Issue #1803 - Convert std::*<T>::value/::type to _v and _t suffixes.

This excludes uses in third-party libs in our tree.
Merge pull request 'implement URL.parse()' (#3141 ) from Basilisk-Dev/UXP-contrib:urlparse into master
2026-07-15 11:20:06 +02:00 · 2026-07-14 21:05:40 +00:00 · 2026-07-14 16:07:45 -04:00 · 2026-07-13 12:44:06 +00:00 · 2026-07-13 12:43:15 +00:00 · 2026-07-11 10:41:52 -04:00
765 changed files with 3660 additions and 45608 deletions
@@ -18,10 +18,6 @@
 #endif
 #include <gtk/gtk.h>

-#if (MOZ_WIDGET_GTK == 3)
-extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
-#endif
-
 using namespace mozilla;
 using namespace mozilla::a11y;

@@ -33,12 +29,20 @@ extern "C" {
 typedef GType (* AtkGetTypeType) (void);
 typedef void (*GnomeAccessibilityInit) (void);
 typedef void (*GnomeAccessibilityShutdown) (void);
+#if (MOZ_WIDGET_GTK == 3)
+typedef int (*AtkBridgeAdaptorInit) (int*, char***);
+#endif
 }

 static PRLibrary* sATKLib = nullptr;
 static const char sATKLibName[] = "libatk-1.0.so.0";
 static const char sATKHyperlinkImplGetTypeSymbol[] =
  "atk_hyperlink_impl_get_type";
+#if (MOZ_WIDGET_GTK == 3)
+static PRLibrary* sAtkBridgeAdaptorLib = nullptr;
+static const char sAtkBridgeAdaptorLibName[] = "libatk-bridge-2.0.so.0";
+static const char sAtkBridgeAdaptorInitSymbol[] = "atk_bridge_adaptor_init";
+#endif

 gboolean toplevel_event_watcher(GSignalInvocationHint*, guint, const GValue*,
                                gpointer);
@@ -127,6 +131,38 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
    return NS_OK;
 }

+#if (MOZ_WIDGET_GTK == 3)
+static bool
+InitAtkBridgeAdaptor()
+{
+  AtkBridgeAdaptorInit initBridge =
+    reinterpret_cast<AtkBridgeAdaptorInit>(
+      PR_FindFunctionSymbolAndLibrary(sAtkBridgeAdaptorInitSymbol,
+                                      &sAtkBridgeAdaptorLib));
+
+  if (!initBridge) {
+    sAtkBridgeAdaptorLib = PR_LoadLibrary(sAtkBridgeAdaptorLibName);
+    if (sAtkBridgeAdaptorLib) {
+      initBridge =
+        reinterpret_cast<AtkBridgeAdaptorInit>(
+          PR_FindFunctionSymbol(sAtkBridgeAdaptorLib,
+                                sAtkBridgeAdaptorInitSymbol));
+      if (!initBridge) {
+        PR_UnloadLibrary(sAtkBridgeAdaptorLib);
+        sAtkBridgeAdaptorLib = nullptr;
+      }
+    }
+  }
+
+  if (!initBridge) {
+    return false;
+  }
+
+  initBridge(nullptr, nullptr);
+  return true;
+}
+#endif
+
 void
 a11y::PlatformInit()
 {
@@ -181,9 +217,7 @@ a11y::PlatformInit()
  // Init atk-bridge now
  PR_SetEnv("NO_AT_BRIDGE=0");
 #if (MOZ_WIDGET_GTK == 3)
-  if (atk_bridge_adaptor_init) {
-    atk_bridge_adaptor_init(nullptr, nullptr);
-  } else
+  if (!InitAtkBridgeAdaptor())
 #endif
  {
    nsresult rv = LoadGtkModule(sAtkBridge);
@@ -228,6 +262,13 @@ a11y::PlatformShutdown()
        sAtkBridge.init = nullptr;
        sAtkBridge.shutdown = nullptr;
    }
+#if (MOZ_WIDGET_GTK == 3)
+    if (sAtkBridgeAdaptorLib) {
+        // Do not shutdown/unload atk-bridge; an exit function registered by
+        // the bridge will take care of it.
+        sAtkBridgeAdaptorLib = nullptr;
+    }
+#endif
 #if (MOZ_WIDGET_GTK == 2)
    if (sGail.lib) {
        // Do not shutdown gail because
@@ -43,8 +43,6 @@ gyp_vars.update({
    'arm_neon': 0,
    'arm_neon_optional': 1,

-    'moz_webrtc_omx': 0,
-    'moz_webrtc_mediacodec': 0,

    # Turn off multi monitor screen share
    'multi_monitor_screenshare%' : 0,
@@ -344,7 +344,7 @@ def split_triplet(triplet):
    if cpu.endswith('86') or (cpu.startswith('i') and '86' in cpu):
        canonical_cpu = 'x86'
        endianness = 'little'
-    elif cpu in ('x86_64', 'ia64'):
+    elif cpu == 'x86_64':
        canonical_cpu = cpu
        endianness = 'little'
    elif cpu in ('s390', 's390x'):
@@ -164,6 +164,7 @@ def old_configure_options(*options):
    '--enable-negotiateauth',
    '--enable-nfc',
    '--enable-npapi',
+    '--enable-npapi-gtk2',
    '--enable-nspr-build',
    '--enable-official-branding',
    '--enable-official-vendor',
@@ -290,11 +290,6 @@ fi
 if [ -n "$LD_LIBRARY_PATH_64" ]; then
 	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64:+":$LD_LIBRARY_PATH_64"}
 fi
-#
-#
-## Set SHLIB_PATH for HPUX
-SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH:+":$SHLIB_PATH"}
-#
 ## Set LIBPATH for AIX
 LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH:+":$LIBPATH"}
 #
@@ -339,7 +334,6 @@ then
  fi
  echo "DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH"
  echo "     LIBRARY_PATH=$LIBRARY_PATH"
-  echo "       SHLIB_PATH=$SHLIB_PATH"
  echo "          LIBPATH=$LIBPATH"
  echo "       ADDON_PATH=$ADDON_PATH"
  echo "      MOZ_PROGRAM=$MOZ_PROGRAM"
@@ -350,7 +344,7 @@ then
 fi
 #
 export MOZILLA_FIVE_HOME LD_LIBRARY_PATH
-export SHLIB_PATH LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH
+export LIBPATH LIBRARY_PATH ADDON_PATH DYLD_LIBRARY_PATH

 if [ $moz_debug -eq 1 ]
 then
@@ -448,7 +448,6 @@ gtk/gtkx.h
 gtk/gtkunixprint.h
 HIToolbox/HIToolbox.h
 hlink.h
-ia64/sys/inline.h
 Icons.h
 iconv.h
 ieeefp.h
@@ -143,7 +143,8 @@ TooltipsOverlay.prototype = {
    // Font preview tooltip
    if (type === VIEW_NODE_VALUE_TYPE && prop.property === "font-family") {
      let value = prop.value.toLowerCase();
-      if (value !== "inherit" && value !== "unset" && value !== "initial" && value !== "revert") {
+      if (value !== "inherit" && value !== "unset" && value !== "initial" &&
+          value !== "revert" && value !== "revert-layer") {
        tooltipType = TOOLTIP_FONTFAMILY_TYPE;
      }
    }
@@ -204,21 +204,22 @@ function initialHTML(doc) {
    os = "linux";
  }

-  let base = doc.createElement("base");
-  base.href = "resource://devtools/client/jsonview/";
+  // The appRoot URI is prepended to all URIs instead of using a <base> element
+  // because the latter can cause spurious network requests (UXP Issue #3122)
+  let appRoot = "resource://devtools/client/jsonview/";

  let style = doc.createElement("link");
  style.rel = "stylesheet";
  style.type = "text/css";
-  style.href = base.href +"css/main.css";
+  style.href = appRoot +"css/main.css";

  let script = doc.createElement("script");
-  script.src = base.href + "lib/require.js";
-  script.dataset.main = "viewer-config";
+  script.src = appRoot + "lib/require.js";
+  script.dataset.main = appRoot + "viewer-config.js";
  script.defer = true;

  let head = doc.createElement("head");
-  head.append(base, style, script);
+  head.append(style, script);

  return "<!DOCTYPE html>\n" +
    startTag("html", {
@@ -4,6 +4,8 @@ subsuite = devtools
 support-files =
  array_json.json
  array_json.json^headers^
+  csp_json.json
+  csp_json.json^headers^
  doc_frame_script.js
  head.js
  invalid_json.json
@@ -22,6 +24,7 @@ subsuite = clipboard
 subsuite = clipboard
 [browser_jsonview_copy_rawdata.js]
 subsuite = clipboard
+[browser_jsonview_csp_json.js]
 [browser_jsonview_filter.js]
 [browser_jsonview_invalid_json.js]
 [browser_jsonview_valid_json.js]
@@ -0,0 +1,17 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const TEST_JSON_URL = URL_ROOT + "csp_json.json";
+
+add_task(function* () {
+  info("Test CSP JSON started");
+
+  yield addJsonViewTab(TEST_JSON_URL);
+
+  let count = yield getElementCount(".jsonPanelBox .treeTable .treeRow");
+  is(count, 1, "There must be one row");
+});
@@ -0,0 +1 @@
+{"csp": true}
@@ -0,0 +1,2 @@
+Content-Type: application/json
+Content-Security-Policy: default-src 'none'; base-uri 'none';
@@ -23,7 +23,7 @@
 * of the code base, so it's consistent and modules can be easily reused.
 */
 require.config({
-  baseUrl: ".",
+  baseUrl: "resource://devtools/client/jsonview/",
  paths: {
    "devtools/client/shared": "resource://devtools/client/shared",
    "devtools/shared": "resource://devtools/shared",
@@ -10,7 +10,8 @@ const SPECIALVALUES = new Set([
  "initial",
  "inherit",
  "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);

 const {getCSSLexer} = require("devtools/shared/css/lexer");
@@ -99,7 +99,14 @@ const filterList = [
 ];

 // Valid values that shouldn't be parsed for filters.
-const SPECIAL_VALUES = new Set(["none", "unset", "initial", "inherit", "revert"]);
+const SPECIAL_VALUES = new Set([
+  "none",
+  "unset",
+  "initial",
+  "inherit",
+  "revert",
+  "revert-layer"
+]);

 /**
 * A CSS Filter editor widget used to add/remove/modify
@@ -20,7 +20,8 @@ const SPECIALVALUES = new Set([
  "inherit",
  "transparent",
  "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);

 /**
@@ -43,7 +43,7 @@ class MachCommands(MachCommandBase):
        if not os.path.exists(generated_dir):
            generated_dir = mozpath.join(self.topsrcdir, 'platform',
                'devtools/shared/css/generated')
-        else:
+        if not os.path.exists(generated_dir):
            raise Exception('Directory expected at %s does not exist.' % generated_dir)
        self.generated_dir = generated_dir

@@ -75,6 +75,9 @@ class MachCommands(MachCommandBase):
        contents = subprocess.check_output([xpcshell_path, '-g', gre_path,
                                            '-a', browser_path, script_path],
                                           env = sub_env)
+        if not isinstance(contents, str):
+            contents = contents.decode('utf-8')
+
        # Extract just the output between the delimiters as the xpcshell output can
        # have extra output that we don't want.
        contents = contents.split('DEVTOOLS_CSS_DB_DELIMITER')[1]
@@ -88,13 +91,13 @@ class MachCommands(MachCommandBase):
        destination_path = mozpath.join(self.generated_dir,
            'properties-db.js')

-        with open(js_template_path, 'rb') as handle:
+        with open(js_template_path, 'r') as handle:
            js_template = handle.read()

        preamble = '/* THIS IS AN AUTOGENERATED FILE.  DO NOT EDIT */\n\n'
        contents = string.Template(js_template).substitute(substitutions)

-        with open(destination_path, 'wb') as destination:
+        with open(destination_path, 'w') as destination:
            destination.write(preamble + contents)

        print(('The database was successfully generated at ' + destination_path))
@@ -274,7 +274,7 @@ public:
    }

    template<typename T,
-             typename = typename std::enable_if<std::is_enum<T>::value>::type>
+             typename = typename std::enable_if_t<std::is_enum_v<T>>>
    EnumTable(const char* aTag, T aValue)
      : tag(aTag)
      , value(static_cast<int16_t>(aValue))
@@ -97,7 +97,7 @@ ToJSValue(JSContext* aCx,
  return true;
 }

-// Accept floating point types
+// accept floating point types
 inline bool
 ToJSValue(JSContext* aCx,
          float aArgument,
@@ -106,7 +106,7 @@ ToJSValue(JSContext* aCx,
  // Make sure we're called in a compartment
  MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));

-  aValue.set(JS_NumberValue(double(aArgument)));
+  aValue.setNumber(aArgument);
  return true;
 }

@@ -876,12 +876,20 @@ HTMLImageElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
  return HTMLImageElementBinding::Wrap(aCx, this, aGivenProto);
 }

+#ifdef DEBUG
+nsIDOMHTMLFormElement*
+HTMLImageElement::GetForm() const
+{
+  return mForm;
+}
+#endif
+
 void
 HTMLImageElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
-             "We don't support switching from one non-null form to another.");
+  NS_ASSERTION(!mForm,
+               "We don't support switching from one non-null form to another.");

  mForm = static_cast<HTMLFormElement*>(aForm);
 }
@@ -216,8 +216,9 @@ public:
    SetHTMLAttr(nsGkAtoms::lowsrc, aLowsrc, aError);
  }

-  HTMLFormElement* GetForm() const { return mForm; };
-
+#ifdef DEBUG
+  nsIDOMHTMLFormElement* GetForm() const;
+#endif
  void SetForm(nsIDOMHTMLFormElement* aForm);
  void ClearForm(bool aRemoveFromForm);

@@ -1824,8 +1824,8 @@ void
 nsGenericHTMLFormElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
-             "We don't support switching from one non-null form to another.");
+  NS_ASSERTION(!mForm,
+               "We don't support switching from one non-null form to another.");

  // keep a *weak* ref to the form here
  mForm = static_cast<HTMLFormElement*>(aForm);
@@ -367,13 +367,12 @@ public:
  {
  }

-  static const uint32_t MIN_RATE = 8000;
  static const uint32_t MAX_RATE = 640000;

  bool IsValid() const override
  {
    return mChannels > 0 && mChannels <= MAX_AUDIO_CHANNELS
-           && mRate >= MIN_RATE && mRate <= MAX_RATE;
+           && mRate > 0 && mRate <= MAX_RATE;
  }

  AudioInfo* GetAsAudioInfo() override
@@ -179,18 +179,12 @@ IsValidVideoRegion(const nsIntSize& aFrame, const nsIntRect& aPicture,
    aFrame.height <= PlanarYCbCrImage::MAX_DIMENSION &&
    aFrame.width * aFrame.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aFrame.width * aFrame.height != 0 &&
-    aPicture.width > 0 &&
    aPicture.width <= PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.x >= 0 &&
    aPicture.x < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.x + aPicture.width < PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.XMost() <= aFrame.width &&
-    aPicture.height > 0 &&
    aPicture.height <= PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.y >= 0 &&
    aPicture.y < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.y + aPicture.height < PlanarYCbCrImage::MAX_DIMENSION &&
-    aPicture.YMost() <= aFrame.height &&
    aPicture.width * aPicture.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aPicture.width * aPicture.height != 0 &&
    aDisplay.width <= PlanarYCbCrImage::MAX_DIMENSION &&
@@ -439,7 +439,7 @@ private:
    Maybe<size_t> mInitOffset;
    Maybe<size_t> mMediaOffset;
    bool mValid = true;
-    char mLastInvalidBox[5]{};
+    char mLastInvalidBox[5];
  };

 public:
@@ -20,7 +20,6 @@
 #include "WebMBufferedParser.h"
 #include "gfx2DGlue.h"
 #include "mozilla/Atomics.h"
-#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/SharedThreadPool.h"
@@ -353,27 +352,19 @@ WebMDemuxer::ReadMetadata()
          mInfo.mVideo.mExtraData = new MediaByteBuffer(length);
          mInfo.mVideo.mExtraData->AppendElements(data, length);
          break;
-        }
+	}
        default:
          NS_WARNING("Unknown WebM video codec");
          return NS_ERROR_FAILURE;
      }
      // Picture region, taking into account cropping, before scaling
      // to the display size.
-      CheckedInt<uint32_t> cropH = CheckedInt<uint32_t>(params.crop_left) + params.crop_right;
-      CheckedInt<uint32_t> cropV = CheckedInt<uint32_t>(params.crop_top) + params.crop_bottom;
-      if (!cropH.isValid() || !cropV.isValid() ||
-          cropH.value() >= params.width || cropV.value() >= params.height) {
-        WEBM_DEBUG("Invalid crop values left: {} right: {} top: {} bottom: {}",
-                   params.crop_left, params.crop_right, params.crop_top,
-                   params.crop_bottom);
-        // Ignore invalid crop parameters.
-        continue;
-      }
+      unsigned int cropH = params.crop_right + params.crop_left;
+      unsigned int cropV = params.crop_bottom + params.crop_top;
      nsIntRect pictureRect(params.crop_left,
                            params.crop_top,
-                            params.width - cropH.value(),
-                            params.height - cropV.value());
+                            params.width - cropH,
+                            params.height - cropV);

