     mDefaultChild = mDefaultChild->GetNextSibling();
     if (mDefaultChild) {
@@ -101,6 +66,19 @@ ExplicitChildIterator::GetNextChild()
 
     mChild = mChild->GetNextSibling();
   } else if (mIsFirst) {  // at the beginning of the child list
+    // For slot parent, iterate over assigned nodes if not empty, otherwise
+    // fall through and iterate over direct children (fallback content).
+    if (mParentAsSlot) {
+      const nsTArray<RefPtr<nsINode>>& assignedNodes =
+        mParentAsSlot->AssignedNodes();
+      if (!assignedNodes.IsEmpty()) {
+        mIndexInInserted = 1;
+        mChild = assignedNodes[0]->AsContent();
+        mIsFirst = false;
+        return mChild;
+      }
+    }
+
     mChild = mParent->GetFirstChild();
     mIsFirst = false;
   } else if (mChild) { // in the middle of the child list
@@ -110,31 +88,16 @@ ExplicitChildIterator::GetNextChild()
   // Iterate until we find a non-insertion point, or an insertion point with
   // content.
   while (mChild) {
-    // If the current child being iterated is a shadow insertion point then
-    // the iterator needs to go into the projected ShadowRoot.
-    if (ShadowRoot::IsShadowInsertionPoint(mChild)) {
-      // Look for the next child in the projected ShadowRoot for the <shadow>
-      // element.
-      HTMLShadowElement* shadowElem = HTMLShadowElement::FromContent(mChild);
-      ShadowRoot* projectedShadow = shadowElem->GetOlderShadowRoot();
-      if (projectedShadow) {
-        mShadowIterator = new ExplicitChildIterator(projectedShadow);
-        nsIContent* nextChild = mShadowIterator->GetNextChild();
-        if (nextChild) {
-          return nextChild;
-        }
-        mShadowIterator = nullptr;
-      }
-      mChild = mChild->GetNextSibling();
-    } else if (nsContentUtils::IsContentInsertionPoint(mChild)) {
+    if (mChild->IsActiveChildrenElement()) {
       // If the current child being iterated is a content insertion point
       // then the iterator needs to return the nodes distributed into
       // the content insertion point.
-      MatchedNodes assignedChildren = GetMatchedNodesForPoint(mChild);
-      if (!assignedChildren.IsEmpty()) {
+      auto* childrenElement =
+        static_cast<XBLChildrenElement*>(mChild);
+      if (childrenElement->HasInsertedChildren()) {
         // Iterate through elements projected on insertion point.
         mIndexInInserted = 1;
-        return assignedChildren[0];
+        return childrenElement->InsertedChild(0);
       }
 
       // Insertion points inside fallback/default content
@@ -192,19 +155,17 @@ FlattenedChildIterator::Init(bool aIgnoreXBL)
 }
 
 bool
-ExplicitChildIterator::Seek(nsIContent* aChildToFind)
+ExplicitChildIterator::Seek(const nsIContent* aChildToFind)
 {
   if (aChildToFind->GetParent() == mParent &&
       !aChildToFind->IsRootOfAnonymousSubtree()) {
     // Fast path: just point ourselves to aChildToFind, which is a
     // normal DOM child of ours.
-    MOZ_ASSERT(!ShadowRoot::IsShadowInsertionPoint(aChildToFind));
-    MOZ_ASSERT(!nsContentUtils::IsContentInsertionPoint(aChildToFind));
-    mChild = aChildToFind;
+    mChild = const_cast<nsIContent*>(aChildToFind);
     mIndexInInserted = 0;
-    mShadowIterator = nullptr;
     mDefaultChild = nullptr;
     mIsFirst = false;
+    MOZ_ASSERT(!mChild->IsActiveChildrenElement());
     return true;
   }
 
@@ -220,12 +181,18 @@ ExplicitChildIterator::Get() const
 {
   MOZ_ASSERT(!mIsFirst);
 
-  if (mIndexInInserted) {
-    MatchedNodes assignedChildren = GetMatchedNodesForPoint(mChild);
-    return assignedChildren[mIndexInInserted - 1];
-  } else if (mShadowIterator)  {
-    return mShadowIterator->Get();
+  // When mParentAsSlot is set, mChild is always set to the current child. It
+  // does not matter whether mChild is an assigned node or a fallback content.
+  if (mParentAsSlot) {
+    return mChild;
   }
+
+  if (mIndexInInserted) {
+    MOZ_ASSERT(mChild->IsActiveChildrenElement());
+    auto* childrenElement = static_cast<XBLChildrenElement*>(mChild);
+    return childrenElement->InsertedChild(mIndexInInserted - 1);
+  }
+
   return mDefaultChild ? mDefaultChild : mChild;
 }
 
@@ -234,20 +201,28 @@ ExplicitChildIterator::GetPreviousChild()
 {
   // If we're already in the inserted-children array, look there first
   if (mIndexInInserted) {
+
+    if (mParentAsSlot) {
+      const nsTArray<RefPtr<nsINode>>& assignedNodes =
+        mParentAsSlot->AssignedNodes();
+
+      mChild = (--mIndexInInserted) ?
+        assignedNodes[mIndexInInserted - 1]->AsContent() : nullptr;
+
+      if (!mChild) {
+        mIsFirst = true;
+      }
+      return mChild;
+    }
+
     // NB: mIndexInInserted points one past the last returned child so we need
     // to look *two* indices back in order to return the previous child.
-    MatchedNodes assignedChildren = GetMatchedNodesForPoint(mChild);
+    MOZ_ASSERT(mChild->IsActiveChildrenElement());
+    auto* childrenElement = static_cast<XBLChildrenElement*>(mChild);
     if (--mIndexInInserted) {
-      return assignedChildren[mIndexInInserted - 1];
+      return childrenElement->InsertedChild(mIndexInInserted - 1);
     }
     mChild = mChild->GetPreviousSibling();
-  } else if (mShadowIterator) {
-    nsIContent* previousChild = mShadowIterator->GetPreviousChild();
-    if (previousChild) {
-      return previousChild;
-    }
-    mShadowIterator = nullptr;
-    mChild = mChild->GetPreviousSibling();
   } else if (mDefaultChild) {
     // If we're already in default content, check if there are more nodes there
     mDefaultChild = mDefaultChild->GetPreviousSibling();
@@ -261,35 +236,32 @@ ExplicitChildIterator::GetPreviousChild()
   } else if (mChild) { // in the middle of the child list
     mChild = mChild->GetPreviousSibling();
   } else { // at the end of the child list
+    // For slot parent, iterate over assigned nodes if not empty, otherwise
+    // fall through and iterate over direct children (fallback content).
+    if (mParentAsSlot) {
+      const nsTArray<RefPtr<nsINode>>& assignedNodes =
+        mParentAsSlot->AssignedNodes();
+      if (!assignedNodes.IsEmpty()) {
+        mIndexInInserted = assignedNodes.Length();
+        mChild = assignedNodes[mIndexInInserted - 1]->AsContent();
+        return mChild;
+      }
+    }
+
     mChild = mParent->GetLastChild();
   }
 
   // Iterate until we find a non-insertion point, or an insertion point with
   // content.
   while (mChild) {
-    if (ShadowRoot::IsShadowInsertionPoint(mChild)) {
-      // If the current child being iterated is a shadow insertion point then
-      // the iterator needs to go into the projected ShadowRoot.
-      HTMLShadowElement* shadowElem = HTMLShadowElement::FromContent(mChild);
-      ShadowRoot* projectedShadow = shadowElem->GetOlderShadowRoot();
-      if (projectedShadow) {
-        // Create a ExplicitChildIterator that begins iterating from the end.
-        mShadowIterator = new ExplicitChildIterator(projectedShadow, false);
-        nsIContent* previousChild = mShadowIterator->GetPreviousChild();
-        if (previousChild) {
-          return previousChild;
-        }
-        mShadowIterator = nullptr;
-      }
-      mChild = mChild->GetPreviousSibling();
-    } else if (nsContentUtils::IsContentInsertionPoint(mChild)) {
+    if (mChild->IsActiveChildrenElement()) {
       // If the current child being iterated is a content insertion point
       // then the iterator needs to return the nodes distributed into
       // the content insertion point.
-      MatchedNodes assignedChildren = GetMatchedNodesForPoint(mChild);
-      if (!assignedChildren.IsEmpty()) {
-        mIndexInInserted = assignedChildren.Length();
-        return assignedChildren[mIndexInInserted - 1];
+      auto* childrenElement = static_cast<XBLChildrenElement*>(mChild);
+      if (childrenElement->HasInsertedChildren()) {
+        mIndexInInserted = childrenElement->InsertedChildrenLength();
+        return childrenElement->InsertedChild(mIndexInInserted - 1);
       }
 
       mDefaultChild = mChild->GetLastChild();
@@ -317,11 +289,9 @@ AllChildrenIterator::Get() const
 {
   switch (mPhase) {
     case eAtBeforeKid: {
-      nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-      MOZ_ASSERT(frame, "No frame at eAtBeforeKid phase");
-      nsIFrame* beforeFrame = nsLayoutUtils::GetBeforeFrame(frame);
-      MOZ_ASSERT(beforeFrame, "No content before frame at eAtBeforeKid phase");
-      return beforeFrame->GetContent();
+      Element* before = nsLayoutUtils::GetBeforePseudo(mOriginalContent);
+      MOZ_ASSERT(before, "No content before frame at eAtBeforeKid phase");
+      return before;
     }
 
     case eAtExplicitKids:
@@ -331,11 +301,9 @@ AllChildrenIterator::Get() const
       return mAnonKids[mAnonKidsIdx];
 
     case eAtAfterKid: {
-      nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-      MOZ_ASSERT(frame, "No frame at eAtAfterKid phase");
-      nsIFrame* afterFrame = nsLayoutUtils::GetAfterFrame(frame);
-      MOZ_ASSERT(afterFrame, "No content before frame at eAtBeforeKid phase");
-      return afterFrame->GetContent();
+      Element* after = nsLayoutUtils::GetAfterPseudo(mOriginalContent);
+      MOZ_ASSERT(after, "No content after frame at eAtAfterKid phase");
+      return after;
     }
 
     default:
@@ -345,19 +313,14 @@ AllChildrenIterator::Get() const
 
 
 bool
-AllChildrenIterator::Seek(nsIContent* aChildToFind)
+AllChildrenIterator::Seek(const nsIContent* aChildToFind)
 {
   if (mPhase == eAtBegin || mPhase == eAtBeforeKid) {
     mPhase = eAtExplicitKids;
-    nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* beforeFrame = nsLayoutUtils::GetBeforeFrame(frame);
-      if (beforeFrame) {
-        if (beforeFrame->GetContent() == aChildToFind) {
-          mPhase = eAtBeforeKid;
-          return true;
-        }
-      }
+    Element* beforePseudo = nsLayoutUtils::GetBeforePseudo(mOriginalContent);
+    if (beforePseudo && beforePseudo == aChildToFind) {
+      mPhase = eAtBeforeKid;
+      return true;
     }
   }
 
@@ -383,12 +346,10 @@ AllChildrenIterator::AppendNativeAnonymousChildren()
 
   // The root scroll frame is not the primary frame of the root element.
   // Detect and handle this case.
-  if (mOriginalContent == mOriginalContent->OwnerDoc()->GetRootElement()) {
-    nsIPresShell* presShell = mOriginalContent->OwnerDoc()->GetShell();
-    nsIFrame* scrollFrame = presShell ? presShell->GetRootScrollFrame() : nullptr;
-    if (scrollFrame) {
-      AppendNativeAnonymousChildrenFromFrame(scrollFrame);
-    }
+  if (!(mFlags & nsIContent::eSkipDocumentLevelNativeAnonymousContent) &&
+      mOriginalContent == mOriginalContent->OwnerDoc()->GetRootElement()) {
+    nsContentUtils::AppendDocumentLevelNativeAnonymousContentTo(
+        mOriginalContent->OwnerDoc(), mAnonKids);
   }
 }
 
@@ -406,13 +367,10 @@ AllChildrenIterator::GetNextChild()
 {
   if (mPhase == eAtBegin) {
     mPhase = eAtExplicitKids;
-    nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* beforeFrame = nsLayoutUtils::GetBeforeFrame(frame);
-      if (beforeFrame) {
-        mPhase = eAtBeforeKid;
-        return beforeFrame->GetContent();
-      }
+    Element* beforeContent = nsLayoutUtils::GetBeforePseudo(mOriginalContent);
+    if (beforeContent) {
+      mPhase = eAtBeforeKid;
+      return beforeContent;
     }
   }
 
@@ -448,13 +406,10 @@ AllChildrenIterator::GetNextChild()
       return mAnonKids[mAnonKidsIdx];
     }
 
-    nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* afterFrame = nsLayoutUtils::GetAfterFrame(frame);
-      if (afterFrame) {
-        mPhase = eAtAfterKid;
-        return afterFrame->GetContent();
-      }
+    Element* afterContent = nsLayoutUtils::GetAfterPseudo(mOriginalContent);
+    if (afterContent) {
+      mPhase = eAtAfterKid;
+      return afterContent;
     }
   }
 
