addons: an add-on naming both the AppCompat GUID and the toolkit is matched by the entry that fits

matchingTargetApplication prefers, in order: this application's own id, the
AppCompat GUID (extensions.guid.appCompatId, the Firefox GUID), the toolkit.
The AppCompat entry was taken whenever present, whatever its version range.

An add-on can name both for different reasons: the GUID entry for the
application that owns that GUID, at that application's versions (Basilisk is
{ec8030f7-...} at 52.9.x), and a toolkit entry meaning "any other application
on this platform". For an application that is neither, with an AppCompat
version of 56.9, the GUID entry "52.9.0 - 52.9.*" under strict compatibility
does not fit - and because it was preferred, the toolkit entry that does
describe the application was never looked at. The add-on was installed and
immediately disabled as incompatible.

Now the AppCompat entry is used only if it admits the AppCompat version (both
bounds under strict compatibility, the lower bound otherwise - the rule
isCompatibleWith applies) or if there is no toolkit entry to fall back to.
Nothing changes for an add-on that names one of the two, or whose GUID entry
fits.

Found with Palefill 1.30 (toolkit@mozilla.org 4.8.2 - 10.*, platform 6.9.0),
which now installs enabled and applies its fixes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcrVQFRMC2ANGDfVaRG9Ed

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Clobber for removal of network tickler
+Clobber for Idle GC backout

build/moz.configure/warnings.configure

@@ -88,6 +88,11 @@ check_and_add_gcc_warning('-Wno-error=deprecated-declarations')
 # false positives depending on optimization
 check_and_add_gcc_warning('-Wno-error=array-bounds')
 
+# GCC 9+ value-range analysis trips -Wformat-overflow on null %s args in debug
+# spew (e.g. js/src/jit/x64/BaseAssembler-x64.h:595); harmless for our build,
+# and js/src forces -Werror=format so this must be downgraded here to reach it.
+check_and_add_gcc_warning('-Wno-error=format-overflow')
+
 # can't get rid of those PGO warnings
 check_and_add_gcc_warning('-Wno-error=coverage-mismatch', when='MOZ_PGO')
 

devtools/client/inspector/shared/tooltips-overlay.js

@@ -143,8 +143,7 @@ TooltipsOverlay.prototype = {
     // Font preview tooltip
     if (type === VIEW_NODE_VALUE_TYPE && prop.property === "font-family") {
       let value = prop.value.toLowerCase();
-      if (value !== "inherit" && value !== "unset" && value !== "initial" &&
-          value !== "revert" && value !== "revert-layer") {
+      if (value !== "inherit" && value !== "unset" && value !== "initial" && value !== "revert") {
         tooltipType = TOOLTIP_FONTFAMILY_TYPE;
       }
     }

devtools/client/preferences/moz.build

@@ -3,6 +3,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-JS_PREFERENCE_FILES += [
+JS_PREFERENCE_PP_FILES += [
     'devtools.js',
 ]

devtools/client/shared/css-angle.js

@@ -10,8 +10,7 @@ const SPECIALVALUES = new Set([
   "initial",
   "inherit",
   "unset",
-  "revert",
-  "revert-layer"
+  "revert"
 ]);
 
 const {getCSSLexer} = require("devtools/shared/css/lexer");

devtools/client/shared/widgets/FilterWidget.js

@@ -99,14 +99,7 @@ const filterList = [
 ];
 
 // Valid values that shouldn't be parsed for filters.
-const SPECIAL_VALUES = new Set([
-  "none",
-  "unset",
-  "initial",
-  "inherit",
-  "revert",
-  "revert-layer"
-]);
+const SPECIAL_VALUES = new Set(["none", "unset", "initial", "inherit", "revert"]);
 
 /**
  * A CSS Filter editor widget used to add/remove/modify

devtools/shared/css/color.js

@@ -20,8 +20,7 @@ const SPECIALVALUES = new Set([
   "inherit",
   "transparent",
   "unset",
-  "revert",
-  "revert-layer"
+  "revert"
 ]);
 
 /**

devtools/shared/css/generated/mach_commands.py

@@ -43,7 +43,7 @@ class MachCommands(MachCommandBase):
         if not os.path.exists(generated_dir):
             generated_dir = mozpath.join(self.topsrcdir, 'platform',
                 'devtools/shared/css/generated')
-        if not os.path.exists(generated_dir):
+        else:
             raise Exception('Directory expected at %s does not exist.' % generated_dir)
         self.generated_dir = generated_dir
 
@@ -75,9 +75,6 @@ class MachCommands(MachCommandBase):
         contents = subprocess.check_output([xpcshell_path, '-g', gre_path,
                                             '-a', browser_path, script_path],
                                            env = sub_env)
-        if not isinstance(contents, str):
-            contents = contents.decode('utf-8')
-
         # Extract just the output between the delimiters as the xpcshell output can
         # have extra output that we don't want.
         contents = contents.split('DEVTOOLS_CSS_DB_DELIMITER')[1]
@@ -91,13 +88,13 @@ class MachCommands(MachCommandBase):
         destination_path = mozpath.join(self.generated_dir,
             'properties-db.js')
 
-        with open(js_template_path, 'r') as handle:
+        with open(js_template_path, 'rb') as handle:
             js_template = handle.read()
 
         preamble = '/* THIS IS AN AUTOGENERATED FILE.  DO NOT EDIT */\n\n'
         contents = string.Template(js_template).substitute(substitutions)
 
-        with open(destination_path, 'w') as destination:
+        with open(destination_path, 'wb') as destination:
             destination.write(preamble + contents)
 
         print(('The database was successfully generated at ' + destination_path))

docshell/base/nsAboutRedirector.cpp

@@ -52,7 +52,7 @@ static RedirEntry kRedirMap[] = {
   { "config", "chrome://global/content/config.xul", 0 },
   { "console", "chrome://global/content/console.xul", 0 },
   {
-    "credits", "http://www.palemoon.org/Contributors.shtml",
+    "credits", "https://net.riverstonerelay.jihad-browser/credits",
     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
     nsIAboutModule::MAKE_LINKABLE
   },

docshell/base/nsDocShell.cpp

@@ -199,6 +199,7 @@
 #include "nsICommandManager.h"
 #include "nsIDOMNode.h"
 #include "nsIDocShellTreeOwner.h"
+#include "nsIBadCertListener2.h"   // JIHAD: route cert errors to the embedder chrome
 #include "nsIHttpChannel.h"
 #include "nsIIDNService.h"
 #include "nsIInputStreamChannel.h"
@@ -1074,6 +1075,33 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
   } else if (aIID.Equals(NS_GET_IID(nsITabChild))) {
     *aSink = GetTabChild().take();
     return *aSink ? NS_OK : NS_ERROR_FAILURE;
+  } else if (aIID.Equals(NS_GET_IID(nsIBadCertListener2))) {
+    // JIHAD: hand the embedder's chrome the certificate error.
+    //
+    // NSS asks the channel's notification callbacks for nsIBadCertListener2
+    // (SSLServerCertVerification.cpp, CertErrorRunnable::CheckCertOverrides) and passes
+    // it the nsISSLStatus carrying the SERVER CERTIFICATE. That call is the one and only
+    // place an embedder is handed the cert while it still exists — the same shape the
+    // Atlas browser gets for free from WebKit's load-failed-with-tls-errors signal, which
+    // delivers the GTlsCertificate as a signal argument.
+    //
+    // Without this hop nothing answers: the docShell's fallthrough is
+    // nsDocLoader::GetInterface, which Queries the docloader ITSELF, so the request never
+    // reaches nsIWebBrowserChrome. The embedder is then left trying to recover the cert
+    // afterwards, and there is no way to: the failed channel's securityInfo has a null
+    // SSLStatus, and UXP has no nsIRecentBadCerts service. Measured 2026-08-04 — the
+    // SSL-confirm dialog worked, the user accepted, and the accept could do nothing
+    // because RememberValidityOverride had no nsIX509Cert to take.
+    //
+    // Routed through the tree owner, exactly as nsIWebBrowserChromeFocus and nsIPrompt
+    // already are (nsDocShellTreeOwner::GetInterface).
+    nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+    GetTreeOwner(getter_AddRefs(treeOwner));
+    nsCOMPtr<nsIInterfaceRequestor> req(do_QueryInterface(treeOwner));
+    if (req) {
+      return req->GetInterface(aIID, aSink);
+    }
+    return NS_NOINTERFACE;
   } else if (aIID.Equals(NS_GET_IID(nsIContentFrameMessageManager))) {
     nsCOMPtr<nsITabChild> tabChild =
       do_GetInterface(static_cast<nsIDocShell*>(this));

dom/base/nsAttrValue.h

@@ -274,7 +274,7 @@ public:
     }
 
     template<typename T,
-             typename = typename std::enable_if_t<std::is_enum_v<T>>>
+             typename = typename std::enable_if<std::is_enum<T>::value>::type>
     EnumTable(const char* aTag, T aValue)
       : tag(aTag)
       , value(static_cast<int16_t>(aValue))

dom/base/nsObjectLoadingContent.cpp

@@ -787,6 +787,12 @@ nsresult
 nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
 {
 #ifdef MOZ_ENABLE_NPAPI
+  // JIHAD DIAGNOSTIC (R7): entry + the four early-out conditions. If this line never appears the
+  // plugin was never asked for at all (no nsPluginFrame -> no HasNewFrame), which is a different
+  // bug from being asked for and refused.
+  fprintf(stderr, "[jihad-npapi] InstantiatePluginInstance(aIsLoading=%d) owner=%d type=%d "
+          "mIsLoading=%d instantiating=%d\n", (int)aIsLoading, (int)!!mInstanceOwner,
+          (int)mType, (int)mIsLoading, (int)mInstantiating);
   if (mInstanceOwner || mType != eType_Plugin || (mIsLoading != aIsLoading) ||
       mInstantiating) {
     // If we hit this assertion it's probably because LoadObject re-entered :(
@@ -822,10 +828,12 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
   NS_ENSURE_TRUE(mInstantiating, NS_OK);
 
   if (!thisContent->GetPrimaryFrame()) {
+    // JIHAD DIAGNOSTIC (R7): a silent NS_OK return — the single most likely place for a plugin
+    // to "do nothing" with no error anywhere.
+    fprintf(stderr, "[jihad-npapi] NO PRIMARY FRAME -> not instantiating\n");
     LOG(("OBJLC [%p]: Not instantiating plugin with no frame", this));
     return NS_OK;
   }
-
   nsresult rv = NS_ERROR_FAILURE;
   RefPtr<nsPluginHost> pluginHost = nsPluginHost::GetInst();
 
@@ -846,6 +854,8 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
   rv = pluginHost->InstantiatePluginInstance(mContentType,
                                              mURI.get(), this,
                                              getter_AddRefs(newOwner));
+  fprintf(stderr, "[jihad-npapi] pluginHost->InstantiatePluginInstance rv=0x%x owner=%d\n",
+          (unsigned)rv, (int)!!newOwner);
 
   // XXX(johns): We don't suspend native inside stopping plugins...
   if (appShell) {
@@ -2378,6 +2388,11 @@ nsObjectLoadingContent::LoadObject(bool aNotify,
   FallbackType clickToPlayReason;
   if (!mActivated && (mType == eType_Null || mType == eType_Plugin) &&
       !ShouldPlay(clickToPlayReason, false)) {
+    // JIHAD DIAGNOSTIC (R7): this is where a plugin that resolved fine is silently demoted to
+    // eType_Null. Every path out of ShouldPlay that returns false lands here, so one line here
+    // names the reason instead of instrumenting each exit.
+    fprintf(stderr, "[jihad-npapi] demoted to fallback: mType=%d fallbackReason=%d\n",
+            (int)mType, (int)clickToPlayReason);
     LOG(("OBJLC [%p]: Marking plugin as click-to-play", this));
     mType = eType_Null;
     fallbackType = clickToPlayReason;
@@ -2887,9 +2902,16 @@ nsObjectLoadingContent::GetTypeOfContent(const nsCString& aMIMEType)
 
 #ifdef MOZ_ENABLE_NPAPI
   RefPtr<nsPluginHost> pluginHost = nsPluginHost::GetInst();
-  if ((caps & eSupportPlugins) &&
-      pluginHost &&
-      pluginHost->HavePluginForType(aMIMEType, nsPluginHost::eExcludeNone)) {
+  bool jihadHave = pluginHost &&
+      pluginHost->HavePluginForType(aMIMEType, nsPluginHost::eExcludeNone);
+  // JIHAD DIAGNOSTIC (R7 windowless port): says, for one MIME type, whether the element
+  // advertised plugin capability and whether the host has a plugin — the two facts that decide
+  // if the NPAPI subsystem is entered at all. Added because a plugin that never instantiates
+  // produces NO plugin logging whatsoever, which is indistinguishable from one that was never
+  // asked for.
+  fprintf(stderr, "[jihad-npapi] GetTypeOfContent mime=%s caps=0x%x supportsPlugins=%d have=%d\n",
+          nsCString(aMIMEType).get(), caps, (int)!!(caps & eSupportPlugins), (int)jihadHave);
+  if ((caps & eSupportPlugins) && jihadHave) {
     // ShouldPlay will handle checking for disabled plugins
     return eType_Plugin;
   }
@@ -3486,9 +3508,15 @@ nsObjectLoadingContent::ShouldPlay(FallbackType &aReason, bool aIgnoreCurrentTyp
   aReason = eFallbackClickToPlay;
 
   uint32_t enabledState = nsIPluginTag::STATE_DISABLED;
-  pluginHost->GetStateForType(mContentType, nsPluginHost::eExcludeNone,
+  nsresult jihadStateRv = pluginHost->GetStateForType(mContentType, nsPluginHost::eExcludeNone,
                               &enabledState);
+  // JIHAD DIAGNOSTIC (R7): note that enabledState is pre-set to STATE_DISABLED and the rv of
+  // GetStateForType is NOT checked upstream, so a failing lookup silently blocks the plugin
+  // with no other trace. Log the rv as well as the value.
+  fprintf(stderr, "[jihad-npapi] ShouldPlay type=%s enabledState=%u rv=0x%x\n",
+          mContentType.get(), enabledState, (unsigned)jihadStateRv);
   if (nsIPluginTag::STATE_DISABLED == enabledState) {
+    fprintf(stderr, "[jihad-npapi] ShouldPlay -> FALSE (eFallbackDisabled)\n");
     aReason = eFallbackDisabled;
     return false;
   }

dom/bindings/ToJSValue.h

@@ -97,7 +97,7 @@ ToJSValue(JSContext* aCx,
   return true;
 }
 
-// Accept floating point types
+// accept floating point types
 inline bool
 ToJSValue(JSContext* aCx,
           float aArgument,
@@ -106,7 +106,7 @@ ToJSValue(JSContext* aCx,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.set(JS_NumberValue(double(aArgument)));
+  aValue.setNumber(aArgument);
   return true;
 }
 

dom/html/HTMLImageElement.cpp

@@ -876,12 +876,20 @@ HTMLImageElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
   return HTMLImageElementBinding::Wrap(aCx, this, aGivenProto);
 }
 
+#ifdef DEBUG
+nsIDOMHTMLFormElement*
+HTMLImageElement::GetForm() const
+{
+  return mForm;
+}
+#endif
+
 void
 HTMLImageElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
   NS_PRECONDITION(aForm, "Don't pass null here");
-  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
-             "We don't support switching from one non-null form to another.");
+  NS_ASSERTION(!mForm,
+               "We don't support switching from one non-null form to another.");
 
   mForm = static_cast<HTMLFormElement*>(aForm);
 }

dom/html/HTMLImageElement.h

@@ -216,8 +216,9 @@ public:
     SetHTMLAttr(nsGkAtoms::lowsrc, aLowsrc, aError);
   }
 
-  HTMLFormElement* GetForm() const { return mForm; };
-
+#ifdef DEBUG
+  nsIDOMHTMLFormElement* GetForm() const;
+#endif
   void SetForm(nsIDOMHTMLFormElement* aForm);
   void ClearForm(bool aRemoveFromForm);
 

dom/html/nsGenericHTMLElement.cpp

@@ -1487,15 +1487,8 @@ nsGenericHTMLElement::MapImageSizeAttributesInto(const nsMappedAttributes* aAttr
     }
 
     if (w && h && *w != 0 && *h != 0) {
-      nsCSSValue width;
-      width.SetFloatValue(float(*w), eCSSUnit_Number);
-      nsCSSValue height;
-      height.SetFloatValue(float(*h), eCSSUnit_Number);
-      nsCSSValue ratio;
-      ratio.SetPairValue(width, height);
-      nsCSSValue autoValue;
-      autoValue.SetAutoValue();
-      aData->ValueForAspectRatio()->SetPairValue(autoValue, ratio);
+      nsCSSValue* aspect_ratio = aData->ValueForAspectRatio();
+      aspect_ratio->SetFloatValue((float(*w) / float(*h)), eCSSUnit_Number);
     }
   }
 }
@@ -1831,8 +1824,8 @@ void
 nsGenericHTMLFormElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
   NS_PRECONDITION(aForm, "Don't pass null here");
-  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
-             "We don't support switching from one non-null form to another.");
+  NS_ASSERTION(!mForm,
+               "We don't support switching from one non-null form to another.");
 
   // keep a *weak* ref to the form here
   mForm = static_cast<HTMLFormElement*>(aForm);

dom/ipc/ContentChild.cpp

@@ -2455,7 +2455,7 @@ ContentChild::RecvUpdateWindow(const uintptr_t& aChildId)
   if (parentInstance) {
   // sync! update call to the plugin instance that forces the
   // plugin to paint its child window.
-  Unused << parentInstance->CallUpdateWindow();
+  parentInstance->CallUpdateWindow();
   }
   return true;
 #else

dom/media/MediaInfo.h

@@ -367,13 +367,12 @@ public:
   {
   }
 
-  static const uint32_t MIN_RATE = 8000;
   static const uint32_t MAX_RATE = 640000;
 
   bool IsValid() const override
   {
     return mChannels > 0 && mChannels <= MAX_AUDIO_CHANNELS
-           && mRate >= MIN_RATE && mRate <= MAX_RATE;
+           && mRate > 0 && mRate <= MAX_RATE;
   }
 
   AudioInfo* GetAsAudioInfo() override

dom/media/VideoUtils.cpp

@@ -179,18 +179,12 @@ IsValidVideoRegion(const nsIntSize& aFrame, const nsIntRect& aPicture,
     aFrame.height <= PlanarYCbCrImage::MAX_DIMENSION &&
     aFrame.width * aFrame.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
     aFrame.width * aFrame.height != 0 &&
-    aPicture.width > 0 &&
     aPicture.width <= PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.x >= 0 &&
     aPicture.x < PlanarYCbCrImage::MAX_DIMENSION &&
     aPicture.x + aPicture.width < PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.XMost() <= aFrame.width &&
-    aPicture.height > 0 &&
     aPicture.height <= PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.y >= 0 &&
     aPicture.y < PlanarYCbCrImage::MAX_DIMENSION &&
     aPicture.y + aPicture.height < PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.YMost() <= aFrame.height &&
     aPicture.width * aPicture.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
     aPicture.width * aPicture.height != 0 &&
     aDisplay.width <= PlanarYCbCrImage::MAX_DIMENSION &&

dom/media/mediasource/ContainerParser.cpp

@@ -439,7 +439,7 @@ private:
     Maybe<size_t> mInitOffset;
     Maybe<size_t> mMediaOffset;
     bool mValid = true;
-    char mLastInvalidBox[5]{};
+    char mLastInvalidBox[5];
   };
 
 public:

dom/media/webm/WebMDemuxer.cpp

@@ -20,7 +20,6 @@
 #include "WebMBufferedParser.h"
 #include "gfx2DGlue.h"
 #include "mozilla/Atomics.h"
-#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/SharedThreadPool.h"
@@ -353,27 +352,19 @@ WebMDemuxer::ReadMetadata()
           mInfo.mVideo.mExtraData = new MediaByteBuffer(length);
           mInfo.mVideo.mExtraData->AppendElements(data, length);
           break;
-        }
+	}
         default:
           NS_WARNING("Unknown WebM video codec");
           return NS_ERROR_FAILURE;
       }
       // Picture region, taking into account cropping, before scaling
       // to the display size.
-      CheckedInt<uint32_t> cropH = CheckedInt<uint32_t>(params.crop_left) + params.crop_right;
-      CheckedInt<uint32_t> cropV = CheckedInt<uint32_t>(params.crop_top) + params.crop_bottom;
-      if (!cropH.isValid() || !cropV.isValid() ||
-          cropH.value() >= params.width || cropV.value() >= params.height) {
-        WEBM_DEBUG("Invalid crop values left: {} right: {} top: {} bottom: {}",
-                   params.crop_left, params.crop_right, params.crop_top,
-                   params.crop_bottom);
-        // Ignore invalid crop parameters.
-        continue;
-      }
+      unsigned int cropH = params.crop_right + params.crop_left;
+      unsigned int cropV = params.crop_bottom + params.crop_top;
       nsIntRect pictureRect(params.crop_left,
                             params.crop_top,
-                            params.width - cropH.value(),
-                            params.height - cropV.value());
+                            params.width - cropH,
+                            params.height - cropV);
 
       // If the cropping data appears invalid then use the frame data
       if (pictureRect.width <= 0 ||

dom/plugins/base/npapi.h

@@ -577,6 +577,166 @@ typedef struct _NPEvent
 } NPEvent;
 #elif defined(XP_UNIX) && defined(MOZ_X11)
 typedef XEvent NPEvent;
+#elif defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+/*
+ * JIHAD (webOS, cavekit-addons-extensions.md R7) — THE PALM EVENT PROTOCOL.
+ *
+ * webOS plugins do not speak X11. Palm's own npapi.h defines NPEvent, under XP_WEBOS, as the
+ * union below; the device's Adobe Flash was compiled against exactly that header and its
+ * NPP_HandleEvent reads these fields. Reproduced here from the webOS WebKit fork's
+ * WebCore/plugins/npapi.h (the XP_WEBOS block, NpPalmEventsEnum through the NPEvent union),
+ * so that the shape crossing our NPAPI boundary is the shape the plugin was built to read.
+ *
+ * This replaces `typedef void* NPEvent` for the headless toolkit, and that arm was not merely
+ * a placeholder — it was load-bearing in the wrong direction. NPRemoteEvent is a raw memcpy of
+ * sizeof(NPEvent) (dom/plugins/ipc/NPEventUnix.h), so with a void* NPEvent the parent shipped
+ * four bytes of its own address space to the child and the child handed the plugin a pointer
+ * into a foreign process. No event could ever have carried a payload. Making NPEvent a real
+ * POD is what lets the whole existing NPP_HandleEvent path work unmodified, parent to child.
+ *
+ * Gated on MOZ_WIDGET_HEADLESS because that is precisely the configuration this port builds
+ * (--enable-default-toolkit=cairo-headless, no X anywhere in the bundle) and the only one that
+ * reaches this arm. A non-webOS headless embedding would get these structs too; that is
+ * harmless, since the alternative it loses is an NPEvent that could not carry an event.
+ *
+ * POINTER-BEARING MEMBERS DO NOT SURVIVE IPC. dstBuffer/graphicsContext (draw),
+ * touches (touch) and reserved (system) are process-local. Pen, key and system events use
+ * none of them; the draw event is built inside the child (PluginInstanceChild.cpp) and never
+ * crosses the boundary, which is why it stays valid.
+ *
+ * One deliberate omission from Palm's union: NpPalmAccelerometerEvent. It is 16 bytes against
+ * NpPalmDrawEvent's 44, so leaving it out changes sizeof(NPEvent) by nothing — and the union
+ * is only ever read through the plugin's OWN copy of this declaration, so an unused member
+ * here is unobservable. It is left out rather than copied because it carries a struct-scoped
+ * `enum Orientation` whose tag would leak to file scope, for no gain.
+ */
+typedef enum NpPalmEventsEnum
+{
+  npPalmPenDownEvent        = 1 << 0,
+  npPalmPenUpEvent          = 1 << 1,
+  npPalmPenMoveEvent        = 1 << 2,
+  npPalmKeyDownEvent        = 1 << 3,
+  npPalmKeyUpEvent          = 1 << 4,
+  npPalmKeyRepeatEvent      = 1 << 5,
+  npPalmKeyPressEvent       = 1 << 6,
+  npPalmDrawEvent           = 1 << 7,
+  npPalmSystemEvent         = 1 << 8,
+  npPalmGestureEvent        = 1 << 9,
+  npPalmAccelerometerEvent  = 1 << 10,
+  npPalmTouchStartEvent     = 1 << 11,
+  npPalmTouchMoveEvent      = 1 << 12,
+  npPalmTouchEndEvent       = 1 << 13,
+  npPalmTouchCancelledEvent = 1 << 14,
+  npPalmPenDoubleClickEvent = 1 << 15,
+  npPalmPenClickEvent       = 1 << 16
+} NpPalmEventsEnum;
+
+typedef enum NpPalmSystemEventsEnum
+{
+  npPalmPauseEvent            = 1,
+  npPalmResumeEvent           = 2,
+  npPalmGainFocusEvent        = 3,
+  npPalmLoseFocusEvent        = 4,
+  npPalmDimmedEvent           = 5,
+  npPalmSetFullScreenEvent    = 6,
+  npPalmUnsetFullScreenEvent  = 7,
+  npPalmPageLoadingEvent      = 8,
+  npPalmPageLoadCompleteEvent = 9,
+  npPalmViewPortChangedEvent  = 10,
+  npPalmSpotlightStartEvent   = 11,
+  npPalmSpotlightEndEvent     = 12
+} NpPalmSystemEventsEnum;
+
+typedef enum NpPalmKeyModifiersEnum
+{
+  npPalmCtrlKeyModifier  = 1 << 0,
+  npPalmAltKeyModifier   = 1 << 1,
+  npPalmShiftKeyModifier = 1 << 2,
+  npPalmMetaKeyModifier  = 1 << 3
+} NpPalmKeyModifiersEnum;
+
+typedef struct NpPalmKeyEvent
+{
+  int32_t chr;         /* 32-bit so any Unicode character fits */
+  int32_t modifiers;
+  int32_t rawkeyCode;
+  int32_t rawModifier;
+} NpPalmKeyEvent;
+
+typedef struct NpPalmPenEvent
+{
+  int32_t xCoord, yCoord;   /* plugin-local, in the plugin's own unscaled pixels */
+  int32_t modifiers;
+} NpPalmPenEvent;
+
+typedef struct NpPalmTouchPoint
+{
+  int32_t xCoord, yCoord;
+} NpPalmTouchPoint;
+
+typedef struct NpPalmTouchEvent
+{
+  int32_t           touchCount;
+  NpPalmTouchPoint* touches;   /* process-local — never send over IPC */
+  int32_t           modifiers;
+} NpPalmTouchEvent;
+
+typedef struct NpPalmDrawEvent
+{
+  void*    dstBuffer;        /* process-local; API 1.0 raster destination */
+  uint32_t dstRowBytes;
+  int32_t  srcLeft;
+  int32_t  srcRight;
+  int32_t  srcTop;
+  int32_t  srcBottom;
+  void*    graphicsContext;  /* process-local; the Piranha PGContext, API 2.0 */
+  int32_t  dstLeft;
+  int32_t  dstRight;
+  int32_t  dstTop;
+  int32_t  dstBottom;
+} NpPalmDrawEvent;
+
+typedef struct NpPalmSystemEvent
+{
+  NpPalmSystemEventsEnum type;
+  int32_t  value;
+  int32_t  viewLeft;
+  int32_t  viewRight;
+  int32_t  viewTop;
+  int32_t  viewBottom;
+  void*    reserved;         /* process-local */
+} NpPalmSystemEvent;
+
+typedef enum NpPalmGestureEventEnum
+{
+  npPalmGestureStartEvent     = 1,
+  npPalmGestureChangeEvent    = 2,
+  npPalmGestureEndEvent       = 3,
+  npPalmGestureSingleTapEvent = 4
+} NpPalmGestureEventEnum;
+
+typedef struct NpPalmGestureEvent
+{
+  NpPalmGestureEventEnum type;
+  int32_t x, y;
+  float   scale, rotate;
+  int32_t center_x, center_y;
+  int32_t modifiers;
+} NpPalmGestureEvent;
+
+typedef struct NPEvent
+{
+  NpPalmEventsEnum eventType;
+
+  union {
+    NpPalmKeyEvent     keyEvent;
+    NpPalmPenEvent     penEvent;
+    NpPalmDrawEvent    drawEvent;
+    NpPalmSystemEvent  systemEvent;
+    NpPalmGestureEvent gestureEvent;
+    NpPalmTouchEvent   touchEvent;
+  } data;
+} NPEvent;
 #else
 typedef void*  NPEvent;
 #endif

dom/plugins/base/nsNPAPIPlugin.cpp

@@ -341,6 +341,10 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
   RefPtr<nsNPAPIPlugin> plugin = new nsNPAPIPlugin();
 
   PluginLibrary* pluginLib = GetNewPluginLibrary(aPluginTag);
+  // JIHAD DIAGNOSTIC (R7): GetNewPluginLibrary is where the OOP decision is made —
+  // RunPluginOOP() ? PluginModuleParent::LoadModule (launches plugin-container) : a
+  // PluginPRLibrary loaded in-process. A null here is the plugin-container launch failing.
+  fprintf(stderr, "[jihad-npapi] GetNewPluginLibrary lib=%d\n", (int)!!pluginLib);
   if (!pluginLib) {
     return NS_ERROR_FAILURE;
   }
@@ -386,6 +390,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
 #else
   NPError pluginCallError;
   nsresult rv = pluginLib->NP_Initialize(&sBrowserFuncs, &plugin->mPluginFuncs, &pluginCallError);
+  fprintf(stderr, "[jihad-npapi] NP_Initialize rv=0x%x npErr=%d\n", (unsigned)rv, (int)pluginCallError);
   if (rv != NS_OK || pluginCallError != NPERR_NO_ERROR) {
     return NS_ERROR_FAILURE;
   }
@@ -1939,7 +1944,16 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 
   case NPNVSupportsWindowless: {
-#if defined(XP_WIN) || defined(XP_MACOSX) || \
+    // MOZ_WIDGET_HEADLESS added for Jihad Browser. This list enumerates the toolkits that can
+    // host a windowless plugin, and it was written before a headless toolkit existed — so a
+    // cairo-headless build answered "windowless unsupported" to every plugin, which is the
+    // opposite of the truth. Headless is the toolkit that MOST needs windowless: there is no X
+    // server, no Drawable and no XEmbed, so windowed hosting is impossible and drawing into a
+    // memory bitmap we own is the only thing that can work. gfxPlatformHeadless already returns
+    // true from SupportsPluginDirectBitmapDrawing(), i.e. the drawing model this unlocks
+    // (NPDrawingModelAsyncBitmapSurface) is implemented for this platform; only this
+    // advertisement was missing, and with it false no plugin would ever choose windowless.
+#if defined(XP_WIN) || defined(XP_MACOSX) || defined(MOZ_WIDGET_HEADLESS) || \
     (defined(MOZ_X11) && defined(MOZ_WIDGET_GTK))
     *(NPBool*)result = true;
 #else

dom/plugins/base/nsPluginHost.cpp

@@ -843,6 +843,9 @@ nsPluginHost::InstantiatePluginInstance(const nsACString& aMimeType, nsIURI* aUR
   }
 
   rv = SetUpPluginInstance(aMimeType, aURL, instanceOwner);
+  // JIHAD DIAGNOSTIC (R7): the real rv is flattened to NS_ERROR_FAILURE below, which is what
+  // made this failure opaque from the caller's side.
+  fprintf(stderr, "[jihad-npapi] SetUpPluginInstance rv=0x%x\n", (unsigned)rv);
   if (NS_FAILED(rv)) {
     instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
@@ -961,7 +964,12 @@ nsPluginHost::TrySetUpPluginInstance(const nsACString &aMimeType,
 #endif
 
