Bump version for release 28.5.2.

This reverts commit e69b3f567c.

application/basilisk/base/content/utilityOverlay.js

@@ -17,6 +17,9 @@ XPCOMUtils.defineLazyServiceGetter(this, "aboutNewTabService",
                                    "@mozilla.org/browser/aboutnewtab-service;1",
                                    "nsIAboutNewTabService");
 
+XPCOMUtils.defineLazyModuleGetter(this, "Deprecated",
+                                  "resource://gre/modules/Deprecated.jsm");
+
 this.__defineGetter__("BROWSER_NEW_TAB_URL", () => {
   if (PrivateBrowsingUtils.isWindowPrivate(window) &&
       !PrivateBrowsingUtils.permanentPrivateBrowsing &&
@@ -42,6 +45,13 @@ function getBrowserURL()
   return "chrome://browser/content/browser.xul";
 }
 
+function getBoolPref(pref, defaultValue) {
+  Deprecated.warning("getBoolPref is deprecated and will be removed in a future release. " +
+                     "You should use Services.pref.getBoolPref (Services.jsm).",
+                     "https://github.com/MoonchildProductions/UXP/issues/989");
+  return Services.prefs.getBoolPref(pref, defaultValue);
+}
+
 function getTopWin(skipPopups) {
   // If this is called in a browser window, use that window regardless of
   // whether it's the frontmost window, since commands can be executed in

application/basilisk/locales/en-US/chrome/browser-region/region.properties

@@ -9,6 +9,7 @@ browser.search.defaultenginename=DuckDuckGo
 browser.search.order.1=DuckDuckGo
 browser.search.order.2=Yahoo
 browser.search.order.3=Bing
+browser.search.order.4=Ecosia
 
 # This is the default set of web based feed handlers shown in the reader
 # selection UI
@@ -20,11 +21,7 @@ browser.contentHandlers.types.0.uri=https://add.my.yahoo.com/rss?url=%s
 # profile database.  Note that "new" is defined as "has a different URL"; this
 # means that it's not possible to update the name of existing handler, so 
 # don't make any spelling errors here.
-gecko.handlerService.defaultHandlersVersion=4
-
-# The default set of protocol handlers for webcal:
-gecko.handlerService.schemes.webcal.0.name=30 Boxes
-gecko.handlerService.schemes.webcal.0.uriTemplate=https://30boxes.com/external/widget?refer=ff&url=%s
+gecko.handlerService.defaultHandlersVersion=5
 
 # The default set of protocol handlers for mailto:
 gecko.handlerService.schemes.mailto.0.name=Yahoo! Mail

application/palemoon/base/content/browser.js

@@ -412,6 +412,10 @@ var gURLBarSettings = {
   },
 
   writePlaceholder: function() {
+    if (!gURLBar) {
+      return;
+    }
+
     let attribute = "placeholder";
     let prefs = this.prefSuggests.map(pref => {
       return this.prefSuggest + pref;
@@ -3471,6 +3475,7 @@ function BrowserToolboxCustomizeDone(aToolboxChanged) {
 
   // Update the urlbar
   if (gURLBar) {
+    gURLBarSettings.writePlaceholder();
     URLBarSetURI();
     XULBrowserWindow.asyncUpdateUI();
     BookmarkingUI.updateStarState();

application/palemoon/base/content/tabbrowser.xml

@@ -823,13 +823,8 @@
             }
 
             let sizedIconUrl = browser.mIconURL || "";
-            if (sizedIconUrl) {
-              let size = Math.round(16 * window.devicePixelRatio);
-              sizedIconUrl += (sizedIconUrl.includes("#") ? "&" : "#") +
-                              "-moz-resolution=" + size + "," + size;
-            }
             if (sizedIconUrl != aTab.getAttribute("image")) {
-              if (browser.mIconURL)
+              if (sizedIconUrl)
                 aTab.setAttribute("image", sizedIconUrl);
               else
                 aTab.removeAttribute("image");

application/palemoon/base/content/utilityOverlay.js

@@ -12,6 +12,9 @@ Components.utils.import("resource:///modules/RecentWindow.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "ShellService",
                                   "resource:///modules/ShellService.jsm");
 
+XPCOMUtils.defineLazyModuleGetter(this, "Deprecated",
+                                  "resource://gre/modules/Deprecated.jsm");
+
 XPCOMUtils.defineLazyGetter(this, "BROWSER_NEW_TAB_URL", function () {
   const PREF = "browser.newtab.url";
 
@@ -57,6 +60,14 @@ function getBrowserURL()
   return "chrome://browser/content/browser.xul";
 }
 
+function getBoolPref(pref, defaultValue) {
+  Deprecated.warning("getBoolPref is deprecated and will be removed in a future release. " +
+                     "You should use Services.pref.getBoolPref (Services.jsm).",
+                     "https://github.com/MoonchildProductions/UXP/issues/989");
+  return Services.prefs.getBoolPref(pref, defaultValue);
+}
+
+
 function getTopWin(skipPopups) {
   // If this is called in a browser window, use that window regardless of
   // whether it's the frontmost window, since commands can be executed in
@@ -547,7 +558,7 @@ function checkForUpdates()
   // If there's an update ready to be applied, show the "Update Downloaded"
   // UI instead and let the user know they have to restart the application for
   // the changes to be applied.
-  if (um.activeUpdate && um.activeUpdate.state == "pending")
+  if (um.activeUpdate && ["pending", "pending-elevate", "applied"].includes(um.activeUpdate.state))
     prompter.showUpdateDownloaded(um.activeUpdate);
   else
     prompter.checkForUpdates();
@@ -573,10 +584,16 @@ function buildHelpMenu()
   var checkForUpdates = document.getElementById("checkForUpdates");
   var appMenuCheckForUpdates = document.getElementById("appmenu_checkForUpdates");
   var canCheckForUpdates = updates.canCheckForUpdates;
+  
   checkForUpdates.setAttribute("disabled", !canCheckForUpdates);
-  appMenuCheckForUpdates.setAttribute("disabled", !canCheckForUpdates);
-  if (!canCheckForUpdates)
+
+  if (appMenuCheckForUpdates) {
+    appMenuCheckForUpdates.setAttribute("disabled", !canCheckForUpdates);
+  }
+
+  if (!canCheckForUpdates) {
     return;
+  }
 