      // If the cropping data appears invalid then use the frame data
      if (pictureRect.width <= 0 ||
@@ -29,8 +29,7 @@ enum {
 * Abstract interface for managing audio and video devices. Each platform
 * must implement a concrete class that will map these classes and methods
 * to the appropriate backend. For example, on Desktop platforms, these will
- * correspond to equivalent webrtc (GIPS) calls, and on B2G they will map to
- * a Gonk interface.
+ * correspond to equivalent webrtc (GIPS) calls.
 */
 class MediaEngineVideoSource;
 class MediaEngineAudioSource;
@@ -302,7 +301,6 @@ public:

  /* If implementation of MediaEngineSource supports TakePhoto(), the picture
   * should be return via aCallback object. Otherwise, it returns NS_ERROR_NOT_IMPLEMENTED.
-   * Currently, only Gonk MediaEngineSource implementation supports it.
   */
  virtual nsresult TakePhoto(MediaEnginePhotoCallback* aCallback) = 0;

@@ -36,8 +36,8 @@ bool MediaEngineCameraVideoSource::AppendToTrack(SourceMediaStream* aSource,
  return aSource->AppendToTrack(aID, &(segment));
 }

-// Sub-classes (B2G or desktop) should overload one of both of these two methods
-// to provide capabilities
+// Subclasses should overload one or both of these methods to provide
+// capabilities.
 size_t
 MediaEngineCameraVideoSource::NumCapabilities() const
 {
@@ -324,21 +324,6 @@ MediaEngineCameraVideoSource::SetName(nsString aName)
  bool hasFacingMode = false;
  VideoFacingModeEnum facingMode = VideoFacingModeEnum::User;

-  // Set facing mode based on device name.
-#if defined(ANDROID)
-  // Names are generated. Example: "Camera 0, Facing back, Orientation 90"
-  //
-  // See media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/
-  // webrtc/videoengine/VideoCaptureDeviceInfoAndroid.java
-
-  if (aName.Find(NS_LITERAL_STRING("Facing back")) != kNotFound) {
-    hasFacingMode = true;
-    facingMode = VideoFacingModeEnum::Environment;
-  } else if (aName.Find(NS_LITERAL_STRING("Facing front")) != kNotFound) {
-    hasFacingMode = true;
-    facingMode = VideoFacingModeEnum::User;
-  }
-#endif // ANDROID
 #ifdef XP_MACOSX
  // Kludge to test user-facing cameras on OSX.
  if (aName.Find(NS_LITERAL_STRING("Face")) != -1) {
@@ -108,7 +108,7 @@ protected:
  nsTArray<PrincipalHandle> mPrincipalHandles; // Directly mapped to mSources.
  RefPtr<layers::Image> mImage;
  RefPtr<layers::ImageContainer> mImageContainer;
-  int mWidth, mHeight; // protected with mMonitor on Gonk due to different threading
+  int mWidth, mHeight; // protected with mMonitor
  // end of data protected by mMonitor


@@ -15,7 +15,7 @@
 #ifdef FF
 #undef FF
 #endif
-#include "webrtc/modules/audio_device/opensl/single_rw_fifo.h"
+#include "SingleRwFifo.h"

 #define CHANNELS 1
 #define ENCODING "L16"
@@ -0,0 +1,99 @@
+/*
+ *  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "SingleRwFifo.h"
+
+#include <assert.h>
+
+#if defined(_MSC_VER)
+#include <windows.h>
+#endif
+
+static int
+UpdatePos(int pos, int capacity)
+{
+  return (pos + 1) % capacity;
+}
+
+namespace webrtc {
+
+namespace subtle {
+
+#if defined(_MSC_VER)
+inline void
+MemoryBarrier()
+{
+  ::MemoryBarrier();
+}
+#elif defined(__GNUC__) || defined(__clang__)
+inline void
+MemoryBarrier()
+{
+  __sync_synchronize();
+}
+#else
+#error Add an implementation of MemoryBarrier() for this platform!
+#endif
+
+}  // namespace subtle
+
+SingleRwFifo::SingleRwFifo(int capacity)
+  : capacity_(capacity)
+  , size_(0)
+  , read_pos_(0)
+  , write_pos_(0)
+{
+  queue_.reset(new int8_t*[capacity_]);
+}
+
+SingleRwFifo::~SingleRwFifo()
+{
+}
+
+void
+SingleRwFifo::Push(int8_t* mem)
+{
+  assert(mem);
+
+  // Ensure that there is space for the new data in the FIFO. There is only one
+  // writer, so the other thread is guaranteed only to decrease the size.
+  const int free_slots = capacity() - size();
+  if (free_slots <= 0) {
+    // Size can be queried outside of Push. The caller is expected to ensure
+    // that Push will be successful before calling it.
+    assert(false);
+    return;
+  }
+  queue_[write_pos_] = mem;
+  // Ensure that |size_| is updated after the stored pointer is visible.
+  subtle::MemoryBarrier();
+  ++size_;
+  write_pos_ = UpdatePos(write_pos_, capacity());
+}
+
+int8_t*
+SingleRwFifo::Pop()
+{
+  int8_t* ret_val = nullptr;
+  if (size() <= 0) {
+    // Size can be queried outside of Pop. The caller is expected to ensure
+    // that Pop will be successful before calling it.
+    assert(false);
+    return ret_val;
+  }
+  ret_val = queue_[read_pos_];
+  // Ensure that |size_| is updated after the stored pointer is read.
+  subtle::MemoryBarrier();
+  --size_;
+  read_pos_ = UpdatePos(read_pos_, capacity());
+  return ret_val;
+}
+
+}  // namespace webrtc
@@ -8,8 +8,8 @@
 *  be found in the AUTHORS file in the root of the source tree.
 */

-#ifndef WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
-#define WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
+#ifndef DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_
+#define DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_

 #include "webrtc/base/scoped_ptr.h"
 #include "webrtc/system_wrappers/interface/atomic32.h"
@@ -17,10 +17,9 @@

 namespace webrtc {

-// Implements a lock-free FIFO losely based on
+// Implements a lock-free FIFO loosely based on
 // http://src.chromium.org/viewvc/chrome/trunk/src/media/base/audio_fifo.cc
-// Note that this class assumes there is one producer (writer) and one
-// consumer (reader) thread.
+// This class assumes there is one producer and one consumer thread.
 class SingleRwFifo {
 public:
  explicit SingleRwFifo(int capacity);
@@ -29,8 +28,6 @@ class SingleRwFifo {
  void Push(int8_t* mem);
  int8_t* Pop();

-  void Clear();
-
  int size() { return size_.Value(); }
  int capacity() const { return capacity_; }

@@ -46,4 +43,4 @@ class SingleRwFifo {

 }  // namespace webrtc

-#endif  // WEBRTC_MODULES_AUDIO_DEVICE_ANDROID_SINGLE_RW_FIFO_H_
+#endif  // DOM_MEDIA_WEBRTC_SINGLE_RW_FIFO_H_
@@ -38,6 +38,7 @@ if CONFIG['MOZ_WEBRTC']:
    # MediaEngineWebRTC.cpp needs to be built separately.
    SOURCES += [
        'MediaEngineWebRTC.cpp',
+        'SingleRwFifo.cpp',
    ]
    LOCAL_INCLUDES += [
        '/dom/base',
@@ -68,8 +69,7 @@ include('/ipc/chromium/chromium-config.mozbuild')

 # Suppress some GCC/clang warnings being treated as errors:
 #  - about attributes on forward declarations for types that are already
-#    defined, which complains about important MOZ_EXPORT attributes for
-#    android API types
+#    defined, which complains about important MOZ_EXPORT attributes.
 if CONFIG['GNU_CC'] or CONFIG['CLANG_CL']:
    CXXFLAGS += [
        '-Wno-error=attributes',
@@ -194,7 +194,7 @@ static void FreeStringArray(uint32_t variants, char ** array)

 static bool CanLoadPlugin(char16ptr_t aBinaryPath)
 {
-#if defined(_M_IX86) || defined(_M_X64) || defined(_M_IA64)
+#if defined(_M_IX86) || defined(_M_X64)
  bool canLoad = false;

  HANDLE file = CreateFileW(aBinaryPath, GENERIC_READ,
@@ -214,8 +214,6 @@ static bool CanLoadPlugin(char16ptr_t aBinaryPath)
            canLoad = (arch == IMAGE_FILE_MACHINE_I386);
 #elif defined(_M_X64)
            canLoad = (arch == IMAGE_FILE_MACHINE_AMD64);
-#elif defined(_M_IA64)
-            canLoad = (arch == IMAGE_FILE_MACHINE_IA64);
 #endif
          }
        }
@@ -55,7 +55,12 @@ using namespace std;
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
+#endif

 #elif defined(OS_WIN)

@@ -208,7 +213,9 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
    memset(&mWsInfo, 0, sizeof(mWsInfo));
 #ifdef MOZ_WIDGET_GTK
    mWsInfo.display = nullptr;
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    mXtClient.top_widget = nullptr;
+#endif
 #else
    mWsInfo.display = DefaultXDisplay();
 #endif
@@ -620,15 +627,17 @@ PluginInstanceChild::NPN_SetValue(NPPVariable aVar, void* aValue)
        NPWindowType newWindowType = windowed ? NPWindowTypeWindow : NPWindowTypeDrawable;
 #ifdef MOZ_WIDGET_GTK
        if (mWindow.type != newWindowType && mWsInfo.display) {
-           // plugin type has been changed but we already have a valid display
-           // so update it for the recent plugin mode
-           if (mXEmbed || !windowed) {
-               // Use default GTK display for XEmbed and windowless plugins
-               mWsInfo.display = DefaultXDisplay();
-           }
-           else {
-               mWsInfo.display = xt_client_get_display();
-           }
+            // plugin type has been changed but we already have a valid display
+            // so update it for the recent plugin mode
+#ifdef MOZ_ENABLE_NPAPI_GTK2
+            if (!mXEmbed && windowed) {
+                mWsInfo.display = xt_client_get_display();
+            } else
+#endif
+            {
+                // Use default GTK display for XEmbed and windowless plugins.
+                mWsInfo.display = DefaultXDisplay();
+            }
        }
 #endif
        mWindow.type = newWindowType;
@@ -1214,12 +1223,18 @@ bool PluginInstanceChild::CreateWindow(const NPRemoteWindow& aWindow)
    if (mXEmbed) {
        mWindow.window = reinterpret_cast<void*>(aWindow.window);
    }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        Window browserSocket = (Window)(aWindow.window);
        xt_client_init(&mXtClient, mWsInfo.visual, mWsInfo.colormap, mWsInfo.depth);
        xt_client_create(&mXtClient, browserSocket, mWindow.width, mWindow.height); 
        mWindow.window = (void *)XtWindow(mXtClient.child_widget);
-    }  
+    }
+#else
+    else {
+        mWindow.window = reinterpret_cast<void*>(aWindow.window);
+    }
+#endif
 #else
    mWindow.window = reinterpret_cast<void*>(aWindow.window);
 #endif
@@ -1239,7 +1254,7 @@ void PluginInstanceChild::DeleteWindow()
  if (!mWindow.window)
      return;

-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
  if (mXtClient.top_widget) {     
      xt_client_unrealize(&mXtClient);
      xt_client_destroy(&mXtClient); 
@@ -1321,7 +1336,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
        CreateWindow(aWindow);
    }

-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    if (mXEmbed && gtk_check_version(2,18,7) != nullptr) { // older
        if (aWindow.type == NPWindowTypeWindow) {
            GdkWindow* socket_window = gdk_window_lookup(static_cast<GdkNativeWindow>(aWindow.window));
@@ -1456,19 +1471,27 @@ PluginInstanceChild::Initialize()
    if (mWindow.type == NPWindowTypeWindow) {
        AnswerNPP_GetValue_NPPVpluginNeedsXEmbed(&mXEmbed, &rv);

+#ifdef MOZ_ENABLE_NPAPI_GTK2
        // Set up Xt loop for windowed plugins without XEmbed support
        if (!mXEmbed) {
           xt_client_xloop_create();
        }
+#endif
    }

-    // Use default GTK display for XEmbed and windowless plugins
+    // Use default GTK display for XEmbed and windowless plugins.
    if (mXEmbed || mWindow.type != NPWindowTypeWindow) {
        mWsInfo.display = DefaultXDisplay();
    }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        mWsInfo.display = xt_client_get_display();
    }
+#else
+    else {
+        mWsInfo.display = DefaultXDisplay();
+    }
+#endif
 #endif 

    return true;
@@ -4656,7 +4679,7 @@ PluginInstanceChild::Destroy()

    mPendingAsyncCalls.Clear();
    
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
    if (mWindow.type == NPWindowTypeWindow && !mXEmbed) {
      xt_client_xloop_destroy();
    }
@@ -36,7 +36,7 @@

 #include <map>

-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
 #include "gtk2xtbin.h"
 #endif

@@ -462,6 +462,8 @@ private:
    NPSetWindowCallbackStruct mWsInfo;
 #ifdef MOZ_WIDGET_GTK
    bool mXEmbed;
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    XtClient mXtClient;
 #endif
 #elif defined(OS_WIN)
@@ -12,6 +12,9 @@

 #ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
 #endif

 #include "nsIFile.h"
@@ -1101,7 +1104,11 @@ _getvalue(NPP aNPP,
                return InstCast(aNPP)->NPN_GetValue(aVariable, aValue);
            } 
            else {
+#ifdef MOZ_ENABLE_NPAPI_GTK2
                *(void **)aValue = xt_client_get_display();
+#else
+                *(void **)aValue = DefaultXDisplay();
+#endif
            }          
            return NPERR_NO_ERROR;
        }
@@ -143,11 +143,13 @@ LOCAL_INCLUDES += [

 DEFINES['FORCE_PR_LOG'] = True

-if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gtk3':
-    CXXFLAGS += CONFIG['TK_CFLAGS']
-else:
+if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk3' and
+        CONFIG['MOZ_ENABLE_NPAPI'] and
+        CONFIG['MOZ_ENABLE_NPAPI_GTK2']):
    # Force build against gtk+2 for struct offsets and such.
    CXXFLAGS += CONFIG['MOZ_GTK2_CFLAGS']
+else:
+    CXXFLAGS += CONFIG['TK_CFLAGS']

 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

@@ -301,6 +301,7 @@ LoadContextOptions(const char* aPrefName, void* /* aClosure */)
                .setAsyncStack(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asyncstack")))
                .setWerror(GetWorkerPref<bool>(NS_LITERAL_CSTRING("werror")))
                .setStreams(GetWorkerPref<bool>(NS_LITERAL_CSTRING("streams")))
+                .setWeakRefs(GetWorkerPref<bool>(NS_LITERAL_CSTRING("weakrefs")))
                .setExtraWarnings(GetWorkerPref<bool>(NS_LITERAL_CSTRING("strict")))
                .setArrayProtoValues(GetWorkerPref<bool>(
                      NS_LITERAL_CSTRING("array_prototype_values")));
@@ -35,6 +35,7 @@ WORKER_SIMPLE_PREF("dom.serviceWorkers.openWindow.enabled", OpenWindowEnabled, O
 WORKER_SIMPLE_PREF("dom.storageManager.enabled", StorageManagerEnabled, STORAGEMANAGER_ENABLED)
 WORKER_SIMPLE_PREF("dom.push.enabled", PushEnabled, PUSH_ENABLED)
 WORKER_SIMPLE_PREF("dom.streams.enabled", StreamsEnabled, STREAMS_ENABLED)
+WORKER_SIMPLE_PREF("javascript.options.weakrefs", WeakRefsEnabled, WEAKREFS_ENABLED)
 WORKER_SIMPLE_PREF("dom.requestcontext.enabled", RequestContextEnabled, REQUESTCONTEXT_ENABLED)
 WORKER_SIMPLE_PREF("gfx.offscreencanvas.enabled", OffscreenCanvasEnabled, OFFSCREENCANVAS_ENABLED)
 WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPickerEnabled, DOM_WEBKITBLINK_DIRPICKER_WEBKITBLINK)
@@ -1117,6 +1117,7 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                        kCGImageAlphaOnly :
                        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host;