   RefPtr<nsNPAPIPlugin> plugin;
-  GetPlugin(aMimeType, getter_AddRefs(plugin));
+  nsresult jihadGetRv = GetPlugin(aMimeType, getter_AddRefs(plugin));
+  // JIHAD DIAGNOSTIC (R7): GetPlugin -> CreateNPAPIPlugin -> nsNPAPIPlugin::CreatePlugin, which
+  // for an OOP build is PluginModuleParent::LoadModule (the plugin-container launch). Its rv is
+  // DISCARDED here; only the null check survives, so a launch failure is invisible.
+  fprintf(stderr, "[jihad-npapi] GetPlugin rv=0x%x plugin=%d\n",
+          (unsigned)jihadGetRv, (int)!!plugin);
   if (!plugin) {
     return NS_ERROR_FAILURE;
   }
@@ -987,6 +995,7 @@ nsPluginHost::TrySetUpPluginInstance(const nsACString &aMimeType,
   // except in some cases not Java, see bug 140931
   // our COM pointer will free the peer
   nsresult rv = instance->Initialize(plugin.get(), aOwner, aMimeType);
+  fprintf(stderr, "[jihad-npapi] instance->Initialize rv=0x%x\n", (unsigned)rv);
   if (NS_FAILED(rv)) {
     mInstances.RemoveElement(instance.get());
     aOwner->SetInstance(nullptr);
@@ -4201,3 +4210,62 @@ PluginDestructionGuard::DelayDestroy(nsNPAPIPluginInstance *aInstance)
 
   return false;
 }
+
+// ── JIHAD (webOS, cavekit-addons-extensions.md R7) ────────────────────────────────────────
+//
+// A C entry point for the render daemon, following the jihad_offscreen_* precedent in
+// widget/PuppetWidget.cpp: the daemon links against libxul but cannot see internal classes,
+// and nsNPAPIPluginInstance::HandleEvent is neither exported nor virtual, so there is no
+// other way to reach a plugin from outside.
+//
+// This exists for the frozen YAP command pair asyncCmdPluginSpotlightStart/End. The card
+// scrims and smart-zooms to a plugin, then tells the server the rect it settled on; the
+// server's job is to pass that on to the plugin as Palm's npPalmSpotlightStartEvent(11) /
+// npPalmSpotlightEndEvent(12). It is not cosmetic: Flash routes 11 to the same handler as
+// npPalmSetFullScreenEvent(6) and 12 to the same as npPalmUnsetFullScreenEvent(7)
+// (libflashplayer.so jump table at 0x44e0c — entries 10 and 11 target 0x44fa0/0x44e80,
+// identical to entries 5 and 6), so this is how a plugin is told it went fullscreen.
+//
+// Broadcast to every running instance rather than targeting one: the spotlight is a
+// page-level, one-plugin-at-a-time state, this daemon serves a single card, and the
+// alternative — matching the rect against each instance's frame — would invent a
+// disambiguation rule that the contract does not define. Returns how many instances were
+// told, so a caller can tell "no plugin" from "delivered".
+extern "C" MOZ_EXPORT int
+jihad_plugin_palm_spotlight(int aOn, int aLeft, int aTop, int aRight, int aBottom)
+{
+#ifdef MOZ_ENABLE_NPAPI
+  RefPtr<nsPluginHost> host = nsPluginHost::GetInst();
+  if (!host) {
+    return 0;
+  }
+
+  NPEvent ev;
+  memset(&ev, 0, sizeof(ev));
+  ev.eventType = npPalmSystemEvent;
+  ev.data.systemEvent.type = aOn ? npPalmSpotlightStartEvent : npPalmSpotlightEndEvent;
+  // Palm's host leaves systemEvent.value uninitialised here and fills only the rect
+  // (libWebKitLuna handlePluginSpotlightStart 0x4e6cec-0x4e6d24, which never writes [sp+8]).
+  // The memset above zeroes it, which is strictly tidier and observably the same.
+  ev.data.systemEvent.viewLeft   = aLeft;
+  ev.data.systemEvent.viewTop    = aTop;
+  ev.data.systemEvent.viewRight  = aRight;
+  ev.data.systemEvent.viewBottom = aBottom;
+
+  int delivered = 0;
+  // Copy the instance list first: HandleEvent re-enters the plugin, which may run script and
+  // tear an instance down underneath us.
+  nsTArray<RefPtr<nsNPAPIPluginInstance>> instances(host->JihadRunningInstances());
+  for (uint32_t i = 0; i < instances.Length(); ++i) {
+    int16_t response = kNPEventNotHandled;
+    if (NS_SUCCEEDED(instances[i]->HandleEvent(&ev, &response,
+                                               NS_PLUGIN_CALL_SAFE_TO_REENTER_GECKO))) {
+      delivered++;
+    }
+  }
+  return delivered;
+#else
+  (void)aOn; (void)aLeft; (void)aTop; (void)aRight; (void)aBottom;
+  return 0;
+#endif
+}

dom/plugins/base/nsPluginHost.h

@@ -274,6 +274,13 @@ public:
                              InfallibleTArray<nsCString>& result,
                              bool firstMatchOnly);
 
+  // Jihad R7 (webOS): a snapshot of the live instances, for jihad_plugin_palm_spotlight.
+  // A COPY, not a reference: dispatching an event re-enters the plugin, which can run script
+  // and destroy an instance, and mInstances is mutated by that teardown.
+  const nsTArray<RefPtr<nsNPAPIPluginInstance>>& JihadRunningInstances() const {
+    return mInstances;
+  }
+
 private:
   friend class nsPluginUnloadRunnable;
 

dom/plugins/base/nsPluginInstanceOwner.cpp

@@ -569,6 +569,75 @@ NS_IMETHODIMP nsPluginInstanceOwner::InvalidateRect(NPRect *invalidRect)
   GetContentsScaleFactor(&scaleFactor);
   rect.ScaleRoundOut(scaleFactor);
   mPluginFrame->InvalidateLayer(nsDisplayItem::TYPE_PLUGIN, &rect);
+
+  // JIHAD (2026-08-09): drive the offscreen daemon's re-capture for WINDOWLESS plugins.
+  //
+  // A windowless plugin has no mWidget, so the mWidget->Invalidate() branch above (which is what
+  // ultimately reaches PuppetWidget::Invalidate and sets the daemon's mJihadDirty flag) never
+  // runs. InvalidateLayer() alone only marks the plugin's ImageLayer for recomposition; with the
+  // in-process BasicLayerManager and no separate compositor, that repaints the widget's own layer
+  // backbuffer but never triggers jihad_offscreen_render_region, the path that actually renders a
+  // frame into the adapter's shared buffer for the card. Measured: Flash pushes a fresh magenta
+  // frame into its ImageContainer ~15x/s and BasicImageLayer::Paint runs on each, yet
+  // render_region fired ONCE (at load) so the card froze on the pre-content frame. The control
+  // plugin only appeared to work because its static fill was already present at that single
+  // capture. Invalidate the nearest real widget here so every async plugin frame marks the daemon
+  // dirty and gets composited to the card.
+  //
+  // THE RECT MATTERS, and the first version of this got it wrong. It invalidated
+  // nearest->GetBounds() — the WIDGET's bounds, i.e. the whole viewport — on the reasoning
+  // that the daemon re-renders the whole document per capture anyway. That reasoning stopped
+  // being true when the daemon learned to repaint only the damaged rows: a whole-viewport
+  // software render costs ~40 ms on this hardware against ~4 ms for a 320x240 plugin box, and
+  // a full-viewport damage box silently forced the expensive path on every single frame.
+  // Measured: an animated SWF ran at 19 fps with 1 partial repaint in 39, and the damage box
+  // logged as 768x942 with the plugin's own 320x240 unioned uselessly into it.
+  //
+  // So invalidate the plugin's own area, translated from plugin-local into the widget's
+  // coordinates the same way the rest of this file does it: content-box origin relative to the
+  // frame, offset to the widget, in device px.
+  if (!mWidget) {
+    nsIWidget* nearest = mPluginFrame->GetNearestWidget();
+    if (nearest) {
+      nsIntRect widgetRect = rect;
+      nsPresContext* pc = mPluginFrame->PresContext();
+      // Offset to the ROOT frame, which is what the widget's coordinates are relative to.
+      // GetReferenceFrame() was the first attempt and it is wrong here: for a plugin it
+      // resolves to a frame that makes the offset come out 0, so every invalidation landed at
+      // the viewport's top-left corner instead of on the plugin. That is not a small error —
+      // the damage-only repaint then faithfully refreshed the wrong 320x240 box and the
+      // plugin's own area never updated again, which reads on screen as the animation
+      // freezing after its first frame. This is the same offset nsPluginFrame itself uses to
+      // build NPWindow.x/y.
+      nsIFrame* rootFrame = nullptr;
+      if (nsIPresShell* ps = mPluginFrame->PresContext()->GetPresShell()) {
+        rootFrame = ps->GetRootFrame();
+      }
+      nsPoint origin = mPluginFrame->GetContentRectRelativeToSelf().TopLeft() +
+                       (rootFrame ? mPluginFrame->GetOffsetToCrossDoc(rootFrame) : nsPoint());
+      widgetRect.MoveBy(pc->AppUnitsToDevPixels(origin.x),
+                        pc->AppUnitsToDevPixels(origin.y));
+      // A plugin is entitled to report an invalid rect larger than itself, and an empty one
+      // would invalidate nothing at all; clamp to the plugin's own box, and fall back to the
+      // widget bounds if that leaves nothing (correctness before speed).
+      nsIntRect pluginBox(pc->AppUnitsToDevPixels(origin.x),
+                          pc->AppUnitsToDevPixels(origin.y),
+                          pc->AppUnitsToDevPixels(
+                              mPluginFrame->GetContentRectRelativeToSelf().width),
+                          pc->AppUnitsToDevPixels(
+                              mPluginFrame->GetContentRectRelativeToSelf().height));
+      widgetRect = widgetRect.Intersect(pluginBox);
+      if (widgetRect.IsEmpty()) {
+        widgetRect = pluginBox;
+      }
+      if (widgetRect.IsEmpty()) {
+        nearest->Invalidate(nearest->GetBounds());
+      } else {
+        nearest->Invalidate(LayoutDeviceIntRect(widgetRect.x, widgetRect.y,
+                                                widgetRect.width, widgetRect.height));
+      }
+    }
+  }
   return NS_OK;
 }
 
@@ -2530,6 +2599,122 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
 
+// Guard MUST match the one npapi.h uses to define NPEvent as Palm's union. Any other
+// predicate compiles this against `typedef void* NPEvent` and does not build.
+#if defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+  // JIHAD (webOS, cavekit-addons-extensions.md R7) — DELIVER INPUT IN THE PALM PROTOCOL.
+  //
+  // Everything above this point is a platform arm: XP_MACOSX, XP_WIN, MOZ_X11. A
+  // cairo-headless build matches none of them, so this function used to reduce to
+  // `return nsEventStatus_eIgnore;` and a windowless plugin received no mouse, key, focus or
+  // blur event in its whole lifetime. Measured on the TouchPad before this branch existed: a
+  // tap hit-tested the <EMBED>, the daemon logged `mouseSend <EMBED> ... : down`, and the
+  // plugin's NPP_HandleEvent was called exactly once ever — for the child's own gain-focus
+  // injection. Nothing upstream is at fault; the DOM listeners, the hit test, the windowless
+  // guards and the IPC hop are all live and correct (see the Dispatch*ToPlugin callers).
+  //
+  // The event shape is Palm's, because NPEvent on this platform IS Palm's union (npapi.h) and
+  // the device's Flash was compiled against that declaration.
+  {
+    NPEvent pluginEvent;
+    memset(&pluginEvent, 0, sizeof(pluginEvent));
+
+    if (anEvent.mClass == eMouseEventClass) {
+      const WidgetMouseEvent& mouseEvent = *anEvent.AsMouseEvent();
+
+      switch (anEvent.mMessage) {
+        case eMouseDown:   pluginEvent.eventType = npPalmPenDownEvent; break;
+        case eMouseUp:     pluginEvent.eventType = npPalmPenUpEvent;   break;
+        case eMouseMove:   pluginEvent.eventType = npPalmPenMoveEvent; break;
+        // The synthesized click/dblclick that follows a down/up pair. Palm's host sends these
+        // as their own event types rather than swallowing them (libWebKitLuna
+        // handleMouseEvent 0x4e946c-0x4e94d8 maps click -> 65536 and dblclick -> 32768, in
+        // ADDITION to the down/up pair, not instead of it), so this is what a plugin written
+        // for webOS was built to see. The X11 arm above drops them instead, which is right
+        // for X11 and wrong here.
+        //
+        // Flash itself ignores both: its NPP_HandleEvent jump table (libflashplayer.so
+        // 0x4514c-0x4522c) compares only against 1/2/4/8/16/64/128/256/512, and anything
+        // else falls through to "not handled" — confirmed on device, where a tap logs
+        // `palm event 0x10000 ... handled=0` between two handled pen events. Sending them
+        // anyway is deliberate: the contract is the host's, not this one plugin's, and a
+        // plugin that acts only on the click is otherwise silently unusable.
+        case eMouseClick:       pluginEvent.eventType = npPalmPenClickEvent;       break;
+        case eMouseDoubleClick: pluginEvent.eventType = npPalmPenDoubleClickEvent; break;
+        default: break;   // over/out/wheel/aux: no Palm equivalent, drop
+      }
+
+      if (pluginEvent.eventType) {
+        // The plugin-local point, computed exactly as the MOZ_X11 arm above computes it. This
+        // is also what Palm's own host does — PluginView's webOS block uses the renderer's
+        // absoluteToLocal() on the same absolute location — so the two hosts agree on the
+        // space without either being ported to the other.
+        //
+        // Deliberately NO zoom or scroll arithmetic here. The card's fit-zoom is not an engine
+        // zoom (it is applied when the daemon scales the capture context), layout.css.
+        // devPixelsPerPx is pinned to 1.0, and the daemon has already mapped card px to CSS
+        // viewport px before dispatching. Adding a factor here is how plugin input drifts away
+        // from where page content thinks it was clicked; the criterion is that both go through
+        // the same transform, and they do precisely because this arm adds none.
+        const nsPresContext* presContext = mPluginFrame->PresContext();
+        nsPoint appPoint =
+          nsLayoutUtils::GetEventCoordinatesRelativeTo(&anEvent, mPluginFrame) -
+          mPluginFrame->GetContentRectRelativeToSelf().TopLeft();
+        pluginEvent.data.penEvent.xCoord =
+          presContext->AppUnitsToDevPixels(appPoint.x);
+        pluginEvent.data.penEvent.yCoord =
+          presContext->AppUnitsToDevPixels(appPoint.y);
+        pluginEvent.data.penEvent.modifiers =
+          (mouseEvent.IsControl() ? npPalmCtrlKeyModifier  : 0) |
+          (mouseEvent.IsAlt()     ? npPalmAltKeyModifier   : 0) |
+          (mouseEvent.IsShift()   ? npPalmShiftKeyModifier : 0) |
+          (mouseEvent.IsMeta()    ? npPalmMetaKeyModifier  : 0);
+      }
+    } else if (anEvent.mClass == eKeyboardEventClass) {
+      const WidgetKeyboardEvent& keyEvent = *anEvent.AsKeyboardEvent();
+
+      switch (anEvent.mMessage) {
+        case eKeyDown:  pluginEvent.eventType = npPalmKeyDownEvent;  break;
+        case eKeyUp:    pluginEvent.eventType = npPalmKeyUpEvent;    break;
+        case eKeyPress: pluginEvent.eventType = npPalmKeyPressEvent; break;
+        default: break;
+      }
+
+      if (pluginEvent.eventType) {
+        // There is no native key event to copy from on this platform (mPluginEvent is a
+        // Windows concept), so the Palm fields are synthesized from the widget event.
+        // rawkeyCode/rawModifier are Palm's "pass the unprocessed event through" pair, which
+        // for a synthesized event is the same key code and modifier set.
+        int32_t mods =
+          (keyEvent.IsControl() ? npPalmCtrlKeyModifier  : 0) |
+          (keyEvent.IsAlt()     ? npPalmAltKeyModifier   : 0) |
+          (keyEvent.IsShift()   ? npPalmShiftKeyModifier : 0) |
+          (keyEvent.IsMeta()    ? npPalmMetaKeyModifier  : 0);
+        pluginEvent.data.keyEvent.chr =
+          static_cast<int32_t>(keyEvent.PseudoCharCode());
+        pluginEvent.data.keyEvent.modifiers   = mods;
+        pluginEvent.data.keyEvent.rawkeyCode  = static_cast<int32_t>(keyEvent.mKeyCode);
+        pluginEvent.data.keyEvent.rawModifier = mods;
+      }
+    } else if (anEvent.mMessage == eFocus || anEvent.mMessage == eBlur) {
+      // Focus arrives as a bare WidgetGUIEvent with a null widget (see DispatchFocusToPlugin),
+      // so it must not touch the coordinate path above.
+      pluginEvent.eventType = npPalmSystemEvent;
+      pluginEvent.data.systemEvent.type =
+        (anEvent.mMessage == eFocus) ? npPalmGainFocusEvent : npPalmLoseFocusEvent;
+    }
+
+    if (pluginEvent.eventType) {
+      int16_t response = kNPEventNotHandled;
+      mInstance->HandleEvent(&pluginEvent, &response,
+                             NS_PLUGIN_CALL_SAFE_TO_REENTER_GECKO);
+      if (response == kNPEventHandled) {
+        rv = nsEventStatus_eConsumeNoDefault;
+      }
+    }
+  }
+#endif
+
   return rv;
 }
 
@@ -2977,23 +3162,40 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
     if (!mWidget) {
       // native (single process)
       mWidget = do_CreateInstance(kWidgetCID, &rv);
-      nsWidgetInitData initData;
-      initData.mWindowType = eWindowType_plugin;
-      initData.mUnicode = false;
-      initData.clipChildren = true;
-      initData.clipSiblings = true;
-      rv = mWidget->Create(parentWidget.get(), nullptr,
-                           LayoutDeviceIntRect(0, 0, 0, 0), &initData);
-      if (NS_FAILED(rv)) {
-        mWidget->Destroy();
-        mWidget = nullptr;
-        return rv;
+      if (!mWidget) {
+        // JIHAD (2026-10-05): A BUILD WITH NO CHILD-WINDOW WIDGET HAS NO WINDOWED PLUGINS.
+        // The offscreen embedding registers no widget for kWidgetCID, so this came back
+        // null and the Create() call below dereferenced it: the daemon died with SIGSEGV on
+        // every page whose Flash movie was embedded the ordinary way. A plugin is windowed
+        // unless it asks otherwise, and Flash asks only for wmode=opaque/transparent — the
+        // default, wmode=window, is what most of the web uses (found on two "Flash test"
+        // sites; every test page of ours had wmode=opaque). webOS's own browser never had
+        // plugin windows either and handed every plugin a drawable; its Flash build draws
+        // through the Palm window structure in both modes. So do the same: with no window
+        // to give, the instance is windowless.
+        mInstance->SetWindowless(true);
+        windowless = true;
+      } else {
+        nsWidgetInitData initData;
+        initData.mWindowType = eWindowType_plugin;
+        initData.mUnicode = false;
+        initData.clipChildren = true;
+        initData.clipSiblings = true;
+        rv = mWidget->Create(parentWidget.get(), nullptr,
+                             LayoutDeviceIntRect(0, 0, 0, 0), &initData);
+        if (NS_FAILED(rv)) {
+          mWidget->Destroy();
+          mWidget = nullptr;
+          return rv;
+        }
       }
     }
 
-    mWidget->EnableDragDrop(true);
-    mWidget->Show(false);
-    mWidget->Enable(false);
+    if (mWidget) {
+      mWidget->EnableDragDrop(true);
+      mWidget->Show(false);
+      mWidget->Enable(false);
+    }
   }
 
   if (mPluginFrame) {

dom/plugins/ipc/BrowserStreamChild.cpp

@@ -133,6 +133,12 @@ BrowserStreamChild::RecvNPP_DestroyStream(const NPReason& reason)
 {
   PLUGIN_LOG_DEBUG_METHOD;
 
+  // Jihad R7: end-of-stream is what tells a Flash player the movie is complete. A player that
+  // is never told stops on frame zero, which looks exactly like a player that cannot draw.
+  fprintf(stderr, "[jihad-npapi-child] RecvNPP_DestroyStream reason=%d state=%d\n",
+          (int)reason, (int)mState);
+  fflush(stderr);
+
   if (ALIVE != mState)
     NS_RUNTIMEABORT("Unexpected state: recevied NPP_DestroyStream twice?");
 
@@ -232,8 +238,12 @@ BrowserStreamChild::Deliver()
     if (kStreamOpen == mStreamStatus)
       mStreamStatus = NPRES_DONE;
 
-    (void) mInstance->mPluginIface
+    NPError dsrv = mInstance->mPluginIface
       ->destroystream(&mInstance->mData, &mStream, mStreamStatus);
+    // Jihad R7: the delivery site, as opposed to RecvNPP_DestroyStream which only queues it.
+    fprintf(stderr, "[jihad-npapi-child] NPP_DestroyStream status=%d rv=%d\n",
+            (int)mStreamStatus, (int)dsrv);
+    fflush(stderr);
   }
   if (DESTROYED == mDestroyPending && mNotifyPending) {
     NS_ASSERTION(mStreamNotify, "mDestroyPending but no mStreamNotify?");

dom/plugins/ipc/JihadNPNInterpose.cpp

@@ -0,0 +1,74 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * NPN entry points exported as GLOBAL SYMBOLS, for plugins that expect the old Netscape
+ * convention where the host browser exports them rather than only passing an NPNetscapeFuncs
+ * table to NP_Initialize.
+ *
+ * WHY THIS IS ITS OWN TRANSLATION UNIT. The obvious place for these is PluginModuleChild.cpp,
+ * and it does not work: npapi.h already declares NPN_InvalidateRect, and every header in this
+ * build is compiled under `-include config/gcc_hidden.h`, which pushes hidden visibility. GCC
+ * takes visibility from the FIRST declaration it sees, so a later definition carrying
+ * __attribute__((visibility("default"))) is silently ignored and the symbol lands in the
+ * object as GLOBAL HIDDEN — present to `nm`, absent from the dynamic table, and therefore
+ * impossible to interpose. Verified with readelf. This file deliberately includes no NPAPI
+ * headers at all and describes the functions with void* so there is no prior declaration to
+ * inherit hidden visibility from.
+ *
+ * WHY IT MATTERS. webOS's Flash imports NPN_CreateObject and NPN_InvalidateRect as undefined
+ * dynamic symbols. Left alone they bind into libWebKitLuna.so — another browser engine that
+ * is in this process because Flash (and our Piranha drawing path) pull it in. Two consequences,
+ * both measured:
+ *   1. Flash's repaint requests go to LunaSysMgr's WebKit and never reach our engine, so the
+ *      plugin is only ever painted when something else happens to invalidate it. That alone
+ *      makes an animating plugin look frozen.
+ *   2. It is a latent crash: UXP stores a PluginInstanceChild* in NPP::ndata, while
+ *      libWebKitLuna's NPN_InvalidateRect casts that same field to a WebCore::PluginView* and
+ *      makes a virtual call on it — a wild vtable dispatch on the first repaint.
+ *
+ * The forwarding pointers are installed by PluginModuleChild once the browser function table
+ * exists; until then these are safe no-ops.
+ */
+
+#include <stdio.h>
+
+extern "C" {
+
+void  (*gJihadNPNInvalidateRect)(void* aNPP, void* aRect) = 0;
+void* (*gJihadNPNCreateObject)(void* aNPP, void* aClass)  = 0;
+
+// Read by the host repaint clock in PluginInstanceChild.cpp: while this is zero the plugin has
+// never asked to be repainted, so the host has to drive it.
+unsigned gJihadNPNInvalidateRectCalls = 0;
+
+__attribute__((visibility("default"))) void
+NPN_InvalidateRect(void* aNPP, void* aRect)
+{
+    // The first call is the signal that the plugin's frame clock is finally running; without
+    // it the plugin is only ever painted by an unrelated invalidation, which is
+    // indistinguishable on screen from a plugin that draws nothing. Log it once, and log the
+    // no-forwarder case too — arriving before PluginModuleChild installs the pointers is a
+    // dropped repaint, not a no-op.
+    gJihadNPNInvalidateRectCalls++;
+    static int sLogged = 0;
+    if (sLogged < 8) {
+        sLogged++;
+        fprintf(stderr, "[jihad-npapi-child] NPN_InvalidateRect npp=%p rect=%p fwd=%p\n",
+                aNPP, aRect, (void*)gJihadNPNInvalidateRect);
+        fflush(stderr);
+    }
+    if (gJihadNPNInvalidateRect) {
+        gJihadNPNInvalidateRect(aNPP, aRect);
+    }
+}
+
+__attribute__((visibility("default"))) void*
+NPN_CreateObject(void* aNPP, void* aClass)
+{
+    return gJihadNPNCreateObject ? gJihadNPNCreateObject(aNPP, aClass) : 0;
+}
+
+} // extern "C"

dom/plugins/ipc/PPluginInstance.ipdl

@@ -125,6 +125,29 @@ child:
   // of its parent has changed
   async ContentsScaleFactorChanged(double aContentsScaleFactor);
 
+  // Jihad (webOS, cavekit-addons-extensions.md R7): ask the plugin for ONE frame, now.
+  //
+  // Palm's host issued npPalmDrawEvent every time the PAGE painted, so Flash can sit on its own
+  // frame clock and expect to be asked. Patch 0026 got it drawing by giving the CHILD a timer,
+  // but that timer free-runs against the daemon's tick, so a frame lands at a drifting phase and
+  // waits up to a whole tick to be published. Measured on device with a 30 fps SWF: 1:1 delivery
+  // and a 31-34 ms average, but a gap spread of 9-62 ms, which is what the eye reads as stutter.
+  //
+  // CAUTION, measured 2026-08-10 and it contradicts what 0026 assumed: the plugin DOES invalidate
+  // itself, ~22 times a second, alongside our ~27. The counter 0026 reads to conclude otherwise
+  // (gJihadNPNInvalidateRectCalls) only sees calls that bind the NPN_InvalidateRect SYMBOL, and
+  // an ordinary NPAPI plugin goes through the NPNetscapeFuncs table instead. So this message is
+  // currently a SECOND producer rather than the only one, and whether it should exist at all for
+  // a self-invalidating plugin is open — see the R7 frame-rate criterion.
+  //
+  // This is the pull that removes the second clock. ASYNC on purpose: the stock host pulls the
+  // plugin synchronously inside its page paint (PluginViewPalm), but out-of-process that shape
+  // is intr NPP_HandleEvent, which would block the daemon's main thread — and therefore its
+  // tick and its YAP socket — for a full IPC round trip plus a Flash paint on every frame.
+  // Async keeps the phase lock and costs nothing: the child coalesces duplicate requests via
+  // mCurrentInvalidateTask, so an extra request while one is in flight is a no-op.
+  async JihadRequestFrame();
+
   // ********************** Async plugins rendering
   // see https://wiki.mozilla.org/Gecko:AsyncPluginPainting
   // **********************

dom/plugins/ipc/PluginInstanceChild.cpp

@@ -31,6 +31,7 @@ using mozilla::gfx::SharedDIBSurface;
 #endif
 #endif
 #include "gfxSharedImageSurface.h"
+#include <dlfcn.h>   // Jihad R7: reach the plugin's own glib for npPalmEventLoopValue
 #include "gfxUtils.h"
 #include "gfxAlphaRecovery.h"
 
@@ -50,6 +51,61 @@ using namespace mozilla::gfx;
 using namespace mozilla::widget;
 using namespace std;
 
+// Defined next to JihadPumpGlib, far below; declared here because DoNPP_New starts it.
+static void JihadStartGlibPump(PluginInstanceChild* aInstance);
+
+// The instance the host clock repaints, and the count of repaints the PLUGIN asked for. Both
+// live here rather than on the instance because the pump is a process-wide free function.
+// Cleared in ~PluginInstanceChild so the clock cannot outlive what it points at.
+static PluginInstanceChild* sJihadPalmInstance = nullptr;
+static uint64_t gJihadPalmDrawEvents = 0;
+// Defined in JihadNPNInterpose.cpp, which deliberately includes no NPAPI headers.
+extern "C" unsigned gJihadNPNInvalidateRectCalls;
+
+// ── WHICH CALL SITE ACTUALLY DRIVES PLUGIN DRAWS (Jihad, addons R7) ──────────────────────
+//
+// Three sessions have now attributed the plugin's draw rate to a specific clock by READING the
+// code, and every attribution was wrong. Patch 0029 finally put a counter on the request side
+// and the numbers did not agree with any of them: 3988 draws against 3072 host requests, with
+// the child's own timer provably stood down (one "frame clock -> HOST" transition, no fallback)
+// and Flash provably not self-invalidating (gJihadNPNInvalidateRectCalls stays 0). So roughly a
+// quarter of all draws come from a fourth place, and at an 8 ms tick that share DOMINATES.
+//
+// Every path to a draw funnels through AsyncShowPluginFrame, so tagging its call sites answers
+// the question directly rather than by elimination. Reported next to `palm draw`, which is the
+// count these have to add up to. Declared up here with the other file statics because the first
+// tagged site is in AnswerNPP_SetWindow, well above the frame-clock block further down.
+enum {
+    kJihadShowSetWindow = 0,   // AnswerNPP_SetWindow / AsyncSetWindow, accumulated rect
+    kJihadShowInvalidate,      // InvalidateRect reached from OUR host repaint tick
+    kJihadShowPluginSelf,      // InvalidateRect reached from the PLUGIN's own NPN_InvalidateRect
+    kJihadShowRetry,           // InvalidateRectDelayed's retry when ShowPluginFrame refused
+    kJihadShowBgUpdate,        // RecvUpdateBackground, background changed
+    kJihadShowBgUpdateTail,    // RecvUpdateBackground, unconditional tail
+    kJihadShowBgDestroy,       // background destroyer
+    kJihadShowSites
+};
+static uint32_t gJihadShowFrom[kJihadShowSites];
+static const char* const kJihadShowNames[kJihadShowSites] = {
+    "setwin", "hostinval", "plugininval", "retry", "bgupd", "bgtail", "bgdestroy"
+};
+
+// True only while JihadPalmRepaintTick's own InvalidateRect call is on the stack, so the two
+// producers can be told apart AT the shared funnel.
+//
+// WHY THIS EXISTS, and it invalidates a premise the port has carried since patch 0026:
+// gJihadNPNInvalidateRectCalls — the counter used to decide "the plugin never asks to be
+// repainted, so the host must drive it" — is STRUCTURALLY BLIND. It lives in
+// JihadNPNInterpose.cpp and only counts calls that bind the NPN_InvalidateRect SYMBOL. An
+// ordinary NPAPI plugin calls through the NPNetscapeFuncs table instead, which
+// PluginModuleChild fills with its own _invalidaterect (PluginModuleChild.cpp:986); that
+// forwards straight to InstCast(aNPP)->InvalidateRect (:1302-1310) and never touches the
+// interpose. So the counter can read 0 for the whole run while the plugin invalidates
+// constantly — which is exactly what was measured: 1344 host requests against 2662 invalidates
+// with the child's timer provably off (one "frame clock -> HOST", no fallback).
+static bool sJihadInHostRepaint = false;
+
+
 #ifdef MOZ_WIDGET_GTK
 
 #include <gtk/gtk.h>
@@ -193,6 +249,8 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
 #endif
     , mAccumulatedInvalidRect(0,0,0,0)
     , mIsTransparent(false)
+    , mJihadSentPalmGainFocus(false)
+    , mJihadInputEventsLogged(0)
     , mSurfaceType(gfxSurfaceType::Max)
     , mPendingPluginCall(false)
     , mDoAlphaExtraction(false)
@@ -231,6 +289,11 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
 
 PluginInstanceChild::~PluginInstanceChild()
 {
+    // The host repaint clock outlives any single instance (it is bound to the process-wide
+    // GMainLoop), so it must not be left holding this pointer.
+    if (sJihadPalmInstance == this) {
+        sJihadPalmInstance = nullptr;
+    }
 #if defined(OS_WIN)
     NS_ASSERTION(!mPluginWindowHWND, "Destroying PluginInstanceChild without NPP_Destroy?");
     if (GetQuirks() & QUIRK_UNITY_FIXUP_MOUSE_CAPTURE) {
@@ -260,6 +323,65 @@ PluginInstanceChild::~PluginInstanceChild()
 #endif
 }
 