   var strings = document.getElementById("bundle_browser");
   var activeUpdate = um.activeUpdate;
@@ -612,19 +629,31 @@ function buildHelpMenu()
   }
 
   checkForUpdates.label = getStringWithUpdateName("updatesItem_" + key);
-  appMenuCheckForUpdates.label = getStringWithUpdateName("updatesItem_" + key);
+
+  if (appMenuCheckForUpdates) {
+    appMenuCheckForUpdates.label = getStringWithUpdateName("updatesItem_" + key);
+  }
+
   // updatesItem_default.accesskey, updatesItem_downloading.accesskey,
   // updatesItem_resume.accesskey or updatesItem_pending.accesskey
   checkForUpdates.accessKey = strings.getString("updatesItem_" + key +
                                                 ".accesskey");
-  appMenuCheckForUpdates.accessKey = strings.getString("updatesItem_" + key +
-                                                       ".accesskey");
+
+  if (appMenuCheckForUpdates) {
+    appMenuCheckForUpdates.accessKey = strings.getString("updatesItem_" + key +
+                                                         ".accesskey");
+  }
+
   if (um.activeUpdate && updates.isDownloading) {
     checkForUpdates.setAttribute("loading", "true");
-    appMenuCheckForUpdates.setAttribute("loading", "true");  
+    if (appMenuCheckForUpdates) {
+      appMenuCheckForUpdates.setAttribute("loading", "true");
+    }
   } else {
     checkForUpdates.removeAttribute("loading");
-    appMenuCheckForUpdates.removeAttribute("loading");
+    if (appMenuCheckForUpdates) {
+      appMenuCheckForUpdates.removeAttribute("loading");
+    }
   }
 #else
 #ifndef XP_MACOSX

application/palemoon/branding/shared/pref/preferences.inc

@@ -28,10 +28,6 @@ pref("app.update.promptWaitTime", 172800);
 // Add-on window fixes
 pref("extensions.getMoreThemesURL", "https://addons.palemoon.org/themes/");
 
-// Extensions Blocklist
-pref("extensions.blocklist.url","http://blocklist.palemoon.org/%VERSION%/blocklist.xml");
-pref("extensions.blocklist.itemURL", "http://blocklist.palemoon.org/info/?id=%blockID%");
-
 pref("extensions.update.autoUpdateDefault", true); // Automatically update extensions by default
 pref("extensions.getAddons.maxResults", 10);
 pref("extensions.getAddons.cache.enabled", false);

application/palemoon/components/places/PlacesUIUtils.jsm

@@ -1170,11 +1170,8 @@ this.PlacesUIUtils = {
    * @return The URL with the fragment at the end
    */
   getImageURLForResolution:
-  function PUIU_getImageURLForResolution(aWindow, aURL, aWidth = 16, aHeight = 16) {
-    let width  = Math.round(aWidth * aWindow.devicePixelRatio);
-    let height = Math.round(aHeight * aWindow.devicePixelRatio);
-    return aURL + (aURL.includes("#") ? "&" : "#") +
-           "-moz-resolution=" + width + "," + height;
+  function PUIU_getImageURLForResolution(aWindow, aURL, aWidth, aHeight) {
+    return aURL;
   }
 };
 

application/palemoon/components/search/content/search.xml

@@ -283,11 +283,6 @@
         <parameter name="element"/>
         <parameter name="uri"/>
         <body><![CDATA[
-          if (uri) {
-            let size = Math.round(16 * window.devicePixelRatio);
-            if (!uri.includes("#"))
-              uri += "#-moz-resolution=" + size + "," + size;
-          }
           element.setAttribute("src", uri);
         ]]></body>
       </method>

application/palemoon/config/version.txt

@@ -1 +1 @@
-28.5.0a2
+28.5.2

application/palemoon/locales/en-US/chrome/browser-region/region.properties

@@ -14,29 +14,25 @@ browser.search.order.4=Ecosia
 # This is the default set of web based feed handlers shown in the reader
 # selection UI
 browser.contentHandlers.types.0.title=My Yahoo!
-browser.contentHandlers.types.0.uri=http://add.my.yahoo.com/rss?url=%s
+browser.contentHandlers.types.0.uri=https://add.my.yahoo.com/rss?url=%s
 
 # increment this number when anything gets changed in the list below.  This will
 # cause Firefox to re-read these prefs and inject any new handlers into the 
 # profile database.  Note that "new" is defined as "has a different URL"; this
 # means that it's not possible to update the name of existing handler, so 
 # don't make any spelling errors here.
-goanna.handlerService.defaultHandlersVersion=3
-
-# The default set of protocol handlers for webcal:
-goanna.handlerService.schemes.webcal.0.name=30 Boxes
-goanna.handlerService.schemes.webcal.0.uriTemplate=http://30boxes.com/external/widget?refer=ff&url=%s
+gecko.handlerService.defaultHandlersVersion=5
 