+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
  mCG = CGBitmapContextCreateWithData(mCanvasData,
                                      mCGSize.width,
                                      mCGSize.height,
@@ -1126,6 +1127,15 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                                      bitmapInfo,
                                      NULL, /* Callback when released */
                                      NULL);
+#else
+  mCG = CGBitmapContextCreate(mCanvasData,
+                              mCGSize.width,
+                              mCGSize.height,
+                              8, /* bits per component */
+                              stride,
+                              mColorSpace,
+                              bitmapInfo);
+#endif
  if (!mCG) {
    ReleaseBits(mCanvasData);
    NS_WARNING("Could not create bitmap around skia data\n");
@@ -115,7 +115,7 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
  return ScaledFontBase::GetPathForGlyphs(aBuffer, aTarget);
 }

-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
 void
 ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
 {
@@ -32,7 +32,7 @@ public:
  virtual SkTypeface* GetSkTypeface();
 #endif
  virtual already_AddRefed<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
 #endif
  virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);
@@ -24,15 +24,21 @@
 *  Skia's 32bit backend only supports 1 sizzle order at a time (compile-time).
 *  This is specified by 4 defines SK_A32_SHIFT, SK_R32_SHIFT, ... for G and B.
 *
- *  For easier compatibility with Skia's GPU backend, we further restrict these
- *  to either (in memory-byte-order) RGBA or BGRA. Note that this "order" does
- *  not directly correspond to the same shift-order, since we have to take endianess
- *  into account.
+ *  For easier compatibility with Skia's GPU backend, Skia normally restricts
+ *  these to either (in memory-byte-order) RGBA or BGRA. Mozilla's big-endian
+ *  PowerPC port uses CoreGraphics' native ARGB pixels, so we also accept ARGB.
+ *  Note that this "order" does not directly correspond to the same shift-order,
+ *  since we have to take endianess into account.
 *
 *  Here we enforce this constraint.
 */

 #ifdef SK_CPU_BENDIAN
+    #define SK_ARGB_A32_SHIFT   24
+    #define SK_ARGB_R32_SHIFT   16
+    #define SK_ARGB_G32_SHIFT   8
+    #define SK_ARGB_B32_SHIFT   0
+
    #define SK_RGBA_R32_SHIFT   24
    #define SK_RGBA_G32_SHIFT   16
    #define SK_RGBA_B32_SHIFT   8
@@ -43,6 +49,11 @@
    #define SK_BGRA_R32_SHIFT   8
    #define SK_BGRA_A32_SHIFT   0
 #else
+    #define SK_ARGB_A32_SHIFT   0
+    #define SK_ARGB_R32_SHIFT   8
+    #define SK_ARGB_G32_SHIFT   16
+    #define SK_ARGB_B32_SHIFT   24
+
    #define SK_RGBA_R32_SHIFT   0
    #define SK_RGBA_G32_SHIFT   8
    #define SK_RGBA_B32_SHIFT   16
@@ -54,10 +65,18 @@
    #define SK_BGRA_A32_SHIFT   24
 #endif

-#if defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)
-    #error "can't define PMCOLOR to be RGBA and BGRA"
+#if (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)) || \
+    (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_ARGB)) || \
+    (defined(SK_PMCOLOR_IS_BGRA) && defined(SK_PMCOLOR_IS_ARGB))
+    #error "can't define PMCOLOR to more than one byte order"
 #endif

+#define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB  \
+    (SK_A32_SHIFT == SK_ARGB_A32_SHIFT &&    \
+     SK_R32_SHIFT == SK_ARGB_R32_SHIFT &&    \
+     SK_G32_SHIFT == SK_ARGB_G32_SHIFT &&    \
+     SK_B32_SHIFT == SK_ARGB_B32_SHIFT)
+
 #define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA  \
    (SK_A32_SHIFT == SK_RGBA_A32_SHIFT &&    \
     SK_R32_SHIFT == SK_RGBA_R32_SHIFT &&    \
@@ -76,6 +95,10 @@
 #define SK_G_INDEX  (SK_G32_SHIFT/8)
 #define SK_B_INDEX  (SK_B32_SHIFT/8)

+#if defined(SK_PMCOLOR_IS_ARGB) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+    #error "SK_PMCOLOR_IS_ARGB does not match SK_*32_SHIFT values"
+#endif
+
 #if defined(SK_PMCOLOR_IS_RGBA) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
    #error "SK_PMCOLOR_IS_RGBA does not match SK_*32_SHIFT values"
 #endif
@@ -84,19 +107,22 @@
    #error "SK_PMCOLOR_IS_BGRA does not match SK_*32_SHIFT values"
 #endif

-#if !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
+#if !defined(SK_PMCOLOR_IS_ARGB) && !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
    // deduce which to define from the _SHIFT defines

-    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
+    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+        #define SK_PMCOLOR_IS_ARGB
+    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
        #define SK_PMCOLOR_IS_RGBA
    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
        #define SK_PMCOLOR_IS_BGRA
    #else
-        #error "need 32bit packing to be either RGBA or BGRA"
+        #error "need 32bit packing to be either ARGB, RGBA, or BGRA"
    #endif
 #endif

 // hide these now that we're done
+#undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA

@@ -131,19 +157,38 @@ static inline uint32_t SkPackARGB_as_BGRA(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
           (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
 }

+static inline SkPMColor SkPackARGB_as_PMColor(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
+    SkASSERT_IS_BYTE(a);
+    SkASSERT_IS_BYTE(r);
+    SkASSERT_IS_BYTE(g);
+    SkASSERT_IS_BYTE(b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+}
+
 static inline SkPMColor SkSwizzle_RGBA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_RGBA
    return c;
-#else
+#elif defined(SK_PMCOLOR_IS_BGRA)
    return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_RGBA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_B32_SHIFT) & 0xFF);
 #endif
 }

 static inline SkPMColor SkSwizzle_BGRA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_BGRA
    return c;
-#else
+#elif defined(SK_PMCOLOR_IS_RGBA)
    return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_BGRA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_B32_SHIFT) & 0xFF);
 #endif
 }

@@ -412,8 +457,7 @@ static inline SkPMColor SkPackARGB32(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
    SkASSERT(g <= a);
    SkASSERT(b <= a);

-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }

 static inline uint32_t SkPackPMColor_as_RGBA(SkPMColor c) {
@@ -547,8 +591,7 @@ static inline SkPMColor SkFastFourByteInterp(SkPMColor src,
 *  values are premultiplied in the debug version.
 */
 static inline SkPMColor SkPackARGB32NoCheck(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }

 static inline
@@ -82,8 +82,13 @@ enum SkColorType {
    kN32_SkColorType = kBGRA_8888_SkColorType,
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    kN32_SkColorType = kRGBA_8888_SkColorType,
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Big-endian PowerPC Mozilla surfaces use native uint32 ARGB memory.
+    // Moz2D's legacy A8R8G8B8_UINT32 format aliases to B8G8R8A8, so keep
+    // kN32 on Skia's BGRA path while the channel shifts above describe ARGB.
+    kN32_SkColorType = kBGRA_8888_SkColorType,
 #else
-    #error "SK_*32_SHFIT values must correspond to BGRA or RGBA byte order"
+    #error "SK_*32_SHIFT values must correspond to BGRA, RGBA, or Mozilla ARGB byte order"
 #endif
 };

@@ -275,17 +275,19 @@ enum GrPixelConfig {
 static const int kGrPixelConfigCnt = kLast_GrPixelConfig + 1;

 // Aliases for pixel configs that match skia's byte order.
-#ifndef SK_CPU_LENDIAN
-    #error "Skia gpu currently assumes little endian"
-#endif
 #if SK_PMCOLOR_BYTE_ORDER(B,G,R,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kRGBA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSRGBA_8888_GrPixelConfig;
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Mozilla's big-endian PowerPC path stores native 32-bit pixels as ARGB,
+    // while Moz2D routes those surfaces through Skia's BGRA color type.
+    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
+    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #else
-    #error "SK_*32_SHIFT values must correspond to GL_BGRA or GL_RGBA format."
+    #error "SK_*32_SHIFT values must correspond to GL_BGRA, GL_RGBA, or Mozilla ARGB format."
 #endif

 // Returns true if the pixel config is a GPU-specific compressed format
@@ -306,7 +306,11 @@ static inline SkPMColor premultiply_argb_as_bgra(U8CPU a, U8CPU r, U8CPU g, U8CP
        b = SkMulDiv255Round(b, a);
    }

+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(a, r, g, b);
+#else
    return SkPackARGB_as_BGRA(a, r, g, b);
+#endif
 }

 static inline bool is_rgba(SkColorType colorType) {
@@ -51,10 +51,16 @@ struct SkPM4f {
    Sk4f to4f_pmorder() const { return swizzle_rb_if_bgra(this->to4f()); }

    SkPMColor toPMColor() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+        Sk4f value = this->to4f();
+        Sk4b bytes = SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f));
+        return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
        Sk4f value = swizzle_rb_if_bgra(this->to4f());
        SkPMColor result;
        SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f)).store(&result);
        return result;
+#endif
    }

    void toF16(uint16_t[4]) const;
@@ -22,29 +22,50 @@ static inline float get_alpha(const Sk4f& px) {


 static inline Sk4f Sk4f_fromL32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk4f(SkGetPackedR32(px), SkGetPackedG32(px),
+                SkGetPackedB32(px), SkGetPackedA32(px)) * (1/255.0f);
+#else
    return SkNx_cast<float>(Sk4b::Load(&px)) * (1/255.0f);
+#endif
 }

 static inline Sk4f Sk4f_fromS32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return { sk_linear_from_srgb[SkGetPackedR32(px)],
+             sk_linear_from_srgb[SkGetPackedG32(px)],
+             sk_linear_from_srgb[SkGetPackedB32(px)],
+                    (1/255.0f) * SkGetPackedA32(px) };
+#else
    return { sk_linear_from_srgb[(px >>  0) & 0xff],
             sk_linear_from_srgb[(px >>  8) & 0xff],
             sk_linear_from_srgb[(px >> 16) & 0xff],
                    (1/255.0f) * (px >> 24)          };
+#endif
 }

 static inline uint32_t Sk4f_toL32(const Sk4f& px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    Sk4b bytes = SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f));
+    return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
    uint32_t l32;
    SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f)).store(&l32);
    return l32;
+#endif
 }

 static inline uint32_t Sk4f_toS32(const Sk4f& px) {
    Sk4i  rgb = sk_linear_to_srgb(px),
         srgb = { rgb[0], rgb[1], rgb[2], (int)(255.0f * px[3] + 0.5f) };

+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(srgb[3], srgb[0], srgb[1], srgb[2]);
+#else
    uint32_t s32;
    SkNx_cast<uint8_t>(srgb).store(&s32);
    return s32;
+#endif
 }


@@ -121,9 +121,10 @@ SkDEBUGCODE(static const unsigned kRunRecordMagic = 0xb10bcafe;)
 namespace {
 struct RunRecordStorageEquivalent {
    RunFont  fFont;
-    SkPoint  fOffset;
    uint32_t fCount;
-    uint32_t fFlags;
+    SkPoint  fOffset;
+    SkTextBlob::GlyphPositioning fPositioning;
+    bool     fExtended;
    SkDEBUGCODE(unsigned fMagic;)
 };
 }
@@ -44,6 +44,25 @@ static Sk4x4f load_4_srgb(const void* vptr) {

    Sk4x4f rgba;

+#ifdef SK_PMCOLOR_IS_ARGB
+    rgba.r = { sk_linear_from_srgb[SkGetPackedR32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[3])] };
+
+    rgba.g = { sk_linear_from_srgb[SkGetPackedG32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[3])] };
+
+    rgba.b = { sk_linear_from_srgb[SkGetPackedB32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[3])] };
+
+    rgba.a = SkNx_cast<float>(Sk4i(SkGetPackedA32(ptr[0]), SkGetPackedA32(ptr[1]),
+                                   SkGetPackedA32(ptr[2]), SkGetPackedA32(ptr[3]))) * (1/255.0f);
+#else
    rgba.r = { sk_linear_from_srgb[(ptr[0] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[1] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[2] >>  0) & 0xff],
@@ -60,15 +79,28 @@ static Sk4x4f load_4_srgb(const void* vptr) {
               sk_linear_from_srgb[(ptr[3] >> 16) & 0xff] };

    rgba.a = SkNx_cast<float>((Sk4i::Load(ptr) >> 24) & 0xff) * (1/255.0f);
+#endif

    return rgba;
 }

 static void store_4_srgb(void* ptr, const Sk4x4f& p) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    uint32_t* dst = (uint32_t*)ptr;
+    Sk4i r = sk_linear_to_srgb(p.r);
+    Sk4i g = sk_linear_to_srgb(p.g);
+    Sk4i b = sk_linear_to_srgb(p.b);
+    Sk4i a = Sk4f_round(255.0f*p.a);
+    dst[0] = SkPackARGB_as_PMColor(a[0], r[0], g[0], b[0]);
+    dst[1] = SkPackARGB_as_PMColor(a[1], r[1], g[1], b[1]);
+    dst[2] = SkPackARGB_as_PMColor(a[2], r[2], g[2], b[2]);
+    dst[3] = SkPackARGB_as_PMColor(a[3], r[3], g[3], b[3]);
+#else
    ( sk_linear_to_srgb(p.r) <<  0
    | sk_linear_to_srgb(p.g) <<  8
    | sk_linear_to_srgb(p.b) << 16
    | Sk4f_round(255.0f*p.a) << 24).store(ptr);
+#endif
 }

 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -391,7 +423,7 @@ SkXfermode::D32Proc SkXfermode::GetD32Proc(SkXfermode* xfer, uint32_t flags) {
 #include "SkColorPriv.h"

 static Sk4f lcd16_to_unit_4f(uint16_t rgb) {
-#ifdef SK_PMCOLOR_IS_RGBA
+#if defined(SK_PMCOLOR_IS_RGBA) || defined(SK_PMCOLOR_IS_ARGB)
    Sk4i rgbi = Sk4i(SkGetPackedR16(rgb), SkGetPackedG16(rgb), SkGetPackedB16(rgb), 0);
 #else
    Sk4i rgbi = Sk4i(SkGetPackedB16(rgb), SkGetPackedG16(rgb), SkGetPackedR16(rgb), 0);
@@ -251,7 +251,7 @@ bool GrDrawTarget::drawBatches(GrBatchFlushState* flushState) {
            if (currentRT) {
                static const GrGpuCommandBuffer::LoadAndStoreInfo kBasicLoadStoreInfo
                    { GrGpuCommandBuffer::LoadOp::kLoad,GrGpuCommandBuffer::StoreOp::kStore,
-                      GrColor_ILLEGAL };
+                      static_cast<GrColor>(GrColor_ILLEGAL) };
                commandBuffer.reset(fGpu->createCommandBuffer(currentRT,
                                                              kBasicLoadStoreInfo,   // Color
                                                              kBasicLoadStoreInfo)); // Stencil
@@ -69,11 +69,18 @@ inline Sk4px Sk4px::Wide::div255() const {
 }

 inline Sk4px Sk4px::alphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], (*this)[ 0], (*this)[ 0], (*this)[ 0],
+                 (*this)[ 4], (*this)[ 4], (*this)[ 4], (*this)[ 4],
+                 (*this)[ 8], (*this)[ 8], (*this)[ 8], (*this)[ 8],
+                 (*this)[12], (*this)[12], (*this)[12], (*this)[12]);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 3], (*this)[ 3], (*this)[ 3], (*this)[ 3],
                 (*this)[ 7], (*this)[ 7], (*this)[ 7], (*this)[ 7],
                 (*this)[11], (*this)[11], (*this)[11], (*this)[11],
                 (*this)[15], (*this)[15], (*this)[15], (*this)[15]);
+#endif
 }

 inline Sk4px Sk4px::Load4Alphas(const SkAlpha a[4]) {
@@ -91,19 +98,33 @@ inline Sk4px Sk4px::Load2Alphas(const SkAlpha a[2]) {
 }

 inline Sk4px Sk4px::zeroAlphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b(0, (*this)[ 1], (*this)[ 2], (*this)[ 3],
+                 0, (*this)[ 5], (*this)[ 6], (*this)[ 7],
+                 0, (*this)[ 9], (*this)[10], (*this)[11],
+                 0, (*this)[13], (*this)[14], (*this)[15]);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 0], (*this)[ 1], (*this)[ 2], 0,
                 (*this)[ 4], (*this)[ 5], (*this)[ 6], 0,
                 (*this)[ 8], (*this)[ 9], (*this)[10], 0,
                 (*this)[12], (*this)[13], (*this)[14], 0);
+#endif
 }

 inline Sk4px Sk4px::zeroColors() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], 0,0,0,
+                 (*this)[ 4], 0,0,0,
+                 (*this)[ 8], 0,0,0,
+                 (*this)[12], 0,0,0);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b(0,0,0, (*this)[ 3],
                 0,0,0, (*this)[ 7],
                 0,0,0, (*this)[11],
                 0,0,0, (*this)[15]);
+#endif
 }