+// ── THE webOS PLUGIN ABI (Jihad, addons R7) ───────────────────────────────────────────────
+//
+// None of this is in our npapi.h; it is Palm's XP_WEBOS block, and every layout below was
+// checked TWICE — against WebKit/Source/WebCore/plugins/npapi.h, and against the machine code
+// of the host that actually shipped on the device. That host is NOT the Qt one in our WebKit
+// checkout (PluginViewQt.cpp passes a QPainter* and Flash has no Qt dependency at all); it is
+// WebCore::PluginView compiled from PluginViewPalm.cpp into /usr/lib/libWebKitLuna.so, which
+// is unstripped on the device and can simply be read. Offsets cited below are into that
+// library. Get these wrong and the plugin reads garbage, silently.
+//
+// The event union itself now lives in npapi.h as the real `NPEvent` for this platform, so the
+// parent (nsPluginInstanceOwner::ProcessEvent) and the child cannot drift and the type survives
+// the NPRemoteEvent memcpy. What used to be here was a TRUNCATED private mirror —
+// systemEvent held only `type`, which is enough for gain-focus and silently wrong for a
+// spotlight event, whose rect lives in the four fields the mirror did not have.
+//
+// These assertions are the actual contract. Each offset was read out of the shipped host's
+// machine code, and a mismatch here means the plugin reads a different field than the one
+// written — a failure with no symptom other than wrong behaviour.
+#if defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+static_assert(sizeof(NPEvent) == 48, "webOS NPEvent is 48 bytes");
+static_assert(offsetof(NPEvent, data) == 4, "eventType is a 4-byte field at 0");
+// PluginView::handleMouseEvent (libWebKitLuna 0x4e9458/0x4e9460/0x4e9464) stores x, y and
+// modifiers to [sp+4], [sp+8], [sp+12] with eventType at [sp].
+static_assert(offsetof(NPEvent, data.penEvent.xCoord) == 4, "penEvent.xCoord @4");
+static_assert(offsetof(NPEvent, data.penEvent.yCoord) == 8, "penEvent.yCoord @8");
+static_assert(offsetof(NPEvent, data.penEvent.modifiers) == 12, "penEvent.modifiers @12");
+// PluginView::handleKeyboardEvent (0x4e8ebc/0x4e8e80/0x4e8ef4/0x4e8f04).
+static_assert(offsetof(NPEvent, data.keyEvent.chr) == 4, "keyEvent.chr @4");
+static_assert(offsetof(NPEvent, data.keyEvent.modifiers) == 8, "keyEvent.modifiers @8");
+static_assert(offsetof(NPEvent, data.keyEvent.rawkeyCode) == 12, "keyEvent.rawkeyCode @12");
+static_assert(offsetof(NPEvent, data.keyEvent.rawModifier) == 16, "keyEvent.rawModifier @16");
+// PluginView::handlePluginSpotlightStart (0x4e6cec-0x4e6d20) writes 0x100 at [sp], 11 at
+// [sp+4], then left/right/top/bottom at [sp+12]/[sp+16]/[sp+20]/[sp+24] — note it never
+// initialises `value` at [sp+8].
+static_assert(offsetof(NPEvent, data.systemEvent.type) == 4, "systemEvent.type @4");
+static_assert(offsetof(NPEvent, data.systemEvent.viewLeft) == 12, "systemEvent.viewLeft @12");
+static_assert(offsetof(NPEvent, data.systemEvent.viewRight) == 16, "systemEvent.viewRight @16");
+static_assert(offsetof(NPEvent, data.systemEvent.viewTop) == 20, "systemEvent.viewTop @20");
+static_assert(offsetof(NPEvent, data.systemEvent.viewBottom) == 24, "systemEvent.viewBottom @24");
+// PluginView::paint (0x4e7e30-0x4e7e44) stores platformContext() at frame+52 and the four
+// scaled dst coords at +56/+60/+64/+68, i.e. +24/+28/+32/+36 inside the draw member.
+static_assert(offsetof(NPEvent, data.drawEvent.graphicsContext) == 28, "drawEvent.gc @28");
+static_assert(offsetof(NPEvent, data.drawEvent.dstLeft) == 32, "drawEvent.dstLeft @32");
+#endif  // XP_UNIX && MOZ_WIDGET_HEADLESS
+
+// NPWindow.window for a webOS plugin. Palm's host never calls setwindow without one:
+// PluginView::setNPWindowRect (libWebKitLuna 0x4e74e0) builds it as a STACK LOCAL, points
+// m_npWindow.window at it (0x4e7570 `str sp, [r4, #520]`), calls setwindow, and immediately
+// re-nulls the pointer (0x4e7614) so the dangling stack address is never left behind.
+// Field offsets read straight off that function: visible is a byte at +0 (0x4e755c
+// `strbne r3, [sp]`), bpp is 32 at +4 (0x4e75dc `mov ip,#32; str ip,[sp,#4]`), and scaleFactor
+// is the double from ScrollView::getScale() at +8 (0x4e7588 `strd r6, [sp, #8]`).
+struct JihadNpPalmWindow {
+    bool     visible;
+    uint32_t bpp;
+    double   scaleFactor;
+};
+
 NPError
 PluginInstanceChild::DoNPP_New()
 {
@@ -286,6 +408,44 @@ PluginInstanceChild::DoNPP_New()
         return rv;
     }
 
+    // WEBOS EVENT LOOP (Jihad, addons R7).
+    //
+    // Palm's own host does this right after NPP_New and before anything else
+    // (WebKit/Source/WebCore/plugins/qt/PluginViewQt.cpp, PluginView::platformStart):
+    // it hands the plugin a GMainLoop* through npPalmEventLoopValue. A webOS plugin drives
+    // its own frame scheduling off that loop, so a plugin that never receives one is a
+    // plugin that instantiates and then never asks to paint — exactly the symptom this port
+    // had.
+    //
+    // glib is not linked into this process; it arrives as a dependency of the plugin, so it
+    // can only be reached by name once the plugin is loaded — which it is by now. A plugin
+    // that does not know the variable just returns an error, so this is safe for any plugin.
+    if (mPluginIface->setvalue) {
+        static void* sMainLoop = nullptr;
+        if (!sMainLoop) {
+            if (void* glib = dlopen("libglib-2.0.so.0", RTLD_NOW | RTLD_GLOBAL)) {
+                typedef void* (*GMainLoopNewFn)(void*, int);
+                GMainLoopNewFn newLoop = (GMainLoopNewFn)dlsym(glib, "g_main_loop_new");
+                if (newLoop) {
+                    sMainLoop = newLoop(nullptr, 1 /* is_running */);
+                }
+            }
+        }
+        if (sMainLoop) {
+            const uint32_t kNpPalmEventLoopValue = 10000;
+            NPError lerr = mPluginIface->setvalue(npp, (NPNVariable)kNpPalmEventLoopValue,
+                                                  sMainLoop);
+            fprintf(stderr, "[jihad-npapi-child] npPalmEventLoopValue loop=%p err=%d\n",
+                    sMainLoop, (int)lerr);
+            // The plugin now has a loop to hang sources off; start running it. See
+            // JihadStartGlibPump for why this cannot wait for the first paint.
+            JihadStartGlibPump(this);
+        } else {
+            fprintf(stderr, "[jihad-npapi-child] npPalmEventLoopValue: no glib main loop\n");
+        }
+        fflush(stderr);
+    }
+
     Initialize();
 
 #if defined(XP_MACOSX) && defined(__i386__)
@@ -717,8 +877,8 @@ PluginInstanceChild::NPN_SetValue(NPPVariable aVar, void* aValue)
       // on the chrome process.  This is because our audio
       // API calls should run the chrome proc, not content.
       NPError rv = NPERR_GENERIC_ERROR;
-      PluginModuleChild* chromeInstance = PluginModuleChild::GetChrome();
-      if (chromeInstance) {
+      PluginModuleChild* chromeInstance = PluginModuleChild::GetChrome();
+      if (chromeInstance) {
         rv = chromeInstance->PluginRequiresAudioDeviceChanges(this,
                                               (NPBool)(intptr_t)aValue);
       }
@@ -964,6 +1124,35 @@ PluginInstanceChild::AnswerNPP_HandleEvent(const NPRemoteEvent& event,
     else
         *handled = mPluginIface->event(&mData, reinterpret_cast<void*>(&evcopy));
 
+    // Guard MUST match the one npapi.h uses to define NPEvent as Palm's union. Any other
+    // predicate compiles this against `typedef void* NPEvent` and does not build.
+#if defined(XP_UNIX) && defined(MOZ_WIDGET_HEADLESS)
+    // JIHAD (webOS R7): the only field-visible evidence that host input reached the plugin.
+    // A closed-source plugin acknowledges nothing — Flash returns its `handled` flag before it
+    // even looks at the event (its NPP_HandleEvent sets the return, then dispatches), so this
+    // line proves DELIVERY and nothing more. Capped, because a pen-move stream would otherwise
+    // flood the daemon log, which is the only channel this device has.
+    if (mJihadInputEventsLogged < 24) {
+        mJihadInputEventsLogged++;
+        if (evcopy.eventType == npPalmKeyDownEvent ||
+            evcopy.eventType == npPalmKeyUpEvent ||
+            evcopy.eventType == npPalmKeyPressEvent) {
+            fprintf(stderr, "[jihad-npapi-child] palm key 0x%x chr=%d raw=%d mods=0x%x "
+                            "handled=%d\n",
+                    (unsigned)evcopy.eventType, (int)evcopy.data.keyEvent.chr,
+                    (int)evcopy.data.keyEvent.rawkeyCode,
+                    (unsigned)evcopy.data.keyEvent.modifiers, (int)*handled);
+        } else {
+            fprintf(stderr, "[jihad-npapi-child] palm event 0x%x at %d,%d mods=0x%x "
+                            "handled=%d\n",
+                    (unsigned)evcopy.eventType, (int)evcopy.data.penEvent.xCoord,
+                    (int)evcopy.data.penEvent.yCoord,
+                    (unsigned)evcopy.data.penEvent.modifiers, (int)*handled);
+        }
+        fflush(stderr);
+    }
+#endif
+
 #ifdef XP_MACOSX
     // Release any reference counted objects created in the child process.
     if (evcopy.type == NPCocoaEventKeyDown ||
@@ -1449,6 +1638,8 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
 
     if (mPluginIface->setwindow)
         (void) mPluginIface->setwindow(&mData, &mWindow);
+#elif defined(MOZ_WIDGET_HEADLESS)
+    // Jihad headless: no windowed plugins; nothing to do.
 #else
 #  error Implement me for your OS
 #endif
@@ -2827,6 +3018,12 @@ PluginInstanceChild::DoNPP_NewStream(BrowserStreamChild* actor,
     AssertPluginThread();
     AutoStackHelper guard(this);
     NPError rv = actor->StreamConstructed(mimeType, seekable, stype);
+    // JIHAD DIAGNOSTIC (R7): does content actually reach the plugin? A plugin that was
+    // never handed its stream draws nothing for a completely different reason than a
+    // plugin that cannot draw, and on screen the two are identical (an empty box).
+    fprintf(stderr, "[jihad-npapi-child] NPP_NewStream mime=%s seekable=%d rv=%d stype=%d\n",
+            mimeType.get(), (int)seekable, (int)rv, (int)*stype);
+    fflush(stderr);
     return rv;
 }
 
@@ -3417,6 +3614,7 @@ PluginInstanceChild::DoAsyncSetWindow(const gfxSurfaceType& aSurfaceType,
 #endif
 
     if (!mAccumulatedInvalidRect.IsEmpty()) {
+        gJihadShowFrom[kJihadShowSetWindow]++;
         AsyncShowPluginFrame();
     }
 }
@@ -3741,10 +3939,467 @@ PluginInstanceChild::UpdateWindowAttributes(bool aForceSetWindow)
          mWindow.clipRect.left, mWindow.clipRect.top, mWindow.clipRect.right, mWindow.clipRect.bottom));
 
     if (mPluginIface->setwindow) {
+        // WEBOS: hand the plugin an NpPalmWindow, exactly as Palm's host does.
+        //
+        // Out of the box this embedder passes NPWindow.window = nullptr for every windowless
+        // plugin (DoAsyncSetWindow hard-nulls it, and the MOZ_WIDGET_HEADLESS branch of
+        // AnswerNPP_SetWindow is a no-op), which is correct for an X11 windowless plugin — the
+        // slot means "native window handle" there, and there isn't one. On webOS the same slot
+        // means something completely different: it carries the plugin's visibility, the
+        // surface depth and the page scale. A webOS plugin told window=NULL has been told
+        // nothing about the surface it is supposed to draw into.
+        //
+        // Scoped to the call and re-nulled afterwards, because this is a stack address and
+        // Palm's host is careful about exactly that (libWebKitLuna 0x4e7570 / 0x4e7614).
+        //
+        // scaleFactor is 1.0 rather than the card's fit-zoom: Palm passes ScrollView::getScale()
+        // because its plugin drew into the page's own scaled surface, whereas here the plugin
+        // owns an unscaled CSS-sized buffer and the compositor applies the zoom afterwards.
+        JihadNpPalmWindow palmWindow;
+        palmWindow.visible     = true;
+        palmWindow.bpp         = 32;
+        palmWindow.scaleFactor = 1.0;
+        void* savedWindow = mWindow.window;
+        mWindow.window = &palmWindow;
+
         mPluginIface->setwindow(&mData, &mWindow);
+
+        mWindow.window = savedWindow;
+
+        static int sLoggedSetWindow = 0;
+        if (sLoggedSetWindow < 3) {
+            sLoggedSetWindow++;
+            fprintf(stderr, "[jihad-npapi-child] NPP_SetWindow %dx%d at %d,%d type=%d "
+                            "palmWindow{visible=1 bpp=32 scale=1.0}\n",
+                    (int)mWindow.width, (int)mWindow.height, (int)mWindow.x, (int)mWindow.y,
+                    (int)mWindow.type);
+            fflush(stderr);
+        }
+
+        // WEBOS: the last thing Palm's PluginView::platformStart does is tell the plugin it has
+        // focus — handlePageGainFocus (libWebKitLuna 0x4e6df0) builds
+        // {eventType = 0x100 (npPalmSystemEvent), systemEvent.type = 3 (npPalmGainFocusEvent)}
+        // and dispatches it. A plugin that is never told it is focused and visible has no
+        // reason to start animating.
+        //
+        // Only gain-focus: Flash's own system-event dispatcher (libflashplayer.so 0x44da0)
+        // routes npPalmPageLoadingEvent(8), npPalmPageLoadCompleteEvent(9) and
+        // npPalmViewPortChangedEvent(10) to a bare `mov r0,#0; pop {pc}`, so those three are
+        // inert in this build and sending them would prove nothing.
+        //
+        // After setwindow, not before, and once: the plugin needs its geometry first, and
+        // UpdateWindowAttributes runs on every resize and every scroll.
+        if (mPluginIface->event && !mJihadSentPalmGainFocus) {
+            mJihadSentPalmGainFocus = true;
+            NPEvent ev;
+            memset(&ev, 0, sizeof(ev));
+            ev.eventType = npPalmSystemEvent;
+            ev.data.systemEvent.type = npPalmGainFocusEvent;
+            int16_t handled = mPluginIface->event(&mData, reinterpret_cast<void*>(&ev));
+            fprintf(stderr, "[jihad-npapi-child] npPalmSystemEvent gainFocus handled=%d\n",
+                    (int)handled);
+            fflush(stderr);
+        }
     }
 }
 
+// Run any work the plugin scheduled on glib.
+//
+// A webOS plugin is handed a GMainLoop through npPalmEventLoopValue and hangs its timers and
+// idle sources off it — but this process's main loop is chromium's MessageLoop, so unless
+// glib is pumped explicitly those sources NEVER RUN. The visible symptom is a plugin that
+// initialises, clears its stage, and then sits on frame zero forever: it is not stuck, it is
+// simply never being given the chance to advance.
+//
+// Bounded so a busy plugin cannot starve the paint it is being pumped for.
+static int
+JihadPumpGlib(int aMaxIterations)
+{
+    typedef int (*GMainContextIterationFn)(void*, int);
+    typedef int (*GMainContextPendingFn)(void*);
+    static bool sTried = false;
+    static GMainContextIterationFn sIterate = nullptr;
+    static GMainContextPendingFn sPending = nullptr;
+
+    if (!sTried) {
+        sTried = true;
+        if (void* glib = dlopen("libglib-2.0.so.0", RTLD_NOW | RTLD_GLOBAL)) {
+            sIterate = (GMainContextIterationFn)dlsym(glib, "g_main_context_iteration");
+            sPending = (GMainContextPendingFn)dlsym(glib, "g_main_context_pending");
+        }
+        fprintf(stderr, "[jihad-npapi-child] glib pump iterate=%p pending=%p\n",
+                (void*)sIterate, (void*)sPending);
+        fflush(stderr);
+    }
+    if (!sIterate) {
+        return 0;
+    }
+    int n = 0;
+    while (n < aMaxIterations) {
+        if (sPending && !sPending(nullptr)) {
+            break;
+        }
+        sIterate(nullptr, 0 /* may_block = FALSE */);
+        n++;
+    }
+    return n;
+}
+
+// ── RUN THE PLUGIN'S EVENT LOOP CONTINUOUSLY (Jihad, addons R7) ───────────────────────────
+//
+// Pumping glib only just before a paint deadlocks a webOS plugin, because its startup is
+// asynchronous: Flash registers com.palm.flashgraphics on the LS2 bus, attaches that socket to
+// the loop it was handed, and then waits on round-trips to com.palm.systemservice
+// (getPreferences), com.palm.display (status) and com.palm.db (find) before it starts its frame
+// clock. Until the clock runs it never calls NPN_InvalidateRect, so nothing ever asks it to
+// paint — and the only pump was on the paint path. No paint, no pump; no pump, no paint.
+//
+// So the pump has to be independent of painting. This reposts itself on the child's own
+// MessageLoop, which is the SAME thread every other NPAPI call into the plugin runs on — the
+// arrangement Palm's host gave it, since BrowserServer's main loop simply WAS a GMainLoop.
+// g_main_loop_run() on a dedicated thread would be the wrong shape: the plugin's timer
+// callbacks would then fire off the NPAPI thread and reenter us from it.
+//
+// MEASURED: before the LS2 role allowed com.palm.flashgraphics, LSRegisterPalmService failed
+// with -1027, nothing was ever attached to the loop, and g_main_context_pending() returned
+// FALSE forever. That is fixed in packaging/gen-variant-scripts.sh; the pump only has anything
+// to run because of it.
+static const int kJihadGlibPumpIntervalMs = 16;   // ~60Hz, the rate a frame clock wants
+static const int kJihadGlibPumpMaxIters   = 20;   // bounded: never starve the MessageLoop
+
+// Host-driven repaint divisor: one repaint every Nth 16 ms tick. 2 is ~30 Hz, which is what
+// ordinary Flash content is authored at; 4 was ~15 Hz and was the measured ceiling on the
+// WHOLE pipeline — device 2026-08-10, single instance: plugin draw 21.6-24 fps and RecvShow
+// 21.3-24.2 fps while the daemon was already compositing 28.4-29.4 fps, i.e. the host was
+// asking for frames more slowly than it could consume them.
+//
+// Env-tunable because the right value is a property of the device under load, not of the
+// source, and a rebuild per candidate costs a 44 MB push. Clamped: 0 or a negative divisor
+// would be a modulo-by-zero, and anything past 8 is slower than the pump itself.
+// Disable the child's OWN repaint timer entirely. $JIHAD_PLUGIN_SELF_DRIVE=0.
+//
+// This exists to isolate ONE producer. Measured 2026-08-10, there are two: our host pull and the
+// plugin invalidating itself (~26/s and ~23/s). Turning off only the daemon's pull
+// (JIHAD_PLUGIN_PULL=0) does NOT isolate the plugin, because the child's host-drive lease then
+// expires and this timer takes over — that run reproduces patch 0026 rather than answering the
+// question, and it measured WORSE than the pull on both rate (24-29 vs 30-33 fps) and spread.
+// With both switches off the plugin's own NPN_InvalidateRect is the only frame source left, which
+// is the experiment that decides whether a host clock should exist here at all.
+static bool JihadChildSelfDriveEnabled()
+{
+    static int s_on = -1;
+    if (s_on < 0) {
+        const char* e = getenv("JIHAD_PLUGIN_SELF_DRIVE");
+        s_on = (e && *e && atoi(e) == 0) ? 0 : 1;   // default ON; only an explicit 0 disables
+        fprintf(stderr, "[jihad-npapi-child] self-drive timer %s\n", s_on ? "enabled" : "DISABLED");
+        fflush(stderr);
+    }
+    return s_on != 0;
+}
+
+static int JihadRepaintEveryTicks()
+{
+    static int sDiv = 0;
+    if (!sDiv) {
+        sDiv = 2;
+        const char* e = getenv("JIHAD_PLUGIN_REPAINT_DIV");
+        if (e && *e) {
+            int v = atoi(e);
+            if (v >= 1 && v <= 8) sDiv = v;
+        }
+        fprintf(stderr, "[jihad-npapi-child] host repaint divisor=%d (~%d Hz)\n",
+                sDiv, 1000 / (kJihadGlibPumpIntervalMs * sDiv));
+        fflush(stderr);
+    }
+    return sDiv;
+}
+
+// ── REPAINT A webOS PLUGIN FROM THE HOST'S CLOCK (Jihad, addons R7) ──────────────────────
+//
+// Gecko paints a windowless plugin only when something invalidates it, and for an ordinary
+// NPAPI plugin that is the plugin itself calling NPN_InvalidateRect. A webOS plugin is under
+// no such obligation, because the host it was written for never made it one: Palm's
+// PluginView::paint (libWebKitLuna 0x4e7a3c) issues npPalmDrawEvent every time the PAGE
+// paints, and BrowserServer's compositor painted continuously. Flash on that host could sit
+// on its frame clock and simply expect to be asked.
+//
+// So this drives the repaint until the plugin proves it drives itself, then gets out of the
+// way — a plugin that calls NPN_InvalidateRect gets Gecko's normal damage-driven painting and
+// none of this cost. Measured: with no host clock, Flash produced exactly 3 draw events in
+// 30 s and 0 invalidates.
+void
+PluginInstanceChild::JihadPalmRepaintTick()
+{
+    if (!mLayersRendering || mWindow.width <= 0 || mWindow.height <= 0) {
+        return;
+    }
+    NPRect windowRect = { 0, 0,
+                          uint16_t(mWindow.height), uint16_t(mWindow.width) };
+    sJihadInHostRepaint = true;
+    InvalidateRect(&windowRect);
+    sJihadInHostRepaint = false;
+}
+
+// ── HOST-DRIVEN FRAME CLOCK (Jihad, addons R7) ───────────────────────────────────────────
+//
+// When the daemon is pulling (it calls jihad_plugin_request_frame after each card frame it
+// publishes), the timer above must get out of the way, or the plugin has TWO drivers and the
+// extra draws are exactly the drift the pull exists to remove.
+//
+// The handoff is timestamp-based rather than a latch because there is no unregister: the daemon
+// can stop asking at any moment — the card is backgrounded (BrowserPageGoanna::freeze returns
+// early from maybePaint), the page navigates, the daemon is stopped or crashes — and a latched
+// plugin would then never paint again. So host-driven is a LEASE that must be renewed. If no
+// request arrives for kJihadHostDriveLeaseMs the timer resumes on its own.
+//
+// THE LEASE MUST EXCEED THE DAEMON'S WORST-CASE GAP BETWEEN REQUESTS, and the first version of
+// this got that wrong in a way that is worth keeping written down, because the symptom looked
+// like a mysterious third party rather than like a bug.
+//
+// The daemon does not ask again while a request is outstanding; it waits out
+// kJihadPluginReqTimeoutMs (250 ms) before re-asking. The lease here was 150 ms — SHORTER — so a
+// single late frame guaranteed the lease expired, the child resumed self-driving, and the two
+// clocks this patch exists to collapse were both running again. Measured on device before the
+// fix: the child logged HOST -> SELF -> HOST, and the invalidate counter split almost exactly in
+// half, 1856 requests from the host against 1846 from the child's own timer, summing to the 3702
+// total. The 23% of "unexplained" draws that sent an earlier session hunting through
+// RecvUpdateBackground were this, and the background paths were measured at exactly ZERO.
+//
+// So the invariant, not a tuned number: lease > request timeout + one grid period + margin.
+// 500 ms is 250 + 33 + slack. A card that really stopped publishing still resumes self-drawing
+// in half a second, which is well inside what a resume can absorb.
+static const uint32_t kJihadHostDriveLeaseMs = 500;
+static uint32_t sJihadLastHostRequestMs = 0;
+static bool sJihadEverHostDriven = false;
+
+static bool JihadHostIsDrivingFrames()
+{
+    bool driving = false;
+    if (sJihadEverHostDriven) {
+        uint32_t nowMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+        // Unsigned subtraction, so the 32-bit PR_IntervalNow wrap is handled without a signed
+        // compare that would read as "lease expired" for one interval every wrap.
+        driving = (nowMs - sJihadLastHostRequestMs) < kJihadHostDriveLeaseMs;
+    }
+
+    // LOG EVERY TRANSITION. A watchdog that silently resumes self-driving would make a BROKEN
+    // pull look like "no change" in the frame numbers instead of "the feature is off" — the same
+    // trap family as an empty log passing every grep, and a wedged plugin reading as a pacing
+    // regression. Both of those cost real time in this tree already; this one is cheap to close.
+    static bool sWas = false;
+    if (driving != sWas) {
+        sWas = driving;
+        fprintf(stderr, "[jihad-npapi-child] frame clock -> %s\n",
+                driving ? "HOST (daemon pull)" : "SELF (timer; host lease expired)");
+        fflush(stderr);
+    }
+    return driving;
+}
+
+bool
+PluginInstanceChild::RecvJihadRequestFrame()
+{
+    sJihadEverHostDriven = true;
+    sJihadLastHostRequestMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+
+    // A plugin that drives itself gets Gecko's normal damage-driven painting, exactly as the
+    // timer path decides below; asking such a plugin for frames would double its draw rate.
+    if (gJihadNPNInvalidateRectCalls != 0) {
+        return true;
+    }
+
+    static uint64_t sHostFrames = 0;
+    static uint32_t sReportMs = 0;
+    if (!(++sHostFrames % 64)) {
+        uint32_t nowMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+        if (sReportMs) {
+            fprintf(stderr, "[jihad-npapi-child] host-driven: 64 requests in %ums\n",
+                    nowMs - sReportMs);
+            fflush(stderr);
+        }
+        sReportMs = nowMs;
+    }
+
+    JihadPalmRepaintTick();
+    return true;
+}
+
+namespace {
+class JihadGlibPumpTask final : public Runnable
+{
+public:
+    NS_IMETHOD Run() override
+    {
+        int n = JihadPumpGlib(kJihadGlibPumpMaxIters);
+
+        // The pump itself keeps running at 16 ms whatever drives the frames — Flash's LS2
+        // socket, its timers and its audio sources all live on this GMainLoop, and starving
+        // them is what deadlocked startup before patch 0026. Only the REPAINT defers.
+        static uint64_t sRepaintTicks = 0;
+        if (sJihadPalmInstance && gJihadNPNInvalidateRectCalls == 0 &&
+            JihadChildSelfDriveEnabled() && !JihadHostIsDrivingFrames() &&
+            (++sRepaintTicks % JihadRepaintEveryTicks()) == 0) {
+            sJihadPalmInstance->JihadPalmRepaintTick();
+        }
+
+        // One-shot liveness, because "the plugin is idle" and "the pump died" look
+        // identical on screen. Report the first tick that actually ran a source.
+        static bool sSawFirstSource = false;
+        static uint64_t sTicks = 0;
+        sTicks++;
+        if (n && !sSawFirstSource) {
+            sSawFirstSource = true;
+            fprintf(stderr, "[jihad-npapi-child] glib pump: first source ran on tick %llu\n",
+                    (unsigned long long)sTicks);
+            fflush(stderr);
+        }
+
+        MessageLoop::current()->PostDelayedTask(
+            RefPtr<Runnable>(new JihadGlibPumpTask()).forget(),
+            kJihadGlibPumpIntervalMs);
+        return NS_OK;
+    }
+};
+} // namespace
+
+// Idempotent: several plugin instances share one GMainLoop, so they share one pump.
+static void
+JihadStartGlibPump(PluginInstanceChild* aInstance)
+{
+    sJihadPalmInstance = aInstance;
+    static bool sStarted = false;
+    if (sStarted) {
+        return;
+    }
+    MessageLoop* loop = MessageLoop::current();
+    if (!loop) {
+        fprintf(stderr, "[jihad-npapi-child] glib pump: no MessageLoop, not starting\n");
+        fflush(stderr);
+        return;
+    }
+    sStarted = true;
+    fprintf(stderr, "[jihad-npapi-child] glib pump: starting, every %dms\n",
+            kJihadGlibPumpIntervalMs);
+    fflush(stderr);
+    loop->PostDelayedTask(RefPtr<Runnable>(new JihadGlibPumpTask()).forget(),
+                          kJihadGlibPumpIntervalMs);
+}
+
+// ── PIRANHA CONTEXT FOR A WEBOS PLUGIN (Jihad, addons R7) ────────────────────────────────
+//
+// webOS plugins that answer npPalmUseGraphicsContext=true expect NpPalmDrawEvent to carry a
+// Piranha PGContext* rather than a raster pointer. Piranha ships on the device inside
+// libWebKitLuna.so (PGContext/PGSurface) and libPiranha.so; neither is linked into this
+// process, so everything is resolved by dlsym on the mangled names — no webOS headers, and
+// nothing breaks on a desktop build where the libraries simply are not there.
+//
+// Feasibility was established separately before any of this was written; see
+// render/goanna/test/piranha_offscreen_probe.c, which does exactly this sequence in a bare
+// process and confirms the pixels land in caller-owned memory.
+//
+// The context is cached per (buffer,size) because a plugin repaints constantly and both
+// objects would otherwise leak once per frame.
+static void*
+JihadPiranhaContextFor(unsigned char* aData, int aWidth, int aHeight, int aStride)
+{
+    // PGSurface::wrap() has no stride parameter, so it can only describe tightly packed
+    // rows. Refuse rather than hand Piranha a buffer it would misread into a sheared image.
+    if (!aData || aWidth <= 0 || aHeight <= 0 || aStride != aWidth * 4) {
+        static bool sWarnedStride = false;
+        if (!sWarnedStride) {
+            sWarnedStride = true;
+            fprintf(stderr, "[jihad-npapi-child] piranha: stride %d != %d*4, not wrapping\n",
+                    aStride, aWidth);
+            fflush(stderr);
+        }
+        return nullptr;
+    }
+
+    typedef void* (*PGSurfaceWrapFn)(unsigned, unsigned, const unsigned char*, bool);
+    typedef void* (*PGContextCreateFn)(void);
+    typedef void  (*PGContextSetSurfaceFn)(void*, void*);
+
+    static bool sTried = false;
+    static PGSurfaceWrapFn sWrap = nullptr;
+    static PGContextCreateFn sCreate = nullptr;
+    static PGContextSetSurfaceFn sSetSurface = nullptr;
+
+    if (!sTried) {
+        sTried = true;
+        // g_thread_init() MUST run before libWebKitLuna loads or its constructors abort with
+        // "GLib-ERROR **: The thread system is not yet initialized". It lives in
+        // libgthread-2.0.so.0, NOT libglib-2.0.so.0. Measured, not guessed.
+        if (void* gthread = dlopen("libgthread-2.0.so.0", RTLD_NOW | RTLD_GLOBAL)) {
+            typedef void (*GThreadInitFn)(void*);
+            if (GThreadInitFn init = (GThreadInitFn)dlsym(gthread, "g_thread_init")) {
+                typedef int (*GThreadGetInitFn)(void);
+                GThreadGetInitFn got =
+                    (GThreadGetInitFn)dlsym(gthread, "g_thread_get_initialized");
+                if (!got || !got()) {
+                    init(nullptr);
+                }
+            }
+        }
+        void* wk = dlopen("libWebKitLuna.so", RTLD_NOW | RTLD_GLOBAL);
+        if (!wk) {
+            fprintf(stderr, "[jihad-npapi-child] piranha: no libWebKitLuna (%s)\n", dlerror());
+            fflush(stderr);
+        } else {
+            sWrap       = (PGSurfaceWrapFn)dlsym(wk, "_ZN9PGSurface4wrapEjjPKhb");
+            sCreate     = (PGContextCreateFn)dlsym(wk, "_ZN9PGContext6createEv");
+            sSetSurface = (PGContextSetSurfaceFn)dlsym(wk, "_ZN9PGContext10setSurfaceEP9PGSurface");
+            fprintf(stderr, "[jihad-npapi-child] piranha syms wrap=%p create=%p setSurface=%p\n",
+                    (void*)sWrap, (void*)sCreate, (void*)sSetSurface);
+            fflush(stderr);
+        }
+    }
+    if (!sWrap || !sCreate || !sSetSurface) {
+        return nullptr;
+    }
+
+    // A SET of cached contexts, not one. Palm got away with a single context because its
+    // buffer was one process-global screen-sized allocation that never moved; here the child
+    // rotates between a front and a back gfxSharedImageSurface, so a one-entry cache keyed on
+    // the buffer address misses on EVERY frame. That was invisible while the plugin was only
+    // painted twice, and turned into a PGSurface + PGContext leaked per frame the moment the
+    // host started driving repaints at 15Hz.
+    //
+    // Four entries: two buffers is the observed case, and a small fixed array keeps this
+    // allocation-free and bounded even if the surface pool grows. On overflow the oldest entry
+    // is dropped — leaking that one context rather than freeing an object the plugin may still
+    // be holding, which is the safer of the two mistakes and is bounded by the buffer count.
+    struct CacheEntry { unsigned char* data; int w, h; void* ctx; };
+    static CacheEntry sCache[4] = {};
+    static unsigned sCacheNext = 0;
+
+    for (size_t i = 0; i < MOZ_ARRAY_LENGTH(sCache); ++i) {
+        if (sCache[i].ctx && sCache[i].data == aData &&
+            sCache[i].w == aWidth && sCache[i].h == aHeight) {
+            return sCache[i].ctx;
+        }
+    }
+
+    void* surf = sWrap((unsigned)aWidth, (unsigned)aHeight, aData, true);
+    void* ctx  = surf ? sCreate() : nullptr;
+    if (ctx) {
+        sSetSurface(ctx, surf);
+    }
+    // Rate-limited: this is now a cache MISS log, and a miss storm is exactly the symptom
+    // worth seeing — but only the first few, or it floods the daemon log at frame rate.
+    static int sLoggedCtx = 0;
+    if (sLoggedCtx < 8) {
+        sLoggedCtx++;
+        fprintf(stderr, "[jihad-npapi-child] piranha ctx %dx%d buf=%p surface=%p context=%p\n",
+                aWidth, aHeight, aData, surf, ctx);
+        fflush(stderr);
+    }
+
+    CacheEntry& slot = sCache[sCacheNext % MOZ_ARRAY_LENGTH(sCache)];
+    sCacheNext++;
+    slot.data = aData; slot.w = aWidth; slot.h = aHeight; slot.ctx = ctx;
+    return ctx;
+}
+
 void
 PluginInstanceChild::PaintRectToPlatformSurface(const nsIntRect& aRect,
                                                 gfxASurface* aSurface)
@@ -3799,7 +4454,187 @@ PluginInstanceChild::PaintRectToPlatformSurface(const nsIntRect& aRect,
     ::IntersectClipRect((HDC) mWindow.window, rect.left, rect.top, rect.right, rect.bottom);
     mPluginIface->event(&mData, reinterpret_cast<void*>(&paintEvent));
 #else
-    NS_RUNTIMEABORT("Surface type not implemented.");
+    // No platform surface to paint onto.
+    //
+    // This is the CLASSIC windowless paint path, and on Unix it is X11 and nothing else: the
+    // browser hands the plugin a Drawable and sends it an XGraphicsExposeEvent. A build with
+    // no X (a headless toolkit) has nothing it can hand over, and NPAPI defines no
+    // alternative for Unix — a plugin that wants to draw without X has to opt into a bitmap
+    // drawing model (NPDrawingModelAsyncBitmapSurface), which is a different path entirely
+    // and is fully supported here.
+    //
+    // Aborting is wrong for an embedder: the plugin process dies, the parent respawns it,
+    // and the whole cycle repeats for every paint, so one plugin that cannot draw becomes an
+    // endless crash loop. Warn once and leave the surface untouched instead — the plugin
+    // stays loaded and scriptable and simply shows nothing, which is a bounded failure the
+    // embedder can report.
+    // fprintf, not NS_WARNING: NS_WARNING compiles to nothing in a release build, and this is
+    // the ONLY signal distinguishing "the plugin drew nothing" from "the plugin was never
+    // asked to draw" — a distinction that is invisible on screen (both are a blank box).
+    // WEBOS RASTER DRAW EVENT (Jihad, addons R7).
+    //
+    // webOS plugins do not use the X11 protocol at all — they are painted by an
+    // npPalmDrawEvent, and NpPalmDrawEvent carries BOTH a raster destination (dstBuffer +
+    // dstRowBytes, "only valid in API version 1.0") and a Piranha PGContext
+    // ("must be used to draw in API version 2.0"). See Palm's own npapi.h, XP_WEBOS block.
+    //
+    // The device's Flash answers npPalmUseGraphicsContext = true, which per that header means
+    // the HOST may then pass a null raster — it is a statement about host behaviour, NOT a
+    // promise that the plugin refuses a non-null dstBuffer. There is no API-version
+    // negotiation anywhere in the contract, so the only way to find out whether a plugin
+    // honours the raster path is to hand it one and look. That is what this does.
+    //
+    // The surface here is already an ordinary shared-memory image (gfxSharedImageSurface,
+    // created a few hundred lines up), living in this process, whose pixels the parent
+    // already composites — so the raster the plugin needs costs nothing to produce.
+    if (aSurface->GetType() == gfxSurfaceType::Image) {
+        gfxImageSurface* img = static_cast<gfxImageSurface*>(aSurface);
+        uint8_t* data = img->Data();
+        int32_t stride = img->Stride();
+
+        if (data && stride > 0) {
+            // NPEvent is Palm's own event union on this platform (npapi.h); the offsets it
+            // depends on are asserted at the top of this file against libWebKitLuna.
+            // THE DRAW ALWAYS COVERS THE WHOLE SURFACE, whatever sub-rect was requested.
+            //
+            // Two things forced this. The PGContext below is built for the FULL surface
+            // (PGSurface::wrap takes width/height and assumes tightly packed rows), so pairing
+            // it with a dstBuffer offset into the middle of that surface makes the plugin's
+            // blit start partway in and run off the end — measured as `FAULT sig=7` (SIGBUS)
+            // in the plugin child the moment the host began sending partial invalidations.
+            // And Palm's own host never sent a partial rect either: PluginView::paint passes
+            // the plugin's whole frame rect, which is why a 2.0 plugin is entitled to assume
+            // the two agree. Redrawing the whole plugin box costs the plugin nothing it was
+            // not already doing every frame.
+            nsIntRect drawRect(0, 0, img->Width(), img->Height());
+            NPEvent ev;
+            memset(&ev, 0, sizeof(ev));
+            ev.eventType = npPalmDrawEvent;
+            // "points to top-left of area to paint"
+            ev.data.drawEvent.dstBuffer = data;
+            ev.data.drawEvent.dstRowBytes = (uint32_t)stride;
+            ev.data.drawEvent.srcLeft   = drawRect.x;
+            ev.data.drawEvent.srcTop    = drawRect.y;
+            ev.data.drawEvent.srcRight  = drawRect.XMost();
+            ev.data.drawEvent.srcBottom = drawRect.YMost();
+            ev.data.drawEvent.dstLeft   = ev.data.drawEvent.srcLeft;
+            ev.data.drawEvent.dstTop    = ev.data.drawEvent.srcTop;
+            ev.data.drawEvent.dstRight  = ev.data.drawEvent.srcRight;
+            ev.data.drawEvent.dstBottom = ev.data.drawEvent.srcBottom;
+            // API 2.0: a real Piranha PGContext bound to the very same pixels.
+            //
+            // The device's Flash answers npPalmUseGraphicsContext = true, and although it
+            // accepts a raster draw event (returns handled=1) it writes nothing into the
+            // buffer — so "handled" evidently means "consumed", not "drew". This gives it
+            // what it actually asked for. Proven possible by
+            // render/goanna/test/piranha_offscreen_probe.c: a PGContext can be created over
+            // wrapped memory in an ordinary process with no display and no compositor.
+            //
+            // PGSurface::wrap() takes no stride, so it assumes tightly-packed w*4 rows. That
+            // holds here (a 320-wide surface has stride 1280) but is asserted rather than
+            // assumed, because a padded stride would silently shear the image.
+            ev.data.drawEvent.graphicsContext = JihadPiranhaContextFor(data, img->Width(),
+                                                                       img->Height(), stride);
+            // BOTH fields stay populated, including for a plugin that answered
+            // npPalmUseGraphicsContext = true.
+            //
+            // npapi.h says the raster pointer "is then passed in as null" for such plugins, and
+            // this code used to believe it. The host that actually shipped does not: PluginView
+            // ::paint (libWebKitLuna 0x4e7c70 / 0x4e7c5c) stores a live dstBuffer and a live
+            // dstRowBytes into the event on the SAME branch that stores the PGContext — the
+            // graphics-context case is precisely the one where it computes
+            // dstBuffer = <shared buffer> + (y*screenWidth + x)*4 and
+            // dstRowBytes = screenWidth*4 (0x4e7e04-0x4e7e18). The header comment describes
+            // what a 2.0 plugin is expected to USE, not what the host is allowed to omit, and
+            // handing Flash a null raster is a difference from the reference host that costs
+            // nothing to remove.
+
+            // Let the plugin's own scheduled work run before we ask it to draw, so the
+            // frame it paints is current rather than whatever it had at instantiation.
+            JihadPumpGlib(50);
+
+            int16_t handled = mPluginIface->event
+                ? mPluginIface->event(&mData, reinterpret_cast<void*>(&ev)) : -1;
+            gJihadPalmDrawEvents++;
+
+            static int sLogged = 0;
+            // FRAME-RATE READOUT. A static SWF and a 30fps game are indistinguishable from
+            // a per-event log (capped) or a screenshot (one instant), and the difference is
+            // the whole question for animated content. One line every 2s costs nothing and
+            // is the only way to see the plugin's real cadence in the field.
+            {
+                static uint32_t sDraws = 0;
+                static uint32_t sLastReport = 0;
+                sDraws++;
+                uint32_t nowMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+                if (!sLastReport) {
+                    sLastReport = nowMs;
+                } else if (nowMs - sLastReport >= 2000) {
+                    fprintf(stderr, "[jihad-npapi-child] palm draw: %u in %ums (%.1f fps)\n",
+                            sDraws, nowMs - sLastReport,
+                            sDraws * 1000.0 / double(nowMs - sLastReport));
+                    // WHICH SITE ASKED FOR THOSE DRAWS. These are requests to draw, not draws:
+                    // AsyncShowPluginFrame coalesces while an invalidate task is already pending,
+                    // so the sum is an UPPER bound on sDraws and the interesting number is the
+                    // SHARE each site holds, not the total. Printed on the same 2 s boundary so a
+                    // reader can line them up without correlating timestamps.
+                    {
+                        char buf[192];
+                        size_t n = 0;
+                        buf[0] = '\0';
+                        for (int i = 0; i < kJihadShowSites; ++i) {
+                            // Clamp rather than trust the running total: snprintf returns the
+                            // length it WANTED, so an overflow would make the next call pass a
+                            // negative size as size_t and write off the end.
+                            if (n < sizeof(buf) - 1) {
+                                int w = snprintf(buf + n, sizeof(buf) - n, " %s=%u",
+                                                 kJihadShowNames[i], gJihadShowFrom[i]);
+                                if (w > 0) {
+                                    n += size_t(w);
+                                    if (n >= sizeof(buf)) n = sizeof(buf) - 1;
+                                }
+                            }
+                            gJihadShowFrom[i] = 0;
+                        }
+                        fprintf(stderr, "[jihad-npapi-child]   show req:%s\n", buf);
+                    }
+                    fflush(stderr);
+                    sDraws = 0;
+                    sLastReport = nowMs;
+                }
+            }
+            if (sLogged < 3) {
+                sLogged++;
+                // handled= is reported but means nothing on its own: Flash's NPP_HandleEvent
+                // sets its return to 1 (libflashplayer.so 0x45274) BEFORE calling the draw
+                // handler and returns it unconditionally, so handled=1 is emitted even when
+                // the handler bails without touching the surface. Only pixels are evidence.
+                fprintf(stderr, "[jihad-npapi-child] npPalmDrawEvent %s %d,%d %dx%d "
+                                "stride=%d ctx=%p handled=%d\n",
+                        ev.data.drawEvent.graphicsContext ? "pgcontext" : "raster",
+                        drawRect.x, drawRect.y, drawRect.width, drawRect.height,
+                        (int)stride, ev.data.drawEvent.graphicsContext, (int)handled);
+                fflush(stderr);
+            }
+            return;
+        }
+    }
+
+    // Nothing we can paint onto at all.
+    //
+    // Aborting is wrong for an embedder: the plugin process dies, the parent respawns it,
+    // and the whole cycle repeats for every paint, so one plugin that cannot draw becomes an
+    // endless crash loop. Warn once and leave the surface untouched instead.
+    // fprintf, not NS_WARNING: NS_WARNING compiles to nothing in a release build, and this is
+    // the ONLY signal distinguishing "the plugin drew nothing" from "the plugin was never
+    // asked to draw" — a distinction that is invisible on screen (both are a blank box).
+    static bool sWarned = false;
+    if (!sWarned) {
+        sWarned = true;
+        fprintf(stderr, "[jihad-npapi-child] no paintable surface for this windowless "
+                        "plugin (type=%d); it will NOT paint.\n", (int)aSurface->GetType());
+        fflush(stderr);
+    }
 #endif
 }
 