 # The default set of protocol handlers for mailto:
-goanna.handlerService.schemes.mailto.0.name=Yahoo! Mail
-goanna.handlerService.schemes.mailto.0.uriTemplate=https://compose.mail.yahoo.com/?To=%s
-goanna.handlerService.schemes.mailto.1.name=Gmail
-goanna.handlerService.schemes.mailto.1.uriTemplate=https://mail.google.com/mail/?extsrc=mailto&url=%s
+gecko.handlerService.schemes.mailto.0.name=Yahoo! Mail
+gecko.handlerService.schemes.mailto.0.uriTemplate=https://compose.mail.yahoo.com/?To=%s
+gecko.handlerService.schemes.mailto.1.name=Gmail
+gecko.handlerService.schemes.mailto.1.uriTemplate=https://mail.google.com/mail/?extsrc=mailto&url=%s
 
 # The default set of protocol handlers for irc:
-goanna.handlerService.schemes.irc.0.name=Mibbit
-goanna.handlerService.schemes.irc.0.uriTemplate=https://www.mibbit.com/?url=%s
+gecko.handlerService.schemes.irc.0.name=Mibbit
+gecko.handlerService.schemes.irc.0.uriTemplate=https://www.mibbit.com/?url=%s
 
 # The default set of protocol handlers for ircs:
-goanna.handlerService.schemes.ircs.0.name=Mibbit
-goanna.handlerService.schemes.ircs.0.uriTemplate=https://www.mibbit.com/?url=%s
+gecko.handlerService.schemes.ircs.0.name=Mibbit
+gecko.handlerService.schemes.ircs.0.uriTemplate=https://www.mibbit.com/?url=%s

dom/base/nsGlobalWindow.cpp

@@ -9335,7 +9335,7 @@ nsGlobalWindow::EnterModalState()
 
     topWin->mSuspendedDoc = topDoc;
     if (topDoc) {
-      topDoc->SuppressEventHandling(nsIDocument::eAnimationsOnly);
+      topDoc->SuppressEventHandling(nsIDocument::eEvents);
     }
 
     nsGlobalWindow* inner = topWin->GetCurrentInnerWindowInternal();
@@ -9372,7 +9372,7 @@ nsGlobalWindow::LeaveModalState()
 
     if (topWin->mSuspendedDoc) {
       nsCOMPtr<nsIDocument> currentDoc = topWin->GetExtantDoc();
-      topWin->mSuspendedDoc->UnsuppressEventHandlingAndFireEvents(nsIDocument::eAnimationsOnly,
+      topWin->mSuspendedDoc->UnsuppressEventHandlingAndFireEvents(nsIDocument::eEvents,
                                                                   currentDoc == topWin->mSuspendedDoc);
       topWin->mSuspendedDoc = nullptr;
     }

dom/events/DataTransfer.cpp

@@ -39,6 +39,7 @@
 #include "mozilla/dom/OSFileSystem.h"
 #include "mozilla/dom/Promise.h"
 #include "nsNetUtil.h"
+#include "nsReadableUtils.h"
 
 namespace mozilla {
 namespace dom {
@@ -644,6 +645,13 @@ DataTransfer::PrincipalMaySetData(const nsAString& aType,
       NS_WARNING("Disallowing adding x-moz-file or x-moz-file-promize types to DataTransfer");
       return false;
     }
+    
+    // Disallow content from creating x-moz-place flavors, so that it cannot
+    // create fake Places smart queries exposing user data.
+    if (StringBeginsWith(aType, NS_LITERAL_STRING("text/x-moz-place"))) {
+      NS_WARNING("Disallowing adding moz-place types to DataTransfer");
+      return false;
+    }
   }
   return true;
 }

dom/indexedDB/ActorsParent.cpp

@@ -23717,32 +23717,38 @@ TransactionDatabaseOperationBase::SendPreprocessInfoOrResults(
   MOZ_ASSERT(mTransaction);
 
   if (NS_WARN_IF(IsActorDestroyed())) {
-    // Don't send any notifications if the actor was destroyed already.
+    // Normally we wouldn't need to send any notifications if the actor was
+    // already destroyed, but this can be a VersionChangeOp which needs to
+    // notify its parent operation (OpenDatabaseOp) about the failure.
+    // So SendFailureResult needs to be called even when the actor was
+    // destroyed.  Normal operations redundantly check if the actor was
+    // destroyed in SendSuccessResult and SendFailureResult, therefore it's
+    // ok to call it in all cases here.
     if (NS_SUCCEEDED(mResultCode)) {
       IDB_REPORT_INTERNAL_ERR();
       mResultCode = NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
-  } else {
-    if (mTransaction->IsInvalidated() || mTransaction->IsAborted()) {
-      // Aborted transactions always see their requests fail with ABORT_ERR,
-      // even if the request succeeded or failed with another error.
-      mResultCode = NS_ERROR_DOM_INDEXEDDB_ABORT_ERR;
-    } else if (NS_SUCCEEDED(mResultCode)) {
-      if (aSendPreprocessInfo) {
-        // This should not release the IPDL reference.
-        mResultCode = SendPreprocessInfo();
-      } else {
-        // This may release the IPDL reference.
-        mResultCode = SendSuccessResult();
-      }
+  } else if (mTransaction->IsInvalidated() || mTransaction->IsAborted()) {
+    // Aborted transactions always see their requests fail with ABORT_ERR,
+    // even if the request succeeded or failed with another error.
+    mResultCode = NS_ERROR_DOM_INDEXEDDB_ABORT_ERR;
+  }
+  
+  if (NS_SUCCEEDED(mResultCode)) {
+    if (aSendPreprocessInfo) {
+      // This should not release the IPDL reference.
+      mResultCode = SendPreprocessInfo();
+    } else {
+      // This may release the IPDL reference.
+      mResultCode = SendSuccessResult();
     }
+  }
 