 }  // namespace
@@ -72,6 +72,10 @@ static void color_cube_filter_span(const SkPMColor src[],
        // color is BGRA (SkColor order), dst is SkPMColor order, so may need to swap R+B.
    #if defined(SK_PMCOLOR_IS_RGBA)
        color = SkNx_shuffle<2,1,0,3>(color);
+    #elif defined(SK_PMCOLOR_IS_ARGB)
+        Sk4b bytes = SkNx_cast<uint8_t>(color);
+        dst[i] = SkPackARGB32NoCheck(a, bytes[2], bytes[1], bytes[0]);
+        continue;
    #endif
        uint8_t* dstBytes = (uint8_t*)(dst+i);
        SkNx_cast<uint8_t>(color).store(dstBytes);
@@ -73,7 +73,39 @@ static CFArrayRef SkCTFontManagerCopyAvailableFontFamilyNames() {
 #ifdef SK_BUILD_FOR_IOS
    return CFArrayCreate(nullptr, nullptr, 0, nullptr);
 #else
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    return CTFontManagerCopyAvailableFontFamilyNames();
+#else
+    CFMutableArrayRef familyNames =
+            CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+    if (!familyNames) {
+        return nullptr;
+    }
+
+    ATSFontFamilyIterator iterator;
+    OSStatus status = ATSFontFamilyIteratorCreate(kATSFontContextGlobal,
+                                                  nullptr,
+                                                  nullptr,
+                                                  kATSOptionFlagsDefaultScope,
+                                                  &iterator);
+    if (status != noErr) {
+        CFRelease(familyNames);
+        return nullptr;
+    }
+
+    ATSFontFamilyRef family;
+    while (ATSFontFamilyIteratorNext(iterator, &family) == noErr) {
+        CFStringRef familyName = nullptr;
+        if (ATSFontFamilyGetName(family, kATSOptionFlagsDefault, &familyName) == noErr &&
+            familyName) {
+            CFArrayAppendValue(familyNames, familyName);
+            CFRelease(familyName);
+        }
+    }
+
+    ATSFontFamilyIteratorRelease(&iterator);
+    return familyNames;
+#endif
 #endif
 }

@@ -908,6 +940,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&

        // Skia handles quantization and subpixel positioning,
        // so disable quantization and enabe subpixel positioning in CG.
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
        CGContextSetAllowsFontSubpixelQuantization(fCG, false);
        CGContextSetShouldSubpixelQuantizeFonts(fCG, false);

@@ -916,6 +949,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
        // then CG cannot draw the glyph in the correct location without subpixel positioning.
        CGContextSetAllowsFontSubpixelPositioning(fCG, true);
        CGContextSetShouldSubpixelPositionFonts(fCG, true);
+#endif

        CGContextSetTextDrawingMode(fCG, kCGTextFill);

@@ -971,7 +1005,13 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
    // So always make the font transform identity and place the transform on the context.
    point = CGPointApplyAffineTransform(point, context.fInvTransform);

+#if defined(MAC_OS_X_VERSION_10_7) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7)
    CTFontDrawGlyphs(context.fCTFont, &glyphID, &point, 1, fCG);
+#else
+    CGContextSetFont(fCG, CTFontCopyGraphicsFont(context.fCTFont, NULL));
+    CGContextSetFontSize(fCG, CTFontGetSize(context.fCTFont));
+    CGContextShowGlyphsAtPositions(fCG, &glyphID, &point, 1);
+#endif

    SkASSERT(rowBytesPtr);
    *rowBytesPtr = rowBytes;
@@ -1682,6 +1722,7 @@ SkAdvancedTypefaceMetrics* SkTypeface_Mac::onGetAdvancedTypefaceMetrics(

 static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
    CTFontRef ctFont = typeface->fFontRef.get();
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    AutoCFRelease<CFNumberRef> fontFormatRef(
            static_cast<CFNumberRef>(CTFontCopyAttribute(ctFont, kCTFontFormatAttribute)));
    if (!fontFormatRef) {
@@ -1711,6 +1752,35 @@ static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
            //Just the presence of the FontForge 'FFTM' table seems to throw it off.
            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
    }
+#else
+    AutoCFRelease<CFStringRef> postScriptName(CTFontCopyPostScriptName(ctFont));
+    if (!postScriptName) {
+        return 0;
+    }
+
+    ATSFontRef atsFont =
+            ATSFontFindFromPostScriptName(postScriptName, kATSOptionFlagsDefault);
+    if (atsFont == kInvalidFont) {
+        return 0;
+    }
+
+    SkSFNTHeader header;
+    ByteCount headerSize = sizeof(header);
+    if (ATSFontGetTableDirectory(atsFont, headerSize, &header, &headerSize) != noErr ||
+        headerSize < sizeof(header.fontType)) {
+        return 0;
+    }
+
+    switch (header.fontType) {
+        case SkSFNTHeader::fontType_OpenTypeCFF::TAG:
+        case SkSFNTHeader::fontType_WindowsTrueType::TAG:
+        case SkSFNTHeader::fontType_MacTrueType::TAG:
+        case SkSFNTHeader::fontType_PostScript::TAG:
+            return header.fontType;
+        default:
+            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
+    }
+#endif
 }

 SkStreamAsset* SkTypeface_Mac::onOpenStream(int* ttcIndex) const {
@@ -336,20 +336,7 @@ gfxGraphiteShaper::SetGlyphsFromSegment(DrawTarget      *aDrawTarget,
            // not a one-to-one mapping with simple metrics: use DetailedGlyph
            AutoTArray<gfxShapedText::DetailedGlyph,8> details;
            float clusterLoc;
-
-            uint32_t glyph_start = c.baseGlyph;
-            uint32_t glyph_end = glyph_start + c.nGlyphs;
-            if (glyph_end < glyph_start) {
-                return NS_ERROR_ILLEGAL_VALUE;
-            }
-            if (glyph_end - glyph_start > 0xFFFF) {
-                return NS_ERROR_ILLEGAL_VALUE;
-            }
-            if (!details.SetCapacity(glyph_end - glyph_start, fallible)) {
-                return NS_ERROR_OUT_OF_MEMORY;
-            }
-
-            for (uint32_t j = glyph_start; j < glyph_end; ++j) {
+            for (uint32_t j = c.baseGlyph; j < c.baseGlyph + c.nGlyphs; ++j) {
                gfxShapedText::DetailedGlyph* d = details.AppendElement();
                d->mGlyphID = gids[j];
                d->mYOffset = roundY ? NSToIntRound(-yLocs[j]) * dev2appUnits :
@@ -231,13 +231,11 @@ gfxTextRun::ComputeLigatureData(Range aPartRange,
    LigatureData result;
    const CompressedGlyph *charGlyphs = mCharacterGlyphs;

-    uint32_t i = aPartRange.start;
-    while (i && !charGlyphs[i].IsLigatureGroupStart()) {
-        --i;
+    uint32_t i;
+    for (i = aPartRange.start; !charGlyphs[i].IsLigatureGroupStart(); --i) {
+        NS_ASSERTION(i > 0, "Ligature at the start of the run??");
    }
-    NS_ASSERTION(charGlyphs[i].IsLigatureGroupStart(), "Ligature at run start?");
    result.mRange.start = i;
-
    for (i = aPartRange.start + 1;
         i < GetLength() && !charGlyphs[i].IsLigatureGroupStart(); ++i) {
    }
@@ -1706,27 +1704,21 @@ gfxFontGroup::GetFontAt(int32_t i, uint32_t aCh)

    RefPtr<gfxFont> font = ff.Font();
    if (!font) {
-        RefPtr<gfxFontEntry> fe = ff.FontEntry();
-        if (!fe) {
-            return nullptr;
-        }
-        RefPtr<gfxCharacterMap> unicodeRangeMap;
+        gfxFontEntry* fe = mFonts[i].FontEntry();
+        gfxCharacterMap* unicodeRangeMap = nullptr;
        if (fe->mIsUserFontContainer) {
-            // This raw pointer is OK because fe holds a strong ref to the object.
-            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe.get());
+            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe);
            if (ufe->LoadState() == gfxUserFontEntry::STATUS_NOT_LOADED &&
                ufe->CharacterInUnicodeRange(aCh) &&
                !FontLoadingForFamily(ff.Family(), aCh)) {
                ufe->Load();
                ff.CheckState(mSkipDrawing);
            }
-            unicodeRangeMap = ufe->GetUnicodeRangeMap();
-            // Update fe to refer to the actual platform font entry, rather than the
-            // webfont wrapper. After this, we no longer have a strong ref to ufe.
            fe = ufe->GetPlatformFontEntry();
            if (!fe) {
                return nullptr;
            }
+            unicodeRangeMap = ufe->GetUnicodeRangeMap();
        }
        font = fe->FindOrMakeFont(&mStyle, mFonts[i].NeedsBold(),
                                  unicodeRangeMap);
@@ -1637,13 +1637,10 @@ RasterImage::NotifyDecodeComplete(const DecoderFinalStatus& aStatus,

  if (!(aDecoderFlags & DecoderFlags::FIRST_FRAME_ONLY) &&
      mHasBeenDecoded && mAnimationState) {
-    // If we've successfully finished a full decode of all animation frames
-    // then let our animation state know it's complete and to not to expect
-    // any more frames.
-    if (aStatus.mFinished && !aStatus.mHadError) {
-      mAnimationState->NotifyDecodeComplete();
-      mAnimationState->UpdateState(mAnimationFinished, this, mSize);
-    }
+    // We've finished a full decode of all animation frames and our AnimationState
+    // has been notified about them all, so let it know not to expect anymore.
+    mAnimationState->NotifyDecodeComplete();
+    mAnimationState->UpdateState(mAnimationFinished, this, mSize);
  }

  // Only act on errors if we have no usable frames from the decoder.
@@ -66,10 +66,28 @@ struct WeakCell {
    WeakCellKind kind;
    WeakRef<JSObject*> object;
    WeakRef<JS::Symbol*> symbol;
+    bool enabled;

-    WeakCell() : kind(WeakCellKind::Empty), object(nullptr), symbol(nullptr) {}
-    explicit WeakCell(JSObject* obj) : kind(WeakCellKind::Object), object(obj), symbol(nullptr) {}
-    explicit WeakCell(JS::Symbol* sym) : kind(WeakCellKind::Symbol), object(nullptr), symbol(sym) {}
+    WeakCell()
+        : kind(WeakCellKind::Empty)
+        , object(nullptr)
+        , symbol(nullptr)
+        , enabled(true)
+    {}
+
+    explicit WeakCell(JSObject* obj, bool enabled)
+        : kind(WeakCellKind::Object)
+        , object(obj)
+        , symbol(nullptr)
+        , enabled(enabled)
+    {}
+
+    explicit WeakCell(JS::Symbol* sym, bool enabled)
+        : kind(WeakCellKind::Symbol)
+        , object(nullptr)
+        , symbol(sym)
+        , enabled(enabled)
+    {}

    void clear() {
        kind = WeakCellKind::Empty;
@@ -101,7 +119,9 @@ struct WeakCell {
            if (!target)
                return;

-            if (IsInsideNursery(target)) {
+            if (!enabled) {
+              // Do nothing
+            } else if (IsInsideNursery(target)) {
                TraceManuallyBarrieredEdge(trc, object.unsafeGet(), name);
            } else {
                if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
@@ -110,7 +130,7 @@ struct WeakCell {
            }
        } else if (kind == WeakCellKind::Symbol) {
            JS::Symbol* target = symbol.unbarrieredGet();
-            if (target) {
+            if (enabled && target) {
                if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
                    return;
                TraceWeakEdge(trc, &symbol, name);
@@ -124,14 +144,16 @@ struct WeakCell {
            if (!target)
                return;

-            if (IsInsideNursery(target)) {
+            if (!enabled) {
+              // Do nothing
+            } else if (IsInsideNursery(target)) {
                TraceManuallyBarrieredEdge(trc, object.unsafeGet(), name);
            } else if (target->asTenured().zone()->isCollecting()) {
                TraceWeakEdge(trc, &object, name);
            }
        } else if (kind == WeakCellKind::Symbol) {
            JS::Symbol* target = symbol.unbarrieredGet();
-            if (target && target->asTenured().zone()->isCollecting())
+            if (enabled && target && target->asTenured().zone()->isCollecting())
                TraceWeakEdge(trc, &symbol, name);
        }
    }
@@ -143,22 +165,24 @@ struct FinalizationRecord {
    WeakCell unregisterToken;
    bool active;
    bool queued;
+    bool enabled;

    FinalizationRecord(HandleValue targetValue, HandleValue heldValue,
-                       HandleValue unregisterTokenValue)
+                       HandleValue unregisterTokenValue, bool enabled)
      : heldValue(heldValue),
        active(true),
-        queued(false)
+        queued(false),
+        enabled(enabled)
    {
        if (targetValue.isObject())
-            target = WeakCell(NormalizeWeakObject(&targetValue.toObject()));
+            target = WeakCell(NormalizeWeakObject(&targetValue.toObject()), enabled);
        else
-            target = WeakCell(targetValue.toSymbol());
+            target = WeakCell(targetValue.toSymbol(), enabled);

        if (unregisterTokenValue.isObject())
-            unregisterToken = WeakCell(NormalizeWeakObject(&unregisterTokenValue.toObject()));
+            unregisterToken = WeakCell(NormalizeWeakObject(&unregisterTokenValue.toObject()), enabled);
        else if (unregisterTokenValue.isSymbol())
-            unregisterToken = WeakCell(unregisterTokenValue.toSymbol());
+            unregisterToken = WeakCell(unregisterTokenValue.toSymbol(), enabled);
    }

    void trace(JSTracer* trc) {
@@ -217,13 +241,15 @@ struct FinalizationRegistryObject::Data {
    FinalizationRecordVector records;
    FinalizationRecordVector cleanupQueue;
    bool queuedForCleanup;
+    bool enabled;

-    explicit Data(JSObject* cleanupCallback)
+    explicit Data(JSObject* cleanupCallback, bool enabled)
      : cleanupCallback(cleanupCallback),
        cleanupJob(nullptr),
        records(SystemAllocPolicy()),
        cleanupQueue(SystemAllocPolicy()),
-        queuedForCleanup(false)
+        queuedForCleanup(false),
+        enabled(enabled)
    {}

    ~Data() {
@@ -232,11 +258,13 @@ struct FinalizationRegistryObject::Data {
    }

    void trace(JSTracer* trc) {
-        JS::TraceEdge(trc, &cleanupCallback, "FinalizationRegistry cleanup callback");
-        if (cleanupJob.unbarrieredGet())
-            JS::TraceEdge(trc, &cleanupJob, "FinalizationRegistry cleanup job");
-        for (size_t i = 0; i < records.length(); i++)
-            records[i]->trace(trc);
+        if (enabled) {
+          JS::TraceEdge(trc, &cleanupCallback, "FinalizationRegistry cleanup callback");
+          if (cleanupJob.unbarrieredGet())
+              JS::TraceEdge(trc, &cleanupJob, "FinalizationRegistry cleanup job");
+          for (size_t i = 0; i < records.length(); i++)
+              records[i]->trace(trc);
+        }
    }

    bool appendRecord(FinalizationRecord* record) {
@@ -317,7 +345,7 @@ FinalizationRegistry_register_impl(JSContext* cx, const CallArgs& args)
        unregisterToken.setUndefined();
    }

-    FinalizationRecord* record = cx->new_<FinalizationRecord>(target, heldValue, unregisterToken);
+    FinalizationRecord* record = cx->new_<FinalizationRecord>(target, heldValue, unregisterToken, cx->options().weakRefs());
    if (!record)
        return false;

@@ -401,7 +429,7 @@ FinalizationRegistryObject::create(JSContext* cx, HandleObject cleanupCallback,
    if (!obj)
        return nullptr;

-    Data* data = cx->new_<Data>(cleanupCallback);
+    Data* data = cx->new_<Data>(cleanupCallback, cx->options().weakRefs());
    if (!data)
        return nullptr;

@@ -8,11 +8,8 @@
 #include "mozilla/CheckedInt.h"
 #include "mozilla/TypeTraits.h"

-#include <algorithm>
-
 #include "jscntxt.h"

-#include "builtin/SelfHostingDefines.h"
 #include "irregexp/RegExpParser.h"
 #include "jit/InlinableNatives.h"
 #include "vm/RegExpStatics.h"
@@ -1757,9 +1754,7 @@ js::RegExpGetSubstitution(JSContext* cx, HandleArrayObject matchResult, HandleLi
    // Step 6.
    MOZ_ASSERT(position <= string->length());