@@ -468,13 +423,10 @@ AllChildrenIterator::GetPreviousChild()
   if (mPhase == eAtEnd) {
     MOZ_ASSERT(mAnonKidsIdx == mAnonKids.Length());
     mPhase = eAtAnonKids;
-    nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* afterFrame = nsLayoutUtils::GetAfterFrame(frame);
-      if (afterFrame) {
-        mPhase = eAtAfterKid;
-        return afterFrame->GetContent();
-      }
+    Element* afterContent = nsLayoutUtils::GetAfterPseudo(mOriginalContent);
+    if (afterContent) {
+      mPhase = eAtAfterKid;
+      return afterContent;
     }
   }
 
@@ -503,13 +455,10 @@ AllChildrenIterator::GetPreviousChild()
       return kid;
     }
 
-    nsIFrame* frame = mOriginalContent->GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* beforeFrame = nsLayoutUtils::GetBeforeFrame(frame);
-      if (beforeFrame) {
-        mPhase = eAtBeforeKid;
-        return beforeFrame->GetContent();
-      }
+    Element* beforeContent = nsLayoutUtils::GetBeforePseudo(mOriginalContent);
+    if (beforeContent) {
+      mPhase = eAtBeforeKid;
+      return beforeContent;
     }
   }
 
@@ -585,12 +534,6 @@ StyleChildrenIterator::IsNeeded(const Element* aElement)
     return true;
   }
 
-  // The root element has a scroll frame that is not the primary frame, so we
-  // need to do special checking for that case.
-  if (aElement == aElement->OwnerDoc()->GetRootElement()) {
-    return true;
-  }
-
   return false;
 }
 

dom/base/ChildIterator.h

@@ -36,27 +36,20 @@ class ExplicitChildIterator
 {
 public:
   explicit ExplicitChildIterator(const nsIContent* aParent,
-                                 bool aStartAtBeginning = true)
-    : mParent(aParent),
-      mChild(nullptr),
-      mDefaultChild(nullptr),
-      mIndexInInserted(0),
-      mIsFirst(aStartAtBeginning)
-  {
-  }
+                                 bool aStartAtBeginning = true);
 
   ExplicitChildIterator(const ExplicitChildIterator& aOther)
-    : mParent(aOther.mParent), mChild(aOther.mChild),
+    : mParent(aOther.mParent),
+      mParentAsSlot(aOther.mParentAsSlot),
+      mChild(aOther.mChild),
       mDefaultChild(aOther.mDefaultChild),
-      mShadowIterator(aOther.mShadowIterator ?
-                      new ExplicitChildIterator(*aOther.mShadowIterator) :
-                      nullptr),
       mIndexInInserted(aOther.mIndexInInserted), mIsFirst(aOther.mIsFirst) {}
 
   ExplicitChildIterator(ExplicitChildIterator&& aOther)
-    : mParent(aOther.mParent), mChild(aOther.mChild),
+    : mParent(aOther.mParent),
+      mParentAsSlot(aOther.mParentAsSlot),
+      mChild(aOther.mChild),
       mDefaultChild(aOther.mDefaultChild),
-      mShadowIterator(Move(aOther.mShadowIterator)),
       mIndexInInserted(aOther.mIndexInInserted), mIsFirst(aOther.mIsFirst) {}
 
   nsIContent* GetNextChild();
@@ -65,13 +58,13 @@ public:
   // found.  This version can take shortcuts that the two-argument version
   // can't, so can be faster (and in fact can be O(1) instead of O(N) in many
   // cases).
-  bool Seek(nsIContent* aChildToFind);
+  bool Seek(const nsIContent* aChildToFind);
 
   // Looks for aChildToFind respecting insertion points until aChildToFind is found.
   // or aBound is found. If aBound is nullptr then the seek is unbounded. Returns
   // whether aChildToFind was found as an explicit child prior to encountering
   // aBound.
-  bool Seek(nsIContent* aChildToFind, nsIContent* aBound)
+  bool Seek(const nsIContent* aChildToFind, nsIContent* aBound)
   {
     // It would be nice to assert that we find aChildToFind, but bz thinks that
     // we might not find aChildToFind when called from ContentInserted
@@ -102,6 +95,10 @@ protected:
   // the <xbl:content> element for the binding.
   const nsIContent* mParent;
 
+  // If parent is a slot element, this points to the parent as HTMLSlotElement,
+  // otherwise, it's null.
+  const HTMLSlotElement* mParentAsSlot;
+
   // The current child. When we encounter an insertion point,
   // mChild remains as the insertion point whose content we're iterating (and
   // our state is controled by mDefaultChild or mIndexInInserted depending on
@@ -114,11 +111,6 @@ protected:
   // to null, we continue iterating at mChild's next sibling.
   nsIContent* mDefaultChild;
 
-  // If non-null, this points to an iterator of the explicit children of
-  // the ShadowRoot projected by the current shadow element that we're
-  // iterating.
-  nsAutoPtr<ExplicitChildIterator> mShadowIterator;
-
   // If not zero, we're iterating inserted children for an insertion point. This
   // is an index into mChild's inserted children array (mChild must be an
   // nsXBLChildrenElement). The index is one past the "current" child (as
@@ -139,19 +131,29 @@ class FlattenedChildIterator : public ExplicitChildIterator
 public:
   explicit FlattenedChildIterator(const nsIContent* aParent,
                                   bool aStartAtBeginning = true)
-    : ExplicitChildIterator(aParent, aStartAtBeginning), mXBLInvolved(false)
+    : ExplicitChildIterator(aParent, aStartAtBeginning)
+    , mXBLInvolved(false)
+    , mOriginalContent(aParent)
   {
     Init(false);
   }
 
   FlattenedChildIterator(FlattenedChildIterator&& aOther)
-    : ExplicitChildIterator(Move(aOther)), mXBLInvolved(aOther.mXBLInvolved) {}
+    : ExplicitChildIterator(Move(aOther))
+    , mXBLInvolved(aOther.mXBLInvolved)
+    , mOriginalContent(aOther.mOriginalContent)
+  {}
 
   FlattenedChildIterator(const FlattenedChildIterator& aOther)
-    : ExplicitChildIterator(aOther), mXBLInvolved(aOther.mXBLInvolved) {}
+    : ExplicitChildIterator(aOther)
+    , mXBLInvolved(aOther.mXBLInvolved)
+    , mOriginalContent(aOther.mOriginalContent)
+  {}
 
   bool XBLInvolved() { return mXBLInvolved; }
 
+  const nsIContent* Parent() const { return mOriginalContent; }
+
 protected:
   /**
    * This constructor is a hack to help AllChildrenIterator which sometimes
@@ -159,7 +161,9 @@ protected:
    */
   FlattenedChildIterator(const nsIContent* aParent, uint32_t aFlags,
                          bool aStartAtBeginning = true)
-    : ExplicitChildIterator(aParent, aStartAtBeginning), mXBLInvolved(false)
+    : ExplicitChildIterator(aParent, aStartAtBeginning)
+    , mXBLInvolved(false)
+    , mOriginalContent(aParent)
   {
     bool ignoreXBL = aFlags & nsIContent::eAllButXBL;
     Init(ignoreXBL);
@@ -170,6 +174,8 @@ protected:
   // For certain optimizations, nsCSSFrameConstructor needs to know if the
   // child list of the element that we're iterating matches its .childNodes.
   bool mXBLInvolved;
+
+  const nsIContent* mOriginalContent;
 };
 
 /**
@@ -187,12 +193,11 @@ public:
   AllChildrenIterator(const nsIContent* aNode, uint32_t aFlags,
                       bool aStartAtBeginning = true) :
     FlattenedChildIterator(aNode, aFlags, aStartAtBeginning),
-    mOriginalContent(aNode), mAnonKidsIdx(aStartAtBeginning ? UINT32_MAX : 0),
+    mAnonKidsIdx(aStartAtBeginning ? UINT32_MAX : 0),
     mFlags(aFlags), mPhase(aStartAtBeginning ? eAtBegin : eAtEnd) { }
 
   AllChildrenIterator(AllChildrenIterator&& aOther)
     : FlattenedChildIterator(Move(aOther)),
-      mOriginalContent(aOther.mOriginalContent),
       mAnonKids(Move(aOther.mAnonKids)), mAnonKidsIdx(aOther.mAnonKidsIdx),
       mFlags(aOther.mFlags), mPhase(aOther.mPhase)
 #ifdef DEBUG
@@ -211,11 +216,10 @@ public:
   // Seeks the given node in children of a parent element, starting from
   // the current iterator's position, and sets the iterator at the given child
   // node if it was found.
-  bool Seek(nsIContent* aChildToFind);
+  bool Seek(const nsIContent* aChildToFind);
 
   nsIContent* GetNextChild();
   nsIContent* GetPreviousChild();
-  const nsIContent* Parent() const { return mOriginalContent; }
 
   enum IteratorPhase
   {
@@ -233,8 +237,6 @@ private:
   void AppendNativeAnonymousChildren();
   void AppendNativeAnonymousChildrenFromFrame(nsIFrame* aFrame);
 
-  const nsIContent* mOriginalContent;
-
   // mAnonKids is an array of native anonymous children, mAnonKidsIdx is index
   // in the array. If mAnonKidsIdx < mAnonKids.Length() and mPhase is
   // eAtAnonKids then the iterator points at a child at mAnonKidsIdx index. If
@@ -256,10 +258,11 @@ private:
 /**
  * StyleChildrenIterator traverses the children of the element from the
  * perspective of the style system, particularly the children we need to traverse
- * during restyle. This is identical to AllChildrenIterator with eAllChildren,
- * _except_ that we detect and skip any native anonymous children that are used
- * to implement pseudo-elements (since the style system needs to cascade those
- * using different algorithms).
+ * during restyle. This is identical to AllChildrenIterator with
+ * (eAllChildren | eSkipDocumentLevelNativeAnonymousContent), _except_ that we
+ * detect and skip any native anonymous children that are used to implement
+ * pseudo-elements (since the style system needs to cascade those using
+ * different algorithms).
  *
  * Note: it assumes that no mutation of the DOM or frame tree takes place during
  * iteration, and will break horribly if that is not true.
@@ -267,7 +270,9 @@ private:
 class StyleChildrenIterator : private AllChildrenIterator {
 public:
   explicit StyleChildrenIterator(const nsIContent* aContent)
-    : AllChildrenIterator(aContent, nsIContent::eAllChildren)
+    : AllChildrenIterator(aContent,
+                          nsIContent::eAllChildren |
+                          nsIContent::eSkipDocumentLevelNativeAnonymousContent)
   {
     MOZ_COUNT_CTOR(StyleChildrenIterator);
   }

dom/base/ChromeNodeList.cpp

@@ -6,6 +6,7 @@
 
 #include "mozilla/dom/ChromeNodeList.h"
 #include "mozilla/dom/ChromeNodeListBinding.h"
+#include "nsPIDOMWindow.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;

dom/base/ChromeNodeList.h

@@ -6,6 +6,7 @@
 
 #include "nsCOMArray.h"
 #include "nsContentList.h"
+#include "nsIDocument.h"
 
 namespace mozilla {
 class ErrorResult;

dom/base/ChromeUtils.cpp

@@ -7,6 +7,7 @@
 
 #include "mozilla/Base64.h"
 #include "mozilla/BasePrincipal.h"
+#include "jsfriendapi.h"
 
 namespace mozilla {
 namespace dom {

dom/base/ChromeUtils.h

@@ -10,6 +10,7 @@
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/ChromeUtilsBinding.h"
 #include "mozilla/dom/ThreadSafeChromeUtilsBinding.h"
+#include "mozilla/dom/UnionTypes.h"
 #include "mozilla/ErrorResult.h"
 
 namespace mozilla {

dom/base/CustomElementRegistry.h

@@ -7,13 +7,16 @@
 #ifndef mozilla_dom_CustomElementRegistry_h
 #define mozilla_dom_CustomElementRegistry_h
 
+#include "js/GCHashTable.h"
 #include "js/TypeDecls.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/BindingDeclarations.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsWrapperCache.h"
 #include "mozilla/dom/FunctionBinding.h"
+#include "mozilla/dom/WebComponentsBinding.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsGenericHTMLElement.h"
+#include "nsWrapperCache.h"
 
 class nsDocument;
 
@@ -22,8 +25,9 @@ namespace dom {
 
 struct CustomElementData;
 struct ElementDefinitionOptions;
-struct LifecycleCallbacks;
 class CallbackFunction;
+class CustomElementReaction;
+class DocGroup;
 class Function;
 class Promise;
 
@@ -32,6 +36,13 @@ struct LifecycleCallbackArgs
   nsString name;
   nsString oldValue;
   nsString newValue;
+  nsString namespaceURI;
+};
+
+struct LifecycleAdoptedCallbackArgs
+{
+  nsCOMPtr<nsIDocument> mOldDocument;
+  nsCOMPtr<nsIDocument> mNewDocument;
 };
 
 class CustomElementCallback
@@ -39,8 +50,7 @@ class CustomElementCallback
 public:
   CustomElementCallback(Element* aThisObject,
                         nsIDocument::ElementCallbackType aCallbackType,
-                        CallbackFunction* aCallback,
-                        CustomElementData* aOwnerData);
+                        CallbackFunction* aCallback);
   void Traverse(nsCycleCollectionTraversalCallback& aCb) const;
   void Call();
   void SetArgs(LifecycleCallbackArgs& aArgs)
@@ -50,6 +60,13 @@ public:
     mArgs = aArgs;
   }
 