-    if (NS_FAILED(mResultCode)) {
-      // This should definitely release the IPDL reference.
-      if (!SendFailureResult(mResultCode)) {
-        // Abort the transaction.
-        mTransaction->Abort(mResultCode, /* aForce */ false);
-      }
+  if (NS_FAILED(mResultCode)) {
+    // This should definitely release the IPDL reference.
+    if (!SendFailureResult(mResultCode)) {
+      // Abort the transaction.
+      mTransaction->Abort(mResultCode, /* aForce */ false);
     }
   }
 

dom/media/AudioConverter.cpp

@@ -5,8 +5,8 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "AudioConverter.h"
-#include <string.h>
 #include <speex/speex_resampler.h>
+#include <string.h>
 #include <cmath>
 
 /*
@@ -140,24 +140,28 @@ static inline int16_t clipTo15(int32_t aX)
 size_t
 AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
 {
-  MOZ_ASSERT(mIn.Format() == AudioConfig::FORMAT_S16 ||
-             mIn.Format() == AudioConfig::FORMAT_FLT);
-  MOZ_ASSERT(mIn.Channels() >= mOut.Channels());
-  MOZ_ASSERT(mIn.Layout() == AudioConfig::ChannelLayout(mIn.Channels()),
-             "Can only downmix input data in SMPTE layout");
-  MOZ_ASSERT(mOut.Layout() == AudioConfig::ChannelLayout(2) ||
-             mOut.Layout() == AudioConfig::ChannelLayout(1));
+  MOZ_DIAGNOSTIC_ASSERT(mIn.Format() == AudioConfig::FORMAT_S16 ||
+                        mIn.Format() == AudioConfig::FORMAT_FLT);
+  MOZ_DIAGNOSTIC_ASSERT(mIn.Channels() >= mOut.Channels());
+  MOZ_DIAGNOSTIC_ASSERT(
+      mIn.Layout() == AudioConfig::ChannelLayout(mIn.Channels()),
+      "Can only downmix input data in SMPTE layout");
+  MOZ_DIAGNOSTIC_ASSERT(mOut.Layout() == AudioConfig::ChannelLayout(2) ||
+                        mOut.Layout() == AudioConfig::ChannelLayout(1),
+      "Can only downmix to stereo or mono");
 
-  uint32_t channels = mIn.Channels();
+  uint32_t inChannels = mIn.Channels();
+  uint32_t outChannels = mOut.Channels();
 
-  if (channels == 1 && mOut.Channels() == 1) {
+  if (inChannels == outChannels) {
+    // Number of channels is equal; no processing needed, just move data.
     if (aOut != aIn) {
       memmove(aOut, aIn, FramesOutToBytes(aFrames));
     }
     return aFrames;
   }
 
-  if (channels > 2) {
+  if (inChannels > 2) {
     if (mIn.Format() == AudioConfig::FORMAT_FLT) {
       // Downmix matrix. Per-row normalization 1 for rows 3,4 and 2 for rows 5-8.
       static const float dmatrix[6][8][2]= {
@@ -174,12 +178,18 @@ AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
       for (uint32_t i = 0; i < aFrames; i++) {
         float sampL = 0.0;
         float sampR = 0.0;
-        for (uint32_t j = 0; j < channels; j++) {
-          sampL += in[i*mIn.Channels()+j]*dmatrix[mIn.Channels()-3][j][0];
-          sampR += in[i*mIn.Channels()+j]*dmatrix[mIn.Channels()-3][j][1];
+        for (uint32_t j = 0; j < inChannels; j++) {
+          sampL += in[i * inChannels + j] * dmatrix[inChannels - 3][j][0];
+          sampR += in[i * inChannels + j] * dmatrix[inChannels - 3][j][1];
+        }
+        if (outChannels == 2) {
+          // Stereo
+          *out++ = sampL;
+          *out++ = sampR;
+        } else {
+          // Mono
+          *out++ = (sampL + sampR) * 0.5;
         }
-        *out++ = sampL;
-        *out++ = sampR;
       }
     } else if (mIn.Format() == AudioConfig::FORMAT_S16) {
       // Downmix matrix. Per-row normalization 1 for rows 3,4 and 2 for rows 5-8.
@@ -198,45 +208,51 @@ AudioConverter::DownmixAudio(void* aOut, const void* aIn, size_t aFrames) const
       for (uint32_t i = 0; i < aFrames; i++) {
         int32_t sampL = 0;
         int32_t sampR = 0;
-        for (uint32_t j = 0; j < channels; j++) {
-          sampL+=in[i*channels+j]*dmatrix[channels-3][j][0];
-          sampR+=in[i*channels+j]*dmatrix[channels-3][j][1];
+        for (uint32_t j = 0; j < inChannels; j++) {
+          sampL += in[i * inChannels + j] * dmatrix[inChannels - 3][j][0];
+          sampR += in[i * inChannels + j] * dmatrix[inChannels - 3][j][1];
+        }
+        sampL = clipTo15((sampL + 8192) >> 14);
+        sampR = clipTo15((sampR + 8192) >> 14);
+        if (outChannels == 2) {
+          // Stereo
+          *out++ = sampL;
+          *out++ = sampR;
+        } else {
+          // Mono
+          *out++ = (sampL + sampR) * 0.5;
         }
-        *out++ = clipTo15((sampL + 8192)>>14);
-        *out++ = clipTo15((sampR + 8192)>>14);
       }
     } else {
       MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
     }
 
-    // If we are to continue downmixing to mono, start working on the output
-    // buffer.
-    aIn = aOut;
-    channels = 2;
+    return aFrames;
   }
 