-    // String substitutions can only reference $1 through $99.
-    uint32_t nCaptures = std::min<uint32_t>(matchResultLength - 1,
-                                            REGEXP_MAX_SUBSTITUTION_CAPTURES);
+    uint32_t nCaptures = matchResultLength - 1;
    Rooted<CapturesVector> captures(cx, CapturesVector(cx));
    if (!captures.reserve(nCaptures))
        return false;
@@ -463,12 +463,6 @@ function RegExpGetComplexReplacement(result, matched, S, position,
    // Step 14.k.i (reordered).
    _DefineDataProperty(captures, capturesLength++, matched);

-    // String substitutions can only reference $1 through $99. Keep getting and
-    // stringifying all captures because those operations are observable.
-    var storedCaptures = functionalReplace ?
-                           nCaptures :
-                           std_Math_min(nCaptures, REGEXP_MAX_SUBSTITUTION_CAPTURES);
-
    // Step 14.g, 14.i, 14.i.iv.
    for (var n = 1; n <= nCaptures; n++) {
        // Step 14.i.i.
@@ -479,9 +473,7 @@ function RegExpGetComplexReplacement(result, matched, S, position,
            capN = ToString(capN);

        // Step 14.i.iii.
-        if (n <= storedCaptures) {
-            _DefineDataProperty(captures, capturesLength++, capN);
-        }
+        _DefineDataProperty(captures, capturesLength++, capN);
    }

    // Step 14.j.
@@ -79,8 +79,6 @@

 #define REGEXP_FLAGS_SLOT 2

-#define REGEXP_MAX_SUBSTITUTION_CAPTURES 99
-
 #define REGEXP_IGNORECASE_FLAG  0x01
 #define REGEXP_GLOBAL_FLAG      0x02
 #define REGEXP_MULTILINE_FLAG   0x04
@@ -140,9 +140,9 @@ WeakRefObject::create(JSContext* cx, HandleValue target, HandleObject proto /* =

    Referent* data;
    if (target.isObject())
-        data = cx->new_<Referent>(&target.toObject());
+        data = cx->new_<Referent>(&target.toObject(), cx->options().weakRefs());
    else
-        data = cx->new_<Referent>(target.toSymbol());
+        data = cx->new_<Referent>(target.toSymbol(), cx->options().weakRefs());

    if (!data)
        return nullptr;
@@ -210,7 +210,9 @@ WeakRefObject::trace(JSTracer* trc, JSObject* obj)
            if (!target)
                return;

-            if (IsInsideNursery(target)) {
+            if (!data->enabled) {
+                // Pref disabled, don't do anything.
+            } else if (IsInsideNursery(target)) {
                // Weak edges must be tenured; trace strongly while referent is in the nursery.
                TraceManuallyBarrieredEdge(trc, data->objectTarget.unsafeGet(),
                                           "WeakRef nursery referent");
@@ -220,7 +222,7 @@ WeakRefObject::trace(JSTracer* trc, JSObject* obj)
        } else {
            MOZ_ASSERT(data->isSymbol());
            JS::Symbol* target = data->symbolTarget.unbarrieredGet();
-            if (target)
+            if (data->enabled && target)
                TraceWeakEdge(trc, &data->symbolTarget, "WeakRef symbol referent");
        }
    }
@@ -22,17 +22,27 @@ class WeakRefObject : public NativeObject
            Symbol
        };

-        explicit Referent(JSObject* obj)
-          : kind(Kind::Object), objectTarget(obj), symbolTarget(nullptr) {}
-        explicit Referent(JS::Symbol* sym)
-          : kind(Kind::Symbol), objectTarget(nullptr), symbolTarget(sym) {}
-
+        explicit Referent(JSObject* obj, bool enabled)
+          : kind(Kind::Object)
+          , objectTarget(obj)
+          , symbolTarget(nullptr)
+          , enabled(enabled)
+        {}
+        
+        explicit Referent(JS::Symbol* sym, bool enabled)
+          : kind(Kind::Symbol)
+          , objectTarget(nullptr)
+          , symbolTarget(sym)
+          , enabled(enabled)
+        {}
+        
        bool isObject() const { return kind == Kind::Object; }
        bool isSymbol() const { return kind == Kind::Symbol; }

        Kind kind;
        WeakRef<JSObject*> objectTarget;
        WeakRef<JS::Symbol*> symbolTarget;
+        bool enabled;
    };

    static const Class class_;
@@ -416,13 +416,13 @@ MapMemoryAt(void* desired, size_t length, int prot = PROT_READ | PROT_WRITE,
            int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)

 // Solaris manages 64-bit address space in a different manner from every other
-// AMD64 operating system, but fortunately the fix is the same one 
-// required for every operating system on 64-bit SPARC, Itanium, and ARM. 
+// AMD64 operating system, but fortunately the fix is the same one
+// required for every operating system on 64-bit SPARC and ARM.
 // Most people's intuition failed them here and they thought this couldn't
 // possibly be correct on AMD64, but for Solaris/illumos it is.	
 	
 {
-#if defined(__ia64__) || defined(__aarch64__) || (defined(__sun) && defined(__x86_64__)) || (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
+#if defined(__aarch64__) || (defined(__sun) && defined(__x86_64__)) || (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
    MOZ_ASSERT((0xffff800000000000ULL & (uintptr_t(desired) + length - 1)) == 0);
 #endif
    void* region = mmap(desired, length, prot, flags, fd, offset);
@@ -445,14 +445,14 @@ static inline void*
 MapMemory(size_t length, int prot = PROT_READ | PROT_WRITE,
          int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)
 {
-#if defined(__ia64__) || (defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__))
+#if defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__)
    /*
     * The JS engine assumes that all allocated pointers have their high 17 bits clear,
-     * which ia64's mmap doesn't support directly. However, we can emulate it by passing
-     * mmap an "addr" parameter with those bits clear. The mmap will return that address,
-     * or the nearest available memory above that address, providing a near-guarantee
-     * that those bits are clear. If they are not, we return nullptr below to indicate
-     * out-of-memory.
+     * which mmap on this platform doesn't support directly. However, we can emulate it
+     * by passing mmap an "addr" parameter with those bits clear. The mmap will return
+     * that address, or the nearest available memory above that address, providing a
+     * near-guarantee that those bits are clear. If they are not, we return nullptr below
+     * to indicate out-of-memory.
     *
     * The addr is chosen as 0x0000070000000000, which still allows about 120TB of virtual
     * address space.
@@ -479,7 +479,7 @@ MapMemory(size_t length, int prot = PROT_READ | PROT_WRITE,
    * different due to the different mmap behavior.
    *
    * TODO: Merge with the above code block if this implementation works for
-    * ia64 and sparc64.
+    * sparc64.
    */
    const uintptr_t start = UINT64_C(0x0000070000000000);
    const uintptr_t end   = UINT64_C(0x0000800000000000);
@@ -8185,7 +8185,7 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleT(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleT> || std::is_same_v<T, LFallibleStoreElementT>,
                  "emitStoreElementHoleT called with unexpected argument type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -8244,7 +8244,7 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleV(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleV> || std::is_same_v<T, LFallibleStoreElementV>,
                  "emitStoreElementHoleV called with unexpected parameter type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -494,9 +494,6 @@ OnLeaveBaselineFrame(JSContext* cx, const JitFrameIterator& frame, jsbytecode* p
 {
    BaselineFrame* baselineFrame = frame.baselineFrame();
    if (jit::DebugEpilogue(cx, baselineFrame, pc, frameOk)) {
-        if (!baselineFrame->hasReturnValue()) {
-            baselineFrame->setReturnValue(UndefinedValue());
-        }
        rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
        rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
        rfe->stackPointer = reinterpret_cast<uint8_t*>(baselineFrame);
@@ -320,7 +320,6 @@ size_t AssemblerLOONGARCH64::bytesNeeded() const {

 // write a blob of binary into the instruction stream
 BufferOffset AssemblerLOONGARCH64::writeInst(uint32_t x, uint32_t* dest) {
-  MOZ_ASSERT(hasCreator());
  if (dest == nullptr) {
    return m_buffer.putInt(x);
  }
@@ -212,6 +212,8 @@ static constexpr Register WasmTableCallIndexReg = ABINonArgReg3;
 static constexpr Register WasmIonExitRegCallee = t0;
 static constexpr Register WasmIonExitRegE0 = a0;
 static constexpr Register WasmIonExitRegE1 = a1;
+static constexpr Register WasmIonExitRegReturnData = JSReturnReg_Data;
+static constexpr Register WasmIonExitRegReturnType = JSReturnReg_Type;
 static constexpr Register WasmIonExitRegD0 = a0;
 static constexpr Register WasmIonExitRegD1 = a1;
 static constexpr Register WasmIonExitRegD2 = t0;
@@ -1013,8 +1013,8 @@ CodeGeneratorLoongArch64::visitTestI64AndBranch(LTestI64AndBranch* lir)
 void
 CodeGeneratorLoongArch64::setReturnDoubleRegs(LiveRegisterSet* regs)
 {
-    MOZ_ASSERT(ReturnFloat32Reg.reg_ == FloatRegisters::f0);
-    MOZ_ASSERT(ReturnDoubleReg.reg_ == FloatRegisters::f0);
+    MOZ_ASSERT(ReturnFloat32Reg.encoding() == FloatRegisters::f0);
+    MOZ_ASSERT(ReturnDoubleReg.encoding() == FloatRegisters::f0);
    FloatRegister f1 = { FloatRegisters::f1, FloatRegisters::Single };
    regs->add(ReturnFloat32Reg);
    regs->add(f1);
@@ -2395,7 +2395,7 @@ void MacroAssemblerLOONGARCH64::wasmLoadImpl(const wasm::MemoryAccessDesc& acces
                                         Register ptrScratch,
                                         AnyRegister output, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
+  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2442,7 +2442,7 @@ void MacroAssemblerLOONGARCH64::wasmStoreImpl(const wasm::MemoryAccessDesc& acce
                                          Register memoryBase, Register ptr,
                                          Register ptrScratch, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
+  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2488,7 +2488,7 @@ void MacroAssemblerLOONGARCH64Compat::wasmLoadI64Impl(
    const wasm::MemoryAccessDesc& access, Register memoryBase, Register ptr,
    Register ptrScratch, Register64 output, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
+  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2534,7 +2534,7 @@ void MacroAssemblerLOONGARCH64Compat::wasmStoreI64Impl(
    const wasm::MemoryAccessDesc& access, Register64 value, Register memoryBase,
    Register ptr, Register ptrScratch, Register tmp) {
  uint32_t offset = access.offset();
-  MOZ_ASSERT(offset < asMasm().wasmMaxOffsetGuardLimit());
+  MOZ_ASSERT(offset < wasm::OffsetGuardLimit);
  MOZ_ASSERT_IF(offset, ptrScratch != InvalidReg);

  // Maybe add the offset.
@@ -2774,12 +2774,13 @@ CodeOffset MacroAssembler::nopPatchableToNearJump() {
 }

 void MacroAssembler::patchNopToNearJump(uint8_t* jump, uint8_t* target) {
-  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->is<InstNOP>());
+  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->encode() == NopInst);
  new (jump) InstJump(op_b, JOffImm26(target - jump));
 }

 void MacroAssembler::patchNearJumpToNop(uint8_t* jump) {
-  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->is<InstJump>());
+  MOZ_ASSERT(reinterpret_cast<Instruction*>(jump)->extractBitField(31, 26) ==
+             (uint32_t)op_b >> 26);
  new (jump) InstNOP();
 }

@@ -301,7 +301,7 @@ void unmapPages(void* p, size_t size) { }
 void*
 mapMemoryAt(void* desired, size_t length)
 {
-#if defined(__ia64__) || defined(__aarch64__) || \
+#if defined(__aarch64__) || \
    (defined(__sparc__) && defined(__arch64__) && (defined(__NetBSD__) || defined(__linux__)))
    MOZ_RELEASE_ASSERT(0xffff800000000000ULL & (uintptr_t(desired) + length - 1) == 0);
 #endif
@@ -324,7 +324,7 @@ mapMemory(size_t length)
    int fd = -1;
    off_t offset = 0;
    // The test code must be aligned with the implementation in gc/Memory.cpp.
-#if defined(__ia64__) || (defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__))
+#if defined(__sparc__) && defined(__arch64__) && defined(__NetBSD__)
    void* region = mmap((void*)0x0000070000000000, length, prot, flags, fd, offset);
    if (region == MAP_FAILED)
        return nullptr;
@@ -999,7 +999,8 @@ class JS_PUBLIC_API(ContextOptions) {
        strictMode_(false),
        extraWarnings_(false),
        arrayProtoValues_(true),
-        streams_(false)
+        streams_(false),
+        weakRefs_(false)
    {
    }

@@ -1139,12 +1140,13 @@ class JS_PUBLIC_API(ContextOptions) {
        return *this;
    }

-    bool weakRefs() const { return true; }
+    bool weakRefs() const { return weakRefs_; }
    ContextOptions& setWeakRefs(bool flag) {
-        (void) flag;
+        weakRefs_ = flag;
        return *this;
    }
    ContextOptions& toggleWeakRefs() {
+        weakRefs_ = !weakRefs_;
        return *this;
    }

@@ -1165,6 +1167,7 @@ class JS_PUBLIC_API(ContextOptions) {
    bool extraWarnings_ : 1;
    bool arrayProtoValues_ : 1;
    bool streams_ : 1;
+    bool weakRefs_ : 1;
 };

 JS_PUBLIC_API(ContextOptions&)
@@ -312,13 +312,12 @@ cvt_s(SprintfState* ss, const char* s, int width, int prec, int flags)
        s = generic_null_str(s);

    // Limit string length by precision value
-    size_t slen = strnlen(s, size_t(prec));
-    if (slen > INT_MAX) {
-        return false;
-    }
+    int slen = int(generic_strlen(s));
+    if (0 < prec && prec < slen)
+        slen = prec;

    // and away we go
-    return fill2(ss, s, int(slen), width, flags);
+    return fill2(ss, s, slen, width, flags);
 }

 /*
@@ -976,6 +976,12 @@ CanUpperCaseSpecialCasing(Latin1Char charCode)
 static inline bool
 CanUpperCaseSpecialCasing(char16_t charCode)
 {
+    // Update mapping for U+00DF LATIN SMALL LETTER SHARP S inline,
+    // overriding Unicode data files to force the use of
+    // U+1E9E LATIN CAPITAL LETTER SHARP S.
+    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S)
+        return true;
+
    return unicode::CanUpperCaseSpecialCasing(charCode);
 }

@@ -991,6 +997,11 @@ LengthUpperCaseSpecialCasing(Latin1Char charCode)
 static inline size_t
 LengthUpperCaseSpecialCasing(char16_t charCode)
 {
+    // U+00DF LATIN SMALL LETTER SHARP S is uppercased according to ICU or
+    // to U+1E9E LATIN CAPITAL LETTER SHARP S.
+    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S)
+        return 1;
+
    MOZ_ASSERT(CanUpperCaseSpecialCasing(charCode));

    return unicode::LengthUpperCaseSpecialCasing(charCode);
@@ -1010,6 +1021,13 @@ AppendUpperCaseSpecialCasing(char16_t charCode, Latin1Char* elements, size_t* in
 static inline void
 AppendUpperCaseSpecialCasing(char16_t charCode, char16_t* elements, size_t* index)
 {
+    // U+00DF LATIN SMALL LETTER SHARP S is uppercased according to ICU or
+    // to U+1E9E LATIN CAPITAL LETTER SHARP S.
+    if (charCode == unicode::LATIN_SMALL_LETTER_SHARP_S) {
+        elements[(*index)++] = 0x1E9E;
+        return;
+    }
+
    unicode::AppendUpperCaseSpecialCasing(charCode, elements, index);
 }

@@ -1025,6 +1043,7 @@ ToUpperCaseImpl(DestChar* destChars, const SrcChar* srcChars, size_t startIndex,
    MOZ_ASSERT(srcLength <= destLength);

    size_t j = startIndex;
+    size_t upperLength = srcLength;
    for (size_t i = startIndex; i < srcLength; i++) {
        char16_t c = srcChars[i];
        if (!IsSame<DestChar, Latin1Char>::value) {
@@ -1040,9 +1059,10 @@ ToUpperCaseImpl(DestChar* destChars, const SrcChar* srcChars, size_t startIndex,
            }
        }

-        if (MOZ_UNLIKELY(c > 0x7f && CanUpperCaseSpecialCasing(static_cast<SrcChar>(c)))) {
+        if (MOZ_UNLIKELY(c > 0x7f && CanUpperCaseSpecialCasing(static_cast<DestChar>(c)))) {
            // Return if the output buffer is too small.
-            if (srcLength == destLength)
+            upperLength += (LengthUpperCaseSpecialCasing(static_cast<DestChar>(c)) - 1);
+            if (upperLength > destLength)
                return i;