+  void SetAdoptedCallbackArgs(LifecycleAdoptedCallbackArgs& aAdoptedCallbackArgs)
+  {
+    MOZ_ASSERT(mType == nsIDocument::eAdopted,
+      "Arguments are only used by adopted callback.");
+    mAdoptedCallbackArgs = aAdoptedCallbackArgs;
+  }
+
 private:
   // The this value to use for invocation of the callback.
   RefPtr<Element> mThisObject;
@@ -59,9 +76,19 @@ private:
   // Arguments to be passed to the callback,
   // used by the attribute changed callback.
   LifecycleCallbackArgs mArgs;
-  // CustomElementData that contains this callback in the
-  // callback queue.
-  CustomElementData* mOwnerData;
+  LifecycleAdoptedCallbackArgs mAdoptedCallbackArgs;
+};
+
+class CustomElementConstructor final : public CallbackFunction
+{
+public:
+  explicit CustomElementConstructor(CallbackFunction* aOther)
+    : CallbackFunction(aOther)
+  {
+    MOZ_ASSERT(JS::IsConstructor(mCallback));
+  }
+
+  already_AddRefed<Element> Construct(const char* aExecutionReason, ErrorResult& aRv);
 };
 
 // Each custom element has an associated callback queue and an element is
@@ -70,63 +97,299 @@ struct CustomElementData
 {
   NS_INLINE_DECL_REFCOUNTING(CustomElementData)
 
-  explicit CustomElementData(nsIAtom* aType);
-  // Objects in this array are transient and empty after each microtask
-  // checkpoint.
-  nsTArray<nsAutoPtr<CustomElementCallback>> mCallbackQueue;
-  // Custom element type, for <button is="x-button"> or <x-button>
-  // this would be x-button.
-  nsCOMPtr<nsIAtom> mType;
-  // The callback that is next to be processed upon calling RunCallbackQueue.
-  int32_t mCurrentCallback;
-  // Element is being created flag as described in the custom elements spec.
-  bool mElementIsBeingCreated;
-  // Flag to determine if the created callback has been invoked, thus it
-  // determines if other callbacks can be enqueued.
-  bool mCreatedCallbackInvoked;
-  // The microtask level associated with the callbacks in the callback queue,
-  // it is used to determine if a new queue needs to be pushed onto the
-  // processing stack.
-  int32_t mAssociatedMicroTask;
+  // https://dom.spec.whatwg.org/#concept-element-custom-element-state
+  // CustomElementData is only created on the element which is a custom element
+  // or an upgrade candidate, so the state of an element without
+  // CustomElementData is "uncustomized".
+  enum class State {
+    eUndefined,
+    eFailed,
+    eCustom
+  };
 
-  // Empties the callback queue.
-  void RunCallbackQueue();
+  explicit CustomElementData(nsIAtom* aType);
+  CustomElementData(nsIAtom* aType, State aState);
+
+  // Custom element state as described in the custom element spec.
+  State mState;
+  // custom element reaction queue as described in the custom element spec.
+  // There is 1 reaction in reaction queue, when 1) it becomes disconnected,
+  // 2) it’s adopted into a new document, 3) its attributes are changed,
+  // appended, removed, or replaced.
+  // There are 3 reactions in reaction queue when doing upgrade operation,
+  // e.g., create an element, insert a node.
+  AutoTArray<UniquePtr<CustomElementReaction>, 3> mReactionQueue;
+
+  void SetCustomElementDefinition(CustomElementDefinition* aDefinition);
+  CustomElementDefinition* GetCustomElementDefinition();
+  nsIAtom* GetCustomElementType();
+
+  void Traverse(nsCycleCollectionTraversalCallback& aCb) const;
+  void Unlink();
 
 private:
   virtual ~CustomElementData() {}
+
+  // Custom element type, for <button is="x-button"> or <x-button>
+  // this would be x-button.
+  RefPtr<nsIAtom> mType;
+  RefPtr<CustomElementDefinition> mCustomElementDefinition;
 };
 
+#define ALEADY_CONSTRUCTED_MARKER nullptr
+
 // The required information for a custom element as defined in:
 // https://html.spec.whatwg.org/multipage/scripting.html#custom-element-definition
 struct CustomElementDefinition
 {
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(CustomElementDefinition)
+  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(CustomElementDefinition)
+
   CustomElementDefinition(nsIAtom* aType,
                           nsIAtom* aLocalName,
-                          JSObject* aConstructor,
+                          Function* aConstructor,
+                          nsCOMArray<nsIAtom>&& aObservedAttributes,
                           JSObject* aPrototype,
                           mozilla::dom::LifecycleCallbacks* aCallbacks,
                           uint32_t aDocOrder);
 
-  // The type (name) for this custom element.
+  // The type (name) for this custom element, for <button is="x-foo"> or <x-foo>
+  // this would be x-foo.
   nsCOMPtr<nsIAtom> mType;
 
   // The localname to (e.g. <button is=type> -- this would be button).
   nsCOMPtr<nsIAtom> mLocalName;
 
   // The custom element constructor.
-  JS::Heap<JSObject *> mConstructor;
+  RefPtr<CustomElementConstructor> mConstructor;
+
+  // The list of attributes that this custom element observes.
+  nsCOMArray<nsIAtom> mObservedAttributes;
 
   // The prototype to use for new custom elements of this type.
   JS::Heap<JSObject *> mPrototype;
 
   // The lifecycle callbacks to call for this custom element.
-  nsAutoPtr<mozilla::dom::LifecycleCallbacks> mCallbacks;
+  UniquePtr<mozilla::dom::LifecycleCallbacks> mCallbacks;
 
-  // A construction stack.
-  // TODO: Bug 1287348 - Implement construction stack for upgrading an element
+  // A construction stack. Use nullptr to represent an "already constructed marker".
+  nsTArray<RefPtr<nsGenericHTMLElement>> mConstructionStack;
 
   // The document custom element order.
   uint32_t mDocOrder;
+
+  bool IsCustomBuiltIn()
+  {
+    return mType != mLocalName;
+  }
+
+  bool IsInObservedAttributeList(nsIAtom* aName)
+  {
+    if (mObservedAttributes.IsEmpty()) {
+      return false;
+    }
+
+    return mObservedAttributes.Contains(aName);
+  }
+
+private:
+  ~CustomElementDefinition() {}
+};
+
+class CustomElementReaction
+{
+public:
+  virtual ~CustomElementReaction() = default;
+  virtual void Invoke(Element* aElement, ErrorResult& aRv) = 0;
+  virtual void Traverse(nsCycleCollectionTraversalCallback& aCb) const
+  {
+  }
+
+#if DEBUG
+  bool IsUpgradeReaction()
+  {
+    return mIsUpgradeReaction;
+  }
+
+protected:
+  bool mIsUpgradeReaction = false;
+#endif
+};
+
+class CustomElementUpgradeReaction final : public CustomElementReaction
+{
+public:
+  explicit CustomElementUpgradeReaction(CustomElementDefinition* aDefinition)
+    : mDefinition(aDefinition)
+  {
+#if DEBUG
+    mIsUpgradeReaction = true;
+#endif
+  }
+
+private:
+   virtual void Invoke(Element* aElement, ErrorResult& aRv) override;
+
+   CustomElementDefinition* mDefinition;
+};
+
+class CustomElementCallbackReaction final : public CustomElementReaction
+{
+  public:
+    explicit CustomElementCallbackReaction(UniquePtr<CustomElementCallback> aCustomElementCallback)
+      : mCustomElementCallback(Move(aCustomElementCallback))
+    {
+    }
+
+    virtual void Traverse(nsCycleCollectionTraversalCallback& aCb) const override
+    {
+      mCustomElementCallback->Traverse(aCb);
+    }
+
+  private:
+    virtual void Invoke(Element* aElement, ErrorResult& aRv) override;
+    UniquePtr<CustomElementCallback> mCustomElementCallback;
+};
+
+// https://html.spec.whatwg.org/multipage/scripting.html#custom-element-reactions-stack
+class CustomElementReactionsStack
+{
+public:
+  NS_INLINE_DECL_REFCOUNTING(CustomElementReactionsStack)
+
+  CustomElementReactionsStack()
+    : mIsBackupQueueProcessing(false)
+    , mRecursionDepth(0)
+    , mIsElementQueuePushedForCurrentRecursionDepth(false)
+  {
+  }
+
+  // Hold a strong reference of Element so that it does not get cycle collected
+  // before the reactions in its reaction queue are invoked.
+  // The element reaction queues are stored in CustomElementData.
+  // We need to lookup ElementReactionQueueMap again to get relevant reaction queue.
+  // The choice of 1 for the auto size here is based on gut feeling.
+  typedef AutoTArray<RefPtr<Element>, 1> ElementQueue;
+
+  /**
+   * Enqueue a custom element upgrade reaction
+   * https://html.spec.whatwg.org/multipage/scripting.html#enqueue-a-custom-element-upgrade-reaction
+   */
+  void EnqueueUpgradeReaction(Element* aElement,
+                              CustomElementDefinition* aDefinition);
+
+  /**
+   * Enqueue a custom element callback reaction
+   * https://html.spec.whatwg.org/multipage/scripting.html#enqueue-a-custom-element-callback-reaction
+   */
+  void EnqueueCallbackReaction(Element* aElement,
+                               UniquePtr<CustomElementCallback> aCustomElementCallback);
+
+  /**
+   * [CEReactions] Before executing the algorithm's steps.
+   * Increase the current recursion depth, and the element queue is pushed
+   * lazily when we really enqueue reactions.
+   *
+   * @return true if the element queue is pushed for "previous" recursion depth.
+   */
+  bool EnterCEReactions()
+  {
+    bool temp = mIsElementQueuePushedForCurrentRecursionDepth;
+    mRecursionDepth++;
+    // The is-element-queue-pushed flag is initially false when entering a new
+    // recursion level. The original value will be cached in AutoCEReaction
+    // and restored after leaving this recursion level.
+    mIsElementQueuePushedForCurrentRecursionDepth = false;
+    return temp;
+  }
+
+  /**
+   * [CEReactions] After executing the algorithm's steps.
+   * Pop and invoke the element queue if it is created and pushed for current
+   * recursion depth, then decrease the current recursion depth.
+   *
+   * @param aCx JSContext used for handling exception thrown by algorithm's
+   *            steps, this could be a nullptr.
+   *        aWasElementQueuePushed used for restoring status after leaving
+   *                               current recursion.
+   */
+  void LeaveCEReactions(JSContext* aCx, bool aWasElementQueuePushed)
+  {
+    MOZ_ASSERT(mRecursionDepth);
+
+    if (mIsElementQueuePushedForCurrentRecursionDepth) {
+      Maybe<JS::AutoSaveExceptionState> ases;
+      if (aCx) {
+        ases.emplace(aCx);
+      }
+      PopAndInvokeElementQueue();
+    }
+    mRecursionDepth--;
+    // Restore the is-element-queue-pushed flag cached in AutoCEReaction when
+    // leaving the recursion level.
+    mIsElementQueuePushedForCurrentRecursionDepth = aWasElementQueuePushed;
+
+    MOZ_ASSERT_IF(!mRecursionDepth, mReactionsStack.IsEmpty());
+  }
+
+private:
+  ~CustomElementReactionsStack() {};
+
+  /**
+   * Push a new element queue onto the custom element reactions stack.
+   */
+  void CreateAndPushElementQueue();
+
+  /**
+   * Pop the element queue from the custom element reactions stack, and invoke
+   * custom element reactions in that queue.
+   */
+  void PopAndInvokeElementQueue();
+
+  // The choice of 8 for the auto size here is based on gut feeling.
+  AutoTArray<UniquePtr<ElementQueue>, 8> mReactionsStack;
+  ElementQueue mBackupQueue;
+  // https://html.spec.whatwg.org/#enqueue-an-element-on-the-appropriate-element-queue
+  bool mIsBackupQueueProcessing;
+
+  void InvokeBackupQueue();
+
+  /**
+   * Invoke custom element reactions
+   * https://html.spec.whatwg.org/multipage/scripting.html#invoke-custom-element-reactions
+   */
+  void InvokeReactions(ElementQueue* aElementQueue, nsIGlobalObject* aGlobal);
+
+  void Enqueue(Element* aElement, CustomElementReaction* aReaction);
+
+  // Current [CEReactions] recursion depth.
+  uint32_t mRecursionDepth;
+  // True if the element queue is pushed into reaction stack for current
+  // recursion depth. This will be cached in AutoCEReaction when entering a new
+  // CEReaction recursion and restored after leaving the recursion.
+  bool mIsElementQueuePushedForCurrentRecursionDepth;
+
+private:
+  class BackupQueueMicroTask final : public mozilla::MicroTaskRunnable {
+    public:
+      explicit BackupQueueMicroTask(CustomElementReactionsStack* aReactionStack)
+        : MicroTaskRunnable()
+        , mReactionStack(aReactionStack)
+      {
+        MOZ_ASSERT(!mReactionStack->mIsBackupQueueProcessing,
+                   "mIsBackupQueueProcessing should be initially false");
+        mReactionStack->mIsBackupQueueProcessing = true;
+      }
+
+      virtual void Run(AutoSlowOperation& aAso) override
+      {
+        mReactionStack->InvokeBackupQueue();
+        mReactionStack->mIsBackupQueueProcessing = false;
+      }
+
+    private:
+      RefPtr<CustomElementReactionsStack> mReactionStack;
+  };
 };
 
 class CustomElementRegistry final : public nsISupports,
@@ -142,41 +405,34 @@ public:
 public:
   static bool IsCustomElementEnabled(JSContext* aCx = nullptr,
                                      JSObject* aObject = nullptr);
-  static already_AddRefed<CustomElementRegistry> Create(nsPIDOMWindowInner* aWindow);
-  static void ProcessTopElementQueue();
 