@@ -4264,6 +5099,7 @@ PluginInstanceChild::InvalidateRectDelayed(void)
     }
 
     if (!ShowPluginFrame()) {
+        gJihadShowFrom[kJihadShowRetry]++;
         AsyncShowPluginFrame();
     }
 }
@@ -4317,6 +5153,8 @@ PluginInstanceChild::InvalidateRect(NPRect* aInvalidRect)
         mAccumulatedInvalidRect.UnionRect(r, mAccumulatedInvalidRect);
         // If we are able to paint and invalidate sent, then reset
         // accumulated rectangle
+        gJihadShowFrom[sJihadInHostRepaint ? kJihadShowInvalidate
+                                          : kJihadShowPluginSelf]++;
         AsyncShowPluginFrame();
         return;
     }
@@ -4360,6 +5198,7 @@ PluginInstanceChild::RecvUpdateBackground(const SurfaceDescriptor& aBackground,
         IntSize bgSize = mBackground->GetSize();
         mAccumulatedInvalidRect.UnionRect(mAccumulatedInvalidRect,
                                           nsIntRect(0, 0, bgSize.width, bgSize.height));
+        gJihadShowFrom[kJihadShowBgUpdate]++;
         AsyncShowPluginFrame();
         return true;
     }
@@ -4369,6 +5208,7 @@ PluginInstanceChild::RecvUpdateBackground(const SurfaceDescriptor& aBackground,
 
     // This must be asynchronous, because we may be nested within RPC messages
     // which do not expect to receiving paint events.
+    gJihadShowFrom[kJihadShowBgUpdateTail]++;
     AsyncShowPluginFrame();
 
     return true;
@@ -4401,6 +5241,7 @@ PluginInstanceChild::RecvPPluginBackgroundDestroyerConstructor(
         // NB: we don't have to XSync here because only ShowPluginFrame()
         // uses mBackground, and it always XSyncs after finishing.
         mBackground = nullptr;
+        gJihadShowFrom[kJihadShowBgDestroy]++;
         AsyncShowPluginFrame();
     }
 
@@ -4679,7 +5520,7 @@ PluginInstanceChild::Destroy()
 
     mPendingAsyncCalls.Clear();
     
-#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     if (mWindow.type == NPWindowTypeWindow && !mXEmbed) {
       xt_client_xloop_destroy();
     }

dom/plugins/ipc/PluginInstanceChild.h

@@ -36,7 +36,7 @@
 
 #include <map>
 
-#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
+#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
 #endif
 
@@ -141,6 +141,10 @@ protected:
     virtual bool
     RecvContentsScaleFactorChanged(const double& aContentsScaleFactor) override;
 
+    // Jihad: the host is driving the frame clock — draw one now. See PPluginInstance.ipdl.
+    virtual bool
+    RecvJihadRequestFrame() override;
+
     virtual bool
     AnswerNPP_Destroy(NPError* result) override;
 
@@ -641,6 +645,22 @@ private:
     // and p->getvalue return always false
     bool mIsTransparent;
 
+    // Jihad R7 (webOS): npPalmGainFocusEvent is a once-per-instance startup signal, but the
+    // setwindow that carries it runs again on every resize and scroll.
+    bool mJihadSentPalmGainFocus;
+
+    // Jihad R7 (webOS): cap on the input-delivery breadcrumb in AnswerNPP_HandleEvent. A
+    // pen-move stream is unbounded; the daemon log is the only field-debug channel there is.
+    uint32_t mJihadInputEventsLogged;
+
+public:
+    // Jihad R7 (webOS): repaint this instance from the host's own clock. See
+    // JihadGlibPumpTask::Run — a webOS plugin is not obliged to ask for repaints, because the
+    // host it was written for painted it as part of every page paint.
+    void JihadPalmRepaintTick();
+
+private:
+
     // Surface type optimized of parent process
     gfxSurfaceType mSurfaceType;
 

dom/plugins/ipc/PluginInstanceParent.cpp

@@ -115,6 +115,16 @@ PluginInstanceParent::LookupPluginInstanceByID(uintptr_t aId)
 }
 #endif
 
+// Jihad: every live instance, so a C entry point can reach one. jihad_plugin_frame_seq needs no
+// instance because it only counts; a frame REQUEST has to be sent on an actual actor.
+//
+// A plain file-static array maintained in the ctor/dtor below, not a hashtable: this is at most a
+// couple of entries on a single-card embedding, it is only ever touched on the main thread (the
+// daemon calls the export from inside its own tick, on that same thread), and the alternative —
+// walking nsPluginHost's nsNPAPIPluginInstance list the way jihad_plugin_palm_spotlight does —
+// would still have to get from there to the PluginInstanceParent actor to call Send on it.
+static nsTArray<PluginInstanceParent*>* gJihadLiveInstances = nullptr;
+
 PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
                                            NPP npp,
                                            const nsCString& aMimeType,
@@ -145,10 +155,24 @@ PluginInstanceParent::PluginInstanceParent(PluginModuleParent* parent,
         sPluginInstanceList = new nsClassHashtable<nsVoidPtrHashKey, PluginInstanceParent>();
     }
 #endif
+    // Jihad: join the live list that jihad_plugin_request_frame walks. Leaked on purpose — it
+    // outlives every instance and there is no shutdown hook here that is guaranteed to run
+    // after the last dtor.
+    if (!gJihadLiveInstances) {
+        gJihadLiveInstances = new nsTArray<PluginInstanceParent*>();
+    }
+    gJihadLiveInstances->AppendElement(this);
 }
 
 PluginInstanceParent::~PluginInstanceParent()
 {
+    // Jihad: leave the live list FIRST. Anything below can run script or spin the loop, and a
+    // frame request delivered to a half-destroyed actor is a use-after-free rather than a
+    // dropped frame.
+    if (gJihadLiveInstances) {
+        gJihadLiveInstances->RemoveElement(this);
+    }
+
     if (mNPP)
         mNPP->pdata = nullptr;
 
@@ -269,6 +293,8 @@ PluginInstanceParent::AnswerNPN_GetValue_NPNVnetscapeWindow(NativeWindowHandle*
     XID id;
 #elif defined(XP_DARWIN)
     intptr_t id;
+#elif defined(MOZ_WIDGET_HEADLESS)
+    intptr_t id; // Jihad headless: no native window id
 #else
 #warning Implement me
 #endif
@@ -769,6 +795,51 @@ PluginInstanceParent::RecvShowDirectBitmap(Shmem&& buffer,
         return false;
     }
 
+    // NO COMPOSITOR PROCESS: composite the plugin's bitmap directly.
+    //
+    // Everything below this point routes the plugin's pixels through a TextureClient to a
+    // compositor, and that requires ImageBridgeChild — which only exists with off-main-thread
+    // composition. This embedder deliberately runs OMTC off (the offscreen renderer uses the
+    // in-process BasicLayerManager and hands finished frames to the browser adapter itself),
+    // so ImageBridgeChild::GetSingleton() is null and TextureClientRecycleAllocator is built
+    // around a null KnowsCompositor. The first plugin paint then dereferenced it and took the
+    // whole daemon down with it — upstream never sees this because the DXGI path a few
+    // hundred lines up checks the forwarder and the direct-bitmap path does not.
+    //
+    // A BasicLayerManager does not need a TextureClient at all: it draws an ImageLayer from
+    // the image's own SourceSurface. So wrap the pixels in a plain SourceSurfaceImage and
+    // hand that to the container.
+    //
+    // The pixels are COPIED, not wrapped. `source` above wraps the shmem the plugin drew
+    // into, and the plugin owns that buffer and may draw the next frame into it as soon as
+    // this call returns; the texture path's UpdateFromSurface copies for the same reason.
+    if (!ImageBridgeChild::GetSingleton()) {
+        RefPtr<gfx::DataSourceSurface> copy =
+            gfx::Factory::CreateDataSourceSurface(size, format);
+        if (!copy) {
+            NS_WARNING("Could not allocate a surface for plugin bitmap!");
+            return false;
+        }
+        {
+            gfx::DataSourceSurface::ScopedMap srcMap(source, gfx::DataSourceSurface::READ);
+            gfx::DataSourceSurface::ScopedMap dstMap(copy, gfx::DataSourceSurface::WRITE);
+            if (!srcMap.IsMapped() || !dstMap.IsMapped()) {
+                return false;
+            }
+            const int32_t bpp = BytesPerPixel(format);
+            const int32_t rowBytes = size.width * bpp;
+            for (int32_t y = 0; y < size.height; y++) {
+                memcpy(dstMap.GetData() + (ptrdiff_t)y * dstMap.GetStride(),
+                       srcMap.GetData() + (ptrdiff_t)y * srcMap.GetStride(),
+                       rowBytes);
+            }
+        }
+
+        RefPtr<SourceSurfaceImage> image = new SourceSurfaceImage(size, copy);
+        SetCurrentImage(image);
+        return true;
+    }
+
     // Allocate a texture for the compositor.
     RefPtr<TextureClientRecycleAllocator> allocator = mParent->EnsureTextureAllocatorForDirectBitmap();
     RefPtr<TextureClient> texture = allocator->CreateOrRecycle(
@@ -864,6 +935,55 @@ PluginInstanceParent::RecvShowDirectDXGISurface(const WindowsHandle& handle,
 }
 #endif // MOZ_ENABLE_NPAPI
 
+// Jihad: monotonic count of plugin frames that have reached the parent. Process-wide rather
+// than per-instance, matching how the daemon consumes it — the embedding is single-page and the
+// question it answers is "has ANY plugin produced a new frame since I last published". A plain
+// uint32_t incremented and read on the same (main) thread; the daemon reads it from the same
+// thread inside its tick, so no atomics are needed and none are used elsewhere in this bridge.
+static uint32_t gJihadPluginFrameSeq = 0;
+
+extern "C" {
+// Weak-linked from the daemon (render/goanna/GoannaRenderPage.cpp), the same way
+// jihad_offscreen_take_dirty is: an older libxul simply does not export it, and the daemon then
+// falls back to its dirty-flag behaviour instead of failing to load.
+MOZ_EXPORT uint32_t jihad_plugin_frame_seq(void)
+{
+    return gJihadPluginFrameSeq;
+}
+}
+
+extern "C" {
+// Ask every live plugin for one frame. Returns how many were asked, so the daemon can tell "no
+// plugin" from "delivered" — the same contract as jihad_plugin_palm_spotlight.
+//
+// WEAK on the daemon side: a libxul without this symbol keeps the child's own timer as the frame
+// clock (patch 0026 behaviour), which is slower to settle but never wrong.
+MOZ_EXPORT int jihad_plugin_request_frame(void)
+{
+#ifdef MOZ_ENABLE_NPAPI
+    if (!gJihadLiveInstances) {
+        return 0;
+    }
+    // Copy first: SendJihadRequestFrame can fail and tear the actor down, which would mutate the
+    // array underneath the loop. Same reasoning as the instance-list copy in
+    // jihad_plugin_palm_spotlight (nsPluginHost.cpp).
+    nsTArray<PluginInstanceParent*> snap(*gJihadLiveInstances);
+    int asked = 0;
+    for (uint32_t i = 0; i < snap.Length(); ++i) {
+        if (!gJihadLiveInstances->Contains(snap[i])) {
+            continue;   // torn down by an earlier Send in this same loop
+        }
+        if (snap[i]->SendJihadRequestFrame()) {
+            asked++;
+        }
+    }
+    return asked;
+#else
+    return 0;
+#endif
+}
+}
+
 bool
 PluginInstanceParent::RecvShow(const NPRect& updatedRect,
                                const SurfaceDescriptor& newSurface,
@@ -877,6 +997,27 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
 
     MOZ_ASSERT(!IsUsingDirectDrawing());
 
+    // FRAME-RATE READOUT, parent side. Paired with the child's `palm draw:` line: the child
+    // reports how often the plugin was ASKED to draw, this reports how many of those frames
+    // actually crossed the process boundary. A gap between the two numbers is the difference
+    // between "the plugin is slow" and "we are dropping its frames", which are opposite bugs.
+    {
+        static uint32_t sShows = 0;
+        static uint32_t sLastReport = 0;
+        sShows++;
+        uint32_t nowMs = uint32_t(PR_IntervalToMilliseconds(PR_IntervalNow()));
+        if (!sLastReport) {
+            sLastReport = nowMs;
+        } else if (nowMs - sLastReport >= 2000) {
+            fprintf(stderr, "[jihad-npapi] RecvShow: %u in %ums (%.1f fps)\n",
+                    sShows, nowMs - sLastReport,
+                    sShows * 1000.0 / double(nowMs - sLastReport));
+            fflush(stderr);
+            sShows = 0;
+            sLastReport = nowMs;
+        }
+    }
+
     // XXXjwatt rewrite to use Moz2D
     RefPtr<gfxASurface> surface;
     if (newSurface.type() == SurfaceDescriptor::TShmem) {
@@ -959,14 +1100,75 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
                    updatedRect.bottom - updatedRect.top);
         surface->MarkDirty(ur);
 
-        bool isPlugin = true;
-        RefPtr<gfx::SourceSurface> sourceSurface =
-            gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(nullptr, surface, isPlugin);
-        RefPtr<SourceSurfaceImage> image = new SourceSurfaceImage(surface->GetSize(), sourceSurface);
+        // JIHAD (2026-08-09): route the legacy windowless show through the SAME
+        // representation the direct-bitmap path uses, for the SAME reasons.
+        //
+        // Background: the webOS npPalmDrawEvent path (PaintRectToPlatformSurface) makes Flash
+        // blit its stage into mCurrentSurface — measured full-magenta in the child — and ships
+        // it here via SendShow. The control plugin's pixels reach the screen through
+        // RecvShowDirectBitmap; Flash's did not, although both feed the one mImageContainer the
+        // BasicLayerManager reads. Two concrete differences made the legacy path invisible:
+        //   1. It WRAPPED the shmem (GetSourceSurfaceForSurface(nullptr,…)) instead of copying.
+        //      The child double-buffers and SwapSurfaces() immediately after SendShow returns,
+        //      so a wrapped front buffer is the very buffer the child repaints next — the image
+        //      the layer later samples is racing the child. RecvShowDirectBitmap copies for
+        //      exactly this reason ("the plugin owns that buffer and may draw the next frame
+        //      into it as soon as this call returns").
+        //   2. It stamped no frameID. SetCurrentImage() on the working path assigns a monotonic
+        //      ++mFrameID; the ImageContainer/ImageLayer treats a repeated frameID as "no new
+        //      frame". A fixed 0 can be coalesced away.
+        // Copying into a fresh DataSourceSurface and stamping a monotonic frameID makes this
+        // path identical in substance to the one already proven to composite here.
+        IntSize ssize = surface->GetSize();
+        RefPtr<Image> image;
+        RefPtr<gfxImageSurface> imgSurf = surface->GetAsImageSurface();
+        if (imgSurf) {
+            // Always present the copy as B8G8R8A8, and force the alpha channel opaque when the
+            // source carries no alpha (RGB24 / B8G8R8X8). This is Bug 1196927 in this file's own
+            // words (see PluginInstanceChild::PaintRectToSurface): Cairo/Skia leave the X byte of
+            // a BGRX surface zeroed, and a BasicImageLayer then composites those pixels multiplied
+            // by alpha 0 — i.e. fully transparent. That is exactly why Flash's magenta stage
+            // arrived here (RecvShow logged px0=0xffff00ff) yet BasicImageLayer::Paint drew
+            // nothing visible, while the control plugin — which ships B8G8R8A8 — composited fine
+            // through the identical layer path. webOS windowless plugins are opaque
+            // (wmode=opaque forces the windowless instance in the first place), so forcing alpha
+            // opaque is correct here.
+            const SurfaceFormat srcFmt = surface->GetSurfaceFormat();
+            const bool srcHasAlpha =
+                srcFmt != SurfaceFormat::B8G8R8X8 &&
+                srcFmt != SurfaceFormat::R8G8B8X8;
+            RefPtr<gfx::DataSourceSurface> copy =
+                gfx::Factory::CreateDataSourceSurface(ssize, SurfaceFormat::B8G8R8A8);
+            if (copy) {
+                gfx::DataSourceSurface::ScopedMap dstMap(copy, gfx::DataSourceSurface::WRITE);
+                if (dstMap.IsMapped()) {
+                    const int32_t rowBytes = ssize.width * 4;
+                    for (int32_t y = 0; y < ssize.height; y++) {
+                        uint8_t* dstRow = dstMap.GetData() + (ptrdiff_t)y * dstMap.GetStride();
+                        memcpy(dstRow, imgSurf->Data() + (ptrdiff_t)y * imgSurf->Stride(),
+                               rowBytes);
+                        if (!srcHasAlpha) {
+                            for (int32_t x = 0; x < ssize.width; x++) {
+                                dstRow[x * 4 + 3] = 0xff;  // BGRA: byte 3 is alpha
+                            }
+                        }
+                    }
+                    image = new SourceSurfaceImage(ssize, copy);
+                }
+            }
+        }
+        if (!image) {
+            // Fallback to the original wrap if the copy path could not be taken.
+            bool isPlugin = true;
+            RefPtr<gfx::SourceSurface> sourceSurface =
+                gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(nullptr, surface, isPlugin);
+            image = new SourceSurfaceImage(ssize, sourceSurface);
+        }
 
+        ImageContainer::NonOwningImage holder(image);
+        holder.mFrameID = ++mFrameID;
         AutoTArray<ImageContainer::NonOwningImage,1> imageList;
-        imageList.AppendElement(
-            ImageContainer::NonOwningImage(image));
+        imageList.AppendElement(holder);
 
         ImageContainer *container = GetImageContainer();
         container->SetCurrentImages(imageList);
@@ -976,6 +1178,17 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
     }
 
     mFrontSurface = surface;
+    // Jihad: count DELIVERED plugin frames so the embedder can tell a new one from a repeat.
+    // The daemon's only frame signal is PuppetWidget's sticky dirty boolean, which carries no
+    // identity: the refresh driver and ordinary page damage set the same flag, so "there is
+    // damage" cannot answer "did the plugin draw again". Measured 2026-08-10 on a 30 fps SWF,
+    // that ambiguity is what made both available policies wrong — publishing on every dirty
+    // tick sent ~78 card frames for ~60 plugin frames (duplicates, and 22-44 deferred because
+    // the adapter could not drain them), while pacing on a fixed 33 ms grid sent ~57 for ~68
+    // (dropped frames, so the animation stepped two positions at once). The stock webOS host
+    // never had to choose: it pulls the plugin synchronously inside the page paint, so it is
+    // 1:1 by construction. This counter is what lets the daemon be 1:1 too.
+    ++gJihadPluginFrameSeq;
     RecvNPN_InvalidateRect(updatedRect);
 
     PLUGIN_LOG_DEBUG(("   (RecvShow invalidated for surface %p)",
@@ -1301,7 +1514,11 @@ PluginInstanceParent::GetImageContainer()
     return mImageContainer;
   }
 
-  if (IsUsingDirectDrawing()) {
+  if (IsUsingDirectDrawing() && ImageBridgeChild::GetSingleton()) {
+      // ASYNCHRONOUS means "shared with the compositor through ImageBridge". Without an
+      // ImageBridge the async container silently gets no image client and never publishes
+      // anything, so with OMTC off this has to be an ordinary local container — which is
+      // what the BasicLayerManager reads from. See RecvShowDirectBitmap.
       mImageContainer = LayerManager::CreateImageContainer(ImageContainer::ASYNCHRONOUS);
   } else {
       mImageContainer = LayerManager::CreateImageContainer();

dom/plugins/ipc/PluginMessageUtils.h

@@ -117,6 +117,8 @@ typedef HWND NativeWindowHandle;
 typedef XID NativeWindowHandle;
 #elif defined(XP_DARWIN)
 typedef intptr_t NativeWindowHandle; // never actually used, will always be 0
+#elif defined(MOZ_WIDGET_HEADLESS)
+typedef intptr_t NativeWindowHandle; // Jihad headless: no native window handle
 #else
 #error Need NativeWindowHandle for this platform
 #endif

dom/plugins/ipc/PluginModuleChild.cpp

@@ -60,6 +60,9 @@ using namespace mozilla::ipc;
 using namespace mozilla::plugins;
 using namespace mozilla::widget;
 
+// Defined at the bottom of this file; see the NPN SYMBOL INTERPOSITION block there.
+namespace mozilla { namespace plugins { void JihadInstallNPNInterposition(); } }
+
 #if defined(XP_WIN)
 const wchar_t * kFlashFullscreenClass = L"ShockwaveFlashFullScreen";
 const wchar_t * kMozillaWindowClass = L"MozillaWindowClass";
@@ -232,6 +235,10 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
 {
     NS_ASSERTION(aChannel, "need a channel");
 
+    // Point the exported NPN_* globals at the real implementations before any plugin can be
+    // loaded, so a plugin that resolves them as symbols reaches us rather than libWebKitLuna.
+    JihadInstallNPNInterposition();
+
     if (!InitGraphics())
         return false;
 
@@ -251,7 +258,11 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
     nsPluginFile pluginFile(localFile);
 
     nsPluginInfo info = nsPluginInfo();
-    if (NS_FAILED(pluginFile.GetPluginInfo(info, &mLibrary))) {
+    nsresult jihadRv = pluginFile.GetPluginInfo(info, &mLibrary);
+    fprintf(stderr, "[jihad-npapi-child] GetPluginInfo rv=0x%x lib=%d\n",
+            (unsigned)jihadRv, (int)!!mLibrary);
+    fflush(stderr);
+    if (NS_FAILED(jihadRv)) {
         return false;
     }
 
@@ -1843,6 +1854,8 @@ bool
 PluginModuleChild::AnswerNP_Initialize(const PluginSettings& aSettings, NPError* rv)
 {
     *rv = DoNP_Initialize(aSettings);
+    fprintf(stderr, "[jihad-npapi-child] AnswerNP_Initialize rv=%d\n", (int)*rv);
+    fflush(stderr);
     return true;
 }
 
@@ -1882,6 +1895,8 @@ PluginModuleChild::DoNP_Initialize(const PluginSettings& aSettings)
 #  error Please implement me for your platform
 #endif
 
+    fprintf(stderr, "[jihad-npapi-child] DoNP_Initialize plugin returned %d\n", (int)result);
+    fflush(stderr);
     return result;
 }
 