            AppendUpperCaseSpecialCasing(c, destChars, &j);
@@ -1071,14 +1091,18 @@ ToUpperCaseImpl(Latin1Char* destChars, const char16_t* srcChars, size_t startInd

 template <typename CharT>
 static size_t
-ToUpperCaseLength(const CharT* chars, size_t startIndex, size_t length)
+ToUpperCaseLength(const CharT* chars, size_t startIndex, size_t length, bool force16)
 {
    size_t upperLength = length;
    for (size_t i = startIndex; i < length; i++) {
        char16_t c = chars[i];

-        if (c > 0x7f && CanUpperCaseSpecialCasing(static_cast<CharT>(c)))
-            upperLength += LengthUpperCaseSpecialCasing(static_cast<CharT>(c)) - 1;
+        if (c > 0x7f &&
+            (force16 && CanUpperCaseSpecialCasing(c) ||
+             CanUpperCaseSpecialCasing(static_cast<CharT>(c))))
+            upperLength += (force16
+                ? LengthUpperCaseSpecialCasing(c)
+                : LengthUpperCaseSpecialCasing(static_cast<CharT>(c))) - 1;
    }
    return upperLength;
 }
@@ -1117,7 +1141,7 @@ ToUpperCase(JSContext* cx, const SrcChar* chars, size_t startIndex, size_t lengt

    size_t readChars = ToUpperCaseImpl(buf.get(), chars, startIndex, length, length);
    if (readChars < length) {
-        size_t actualLength = ToUpperCaseLength(chars, readChars, length);
+        size_t actualLength = ToUpperCaseLength(chars, readChars, length, !IsSame<DestChar, Latin1Char>::value);

        *resultLength = actualLength;
        DestCharPtr buf2 = ReallocChars(cx, Move(buf), length + 1, actualLength + 1);
@@ -1178,7 +1202,8 @@ ToUpperCase(JSContext* cx, JSLinearString* str)
        //
        // If the original string is Latin-1, it can -- unless the string
        // contains U+00B5 MICRO SIGN or U+00FF SMALL LETTER Y WITH DIAERESIS,
-        // the only Latin-1 codepoints that don't uppercase within Latin-1.
+        // the only Latin-1 codepoints that don't uppercase within Latin-1, or
+        // it contains U+00DF LATIN SMALL LETTER SHARP S, which we override.
        // Search for those codepoints to decide whether the new string can be
        // Latin-1.
        // If the original string is a two-byte string, its uppercase form is
@@ -1195,6 +1220,9 @@ ToUpperCase(JSContext* cx, JSLinearString* str)
                    MOZ_ASSERT(unicode::ToUpperCase(c) > JSString::MAX_LATIN1_CHAR);
                    resultIsLatin1 = false;
                    break;
+                } else if (c == unicode::LATIN_SMALL_LETTER_SHARP_S) {
+                    resultIsLatin1 = false;
+                    break;
                } else {
                    MOZ_ASSERT(unicode::ToUpperCase(c) <= JSString::MAX_LATIN1_CHAR);
                }
@@ -2843,8 +2871,8 @@ static JSString* ReplaceAll(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-      std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+      std::is_same_v<RepChar, char16_t>) {
        if (!result.ensureTwoByteChars()) {
          return nullptr;
        }
@@ -2926,8 +2954,8 @@ static JSString* ReplaceAllInterleave(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-        std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+        std::is_same_v<RepChar, char16_t>) {
        if (!result.ensureTwoByteChars()) {
            return nullptr;
        }
@@ -309,26 +309,26 @@ InflateUTF8StringToBuffer(ContextT* cx, const UTF8Chars src, CharT* dst, size_t*
            while (v & (0x80 >> n))
                n++;

-        #define INVALID(report, arg, n2)                                \
-            do {                                                        \
-                if (Action == CountAndReportInvalids) {                 \
-                    report(cx, arg);                                    \
-                    return false;                                       \
-                } else if (Action == AssertNoInvalids) {                \
-                    MOZ_CRASH("invalid UTF-8 string: " # report);       \
-                } else {                                                \
-                    if (Action == Copy) {                               \
-                        if (std::is_same<decltype(dst[0]), Latin1Char>::value) \
-                            dst[j] = CharT(REPLACE_UTF8_LATIN1);        \
-                        else                                            \
-                            dst[j] = CharT(REPLACE_UTF8);               \
-                    } else {                                            \
-                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||  \
-                                   Action == FindEncoding);             \
-                    }                                                   \
-                    n = n2;                                             \
-                    goto invalidMultiByteCodeUnit;                      \
-                }                                                       \
+        #define INVALID(report, arg, n2)                                  \
+            do {                                                          \
+                if (Action == CountAndReportInvalids) {                   \
+                    report(cx, arg);                                      \
+                    return false;                                         \
+                } else if (Action == AssertNoInvalids) {                  \
+                    MOZ_CRASH("invalid UTF-8 string: " # report);         \
+                } else {                                                  \
+                    if (Action == Copy) {                                 \
+                        if (std::is_same_v<decltype(dst[0]), Latin1Char>) \
+                            dst[j] = CharT(REPLACE_UTF8_LATIN1);          \
+                        else                                              \
+                            dst[j] = CharT(REPLACE_UTF8);                 \
+                    } else {                                              \
+                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||    \
+                                   Action == FindEncoding);               \
+                    }                                                     \
+                    n = n2;                                               \
+                    goto invalidMultiByteCodeUnit;                        \
+                }                                                         \
            } while (0)

            // Check the leading byte.
@@ -1138,7 +1138,7 @@ class StaticStrings
    }

    template <typename CharT,
-              typename = typename std::enable_if<!std::is_const<CharT>::value>::type>
+              typename = typename std::enable_if_t<!std::is_const_v<CharT>>>
    MOZ_ALWAYS_INLINE JSAtom* lookup(CharT* chars, size_t length) {
        // Collapse the remaining |CharT*| to |const CharT*| to avoid excess
        // instantiations.
@@ -677,12 +677,12 @@ class ElementSpecific
            return true;
        }

-        if (std::is_same<T, int64_t>::value) {
+        if (std::is_same_v<T, int64_t>) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigInt64(cx, v));
            return true;
        }

-        if (std::is_same<T, uint64_t>::value) {
+        if (std::is_same_v<T, uint64_t>) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigUint64(cx, v));
            return true;
        }
@@ -839,7 +839,7 @@ wasm::ToggleProfiling(const Code& code, const CallSite& callSite, bool enabled)
 #elif defined(JS_CODEGEN_LOONGARCH64)
    uint8_t* caller = callerRetAddr - sizeof(uint32_t);
    Instruction* callerInsn = reinterpret_cast<Instruction*>(caller);
-    MOZ_ASSERT(callerInsn->extractOpcode() == ((uint32_t)op_bl >> OpcodeShift));
+    MOZ_ASSERT(callerInsn->extractBitField(31, 26) == ((uint32_t)op_bl >> 26));
    int32_t calleeOffset =
        int32_t(reinterpret_cast<InstJump*>(callerInsn)->extractImm26Value() << 8) >> 6;
    void* callee = caller + calleeOffset;
@@ -1442,6 +1442,7 @@ ReloadPrefsCallback(const char* pref, void* data)
    bool extraWarnings = Preferences::GetBool(JS_OPTIONS_DOT_STR "strict");
    
    bool streams = Preferences::GetBool(JS_OPTIONS_DOT_STR "streams");
+    bool weakRefs = Preferences::GetBool(JS_OPTIONS_DOT_STR "weakrefs");

    bool unboxedObjects = Preferences::GetBool(JS_OPTIONS_DOT_STR "unboxed_objects");
    
@@ -1468,7 +1469,8 @@ ReloadPrefsCallback(const char* pref, void* data)
                             .setWerror(werror)
                             .setExtraWarnings(extraWarnings)
                             .setArrayProtoValues(arrayProtoValues)
-                             .setStreams(streams);
+                             .setStreams(streams)
+                             .setWeakRefs(weakRefs);

    JS_SetParallelParsingEnabled(cx, parallelParsing);
    JS_SetOffthreadIonCompilationEnabled(cx, offthreadIonCompilation);
@@ -411,13 +411,6 @@ DottedCornerFinder::FindBestOverlap(Float aMinR, Float aMinBorderRadius,
        mCount = mMaxCount;
        break;
      }
-      // GetCountAndLastOverlap() failed without writing |count| and
-      // |actualOverlap|: the walk needed more than mMaxCount circles, i.e.
-      // this overlap produces too many circles.  Narrow the search toward
-      // smaller overlaps.
-      upper = overlap;
-      overlap = (upper + lower) / 2.0f;
-      continue;
    }

    if (j == 0) {
@@ -318,11 +318,7 @@ nsHTMLFramesetFrame::Init(nsIContent*       aContent,
        mChildFrameborder[mChildCount] = GetFrameBorder(child);
        mChildBorderColors[mChildCount].Set(GetBorderColor(child));
      }
-      if (MOZ_LIKELY(!child->GetPrimaryFrame())) {
-        // Child might have a pre-existing primary frame if we're doing fixed-pos
-        // replication... So, only set it if there is no primary frame yet.
-        child->SetPrimaryFrame(frame);
-      }
+      child->SetPrimaryFrame(frame);

      mFrames.AppendFrame(nullptr, frame);

@@ -318,7 +318,7 @@ nsCaseTransformTextRunFactory::TransformString(
                                     // in the output string
  uint32_t irishMarkSrc = uint32_t(-1); // corresponding location in source
                                        // string (may differ from output due to
-                                        // expansions like eszet -> 'SS')
+                                        // expansions)

  for (uint32_t i = 0; i < length; ++i, ++aOffsetInTextRun) {
    uint32_t ch = str[i];
@@ -604,6 +604,13 @@ nsCaseTransformTextRunFactory::TransformString(
        // to check for special uppercase (ß)
      }

+      // Updated mapping for Germen eszett, not currently reflected in the
+      // Unicode data files.
+      if (ch == 0x00DF) {
+        ch = 0x1E9E;
+        break;
+      }
+
      mcm = mozilla::unicode::SpecialUpper(ch);
      if (mcm) {
        int j = 0;
@@ -658,6 +665,12 @@ nsCaseTransformTextRunFactory::TransformString(
            }
          }

+          // Updated mapping for Germen eszett as a capital letter.
+          if (ch == 0x00DF) {
+            ch = 0x1E9E;
+            break;
+          }
+
          mcm = mozilla::unicode::SpecialTitle(ch);
          if (mcm) {
            int j = 0;
@@ -953,11 +953,12 @@ inDOMUtils::GetCSSValuesForProperty(const nsAString& aProperty,
      GetOtherValuesForProperty(propertyParserVariant, array);
    }
  }
-  // All CSS properties take initial, inherit, unset, and revert.
+  // All CSS properties take initial, inherit, unset, revert, and revert-layer.
  InsertNoDuplicates(array, NS_LITERAL_STRING("initial"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("inherit"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("unset"));
  InsertNoDuplicates(array, NS_LITERAL_STRING("revert"));
+  InsertNoDuplicates(array, NS_LITERAL_STRING("revert-layer"));

  *aLength = array.Length();
  char16_t** ret =
@@ -8,19 +8,227 @@
 #include "CSSVariableDeclarations.h"

 #include "CSSVariableResolver.h"
+#include "CSSVariableValues.h"
 #include "nsCSSScanner.h"
 #include "nsRuleData.h"

-// These four special string values are used to represent specified values of
-// 'initial', 'inherit', 'unset', and 'revert'.  (Note that none of these are
-// valid variable values.)
+// These special string values are used to represent specified values of
+// CSS-wide keywords.  (Note that none of these are valid variable values.)
 #define INITIAL_VALUE "!"
 #define INHERIT_VALUE ";"
 #define UNSET_VALUE   ")"
 #define REVERT_VALUE  ">"
+#define REVERT_LAYER_VALUE  "]"
+
+static const int32_t kRevertLayerMask = 0x000fffff;
+static const int32_t kRevertLayerImportant = 0x00100000;
+static const int32_t kRevertLayerOriginShift = 21;
+static const int32_t kLayerIndexMax = 0x000fffff;
+static const int32_t kCascadeRankStride = kLayerIndexMax + 1;

 namespace mozilla {

+static bool
+IsRevertLayerValue(const nsString& aValue)
+{
+  return StringBeginsWith(aValue, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
+}
+
+static bool
+ValueMightResolveToRevertLayer(const nsString& aValue)
+{
+  return IsRevertLayerValue(aValue) ||
+         aValue.Find(NS_LITERAL_STRING("revert-layer")) != kNotFound;
+}
+
+static int32_t
+PackRevertLayerData(SheetType aLevel, bool aIsImportant,
+                    int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask);
+  return (uint32_t(aLevel) << kRevertLayerOriginShift) |
+         (aIsImportant ? kRevertLayerImportant : 0) |
+         (aLayerIndex & kRevertLayerMask);
+}
+
+static void
+SetRevertLayerData(nsString& aValue, const nsRuleData* aRuleData)
+{
+  aValue.AssignLiteral(REVERT_LAYER_VALUE);
+  aValue.AppendInt(PackRevertLayerData(aRuleData->mLevel,
+                                       aRuleData->mIsImportantRule,
+                                       aRuleData->mLayerIndex));
+}
+
+static bool
+UnpackRevertLayerData(const nsString& aValue, SheetType& aLevel,
+                      bool& aIsImportant, int32_t& aLayerIndex)
+{
+  if (!IsRevertLayerValue(aValue) ||
+      aValue.Length() == NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()) {
+    return false;
+  }
+
+  nsresult rv;
+  nsAutoString metadata;
+  metadata.Assign(Substring(aValue,
+                            NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()));
+  int32_t packed = metadata.ToInteger(&rv);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  aLevel = SheetType(uint32_t(packed) >> kRevertLayerOriginShift);
+  aIsImportant = (packed & kRevertLayerImportant) != 0;
+  aLayerIndex = packed & kRevertLayerMask;
+  return true;
+}
+
+static int32_t
+LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0);
+  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
+  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
+}
+
+static int32_t
+CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
+                      int32_t aLayerIndex)
+{
+  int32_t bucket = 0;
+  bool isLayeredOrigin = false;
+
+  switch (aLevel) {
+    case SheetType::Agent:
+      bucket = aIsImportant ? 14 : 0;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::User:
+      bucket = aIsImportant ? 13 : 1;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::PresHint:
+      bucket = 2;
+      break;
+    case SheetType::SVGAttrAnimation:
+      bucket = 3;
+      break;
+    case SheetType::Doc:
+      bucket = aIsImportant ? 10 : 4;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::ScopedDoc:
+      bucket = aIsImportant ? 9 : 5;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::StyleAttr:
+      bucket = aIsImportant ? 11 : 6;
+      break;
+    case SheetType::Override:
+      bucket = aIsImportant ? 12 : 7;
+      break;
+    case SheetType::Animation:
+      bucket = 8;
+      break;
+    case SheetType::Transition:
+      bucket = 15;
+      break;
+    default:
+      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
+      break;
+  }
+
+  return bucket * kCascadeRankStride +
+         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
+}
+
+static bool
+ShouldIgnoreForRevertLayerData(SheetType aSourceLevel,
+                               bool aSourceImportant,
+                               int32_t aSourceLayerIndex,
+                               SheetType aCandidateLevel,
+                               bool aCandidateImportant,
+                               int32_t aCandidateLayerIndex)
+{
+  int32_t candidateRank =
+    CascadePrecedenceRank(aCandidateLevel, aCandidateImportant,
+                          aCandidateLayerIndex);
+  int32_t sourceRank =
+    CascadePrecedenceRank(aSourceLevel, aSourceImportant, aSourceLayerIndex);
+
+  if (candidateRank >= sourceRank) {
+    return true;
+  }
+
+  if (!aSourceImportant) {
+    return false;
+  }
+
+  if (aSourceLevel == SheetType::StyleAttr) {
+    return aCandidateLevel == SheetType::StyleAttr ||
+           aCandidateLevel == SheetType::Animation;
+  }
+
+  int32_t normalBoundary =
+    CascadePrecedenceRank(aSourceLevel, false, aSourceLayerIndex);
+  return candidateRank >= normalBoundary;
+}
+
+static bool
+ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
+                                SheetType aCandidateLevel,
+                                bool aCandidateImportant,
+                                int32_t aCandidateLayerIndex)
+{
+  SheetType sourceLevel;
+  bool sourceImportant;
+  int32_t sourceLayerIndex;
+  if (!UnpackRevertLayerData(aTargetValue, sourceLevel, sourceImportant,
+                             sourceLayerIndex)) {
+    return false;
+  }
+
+  return ShouldIgnoreForRevertLayerData(sourceLevel, sourceImportant,
+                                        sourceLayerIndex, aCandidateLevel,
+                                        aCandidateImportant,
+                                        aCandidateLayerIndex);
+}
+
+static bool
+ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
+                                const nsRuleData* aRuleData)
+{
+  return ShouldIgnoreForRevertLayerValue(aTargetValue, aRuleData->mLevel,
+                                         aRuleData->mIsImportantRule,
+                                         aRuleData->mLayerIndex);
+}
+
+static bool
+ShouldIgnoreForRevertLayerSourceValue(const nsString& aTargetValue,
+                                      const nsString& aCandidateValue)
+{
+  SheetType candidateLevel;
+  bool candidateImportant;
+  int32_t candidateLayerIndex;
+  if (!UnpackRevertLayerData(aCandidateValue, candidateLevel,
+                             candidateImportant, candidateLayerIndex)) {
+    return false;
+  }
+
+  return ShouldIgnoreForRevertLayerValue(aTargetValue, candidateLevel,
+                                         candidateImportant,
+                                         candidateLayerIndex);
+}
+
+static bool
+IsComputedRevertLayerValue(const nsString& aValue)
+{
+  nsAutoString trimmed(aValue);
+  trimmed.CompressWhitespace(true, true);
+  return trimmed.EqualsLiteral("revert-layer");
+}
+
 CSSVariableDeclarations::CSSVariableDeclarations()
 {
  MOZ_COUNT_CTOR(CSSVariableDeclarations);
@@ -47,6 +255,8 @@ CSSVariableDeclarations::operator=(const CSSVariableDeclarations& aOther)
  }