-  static void XPCOMShutdown();
+  explicit CustomElementRegistry(nsPIDOMWindowInner* aWindow);
 
   /**
    * Looking up a custom element definition.
    * https://html.spec.whatwg.org/#look-up-a-custom-element-definition
    */
   CustomElementDefinition* LookupCustomElementDefinition(
-    const nsAString& aLocalName, const nsAString* aIs = nullptr) const;
+    nsIAtom* aNameAtom, nsIAtom* aTypeAtom) const;
+
+  CustomElementDefinition* LookupCustomElementDefinition(
+    JSContext* aCx, JSObject *aConstructor) const;
+
+  static void EnqueueLifecycleCallback(nsIDocument::ElementCallbackType aType,
+                                       Element* aCustomElement,
+                                       LifecycleCallbackArgs* aArgs,
+                                       LifecycleAdoptedCallbackArgs* aAdoptedCallbackArgs,
+                                       CustomElementDefinition* aDefinition);
 
   /**
-   * Enqueue created callback or register upgrade candidate for
-   * newly created custom elements, possibly extending an existing type.
-   * ex. <x-button>, <button is="x-button> (type extension)
+   * Upgrade an element.
+   * https://html.spec.whatwg.org/multipage/scripting.html#upgrades
    */
-  void SetupCustomElement(Element* aElement, const nsAString* aTypeExtension);
-
-  void EnqueueLifecycleCallback(nsIDocument::ElementCallbackType aType,
-                                Element* aCustomElement,
-                                LifecycleCallbackArgs* aArgs,
-                                CustomElementDefinition* aDefinition);
-
-  void GetCustomPrototype(nsIAtom* aAtom,
-                          JS::MutableHandle<JSObject*> aPrototype);
-
-private:
-  explicit CustomElementRegistry(nsPIDOMWindowInner* aWindow);
-  ~CustomElementRegistry();
+  static void Upgrade(Element* aElement, CustomElementDefinition* aDefinition, ErrorResult& aRv);
 
   /**
    * Registers an unresolved custom element that is a candidate for
-   * upgrade when the definition is registered via registerElement.
-   * |aTypeName| is the name of the custom element type, if it is not
+   * upgrade. |aTypeName| is the name of the custom element type, if it is not
    * provided, then element name is used. |aTypeName| should be provided
    * when registering a custom element that extends an existing
    * element. e.g. <button is="x-button">.
@@ -184,23 +440,48 @@ private:
   void RegisterUnresolvedElement(Element* aElement,
                                  nsIAtom* aTypeName = nullptr);
 
-  void UpgradeCandidates(JSContext* aCx,
-                         nsIAtom* aKey,
-                         CustomElementDefinition* aDefinition);
+  /**
+   * Unregister an unresolved custom element that is a candidate for
+   * upgrade when a custom element is removed from tree.
+   */
+  void UnregisterUnresolvedElement(Element* aElement,
+                                   nsIAtom* aTypeName = nullptr);
+private:
+  ~CustomElementRegistry();
 
-  typedef nsClassHashtable<nsISupportsHashKey, CustomElementDefinition>
+  static UniquePtr<CustomElementCallback> CreateCustomElementCallback(
+    nsIDocument::ElementCallbackType aType, Element* aCustomElement,
+    LifecycleCallbackArgs* aArgs,
+    LifecycleAdoptedCallbackArgs* aAdoptedCallbackArgs,
+    CustomElementDefinition* aDefinition);
+
+  void UpgradeCandidates(nsIAtom* aKey,
+                         CustomElementDefinition* aDefinition,
+                         ErrorResult& aRv);
+
+  typedef nsRefPtrHashtable<nsISupportsHashKey, CustomElementDefinition>
     DefinitionMap;
   typedef nsClassHashtable<nsISupportsHashKey, nsTArray<nsWeakPtr>>
     CandidateMap;
+  typedef JS::GCHashMap<JS::Heap<JSObject*>,
+                        nsCOMPtr<nsIAtom>,
+                        js::MovableCellHasher<JS::Heap<JSObject*>>,
+                        js::SystemAllocPolicy> ConstructorMap;
 
   // Hashtable for custom element definitions in web components.
-  // Custom prototypes are stored in the compartment where
-  // registerElement was called.
+  // Custom prototypes are stored in the compartment where definition was
+  // defined.
   DefinitionMap mCustomDefinitions;
 
+  // Hashtable for looking up definitions by using constructor as key.
+  // Custom elements' name are stored here and we need to lookup
+  // mCustomDefinitions again to get definitions.
+  ConstructorMap mConstructors;
+
   typedef nsRefPtrHashtable<nsISupportsHashKey, Promise>
     WhenDefinedPromiseMap;
   WhenDefinedPromiseMap mWhenDefinedPromiseMap;
+
   // The "upgrade candidates map" from the web components spec. Maps from a
   // namespace id and local name to a list of elements to upgrade if that
   // element is registered as a custom element.
@@ -208,14 +489,6 @@ private:
 
   nsCOMPtr<nsPIDOMWindowInner> mWindow;
 
-  // Array representing the processing stack in the custom elements
-  // specification. The processing stack is conceptually a stack of
-  // element queues. Each queue is represented by a sequence of
-  // CustomElementData in this array, separated by nullptr that
-  // represent the boundaries of the items in the stack. The first
-  // queue in the stack is the base element queue.
-  static mozilla::Maybe<nsTArray<RefPtr<CustomElementData>>> sProcessingStack;
-
   // It is used to prevent reentrant invocations of element definition.
   bool mIsCustomDefinitionRunning;
 
@@ -241,6 +514,8 @@ private:
 public:
   nsISupports* GetParentObject() const;
 
+  DocGroup* GetDocGroup() const;
+
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
   void Define(const nsAString& aName, Function& aFunctionConstructor,
@@ -252,6 +527,31 @@ public:
   already_AddRefed<Promise> WhenDefined(const nsAString& aName, ErrorResult& aRv);
 };
 
+class MOZ_RAII AutoCEReaction final {
+  public:
+    // JSContext is allowed to be a nullptr if we are guaranteeing that we're
+    // not doing something that might throw but not finish reporting a JS
+    // exception during the lifetime of the AutoCEReaction.
+    AutoCEReaction(CustomElementReactionsStack* aReactionsStack, JSContext* aCx)
+      : mReactionsStack(aReactionsStack)
+      , mCx(aCx)
+    {
+      mIsElementQueuePushedForPreviousRecursionDepth =
+        mReactionsStack->EnterCEReactions();
+    }
+
+    ~AutoCEReaction()
+    {
+      mReactionsStack->LeaveCEReactions(
+        mCx, mIsElementQueuePushedForPreviousRecursionDepth);
+    }
+
+  private:
+    RefPtr<CustomElementReactionsStack> mReactionsStack;
+    JSContext* mCx;
+    bool mIsElementQueuePushedForPreviousRecursionDepth;
+};
+
 } // namespace dom
 } // namespace mozilla
 

dom/base/DirectionalityUtils.cpp

@@ -728,7 +728,7 @@ WalkDescendantsResetAutoDirection(Element* aElement)
 {
   nsIContent* child = aElement->GetFirstChild();
   while (child) {
-    if (child->HasDirAuto()) {
+    if (child->IsElement() && child->AsElement()->HasDirAuto()) {
       child = child->GetNextNonChildNode(aElement);
       continue;
     }
@@ -791,7 +791,7 @@ WalkDescendantsClearAncestorDirAuto(Element* aElement)
 {
   nsIContent* child = aElement->GetFirstChild();
   while (child) {
-    if (child->HasDirAuto()) {
+    if (child->IsElement() && child->AsElement()->HasDirAuto()) {
       child = child->GetNextNonChildNode(aElement);
       continue;
     }

dom/base/DocGroup.cpp

@@ -1,3 +1,7 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
 #include "mozilla/dom/DocGroup.h"
 #include "mozilla/dom/TabGroup.h"
 #include "mozilla/Telemetry.h"
@@ -6,10 +10,14 @@
 #include "mozilla/StaticPtr.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "nsIDocShell.h"
+#include "nsDOMMutationObserver.h"
+#include "nsNetCID.h"
 
 namespace mozilla {
 namespace dom {
 
+AutoTArray<RefPtr<DocGroup>, 2>* DocGroup::sPendingDocGroups = nullptr;
+
 /* static */ void
 DocGroup::GetKey(nsIPrincipal* aPrincipal, nsACString& aKey)
 {
@@ -46,10 +54,31 @@ DocGroup::DocGroup(TabGroup* aTabGroup, const nsACString& aKey)
 DocGroup::~DocGroup()
 {
   MOZ_ASSERT(mDocuments.IsEmpty());
+  if (!NS_IsMainThread()) {
+     NS_ReleaseOnMainThread(mReactionsStack.forget());
+  }
   mTabGroup->mDocGroups.RemoveEntry(mKey);
 }
 
 NS_IMPL_ISUPPORTS(DocGroup, nsISupports)
 
+void
+DocGroup::SignalSlotChange(const HTMLSlotElement* aSlot)
+{
+  if (mSignalSlotList.Contains(aSlot)) {
+    return;
+  }
+
+  mSignalSlotList.AppendElement(const_cast<HTMLSlotElement*>(aSlot));
+
+  if (!sPendingDocGroups) {
+    // Queue a mutation observer compound microtask.
+    nsDOMMutationObserver::QueueMutationObserverMicroTask();
+    sPendingDocGroups = new AutoTArray<RefPtr<DocGroup>, 2>;
+  }
+
+  sPendingDocGroups->AppendElement(this);
+}
+
 }
 }

dom/base/DocGroup.h

@@ -14,6 +14,8 @@
 #include "nsString.h"
 
 #include "mozilla/RefPtr.h"
+#include "mozilla/dom/CustomElementRegistry.h"
+#include "mozilla/dom/HTMLSlotElement.h"
 
 namespace mozilla {
 namespace dom {
@@ -52,6 +54,14 @@ public:
   {
     return mTabGroup;
   }
+  mozilla::dom::CustomElementReactionsStack* CustomElementReactionsStack()
+  {
+    if (!mReactionsStack) {
+      mReactionsStack = new mozilla::dom::CustomElementReactionsStack();
+    }
+
+    return mReactionsStack;
+  }
   void RemoveDocument(nsIDocument* aWindow);
 
   // Iterators for iterating over every document within the DocGroup
@@ -64,6 +74,23 @@ public:
     return mDocuments.end();
   }
 
+  // Append aSlot to the list of signal slot list, if it's not in it already
+  // list, and queue a mutation observer microtask.
+  void SignalSlotChange(const mozilla::dom::HTMLSlotElement* aSlot);
+
+  const nsTArray<RefPtr<HTMLSlotElement>>& SignalSlotList() const
+  {
+    return mSignalSlotList;
+  }
+
+  void ClearSignalSlotList()
+  {
+    mSignalSlotList.Clear();
+  }
+
+  // List of DocGroups that has non-empty signal slot list.
+  static AutoTArray<RefPtr<DocGroup>, 2>* sPendingDocGroups;
+
 private:
   DocGroup(TabGroup* aTabGroup, const nsACString& aKey);
   ~DocGroup();
@@ -71,6 +98,8 @@ private:
   nsCString mKey;
   RefPtr<TabGroup> mTabGroup;
   nsTArray<nsIDocument*> mDocuments;
+  RefPtr<mozilla::dom::CustomElementReactionsStack> mReactionsStack;
+  nsTArray<RefPtr<HTMLSlotElement>> mSignalSlotList;
 };
 
 } // namespace dom

dom/base/DocumentFragment.cpp

@@ -125,6 +125,8 @@ DocumentFragment::Constructor(const GlobalObject& aGlobal,
   return window->GetDoc()->CreateDocumentFragment();
 }
 
+NS_IMPL_CYCLE_COLLECTION_INHERITED(DocumentFragment, FragmentOrElement, mHost)
+
 // QueryInterface implementation for DocumentFragment
 NS_INTERFACE_MAP_BEGIN(DocumentFragment)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY

dom/base/DocumentFragment.h

@@ -43,6 +43,7 @@ public:
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DocumentFragment, FragmentOrElement)
 
   // interface nsIDOMNode
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
@@ -121,15 +122,9 @@ public:
     return nullptr;
   }
 
-  nsIContent* GetHost() const
-  {
-    return mHost;
-  }
+  Element* GetHost() const { return mHost; }
 
-  void SetHost(nsIContent* aHost)
-  {
-    mHost = aHost;
-  }
+  void SetHost(Element* aHost) { mHost = aHost; }
 
   static already_AddRefed<DocumentFragment>
   Constructor(const GlobalObject& aGlobal, ErrorResult& aRv);
@@ -145,7 +140,7 @@ protected:
   }
 
   nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const override;
-  nsIContent* mHost; // Weak
+  nsCOMPtr<Element> mHost;
 };
 