@@ -2617,3 +2632,31 @@ PluginModuleChild::RecvNPP_SetValue_NPNVaudioDeviceChangeDetails(
 #endif
 }
 #endif // MOZ_ENABLE_NPAPI
+
+// ── NPN SYMBOL INTERPOSITION (Jihad, addons R7) ──────────────────────────────────────────
+//
+// The exported NPN_* globals themselves live in JihadNPNInterpose.cpp (they must, to escape
+// hidden visibility — see the long comment there). All that is needed here is to point them
+// at the same implementations the browser function table uses, which is done once the table
+// exists. Installed from a static initializer-free helper called by the child at startup.
+extern "C" {
+extern void  (*gJihadNPNInvalidateRect)(void*, void*);
+extern void* (*gJihadNPNCreateObject)(void*, void*);
+}
+
+namespace mozilla {
+namespace plugins {
+
+void JihadInstallNPNInterposition()
+{
+    const NPNetscapeFuncs& f = PluginModuleChild::sBrowserFuncs;
+    gJihadNPNInvalidateRect = (void(*)(void*, void*))f.invalidaterect;
+    gJihadNPNCreateObject   = (void*(*)(void*, void*))f.createobject;
+    fprintf(stderr, "[jihad-npapi-child] NPN interposition installed invalidaterect=%p "
+                    "createobject=%p\n",
+            (void*)f.invalidaterect, (void*)f.createobject);
+    fflush(stderr);
+}
+
+} // namespace plugins
+} // namespace mozilla

dom/plugins/ipc/PluginModuleParent.cpp

@@ -444,6 +444,8 @@ PluginModuleChromeParent::LoadModule(const char* aFilePath, uint32_t aPluginId,
     parent->mSubprocess->SetCallRunnableImmediately(!parent->mIsStartingAsync);
     bool launched = parent->mSubprocess->Launch(Move(onLaunchedRunnable),
                                                 aPluginTag->mSandboxLevel);
+    fprintf(stderr, "[jihad-npapi] LoadModule path=%s async=%d launched=%d\n",
+            aFilePath, (int)parent->mIsStartingAsync, (int)launched);
     if (!launched) {
         // We never reached open
         parent->mShutdown = true;
@@ -455,7 +457,10 @@ PluginModuleChromeParent::LoadModule(const char* aFilePath, uint32_t aPluginId,
     parent->mIsBlocklisted = NS_FAILED(rv) || blocklistState != 0;
     if (!parent->mIsStartingAsync) {
         int32_t launchTimeoutSecs = Preferences::GetInt(kLaunchTimeoutPref, 0);
-        if (!parent->mSubprocess->WaitUntilConnected(launchTimeoutSecs * 1000)) {
+        bool connected = parent->mSubprocess->WaitUntilConnected(launchTimeoutSecs * 1000);
+        fprintf(stderr, "[jihad-npapi] LoadModule WaitUntilConnected(%ds) = %d\n",
+                (int)launchTimeoutSecs, (int)connected);
+        if (!connected) {
             parent->mShutdown = true;
             return nullptr;
         }
@@ -1134,9 +1139,20 @@ PluginModuleChromeParent::OnHangUIContinue()
 }
 #endif // XP_WIN
 
+// Defined with the rest of the Jihad CPU-boost helpers further down this file.
+namespace { void JihadCpuBoostReleaseAll(); }
+
 void
 PluginModuleParent::ActorDestroy(ActorDestroyReason why)
 {
+    // Release the CPU boost here as well as in NPP_Destroy, because on this port NPP_Destroy is
+    // NOT the path a plugin usually leaves by: navigating away from a Flash page ends in the
+    // child's own mozalloc_abort, so the instance never gets an orderly destroy and the boost
+    // would leak — device-observed 2026-08-10, tunables still at 40/50000 after navigation with
+    // no release logged. This runs for every ActorDestroyReason, normal and abnormal, which also
+    // covers a plugin crash.
+    JihadCpuBoostReleaseAll();
+
     switch (why) {
     case AbnormalShutdown: {
         mShutdown = true;
@@ -1271,6 +1287,172 @@ NP_BEGIN_MACRO                                                                 \
     return i->func;                                                            \
 NP_END_MACRO
 
+// ── Jihad: hold a CPU-frequency boost while a plugin instance is alive ──────────────────────
+//
+// WHY. The TouchPad's governor is Palm's `ondemandtcl`, whose stock `up_threshold` is 95 — it
+// only raises the clock when a single core exceeds 95% load. Flash never gets there: measured on
+// device, the daemon runs ~26% and plugin-container ~11% of two cores, so a passively-watched
+// animation sits at the FLOOR. Sampling `scaling_cur_freq` once a second during playback gave
+// 192000-384000 out of a 1188000 maximum, snapping back to 1188000 the moment the page was
+// navigated away. The whole system was only 69% busy, so this was never a capacity wall.
+//
+// Dropping `up_threshold` to 40 and `sampling_rate` to 50000 pins 1188000 and lifts the card
+// composite from 20.4-27.5 fps to 30.7-35.2, daemon paints 24.0-28.7 to 31.4-33.0, and the frame
+// gap MAXIMUM — the number that reads as stutter — from 63-81 ms to 49-56. It also clears the
+// audio xruns, because MP3 decode at 192 MHz underruns.
+//
+// NEVER WRITE `scaling_governor`. Switching away from `ondemandtcl` DEADLOCKS cpufreq in the
+// kernel: every later reader of any cpufreq node blocks in unkillable D state — the daemon,
+// `powerlog`, and the restore path itself — so the boost is never released and only a reboot
+// clears it (and a clean `reboot` will not run, because init waits on those D-state tasks).
+// Governor TUNABLE writes, which is all this does, are safe and return instantly.
+//
+// These are SYSTEM-WIDE tunables, so they are held only while a plugin instance exists and the
+// ORIGINAL values are read back and restored on teardown. The upstart job restores them again
+// from `post-stop`, because a daemon that dies holding the boost would otherwise leave the whole
+// device tuned for battery burn. Both hooks run on the main thread, so the counter needs no lock.
+namespace {
+
+const char kJihadOndemandDir[] = "/sys/devices/system/cpu/cpufreq/ondemandtcl";
+
+// The stock values, used ONLY as the restore fallback when the current value already equals what
+// we are about to write — which happens when another variant's daemon is holding the boost.
+// Saving the boosted value as "original" there would make the last release pin the device.
+const char kJihadStockUpThreshold[]  = "95";
+const char kJihadStockSamplingRate[] = "200000";
+
+// The instances that actually TOOK a boost, not a bare count. NPP_Destroy also runs for instances
+// that failed before the boost was taken, and decrementing a count there would release the boost
+// out from under a plugin that is still playing.
+nsTArray<NPP> gJihadBoostedInstances;
+bool gJihadBoostHeld = false;
+char gJihadSavedUpThreshold[32];
+char gJihadSavedSamplingRate[32];
+
+bool
+JihadReadTunable(const char* aName, char* aOut, size_t aOutLen)
+{
+    char path[256];
+    snprintf(path, sizeof(path), "%s/%s", kJihadOndemandDir, aName);
+    FILE* f = fopen(path, "r");
+    if (!f) return false;
+    char* got = fgets(aOut, aOutLen, f);
+    fclose(f);
+    if (!got) return false;
+    // Trim the trailing newline so a value read back can be compared and rewritten verbatim.
+    size_t n = strlen(aOut);
+    while (n > 0 && (aOut[n - 1] == '\n' || aOut[n - 1] == '\r')) aOut[--n] = '\0';
+    return n > 0;
+}
+
+bool
+JihadWriteTunable(const char* aName, const char* aValue)
+{
+    char path[256];
+    snprintf(path, sizeof(path), "%s/%s", kJihadOndemandDir, aName);
+    FILE* f = fopen(path, "w");
+    if (!f) return false;
+    bool ok = fputs(aValue, f) >= 0;
+    ok = (fclose(f) == 0) && ok;
+    return ok;
+}
+
+// Env-tunable for the same reason the repaint divisor is: the right value is a property of the
+// device under load, not of the source, and a rebuild per candidate costs a 44 MB push.
+void
+JihadCpuBoostTargets(const char** aUpThreshold, const char** aSamplingRate)
+{
+    static char sUp[32]   = "40";
+    static char sRate[32] = "50000";
+    static bool sInit = false;
+    if (!sInit) {
+        sInit = true;
+        const char* e = getenv("JIHAD_PLUGIN_CPU_UP_THRESHOLD");
+        if (e && *e) {
+            int v = atoi(e);
+            if (v >= 5 && v <= 95) snprintf(sUp, sizeof(sUp), "%d", v);
+        }
+        e = getenv("JIHAD_PLUGIN_CPU_SAMPLING_RATE");
+        if (e && *e) {
+            int v = atoi(e);
+            if (v >= 10000 && v <= 1000000) snprintf(sRate, sizeof(sRate), "%d", v);
+        }
+    }
+    *aUpThreshold = sUp;
+    *aSamplingRate = sRate;
+}
+
+bool
+JihadCpuBoostEnabled()
+{
+    const char* e = getenv("JIHAD_PLUGIN_CPU_BOOST");
+    return !(e && e[0] == '0' && e[1] == '\0');
+}
+
+void
+JihadCpuBoostAcquire(NPP aInstance)
+{
+    if (!JihadCpuBoostEnabled() || gJihadBoostedInstances.Contains(aInstance)) return;
+    gJihadBoostedInstances.AppendElement(aInstance);
+    if (gJihadBoostedInstances.Length() != 1 || gJihadBoostHeld) return;
+
+    const char* wantUp;
+    const char* wantRate;
+    JihadCpuBoostTargets(&wantUp, &wantRate);
+
+    if (!JihadReadTunable("up_threshold", gJihadSavedUpThreshold,
+                          sizeof(gJihadSavedUpThreshold)) ||
+        !strcmp(gJihadSavedUpThreshold, wantUp)) {
+        strcpy(gJihadSavedUpThreshold, kJihadStockUpThreshold);
+    }
+    if (!JihadReadTunable("sampling_rate", gJihadSavedSamplingRate,
+                          sizeof(gJihadSavedSamplingRate)) ||
+        !strcmp(gJihadSavedSamplingRate, wantRate)) {
+        strcpy(gJihadSavedSamplingRate, kJihadStockSamplingRate);
+    }
+
+    bool ok = JihadWriteTunable("up_threshold", wantUp);
+    ok = JihadWriteTunable("sampling_rate", wantRate) && ok;
+    gJihadBoostHeld = ok;
+    fprintf(stderr, "[jihad-npapi] cpu boost acquire: up_threshold %s->%s sampling_rate %s->%s%s\n",
+            gJihadSavedUpThreshold, wantUp, gJihadSavedSamplingRate, wantRate,
+            ok ? "" : "  FAILED (not root, or no ondemandtcl)");
+    fflush(stderr);
+}
+
+void
+JihadCpuBoostRelease(NPP aInstance)
+{
+    if (!gJihadBoostedInstances.RemoveElement(aInstance)) return;
+    if (!gJihadBoostedInstances.IsEmpty() || !gJihadBoostHeld) return;
+
+    JihadWriteTunable("up_threshold", gJihadSavedUpThreshold);
+    JihadWriteTunable("sampling_rate", gJihadSavedSamplingRate);
+    gJihadBoostHeld = false;
+    fprintf(stderr, "[jihad-npapi] cpu boost release: up_threshold=%s sampling_rate=%s\n",
+            gJihadSavedUpThreshold, gJihadSavedSamplingRate);
+    fflush(stderr);
+}
+
+// Drop every outstanding boost at once. Used when the plugin module itself goes away, which on
+// this port is the NORMAL exit path (see ActorDestroy), not just the crash path.
+void
+JihadCpuBoostReleaseAll()
+{
+    if (gJihadBoostedInstances.IsEmpty()) return;
+    gJihadBoostedInstances.Clear();
+    if (!gJihadBoostHeld) return;
+
+    JihadWriteTunable("up_threshold", gJihadSavedUpThreshold);
+    JihadWriteTunable("sampling_rate", gJihadSavedSamplingRate);
+    gJihadBoostHeld = false;
+    fprintf(stderr, "[jihad-npapi] cpu boost release (module gone): up_threshold=%s sampling_rate=%s\n",
+            gJihadSavedUpThreshold, gJihadSavedSamplingRate);
+    fflush(stderr);
+}
+
+} // anonymous namespace
+
 NPError
 PluginModuleParent::NPP_Destroy(NPP instance,
                                 NPSavedData** saved)
@@ -1296,6 +1478,7 @@ PluginModuleParent::NPP_Destroy(NPP instance,
     instance->pdata = nullptr;
 
     Unused << PluginInstanceParent::Call__delete__(parentInstance);
+    JihadCpuBoostRelease(instance);
     return retval;
 }
 
@@ -2292,6 +2475,12 @@ PluginModuleParent::NPP_NewInternal(NPMIMEType pluginType, NPP instance,
 
     UpdatePluginTimeout();
 
+    // Taken ONLY here, on the single success path, and released in NPP_Destroy. Every failure
+    // return above this point either deletes |parentInstance| itself or hands it to NPP_Destroy,
+    // and a boost acquired on one of those paths would never be released — which on this device
+    // means leaving the WHOLE system tuned for battery burn with nothing owning it.
+    JihadCpuBoostAcquire(instance);
+
     return NS_OK;
 }
 

dom/plugins/ipc/PluginProcessChild.cpp

@@ -111,9 +111,14 @@ PluginProcessChild::Init()
       return false;
     }
 
+    fprintf(stderr, "[jihad-npapi-child] InitForChrome plugin=%s parentPid=%d\n",
+            pluginFilename.c_str(), (int)ParentPid());
+    fflush(stderr);
     bool retval = mPlugin.InitForChrome(pluginFilename, ParentPid(),
                                         IOThreadChild::message_loop(),
                                         IOThreadChild::channel());
+    fprintf(stderr, "[jihad-npapi-child] InitForChrome = %d\n", (int)retval);
+    fflush(stderr);
 #if defined(XP_MACOSX)
     if (nsCocoaFeatures::OnYosemiteOrLater()) {
       // Explicitly turn off CGEvent logging.  This works around bug 1092855.

dom/plugins/ipc/moz.build

@@ -88,6 +88,10 @@ UNIFIED_SOURCES += [
 ]
 
 SOURCES += [
+    # Jihad: must NOT be unified — it deliberately includes no NPAPI headers so its exported
+    # NPN_* symbols escape the hidden-visibility pragma. Merging it with a TU that includes
+    # npapi.h would reintroduce the prior hidden declaration and silently un-export them.
+    'JihadNPNInterpose.cpp',
     'PluginInstanceChild.cpp', # 'PluginThreadCallback' : ambiguous symbol
     'PluginModuleChild.cpp',   # Redefinition of mozilla::WindowsDllInterceptor sUser32Intercept
 ]

dom/url/URL.cpp

@@ -1789,26 +1789,17 @@ URL::IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
   return URLWorker::IsValidURL(aGlobal, aURL, aRv);
 }
 
-already_AddRefed<URL>
-URL::Parse(const GlobalObject& aGlobal, const nsAString& aURL,
-           const Optional<nsAString>& aBase)
-{
+bool
+URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
+              const Optional<nsAString>& aBase) {
   ErrorResult rv;
   RefPtr<URL> parsed = URL::Constructor(aGlobal, aURL, aBase, rv);
   if (rv.Failed() || !parsed) {
     rv.SuppressException();
-    return nullptr;
+    return false;
   }
 
-  return parsed.forget();
-}
-
-bool
-URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
-              const Optional<nsAString>& aBase)
-{
-  RefPtr<URL> parsed = URL::Parse(aGlobal, aURL, aBase);
-  return !!parsed;
+  return true;
 }
 
 already_AddRefed<URLSearchParams>

dom/url/URL.h

@@ -88,10 +88,6 @@ public:
   IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
              ErrorResult& aRv);
 
-  static already_AddRefed<URL>
-  Parse(const GlobalObject& aGlobal, const nsAString& aURL,
-        const Optional<nsAString>& aBase);
-
   static bool
   CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
            const Optional<nsAString>& aBase);

dom/url/tests/test_url.html

@@ -448,34 +448,6 @@
                 !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
                 "URL.canParse rejects root-relative input against opaque mailto: base",
             );
-            ok("parse" in URL, "URL.parse exists");
-            is(URL.parse.length, 1, "URL.parse has one required argument");
-            var parsed = URL.parse("/static/client/runtime.js", "x:/");
-            ok(parsed instanceof URL, "URL.parse returns a URL object on success");
-            is(parsed.href, "x:/static/client/runtime.js", "URL.parse resolves against a base");
-            is(URL.parse("/static/client/runtime.js"), null, "URL.parse returns null for invalid input");
-            is(
-                URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
-                null,
-                "URL.parse returns null for an invalid base/input combination",
-            );
-
-            var conversionOrder = [];
-            parsed = URL.parse(
-                { toString: function() { conversionOrder.push("url"); return "child"; } },
-                { toString: function() { conversionOrder.push("base"); return "https://example.com/root/"; } },
-            );
-            is(conversionOrder.join(","), "url,base", "URL.parse converts its arguments in order");
-            is(parsed.href, "https://example.com/root/child", "URL.parse uses converted arguments");
-
-            var sentinel = {};
-            var thrown;
-            try {
-                URL.parse({ toString: function() { throw sentinel; } });
-            } catch (e) {
-                thrown = e;
-            }
-            is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
             SimpleTest.doesThrow(() => {
                 new URL("/static/client/runtime.js", "mailto:test@example.com");
             }, "constructor rejects root-relative input against opaque mailto: base");

dom/url/tests/urlApi_worker.js

@@ -301,64 +301,6 @@ onmessage = function () {
     !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
     "URL.canParse rejects root-relative input against opaque mailto: base",
   );
-  ok("parse" in URL, "URL.parse exists");
-  is(URL.parse.length, 1, "URL.parse has one required argument");
-  let parsed = URL.parse("/static/client/runtime.js", "x:/");
-  ok(parsed instanceof URL, "URL.parse returns a URL object on success");
-  is(
-    parsed.href,
-    "x:/static/client/runtime.js",
-    "URL.parse resolves against a base",
-  );
-  is(
-    URL.parse("/static/client/runtime.js"),
-    null,
-    "URL.parse returns null for invalid input",
-  );
-  is(
-    URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
-    null,
-    "URL.parse returns null for an invalid base/input combination",
-  );
-
-  const conversionOrder = [];
-  parsed = URL.parse(
-    {
-      toString() {
-        conversionOrder.push("url");
-        return "child";
-      },
-    },
-    {
-      toString() {
-        conversionOrder.push("base");
-        return "https://example.com/root/";
-      },
-    },
-  );
-  is(
-    conversionOrder.join(","),
-    "url,base",
-    "URL.parse converts its arguments in order",
-  );
-  is(
-    parsed.href,
-    "https://example.com/root/child",
-    "URL.parse uses converted arguments",
-  );
-
-  const sentinel = {};
-  let thrown;
-  try {
-    URL.parse({
-      toString() {
-        throw sentinel;
-      },
-    });
-  } catch (e) {
-    thrown = e;
-  }
-  is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
   let mailtoRelativeFailed = false;
   try {
     new URL("/static/client/runtime.js", "mailto:test@example.com");

dom/webidl/CSSStyleSheet.webidl

@@ -25,8 +25,6 @@ interface CSSStyleSheet : StyleSheet {
   unsigned long insertRule(DOMString rule, optional unsigned long index = 0);
   [Throws, NeedsSubjectPrincipal]
   void deleteRule(unsigned long index);
-  [Throws]
-  void replaceSync(DOMString text);
 
   // Non-standard WebKit things, see https://github.com/w3c/csswg-drafts/pull/3900.
   [Throws, NeedsSubjectPrincipal, BinaryName="cssRules"]

dom/webidl/URL.webidl

@@ -23,7 +23,6 @@ interface URL {
   [Throws]
   stringifier;
   
-  static URL? parse(USVString url, optional USVString base);
   static boolean canParse(USVString url, optional USVString base);
 
   [Throws]

embedding/browser/nsDocShellTreeOwner.cpp

@@ -5,6 +5,7 @@
 
 // Local Includes
 #include "nsDocShellTreeOwner.h"
+#include "nsIBadCertListener2.h"   // JIHAD: route cert errors to the embedder chrome
 #include "nsWebBrowser.h"
 
 // Helper Classes
@@ -143,6 +144,15 @@ nsDocShellTreeOwner::GetInterface(const nsIID& aIID, void** aSink)
     return NS_OK;
   }
 
+  if (aIID.Equals(NS_GET_IID(nsIBadCertListener2))) {
+    // JIHAD: the embedder's chrome is what implements this — see the matching comment in
+    // nsDocShell::GetInterface. Same forwarding shape as nsIWebBrowserChromeFocus below.
+    if (mWebBrowserChromeWeak != nullptr) {
+      return mWebBrowserChromeWeak->QueryReferent(aIID, aSink);
+    }
+    return mOwnerWin ? mOwnerWin->QueryInterface(aIID, aSink) : NS_NOINTERFACE;
+  }
+
   if (aIID.Equals(NS_GET_IID(nsIWebBrowserChromeFocus))) {
     if (mWebBrowserChromeWeak != nullptr) {
       return mWebBrowserChromeWeak->QueryReferent(aIID, aSink);

embedding/components/find/nsWebBrowserFind.cpp

@@ -390,6 +390,14 @@ nsWebBrowserFind::SetSelectionAndScroll(nsPIDOMWindowOuter* aWindow,
 
   nsCOMPtr<nsISelection> selection;
 
+  // JIHAD: frame->GetSelectionController can leave selCon NULL, and this dereferenced it
+  // unconditionally — a null deref that took the whole process down. It is reachable in an
+  // offscreen embedding with no chrome: this is the ONLY thing that made find-in-page
+  // unusable there (faultaddr=0x0, measured repeatedly). Guarding costs nothing and the
+  // rest of the function already tolerates a null `selection`.
+  if (!selCon) {
+    return;
+  }
   selCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
   selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
                        getter_AddRefs(selection));
@@ -707,7 +715,24 @@ nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping,
     return NS_ERROR_FAILURE;
   }
 
-  if (!nsContentUtils::SubjectPrincipal()->Subsumes(theDoc->NodePrincipal())) {
+  // JIHAD: this same-origin check is why find-in-page took the whole process down in this
+  // embedding, and the engine says why itself. nsContentUtils::SubjectPrincipal() begins:
+  //     JSContext* cx = GetCurrentJSContext();
+  //     if (!cx) {
+  //       MOZ_CRASH("Accessing the Subject Principal without an AutoJSAPI on the stack is forbidden");
+  //     }
+  // An EMBEDDER calls nsIWebBrowserFind::FindNext from C++ with no script on the stack, so
+  // there is no JSContext and MOZ_CRASH fires — a deliberate abort that presents as SIGSEGV at
+  // address 0, which is precisely the fault this port recorded for two weeks and attributed to
+  // "a frame-selection controller the offscreen browser doesn't set up". That was wrong: the
+  // selection machinery is fine and the crash happens BEFORE any of it, on the security check.
+  //
+  // The check is meaningful only when there IS a caller to check. With no JS on the stack the
+  // caller is native embedding code, which is already fully trusted — it is inside libxul's own
+  // process, holding the nsIWebBrowserFind for that very docShell. So: consult the subject
+  // principal only when a JSContext exists, and otherwise proceed.
+  if (nsContentUtils::GetCurrentJSContext() &&
+      !nsContentUtils::SubjectPrincipal()->Subsumes(theDoc->NodePrincipal())) {
     return NS_ERROR_DOM_PROP_ACCESS_DENIED;
   }
 
@@ -809,8 +834,11 @@ nsWebBrowserFind::GetFrameSelection(nsPIDOMWindowOuter* aWindow)
   nsCOMPtr<nsISelection> sel;
   if (frame) {
     frame->GetSelectionController(presContext, getter_AddRefs(selCon));
-    selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
-                         getter_AddRefs(sel));
+    // JIHAD: same unguarded deref as above — GetSelectionController can yield null.
+    if (selCon) {
+      selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
+                           getter_AddRefs(sel));
+    }
     if (sel) {
       int32_t count = -1;
       sel->GetRangeCount(&count);
@@ -820,7 +848,12 @@ nsWebBrowserFind::GetFrameSelection(nsPIDOMWindowOuter* aWindow)
     }
   }
 
+  // JIHAD: and the fallback QI is not guaranteed either — if the presShell does not answer
+  // nsISelectionController we must return nothing rather than crash.
   selCon = do_QueryInterface(presShell);
+  if (!selCon) {
+    return nullptr;
+  }
   selCon->GetSelection(nsISelectionController::SELECTION_NORMAL,
                        getter_AddRefs(sel));
   return sel.forget();

embedding/components/printingui/moz.build

@@ -12,5 +12,6 @@ if CONFIG['NS_PRINTING']:
         DIRS += ['win']
     elif toolkit == 'cocoa':
         DIRS += ['mac']
-    elif CONFIG['MOZ_PDF_PRINTING']:
+    elif CONFIG['MOZ_PDF_PRINTING'] or toolkit == 'headless':
+        # Jihad headless: reuse the gtk-free PDF printing prompt service.
         DIRS += ['unixshared']

gfx/2d/2D.h

@@ -1374,7 +1374,7 @@ public:
   static already_AddRefed<ScaledFont>
     CreateScaledFontForNativeFont(const NativeFont &aNativeFont, Float aSize);
 
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
   static already_AddRefed<ScaledFont>
     CreateScaledFontForFontconfigFont(cairo_scaled_font_t* aScaledFont, FcPattern* aPattern, Float aSize);
 #endif

gfx/2d/DrawTargetSkia.cpp

@@ -1117,7 +1117,6 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                         kCGImageAlphaOnly :
                         kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host;
 
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
   mCG = CGBitmapContextCreateWithData(mCanvasData,
                                       mCGSize.width,
                                       mCGSize.height,
@@ -1127,15 +1126,6 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                                       bitmapInfo,
                                       NULL, /* Callback when released */
                                       NULL);
-#else
-  mCG = CGBitmapContextCreate(mCanvasData,
-                              mCGSize.width,
-                              mCGSize.height,
-                              8, /* bits per component */
-                              stride,
-                              mColorSpace,
-                              bitmapInfo);
-#endif
   if (!mCG) {
     ReleaseBits(mCanvasData);
     NS_WARNING("Could not create bitmap around skia data\n");

gfx/2d/Factory.cpp

@@ -30,7 +30,7 @@
 #include "NativeFontResourceMac.h"
 #endif
 
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
 #include "ScaledFontFontconfig.h"
 #endif
 
@@ -584,7 +584,7 @@ Factory::CreateScaledFontWithCairo(const NativeFont& aNativeFont, Float aSize, c
 #endif
 }
 
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_HEADLESS)
 already_AddRefed<ScaledFont>
 Factory::CreateScaledFontForFontconfigFont(cairo_scaled_font_t* aScaledFont, FcPattern* aPattern, Float aSize)
 {

gfx/2d/ScaledFontMac.cpp

@@ -115,7 +115,7 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
   return ScaledFontBase::GetPathForGlyphs(aBuffer, aTarget);
 }
 
-#ifndef USE_SKIA
+#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
 void
 ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
 {

gfx/2d/ScaledFontMac.h

@@ -32,7 +32,7 @@ public:
   virtual SkTypeface* GetSkTypeface();
 #endif
   virtual already_AddRefed<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-#ifndef USE_SKIA
+#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
   virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
 #endif
   virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);

gfx/2d/moz.build

@@ -91,7 +91,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'windows':
         'JobScheduler_posix.cpp',
     ]
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
     SOURCES += [
         'ScaledFontFontconfig.cpp',
     ]
@@ -209,12 +209,12 @@ FINAL_LIBRARY = 'xul'
 for var in ('USE_CAIRO', 'MOZ2D_HAS_MOZ_CAIRO'):
     DEFINES[var] = True
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
     DEFINES['MOZ_ENABLE_FREETYPE'] = True
 
 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
     CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']
 
 LOCAL_INCLUDES += CONFIG['SKIA_INCLUDES']

gfx/layers/basic/BasicImages.cpp

@@ -87,12 +87,19 @@ public:
 bool
 BasicPlanarYCbCrImage::CopyData(const Data& aData)
 {
-  RecyclingPlanarYCbCrImage::CopyData(aData);
-
-  if (mDelayedConversion) {
+  if (!RecyclingPlanarYCbCrImage::CopyData(aData)) {
     return false;
   }
 
+  // The YCbCr copy above succeeded; delaying the RGB conversion is not a
+  // failure. GetAsSourceSurface() converts on demand when mDecodedBuffer is
+  // null. Returning false here made VideoData::CreateAndCopyData report OOM
+  // (MEDIA_ERR_DECODE) for any frame decoded while BasicImageLayer::Paint had
+  // swapped this factory into the video's ImageContainer.
+  if (mDelayedConversion) {
+    return true;
+  }
+
   // Do some sanity checks to prevent integer overflow
   if (aData.mYSize.width > PlanarYCbCrImage::MAX_DIMENSION ||
       aData.mYSize.height > PlanarYCbCrImage::MAX_DIMENSION) {

gfx/skia/moz.build

@@ -529,7 +529,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in {'cocoa', 'uikit'}:
     SOURCES += [
         'skia/src/ports/SkFontHost_mac.cpp',
     ]
-if 'gtk' in CONFIG['MOZ_WIDGET_TOOLKIT']:
+if 'gtk' in CONFIG['MOZ_WIDGET_TOOLKIT'] or CONFIG['MOZ_WIDGET_TOOLKIT'] == 'headless':
     UNIFIED_SOURCES += [
         'skia/src/ports/SkDebug_stdio.cpp',
         'skia/src/ports/SkOSFile_posix.cpp',
@@ -665,6 +665,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in {
     'cocoa',
     'gtk2',
     'gtk3',
+    'headless',
     'uikit',
   }:
     DEFINES['SK_FONTHOST_DOES_NOT_USE_FONTMGR'] = 1
@@ -738,7 +739,7 @@ if CONFIG['CLANG_CXX'] or CONFIG['CLANG_CL']:
         '-Wno-unused-private-field',
     ]
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'headless'):
     CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
     CXXFLAGS += CONFIG['CAIRO_FT_CFLAGS']
 

gfx/skia/skia/include/core/SkColorPriv.h

@@ -24,21 +24,15 @@
  *  Skia's 32bit backend only supports 1 sizzle order at a time (compile-time).
  *  This is specified by 4 defines SK_A32_SHIFT, SK_R32_SHIFT, ... for G and B.
  *
- *  For easier compatibility with Skia's GPU backend, Skia normally restricts
- *  these to either (in memory-byte-order) RGBA or BGRA. Mozilla's big-endian
- *  PowerPC port uses CoreGraphics' native ARGB pixels, so we also accept ARGB.
- *  Note that this "order" does not directly correspond to the same shift-order,
- *  since we have to take endianess into account.
+ *  For easier compatibility with Skia's GPU backend, we further restrict these
+ *  to either (in memory-byte-order) RGBA or BGRA. Note that this "order" does
+ *  not directly correspond to the same shift-order, since we have to take endianess
+ *  into account.
  *
  *  Here we enforce this constraint.
  */
 
 #ifdef SK_CPU_BENDIAN
-    #define SK_ARGB_A32_SHIFT   24
-    #define SK_ARGB_R32_SHIFT   16
-    #define SK_ARGB_G32_SHIFT   8
-    #define SK_ARGB_B32_SHIFT   0
-
     #define SK_RGBA_R32_SHIFT   24
     #define SK_RGBA_G32_SHIFT   16
     #define SK_RGBA_B32_SHIFT   8
@@ -49,11 +43,6 @@
     #define SK_BGRA_R32_SHIFT   8
     #define SK_BGRA_A32_SHIFT   0
 #else
-    #define SK_ARGB_A32_SHIFT   0
-    #define SK_ARGB_R32_SHIFT   8
-    #define SK_ARGB_G32_SHIFT   16
-    #define SK_ARGB_B32_SHIFT   24
-
     #define SK_RGBA_R32_SHIFT   0
     #define SK_RGBA_G32_SHIFT   8
     #define SK_RGBA_B32_SHIFT   16
@@ -65,18 +54,10 @@
     #define SK_BGRA_A32_SHIFT   24
 #endif
 
-#if (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)) || \
-    (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_ARGB)) || \
-    (defined(SK_PMCOLOR_IS_BGRA) && defined(SK_PMCOLOR_IS_ARGB))
-    #error "can't define PMCOLOR to more than one byte order"
+#if defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)
+    #error "can't define PMCOLOR to be RGBA and BGRA"
 #endif
 
-#define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB  \
-    (SK_A32_SHIFT == SK_ARGB_A32_SHIFT &&    \
-     SK_R32_SHIFT == SK_ARGB_R32_SHIFT &&    \
-     SK_G32_SHIFT == SK_ARGB_G32_SHIFT &&    \
-     SK_B32_SHIFT == SK_ARGB_B32_SHIFT)
-
 #define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA  \
     (SK_A32_SHIFT == SK_RGBA_A32_SHIFT &&    \
      SK_R32_SHIFT == SK_RGBA_R32_SHIFT &&    \
@@ -95,10 +76,6 @@
 #define SK_G_INDEX  (SK_G32_SHIFT/8)
 #define SK_B_INDEX  (SK_B32_SHIFT/8)
 
-#if defined(SK_PMCOLOR_IS_ARGB) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
-    #error "SK_PMCOLOR_IS_ARGB does not match SK_*32_SHIFT values"
-#endif
-
 #if defined(SK_PMCOLOR_IS_RGBA) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
     #error "SK_PMCOLOR_IS_RGBA does not match SK_*32_SHIFT values"
 #endif
@@ -107,22 +84,19 @@
     #error "SK_PMCOLOR_IS_BGRA does not match SK_*32_SHIFT values"
 #endif
 
-#if !defined(SK_PMCOLOR_IS_ARGB) && !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
+#if !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
     // deduce which to define from the _SHIFT defines
 
-    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
-        #define SK_PMCOLOR_IS_ARGB
-    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
+    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
         #define SK_PMCOLOR_IS_RGBA
     #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
         #define SK_PMCOLOR_IS_BGRA
     #else
-        #error "need 32bit packing to be either ARGB, RGBA, or BGRA"
+        #error "need 32bit packing to be either RGBA or BGRA"
     #endif
 #endif
 
 // hide these now that we're done
-#undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
 
@@ -157,38 +131,19 @@ static inline uint32_t SkPackARGB_as_BGRA(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
            (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
 }
 