-  if (mOut.Channels() == 1) {
-    if (mIn.Format() == AudioConfig::FORMAT_FLT) {
-      const float* in = static_cast<const float*>(aIn);
-      float* out = static_cast<float*>(aOut);
-      for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
-        float sample = 0.0;
-        // The sample of the buffer would be interleaved.
-        sample = (in[fIdx*channels] + in[fIdx*channels + 1]) * 0.5;
-        *out++ = sample;
-      }
-    } else if (mIn.Format() == AudioConfig::FORMAT_S16) {
-      const int16_t* in = static_cast<const int16_t*>(aIn);
-      int16_t* out = static_cast<int16_t*>(aOut);
-      for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
-        int32_t sample = 0.0;
-        // The sample of the buffer would be interleaved.
-        sample = (in[fIdx*channels] + in[fIdx*channels + 1]) * 0.5;
-        *out++ = sample;
-      }
-    } else {
-      MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
+  // If we get here, we're doing a stereo -> mono conversion.
+  MOZ_DIAGNOSTIC_ASSERT(inChannels == 2 && outChannels == 1);
+  
+  if (mIn.Format() == AudioConfig::FORMAT_FLT) {
+    const float* in = static_cast<const float*>(aIn);
+    float* out = static_cast<float*>(aOut);
+    for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
+      float sample = 0.0;
+      // The sample of the buffer would be interleaved.
+      sample = (in[fIdx * inChannels] + in[fIdx * inChannels + 1]) * 0.5;
+      *out++ = sample;
     }
+  } else if (mIn.Format() == AudioConfig::FORMAT_S16) {
+    const int16_t* in = static_cast<const int16_t*>(aIn);
+    int16_t* out = static_cast<int16_t*>(aOut);
+    for (size_t fIdx = 0; fIdx < aFrames; ++fIdx) {
+      int32_t sample = 0.0;
+      // The sample of the buffer would be interleaved.
+      sample = (in[fIdx * inChannels] + in[fIdx * inChannels + 1]) * 0.5;
+      *out++ = sample;
+    }
+  } else {
+    MOZ_DIAGNOSTIC_ASSERT(false, "Unsupported data type");
   }
   return aFrames;
 }

dom/xslt/base/txURIUtils.cpp

@@ -45,6 +45,10 @@ void URIUtils::resolveHref(const nsAString& href, const nsAString& base,
 void
 URIUtils::ResetWithSource(nsIDocument *aNewDoc, nsINode *aSourceNode)
 {
+	if (!aSourceNode) {
+		return;
+	}
+
     nsCOMPtr<nsIDocument> sourceDoc = aSourceNode->OwnerDoc();
     nsIPrincipal* sourcePrincipal = sourceDoc->NodePrincipal();
 

embedding/components/find/nsFind.cpp

@@ -932,7 +932,7 @@ nsFind::ResetAll()
 // Take nodes out of the tree with NextNode, until null (NextNode will return 0
 // at the end of our range).
 NS_IMETHODIMP
-nsFind::Find(const char16_t* aPatText, nsIDOMRange* aSearchRange,
+nsFind::Find(const nsAString& aPatText, nsIDOMRange* aSearchRange,
              nsIDOMRange* aStartPoint, nsIDOMRange* aEndPoint,
              nsIDOMRange** aRangeRet)
 {
@@ -949,10 +949,6 @@ nsFind::Find(const char16_t* aPatText, nsIDOMRange* aSearchRange,
   NS_ENSURE_ARG_POINTER(aRangeRet);
   *aRangeRet = 0;
 
-  if (!aPatText) {
-    return NS_ERROR_NULL_POINTER;
-  }
-
   ResetAll();
 
   nsAutoString patAutoStr(aPatText);
@@ -966,6 +962,11 @@ nsFind::Find(const char16_t* aPatText, nsIDOMRange* aSearchRange,
 
   const char16_t* patStr = patAutoStr.get();
   int32_t patLen = patAutoStr.Length() - 1;
+  
+  // If this function is called with an empty string, we should early exit.
+  if (patLen < 0) {
+    return NS_OK;
+  }
 
   // current offset into the pattern -- reset to beginning/end:
   int32_t pindex = (mFindBackward ? patLen : 0);

embedding/components/find/nsIFind.idl

@@ -29,6 +29,6 @@ interface nsIFind : nsISupports
    *                     end (forward) or start (backward).
    * @retval             A range spanning the match that was found (or null).
    */
-  nsIDOMRange Find(in wstring aPatText, in nsIDOMRange aSearchRange,
+  nsIDOMRange Find(in AString aPatText, in nsIDOMRange aSearchRange,
                    in nsIDOMRange aStartPoint, in nsIDOMRange aEndPoint);
 };

embedding/components/find/nsWebBrowserFind.cpp

@@ -751,7 +751,7 @@ nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping,
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = find->Find(mSearchString.get(), searchRange, startPt, endPt,
+  rv = find->Find(mSearchString, searchRange, startPt, endPt,
                   getter_AddRefs(foundRange));
 
   if (NS_SUCCEEDED(rv) && foundRange) {

embedding/test/test_nsFind.html

@@ -33,20 +33,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=450048
   var startPt = searchRange;
   var endPt = searchRange;
 
-  // Check |null| detection on |aPatText| parameter.
-  try {
-    rf.Find(null, searchRange, startPt, endPt);
-
-    ok(false, "Missing NS_ERROR_NULL_POINTER exception");
-  } catch (e) {
-    e = SpecialPowers.wrap(e);
-    if (e.result == SpecialPowers.Cr.NS_ERROR_NULL_POINTER) {
-      ok(true, null);
-    } else {
-      throw e;
-    }
-  }
-
   // Check |null| detection on |aSearchRange| parameter.
   try {
     rf.Find("", null, startPt, endPt);

gfx/layers/composite/CanvasLayerComposite.cpp

@@ -43,9 +43,13 @@ bool
 CanvasLayerComposite::SetCompositableHost(CompositableHost* aHost)
 {
   switch (aHost->GetType()) {
-    case CompositableType::IMAGE:
+    case CompositableType::IMAGE: {
+      if (mCompositableHost && aHost != mCompositableHost) {
+        mCompositableHost->Detach(this);
+      }
       mCompositableHost = aHost;
       return true;
+    }
     default:
       return false;
   }