 } // namespace dom

dom/base/DocumentOrShadowRoot.cpp

@@ -0,0 +1,149 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DocumentOrShadowRoot.h"
+#include "mozilla/dom/StyleSheetList.h"
+#include "nsDocument.h"
+#include "nsFocusManager.h"
+#include "ShadowRoot.h"
+#include "XULDocument.h"
+
+class nsINode;
+class nsIDocument;
+class ShadowRoot;
+
+namespace mozilla {
+namespace dom {
+
+DocumentOrShadowRoot::DocumentOrShadowRoot(mozilla::dom::ShadowRoot* aShadowRoot)
+  : mAsNode(aShadowRoot)
+  , mKind(Kind::ShadowRoot)
+{
+ MOZ_ASSERT(mAsNode);
+}
+
+DocumentOrShadowRoot::DocumentOrShadowRoot(nsIDocument* aDoc)
+  : mAsNode(aDoc)
+  , mKind(Kind::Document)
+{
+  MOZ_ASSERT(mAsNode);
+}
+
+StyleSheetList&
+DocumentOrShadowRoot::EnsureDOMStyleSheets()
+{
+  if (!mDOMStyleSheets) {
+    mDOMStyleSheets = new StyleSheetList(*this);
+  }
+  return *mDOMStyleSheets;
+}
+
+Element*
+DocumentOrShadowRoot::GetElementById(const nsAString& aElementId)
+{
+  if (MOZ_UNLIKELY(aElementId.IsEmpty())) {
+    nsContentUtils::ReportEmptyGetElementByIdArg(AsNode().OwnerDoc());
+    return nullptr;
+  }
+
+  if (nsIdentifierMapEntry* entry = mIdentifierMap.GetEntry(aElementId)) {
+    if (Element* el = entry->GetIdElement()) {
+      return el;
+    }
+  }
+
+  if (MOZ_UNLIKELY(mKind == Kind::Document &&
+      static_cast<nsIDocument&>(AsNode()).IsXULDocument())) {
+    return static_cast<XULDocument&>(AsNode()).GetRefById(aElementId);
+  }
+
+  return nullptr;
+}
+
+already_AddRefed<nsContentList>
+DocumentOrShadowRoot::GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                                   const nsAString& aLocalName)
+{
+  ErrorResult rv;
+  RefPtr<nsContentList> list =
+    GetElementsByTagNameNS(aNamespaceURI, aLocalName, rv);
+  if (rv.Failed()) {
+    return nullptr;
+  }
+  return list.forget();
+}
+
+already_AddRefed<nsContentList>
+DocumentOrShadowRoot::GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                                   const nsAString& aLocalName,
+                                   mozilla::ErrorResult& aResult)
+{
+  int32_t nameSpaceId = kNameSpaceID_Wildcard;
+
+  if (!aNamespaceURI.EqualsLiteral("*")) {
+    aResult =
+      nsContentUtils::NameSpaceManager()->RegisterNameSpace(aNamespaceURI,
+                                                            nameSpaceId);
+    if (aResult.Failed()) {
+      return nullptr;
+    }
+  }
+
+  NS_ASSERTION(nameSpaceId != kNameSpaceID_Unknown, "Unexpected namespace ID!");
+  return NS_GetContentList(&AsNode(), nameSpaceId, aLocalName);
+}
+
+already_AddRefed<nsContentList>
+DocumentOrShadowRoot::GetElementsByClassName(const nsAString& aClasses)
+{
+  return nsContentUtils::GetElementsByClassName(&AsNode(), aClasses);
+}
+
+nsIContent*
+DocumentOrShadowRoot::Retarget(nsIContent* aContent) const
+{
+  for (nsIContent* cur = aContent;
+       cur;
+       cur = cur->GetContainingShadowHost()) {
+    if (cur->SubtreeRoot() == &AsNode()) {
+      return cur;
+    }
+  }
+  return nullptr;
+}
+
+Element*
+DocumentOrShadowRoot::GetRetargetedFocusedElement()
+{
+  if (nsCOMPtr<nsPIDOMWindowOuter> window = AsNode().OwnerDoc()->GetWindow()) {
+    nsCOMPtr<nsPIDOMWindowOuter> focusedWindow;
+    nsIContent* focusedContent =
+      nsFocusManager::GetFocusedDescendant(window,
+                                           false,
+                                           getter_AddRefs(focusedWindow));
+    // be safe and make sure the element is from this document
+    if (focusedContent && focusedContent->OwnerDoc() == AsNode().OwnerDoc()) {
+      if (focusedContent->ChromeOnlyAccess()) {
+        focusedContent = focusedContent->FindFirstNonChromeOnlyAccessContent();
+      }
+
+      if (focusedContent) {
+        if (!nsDocument::IsWebComponentsEnabled(focusedContent)) {
+          return focusedContent->AsElement();
+        }
+
+        if (nsIContent* retarget = Retarget(focusedContent)) {
+          return retarget->AsElement();
+        }
+      }
+    }
+  }
+
+  return nullptr;
+}
+
+}
+}

dom/base/DocumentOrShadowRoot.h

@@ -0,0 +1,160 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_DocumentOrShadowRoot_h__
+#define mozilla_dom_DocumentOrShadowRoot_h__
+
+#include "nsTArray.h"
+#include "nsIdentifierMapEntry.h"
+#include "nsContentListDeclarations.h"
+#include "nsNameSpaceManager.h"
+#include "mozilla/dom/NameSpaceConstants.h"
+
+class nsContentList;
+class nsINode;
+
+namespace mozilla {
+class StyleSheet;
+
+namespace dom {
+
+class StyleSheetList;
+class ShadowRoot;
+
+/**
+ * A class meant to be shared by ShadowRoot and Document, that holds a list of
+ * stylesheets.
+ *
+ * TODO(emilio, bug 1418159): In the future this should hold most of the
+ * relevant style state, this should allow us to fix bug 548397.
+ */
+class DocumentOrShadowRoot
+{
+  enum class Kind {
+    Document,
+    ShadowRoot,
+  };
+
+public:
+  explicit DocumentOrShadowRoot(nsIDocument*);
+  explicit DocumentOrShadowRoot(mozilla::dom::ShadowRoot*);
+
+  nsINode& AsNode()
+  {
+    return *mAsNode;
+  }
+
+  const nsINode& AsNode() const
+  {
+    return *mAsNode;
+  }
+
+  StyleSheet* SheetAt(size_t aIndex) const
+  {
+    return mStyleSheets.SafeElementAt(aIndex);
+  }
+
+  size_t SheetCount() const
+  {
+    return mStyleSheets.Length();
+  }
+
+  int32_t IndexOfSheet(const StyleSheet& aSheet) const
+  {
+    return mStyleSheets.IndexOf(&aSheet);
+  }
+
+  void InsertSheetAt(size_t aIndex, StyleSheet& aSheet)
+  {
+    mStyleSheets.InsertElementAt(aIndex, &aSheet);
+  }
+
+  void RemoveSheet(StyleSheet& aSheet)
+  {
+    mStyleSheets.RemoveElement(&aSheet);
+  }
+
+  void AppendStyleSheet(StyleSheet& aSheet)
+  {
+    mStyleSheets.AppendElement(&aSheet);
+  }
+
+  StyleSheetList& EnsureDOMStyleSheets();
+
+  Element* GetElementById(const nsAString& aElementId);
+
+  /**
+   * This method returns _all_ the elements in this scope which have id
+   * aElementId, if there are any.  Otherwise it returns null.
+   *
+   * This is useful for stuff like QuerySelector optimization and such.
+   */
+  inline const nsTArray<Element*>*
+  GetAllElementsForId(const nsAString& aElementId) const;
+
+  already_AddRefed<nsContentList>
+  GetElementsByTagName(const nsAString& aTagName)
+  {
+    return NS_GetContentList(&AsNode(), kNameSpaceID_Unknown, aTagName);
+  }
+
+  already_AddRefed<nsContentList>
+  GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                         const nsAString& aLocalName);
+
+  already_AddRefed<nsContentList>
+  GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                         const nsAString& aLocalName,
+                         mozilla::ErrorResult&);
+
+  already_AddRefed<nsContentList>
+  GetElementsByClassName(const nsAString& aClasses);
+
+  ~DocumentOrShadowRoot() = default;
+
+protected:
+  nsIContent* Retarget(nsIContent* aContent) const;
+
+  /**
+   * If focused element's subtree root is this document or shadow root, return
+   * focused element, otherwise, get the shadow host recursively until the
+   * shadow host's subtree root is this document or shadow root.
+   */
+  Element* GetRetargetedFocusedElement();
+
+  nsTArray<RefPtr<mozilla::StyleSheet>> mStyleSheets;
+  RefPtr<mozilla::dom::StyleSheetList> mDOMStyleSheets;
+
+  /*
+   * mIdentifierMap works as follows for IDs:
+   * 1) Attribute changes affect the table immediately (removing and adding
+   *    entries as needed).
+   * 2) Removals from the DOM affect the table immediately
+   * 3) Additions to the DOM always update existing entries for names, and add
+   *    new ones for IDs.
+   */
+  nsTHashtable<nsIdentifierMapEntry> mIdentifierMap;
+
+  nsINode* mAsNode;
+  const Kind mKind;
+};
+
+inline const nsTArray<Element*>*
+DocumentOrShadowRoot::GetAllElementsForId(const nsAString& aElementId) const
+{
+  if (aElementId.IsEmpty()) {
+    return nullptr;
+  }
+
+  nsIdentifierMapEntry* entry = mIdentifierMap.GetEntry(aElementId);
+  return entry ? &entry->GetIdElements() : nullptr;
+}
+
+}
+
+}
+
+#endif

dom/base/Element.h

@@ -41,6 +41,7 @@
 #include "Units.h"
 #include "DOMIntersectionObserver.h"
 
+class mozAutoDocUpdate;
 class nsIFrame;
 class nsIDOMMozNamedAttrMap;
 class nsIURI;
@@ -138,12 +139,12 @@ class EventStateManager;
 
 namespace dom {
 
+struct CustomElementDefinition;
 class Animation;
 class CustomElementRegistry;
 class Link;
 class DOMRect;
 class DOMRectList;
-class DestinationInsertionPointList;
 class Grid;
 
 // IID for the dom::Element interface
@@ -254,6 +255,23 @@ public:
    */
   void ClearStyleStateLocks();
 
+  /**
+   * Accessors for the state of our dir attribute.
+   */
+  bool HasDirAuto() const
+  {
+    return State().HasState(NS_EVENT_STATE_DIR_ATTR_LIKE_AUTO);
+  }
+
+  /**
+   * Elements with dir="rtl" or dir="ltr".
+   */
+  bool HasFixedDir() const
+  {
+    return State().HasAtLeastOneOfStates(NS_EVENT_STATE_DIR_ATTR_LTR |
+                                         NS_EVENT_STATE_DIR_ATTR_RTL);
+  }
+
   /**
    * Get the inline style declaration, if any, for this element.
    */
@@ -379,16 +397,48 @@ public:
 
   bool GetBindingURL(nsIDocument *aDocument, css::URLValue **aResult);
 
-  // The bdi element defaults to dir=auto if it has no dir attribute set.
-  // Other elements will only have dir=auto if they have an explicit dir=auto,
-  // which will mean that HasValidDir() returns true but HasFixedDir() returns
-  // false
-  inline bool HasDirAuto() const {
-    return (!HasFixedDir() &&
-            (HasValidDir() || IsHTMLElement(nsGkAtoms::bdi)));
+  Directionality GetComputedDirectionality() const;
+
+  inline Element* GetFlattenedTreeParentElementForStyle() const;
+
+  /**
+   * Gets the custom element data used by web components custom element.
+   * Custom element data is created at the first attempt to enqueue a callback.
+   *
+   * @return The custom element data or null if none.
+   */
+  inline CustomElementData* GetCustomElementData() const
+  {
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
+    if (slots) {
+      return slots->mCustomElementData;
+    }
+    return nullptr;
   }
 
-  Directionality GetComputedDirectionality() const;
+  /**
+   * Sets the custom element data, ownership of the
+   * callback data is taken by this element.
+   *
+   * @param aData The custom element data.
+   */
+  void SetCustomElementData(CustomElementData* aData);
+
+  /**
+   * Gets the custom element definition used by web components custom element.
+   *
+   * @return The custom element definition or null if element is not a custom
+   *         element or custom element is not defined yet.
+   */
+  CustomElementDefinition* GetCustomElementDefinition() const;
+
+  /**
+   * Sets the custom element definition, called when custom element is created
+   * or upgraded.
+   *
+   * @param aDefinition The custom element definition.
+   */
+  void SetCustomElementDefinition(CustomElementDefinition* aDefinition);
 
 protected:
   /**
@@ -421,6 +471,9 @@ protected:
     mState &= ~aStates;
   }
 
+  already_AddRefed<ShadowRoot> AttachShadowInternal(bool aClosed,
+                                                    ErrorResult& aError);
+
 private:
   // Need to allow the ESM, nsGlobalWindow, and the focus manager to
   // set our state
@@ -459,6 +512,16 @@ protected:
     RemoveStatesSilently(aStates);
     NotifyStateChange(aStates);
   }
+  virtual void ToggleStates(EventStates aStates, bool aNotify)
+  {
+    NS_PRECONDITION(!aStates.HasAtLeastOneOfStates(INTRINSIC_STATES),
+                    "Should only be removing externally-managed states here");
+    mState ^= aStates;
+    if (aNotify) {
+      NotifyStateChange(aStates);
+    }
+  }
+
 public:
   virtual void UpdateEditableState(bool aNotify) override;
 