-static inline SkPMColor SkPackARGB_as_PMColor(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    SkASSERT_IS_BYTE(a);
-    SkASSERT_IS_BYTE(r);
-    SkASSERT_IS_BYTE(g);
-    SkASSERT_IS_BYTE(b);
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
-}
-
 static inline SkPMColor SkSwizzle_RGBA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_RGBA
     return c;
-#elif defined(SK_PMCOLOR_IS_BGRA)
-    return SkSwizzle_RB(c);
 #else
-    return SkPackARGB_as_PMColor((c >> SK_RGBA_A32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_R32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_G32_SHIFT) & 0xFF,
-                                 (c >> SK_RGBA_B32_SHIFT) & 0xFF);
+    return SkSwizzle_RB(c);
 #endif
 }
 
 static inline SkPMColor SkSwizzle_BGRA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_BGRA
     return c;
-#elif defined(SK_PMCOLOR_IS_RGBA)
-    return SkSwizzle_RB(c);
 #else
-    return SkPackARGB_as_PMColor((c >> SK_BGRA_A32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_R32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_G32_SHIFT) & 0xFF,
-                                 (c >> SK_BGRA_B32_SHIFT) & 0xFF);
+    return SkSwizzle_RB(c);
 #endif
 }
 
@@ -457,7 +412,8 @@ static inline SkPMColor SkPackARGB32(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
     SkASSERT(g <= a);
     SkASSERT(b <= a);
 
-    return SkPackARGB_as_PMColor(a, r, g, b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
 }
 
 static inline uint32_t SkPackPMColor_as_RGBA(SkPMColor c) {
@@ -591,7 +547,8 @@ static inline SkPMColor SkFastFourByteInterp(SkPMColor src,
  *  values are premultiplied in the debug version.
  */
 static inline SkPMColor SkPackARGB32NoCheck(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    return SkPackARGB_as_PMColor(a, r, g, b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
 }
 
 static inline

gfx/skia/skia/include/core/SkImageInfo.h

@@ -82,13 +82,8 @@ enum SkColorType {
     kN32_SkColorType = kBGRA_8888_SkColorType,
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
     kN32_SkColorType = kRGBA_8888_SkColorType,
-#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
-    // Big-endian PowerPC Mozilla surfaces use native uint32 ARGB memory.
-    // Moz2D's legacy A8R8G8B8_UINT32 format aliases to B8G8R8A8, so keep
-    // kN32 on Skia's BGRA path while the channel shifts above describe ARGB.
-    kN32_SkColorType = kBGRA_8888_SkColorType,
 #else
-    #error "SK_*32_SHIFT values must correspond to BGRA, RGBA, or Mozilla ARGB byte order"
+    #error "SK_*32_SHFIT values must correspond to BGRA or RGBA byte order"
 #endif
 };
 

gfx/skia/skia/include/gpu/GrTypes.h

@@ -275,19 +275,17 @@ enum GrPixelConfig {
 static const int kGrPixelConfigCnt = kLast_GrPixelConfig + 1;
 
 // Aliases for pixel configs that match skia's byte order.
+#ifndef SK_CPU_LENDIAN
+    #error "Skia gpu currently assumes little endian"
+#endif
 #if SK_PMCOLOR_BYTE_ORDER(B,G,R,A)
     static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
     static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
     static const GrPixelConfig kSkia8888_GrPixelConfig = kRGBA_8888_GrPixelConfig;
     static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSRGBA_8888_GrPixelConfig;
-#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
-    // Mozilla's big-endian PowerPC path stores native 32-bit pixels as ARGB,
-    // while Moz2D routes those surfaces through Skia's BGRA color type.
-    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
-    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #else
-    #error "SK_*32_SHIFT values must correspond to GL_BGRA, GL_RGBA, or Mozilla ARGB format."
+    #error "SK_*32_SHIFT values must correspond to GL_BGRA or GL_RGBA format."
 #endif
 
 // Returns true if the pixel config is a GPU-specific compressed format

gfx/skia/skia/src/codec/SkCodecPriv.h

@@ -306,11 +306,7 @@ static inline SkPMColor premultiply_argb_as_bgra(U8CPU a, U8CPU r, U8CPU g, U8CP
         b = SkMulDiv255Round(b, a);
     }
 
-#ifdef SK_PMCOLOR_IS_ARGB
-    return SkPackARGB_as_PMColor(a, r, g, b);
-#else
     return SkPackARGB_as_BGRA(a, r, g, b);
-#endif
 }
 
 static inline bool is_rgba(SkColorType colorType) {

gfx/skia/skia/src/core/SkPM4f.h

@@ -51,16 +51,10 @@ struct SkPM4f {
     Sk4f to4f_pmorder() const { return swizzle_rb_if_bgra(this->to4f()); }
 
     SkPMColor toPMColor() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-        Sk4f value = this->to4f();
-        Sk4b bytes = SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f));
-        return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
-#else
         Sk4f value = swizzle_rb_if_bgra(this->to4f());
         SkPMColor result;
         SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f)).store(&result);
         return result;
-#endif
     }
 
     void toF16(uint16_t[4]) const;

gfx/skia/skia/src/core/SkPM4fPriv.h

@@ -22,50 +22,29 @@ static inline float get_alpha(const Sk4f& px) {
 
 
 static inline Sk4f Sk4f_fromL32(uint32_t px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk4f(SkGetPackedR32(px), SkGetPackedG32(px),
-                SkGetPackedB32(px), SkGetPackedA32(px)) * (1/255.0f);
-#else
     return SkNx_cast<float>(Sk4b::Load(&px)) * (1/255.0f);
-#endif
 }
 
 static inline Sk4f Sk4f_fromS32(uint32_t px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return { sk_linear_from_srgb[SkGetPackedR32(px)],
-             sk_linear_from_srgb[SkGetPackedG32(px)],
-             sk_linear_from_srgb[SkGetPackedB32(px)],
-                    (1/255.0f) * SkGetPackedA32(px) };
-#else
     return { sk_linear_from_srgb[(px >>  0) & 0xff],
              sk_linear_from_srgb[(px >>  8) & 0xff],
              sk_linear_from_srgb[(px >> 16) & 0xff],
                     (1/255.0f) * (px >> 24)          };
-#endif
 }
 
 static inline uint32_t Sk4f_toL32(const Sk4f& px) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    Sk4b bytes = SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f));
-    return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
-#else
     uint32_t l32;
     SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f)).store(&l32);
     return l32;
-#endif
 }
 
 static inline uint32_t Sk4f_toS32(const Sk4f& px) {
     Sk4i  rgb = sk_linear_to_srgb(px),
          srgb = { rgb[0], rgb[1], rgb[2], (int)(255.0f * px[3] + 0.5f) };
 
-#ifdef SK_PMCOLOR_IS_ARGB
-    return SkPackARGB_as_PMColor(srgb[3], srgb[0], srgb[1], srgb[2]);
-#else
     uint32_t s32;
     SkNx_cast<uint8_t>(srgb).store(&s32);
     return s32;
-#endif
 }
 
 

gfx/skia/skia/src/core/SkTextBlob.cpp

@@ -121,10 +121,9 @@ SkDEBUGCODE(static const unsigned kRunRecordMagic = 0xb10bcafe;)
 namespace {
 struct RunRecordStorageEquivalent {
     RunFont  fFont;
-    uint32_t fCount;
     SkPoint  fOffset;
-    SkTextBlob::GlyphPositioning fPositioning;
-    bool     fExtended;
+    uint32_t fCount;
+    uint32_t fFlags;
     SkDEBUGCODE(unsigned fMagic;)
 };
 }

gfx/skia/skia/src/core/SkXfermode4f.cpp

@@ -44,25 +44,6 @@ static Sk4x4f load_4_srgb(const void* vptr) {
 
     Sk4x4f rgba;
 
-#ifdef SK_PMCOLOR_IS_ARGB
-    rgba.r = { sk_linear_from_srgb[SkGetPackedR32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedR32(ptr[3])] };
-
-    rgba.g = { sk_linear_from_srgb[SkGetPackedG32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedG32(ptr[3])] };
-
-    rgba.b = { sk_linear_from_srgb[SkGetPackedB32(ptr[0])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[1])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[2])],
-               sk_linear_from_srgb[SkGetPackedB32(ptr[3])] };
-
-    rgba.a = SkNx_cast<float>(Sk4i(SkGetPackedA32(ptr[0]), SkGetPackedA32(ptr[1]),
-                                   SkGetPackedA32(ptr[2]), SkGetPackedA32(ptr[3]))) * (1/255.0f);
-#else
     rgba.r = { sk_linear_from_srgb[(ptr[0] >>  0) & 0xff],
                sk_linear_from_srgb[(ptr[1] >>  0) & 0xff],
                sk_linear_from_srgb[(ptr[2] >>  0) & 0xff],
@@ -79,28 +60,15 @@ static Sk4x4f load_4_srgb(const void* vptr) {
                sk_linear_from_srgb[(ptr[3] >> 16) & 0xff] };
 
     rgba.a = SkNx_cast<float>((Sk4i::Load(ptr) >> 24) & 0xff) * (1/255.0f);
-#endif
 
     return rgba;
 }
 
 static void store_4_srgb(void* ptr, const Sk4x4f& p) {
-#ifdef SK_PMCOLOR_IS_ARGB
-    uint32_t* dst = (uint32_t*)ptr;
-    Sk4i r = sk_linear_to_srgb(p.r);
-    Sk4i g = sk_linear_to_srgb(p.g);
-    Sk4i b = sk_linear_to_srgb(p.b);
-    Sk4i a = Sk4f_round(255.0f*p.a);
-    dst[0] = SkPackARGB_as_PMColor(a[0], r[0], g[0], b[0]);
-    dst[1] = SkPackARGB_as_PMColor(a[1], r[1], g[1], b[1]);
-    dst[2] = SkPackARGB_as_PMColor(a[2], r[2], g[2], b[2]);
-    dst[3] = SkPackARGB_as_PMColor(a[3], r[3], g[3], b[3]);
-#else
     ( sk_linear_to_srgb(p.r) <<  0
     | sk_linear_to_srgb(p.g) <<  8
     | sk_linear_to_srgb(p.b) << 16
     | Sk4f_round(255.0f*p.a) << 24).store(ptr);
-#endif
 }
 
 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -423,7 +391,7 @@ SkXfermode::D32Proc SkXfermode::GetD32Proc(SkXfermode* xfer, uint32_t flags) {
 #include "SkColorPriv.h"
 
 static Sk4f lcd16_to_unit_4f(uint16_t rgb) {
-#if defined(SK_PMCOLOR_IS_RGBA) || defined(SK_PMCOLOR_IS_ARGB)
+#ifdef SK_PMCOLOR_IS_RGBA
     Sk4i rgbi = Sk4i(SkGetPackedR16(rgb), SkGetPackedG16(rgb), SkGetPackedB16(rgb), 0);
 #else
     Sk4i rgbi = Sk4i(SkGetPackedB16(rgb), SkGetPackedG16(rgb), SkGetPackedR16(rgb), 0);

gfx/skia/skia/src/gpu/GrDrawTarget.cpp

@@ -251,7 +251,7 @@ bool GrDrawTarget::drawBatches(GrBatchFlushState* flushState) {
             if (currentRT) {
                 static const GrGpuCommandBuffer::LoadAndStoreInfo kBasicLoadStoreInfo
                     { GrGpuCommandBuffer::LoadOp::kLoad,GrGpuCommandBuffer::StoreOp::kStore,
-                      static_cast<GrColor>(GrColor_ILLEGAL) };
+                      GrColor_ILLEGAL };
                 commandBuffer.reset(fGpu->createCommandBuffer(currentRT,
                                                               kBasicLoadStoreInfo,   // Color
                                                               kBasicLoadStoreInfo)); // Stencil

gfx/skia/skia/src/opts/Sk4px_none.h

@@ -69,18 +69,11 @@ inline Sk4px Sk4px::Wide::div255() const {
 }
 
 inline Sk4px Sk4px::alphas() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b((*this)[ 0], (*this)[ 0], (*this)[ 0], (*this)[ 0],
-                 (*this)[ 4], (*this)[ 4], (*this)[ 4], (*this)[ 4],
-                 (*this)[ 8], (*this)[ 8], (*this)[ 8], (*this)[ 8],
-                 (*this)[12], (*this)[12], (*this)[12], (*this)[12]);
-#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b((*this)[ 3], (*this)[ 3], (*this)[ 3], (*this)[ 3],
                  (*this)[ 7], (*this)[ 7], (*this)[ 7], (*this)[ 7],
                  (*this)[11], (*this)[11], (*this)[11], (*this)[11],
                  (*this)[15], (*this)[15], (*this)[15], (*this)[15]);
-#endif
 }
 
 inline Sk4px Sk4px::Load4Alphas(const SkAlpha a[4]) {
@@ -98,33 +91,19 @@ inline Sk4px Sk4px::Load2Alphas(const SkAlpha a[2]) {
 }
 
 inline Sk4px Sk4px::zeroAlphas() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b(0, (*this)[ 1], (*this)[ 2], (*this)[ 3],
-                 0, (*this)[ 5], (*this)[ 6], (*this)[ 7],
-                 0, (*this)[ 9], (*this)[10], (*this)[11],
-                 0, (*this)[13], (*this)[14], (*this)[15]);
-#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b((*this)[ 0], (*this)[ 1], (*this)[ 2], 0,
                  (*this)[ 4], (*this)[ 5], (*this)[ 6], 0,
                  (*this)[ 8], (*this)[ 9], (*this)[10], 0,
                  (*this)[12], (*this)[13], (*this)[14], 0);
-#endif
 }
 
 inline Sk4px Sk4px::zeroColors() const {
-#ifdef SK_PMCOLOR_IS_ARGB
-    return Sk16b((*this)[ 0], 0,0,0,
-                 (*this)[ 4], 0,0,0,
-                 (*this)[ 8], 0,0,0,
-                 (*this)[12], 0,0,0);
-#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b(0,0,0, (*this)[ 3],
                  0,0,0, (*this)[ 7],
                  0,0,0, (*this)[11],
                  0,0,0, (*this)[15]);
-#endif
 }
 
 }  // namespace

gfx/skia/skia/src/opts/SkColorCubeFilter_opts.h

@@ -72,10 +72,6 @@ static void color_cube_filter_span(const SkPMColor src[],
         // color is BGRA (SkColor order), dst is SkPMColor order, so may need to swap R+B.
     #if defined(SK_PMCOLOR_IS_RGBA)
         color = SkNx_shuffle<2,1,0,3>(color);
-    #elif defined(SK_PMCOLOR_IS_ARGB)
-        Sk4b bytes = SkNx_cast<uint8_t>(color);
-        dst[i] = SkPackARGB32NoCheck(a, bytes[2], bytes[1], bytes[0]);
-        continue;
     #endif
         uint8_t* dstBytes = (uint8_t*)(dst+i);
         SkNx_cast<uint8_t>(color).store(dstBytes);

gfx/skia/skia/src/ports/SkFontHost_mac.cpp

@@ -73,39 +73,7 @@ static CFArrayRef SkCTFontManagerCopyAvailableFontFamilyNames() {
 #ifdef SK_BUILD_FOR_IOS
     return CFArrayCreate(nullptr, nullptr, 0, nullptr);
 #else
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
     return CTFontManagerCopyAvailableFontFamilyNames();
-#else
-    CFMutableArrayRef familyNames =
-            CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
-    if (!familyNames) {
-        return nullptr;
-    }
-
-    ATSFontFamilyIterator iterator;
-    OSStatus status = ATSFontFamilyIteratorCreate(kATSFontContextGlobal,
-                                                  nullptr,
-                                                  nullptr,
-                                                  kATSOptionFlagsDefaultScope,
-                                                  &iterator);
-    if (status != noErr) {
-        CFRelease(familyNames);
-        return nullptr;
-    }
-
-    ATSFontFamilyRef family;
-    while (ATSFontFamilyIteratorNext(iterator, &family) == noErr) {
-        CFStringRef familyName = nullptr;
-        if (ATSFontFamilyGetName(family, kATSOptionFlagsDefault, &familyName) == noErr &&
-            familyName) {
-            CFArrayAppendValue(familyNames, familyName);
-            CFRelease(familyName);
-        }
-    }
-
-    ATSFontFamilyIteratorRelease(&iterator);
-    return familyNames;
-#endif
 #endif
 }
 
@@ -940,7 +908,6 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
 
         // Skia handles quantization and subpixel positioning,
         // so disable quantization and enabe subpixel positioning in CG.
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
         CGContextSetAllowsFontSubpixelQuantization(fCG, false);
         CGContextSetShouldSubpixelQuantizeFonts(fCG, false);
 
@@ -949,7 +916,6 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
         // then CG cannot draw the glyph in the correct location without subpixel positioning.
         CGContextSetAllowsFontSubpixelPositioning(fCG, true);
         CGContextSetShouldSubpixelPositionFonts(fCG, true);
-#endif
 
         CGContextSetTextDrawingMode(fCG, kCGTextFill);
 
@@ -1005,13 +971,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
     // So always make the font transform identity and place the transform on the context.
     point = CGPointApplyAffineTransform(point, context.fInvTransform);
 
-#if defined(MAC_OS_X_VERSION_10_7) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7)
     CTFontDrawGlyphs(context.fCTFont, &glyphID, &point, 1, fCG);
-#else
-    CGContextSetFont(fCG, CTFontCopyGraphicsFont(context.fCTFont, NULL));
-    CGContextSetFontSize(fCG, CTFontGetSize(context.fCTFont));
-    CGContextShowGlyphsAtPositions(fCG, &glyphID, &point, 1);
-#endif
 
     SkASSERT(rowBytesPtr);
     *rowBytesPtr = rowBytes;
@@ -1722,7 +1682,6 @@ SkAdvancedTypefaceMetrics* SkTypeface_Mac::onGetAdvancedTypefaceMetrics(
 
 static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
     CTFontRef ctFont = typeface->fFontRef.get();
-#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
     AutoCFRelease<CFNumberRef> fontFormatRef(
             static_cast<CFNumberRef>(CTFontCopyAttribute(ctFont, kCTFontFormatAttribute)));
     if (!fontFormatRef) {
@@ -1752,35 +1711,6 @@ static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
             //Just the presence of the FontForge 'FFTM' table seems to throw it off.
             return SkSFNTHeader::fontType_WindowsTrueType::TAG;
     }
-#else
-    AutoCFRelease<CFStringRef> postScriptName(CTFontCopyPostScriptName(ctFont));
-    if (!postScriptName) {
-        return 0;
-    }
-
-    ATSFontRef atsFont =
-            ATSFontFindFromPostScriptName(postScriptName, kATSOptionFlagsDefault);
-    if (atsFont == kInvalidFont) {
-        return 0;
-    }
-
-    SkSFNTHeader header;
-    ByteCount headerSize = sizeof(header);
-    if (ATSFontGetTableDirectory(atsFont, headerSize, &header, &headerSize) != noErr ||
-        headerSize < sizeof(header.fontType)) {
-        return 0;
-    }
-
-    switch (header.fontType) {
-        case SkSFNTHeader::fontType_OpenTypeCFF::TAG:
-        case SkSFNTHeader::fontType_WindowsTrueType::TAG:
-        case SkSFNTHeader::fontType_MacTrueType::TAG:
-        case SkSFNTHeader::fontType_PostScript::TAG:
-            return header.fontType;
-        default:
-            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
-    }
-#endif
 }
 
 SkStreamAsset* SkTypeface_Mac::onOpenStream(int* ttcIndex) const {

gfx/thebes/gfxFcPlatformFontList.cpp

@@ -32,6 +32,9 @@
 #include <gdk/gdk.h>
 #include "gfxPlatformGtk.h"
 #endif
+#ifdef MOZ_WIDGET_HEADLESS
+#include "gfxPlatformHeadless.h"
+#endif
 
 #ifdef MOZ_X11
 #include "mozilla/X11Util.h"
@@ -1764,7 +1767,11 @@ gfxFcPlatformFontList::FindGenericFamilies(const nsAString& aGeneric,
 
     // -- select the fonts to be used for the generic
     prefFonts = new PrefFontList; // can be empty but in practice won't happen
+#ifdef MOZ_WIDGET_HEADLESS
+    uint32_t limit = gfxPlatformHeadless::GetPlatform()->MaxGenericSubstitions();
+#else
     uint32_t limit = gfxPlatformGtk::GetPlatform()->MaxGenericSubstitions();
+#endif
     bool foundFontWithLang = false;
     for (int i = 0; i < faces->nfont; i++) {
         FcPattern* font = faces->fonts[i];

gfx/thebes/gfxGraphiteShaper.cpp

@@ -336,20 +336,7 @@ gfxGraphiteShaper::SetGlyphsFromSegment(DrawTarget      *aDrawTarget,
             // not a one-to-one mapping with simple metrics: use DetailedGlyph
             AutoTArray<gfxShapedText::DetailedGlyph,8> details;
             float clusterLoc;
-
-            uint32_t glyph_start = c.baseGlyph;
-            uint32_t glyph_end = glyph_start + c.nGlyphs;
-            if (glyph_end < glyph_start) {
-                return NS_ERROR_ILLEGAL_VALUE;
-            }
-            if (glyph_end - glyph_start > 0xFFFF) {
-                return NS_ERROR_ILLEGAL_VALUE;
-            }
-            if (!details.SetCapacity(glyph_end - glyph_start, fallible)) {
-                return NS_ERROR_OUT_OF_MEMORY;
-            }
-
-            for (uint32_t j = glyph_start; j < glyph_end; ++j) {
+            for (uint32_t j = c.baseGlyph; j < c.baseGlyph + c.nGlyphs; ++j) {
                 gfxShapedText::DetailedGlyph* d = details.AppendElement();
                 d->mGlyphID = gids[j];
                 d->mYOffset = roundY ? NSToIntRound(-yLocs[j]) * dev2appUnits :

gfx/thebes/gfxPlatform.cpp

@@ -40,6 +40,8 @@
 #elif defined(XP_MACOSX)
 #include "gfxPlatformMac.h"
 #include "gfxQuartzSurface.h"
+#elif defined(MOZ_WIDGET_HEADLESS)
+#include "gfxPlatformHeadless.h"
 #elif defined(MOZ_WIDGET_GTK)
 #include "gfxPlatformGtk.h"
 #elif defined(ANDROID)
@@ -572,6 +574,8 @@ gfxPlatform::Init()
     gPlatform = new gfxWindowsPlatform;
 #elif defined(XP_MACOSX)
     gPlatform = new gfxPlatformMac;
+#elif defined(MOZ_WIDGET_HEADLESS)
+    gPlatform = new gfxPlatformHeadless;
 #elif defined(MOZ_WIDGET_GTK)
     gPlatform = new gfxPlatformGtk;
 #elif defined(ANDROID)
@@ -2166,6 +2170,13 @@ gfxPlatform::UsesOffMainThreadCompositing()
     result |= gfxPrefs::LayersAccelerationForceEnabledDoNotUseDirectly();
 
 #endif
+    // Jihad Browser: the headless BrowserServer embedder has no compositor
+    // process; allow forcing off-main-thread compositing off (use the in-process
+    // BasicLayerManager) via env, since the gfxPrefs "Once" snapshot can miss a
+    // grepref set during XRE_InitEmbedding2 init ordering.
+    if (getenv("JIHAD_DISABLE_OMTC")) {
+      result = false;
+    }
     firstTime = false;
   }
 

gfx/thebes/gfxPlatformGtk.cpp

@@ -72,7 +72,17 @@ static cairo_user_data_key_t cairo_gdk_drawable_key;
 
 gfxPlatformGtk::gfxPlatformGtk()
 {
-    gtk_init(nullptr, nullptr);
+    // Jihad: in JIHAD_OFFSCREEN (headless daemon) mode there is no X server on the
+    // device. gtk_init() calls exit() if it cannot open a display; gtk_init_check()
+    // returns false instead and leaves GTK usable for the non-X paths (fontconfig/
+    // freetype font list, image/CPU surfaces via the BasicLayerManager). The X code
+    // below is already guarded by GDK_IS_X11_DISPLAY(gdk_display_get_default()),
+    // which is false with no display, so it is skipped cleanly.
+    if (getenv("JIHAD_OFFSCREEN")) {
+        gtk_init_check(nullptr, nullptr);
+    } else {
+        gtk_init(nullptr, nullptr);
+    }
 
     mMaxGenericSubstitutions = UNINITIALIZED_VALUE;
 
@@ -325,8 +335,10 @@ gfxPlatformGtk::GetDPI()
     if (!sDPI) {
         // Make sure init is run so we have a resolution
         GdkScreen *screen = gdk_screen_get_default();
-        gtk_settings_get_for_screen(screen);
-        sDPI = int32_t(round(gdk_screen_get_resolution(screen)));
+        if (screen) {                       // null when headless (no X display)
+            gtk_settings_get_for_screen(screen);
+            sDPI = int32_t(round(gdk_screen_get_resolution(screen)));
+        }
         if (sDPI <= 0) {
             // Fall back to something sane
             sDPI = 96;