gfx/layers/composite/ImageLayerComposite.cpp

@@ -50,9 +50,14 @@ bool
 ImageLayerComposite::SetCompositableHost(CompositableHost* aHost)
 {
   switch (aHost->GetType()) {
-    case CompositableType::IMAGE:
-      mImageHost = static_cast<ImageHost*>(aHost);
+    case CompositableType::IMAGE: {
+      ImageHost* newImageHost = static_cast<ImageHost*>(aHost);
+      if (mImageHost && newImageHost != mImageHost) {
+        mImageHost->Detach(this);
+      }
+      mImageHost = newImageHost;
       return true;
+    }
     default:
       return false;
   }

gfx/layers/composite/PaintedLayerComposite.cpp

@@ -49,9 +49,14 @@ PaintedLayerComposite::SetCompositableHost(CompositableHost* aHost)
   switch (aHost->GetType()) {
     case CompositableType::CONTENT_TILED:
     case CompositableType::CONTENT_SINGLE:
-    case CompositableType::CONTENT_DOUBLE:
-      mBuffer = static_cast<ContentHost*>(aHost);
+    case CompositableType::CONTENT_DOUBLE: {
+      ContentHost* newBuffer = static_cast<ContentHost*>(aHost);
+      if (mBuffer && newBuffer != mBuffer) {
+        mBuffer->Detach(this);
+      }
+      mBuffer = newBuffer;
       return true;
+    }
     default:
       return false;
   }

gfx/skia/skia/src/core/SkPath.cpp

@@ -1620,10 +1620,10 @@ void SkPath::reverseAddPath(const SkPath& srcPath) {
         src = tmp.set(srcPath);
     }
 
-    SkPathRef::Editor ed(&fPathRef, src->fPathRef->countPoints(), src->fPathRef->countVerbs());
+    SkPathRef::Editor ed(&fPathRef, src->countPoints(), src->countVerbs());
 
     const SkPoint* pts = src->fPathRef->pointsEnd();
-    // we will iterator through src's verbs backwards
+    // we will iterate through src's verbs backwards
     const uint8_t* verbs = src->fPathRef->verbsMemBegin(); // points at the last verb
     const uint8_t* verbsEnd = src->fPathRef->verbs(); // points just past the first verb
     const SkScalar* conicWeights = src->fPathRef->conicWeightsEnd();
@@ -1743,6 +1743,7 @@ void SkPath::transform(const SkMatrix& matrix, SkPath* dst) const {
         SkPathRef::CreateTransformedCopy(&dst->fPathRef, *fPathRef.get(), matrix);
 
         if (this != dst) {
+            dst->fLastMoveToIndex = fLastMoveToIndex;
             dst->fFillType = fFillType;
             dst->fConvexity = kUnknown_Convexity;
             dst->fIsVolatile = fIsVolatile;

js/src/frontend/BytecodeEmitter.cpp

@@ -2260,12 +2260,14 @@ BytecodeEmitter::locationOfNameBoundInFunctionScope(JSAtom* name, EmitterScope*
 bool
 BytecodeEmitter::emitCheck(ptrdiff_t delta, ptrdiff_t* offset)
 {
-    *offset = code().length();
+    size_t oldLength = code().length();
+    *offset = ptrdiff_t(oldLength);
 
-    // Start it off moderately large to avoid repeated resizings early on.
-    // ~98% of cases fit within 1024 bytes.
-    if (code().capacity() == 0 && !code().reserve(1024))
-        return false;
+    size_t newLength = oldLength + size_t(delta);
+    if (MOZ_UNLIKELY(newLength > MaxBytecodeLength)) {
+      ReportAllocationOverflow(cx);
+      return false;
+    }
 
     if (!code().growBy(delta)) {
         ReportOutOfMemory(cx);
@@ -10697,17 +10699,19 @@ BytecodeEmitter::emitTreeInBranch(ParseNode* pn)
 static bool
 AllocSrcNote(ExclusiveContext* cx, SrcNotesVector& notes, unsigned* index)
 {
-    // Start it off moderately large to avoid repeated resizings early on.
-    // ~99% of cases fit within 256 bytes.
-    if (notes.capacity() == 0 && !notes.reserve(256))
-        return false;
+    size_t oldLength = notes.length();
 
+    if (MOZ_UNLIKELY(oldLength + 1 > MaxSrcNotesLength)) {
+        ReportAllocationOverflow(cx);
+        return false;
+    }
+    
     if (!notes.growBy(1)) {
         ReportOutOfMemory(cx);
         return false;
     }
 
-    *index = notes.length() - 1;
+    *index = oldLength;
     return true;
 }
 
@@ -10833,6 +10837,10 @@ BytecodeEmitter::setSrcNoteOffset(unsigned index, unsigned which, ptrdiff_t offs
         /* Maybe this offset was already set to a four-byte value. */
         if (!(*sn & SN_4BYTE_OFFSET_FLAG)) {
             /* Insert three dummy bytes that will be overwritten shortly. */
+            if (MOZ_UNLIKELY(notes.length() + 3 > MaxSrcNotesLength)) {
+                ReportAllocationOverflow(cx);
+                return false;
+            }
             jssrcnote dummy = 0;
             if (!(sn = notes.insert(sn, dummy)) ||
                 !(sn = notes.insert(sn, dummy)) ||

js/src/frontend/BytecodeEmitter.h

@@ -109,10 +109,12 @@ struct CGYieldOffsetList {
     void finish(YieldOffsetArray& array, uint32_t prologueLength);
 };
 