@@ -481,6 +544,7 @@ public:
   already_AddRefed<mozilla::dom::NodeInfo>
   GetExistingAttrNameFromQName(const nsAString& aStr) const;
 
+  MOZ_ALWAYS_INLINE  // Avoid a crashy hook from Avast 10 Beta (Bug 1058131)
   nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                    const nsAString& aValue, bool aNotify)
   {
@@ -495,25 +559,57 @@ public:
    * values will not actually be compared if we aren't notifying and we don't
    * have mutation listeners (in which case it's cheap to just return false
    * and let the caller go ahead and set the value).
-   * @param aOldValue Set to the old value of the attribute, but only if there
-   *   are event listeners. If set, the type of aOldValue will be either
+   * @param aOldValue [out] Set to the old value of the attribute, but only if
+   *   there are event listeners. If set, the type of aOldValue will be either
    *   nsAttrValue::eString or nsAttrValue::eAtom.
-   * @param aModType Set to nsIDOMMutationEvent::MODIFICATION or to
+   * @param aModType [out] Set to nsIDOMMutationEvent::MODIFICATION or to
    *   nsIDOMMutationEvent::ADDITION, but only if this helper returns true
-   * @param aHasListeners Set to true if there are mutation event listeners
-   *   listening for NS_EVENT_BITS_MUTATION_ATTRMODIFIED
+   * @param aHasListeners [out] Set to true if there are mutation event
+   *   listeners listening for NS_EVENT_BITS_MUTATION_ATTRMODIFIED
+   * @param aOldValueSet [out] Indicates whether an old attribute value has been
+   *   stored in aOldValue. The bool will be set to true if a value was stored.
    */
   bool MaybeCheckSameAttrVal(int32_t aNamespaceID, nsIAtom* aName,
                              nsIAtom* aPrefix,
                              const nsAttrValueOrString& aValue,
                              bool aNotify, nsAttrValue& aOldValue,
-                             uint8_t* aModType, bool* aHasListeners);
+                             uint8_t* aModType, bool* aHasListeners,
+                             bool* aOldValueSet);
+
+  /**
+   * Notifies mutation listeners if aNotify is true, there are mutation
+   * listeners, and the attribute value is changing.
+   *
+   * @param aNamespaceID The namespace of the attribute
+   * @param aName The local name of the attribute
+   * @param aPrefix The prefix of the attribute
+   * @param aValue The value that the attribute is being changed to
+   * @param aNotify If true, mutation listeners will be notified if they exist
+   *   and the attribute value is changing
+   * @param aOldValue [out] Set to the old value of the attribute, but only if
+   *   there are event listeners. If set, the type of aOldValue will be either
+   *   nsAttrValue::eString or nsAttrValue::eAtom.
+   * @param aModType [out] Set to nsIDOMMutationEvent::MODIFICATION or to
+   *   nsIDOMMutationEvent::ADDITION, but only if this helper returns true
+   * @param aHasListeners [out] Set to true if there are mutation event
+   *   listeners listening for NS_EVENT_BITS_MUTATION_ATTRMODIFIED
+   * @param aOldValueSet [out] Indicates whether an old attribute value has been
+   *   stored in aOldValue. The bool will be set to true if a value was stored.
+   */
 
   bool OnlyNotifySameValueSet(int32_t aNamespaceID, nsIAtom* aName,
                               nsIAtom* aPrefix,
                               const nsAttrValueOrString& aValue,
                               bool aNotify, nsAttrValue& aOldValue,
-                              uint8_t* aModType, bool* aHasListeners);
+                              uint8_t* aModType, bool* aHasListeners,
+                              bool* aOldValueSet);
+
+  /**
+   * Sets the class attribute to a value that contains no whitespace.
+   * Assumes that we are not notifying and that the attribute hasn't been
+   * set previously.
+   */
+  nsresult SetSingleClassFromParser(nsIAtom* aSingleClassName);
 
   virtual nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName, nsIAtom* aPrefix,
                            const nsAString& aValue, bool aNotify) override;
@@ -550,7 +646,7 @@ public:
    * guaranteed (e.g. we could have class="").
    */
   const nsAttrValue* GetClasses() const {
-    if (HasFlag(NODE_MAY_HAVE_CLASS)) {
+    if (MayHaveClass()) {
       return DoGetClasses();
     }
     return nullptr;
@@ -722,6 +818,25 @@ public:
   already_AddRefed<nsIHTMLCollection>
     GetElementsByClassName(const nsAString& aClassNames);
 
+  CSSPseudoElementType GetPseudoElementType() const {
+    if (!HasProperties()) {
+      return CSSPseudoElementType::NotPseudo;
+    }
+    nsresult rv = NS_OK;
+    auto raw = GetProperty(nsGkAtoms::pseudoProperty, &rv);
+    if (rv == NS_PROPTABLE_PROP_NOT_THERE) {
+      return CSSPseudoElementType::NotPseudo;
+    }
+    return CSSPseudoElementType(reinterpret_cast<uintptr_t>(raw));
+  }
+
+  void SetPseudoElementType(CSSPseudoElementType aPseudo) {
+    static_assert(sizeof(CSSPseudoElementType) <= sizeof(uintptr_t),
+                  "Need to be able to store this in a void*");
+    MOZ_ASSERT(aPseudo != CSSPseudoElementType::NotPseudo);
+    SetProperty(nsGkAtoms::pseudoProperty, reinterpret_cast<void*>(aPseudo));
+  }
+
 private:
   /**
    * Implement the algorithm specified at
@@ -809,12 +924,19 @@ public:
   already_AddRefed<DOMRectList> GetClientRects();
   already_AddRefed<DOMRect> GetBoundingClientRect();
 
+  // Shadow DOM v1
+  already_AddRefed<ShadowRoot> AttachShadow(const ShadowRootInit& aInit,
+                                            ErrorResult& aError);
+  ShadowRoot* GetShadowRootByMode() const;
+  void SetSlot(const nsAString& aName, ErrorResult& aError);
+  void GetSlot(nsAString& aName);
+
+  // [deprecated] Shadow DOM v0
   already_AddRefed<ShadowRoot> CreateShadowRoot(ErrorResult& aError);
-  already_AddRefed<DestinationInsertionPointList> GetDestinationInsertionPoints();
 
   ShadowRoot *FastGetShadowRoot() const
   {
-    nsDOMSlots* slots = GetExistingDOMSlots();
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
     return slots ? slots->mShadowRoot.get() : nullptr;
   }
 
@@ -1200,7 +1322,10 @@ protected:
    *                      its current value) is !StoresOwnData() --- in which
    *                      case the current value is probably already useless.
    *                      If the current value is StoresOwnData() (or absent),
-   *                      aOldValue will not be used.
+   *                      aOldValue will not be used. aOldValue will only be set
+   *                      in certain circumstances (there are mutation
+   *                      listeners, element is a custom element, attribute was
+   *                      not previously unset). Otherwise it will be null.
    * @param aParsedValue  parsed new value of attribute. Replaced by the
    *                      old value of the attribute. This old value is only
    *                      useful if either it or the new value is StoresOwnData.
@@ -1209,16 +1334,19 @@ protected:
    * @param aFireMutation should mutation-events be fired?
    * @param aNotify       should we notify document-observers?
    * @param aCallAfterSetAttr should we call AfterSetAttr?
+   * @param aComposedDocument The current composed document of the element.
    */
   nsresult SetAttrAndNotify(int32_t aNamespaceID,
                             nsIAtom* aName,
                             nsIAtom* aPrefix,
-                            const nsAttrValue& aOldValue,
+                            const nsAttrValue* aOldValue,
                             nsAttrValue& aParsedValue,
                             uint8_t aModType,
                             bool aFireMutation,
                             bool aNotify,
-                            bool aCallAfterSetAttr);
+                            bool aCallAfterSetAttr,
+                            nsIDocument* aComposedDocument,
+                            const mozAutoDocUpdate& aGuard);
 
   /**
    * Scroll to a new position using behavior evaluated from CSS and
@@ -1256,14 +1384,21 @@ protected:
    *
    * @param aDocument the current document of this node (an optimization)
    * @param aName the name of the attribute
-   * @param aValue the nsAttrValue to set
+   * @param aValue the nsAttrValue to set. Will be swapped with the existing
+   *               value of the attribute if the attribute already exists.
+   * @param [out] aValueWasSet If the attribute was not set previously,
+   *                           aValue will be swapped with an empty attribute
+   *                           and aValueWasSet will be set to false. Otherwise,
+   *                           aValueWasSet will be set to true and aValue will
+   *                           contain the previous value set.
    * @param [out] aRetval the nsresult status of the operation, if any.
    * @return true if the setting was attempted, false otherwise.
    */
-  virtual bool SetMappedAttribute(nsIDocument* aDocument,
-                                    nsIAtom* aName,
-                                    nsAttrValue& aValue,
-                                    nsresult* aRetval);
+  virtual bool SetAndSwapMappedAttribute(nsIDocument* aDocument,
+                                         nsIAtom* aName,
+                                         nsAttrValue& aValue,
+                                         bool* aValueWasSet,
+                                         nsresult* aRetval);
 
   /**
    * Hook that is called by Element::SetAttr to allow subclasses to
@@ -1276,33 +1411,92 @@ protected:
    * @param aName the localname of the attribute being set
    * @param aValue the value it's being set to represented as either a string or
    *        a parsed nsAttrValue. Alternatively, if the attr is being removed it
-   *        will be null. BeforeSetAttr is allowed to modify aValue by parsing
-   *        the string to an nsAttrValue (to avoid having to reparse it in
-   *        ParseAttribute).
+   *        will be null.
    * @param aNotify Whether we plan to notify document observers.
    */
-  // Note that this is inlined so that when subclasses call it it gets
-  // inlined.  Those calls don't go through a vtable.
   virtual nsresult BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
-                                 nsAttrValueOrString* aValue,
+                                 const nsAttrValueOrString* aValue,
                                  bool aNotify);
 
   /**
    * Hook that is called by Element::SetAttr to allow subclasses to
    * deal with attribute sets.  This will only be called after we have called
-   * SetAndTakeAttr and AttributeChanged (that is, after we have actually set
-   * the attr).  It will always be called under a scriptblocker.
+   * SetAndSwapAttr (that is, after we have actually set the attr).  It will
+   * always be called under a scriptblocker.
    *
    * @param aNamespaceID the namespace of the attr being set
    * @param aName the localname of the attribute being set
    * @param aValue the value it's being set to.  If null, the attr is being
    *        removed.
+   * @param aOldValue the value that the attribute had previously. If null,
+   *        the attr was not previously set. This argument may not have the
+   *        correct value for SVG elements, or other cases in which the
+   *        attribute value doesn't store its own data
    * @param aNotify Whether we plan to notify document observers.
    */
   // Note that this is inlined so that when subclasses call it it gets
   // inlined.  Those calls don't go through a vtable.
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
-                                const nsAttrValue* aValue, bool aNotify)
+                                const nsAttrValue* aValue,
+                                const nsAttrValue* aOldValue, bool aNotify)
+  {
+    return NS_OK;
+  }
+
+  /**
+   * This function shall be called just before the id attribute changes. It will
+   * be called after BeforeSetAttr. If the attribute being changed is not the id
+   * attribute, this function does nothing. Otherwise, it will remove the old id
+   * from the document's id cache.
+   *
+   * This must happen after BeforeSetAttr (rather than during) because the
+   * the subclasses' calls to BeforeSetAttr may notify on state changes. If they
+   * incorrectly determine whether the element had an id, the element may not be
+   * restyled properly.
+   *
+   * @param aNamespaceID the namespace of the attr being set
+   * @param aName the localname of the attribute being set
+   * @param aValue the new id value. Will be null if the id is being unset.
+   */
+  void PreIdMaybeChange(int32_t aNamespaceID, nsIAtom* aName,
+                        const nsAttrValueOrString* aValue);
+
+  /**
+   * This function shall be called just after the id attribute changes. It will
+   * be called before AfterSetAttr. If the attribute being changed is not the id
+   * attribute, this function does nothing. Otherwise, it will add the new id to
+   * the document's id cache and properly set the ElementHasID flag.
+   *
+   * This must happen before AfterSetAttr (rather than during) because the
+   * the subclasses' calls to AfterSetAttr may notify on state changes. If they
+   * incorrectly determine whether the element now has an id, the element may
+   * not be restyled properly.
+   *
+   * @param aNamespaceID the namespace of the attr being set
+   * @param aName the localname of the attribute being set
+   * @param aValue the new id value. Will be null if the id is being unset.
+   */
+  void PostIdMaybeChange(int32_t aNamespaceID, nsIAtom* aName,
+                         const nsAttrValue* aValue);
+
+  /**
+   * Usually, setting an attribute to the value that it already has results in
+   * no action. However, in some cases, setting an attribute to its current
+   * value should have the effect of, for example, forcing a reload of
+   * network data. To address that, this function will be called in this
+   * situation to allow the handling of such a case.
+   *
+   * @param aNamespaceID the namespace of the attr being set
+   * @param aName the localname of the attribute being set
+   * @param aValue the value it's being set to represented as either a string or
+   *        a parsed nsAttrValue.
+   * @param aNotify Whether we plan to notify document observers.
+   */
+  // Note that this is inlined so that when subclasses call it it gets
+  // inlined.  Those calls don't go through a vtable.
+  virtual nsresult OnAttrSetButNotChanged(int32_t aNamespaceID, nsIAtom* aName,
+                                          const nsAttrValueOrString& aValue,
+                                          bool aNotify)
   {
     return NS_OK;
   }
@@ -1361,7 +1555,7 @@ protected:
   /**
    * Handle status bar updates before they can be cancelled.
    */
-  nsresult PreHandleEventForLinks(EventChainPreVisitor& aVisitor);
+  nsresult GetEventTargetParentForLinks(EventChainPreVisitor& aVisitor);
 