gfx/thebes/gfxPlatformHeadless.cpp

@@ -0,0 +1,834 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#define PANGO_ENABLE_BACKEND
+#define PANGO_ENABLE_ENGINE
+
+#include "gfxPlatformHeadless.h"
+#include "prenv.h"
+
+#include "nsUnicharUtils.h"
+#include "nsUnicodeProperties.h"
+#include "gfx2DGlue.h"
+#include "gfxFcPlatformFontList.h"
+#include "gfxConfig.h"
+#include "gfxContext.h"
+#include "gfxUserFontSet.h"
+#include "gfxUtils.h"
+#include "gfxFT2FontBase.h"
+#include "gfxPrefs.h"
+#include "gfxTextRun.h"
+#include "VsyncSource.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/Monitor.h"
+#include "base/task.h"
+#include "base/thread.h"
+#include "base/message_loop.h"
+#include "mozilla/gfx/Logging.h"
+
+#include "mozilla/gfx/2D.h"
+
+#include "cairo.h"
+
+
+#include "gfxImageSurface.h"
+#include "mozilla/Preferences.h"
+#ifdef MOZ_X11
+
+#include "gfxXlibSurface.h"
+#include "cairo-xlib.h"
+#include "mozilla/X11Util.h"
+
+#ifdef GL_PROVIDER_GLX
+#include "GLContextProvider.h"
+#include "GLContextGLX.h"
+#include "GLXLibrary.h"
+#endif
+
+/* Undefine the Status from Xlib since it will conflict with system headers on OSX */
+#if defined(__APPLE__) && defined(Status)
+#undef Status
+#endif
+
+#endif /* MOZ_X11 */
+
+#include <fontconfig/fontconfig.h>
+
+#include "nsMathUtils.h"
+
+#define GDK_PIXMAP_SIZE_MAX 32767
+
+#define GFX_PREF_MAX_GENERIC_SUBSTITUTIONS "gfx.font_rendering.fontconfig.max_generic_substitutions"
+
+using namespace mozilla;
+using namespace mozilla::gfx;
+using namespace mozilla::unicode;
+
+#if (MOZ_WIDGET_GTK == 2)
+static cairo_user_data_key_t cairo_gdk_drawable_key;
+#endif
+
+gfxPlatformHeadless::gfxPlatformHeadless()
+{
+    // Jihad: in JIHAD_OFFSCREEN (headless daemon) mode there is no X server on the
+    // device. gtk_init() calls exit() if it cannot open a display; gtk_init_check()
+    // returns false instead and leaves GTK usable for the non-X paths (fontconfig/
+    // freetype font list, image/CPU surfaces via the BasicLayerManager). The X code
+    // below is already guarded by GDK_IS_X11_DISPLAY(gdk_display_get_default()),
+    // which is false with no display, so it is skipped cleanly.
+    /* headless: no gtk_init */
+
+    mMaxGenericSubstitutions = UNINITIALIZED_VALUE;
+
+#ifdef MOZ_X11
+    if (XRE_IsParentProcess()) {
+      if (GDK_IS_X11_DISPLAY(gdk_display_get_default()) &&
+          mozilla::Preferences::GetBool("gfx.xrender.enabled"))
+      {
+          gfxVars::SetUseXRender(true);
+      }
+    }
+#endif
+
+    uint32_t canvasMask = BackendTypeBit(BackendType::CAIRO);
+    uint32_t contentMask = BackendTypeBit(BackendType::CAIRO);
+#ifdef USE_SKIA
+    canvasMask |= BackendTypeBit(BackendType::SKIA);
+    contentMask |= BackendTypeBit(BackendType::SKIA);
+#endif
+    InitBackendPrefs(canvasMask, BackendType::CAIRO,
+                     contentMask, BackendType::CAIRO);
+
+#ifdef MOZ_X11
+    if (GDK_IS_X11_DISPLAY(gdk_display_get_default())) {
+      mCompositorDisplay = XOpenDisplay(nullptr);
+      MOZ_ASSERT(mCompositorDisplay, "Failed to create compositor display!");
+    } else {
+      mCompositorDisplay = nullptr;
+    }
+#endif // MOZ_X11
+}
+
+gfxPlatformHeadless::~gfxPlatformHeadless()
+{
+#ifdef MOZ_X11
+    if (mCompositorDisplay) {
+      XCloseDisplay(mCompositorDisplay);
+    }
+#endif // MOZ_X11
+}
+
+void
+gfxPlatformHeadless::FlushContentDrawing()
+{
+#ifdef MOZ_X11
+    if (gfxVars::UseXRender()) {
+        XFlush(DefaultXDisplay());
+    }
+#endif
+}
+
+already_AddRefed<gfxASurface>
+gfxPlatformHeadless::CreateOffscreenSurface(const IntSize& aSize,
+                                       gfxImageFormat aFormat)
+{
+    if (!Factory::AllowedSurfaceSize(aSize)) {
+        return nullptr;
+    }
+
+    RefPtr<gfxASurface> newSurface;
+    bool needsClear = true;
+#ifdef MOZ_X11
+    // XXX we really need a different interface here, something that passes
+    // in more context, including the display and/or target surface type that
+    // we should try to match
+    GdkScreen *gdkScreen = gdk_screen_get_default();
+    if (gdkScreen) {
+        // When forcing PaintedLayers to use image surfaces for content,
+        // force creation of gfxImageSurface surfaces.
+        if (gfxVars::UseXRender()) {
+            Screen *screen = gdk_x11_screen_get_xscreen(gdkScreen);
+            XRenderPictFormat* xrenderFormat =
+                gfxXlibSurface::FindRenderFormat(DisplayOfScreen(screen),
+                                                 aFormat);
+
+            if (xrenderFormat) {
+                newSurface = gfxXlibSurface::Create(screen, xrenderFormat,
+                                                    aSize);
+            }
+        }
+    }
+#endif
+
+    if (!newSurface) {
+        // We couldn't create a native surface for whatever reason;
+        // e.g., no display, no RENDER, bad size, etc.
+        // Fall back to image surface for the data.
+        newSurface = new gfxImageSurface(aSize, aFormat);
+
+        // The gfxImageSurface ctor zeroes this for us, no need to
+        // waste time clearing again
+        needsClear = false;
+    }
+
+    if (newSurface->CairoStatus()) {
+        newSurface = nullptr; // surface isn't valid for some reason
+    }
+
+    if (newSurface && needsClear) {
+        gfxUtils::ClearThebesSurface(newSurface);
+    }
+
+    return newSurface.forget();
+}
+
+nsresult
+gfxPlatformHeadless::GetFontList(nsIAtom *aLangGroup,
+                            const nsACString& aGenericFamily,
+                            nsTArray<nsString>& aListOfFonts)
+{
+    gfxPlatformFontList::PlatformFontList()->GetFontList(aLangGroup,
+                                                         aGenericFamily,
+                                                         aListOfFonts);
+    return NS_OK;
+}
+
+nsresult
+gfxPlatformHeadless::UpdateFontList()
+{
+    gfxPlatformFontList::PlatformFontList()->UpdateFontList();
+    return NS_OK;
+}
+
+// xxx - this is ubuntu centric, need to go through other distros and flesh
+// out a more general list
+static const char kFontDejaVuSans[] = "DejaVu Sans";
+static const char kFontDejaVuSerif[] = "DejaVu Serif";
+static const char kFontFreeSans[] = "FreeSans";
+static const char kFontFreeSerif[] = "FreeSerif";
+static const char kFontTakaoPGothic[] = "TakaoPGothic";
+static const char kFontTwemojiMozilla[] = "Twemoji Mozilla";
+static const char kFontDroidSansFallback[] = "Droid Sans Fallback";
+static const char kFontWenQuanYiMicroHei[] = "WenQuanYi Micro Hei";
+static const char kFontNanumGothic[] = "NanumGothic";
+
+void
+gfxPlatformHeadless::GetCommonFallbackFonts(uint32_t aCh, uint32_t aNextCh,
+                                       Script aRunScript,
+                                       nsTArray<const char*>& aFontList)
+{
+    EmojiPresentation emoji = GetEmojiPresentation(aCh);
+    EmojiPresentation eNext = GetEmojiPresentation(aNextCh, true);
+    if (aNextCh != kVariationSelector15 &&
+        emoji != EmojiPresentation::TextOnly &&
+        (emoji != EmojiPresentation::TextDefault ||
+         eNext == EmojiPresentation::EmojiComponent)) {
+        aFontList.AppendElement(kFontTwemojiMozilla);
+    }
+
+    aFontList.AppendElement(kFontDejaVuSerif);
+    aFontList.AppendElement(kFontFreeSerif);
+    aFontList.AppendElement(kFontDejaVuSans);
+    aFontList.AppendElement(kFontFreeSans);
+
+    // add fonts for CJK ranges
+    // xxx - this isn't really correct, should use the same CJK font ordering
+    // as the pref font code
+    if (aCh >= 0x3000 &&
+        ((aCh < 0xe000) ||
+         (aCh >= 0xf900 && aCh < 0xfff0) ||
+         ((aCh >> 16) == 2))) {
+        aFontList.AppendElement(kFontTakaoPGothic);
+        aFontList.AppendElement(kFontDroidSansFallback);
+        aFontList.AppendElement(kFontWenQuanYiMicroHei);
+        aFontList.AppendElement(kFontNanumGothic);
+    }
+}
+
+gfxPlatformFontList*
+gfxPlatformHeadless::CreatePlatformFontList()
+{
+    gfxPlatformFontList* list = new gfxFcPlatformFontList();
+    if (NS_SUCCEEDED(list->InitFontList())) {
+        return list;
+    }
+    gfxPlatformFontList::Shutdown();
+    return nullptr;
+}
+
+nsresult
+gfxPlatformHeadless::GetStandardFamilyName(const nsAString& aFontName, nsAString& aFamilyName)
+{
+    gfxPlatformFontList::PlatformFontList()->
+        GetStandardFamilyName(aFontName, aFamilyName);
+    return NS_OK;
+}
+
+gfxFontGroup *
+gfxPlatformHeadless::CreateFontGroup(const FontFamilyList& aFontFamilyList,
+                                const gfxFontStyle* aStyle,
+                                gfxTextPerfMetrics* aTextPerf,
+                                gfxUserFontSet* aUserFontSet,
+                                gfxFloat aDevToCssSize)
+{
+    return new gfxFontGroup(aFontFamilyList, aStyle, aTextPerf,
+                            aUserFontSet, aDevToCssSize);
+}
+
+gfxFontEntry*
+gfxPlatformHeadless::LookupLocalFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                uint8_t aStyle)
+{
+    gfxPlatformFontList* pfl = gfxPlatformFontList::PlatformFontList();
+    return pfl->LookupLocalFont(aFontName, aWeight, aStretch,
+                                aStyle);
+}
+
+gfxFontEntry*
+gfxPlatformHeadless::MakePlatformFont(const nsAString& aFontName,
+                                 uint16_t aWeight,
+                                 int16_t aStretch,
+                                 uint8_t aStyle,
+                                 const uint8_t* aFontData,
+                                 uint32_t aLength)
+{
+    gfxPlatformFontList* pfl = gfxPlatformFontList::PlatformFontList();
+    return pfl->MakePlatformFont(aFontName, aWeight, aStretch,
+                                 aStyle, aFontData, aLength);
+}
+
+bool
+gfxPlatformHeadless::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
+{
+    // check for strange format flags
+    NS_ASSERTION(!(aFormatFlags & gfxUserFontSet::FLAG_FORMAT_NOT_USED),
+                 "strange font format hint set");
+
+    // accept supported formats
+    // Pango doesn't apply features from AAT TrueType extensions.
+    // Assume that if this is the only SFNT format specified,
+    // then AAT extensions are required for complex script support.
+    if (aFormatFlags & gfxUserFontSet::FLAG_FORMATS_COMMON) {
+        return true;
+    }
+
+    // reject all other formats, known and unknown
+    if (aFormatFlags != 0) {
+        return false;
+    }
+
+    // no format hint set, need to look at data
+    return true;
+}
+
+static int32_t sDPI = 0;
+
+int32_t
+gfxPlatformHeadless::GetDPI()
+{
+    if (!sDPI) {
+        // Make sure init is run so we have a resolution
+        sDPI = 96;
+if (sDPI <= 0) {
+            // Fall back to something sane
+            sDPI = 96;
+        }
+    }
+    return sDPI;
+}
+
+double
+gfxPlatformHeadless::GetDPIScale()
+{
+    // Integer scale factors work well with GTK window scaling, image scaling,
+    // and pixel alignment, but there is a range where 1 is too small and 2 is
+    // too big.  An additional step of 1.5 is added because this is common
+    // scale on WINNT and at this ratio the advantages of larger rendering
+    // outweigh the disadvantages from scaling and pixel mis-alignment.
+    int32_t dpi = GetDPI();
+    if (dpi < 144) {
+        return 1.0;
+    } else if (dpi < 168) {
+        return 1.5;
+    } else {
+        return round(dpi/96.0);
+    }
+}
+
+bool
+gfxPlatformHeadless::UseImageOffscreenSurfaces()
+{
+    return GetDefaultContentBackend() != mozilla::gfx::BackendType::CAIRO ||
+           gfxPrefs::UseImageOffscreenSurfaces();
+}
+
+gfxImageFormat
+gfxPlatformHeadless::GetOffscreenFormat()
+{
+    // Make sure there is a screen
+    
+
+    return SurfaceFormat::X8R8G8B8_UINT32;
+}
+
+void gfxPlatformHeadless::FontsPrefsChanged(const char *aPref)
+{
+    // only checking for generic substitions, pass other changes up
+    if (strcmp(GFX_PREF_MAX_GENERIC_SUBSTITUTIONS, aPref)) {
+        gfxPlatform::FontsPrefsChanged(aPref);
+        return;
+    }
+
+    mMaxGenericSubstitutions = UNINITIALIZED_VALUE;
+    gfxFcPlatformFontList* pfl = gfxFcPlatformFontList::PlatformFontList();
+    pfl->ClearGenericMappings();
+    FlushFontAndWordCaches();
+}
+
+uint32_t gfxPlatformHeadless::MaxGenericSubstitions()
+{
+    if (mMaxGenericSubstitutions == UNINITIALIZED_VALUE) {
+        mMaxGenericSubstitutions =
+            Preferences::GetInt(GFX_PREF_MAX_GENERIC_SUBSTITUTIONS, 3);
+        if (mMaxGenericSubstitutions < 0) {
+            mMaxGenericSubstitutions = 3;
+        }
+    }
+
+    return uint32_t(mMaxGenericSubstitutions);
+}
+
+void
+gfxPlatformHeadless::GetPlatformCMSOutputProfile(void *&mem, size_t &size)
+{
+    mem = nullptr;
+    size = 0;
+
+#ifdef MOZ_X11
+    GdkDisplay *display = gdk_display_get_default();
+    if (!GDK_IS_X11_DISPLAY(display))
+        return;
+
+    const char EDID1_ATOM_NAME[] = "XFree86_DDC_EDID1_RAWDATA";
+    const char ICC_PROFILE_ATOM_NAME[] = "_ICC_PROFILE";
+
+    Atom edidAtom, iccAtom;
+    Display *dpy = GDK_DISPLAY_XDISPLAY(display);
+    // In xpcshell tests, we never initialize X and hence don't have a Display.
+    // In this case, there's no output colour management to be done, so we just
+    // return with nullptr.
+    if (!dpy)
+        return;
+
+    Window root = gdk_x11_get_default_root_xwindow();
+
+    Atom retAtom;
+    int retFormat;
+    unsigned long retLength, retAfter;
+    unsigned char *retProperty ;
+
+    iccAtom = XInternAtom(dpy, ICC_PROFILE_ATOM_NAME, TRUE);
+    if (iccAtom) {
+        // read once to get size, once for the data
+        if (Success == XGetWindowProperty(dpy, root, iccAtom,
+                                          0, INT_MAX /* length */,
+                                          False, AnyPropertyType,
+                                          &retAtom, &retFormat, &retLength,
+                                          &retAfter, &retProperty)) {
+
+            if (retLength > 0) {
+                void *buffer = malloc(retLength);
+                if (buffer) {
+                    memcpy(buffer, retProperty, retLength);
+                    mem = buffer;
+                    size = retLength;
+                }
+            }
+
+            XFree(retProperty);
+            if (size > 0) {
+#ifdef DEBUG_tor
+                fprintf(stderr,
+                        "ICM profile read from %s successfully\n",
+                        ICC_PROFILE_ATOM_NAME);
+#endif
+                return;
+            }
+        }
+    }
+
+    edidAtom = XInternAtom(dpy, EDID1_ATOM_NAME, TRUE);
+    if (edidAtom) {
+        if (Success == XGetWindowProperty(dpy, root, edidAtom, 0, 32,
+                                          False, AnyPropertyType,
+                                          &retAtom, &retFormat, &retLength,
+                                          &retAfter, &retProperty)) {
+            double gamma;
+            qcms_CIE_xyY whitePoint;
+            qcms_CIE_xyYTRIPLE primaries;
+
+            if (retLength != 128) {
+#ifdef DEBUG_tor
+                fprintf(stderr, "Short EDID data\n");
+#endif
+                return;
+            }
+
+            // Format documented in "VESA E-EDID Implementation Guide"
+
+            gamma = (100 + retProperty[0x17]) / 100.0;
+            whitePoint.x = ((retProperty[0x21] << 2) |
+                            (retProperty[0x1a] >> 2 & 3)) / 1024.0;
+            whitePoint.y = ((retProperty[0x22] << 2) |
+                            (retProperty[0x1a] >> 0 & 3)) / 1024.0;
+            whitePoint.Y = 1.0;
+
+            primaries.red.x = ((retProperty[0x1b] << 2) |
+                               (retProperty[0x19] >> 6 & 3)) / 1024.0;
+            primaries.red.y = ((retProperty[0x1c] << 2) |
+                               (retProperty[0x19] >> 4 & 3)) / 1024.0;
+            primaries.red.Y = 1.0;
+
+            primaries.green.x = ((retProperty[0x1d] << 2) |
+                                 (retProperty[0x19] >> 2 & 3)) / 1024.0;
+            primaries.green.y = ((retProperty[0x1e] << 2) |
+                                 (retProperty[0x19] >> 0 & 3)) / 1024.0;
+            primaries.green.Y = 1.0;
+
+            primaries.blue.x = ((retProperty[0x1f] << 2) |
+                               (retProperty[0x1a] >> 6 & 3)) / 1024.0;
+            primaries.blue.y = ((retProperty[0x20] << 2) |
+                               (retProperty[0x1a] >> 4 & 3)) / 1024.0;
+            primaries.blue.Y = 1.0;
+
+            XFree(retProperty);
+
+#ifdef DEBUG_tor
+            fprintf(stderr, "EDID gamma: %f\n", gamma);
+            fprintf(stderr, "EDID whitepoint: %f %f %f\n",
+                    whitePoint.x, whitePoint.y, whitePoint.Y);
+            fprintf(stderr, "EDID primaries: [%f %f %f] [%f %f %f] [%f %f %f]\n",
+                    primaries.Red.x, primaries.Red.y, primaries.Red.Y,
+                    primaries.Green.x, primaries.Green.y, primaries.Green.Y,
+                    primaries.Blue.x, primaries.Blue.y, primaries.Blue.Y);
+#endif
+
+            qcms_data_create_rgb_with_gamma(whitePoint, primaries, gamma, &mem, &size);
+
+#ifdef DEBUG_tor
+            if (size > 0) {
+                fprintf(stderr,
+                        "ICM profile read from %s successfully\n",
+                        EDID1_ATOM_NAME);
+            }
+#endif
+        }
+    }
+#endif
+}
+
+
+#if (MOZ_WIDGET_GTK == 2)
+void
+gfxPlatformHeadless::SetGdkDrawable(cairo_surface_t *target,
+                               GdkDrawable *drawable)
+{
+    if (cairo_surface_status(target))
+        return;
+
+    g_object_ref(drawable);
+
+    cairo_surface_set_user_data (target,
+                                 &cairo_gdk_drawable_key,
+                                 drawable,
+                                 g_object_unref);
+}
+
+GdkDrawable *
+gfxPlatformHeadless::GetGdkDrawable(cairo_surface_t *target)
+{
+    if (cairo_surface_status(target))
+        return nullptr;
+
+    GdkDrawable *result;
+
+    result = (GdkDrawable*) cairo_surface_get_user_data (target,
+                                                         &cairo_gdk_drawable_key);
+    if (result)
+        return result;
+
+#ifdef MOZ_X11
+    if (cairo_surface_get_type(target) != CAIRO_SURFACE_TYPE_XLIB)
+        return nullptr;
+
+    // try looking it up in gdk's table
+    result = (GdkDrawable*) gdk_xid_table_lookup(cairo_xlib_surface_get_drawable(target));
+    if (result) {
+        SetGdkDrawable(target, result);
+        return result;
+    }
+#endif
+
+    return nullptr;
+}
+#endif
+
+#ifdef GL_PROVIDER_GLX
+
+class GLXVsyncSource final : public VsyncSource
+{
+public:
+  GLXVsyncSource()
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    mGlobalDisplay = new GLXDisplay();
+  }
+
+  virtual ~GLXVsyncSource()
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+  }
+
+  virtual Display& GetGlobalDisplay() override
+  {
+    return *mGlobalDisplay;
+  }
+
+  class GLXDisplay final : public VsyncSource::Display
+  {
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GLXDisplay)
+
+  public:
+    GLXDisplay() : mGLContext(nullptr)
+                 , mXDisplay(nullptr)
+                 , mSetupLock("GLXVsyncSetupLock")
+                 , mVsyncThread("GLXVsyncThread")
+                 , mVsyncTask(nullptr)
+                 , mVsyncEnabledLock("GLXVsyncEnabledLock")
+                 , mVsyncEnabled(false)
+    {
+    }
+
+    // Sets up the display's GL context on a worker thread.
+    // Required as GLContexts may only be used by the creating thread.
+    // Returns true if setup was a success.
+    bool Setup()
+    {
+      MonitorAutoLock lock(mSetupLock);
+      MOZ_ASSERT(NS_IsMainThread());
+      if (!mVsyncThread.Start())
+        return false;
+
+      RefPtr<Runnable> vsyncSetup = NewRunnableMethod(this, &GLXDisplay::SetupGLContext);
+      mVsyncThread.message_loop()->PostTask(vsyncSetup.forget());
+      // Wait until the setup has completed.
+      lock.Wait();
+      return mGLContext != nullptr;
+    }
+
+    // Called on the Vsync thread to setup the GL context.
+    void SetupGLContext()
+    {
+        MonitorAutoLock lock(mSetupLock);
+        MOZ_ASSERT(!NS_IsMainThread());
+        MOZ_ASSERT(!mGLContext, "GLContext already setup!");
+
+        // Create video sync timer on a separate Display to prevent locking the
+        // main thread X display.
+        mXDisplay = XOpenDisplay(nullptr);
+        if (!mXDisplay) {
+          lock.NotifyAll();
+          return;
+        }
+
+        // Most compositors wait for vsync events on the root window.
+        Window root = DefaultRootWindow(mXDisplay);
+        int screen = DefaultScreen(mXDisplay);
+
+        ScopedXFree<GLXFBConfig> cfgs;
+        GLXFBConfig config;
+        int visid;
+        if (!gl::GLContextGLX::FindFBConfigForWindow(mXDisplay, screen, root,
+                                                     &cfgs, &config, &visid)) {
+          lock.NotifyAll();
+          return;
+        }
+
+        mGLContext = gl::GLContextGLX::CreateGLContext(
+            gl::CreateContextFlags::NONE,
+            gl::SurfaceCaps::Any(),
+            nullptr,
+            false,
+            mXDisplay,
+            root,
+            config);
+
+        if (!mGLContext) {
+          lock.NotifyAll();
+          return;
+        }
+
+        mGLContext->MakeCurrent();
+
+        // Test that SGI_video_sync lets us get the counter.
+        unsigned int syncCounter = 0;
+        if (gl::sGLXLibrary.xGetVideoSync(&syncCounter) != 0) {
+          mGLContext = nullptr;
+        }
+
+        lock.NotifyAll();
+    }
+
+    virtual void EnableVsync() override
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+      MOZ_ASSERT(mGLContext, "GLContext not setup!");
+
+      MonitorAutoLock lock(mVsyncEnabledLock);
+      if (mVsyncEnabled) {
+        return;
+      }
+      mVsyncEnabled = true;
+
+      // If the task has not nulled itself out, it hasn't yet realized
+      // that vsync was disabled earlier, so continue its execution.
+      if (!mVsyncTask) {
+        mVsyncTask = NewRunnableMethod(this, &GLXDisplay::RunVsync);
+        RefPtr<Runnable> addrefedTask = mVsyncTask;
+        mVsyncThread.message_loop()->PostTask(addrefedTask.forget());
+      }
+    }
+
+    virtual void DisableVsync() override
+    {
+      MonitorAutoLock lock(mVsyncEnabledLock);
+      mVsyncEnabled = false;
+    }
+
+    virtual bool IsVsyncEnabled() override
+    {
+      MonitorAutoLock lock(mVsyncEnabledLock);
+      return mVsyncEnabled;
+    }
+
+    virtual void Shutdown() override
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+      DisableVsync();
+
+      // Cleanup thread-specific resources before shutting down.
+      RefPtr<Runnable> shutdownTask = NewRunnableMethod(this, &GLXDisplay::Cleanup);
+      mVsyncThread.message_loop()->PostTask(shutdownTask.forget());
+
+      // Stop, waiting for the cleanup task to finish execution.
+      mVsyncThread.Stop();
+    }
+
+  private:
+    virtual ~GLXDisplay()
+    {
+    }
+
+    void RunVsync()
+    {
+      MOZ_ASSERT(!NS_IsMainThread());
+
+      mGLContext->MakeCurrent();
+
+      unsigned int syncCounter = 0;
+      gl::sGLXLibrary.xGetVideoSync(&syncCounter);
+      for (;;) {
+        {
+          MonitorAutoLock lock(mVsyncEnabledLock);
+          if (!mVsyncEnabled) {
+            mVsyncTask = nullptr;
+            return;
+          }
+        }
+
+        TimeStamp lastVsync = TimeStamp::Now();
+        bool useSoftware = false;
+
+        // Wait until the video sync counter reaches the next value by waiting
+        // until the parity of the counter value changes.
+        unsigned int nextSync = syncCounter + 1;
+        int status;
+        if ((status = gl::sGLXLibrary.xWaitVideoSync(2, nextSync % 2, &syncCounter)) != 0) {
+          gfxWarningOnce() << "glXWaitVideoSync returned " << status;
+          useSoftware = true;
+        }
+
+        if (syncCounter == (nextSync - 1)) {
+          gfxWarningOnce() << "glXWaitVideoSync failed to increment the sync counter.";
+          useSoftware = true;
+        }
+
+        if (useSoftware) {
+          double remaining = (1000.f / 60.f) -
+            (TimeStamp::Now() - lastVsync).ToMilliseconds();
+          if (remaining > 0) {
+            PlatformThread::Sleep(remaining);
+          }
+        }
+
+        lastVsync = TimeStamp::Now();
+        NotifyVsync(lastVsync);
+      }
+    }
+
+    void Cleanup() {
+      MOZ_ASSERT(!NS_IsMainThread());
+
+      mGLContext = nullptr;
+      XCloseDisplay(mXDisplay);
+    }
+
+    // Owned by the vsync thread.
+    RefPtr<gl::GLContextGLX> mGLContext;
+    _XDisplay* mXDisplay;
+    Monitor mSetupLock;
+    base::Thread mVsyncThread;
+    RefPtr<Runnable> mVsyncTask;
+    Monitor mVsyncEnabledLock;
+    bool mVsyncEnabled;
+  };
+private:
+  // We need a refcounted VsyncSource::Display to use chromium IPC runnables.
+  RefPtr<GLXDisplay> mGlobalDisplay;
+};
+
+already_AddRefed<gfx::VsyncSource>
+gfxPlatformHeadless::CreateHardwareVsyncSource()
+{
+  // Only use GLX vsync when the OpenGL compositor is being used.
+  // The extra cost of initializing a GLX context while blocking the main
+  // thread is not worth it when using basic composition.
+  if (gfxConfig::IsEnabled(Feature::HW_COMPOSITING)) {
+    if (gl::sGLXLibrary.SupportsVideoSync()) {
+      RefPtr<VsyncSource> vsyncSource = new GLXVsyncSource();
+      VsyncSource::Display& display = vsyncSource->GetGlobalDisplay();
+      if (!static_cast<GLXVsyncSource::GLXDisplay&>(display).Setup()) {
+        NS_WARNING("Failed to setup GLContext, falling back to software vsync.");
+        return gfxPlatform::CreateHardwareVsyncSource();
+      }
+      return vsyncSource.forget();
+    }
+    NS_WARNING("SGI_video_sync unsupported. Falling back to software vsync.");
+  }
+  return gfxPlatform::CreateHardwareVsyncSource();
+}
+
+#endif
+
+// Not GLX-specific: must be defined regardless of GL_PROVIDER_GLX so the
+// vtable slot resolves in a headless (no X/GLX) build.
+bool
+gfxPlatformHeadless::SupportsApzTouchInput() const
+{
+  int value = gfxPrefs::TouchEventsEnabled();
+  return value == 1 || value == 2;
+}

gfx/thebes/gfxPlatformHeadless.h

@@ -0,0 +1,150 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GFX_PLATFORM_GTK_H
+#define GFX_PLATFORM_GTK_H
+
+#include "gfxPlatform.h"
+#include "nsAutoRef.h"
+#include "nsTArray.h"
+#include "mozilla/gfx/gfxVars.h"
+
+#if (MOZ_WIDGET_GTK == 2)
+extern "C" {
+    typedef struct _GdkDrawable GdkDrawable;
+}
+#endif
+
+#ifdef MOZ_X11
+struct _XDisplay;
+typedef struct _XDisplay Display;
+#endif // MOZ_X11
+
+class gfxPlatformHeadless : public gfxPlatform {
+public:
+    gfxPlatformHeadless();
+    virtual ~gfxPlatformHeadless();
+
+    static gfxPlatformHeadless *GetPlatform() {
+        return (gfxPlatformHeadless*) gfxPlatform::GetPlatform();
+    }
+
+    virtual already_AddRefed<gfxASurface>
+      CreateOffscreenSurface(const IntSize& aSize,
+                             gfxImageFormat aFormat) override;
+
+    virtual nsresult GetFontList(nsIAtom *aLangGroup,
+                                 const nsACString& aGenericFamily,
+                                 nsTArray<nsString>& aListOfFonts) override;
+
+    virtual nsresult UpdateFontList() override;
+
+    virtual void
+    GetCommonFallbackFonts(uint32_t aCh, uint32_t aNextCh,
+                           Script aRunScript,
+                           nsTArray<const char*>& aFontList) override;
+
+    virtual gfxPlatformFontList* CreatePlatformFontList() override;
+
+    virtual nsresult GetStandardFamilyName(const nsAString& aFontName,
+                                           nsAString& aFamilyName) override;
+
+    gfxFontGroup*
+    CreateFontGroup(const mozilla::FontFamilyList& aFontFamilyList,
+                    const gfxFontStyle *aStyle,
+                    gfxTextPerfMetrics* aTextPerf,
+                    gfxUserFontSet *aUserFontSet,
+                    gfxFloat aDevToCssSize) override;
+
+    /**
+     * Look up a local platform font using the full font face name (needed to
+     * support @font-face src local() )
+     */
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          uint8_t aStyle) override;
+
+    /**
+     * Activate a platform font (needed to support @font-face src url() )
+     *
+     */
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           uint8_t aStyle,
+                                           const uint8_t* aFontData,
+                                           uint32_t aLength) override;
+
+    /**
+     * Check whether format is supported on a platform or not (if unclear,
+     * returns true).
+     */
+    virtual bool IsFontFormatSupported(nsIURI *aFontURI,
+                                         uint32_t aFormatFlags) override;
+
+    /**
+     * Calls XFlush if xrender is enabled.
+     */
+    virtual void FlushContentDrawing() override;
+
+#if (MOZ_WIDGET_GTK == 2)
+    static void SetGdkDrawable(cairo_surface_t *target,
+                               GdkDrawable *drawable);
+    static GdkDrawable *GetGdkDrawable(cairo_surface_t *target);
+#endif
+
+    static int32_t GetDPI();
+    static double  GetDPIScale();
+
+#ifdef MOZ_X11
+    virtual void GetAzureBackendInfo(mozilla::widget::InfoObject &aObj) override {
+      gfxPlatform::GetAzureBackendInfo(aObj);
+      aObj.DefineProperty("CairoUseXRender", mozilla::gfx::gfxVars::UseXRender());
+    }
+#endif
+
+    bool UseImageOffscreenSurfaces();
+
+    virtual gfxImageFormat GetOffscreenFormat() override;
+
+    bool SupportsApzWheelInput() const override {
+      return true;
+    }
+
+    bool SupportsApzTouchInput() const override;
+
+    void FontsPrefsChanged(const char *aPref) override;
+
+    // maximum number of fonts to substitute for a generic
+    uint32_t MaxGenericSubstitions();
+
+    bool SupportsPluginDirectBitmapDrawing() override {
+      return true;
+    }
+
+#ifdef GL_PROVIDER_GLX
+    already_AddRefed<mozilla::gfx::VsyncSource> CreateHardwareVsyncSource() override;
+#endif
+
+#ifdef MOZ_X11
+    Display* GetCompositorDisplay() {
+      return mCompositorDisplay;
+    }
+#endif // MOZ_X11
+
+protected:
+    int8_t mMaxGenericSubstitutions;
+
+private:
+    virtual void GetPlatformCMSOutputProfile(void *&mem,
+                                             size_t &size) override;
+
+#ifdef MOZ_X11
+    Display* mCompositorDisplay;
+#endif
+};
+
+#endif /* GFX_PLATFORM_GTK_H */

gfx/thebes/gfxTextRun.cpp

@@ -231,13 +231,11 @@ gfxTextRun::ComputeLigatureData(Range aPartRange,
     LigatureData result;
     const CompressedGlyph *charGlyphs = mCharacterGlyphs;
 
-    uint32_t i = aPartRange.start;
-    while (i && !charGlyphs[i].IsLigatureGroupStart()) {
-        --i;
+    uint32_t i;
+    for (i = aPartRange.start; !charGlyphs[i].IsLigatureGroupStart(); --i) {
+        NS_ASSERTION(i > 0, "Ligature at the start of the run??");
     }
-    NS_ASSERTION(charGlyphs[i].IsLigatureGroupStart(), "Ligature at run start?");
     result.mRange.start = i;
-
     for (i = aPartRange.start + 1;
          i < GetLength() && !charGlyphs[i].IsLigatureGroupStart(); ++i) {
     }
@@ -1706,27 +1704,21 @@ gfxFontGroup::GetFontAt(int32_t i, uint32_t aCh)
 
     RefPtr<gfxFont> font = ff.Font();
     if (!font) {
-        RefPtr<gfxFontEntry> fe = ff.FontEntry();
-        if (!fe) {
-            return nullptr;
-        }
-        RefPtr<gfxCharacterMap> unicodeRangeMap;
+        gfxFontEntry* fe = mFonts[i].FontEntry();
+        gfxCharacterMap* unicodeRangeMap = nullptr;
         if (fe->mIsUserFontContainer) {
-            // This raw pointer is OK because fe holds a strong ref to the object.
-            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe.get());
+            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe);
             if (ufe->LoadState() == gfxUserFontEntry::STATUS_NOT_LOADED &&
                 ufe->CharacterInUnicodeRange(aCh) &&
                 !FontLoadingForFamily(ff.Family(), aCh)) {
                 ufe->Load();
                 ff.CheckState(mSkipDrawing);
             }
-            unicodeRangeMap = ufe->GetUnicodeRangeMap();
-            // Update fe to refer to the actual platform font entry, rather than the
-            // webfont wrapper. After this, we no longer have a strong ref to ufe.
             fe = ufe->GetPlatformFontEntry();
             if (!fe) {
                 return nullptr;
             }
+            unicodeRangeMap = ufe->GetUnicodeRangeMap();
         }
         font = fe->FindOrMakeFont(&mStyle, mFonts[i].NeedsBold(),
                                   unicodeRangeMap);

gfx/thebes/moz.build

@@ -74,6 +74,22 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
         'gfxQuartzSurface.cpp',
         'PrintTargetCG.cpp',
     ]
+elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'headless':
+    # Jihad headless (no X/GTK): fontconfig/freetype fonts + a memory gfxPlatform.
+    EXPORTS += [
+        'gfxFT2FontBase.h',
+        'gfxPlatformHeadless.h',
+    ]
+    EXPORTS.mozilla.gfx += [
+        'PrintTargetPDF.h',
+    ]
+    SOURCES += [
+        'gfxFcPlatformFontList.cpp',
+        'gfxFT2FontBase.cpp',
+        'gfxFT2Utils.cpp',
+        'gfxPlatformHeadless.cpp',
+        'PrintTargetPDF.cpp',
+    ]
 elif 'gtk' in CONFIG['MOZ_WIDGET_TOOLKIT']:
     EXPORTS += [
         'gfxFT2FontBase.h',

image/RasterImage.cpp

@@ -1637,13 +1637,10 @@ RasterImage::NotifyDecodeComplete(const DecoderFinalStatus& aStatus,
 
   if (!(aDecoderFlags & DecoderFlags::FIRST_FRAME_ONLY) &&
       mHasBeenDecoded && mAnimationState) {
-    // If we've successfully finished a full decode of all animation frames
-    // then let our animation state know it's complete and to not to expect
-    // any more frames.
-    if (aStatus.mFinished && !aStatus.mHadError) {
-      mAnimationState->NotifyDecodeComplete();
-      mAnimationState->UpdateState(mAnimationFinished, this, mSize);
-    }
+    // We've finished a full decode of all animation frames and our AnimationState
+    // has been notified about them all, so let it know not to expect anymore.
+    mAnimationState->NotifyDecodeComplete();
+    mAnimationState->UpdateState(mAnimationFinished, this, mSize);
   }
 
   // Only act on errors if we have no usable frames from the decoder.

ipc/app/moz.build

@@ -6,6 +6,14 @@
 GeckoProgram(CONFIG['MOZ_CHILD_PROCESS_NAME'], linkage='dependent')
 