-// Use zero inline elements because these go on the stack and affect how many
-// nested functions are possible.
-typedef Vector<jsbytecode, 0> BytecodeVector;
-typedef Vector<jssrcnote, 0> SrcNotesVector;
+static size_t MaxBytecodeLength = INT32_MAX;
+static size_t MaxSrcNotesLength = INT32_MAX;
+
+// Have a few inline elements to avoid heap allocation for tiny sequences.
+typedef Vector<jsbytecode, 256> BytecodeVector;
+typedef Vector<jssrcnote, 64> SrcNotesVector;
 
 // Linked list of jump instructions that need to be patched. The linked list is
 // stored in the bytes of the incomplete bytecode that will be patched, so no

layout/base/nsPresShell.cpp

@@ -8192,6 +8192,9 @@ PresShell::HandleEventInternal(WidgetEvent* aEvent,
           }
         }
       }
+      if (aEvent->mMessage == eKeyDown) {
+        mIsLastKeyDownCanceled = aEvent->mFlags.mDefaultPrevented;
+      }
       break;
     }
     case eMouseUp:
@@ -8981,6 +8984,9 @@ PresShell::FireOrClearDelayedEvents(bool aFireEvents)
            !doc->EventHandlingSuppressed()) {
       nsAutoPtr<DelayedEvent> ev(mDelayedEvents[0].forget());
       mDelayedEvents.RemoveElementAt(0);
+      if (ev->IsKeyPressEvent() && mIsLastKeyDownCanceled) {
+        continue;
+      }
       ev->Dispatch();
     }
     if (!doc->EventHandlingSuppressed()) {
@@ -9775,6 +9781,12 @@ PresShell::DelayedKeyEvent::DelayedKeyEvent(WidgetKeyboardEvent* aEvent) :
   mEvent = keyEvent;
 }
 
+bool
+PresShell::DelayedKeyEvent::IsKeyPressEvent()
+{
+  return mEvent->mMessage == eKeyPress;
+}
+
 // Start of DEBUG only code
 
 #ifdef DEBUG

layout/base/nsPresShell.h

@@ -617,6 +617,7 @@ protected:
   public:
     virtual ~DelayedEvent() { }
     virtual void Dispatch() { }
+    virtual bool IsKeyPressEvent() { return false; }
   };
 
   class DelayedInputEvent : public DelayedEvent
@@ -641,6 +642,7 @@ protected:
   {
   public:
     explicit DelayedKeyEvent(mozilla::WidgetKeyboardEvent* aEvent);
+    virtual bool IsKeyPressEvent() override;
   };
 
   // Check if aEvent is a mouse event and record the mouse location for later
@@ -951,6 +953,8 @@ protected:
   // Whether the widget has received a paint message yet.
   bool                      mHasReceivedPaintMessage : 1;
 
+  bool                      mIsLastKeyDownCanceled : 1;
+
   static bool               sDisableNonTestMouseEvents;
 };
 

media/libpng/png.c

@@ -4517,8 +4517,7 @@ png_image_free(png_imagep image)
    if (image != NULL && image->opaque != NULL &&
       image->opaque->error_buf == NULL)
    {
-      /* Ignore errors here: */
-      (void)png_safe_execute(image, png_image_free_function, image);
+      png_image_free_function(image);
       image->opaque = NULL;
    }
 }

media/webrtc/trunk/webrtc/modules/video_capture/windows/MediaType.cpp

@@ -82,7 +82,10 @@ MediaType::Assign(const AM_MEDIA_TYPE* aMediaType)
   Clear();
 
   // Shallow copy.
-  memcpy(this, aMediaType, sizeof(AM_MEDIA_TYPE));
+  memcpy(static_cast<AM_MEDIA_TYPE*>(this), aMediaType, sizeof(AM_MEDIA_TYPE));
+
+  if (pUnk)
+    pUnk->AddRef();
 
   // Create deep copy of incoming data...
   if (cbFormat) {
@@ -92,9 +95,6 @@ MediaType::Assign(const AM_MEDIA_TYPE* aMediaType)
     memcpy(pbFormat, aMediaType->pbFormat, cbFormat);
   }
 
-  if (pUnk)
-    pUnk->AddRef();
-
   return S_OK;
 }
 

modules/libpref/init/all.js

@@ -1385,6 +1385,7 @@ pref("network.protocol-handler.external.vbscript", false);
 pref("network.protocol-handler.external.javascript", false);
 pref("network.protocol-handler.external.data", false);
 pref("network.protocol-handler.external.ms-help", false);
+pref("network.protocol-handler.external.res", false);
 pref("network.protocol-handler.external.shell", false);
 pref("network.protocol-handler.external.vnd.ms.radio", false);
 #ifdef XP_MACOSX

netwerk/base/nsMediaFragmentURIParser.h

@@ -89,7 +89,6 @@ private:
   bool ParseNPTMM(nsDependentSubstring& aString, uint32_t& aMinute);
   bool ParseNPTSS(nsDependentSubstring& aString, uint32_t& aSecond);
   bool ParseXYWH(nsDependentSubstring aString);
-  bool ParseMozResolution(nsDependentSubstring aString);
   bool ParseMozSampleSize(nsDependentSubstring aString);
 
   // Media fragment information.