   /**
    * Handle default actions for link event if the event isn't consumed yet.
@@ -1421,30 +1615,6 @@ private:
   nsCOMPtr<nsIDocument> mDoc;
 };
 
-class DestinationInsertionPointList : public nsINodeList
-{
-public:
-  explicit DestinationInsertionPointList(Element* aElement);
-
-  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DestinationInsertionPointList)
-
-  // nsIDOMNodeList
-  NS_DECL_NSIDOMNODELIST
-
-  // nsINodeList
-  virtual nsIContent* Item(uint32_t aIndex) override;
-  virtual int32_t IndexOf(nsIContent* aContent) override;
-  virtual nsINode* GetParentObject() override { return mParent; }
-  virtual uint32_t Length() const;
-  virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
-protected:
-  virtual ~DestinationInsertionPointList();
-
-  RefPtr<Element> mParent;
-  nsCOMArray<nsIContent> mDestinationPoints;
-};
-
 NS_DEFINE_STATIC_IID_ACCESSOR(Element, NS_ELEMENT_IID)
 
 inline bool

dom/base/ElementInlines.h

@@ -8,6 +8,7 @@
 #define mozilla_dom_ElementInlines_h
 
 #include "mozilla/dom/Element.h"
+#include "nsIContentInlines.h"
 #include "nsIDocument.h"
 
 namespace mozilla {
@@ -25,6 +26,17 @@ Element::UnregisterActivityObserver()
   OwnerDoc()->UnregisterActivityObserver(this);
 }
 
+inline Element*
+Element::GetFlattenedTreeParentElementForStyle() const
+{
+  nsINode* parentNode = GetFlattenedTreeParentNodeForStyle();
+  if MOZ_LIKELY(parentNode && parentNode->IsElement()) {
+    return parentNode->AsElement();
+  }
+
+  return nullptr;
+}
+
 } // namespace dom
 } // namespace mozilla
 

dom/base/FragmentOrElement.cpp

@@ -123,6 +123,7 @@
 #include "mozilla/CORSMode.h"
 
 #include "mozilla/dom/ShadowRoot.h"
+#include "mozilla/dom/HTMLSlotElement.h"
 #include "mozilla/dom/HTMLTemplateElement.h"
 
 #include "nsStyledElement.h"
@@ -151,8 +152,56 @@ nsIContent::FindFirstNonChromeOnlyAccessContent() const
   return nullptr;
 }
 
+// https://dom.spec.whatwg.org/#dom-slotable-assignedslot
+HTMLSlotElement*
+nsIContent::GetAssignedSlotByMode() const
+{
+  /**
+   * Get slotable's assigned slot for the result of
+   * find a slot with open flag UNSET [1].
+   *
+   * [1] https://dom.spec.whatwg.org/#assign-a-slot
+   */
+  HTMLSlotElement* slot = GetAssignedSlot();
+  if (!slot) {
+    return nullptr;
+  }
+
+  MOZ_ASSERT(GetParent());
+  MOZ_ASSERT(GetParent()->GetShadowRoot());
+
+  /**
+   * Additional check for open flag SET:
+   *   If slotable’s parent’s shadow root's mode is not "open",
+   *   then return null.
+   */
+  if (GetParent()->GetShadowRoot()->IsClosed()) {
+    return nullptr;
+  }
+
+  return slot;
+}
+
 nsINode*
-nsIContent::GetFlattenedTreeParentNodeInternal() const
+nsIContent::GetFlattenedTreeParentForMaybeAssignedNode() const
+{
+  if (HTMLSlotElement* assignedSlot = GetAssignedSlot()) {
+    return assignedSlot;
+  }
+
+  HTMLSlotElement* parentSlot = HTMLSlotElement::FromContent(GetParent());
+  if (!parentSlot) {
+    return nullptr;
+  }
+
+  // If this is not an unassigned node, then it must be a fallback content.
+  MOZ_ASSERT(parentSlot->AssignedNodes().IsEmpty());
+
+  return parentSlot;
+}
+
+nsINode*
+nsIContent::GetFlattenedTreeParentNodeInternal(FlattenedParentType aType) const
 {
   nsINode* parentNode = GetParentNode();
   if (!parentNode || !parentNode->IsContent()) {
@@ -161,18 +210,51 @@ nsIContent::GetFlattenedTreeParentNodeInternal() const
   }
   nsIContent* parent = parentNode->AsContent();
 
+  if (aType == eForStyle &&
+      IsRootOfNativeAnonymousSubtree() &&
+      OwnerDoc()->GetRootElement() == parent) {
+    // When getting the flattened tree parent for style, we return null
+    // for any "document level" native anonymous content subtree root.
+    // This is NAC generated by an ancestor frame of the document element's
+    // primary frame, and includes scrollbar elements created by the root
+    // scroll frame, and the "custom content container" and accessible caret
+    // generated by the nsCanvasFrame.  We distinguish document level NAC
+    // from NAC generated by the root element's primary frame below.
+    nsIFrame* parentFrame = parent->GetPrimaryFrame();
+    if (!parentFrame) {
+      // If the root element has no primary frame, it means it can't have
+      // generated any NAC itself.  Thus any NAC we have here must have
+      // been generated by an ancestor frame.
+      //
+      // If we are in here, then either the root element is display:none, or
+      // we are in the middle of constructing the root of the frame tree and
+      // we are trying to eagerly restyle document level NAC in
+      // nsCSSFrameConstructor::GetAnonymousContent before the root
+      // element's frame has been constructed.
+      return nullptr;
+    }
+    nsIAnonymousContentCreator* creator = do_QueryFrame(parentFrame);
+    if (!creator) {
+      // If the root element does have a frame, but does not implement
+      // nsIAnonymousContentCreator, then this must be document level NAC.
+      return nullptr;
+    }
+    AutoTArray<nsIContent*, 8> elements;
+    creator->AppendAnonymousContentTo(elements, 0);
+    if (!elements.Contains(this)) {
+      // If the root element does have a frame, and also does implement
+      // nsIAnonymousContentCreator, but didn't create this node, then
+      // it must be document level NAC.
+      return nullptr;
+    }
+  }
+
   if (parent && nsContentUtils::HasDistributedChildren(parent) &&
       nsContentUtils::IsInSameAnonymousTree(parent, this)) {
-    // This node is distributed to insertion points, thus we
-    // need to consult the destination insertion points list to
-    // figure out where this node was inserted in the flattened tree.
-    // It may be the case that |parent| distributes its children
-    // but the child does not match any insertion points, thus
-    // the flattened tree parent is nullptr.
-    nsTArray<nsIContent*>* destInsertionPoints = GetExistingDestInsertionPoints();
-    parent = destInsertionPoints && !destInsertionPoints->IsEmpty() ?
-      destInsertionPoints->LastElement()->GetParent() : nullptr;
-  } else if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
+    return GetFlattenedTreeParentForMaybeAssignedNode();
+  }
+
+  if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
     nsIContent* insertionParent = GetXBLInsertionParent();
     if (insertionParent) {
       parent = insertionParent;
@@ -530,8 +612,7 @@ nsNodeSupportsWeakRefTearoff::GetWeakReference(nsIWeakReference** aInstancePtr)
 //----------------------------------------------------------------------
 FragmentOrElement::nsDOMSlots::nsDOMSlots()
   : nsINode::nsSlots(),
-    mDataset(nullptr),
-    mBindingParent(nullptr)
+    mDataset(nullptr)
 {
 }
 
@@ -543,84 +624,108 @@ FragmentOrElement::nsDOMSlots::~nsDOMSlots()
 }
 
 void
-FragmentOrElement::nsDOMSlots::Traverse(nsCycleCollectionTraversalCallback &cb, bool aIsXUL)
+FragmentOrElement::nsDOMSlots::Traverse(nsCycleCollectionTraversalCallback &cb)
 {
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mStyle");
   cb.NoteXPCOMChild(mStyle.get());
 
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mSMILOverrideStyle");
-  cb.NoteXPCOMChild(mSMILOverrideStyle.get());
-
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mAttributeMap");
   cb.NoteXPCOMChild(mAttributeMap.get());
 
-  if (aIsXUL) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mControllers");
-    cb.NoteXPCOMChild(mControllers);
-  }
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mXBLBinding");
-  cb.NoteNativeChild(mXBLBinding, NS_CYCLE_COLLECTION_PARTICIPANT(nsXBLBinding));
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mXBLInsertionParent");
-  cb.NoteXPCOMChild(mXBLInsertionParent.get());
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mShadowRoot");
-  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mShadowRoot));
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mContainingShadow");
-  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mContainingShadow));
-
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mChildrenList");
   cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIDOMNodeList*, mChildrenList));
 
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mLabelsList");
-  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIDOMNodeList*, mLabelsList));
-
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mClassList");
   cb.NoteXPCOMChild(mClassList.get());
 
-  if (mCustomElementData) {
-    for (uint32_t i = 0; i < mCustomElementData->mCallbackQueue.Length(); i++) {
-      mCustomElementData->mCallbackQueue[i]->Traverse(cb);
-    }
+  if (!mExtendedSlots) {
+    return;
   }
 
-  for (auto iter = mRegisteredIntersectionObservers.Iter(); !iter.Done(); iter.Next()) {
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mSMILOverrideStyle");
+  cb.NoteXPCOMChild(mExtendedSlots->mSMILOverrideStyle.get());
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mControllers");
+  cb.NoteXPCOMChild(mExtendedSlots->mControllers);
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mLabelsList");
+  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIDOMNodeList*,mExtendedSlots-> mLabelsList));
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mShadowRoot");
+  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mExtendedSlots->mShadowRoot));
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mContainingShadow");
+  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mExtendedSlots->mContainingShadow));
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mAssignedSlot");
+  cb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mExtendedSlots->mAssignedSlot.get()));
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mXBLBinding");
+  cb.NoteNativeChild(mExtendedSlots->mXBLBinding,
+                     NS_CYCLE_COLLECTION_PARTICIPANT(nsXBLBinding));
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mXBLInsertionParent");
+  cb.NoteXPCOMChild(mExtendedSlots->mXBLInsertionParent.get());
+
+  if (mExtendedSlots->mCustomElementData) {
+    mExtendedSlots->mCustomElementData->Traverse(cb);
+  }
+
+  for (auto iter = mExtendedSlots->mRegisteredIntersectionObservers.Iter();
+       !iter.Done(); iter.Next()) {
     DOMIntersectionObserver* observer = iter.Key();
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mSlots->mRegisteredIntersectionObservers[i]");
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
+                                       "mExtendedSlots->mRegisteredIntersectionObservers[i]");
     cb.NoteXPCOMChild(observer);
   }
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mExtendedSlots->mFrameLoaderOrOpener");
+  cb.NoteXPCOMChild(mExtendedSlots->mFrameLoaderOrOpener);
 }
 
 void
-FragmentOrElement::nsDOMSlots::Unlink(bool aIsXUL)
+FragmentOrElement::nsDOMSlots::Unlink()
 {
   mStyle = nullptr;
-  mSMILOverrideStyle = nullptr;
   if (mAttributeMap) {
     mAttributeMap->DropReference();
     mAttributeMap = nullptr;
   }
-  if (aIsXUL)
-    NS_IF_RELEASE(mControllers);
-
-  MOZ_ASSERT(!mXBLBinding);
-
-  mXBLInsertionParent = nullptr;
-  mShadowRoot = nullptr;
-  mContainingShadow = nullptr;
   mChildrenList = nullptr;
-  mLabelsList = nullptr;
-  mCustomElementData = nullptr;
   mClassList = nullptr;
-  mRegisteredIntersectionObservers.Clear();
+
+  if (!mExtendedSlots) {
+    return;
+  }
+
+  mExtendedSlots->mSMILOverrideStyle = nullptr;
+  mExtendedSlots->mControllers = nullptr;
+  mExtendedSlots->mLabelsList = nullptr;
+  mExtendedSlots->mShadowRoot = nullptr;
+  mExtendedSlots->mContainingShadow = nullptr;
+  mExtendedSlots->mAssignedSlot = nullptr;
+  MOZ_ASSERT(!(mExtendedSlots->mXBLBinding));
+  mExtendedSlots->mXBLInsertionParent = nullptr;
+  if (mExtendedSlots->mCustomElementData) {
+    mExtendedSlots->mCustomElementData->Unlink();
+    mExtendedSlots->mCustomElementData = nullptr;
+  }
+  mExtendedSlots->mRegisteredIntersectionObservers.Clear();
+  nsCOMPtr<nsIFrameLoader> frameLoader =
+    do_QueryInterface(mExtendedSlots->mFrameLoaderOrOpener);
+  if (frameLoader) {
+    static_cast<nsFrameLoader*>(frameLoader.get())->Destroy();
+  }
+  mExtendedSlots->mFrameLoaderOrOpener = nullptr;
 }
 
 size_t
 FragmentOrElement::nsDOMSlots::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const
 {
   size_t n = aMallocSizeOf(this);
+  if (mExtendedSlots) {
+    n += aMallocSizeOf(mExtendedSlots.get());
+  }
 
   if (mAttributeMap) {
     n += mAttributeMap->SizeOfIncludingThis(aMallocSizeOf);
@@ -641,6 +746,19 @@ FragmentOrElement::nsDOMSlots::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) c
   return n;
 }
 