 SOURCES += [
+    # JihadPmLogSem.c interposes sem_open/sem_close for the ONE name "PmLogLib". The device's
+    # Flash pulls in libPmLogLib.so, whose constructor sem_wait()s a named semaphore created
+    # by webOS's glibc 2.8; glibc 2.21 changed sem_t's value word to (tokens << 1), so our
+    # bundled 2.23 reads that semaphore as "no tokens, waiters pending" and the dlopen never
+    # returns. It has to be in THIS directory: a dlopened plugin resolves its PLT against the
+    # global scope, which the program image heads, and ipc/app is where the program is linked
+    # (ipc/contentproc only produces an archive this link does not use).
+    '../contentproc/JihadPmLogSem.c',
     'MozillaRuntimeMain.cpp',
 ]
 

ipc/chromium/src/base/message_loop.cc

@@ -146,7 +146,13 @@ MessageLoop::MessageLoop(Type type, nsIThread* aThread)
 #if defined(OS_MACOSX)
     pump_ = base::MessagePumpMac::Create();
 #elif defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS)
+#if defined(MOZ_WIDGET_GTK)
     pump_ = new base::MessagePumpForUI();
+#else
+    // Jihad headless: no GTK UI pump; the embedder drives events via
+    // NS_ProcessNextEvent, so a default (non-UI) message pump suffices.
+    pump_ = new base::MessagePumpDefault();
+#endif
 #endif  // OS_LINUX
   } else if (type_ == TYPE_IO) {
     pump_ = new base::MessagePumpLibevent();

ipc/contentproc/JihadPmLogSem.c

@@ -0,0 +1,135 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * Jihad Browser — the /PmLogLib named-semaphore ABI trap.
+ *
+ * Compiled into every one of our binaries that can dlopen a device NPAPI plugin: the
+ * daemon (its plugin scan) and plugin-container (the plugin itself). Plain C, no headers
+ * from UXP or from the daemon, so the same file drops into both build systems unchanged.
+ */
+
+// ── WHAT THIS IS FOR ────────────────────────────────────────────────────────────────────
+//
+// The device's libflashplayer.so has libWebKitLuna.so as a DT_NEEDED, which drags in
+// libPmLogLib.so. PmLogLib's ELF constructor opens the POSIX named semaphore "PmLogLib"
+// and sem_wait()s it to guard a SysV shared-memory table of log contexts that every
+// process on the device shares.
+//
+// glibc changed sem_t's layout in 2.21. The value word went from a raw token count to
+// (tokens << 1) | has-waiters. webOS 3's userland is glibc 2.8 — the OLD layout — and
+// everything we cross-build runs on the bundled glibc 2.23, the NEW one. /dev/shm/
+// sem.PmLogLib is created once per boot by whichever process opens it first, in that
+// process's layout, and then outlives every user of it.
+//
+// When a system process wins that race the word holds a raw 1, meaning "one token". Our
+// 2.23 sem_wait reads the same word as ZERO tokens with the waiters bit set, so it goes
+// straight to futex_wait and never returns. dlopen never completes and whoever called it
+// wedges: measured on device 2026-08-10 as
+//     futex(0x2dd98000, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, ffffffff
+// immediately after the mmap of /dev/shm/sem.PmLogLib, with every library already loaded.
+//
+// That is why this reads as an intermittent, reboot-triggered failure on binaries nobody
+// touched: it is decided by a boot race, not by our code. The same dlopen run under the
+// device's own /lib/ld-linux.so.3 completes and returns both Flash MIME types.
+//
+// ── WHY INTERPOSE RATHER THAN REPAIR THE SEMAPHORE ──────────────────────────────────────
+//
+// Rewriting /dev/shm/sem.PmLogLib into our layout, or posting it once to make it readable
+// to us, both work — and both hand every OTHER process on the device an extra token on a
+// lock guarding a shared table. That silently weakens PmLogLib's mutual exclusion
+// system-wide to fix a browser. Interposing ONE name does not: PmLogLib gets a semaphore
+// that never leaves this process, so no other glibc ever parses its layout, and the file
+// in /dev/shm is not touched at all.
+//
+// Everything else is forwarded to the real implementation untouched, which MATTERS: our
+// own shared frame buffers are named semaphores too (/dev/shm/sem.browserserver.<pid>-<n>,
+// created here and opened by the adapter inside LunaSysMgr), and those genuinely must stay
+// shared across the process boundary.
+
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <semaphore.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <string.h>
+
+// PmLogLib asks for the name WITHOUT a leading slash (verified on device: the interposer
+// logged sem_open("PmLogLib")). POSIX says a portable name starts with '/', and glibc
+// accepts both, so match both rather than trusting either spelling.
+// Link anchor. plugin-container builds this TU into a static archive, and an archive member
+// is only pulled in to satisfy an UNDEFINED symbol — sem_open is already defined by
+// libpthread, so nothing was undefined and the whole file was silently dropped from the
+// link. Calling this from the program's entry point forces the member in. The daemon links
+// the object directly and does not need it; it costs one call there.
+__attribute__((visibility("default")))
+int jihad_pmlog_sem_installed(void) { return 1; }
+
+static int jihad_is_pmlog_name(const char* name)
+{
+  if (!name) return 0;
+  if (name[0] == '/') ++name;
+  return strcmp(name, "PmLogLib") == 0;
+}
+
+static sem_t g_pmlogSem;
+static pthread_once_t g_pmlogSemOnce = PTHREAD_ONCE_INIT;
+static unsigned int g_pmlogSemInitial = 1;
+
+static void jihad_pmlog_sem_init(void)
+{
+  // pshared = 0. Process-private is the whole point: it can never be observed, and so can
+  // never be misread, by a glibc with a different sem_t layout.
+  sem_init(&g_pmlogSem, 0, g_pmlogSemInitial);
+}
+
+__attribute__((visibility("default")))
+sem_t* sem_open(const char* name, int oflag, ...)
+{
+  static sem_t* (*real_sem_open)(const char*, int, ...);
+  if (!real_sem_open)
+    real_sem_open = (sem_t* (*)(const char*, int, ...))dlsym(RTLD_NEXT, "sem_open");
+
+  // The mode/value pair is only present when O_CREAT is set; reading it otherwise walks off
+  // the end of the argument list.
+  mode_t mode = 0;
+  unsigned int value = 0;
+  const int creating = (oflag & O_CREAT) != 0;
+  if (creating) {
+    va_list ap;
+    va_start(ap, oflag);
+    mode = (mode_t)va_arg(ap, unsigned int);
+    value = va_arg(ap, unsigned int);
+    va_end(ap);
+  }
+
+  if (jihad_is_pmlog_name(name)) {
+    if (creating) g_pmlogSemInitial = value;
+    pthread_once(&g_pmlogSemOnce, jihad_pmlog_sem_init);
+    return &g_pmlogSem;
+  }
+
+  if (!real_sem_open) return SEM_FAILED;
+  if (creating) return real_sem_open(name, oflag, mode, value);
+  return real_sem_open(name, oflag);
+}
+
+// PmLogLib closes the semaphore on unload. glibc's sem_close looks the pointer up in its
+// table of NAMED semaphores, would not find ours, and would return EINVAL — harmless today,
+// but only by luck. Answer for our own pointer and forward everything else.
+__attribute__((visibility("default")))
+int sem_close(sem_t* sem)
+{
+  static int (*real_sem_close)(sem_t*);
+  if (!real_sem_close)
+    real_sem_close = (int (*)(sem_t*))dlsym(RTLD_NEXT, "sem_close");
+
+  // Deliberately NOT sem_destroy: the plugin can be unloaded and reloaded within one
+  // process (the scan does exactly that), and a destroyed static would be reused.
+  if (sem == &g_pmlogSem) return 0;
+
+  if (!real_sem_close) return 0;
+  return real_sem_close(sem);
+}

ipc/contentproc/moz.build

@@ -9,6 +9,10 @@ SOURCES += [
     'plugin-container.cpp',
 ]
 
+# JihadPmLogSem.c lives here next to its only caller but is compiled by ipc/app, which is
+# where the plugin-container PROGRAM is linked; this directory only produces an archive that
+# that link does not use. See ipc/app/moz.build.
+
 include('/ipc/chromium/chromium-config.mozbuild')
 
 if CONFIG['OS_ARCH'] == 'WINNT':

ipc/contentproc/plugin-container.cpp

@@ -3,10 +3,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <stdlib.h>   // getenv / unsetenv (JIHAD: see main)
 #include "nsXPCOM.h"
 #include "nsXULAppAPI.h"
 #include "nsAutoPtr.h"
 
+// JihadPmLogSem.c — C, and deliberately carries no header, so it drops unchanged into both
+// this build and the daemon's. Declared here rather than in one because that is the entire
+// interface: one call whose only job is to keep the archive member in the link.
+extern "C" int jihad_pmlog_sem_installed(void);
+
 #ifdef XP_WIN
 #include <windows.h>
 // we want a wmain entry point
@@ -19,6 +25,82 @@
 #include <unistd.h>
 #endif
 
+// JIHAD DIAGNOSTIC (R7): the child process dies with SIGSEGV between a successful
+// InitForChrome and handling its first IPC message, and the device's own minicore reporter
+// is out of report slots ("no room for new reports"), so nothing records where. This prints
+// the faulting address, a backtrace, and /proc/self/maps to stderr — which the child
+// inherits from the daemon, so it lands in the variant's daemon.log. The maps dump is the
+// part that matters on ARM: even a single frame is enough to name the faulting library.
+#if defined(OS_POSIX) || defined(XP_UNIX)
+#include <execinfo.h>
+#include <signal.h>
+#include <ucontext.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+static void
+jihad_child_fault_handler(int sig, siginfo_t* info, void* ctx)
+{
+  void* frames[32];
+  int n = backtrace(frames, 32);
+  fprintf(stderr, "[jihad-npapi-child] FAULT sig=%d addr=%p pid=%d frames=%d\n",
+          sig, info ? info->si_addr : nullptr, (int)getpid(), n);
+
+  // backtrace() returns nothing useful from a signal frame on ARM (no unwind tables
+  // through the trampoline), so take the registers straight out of the signal context.
+  // pc and lr against the maps below give the faulting library and offset, and
+  // addr2line on the unstripped build turns that into file:line.
+#if defined(__arm__)
+  if (ctx) {
+    ucontext_t* uc = (ucontext_t*)ctx;
+    fprintf(stderr, "[jihad-npapi-child] FAULT pc=%08lx lr=%08lx sp=%08lx r0=%08lx\n",
+            (unsigned long)uc->uc_mcontext.arm_pc,
+            (unsigned long)uc->uc_mcontext.arm_lr,
+            (unsigned long)uc->uc_mcontext.arm_sp,
+            (unsigned long)uc->uc_mcontext.arm_r0);
+  }
+#else
+  (void)ctx;
+#endif
+  fflush(stderr);
+  backtrace_symbols_fd(frames, n, STDERR_FILENO);
+
+  FILE* maps = fopen("/proc/self/maps", "r");
+  if (maps) {
+    char line[512];
+    fputs("[jihad-npapi-child] --- maps ---\n", stderr);
+    while (fgets(line, sizeof(line), maps)) {
+      // Only the executable mappings; the full map is hundreds of lines of noise.
+      if (strstr(line, "r-xp")) {
+        fputs("[jihad-npapi-child] ", stderr);
+        fputs(line, stderr);
+      }
+    }
+    fclose(maps);
+  }
+  fflush(stderr);
+
+  // Restore the default disposition and re-raise so the exit status still says "crashed".
+  signal(sig, SIG_DFL);
+  raise(sig);
+}
+
+static void
+jihad_install_child_fault_handler()
+{
+  struct sigaction sa;
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_sigaction = jihad_child_fault_handler;
+  sa.sa_flags = SA_SIGINFO;
+  sigemptyset(&sa.sa_mask);
+  sigaction(SIGSEGV, &sa, nullptr);
+  sigaction(SIGBUS, &sa, nullptr);
+  sigaction(SIGILL, &sa, nullptr);
+  sigaction(SIGFPE, &sa, nullptr);
+}
+#endif
+
 #ifdef MOZ_GMP
 #include "GMPLoader.h"
 
@@ -38,6 +120,41 @@ content_process_main(int argc, char* argv[])
       return 3;
     }
 
+#if defined(OS_POSIX) || defined(XP_UNIX)
+    jihad_install_child_fault_handler();
+#endif
+
+    // JIHAD (R7): force JihadPmLogSem.o into the link and say so. It interposes sem_open for
+    // the single name "PmLogLib", without which dlopening the device's Flash deadlocks this
+    // process forever — libPmLogLib's constructor waits on a named semaphore created by
+    // webOS's glibc 2.8, whose sem_t value word our glibc 2.23 reads as "no tokens, waiters
+    // pending". The call is also the only cheap proof the interposer survived the link: it
+    // lives in a static archive, and an archive member with no undefined symbol to satisfy
+    // is silently dropped. See render/goanna/JihadPmLogSem.c.
+    fprintf(stderr, "[jihad-npapi-child] pmlog sem interposition=%d\n",
+            jihad_pmlog_sem_installed());
+
+    // JIHAD DIAGNOSTIC (R7): the child's own view of its argv. Doubles as the control that
+    // child stderr reaches the parent's log at all — every other child probe is worthless
+    // until this line is seen.
+    fprintf(stderr, "[jihad-npapi-child] main argc=%d\n", argc);
+    for (int i = 0; i < argc; i++) {
+      fprintf(stderr, "[jihad-npapi-child]   argv[%d]=%s\n", i, argv[i]);
+    }
+    fflush(stderr);
+
+    // JIHAD (2026-10-05): DO NOT HAND OUR LIBRARY PATH TO WHAT THE PLUGIN RUNS.
+    // This process is started through the bundled loader with an explicit --library-path,
+    // which is what its own later dlopen()s search; the LD_LIBRARY_PATH it also inherits
+    // is not needed by it. But it is inherited again by anything the plugin spawns, and
+    // Flash for Linux runs `sh -c "ps x | grep netscape"` at start-up: the device's own
+    // /bin/sh (built for its glibc 2.8) then loads the bundled glibc 2.23 and dies with
+    // SIGSEGV, leaving a crash report in /var/log/reports for every page with Flash on it.
+    // Only when the bundled loader is in use; a desktop build keeps its environment.
+    if (getenv("MOZ_CHILD_PROCESS_LOADER")) {
+      unsetenv("LD_LIBRARY_PATH");
+    }
+
 #ifdef MOZ_GMP
     XREChildData childData;
 #endif

ipc/glue/GeckoChildProcessHost.cpp

@@ -160,6 +160,13 @@ GeckoChildProcessHost::GetPathToBinary(FilePath& exePath, GeckoProcessType proce
 
   exePath = exePath.AppendASCII(MOZ_CHILD_PROCESS_NAME);
 
+  // JIHAD DIAGNOSTIC (R7): the resolved child path, and which branch produced it. In this
+  // embedding the daemon is exec'd as `./ld-2.23.so … ./jihad-browserserver`, so argv[0] is the
+  // LOADER — if the directory-service branch is not taken, the fallback dirname(argv[0]) is
+  // relative to that, not to the daemon.
+  fprintf(stderr, "[jihad-npapi] child binary path=%s (dirService=%d)\n",
+          exePath.value().c_str(), (int)ShouldHaveDirectoryService());
+
   return BinaryPathType::PluginContainer;
 }
 
@@ -662,6 +669,27 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
 
   std::vector<std::string> childArgv;
 
+  // Optional ELF loader prefix for the child process.
+  //
+  // An embedder whose bundled glibc differs from the host system's cannot exec the child
+  // binary directly: its PT_INTERP names the SYSTEM loader, which then resolves the child's
+  // libraries against the bundled set and dies before main(). Exporting these two variables
+  // makes the child be launched exactly the way such an embedder launches itself —
+  //     <loader> --library-path <path> <child> <args…>
+  // — which runs the child in the same process image (no extra fork, no shell hop, so the
+  // pid we hand to waitpid and the inherited IPC channel fd are unaffected).
+  //
+  // Both unset is upstream behaviour, unchanged.
+  const char* childLoader = PR_GetEnv("MOZ_CHILD_PROCESS_LOADER");
+  if (childLoader && *childLoader) {
+    childArgv.push_back(childLoader);
+    const char* loaderLibPath = PR_GetEnv("MOZ_CHILD_PROCESS_LOADER_PATH");
+    if (loaderLibPath && *loaderLibPath) {
+      childArgv.push_back("--library-path");
+      childArgv.push_back(loaderLibPath);
+    }
+  }
+
   childArgv.push_back(exePath.value());
 
   if (pathType == BinaryPathType::Self) {

js/src/builtin/RegExp.cpp

@@ -8,11 +8,8 @@
 #include "mozilla/CheckedInt.h"
 #include "mozilla/TypeTraits.h"
 
-#include <algorithm>
-
 #include "jscntxt.h"
 
-#include "builtin/SelfHostingDefines.h"
 #include "irregexp/RegExpParser.h"
 #include "jit/InlinableNatives.h"
 #include "vm/RegExpStatics.h"
@@ -1757,9 +1754,7 @@ js::RegExpGetSubstitution(JSContext* cx, HandleArrayObject matchResult, HandleLi
     // Step 6.
     MOZ_ASSERT(position <= string->length());
 
-    // String substitutions can only reference $1 through $99.
-    uint32_t nCaptures = std::min<uint32_t>(matchResultLength - 1,
-                                            REGEXP_MAX_SUBSTITUTION_CAPTURES);
+    uint32_t nCaptures = matchResultLength - 1;
     Rooted<CapturesVector> captures(cx, CapturesVector(cx));
     if (!captures.reserve(nCaptures))
         return false;

js/src/builtin/RegExp.js

@@ -463,12 +463,6 @@ function RegExpGetComplexReplacement(result, matched, S, position,
     // Step 14.k.i (reordered).
     _DefineDataProperty(captures, capturesLength++, matched);
 
-    // String substitutions can only reference $1 through $99. Keep getting and
-    // stringifying all captures because those operations are observable.
-    var storedCaptures = functionalReplace ?
-                           nCaptures :
-                           std_Math_min(nCaptures, REGEXP_MAX_SUBSTITUTION_CAPTURES);
-
     // Step 14.g, 14.i, 14.i.iv.
     for (var n = 1; n <= nCaptures; n++) {
         // Step 14.i.i.
@@ -479,9 +473,7 @@ function RegExpGetComplexReplacement(result, matched, S, position,
             capN = ToString(capN);
 
         // Step 14.i.iii.
-        if (n <= storedCaptures) {
-            _DefineDataProperty(captures, capturesLength++, capN);
-        }
+        _DefineDataProperty(captures, capturesLength++, capN);
     }
 
     // Step 14.j.

js/src/builtin/SelfHostingDefines.h

@@ -79,8 +79,6 @@
 
 #define REGEXP_FLAGS_SLOT 2
 
-#define REGEXP_MAX_SUBSTITUTION_CAPTURES 99
-
 #define REGEXP_IGNORECASE_FLAG  0x01
 #define REGEXP_GLOBAL_FLAG      0x02
 #define REGEXP_MULTILINE_FLAG   0x04

js/src/jit/CodeGenerator.cpp

@@ -8185,7 +8185,7 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleT(T* lir)
 {
-    static_assert(std::is_same_v<T, LStoreElementHoleT> || std::is_same_v<T, LFallibleStoreElementT>,
+    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
                   "emitStoreElementHoleT called with unexpected argument type");
 
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -8244,7 +8244,7 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleV(T* lir)
 {
-    static_assert(std::is_same_v<T, LStoreElementHoleV> || std::is_same_v<T, LFallibleStoreElementV>,
+    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
                   "emitStoreElementHoleV called with unexpected parameter type");
 
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);

js/src/jit/JitFrames.cpp

@@ -494,9 +494,6 @@ OnLeaveBaselineFrame(JSContext* cx, const JitFrameIterator& frame, jsbytecode* p
 {
     BaselineFrame* baselineFrame = frame.baselineFrame();
     if (jit::DebugEpilogue(cx, baselineFrame, pc, frameOk)) {
-        if (!baselineFrame->hasReturnValue()) {
-            baselineFrame->setReturnValue(UndefinedValue());
-        }
         rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
         rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
         rfe->stackPointer = reinterpret_cast<uint8_t*>(baselineFrame);

js/src/jit/x64/BaseAssembler-x64.h

@@ -8,6 +8,14 @@
 
 #include "jit/x86-shared/BaseAssembler-x86-shared.h"
 
+// Jihad Browser: GCC 9+ -Wformat-overflow raises false positives on the debug
+// spew() format strings below (it deduces a null %s arg via value-range
+// analysis). js/src forces -Werror=format, which re-escalates this even when
+// downgraded on the command line, so silence the diagnostic at the source.
+#if defined(__GNUC__) && !defined(__clang__)
+# pragma GCC diagnostic ignored "-Wformat-overflow"
+#endif
+
 namespace js {
 namespace jit {
 

js/src/jsprf.cpp

@@ -312,13 +312,12 @@ cvt_s(SprintfState* ss, const char* s, int width, int prec, int flags)
         s = generic_null_str(s);
 
     // Limit string length by precision value
-    size_t slen = strnlen(s, size_t(prec));
-    if (slen > INT_MAX) {
-        return false;
-    }
+    int slen = int(generic_strlen(s));
+    if (0 < prec && prec < slen)
+        slen = prec;
 
     // and away we go
-    return fill2(ss, s, int(slen), width, flags);
+    return fill2(ss, s, slen, width, flags);
 }
 
 /*

js/src/jsstr.cpp

@@ -2871,8 +2871,8 @@ static JSString* ReplaceAll(JSContext* cx, JSLinearString* str,
 
     // Step 13.
     StringBuffer result(cx);
-    if (std::is_same_v<StrChar, char16_t> ||
-      std::is_same_v<RepChar, char16_t>) {
+    if (std::is_same<StrChar, char16_t>::value ||
+      std::is_same<RepChar, char16_t>::value) {
         if (!result.ensureTwoByteChars()) {
           return nullptr;
         }
@@ -2954,8 +2954,8 @@ static JSString* ReplaceAllInterleave(JSContext* cx, JSLinearString* str,
 
     // Step 13.
     StringBuffer result(cx);
-    if (std::is_same_v<StrChar, char16_t> ||
-        std::is_same_v<RepChar, char16_t>) {
+    if (std::is_same<StrChar, char16_t>::value ||
+        std::is_same<RepChar, char16_t>::value) {
         if (!result.ensureTwoByteChars()) {
             return nullptr;
         }

js/src/vm/CharacterEncoding.cpp

@@ -309,26 +309,26 @@ InflateUTF8StringToBuffer(ContextT* cx, const UTF8Chars src, CharT* dst, size_t*
             while (v & (0x80 >> n))
                 n++;
 
-        #define INVALID(report, arg, n2)                                  \
-            do {                                                          \
-                if (Action == CountAndReportInvalids) {                   \
-                    report(cx, arg);                                      \
-                    return false;                                         \
-                } else if (Action == AssertNoInvalids) {                  \
-                    MOZ_CRASH("invalid UTF-8 string: " # report);         \
-                } else {                                                  \
-                    if (Action == Copy) {                                 \
-                        if (std::is_same_v<decltype(dst[0]), Latin1Char>) \
-                            dst[j] = CharT(REPLACE_UTF8_LATIN1);          \
-                        else                                              \
-                            dst[j] = CharT(REPLACE_UTF8);                 \
-                    } else {                                              \
-                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||    \
-                                   Action == FindEncoding);               \
-                    }                                                     \
-                    n = n2;                                               \
-                    goto invalidMultiByteCodeUnit;                        \
-                }                                                         \
+        #define INVALID(report, arg, n2)                                \
+            do {                                                        \
+                if (Action == CountAndReportInvalids) {                 \
+                    report(cx, arg);                                    \
+                    return false;                                       \
+                } else if (Action == AssertNoInvalids) {                \
+                    MOZ_CRASH("invalid UTF-8 string: " # report);       \
+                } else {                                                \
+                    if (Action == Copy) {                               \
+                        if (std::is_same<decltype(dst[0]), Latin1Char>::value) \
+                            dst[j] = CharT(REPLACE_UTF8_LATIN1);        \
+                        else                                            \
+                            dst[j] = CharT(REPLACE_UTF8);               \
+                    } else {                                            \
+                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||  \
+                                   Action == FindEncoding);             \
+                    }                                                   \
+                    n = n2;                                             \
+                    goto invalidMultiByteCodeUnit;                      \
+                }                                                       \
             } while (0)
 
             // Check the leading byte.

js/src/vm/String.h

@@ -1138,7 +1138,7 @@ class StaticStrings
     }
 
     template <typename CharT,
-              typename = typename std::enable_if_t<!std::is_const_v<CharT>>>
+              typename = typename std::enable_if<!std::is_const<CharT>::value>::type>
     MOZ_ALWAYS_INLINE JSAtom* lookup(CharT* chars, size_t length) {
         // Collapse the remaining |CharT*| to |const CharT*| to avoid excess
         // instantiations.

js/src/vm/TypedArrayCommon.h

@@ -677,12 +677,12 @@ class ElementSpecific
             return true;
         }
 
-        if (std::is_same_v<T, int64_t>) {
+        if (std::is_same<T, int64_t>::value) {
             JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigInt64(cx, v));
             return true;
         }
 
-        if (std::is_same_v<T, uint64_t>) {
+        if (std::is_same<T, uint64_t>::value) {
             JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigUint64(cx, v));
             return true;
         }

layout/base/DottedCornerFinder.cpp

@@ -411,13 +411,6 @@ DottedCornerFinder::FindBestOverlap(Float aMinR, Float aMinBorderRadius,
         mCount = mMaxCount;
         break;
       }
-      // GetCountAndLastOverlap() failed without writing |count| and
-      // |actualOverlap|: the walk needed more than mMaxCount circles, i.e.
-      // this overlap produces too many circles.  Narrow the search toward
-      // smaller overlaps.
-      upper = overlap;
-      overlap = (upper + lower) / 2.0f;
-      continue;
     }
 
     if (j == 0) {

layout/base/nsLayoutUtils.cpp

@@ -5107,28 +5107,19 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
            styleMinBSize.GetCoordValue() == 0)) ||
         styleMaxBSize.GetUnit() != eStyleUnit_None) {
 
-      AspectRatio ratio = aFrame->GetAspectRatio();
+      AspectRatio ratio = aFrame->GetIntrinsicRatio();
       if (ratio) {
+        // Convert 'ratio' if necessary, so that it's storing ISize/BSize:
+        if (!horizontalAxis) {
+          ratio = ratio.Inverted();
+        }
         AddStateBitToAncestors(aFrame,
             NS_FRAME_DESCENDANT_INTRINSIC_ISIZE_DEPENDS_ON_BSIZE);
 
-        const WritingMode wm = aFrame->GetWritingMode();
-        LogicalSize boxSizingAdjust(wm);
-        boxSizingAdjust.ISize(wm) =
-          GetDefiniteSizeTakenByBoxSizing(boxSizing, aFrame, isInlineAxis,
-                                          aFlags & IGNORE_PADDING,
-                                          aPercentageBasis);
         nscoord bSizeTakenByBoxSizing =
           GetDefiniteSizeTakenByBoxSizing(boxSizing, aFrame, !isInlineAxis,
                                           aFlags & IGNORE_PADDING,
                                           aPercentageBasis);
-        boxSizingAdjust.BSize(wm) = bSizeTakenByBoxSizing;
-        auto iSizeFromBSize = [&](nscoord aBSize) {
-          LogicalAxis dependentAxis =
-            isInlineAxis ? eLogicalAxisInline : eLogicalAxisBlock;
-          return ratio.ComputeRatioDependentSize(
-              dependentAxis, wm, aBSize, boxSizingAdjust);
-        };
         // NOTE: This is only the minContentSize if we've been passed MIN_INTRINSIC_ISIZE
         // (which is fine, because this should only be used inside a check for that flag).
         nscoord minContentSize = result;
@@ -5137,14 +5128,14 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
             (aPercentageBasis.isNothing() &&
              GetPercentBSize(styleBSize, aFrame, horizontalAxis, h))) {
           h = std::max(0, h - bSizeTakenByBoxSizing);
-          result = iSizeFromBSize(h);
+          result = ratio.ApplyTo(h);
         }
 
         if (GetDefiniteSize(styleMaxBSize, aFrame, !isInlineAxis, aPercentageBasis, &h) ||
             (aPercentageBasis.isNothing() &&
              GetPercentBSize(styleMaxBSize, aFrame, horizontalAxis, h))) {
           h = std::max(0, h - bSizeTakenByBoxSizing);
-          nscoord maxISize = iSizeFromBSize(h);
+          nscoord maxISize = ratio.ApplyTo(h);
           if (maxISize < result) {
             result = maxISize;
           }
@@ -5157,7 +5148,7 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
             (aPercentageBasis.isNothing() &&
              GetPercentBSize(styleMinBSize, aFrame, horizontalAxis, h))) {
           h = std::max(0, h - bSizeTakenByBoxSizing);
-          nscoord minISize = iSizeFromBSize(h);
+          nscoord minISize = ratio.ApplyTo(h);
           if (minISize > result) {
             result = minISize;
           }

layout/forms/nsHTMLButtonControlFrame.cpp

@@ -234,18 +234,7 @@ nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext* aPresContext,
 {
   WritingMode wm = GetWritingMode();
   LogicalSize availSize = aButtonReflowInput.ComputedSize(wm);
-
-  // Identify if the inner anonymous block is actually functioning as a flex or grid container.
-  nsIAtom* kidType = aFirstKid->GetType();
-  bool isFlexOrGrid = (kidType == nsGkAtoms::flexContainerFrame ||
-                       kidType == nsGkAtoms::gridContainerFrame);
-
-  // Preserve the button's definite BSize ONLY for flex/grid children so they
-  // see a definite containing block main size. For standard buttons, clobber
-  // to intrinsic so standard vertical centering (extraSpace) calculations work.
-  if (!isFlexOrGrid || aButtonReflowInput.ComputedBSize() == NS_INTRINSICSIZE) {
-    availSize.BSize(wm) = NS_INTRINSICSIZE;
-  }
+  availSize.BSize(wm) = NS_INTRINSICSIZE;
 
   // shorthand for a value we need to use in a bunch of places
   const LogicalMargin& clbp = aButtonReflowInput.ComputedLogicalBorderPadding();
@@ -259,12 +248,6 @@ nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext* aPresContext,
                                   aFirstKid,
                                   availSize);
 
-  // Apply the definite BSize directly on the inner reflow input ONLY if it's
-  // a flex or grid container, allowing it to be used as-is.
-  if (isFlexOrGrid && aButtonReflowInput.ComputedBSize() != NS_INTRINSICSIZE) {
-    contentsReflowInput.SetComputedBSize(aButtonReflowInput.ComputedBSize());
-  }
-
   nsReflowStatus contentsReflowStatus;
   ReflowOutput contentsDesiredSize(aButtonReflowInput);
   childPos.B(wm) = 0; // This will be set properly later, after reflowing the

layout/generic/AspectRatio.cpp

@@ -1,39 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/AspectRatio.h"
-
-#include "mozilla/WritingModes.h"
-
-namespace mozilla {
-
-nscoord
-AspectRatio::ComputeRatioDependentSize(
-    LogicalAxis aRatioDependentAxis,
-    const WritingMode& aWM,
-    nscoord aRatioDeterminingSize,
-    const LogicalSize& aContentBoxToBoxSizingAdjust) const
-{
-  MOZ_DIAGNOSTIC_ASSERT(*this);
-
-  LogicalSize adjust(aWM);
-  if (mUseBoxSizing == UseBoxSizing::Yes) {
-    adjust = aContentBoxToBoxSizingAdjust;
-  }
-
-  AspectRatio logicalRatio = aWM.IsVertical() ? Inverted() : *this;
-  nscoord result;
-  if (aRatioDependentAxis == eLogicalAxisInline) {
-    result = logicalRatio.ApplyTo(aRatioDeterminingSize +
-                                  adjust.BSize(aWM)) -
-             adjust.ISize(aWM);
-  } else {
-    result = logicalRatio.Inverted().ApplyTo(aRatioDeterminingSize +
-                                             adjust.ISize(aWM)) -
-             adjust.BSize(aWM);
-  }
-  return std::max(nscoord(0), result);
-}
-
-} // namespace mozilla

layout/generic/AspectRatio.h

@@ -9,46 +9,21 @@
 /* The aspect ratio of a box, in a "width / height" format. */
 
 #include "mozilla/Attributes.h"
-#include "mozilla/LogicalTypes.h"
 #include "nsCoord.h"
-#include "nsSize.h"
 #include <algorithm>
 #include <limits>
 
 namespace mozilla {
 
-class LogicalSize;
-class WritingMode;
-
-enum class UseBoxSizing : uint8_t {
-  // Natural ratios and "auto <ratio>" always use content-box dimensions.
-  No,
-  // A specified <ratio> uses the dimensions selected by box-sizing.
-  Yes,
-};
-
 struct AspectRatio {
-  AspectRatio()
-    : mRatio(0.0f)
-    , mUseBoxSizing(UseBoxSizing::No)
-  {}
+  AspectRatio() : mRatio(0.0f) {}
+  explicit AspectRatio(float aRatio) : mRatio(std::max(aRatio, 0.0f)) {}
 
-  explicit AspectRatio(float aRatio,
-                       UseBoxSizing aUseBoxSizing = UseBoxSizing::No)
-    : mRatio(std::max(aRatio, 0.0f))
-    , mUseBoxSizing(aUseBoxSizing)
-  {}
-
-  static AspectRatio FromSize(float aWidth, float aHeight,
-                              UseBoxSizing aUseBoxSizing = UseBoxSizing::No) {
+  static AspectRatio FromSize(float aWidth, float aHeight) {
     if (aWidth == 0.0f || aHeight == 0.0f) {
       return AspectRatio();
     }
-    float ratio = aWidth / aHeight;
-    if (!std::isfinite(ratio)) {
-      return AspectRatio();
-    }
-    return AspectRatio(ratio, aUseBoxSizing);
+    return AspectRatio(aWidth / aHeight);
   }
 
   static AspectRatio FromSize(nsSize aSize) {
@@ -80,23 +55,11 @@ struct AspectRatio {
     // 0.0f in the division here (so that valid ratios always generate other
     // valid ratios when inverted).
     return AspectRatio(
-        std::max(std::numeric_limits<float>::epsilon(), 1.0f / mRatio),
-        mUseBoxSizing);
+        std::max(std::numeric_limits<float>::epsilon(), 1.0f / mRatio));
   }
 
-  /**
-   * Computes a content-box size in the ratio-dependent axis from a
-   * content-box size in the ratio-determining axis.
-   */
-  nscoord ComputeRatioDependentSize(
-      LogicalAxis aRatioDependentAxis,
-      const WritingMode& aWM,
-      nscoord aRatioDeterminingSize,
-      const LogicalSize& aContentBoxToBoxSizingAdjust) const;
-
   bool operator==(const AspectRatio& aOther) const {
-    return mRatio == aOther.mRatio &&
-           mUseBoxSizing == aOther.mUseBoxSizing;
+    return mRatio == aOther.mRatio;
   }
 
   bool operator!=(const AspectRatio& aOther) const {
@@ -110,7 +73,6 @@ struct AspectRatio {
  private:
   // 0.0f represents no aspect ratio.
   float mRatio;
-  UseBoxSizing mUseBoxSizing;
 };
 
 }  // namespace mozilla

layout/generic/LogicalTypes.h

@@ -1,37 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_LogicalTypes_h
-#define mozilla_LogicalTypes_h
-
-namespace mozilla {
-
-// Logical axis, edge, side and corner constants for use in various places.
-enum LogicalAxis {
-  eLogicalAxisBlock  = 0x0,
-  eLogicalAxisInline = 0x1
-};
-enum LogicalEdge {
-  eLogicalEdgeStart  = 0x0,
-  eLogicalEdgeEnd    = 0x1
-};
-enum LogicalSide {
-  eLogicalSideBStart = (eLogicalAxisBlock  << 1) | eLogicalEdgeStart,  // 0x0
-  eLogicalSideBEnd   = (eLogicalAxisBlock  << 1) | eLogicalEdgeEnd,    // 0x1
-  eLogicalSideIStart = (eLogicalAxisInline << 1) | eLogicalEdgeStart,  // 0x2
-  eLogicalSideIEnd   = (eLogicalAxisInline << 1) | eLogicalEdgeEnd     // 0x3
-};
-
-enum LogicalCorner
-{
-  eLogicalCornerBStartIStart = 0,
-  eLogicalCornerBStartIEnd   = 1,
-  eLogicalCornerBEndIEnd     = 2,
-  eLogicalCornerBEndIStart   = 3
-};
-
-} // namespace mozilla
-
-#endif // mozilla_LogicalTypes_h

layout/generic/WritingModes.h

@@ -6,7 +6,6 @@
 #ifndef WritingModes_h_
 #define WritingModes_h_
 
-#include "mozilla/LogicalTypes.h"
 #include "nsRect.h"
 #include "nsStyleContext.h"
 #include "nsBidiUtils.h"