  mVariables.Clear();
+  mRevertLayerSources.Clear();
+  mRevertLayerFallbacks.Clear();
  CopyVariablesFrom(aOther);
  return *this;
 }
@@ -57,6 +267,15 @@ CSSVariableDeclarations::CopyVariablesFrom(const CSSVariableDeclarations& aOther
  for (auto iter = aOther.mVariables.ConstIter(); !iter.Done(); iter.Next()) {
    mVariables.Put(iter.Key(), iter.UserData());
  }
+  for (auto iter = aOther.mRevertLayerSources.ConstIter();
+       !iter.Done(); iter.Next()) {
+    mRevertLayerSources.Put(iter.Key(), iter.UserData());
+  }
+  for (auto iter = aOther.mRevertLayerFallbacks.ConstIter();
+       !iter.Done(); iter.Next()) {
+    RevertLayerFallbackList* list = mRevertLayerFallbacks.LookupOrAdd(iter.Key());
+    list->mItems = iter.UserData()->mItems;
+  }
 }

 bool
@@ -87,6 +306,9 @@ CSSVariableDeclarations::Get(const nsAString& aName,
  } else if (value.EqualsLiteral(REVERT_VALUE)) {
    aType = eRevert;
    aTokenStream.Truncate();
+  } else if (IsRevertLayerValue(value)) {
+    aType = eRevertLayer;
+    aTokenStream.Truncate();
  } else {
    aType = eTokenStream;
    aTokenStream = value;
@@ -101,7 +323,8 @@ CSSVariableDeclarations::PutTokenStream(const nsAString& aName,
  MOZ_ASSERT(!aTokenStream.EqualsLiteral(INITIAL_VALUE) &&
             !aTokenStream.EqualsLiteral(INHERIT_VALUE) &&
             !aTokenStream.EqualsLiteral(UNSET_VALUE) &&
-             !aTokenStream.EqualsLiteral(REVERT_VALUE));
+             !aTokenStream.EqualsLiteral(REVERT_VALUE) &&
+             !aTokenStream.EqualsLiteral(REVERT_LAYER_VALUE));
  mVariables.Put(aName, aTokenStream);
 }

@@ -129,6 +352,12 @@ CSSVariableDeclarations::PutRevert(const nsAString& aName)
  mVariables.Put(aName, NS_LITERAL_STRING(REVERT_VALUE));
 }

+void
+CSSVariableDeclarations::PutRevertLayer(const nsAString& aName)
+{
+  mVariables.Put(aName, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
+}
+
 void
 CSSVariableDeclarations::Remove(const nsAString& aName)
 {
@@ -143,16 +372,49 @@ CSSVariableDeclarations::MapRuleInfoInto(nsRuleData* aRuleData)
  }

  if (!aRuleData->mVariables) {
-    aRuleData->mVariables = new CSSVariableDeclarations(*this);
-  } else {
-    for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
-      nsDataHashtable<nsStringHashKey, nsString>& variables =
-        aRuleData->mVariables->mVariables;
-      const nsAString& aName = iter.Key();
-      if (!variables.Contains(aName)) {
-        variables.Put(aName, iter.UserData());
+    aRuleData->mVariables = new CSSVariableDeclarations;
+  }
+
+  for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
+    nsDataHashtable<nsStringHashKey, nsString>& variables =
+      aRuleData->mVariables->mVariables;
+    const nsAString& name = iter.Key();
+    nsString value = iter.UserData();
+    nsString valueSource;
+    SetRevertLayerData(valueSource, aRuleData);
+    if (value.EqualsLiteral(REVERT_LAYER_VALUE)) {
+      value = valueSource;
+      aRuleData->mConditions.SetUncacheable();
+    }
+
+    nsString existingValue;
+    if (variables.Get(name, &existingValue)) {
+      if (IsRevertLayerValue(existingValue)) {
+        if (ShouldIgnoreForRevertLayerValue(existingValue, aRuleData)) {
+          continue;
+        }
+      } else {
+        nsString sourceValue;
+        if (aRuleData->mVariables->mRevertLayerSources.Get(name,
+                                                           &sourceValue) &&
+            !ShouldIgnoreForRevertLayerValue(sourceValue, aRuleData)) {
+          RevertLayerFallbackList* fallbacks =
+            aRuleData->mVariables->mRevertLayerFallbacks.LookupOrAdd(name);
+          RevertLayerFallback* fallback = fallbacks->mItems.AppendElement();
+          fallback->mValue = value;
+          fallback->mSource = valueSource;
+        }
+        continue;
      }
    }
+
+    variables.Put(name, value);
+    if (ValueMightResolveToRevertLayer(value)) {
+      aRuleData->mVariables->mRevertLayerSources.Put(name, valueSource);
+    } else {
+      aRuleData->mVariables->mRevertLayerSources.Remove(name);
+      aRuleData->mVariables->mRevertLayerFallbacks.Remove(name);
+    }
  }
 }

@@ -172,8 +434,9 @@ CSSVariableDeclarations::AddVariablesToResolver(
                     false);
    } else if (value.EqualsLiteral(INHERIT_VALUE) ||
               value.EqualsLiteral(UNSET_VALUE) ||
-               value.EqualsLiteral(REVERT_VALUE)) {
-      // Values of 'inherit', 'unset', and 'revert' don't need any handling,
+               value.EqualsLiteral(REVERT_VALUE) ||
+               IsRevertLayerValue(value)) {
+      // Values of 'inherit', 'unset', 'revert', and 'revert-layer' don't need any handling,
      // since it means we just need to keep whatever value is currently in
      // the resolver.  This is because the specified variable declarations
      // already have only the winning declaration for the variable and no
@@ -190,6 +453,83 @@ CSSVariableDeclarations::AddVariablesToResolver(
  }
 }

+void
+CSSVariableDeclarations::ResolveRevertLayerFallbacks(
+                                             const CSSVariableValues* aInherited,
+                                             CSSVariableValues* aOutput) const
+{
+  for (auto iter = mRevertLayerSources.ConstIter();
+       !iter.Done(); iter.Next()) {
+    const nsAString& name = iter.Key();
+    nsString value;
+    nsCSSTokenSerializationType firstToken, lastToken;
+    if (!aOutput->Get(name, value, firstToken, lastToken)) {
+      continue;
+    }
+
+    if (!IsComputedRevertLayerValue(value)) {
+      continue;
+    }
+
+    const RevertLayerFallbackList* fallbacks = mRevertLayerFallbacks.Get(name);
+    if (fallbacks) {
+      nsString sourceValue = iter.UserData();
+      bool foundFallback = false;
+      for (uint32_t i = 0, n = fallbacks->mItems.Length(); i < n; i++) {
+        const RevertLayerFallback& fallback = fallbacks->mItems[i];
+        if (ShouldIgnoreForRevertLayerSourceValue(sourceValue,
+                                                 fallback.mSource)) {
+          continue;
+        }
+
+        if (IsRevertLayerValue(fallback.mValue)) {
+          sourceValue = fallback.mSource;
+          continue;
+        }
+
+        CSSVariableValues inheritedValues(*aOutput);
+        if (aInherited->Get(name, value, firstToken, lastToken)) {
+          inheritedValues.Put(name, value, firstToken, lastToken);
+        } else {
+          inheritedValues.Remove(name);
+        }
+
+        CSSVariableDeclarations fallbackDeclarations;
+        fallbackDeclarations.mVariables.Put(name, fallback.mValue);
+
+        CSSVariableValues fallbackValues;
+        CSSVariableResolver resolver(&fallbackValues);
+        resolver.Resolve(&inheritedValues, &fallbackDeclarations);
+
+        if (!fallbackValues.Get(name, value, firstToken, lastToken)) {
+          aOutput->Remove(name);
+          foundFallback = true;
+          break;
+        }
+
+        if (IsComputedRevertLayerValue(value)) {
+          sourceValue = fallback.mSource;
+          continue;
+        }
+
+        aOutput->Put(name, value, firstToken, lastToken);
+        foundFallback = true;
+        break;
+      }
+
+      if (foundFallback) {
+        continue;
+      }
+    }
+
+    if (aInherited->Get(name, value, firstToken, lastToken)) {
+      aOutput->Put(name, value, firstToken, lastToken);
+    } else {
+      aOutput->Remove(name);
+    }
+  }
+}
+
 size_t
 CSSVariableDeclarations::SizeOfIncludingThis(
                                      mozilla::MallocSizeOf aMallocSizeOf) const
@@ -200,6 +540,22 @@ CSSVariableDeclarations::SizeOfIncludingThis(
    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
    n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
  }
+  n += mRevertLayerSources.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  for (auto iter = mRevertLayerSources.ConstIter(); !iter.Done(); iter.Next()) {
+    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+  }
+  n += mRevertLayerFallbacks.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  for (auto iter = mRevertLayerFallbacks.ConstIter(); !iter.Done(); iter.Next()) {
+    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    const RevertLayerFallbackList* list = iter.UserData();
+    n += aMallocSizeOf(list);
+    n += list->mItems.ShallowSizeOfExcludingThis(aMallocSizeOf);
+    for (uint32_t i = 0, len = list->mItems.Length(); i < len; i++) {
+      n += list->mItems[i].mValue.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+      n += list->mItems[i].mSource.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    }
+  }
  return n;
 }

@@ -7,10 +7,13 @@
 #ifndef mozilla_CSSVariableDeclarations_h
 #define mozilla_CSSVariableDeclarations_h

+#include "nsClassHashtable.h"
 #include "nsDataHashtable.h"
+#include "nsTArray.h"

 namespace mozilla {
 class CSSVariableResolver;
+class CSSVariableValues;
 } // namespace mozilla
 struct nsRuleData;

@@ -43,7 +46,8 @@ public:
    eInitial,      // 'initial'
    eInherit,      // 'inherit'
    eUnset,        // 'unset'
-    eRevert        // 'revert'
+    eRevert,       // 'revert'
+    eRevertLayer   // 'revert-layer'
  };

  /**
@@ -97,6 +101,15 @@ public:
   */
  void PutRevert(const nsAString& aName);

+  /**
+   * Adds or modifies an existing entry in this set of variable declarations
+   * to have the value 'revert-layer'.
+   *
+   * @param aName The variable name (not including any "--" prefix that would
+   *   be part of the custom property name) whose value is to be set.
+   */
+  void PutRevertLayer(const nsAString& aName);
+
  /**
   * Adds or modifies an existing entry in this set of variable declarations
   * to have a token stream value.
@@ -132,15 +145,36 @@ public:
   */
  void AddVariablesToResolver(CSSVariableResolver* aResolver) const;

+  /**
+   * Applies stored lower-priority declarations for custom property values that
+   * resolved to 'revert-layer'.
+   */
+  void ResolveRevertLayerFallbacks(const CSSVariableValues* aInherited,
+                                   CSSVariableValues* aOutput) const;
+
  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;

 private:
+  struct RevertLayerFallback
+  {
+    nsString mValue;
+    nsString mSource;
+  };
+
+  struct RevertLayerFallbackList
+  {
+    nsTArray<RevertLayerFallback> mItems;
+  };
+
  /**
   * Adds all the variable declarations from aOther into this object.
   */
  void CopyVariablesFrom(const CSSVariableDeclarations& aOther);

  nsDataHashtable<nsStringHashKey, nsString> mVariables;
+  nsDataHashtable<nsStringHashKey, nsString> mRevertLayerSources;
+  nsClassHashtable<nsStringHashKey, RevertLayerFallbackList>
+    mRevertLayerFallbacks;
 };

 } // namespace mozilla
@@ -121,6 +121,21 @@ CSSVariableValues::Put(const nsAString& aName,
  }
 }

+void
+CSSVariableValues::Remove(const nsAString& aName)
+{
+  size_t id;
+  if (!mVariableIDs.Get(aName, &id)) {
+    return;
+  }
+
+  mVariables.RemoveElementAt(id);
+  mVariableIDs.Clear();
+  for (size_t i = 0, n = mVariables.Length(); i < n; i++) {
+    mVariableIDs.Put(mVariables[i].mVariableName, i);
+  }
+}
+
 void
 CSSVariableValues::CopyVariablesFrom(const CSSVariableValues& aOther)
 {
@@ -94,6 +94,11 @@ public:
           nsCSSTokenSerializationType aFirstToken,
           nsCSSTokenSerializationType aLastToken);

+  /**
+   * Removes an entry in this set of variable values.
+   */
+  void Remove(const nsAString& aName);
+
  /**
   * Copies the variables from this object into aResolver, marking them as
   * computed, inherited values.
@@ -576,6 +576,7 @@ Declaration::GetPropertyValueInternal(
  const nsCSSValue* tokenStream = nullptr;
  uint32_t totalCount = 0, importantCount = 0,
           initialCount = 0, inheritCount = 0, unsetCount = 0, revertCount = 0,
+           revertLayerCount = 0,
           matchingTokenStreamCount = 0, nonMatchingTokenStreamCount = 0;
  CSSPROPS_FOR_SHORTHAND_SUBPROPERTIES(p, aProperty,
                                       CSSEnabledState::eForAllContent) {
@@ -603,6 +604,8 @@ Declaration::GetPropertyValueInternal(
      ++unsetCount;
    } else if (val->GetUnit() == eCSSUnit_Revert) {
      ++revertCount;
+    } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
+      ++revertLayerCount;
    } else if (val->GetUnit() == eCSSUnit_TokenStream) {
      if (val->GetTokenStreamValue()->mShorthandPropertyID == aProperty) {
        tokenStream = val;
@@ -640,9 +643,19 @@ Declaration::GetPropertyValueInternal(
                                              nsCSSValue::eNormalized);
    return;
  }
+  if (revertLayerCount == totalCount) {
+    // Simplify serialization below by serializing revert-layer up-front.
+    nsCSSValue revertLayer;
+    revertLayer.SetRevertLayerValue();
+    revertLayer.AppendToString(eCSSProperty_UNKNOWN, aValue,
+                               nsCSSValue::eNormalized);
+    return;
+  }
  if (initialCount != 0 || inheritCount != 0 || unsetCount != 0 ||
-      revertCount != 0 || nonMatchingTokenStreamCount != 0) {
-    // Case (2): partially initial, inherit, unset, revert, or token stream.
+      revertCount != 0 || revertLayerCount != 0 ||
+      nonMatchingTokenStreamCount != 0) {
+    // Case (2): partially initial, inherit, unset, revert, revert-layer,
+    // or token stream.
    return;
  }
  if (tokenStream) {
@@ -1535,6 +1548,7 @@ Declaration::GetPropertyValueInternal(
          case eCSSUnit_Initial:
          case eCSSUnit_Unset:
          case eCSSUnit_Revert:
+          case eCSSUnit_RevertLayer:
            return true;
          case eCSSUnit_Enumerated:
            // return false if there is a fallback value or <overflow-position>
@@ -1749,6 +1763,10 @@ Declaration::AppendVariableAndValueToString(const nsAString& aName,
      aResult.AppendLiteral("revert");
      break;