+FragmentOrElement::nsExtendedDOMSlots::nsExtendedDOMSlots()
+  : mBindingParent(nullptr)
+{
+}
+
+FragmentOrElement::nsExtendedDOMSlots::~nsExtendedDOMSlots()
+{
+  nsCOMPtr<nsIFrameLoader> frameLoader = do_QueryInterface(mFrameLoaderOrOpener);
+  if (frameLoader) {
+    static_cast<nsFrameLoader*>(frameLoader.get())->Destroy();
+  }
+}
+
 FragmentOrElement::FragmentOrElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : nsIContent(aNodeInfo)
 {
@@ -686,7 +804,7 @@ FindChromeAccessOnlySubtreeOwner(nsIContent* aContent)
 }
 
 nsresult
-nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
+nsIContent::GetEventTargetParent(EventChainPreVisitor& aVisitor)
 {
   //FIXME! Document how this event retargeting works, Bug 329124.
   aVisitor.mCanHandle = true;
@@ -695,6 +813,7 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
   // Don't propagate mouseover and mouseout events when mouse is moving
   // inside chrome access only content.
   bool isAnonForEvents = IsRootOfChromeAccessOnlySubtree();
+  aVisitor.mRootOfClosedTree = isAnonForEvents;
   if ((aVisitor.mEvent->mMessage == eMouseOver ||
        aVisitor.mEvent->mMessage == eMouseOut ||
        aVisitor.mEvent->mMessage == ePointerOver ||
@@ -706,7 +825,7 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
       ((this == aVisitor.mEvent->mOriginalTarget &&
         !ChromeOnlyAccess()) || isAnonForEvents || GetShadowRoot())) {
      nsCOMPtr<nsIContent> relatedTarget =
-       do_QueryInterface(aVisitor.mEvent->AsMouseEvent()->relatedTarget);
+       do_QueryInterface(aVisitor.mEvent->AsMouseEvent()->mRelatedTarget);
     if (relatedTarget &&
         relatedTarget->OwnerDoc() == OwnerDoc()) {
 
@@ -716,7 +835,7 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
         nsIContent* adjustedTarget =
           Event::GetShadowRelatedTarget(this, relatedTarget);
         if (this == adjustedTarget) {
-          aVisitor.mParentTarget = nullptr;
+          aVisitor.SetParentTarget(nullptr, false);
           aVisitor.mCanHandle = false;
           return NS_OK;
         }
@@ -773,7 +892,7 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
                         originalTarget->FindFirstNonChromeOnlyAccessContent())
                        ? "" : "Wrong event propagation!?!\n");
 #endif
-              aVisitor.mParentTarget = nullptr;
+              aVisitor.SetParentTarget(nullptr, false);
               // Event should not propagate to non-anon content.
               aVisitor.mCanHandle = isAnonForEvents;
               return NS_OK;
@@ -784,58 +903,10 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
     }
   }
 
-  nsIContent* parent = GetParent();
-
-  // Web components have a special event chain that need to account
-  // for destination insertion points where nodes have been distributed.
-  nsTArray<nsIContent*>* destPoints = GetExistingDestInsertionPoints();
-  if (destPoints && !destPoints->IsEmpty()) {
-    // Push destination insertion points to aVisitor.mDestInsertionPoints
-    // excluding shadow insertion points.
-    bool didPushNonShadowInsertionPoint = false;
-    for (uint32_t i = 0; i < destPoints->Length(); i++) {
-      nsIContent* point = destPoints->ElementAt(i);
-      if (!ShadowRoot::IsShadowInsertionPoint(point)) {
-        aVisitor.mDestInsertionPoints.AppendElement(point);
-        didPushNonShadowInsertionPoint = true;
-      }
-    }
-
-    // Next node in the event path is the final destination
-    // (non-shadow) insertion point that was pushed.
-    if (didPushNonShadowInsertionPoint) {
-      parent = aVisitor.mDestInsertionPoints.LastElement();
-      aVisitor.mDestInsertionPoints.SetLength(
-        aVisitor.mDestInsertionPoints.Length() - 1);
-    }
-  }
-
-  ShadowRoot* thisShadowRoot = ShadowRoot::FromNode(this);
-  if (thisShadowRoot) {
-    if (!aVisitor.mEvent->mFlags.mComposed) {
-      // If we do stop propagation, we still want to propagate
-      // the event to chrome (nsPIDOMWindow::GetParentTarget()).
-      // The load event is special in that we don't ever propagate it
-      // to chrome.
-      nsCOMPtr<nsPIDOMWindowOuter> win = OwnerDoc()->GetWindow();
-      EventTarget* parentTarget = win && aVisitor.mEvent->mMessage != eLoad
-        ? win->GetParentTarget() : nullptr;
-
-      aVisitor.mParentTarget = parentTarget;
-      return NS_OK;
-    }
-
-    if (!aVisitor.mDestInsertionPoints.IsEmpty()) {
-      parent = aVisitor.mDestInsertionPoints.LastElement();
-      aVisitor.mDestInsertionPoints.SetLength(
-        aVisitor.mDestInsertionPoints.Length() - 1);
-    } else {
-      // The pool host for the youngest shadow root is shadow DOM host,
-      // for older shadow roots, it is the shadow insertion point
-      // where the shadow root is projected, nullptr if none exists.
-      parent = thisShadowRoot->GetPoolHost();
-    }
-  }
+  // Event parent is the assigned slot, if node is assigned, or node's parent
+  // otherwise.
+  HTMLSlotElement* slot = GetAssignedSlot();
+  nsIContent* parent = slot ? slot : GetParent();
 
   // Event may need to be retargeted if this is the root of a native
   // anonymous content subtree or event is dispatched somewhere inside XBL.
@@ -873,11 +944,17 @@ nsIContent::PreHandleEvent(EventChainPreVisitor& aVisitor)
   if (!aVisitor.mEvent->mFlags.mComposedInNativeAnonymousContent &&
       IsRootOfNativeAnonymousSubtree() && OwnerDoc() &&
       OwnerDoc()->GetWindow()) {
-    aVisitor.mParentTarget = OwnerDoc()->GetWindow()->GetParentTarget();
+    aVisitor.SetParentTarget(OwnerDoc()->GetWindow()->GetParentTarget(), true);
   } else if (parent) {
-    aVisitor.mParentTarget = parent;
+    aVisitor.SetParentTarget(parent, false);
+    if (slot) {
+      ShadowRoot* root = slot->GetContainingShadow();
+      if (root && root->IsClosed()) {
+        aVisitor.mParentIsSlotInClosedTree = true;
+      }
+    }
   } else {
-    aVisitor.mParentTarget = GetComposedDoc();
+    aVisitor.SetParentTarget(GetComposedDoc(), false);
   }
   return NS_OK;
 }
@@ -962,7 +1039,7 @@ FragmentOrElement::IsLink(nsIURI** aURI) const
 nsIContent*
 FragmentOrElement::GetBindingParent() const
 {
-  nsDOMSlots *slots = GetExistingDOMSlots();
+  nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
 
   if (slots) {
     return slots->mBindingParent;
@@ -974,7 +1051,7 @@ nsXBLBinding*
 FragmentOrElement::GetXBLBinding() const
 {
   if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-    nsDOMSlots *slots = GetExistingDOMSlots();
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
     if (slots) {
       return slots->mXBLBinding;
     }
@@ -1009,11 +1086,11 @@ FragmentOrElement::SetXBLBinding(nsXBLBinding* aBinding,
 
   if (aBinding) {
     SetFlags(NODE_MAY_BE_IN_BINDING_MNGR);
-    nsDOMSlots *slots = DOMSlots();
+    nsExtendedDOMSlots* slots = ExtendedDOMSlots();
     slots->mXBLBinding = aBinding;
     bindingManager->AddBoundContent(this);
   } else {
-    nsDOMSlots *slots = GetExistingDOMSlots();
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
     if (slots) {
       slots->mXBLBinding = nullptr;
     }
@@ -1028,7 +1105,7 @@ nsIContent*
 FragmentOrElement::GetXBLInsertionParent() const
 {
   if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-    nsDOMSlots *slots = GetExistingDOMSlots();
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
     if (slots) {
       return slots->mXBLInsertionParent;
     }
@@ -1040,7 +1117,7 @@ FragmentOrElement::GetXBLInsertionParent() const
 ShadowRoot*
 FragmentOrElement::GetContainingShadow() const
 {
-  nsDOMSlots *slots = GetExistingDOMSlots();
+  nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
   if (slots) {
     return slots->mContainingShadow;
   }
@@ -1050,60 +1127,48 @@ FragmentOrElement::GetContainingShadow() const
 void
 FragmentOrElement::SetShadowRoot(ShadowRoot* aShadowRoot)
 {
-  nsDOMSlots *slots = DOMSlots();
+  nsExtendedDOMSlots* slots = ExtendedDOMSlots();
   slots->mShadowRoot = aShadowRoot;
 }
 
-nsTArray<nsIContent*>&
-FragmentOrElement::DestInsertionPoints()
+HTMLSlotElement*
+FragmentOrElement::GetAssignedSlot() const
 {
-  nsDOMSlots *slots = DOMSlots();
-  return slots->mDestInsertionPoints;
+  nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
+  return slots ? slots->mAssignedSlot.get() : nullptr;
 }
 
-nsTArray<nsIContent*>*
-FragmentOrElement::GetExistingDestInsertionPoints() const
+nsIContent*
+nsIContent::GetContainingShadowHost() const
 {
-  nsDOMSlots *slots = GetExistingDOMSlots();
-  if (slots) {
-    return &slots->mDestInsertionPoints;
+  if (mozilla::dom::ShadowRoot* shadow = GetContainingShadow()) {
+    return shadow->GetHost();
   }
   return nullptr;
 }
 
+void
+FragmentOrElement::SetAssignedSlot(HTMLSlotElement* aSlot)
+{
+  nsExtendedDOMSlots* slots = ExtendedDOMSlots();
+  slots->mAssignedSlot = aSlot;
+}
+
 void
 FragmentOrElement::SetXBLInsertionParent(nsIContent* aContent)
 {
   if (aContent) {
-    nsDOMSlots *slots = DOMSlots();
+    nsExtendedDOMSlots* slots = ExtendedDOMSlots();
     SetFlags(NODE_MAY_BE_IN_BINDING_MNGR);
     slots->mXBLInsertionParent = aContent;
   } else {
-    nsDOMSlots *slots = GetExistingDOMSlots();
+    nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
     if (slots) {
       slots->mXBLInsertionParent = nullptr;
     }
   }
 }
 
-CustomElementData*
-FragmentOrElement::GetCustomElementData() const
-{
-  nsDOMSlots *slots = GetExistingDOMSlots();
-  if (slots) {
-    return slots->mCustomElementData;
-  }
-  return nullptr;
-}
-
-void
-FragmentOrElement::SetCustomElementData(CustomElementData* aData)
-{
-  nsDOMSlots *slots = DOMSlots();
-  MOZ_ASSERT(!slots->mCustomElementData, "Custom element data may not be changed once set.");
-  slots->mCustomElementData = aData;
-}
-
 nsresult
 FragmentOrElement::InsertChildAt(nsIContent* aKid,
                                 uint32_t aIndex,
@@ -1366,14 +1431,15 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(FragmentOrElement)
   {
     nsDOMSlots *slots = tmp->GetExistingDOMSlots();
     if (slots) {
-      if (tmp->IsElement()) {
+      if (slots->mExtendedSlots && tmp->IsElement()) {
         Element* elem = tmp->AsElement();
-        for (auto iter = slots->mRegisteredIntersectionObservers.Iter(); !iter.Done(); iter.Next()) {
+        for (auto iter = slots->mExtendedSlots->mRegisteredIntersectionObservers.Iter();
+             !iter.Done(); iter.Next()) {
           DOMIntersectionObserver* observer = iter.Key();
           observer->UnlinkTarget(*elem);
         }
       }
-      slots->Unlink(tmp->IsXULElement());
+      slots->Unlink();
     }
   }
 
@@ -1938,7 +2004,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(FragmentOrElement)
   {
     nsDOMSlots *slots = tmp->GetExistingDOMSlots();
     if (slots) {
-      slots->Traverse(cb, tmp->IsXULElement());
+      slots->Traverse(cb);
     }
   }
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
@@ -2353,9 +2419,8 @@ FragmentOrElement::SetIsElementInStyleScopeFlagOnShadowTree(bool aInStyleScope)
   NS_ASSERTION(IsElement(), "calling SetIsElementInStyleScopeFlagOnShadowTree "
                             "on a non-Element is useless");
   ShadowRoot* shadowRoot = GetShadowRoot();
-  while (shadowRoot) {
+  if (shadowRoot) {
     shadowRoot->SetIsElementInStyleScopeFlagOnSubtree(aInStyleScope);
-    shadowRoot = shadowRoot->GetOlderShadowRoot();
   }
 }