services/sync/modules/engines/history.js

@@ -346,7 +346,7 @@ HistoryStore.prototype = {
   },
 
   wipe: function HistStore_wipe() {
-    PlacesUtils.history.removeAllPages();
+    PlacesUtils.history.clear();
   }
 };
 

toolkit/components/passwordmgr/test/subtst_master_pass.html

@@ -2,11 +2,6 @@
 This form triggers a MP and gets filled in.<br>
 <form>
 Username: <input type="text"     id="userfield" name="u"><br>
-Password: <input type="password" id="passfield" name="p"><br>
-<script>
-    // Only notify when we fill in the password field.
-    document.getElementById("passfield").addEventListener("input", function() {
-        parent.postMessage("filled", "*");
-    });
-</script>
+Password: <input type="password" id="passfield" name="p"
+                 oninput="parent.postMessage('filled', '*');"><br>
 </form>

toolkit/components/places/PlacesUtils.jsm

@@ -908,6 +908,7 @@ this.PlacesUtils = {
    * @param   type
    *          The content type of the blob.
    * @returns An array of objects representing each item contained by the source.
+   * @throws if the blob contains invalid data.
    */
   unwrapNodes: function PU_unwrapNodes(blob, type) {
     // We split on "\n"  because the transferable system converts "\r\n" to "\n"
@@ -939,7 +940,7 @@ this.PlacesUtils = {
             catch (e) {}
           }
           // note:  this._uri() will throw if uriString is not a valid URI
-          if (this._uri(uriString)) {
+          if (this._uri(uriString) && this._uri(uriString).scheme != "place") {
             nodes.push({ uri: uriString,
                          title: titleString ? titleString : uriString,
                          type: this.TYPE_X_MOZ_URL });
@@ -952,11 +953,12 @@ this.PlacesUtils = {
         for (let i = 0; i < parts.length; i++) {
           let uriString = parts[i];
           // text/uri-list is converted to TYPE_UNICODE but it could contain
-          // comments line prepended by #, we should skip them
-          if (uriString.substr(0, 1) == '\x23')
+          // comments line prepended by #, we should skip them, as well as
+          // empty URIs
+          if (uriString.substr(0, 1) == '\x23' || uriString == "")
             continue;
           // note: this._uri() will throw if uriString is not a valid URI
-          if (uriString != "" && this._uri(uriString))
+          if (this._uri(uriString).scheme != "place")
             nodes.push({ uri: uriString,
                          title: uriString,
                          type: this.TYPE_X_MOZ_URL });

toolkit/components/typeaheadfind/nsTypeAheadFind.cpp

@@ -420,7 +420,7 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
 
   while (true) {    // ----- Outer while loop: go through all docs -----
     while (true) {  // === Inner while loop: go through a single doc ===
-      mFind->Find(mTypeAheadBuffer.get(), mSearchRange, mStartPointRange,
+      mFind->Find(mTypeAheadBuffer, mSearchRange, mStartPointRange,
                   mEndPointRange, getter_AddRefs(returnRange));
       
       if (!returnRange)

toolkit/mozapps/update/nsUpdateService.js

@@ -3739,8 +3739,8 @@ UpdatePrompt.prototype = {
       return;
     }
 
-    this._showUnobtrusiveUI(null, URI_UPDATE_PROMPT_DIALOG, null,
-                           UPDATE_WINDOW_NAME, "updatesavailable", update);
+    this._showUI(null, URI_UPDATE_PROMPT_DIALOG, null,
+                 UPDATE_WINDOW_NAME, "updatesavailable", update);
   },
 
   /**
@@ -3756,13 +3756,8 @@ UpdatePrompt.prototype = {
     if (this._getAltUpdateWindow())
       return;
 
-    if (background) {
-      this._showUnobtrusiveUI(null, URI_UPDATE_PROMPT_DIALOG, null,
-                              UPDATE_WINDOW_NAME, "finishedBackground", update);
-    } else {
-      this._showUI(null, URI_UPDATE_PROMPT_DIALOG, null,
-                   UPDATE_WINDOW_NAME, "finishedBackground", update);
-    }
+    this._showUI(null, URI_UPDATE_PROMPT_DIALOG, null,
+                 UPDATE_WINDOW_NAME, "finishedBackground", update);
   },
 
   /**

widget/windows/nsClipboard.cpp

@@ -291,16 +291,20 @@ nsresult nsClipboard::GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLe
   nsresult  result = NS_ERROR_FAILURE;
   if (aHGBL != nullptr) {
     LPSTR lpStr = (LPSTR) GlobalLock(aHGBL);
-    DWORD allocSize = GlobalSize(aHGBL);
-    char* data = static_cast<char*>(malloc(allocSize + 3));
+    CheckedInt<uint32_t> allocSize = CheckedInt<uint32_t>(GlobalSize(aHGBL)) + 3;
+    if (!allocSize.isValid()) {
+      return NS_ERROR_INVALID_ARG;
+    }
+    char* data = static_cast<char*>(malloc(allocSize.value()));
     if ( data ) {    
-      memcpy ( data, lpStr, allocSize );
-      data[allocSize] = data[allocSize + 1] = data[allocSize + 2] =
-          '\0'; // null terminate for safety
+      uint32_t size = allocSize.value() - 3;
+      memcpy(data, lpStr, size);
+      // null terminate for safety
+      data[size] = data[size + 1] = data[size + 2] = '\0';
 
       GlobalUnlock(aHGBL);
       *aData = data;
-      *aLen = allocSize;
+      *aLen = size;
 
       result = NS_OK;
     }

xpcom/base/nsCycleCollector.cpp

@@ -2832,6 +2832,11 @@ nsCycleCollector::ForgetSkippable(bool aRemoveChildlessNodes,
 {
   CheckThreadSafety();
 
+  // Avoid this when we're aleady dealing with snow-white objects.
+  if (mFreeingSnowWhite) {
+    return;
+  }
+
   mozilla::Maybe<mozilla::AutoGlobalTimelineMarker> marker;
   if (NS_IsMainThread()) {
     marker.emplace("nsCycleCollector::ForgetSkippable", MarkerStackRequest::NO_STACK);

xpcom/io/nsLocalFileWin.cpp

@@ -3034,6 +3034,7 @@ nsLocalFile::IsExecutable(bool* aResult)
       "ins",
       "isp",
       "jar",         // java application bundle
+      "jnlp",        // java web start
       "js",
       "jse",
       "lnk",