+    case CSSVariableDeclarations::eRevertLayer:
+      aResult.AppendLiteral("revert-layer");
+      break;
+
    default:
      MOZ_ASSERT(false, "unexpected variable value type");
  }
@@ -1989,6 +2007,10 @@ Declaration::GetVariableValue(const nsAString& aName, nsAString& aValue) const
        aValue.AppendLiteral("revert");
        break;

+      case CSSVariableDeclarations::eRevertLayer:
+        aValue.AppendLiteral("revert-layer");
+        break;
+
      default:
        MOZ_ASSERT(false, "unexpected variable value type");
    }
@@ -2059,6 +2081,11 @@ Declaration::AddVariable(const nsAString& aName,
      variables->PutRevert(aName);
      break;

+    case CSSVariableDeclarations::eRevertLayer:
+      MOZ_ASSERT(aValue.IsEmpty());
+      variables->PutRevertLayer(aName);
+      break;
+
    default:
      MOZ_ASSERT(false, "unexpected aType value");
  }
@@ -489,7 +489,7 @@ public:
  void SetNoneValue();
  void SetIntValue(int32_t aInt, Unit aUnit);
  template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
  void SetIntValue(T aInt, Unit aUnit)
  {
    static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,
@@ -48,6 +48,102 @@ ShouldIgnoreColors(nsRuleData *aRuleData)
         !aRuleData->mPresContext->UseDocumentColors();
 }

+static const int32_t kLayerIndexMax = 0x000fffff;
+static const int32_t kCascadeRankStride = kLayerIndexMax + 1;
+
+static int32_t
+LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0);
+  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
+  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
+}
+
+static int32_t
+CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
+                      int32_t aLayerIndex)
+{
+  int32_t bucket = 0;
+  bool isLayeredOrigin = false;
+
+  switch (aLevel) {
+    case SheetType::Agent:
+      bucket = aIsImportant ? 14 : 0;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::User:
+      bucket = aIsImportant ? 13 : 1;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::PresHint:
+      bucket = 2;
+      break;
+    case SheetType::SVGAttrAnimation:
+      bucket = 3;
+      break;
+    case SheetType::Doc:
+      bucket = aIsImportant ? 10 : 4;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::ScopedDoc:
+      bucket = aIsImportant ? 9 : 5;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::StyleAttr:
+      bucket = aIsImportant ? 11 : 6;
+      break;
+    case SheetType::Override:
+      bucket = aIsImportant ? 12 : 7;
+      break;
+    case SheetType::Animation:
+      bucket = 8;
+      break;
+    case SheetType::Transition:
+      bucket = 15;
+      break;
+    default:
+      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
+      break;
+  }
+
+  return bucket * kCascadeRankStride +
+         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
+}
+
+static bool
+ShouldIgnoreForRevertLayer(const nsCSSValue& aTargetValue,
+                           const nsRuleData* aRuleData)
+{
+  SheetType sourceLevel = aTargetValue.GetRevertLayerOriginValue();
+  bool sourceImportant = aTargetValue.GetRevertLayerImportanceValue();
+  int32_t sourceLayerIndex = aTargetValue.GetRevertLayerLayerIndexValue();
+  MOZ_ASSERT(sourceLevel != SheetType::Unknown,
+             "revert-layer should have cascade metadata before mapping");
+
+  int32_t candidateRank =
+    CascadePrecedenceRank(aRuleData->mLevel, aRuleData->mIsImportantRule,
+                          aRuleData->mLayerIndex);
+  int32_t sourceRank =
+    CascadePrecedenceRank(sourceLevel, sourceImportant, sourceLayerIndex);
+
+  if (candidateRank >= sourceRank) {
+    return true;
+  }
+
+  if (!sourceImportant) {
+    return false;
+  }
+
+  if (sourceLevel == SheetType::StyleAttr) {
+    return aRuleData->mLevel == SheetType::StyleAttr ||
+           aRuleData->mLevel == SheetType::Animation;
+  }
+
+  int32_t normalBoundary =
+    CascadePrecedenceRank(sourceLevel, false, sourceLayerIndex);
+  return candidateRank >= normalBoundary;
+}
+
 /**
 * Tries to call |nsCSSValue::StartImageLoad()| on an image source.
 * Image sources are specified by |url()| or |-moz-image-rect()| function.
@@ -175,7 +271,8 @@ MapSinglePropertyInto(nsCSSPropertyID aTargetProp,
  // CSSVariableImageTable, to give them the appropriate lifetime.
  MOZ_ASSERT(aTargetValue->GetUnit() == eCSSUnit_TokenStream ||
             aTargetValue->GetUnit() == eCSSUnit_Null ||
-             aTargetValue->GetUnit() == eCSSUnit_Revert,
+             aTargetValue->GetUnit() == eCSSUnit_Revert ||
+             aTargetValue->GetUnit() == eCSSUnit_RevertLayer,
             "aTargetValue must only be a token stream (when re-parsing "
             "properties with variable references) or null");

@@ -365,6 +462,10 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
        if (aRuleData->mLevel >= target->GetCascadeOriginValue()) {
          continue;
        }
+      } else if (target->GetUnit() == eCSSUnit_RevertLayer) {
+        if (ShouldIgnoreForRevertLayer(*target, aRuleData)) {
+          continue;
+        }
      } else if (target->GetUnit() != eCSSUnit_Null) {
        continue;
      }
@@ -377,8 +478,18 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
      // the rule walking will have just updated aRuleData.
      if (val->GetUnit() == eCSSUnit_TokenStream) {
        val->GetTokenStreamValue()->mLevel = aRuleData->mLevel;
+        val->GetTokenStreamValue()->mIsImportant = aRuleData->mIsImportantRule;
+        val->GetTokenStreamValue()->mLayerIndex = aRuleData->mLayerIndex;
      } else if (val->GetUnit() == eCSSUnit_Revert) {
        aRuleData->mConditions.SetUncacheable();
+      } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
+        nsCSSValue revertLayer;
+        revertLayer.SetRevertLayerValue(aRuleData->mLevel,
+                                        aRuleData->mIsImportantRule,
+                                        aRuleData->mLayerIndex);
+        aRuleData->mConditions.SetUncacheable();
+        MapSinglePropertyInto(iProp, &revertLayer, target, aRuleData);
+        continue;
      }
      MapSinglePropertyInto(iProp, val, target, aRuleData);
    }
@@ -819,6 +930,17 @@ nsCSSExpandedDataBlock::MapRuleInfoInto(nsCSSPropertyID aPropID,
  MOZ_ASSERT(dest->GetUnit() == eCSSUnit_TokenStream &&
             dest->GetTokenStreamValue()->mPropertyID == aPropID);

+  if (src->GetUnit() == eCSSUnit_RevertLayer) {
+    nsCSSValueTokenStream* tokenStream = dest->GetTokenStreamValue();
+    nsCSSValue revertLayer;
+    revertLayer.SetRevertLayerValue(tokenStream->mLevel,
+                                    tokenStream->mIsImportant,
+                                    tokenStream->mLayerIndex);
+    aRuleData->mConditions.SetUncacheable();
+    MapSinglePropertyInto(physicalProp, &revertLayer, dest, aRuleData);
+    return;
+  }
+
  CSSVariableImageTable::ReplaceAll(aRuleData->mStyleContext, aPropID, [=] {
    MapSinglePropertyInto(physicalProp, src, dest, aRuleData);
  });
@@ -481,6 +481,7 @@ CSS_KEY(repeat-x, repeat_x)
 CSS_KEY(repeat-y, repeat_y)
 CSS_KEY(reverse, reverse)
 CSS_KEY(revert, revert)
+CSS_KEY(revert-layer, revert_layer)
 CSS_KEY(ridge, ridge)
 CSS_KEY(right, right)
 CSS_KEY(rl, rl)
@@ -814,4 +815,3 @@ CSS_KEY(text-before-edge, text_before_edge)
 CSS_KEY(use-script, use_script)
 CSS_KEY(-moz-crisp-edges, _moz_crisp_edges)
 CSS_KEY(space, space)
-
@@ -9126,6 +9126,10 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
          aValue.SetRevertValue(mLevel);
          return CSSParseResult::Ok;
        }
+        else if (eCSSKeyword_revert_layer == keyword) {
+          aValue.SetRevertLayerValue();
+          return CSSParseResult::Ok;
+        }
      }
      if ((aVariantMask & VARIANT_NONE) != 0) {
        if (eCSSKeyword_none == keyword) {
@@ -9330,7 +9334,8 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
         tk->mIdent.LowerCaseEqualsLiteral("initial") ||
         (tk->mIdent.LowerCaseEqualsLiteral("unset") &&
          nsLayoutUtils::UnsetValueEnabled()) ||
-         tk->mIdent.LowerCaseEqualsLiteral("revert")))) {
+         tk->mIdent.LowerCaseEqualsLiteral("revert") ||
+         tk->mIdent.LowerCaseEqualsLiteral("revert-layer")))) {
    aValue.SetStringValue(tk->mIdent, eCSSUnit_Ident);
    return CSSParseResult::Ok;
  }
@@ -9406,6 +9411,7 @@ CSSParserImpl::ParseCustomIdent(nsCSSValue& aValue,
      keyword == eCSSKeyword_initial ||
      keyword == eCSSKeyword_unset ||
      keyword == eCSSKeyword_revert ||
+      keyword == eCSSKeyword_revert_layer ||
      keyword == eCSSKeyword_default ||
      (aPropertyKTable &&
        nsCSSProps::FindIndexOfKeyword(keyword, aPropertyKTable) >= 0)) {
@@ -12595,6 +12601,12 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
        }
        found = ((1 << aNumIDs) - 1);
      }
+      else if (eCSSUnit_RevertLayer == aValues[0].GetUnit()) { // one revert-layer, all revert-layer
+        for (loop = 1; loop < aNumIDs; loop++) {
+          aValues[loop].SetRevertLayerValue();
+        }
+        found = ((1 << aNumIDs) - 1);
+      }
    }
    else {  // more than one value, verify no inherits, initials, unsets, or reverts
      for (loop = 0; loop < aNumIDs; loop++) {
@@ -12610,7 +12622,8 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
          found = -1;
          break;
        }
-        else if (eCSSUnit_Revert == aValues[loop].GetUnit()) {
+        else if (eCSSUnit_Revert == aValues[loop].GetUnit() ||
+                 eCSSUnit_RevertLayer == aValues[loop].GetUnit()) {
          found = -1;
          break;
        }
@@ -12658,7 +12671,8 @@ CSSParserImpl::ParseBoxProperties(const nsCSSPropertyID aPropIDs[])
      if (eCSSUnit_Inherit == unit ||
          eCSSUnit_Initial == unit ||
          eCSSUnit_Unset == unit ||
-          eCSSUnit_Revert == unit) {
+          eCSSUnit_Revert == unit ||
+          eCSSUnit_RevertLayer == unit) {
        return false;
      }
    }
@@ -12766,7 +12780,8 @@ CSSParserImpl::ParseBoxCornerRadius(nsCSSPropertyID aPropID)
  if (dimenX.GetUnit() != eCSSUnit_Inherit &&
      dimenX.GetUnit() != eCSSUnit_Initial &&
      dimenX.GetUnit() != eCSSUnit_Unset &&
-      dimenX.GetUnit() != eCSSUnit_Revert) {
+      dimenX.GetUnit() != eCSSUnit_Revert &&
+      dimenX.GetUnit() != eCSSUnit_RevertLayer) {
    if (ParseNonNegativeVariant(dimenY, VARIANT_LP | VARIANT_CALC, nullptr) ==
        CSSParseResult::Error) {
      return false;
@@ -12831,7 +12846,8 @@ CSSParserImpl::ParseBoxCornerRadiiInternals(nsCSSValue array[])
    if (eCSSUnit_Inherit == unit ||
        eCSSUnit_Initial == unit ||
        eCSSUnit_Unset == unit ||
-        eCSSUnit_Revert == unit)
+        eCSSUnit_Revert == unit ||
+        eCSSUnit_RevertLayer == unit)
      return false;
  }

@@ -13642,6 +13658,7 @@ CSSParserImpl::ParseFontDescriptorValue(nsCSSFontDesc aDescID,
            aValue.GetUnit() != eCSSUnit_Initial &&
            aValue.GetUnit() != eCSSUnit_Unset &&
            aValue.GetUnit() != eCSSUnit_Revert &&
+            aValue.GetUnit() != eCSSUnit_RevertLayer &&
            (aValue.GetUnit() != eCSSUnit_Enumerated ||
             (aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_BOLDER &&
              aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_LIGHTER)));
@@ -13905,7 +13922,8 @@ CSSParserImpl::ParseImageLayersItem(
      if (keyword == eCSSKeyword_inherit ||
          keyword == eCSSKeyword_initial ||
          keyword == eCSSKeyword_unset ||
-          keyword == eCSSKeyword_revert) {
+          keyword == eCSSKeyword_revert ||
+          keyword == eCSSKeyword_revert_layer) {
        return false;
      } else if (keyword == eCSSKeyword_none) {
        if (haveImage)
@@ -14262,7 +14280,8 @@ bool CSSParserImpl::ParseBoxPositionValues(nsCSSValuePair &aOut,
    if (eCSSUnit_Inherit == xValue.GetUnit() ||
        eCSSUnit_Initial == xValue.GetUnit() ||
        eCSSUnit_Unset == xValue.GetUnit() ||
-        eCSSUnit_Revert == xValue.GetUnit()) {  // both are inherit, initial, unset, or revert
+        eCSSUnit_Revert == xValue.GetUnit() ||
+        eCSSUnit_RevertLayer == xValue.GetUnit()) {
      yValue = xValue;
      return true;
    }
@@ -15094,6 +15113,7 @@ CSSParserImpl::ParseBorderSide(const nsCSSPropertyID aPropIDs[],
    case eCSSUnit_Initial:
    case eCSSUnit_Unset:
    case eCSSUnit_Revert:
+    case eCSSUnit_RevertLayer:
      extraValue = values[0];
      // Set value of border-image properties to initial/inherit/unset/revert
      AppendValue(eCSSProperty_border_image_source, extraValue);
@@ -15860,7 +15880,8 @@ CSSParserImpl::ParseFont()
    if (eCSSUnit_Inherit == family.GetUnit() ||
        eCSSUnit_Initial == family.GetUnit() ||
        eCSSUnit_Unset == family.GetUnit() ||
-        eCSSUnit_Revert == family.GetUnit()) {
+        eCSSUnit_Revert == family.GetUnit() ||
+        eCSSUnit_RevertLayer == family.GetUnit()) {
      AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
      AppendValue(eCSSProperty_font_family, family);
      AppendValue(eCSSProperty_font_style, family);
@@ -15929,7 +15950,8 @@ CSSParserImpl::ParseFont()
      eCSSUnit_Inherit == values[kFontStyleIndex].GetUnit() ||
      eCSSUnit_Initial == values[kFontStyleIndex].GetUnit() ||
      eCSSUnit_Unset == values[kFontStyleIndex].GetUnit() ||
-      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ) { // illegal data
+      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ||
+      eCSSUnit_RevertLayer == values[kFontStyleIndex].GetUnit() ) { // illegal data
    return false;
  }
  if ((found & (1 << kFontStyleIndex)) == 0) {
@@ -15988,7 +16010,8 @@ CSSParserImpl::ParseFont()
    if (eCSSUnit_Inherit != family.GetUnit() &&
        eCSSUnit_Initial != family.GetUnit() &&
        eCSSUnit_Unset != family.GetUnit() &&
-        eCSSUnit_Revert != family.GetUnit()) {
+        eCSSUnit_Revert != family.GetUnit() &&
+        eCSSUnit_RevertLayer != family.GetUnit()) {
      AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
      AppendValue(eCSSProperty_font_family, family);
      AppendValue(eCSSProperty_font_style, values[kFontStyleIndex]);
@@ -16034,7 +16057,8 @@ CSSParserImpl::ParseFontSynthesis(nsCSSValue& aValue)
      eCSSUnit_Initial == aValue.GetUnit() ||
      eCSSUnit_Inherit == aValue.GetUnit() ||
      eCSSUnit_Unset == aValue.GetUnit() ||
-      eCSSUnit_Revert == aValue.GetUnit() )
+      eCSSUnit_Revert == aValue.GetUnit() ||
+      eCSSUnit_RevertLayer == aValue.GetUnit() )
  {
    return true;
  }
@@ -16657,6 +16681,9 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
      case eCSSKeyword_revert:
        aValue.SetRevertValue(mLevel);
        return true;
+      case eCSSKeyword_revert_layer:
+        aValue.SetRevertLayerValue();
+        return true;
      case eCSSKeyword__moz_use_system_font:
        if (!IsParsingCompoundProperty()) {
          aValue.SetSystemFontValue();
@@ -16691,6 +16718,7 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
        case eCSSKeyword_initial:
        case eCSSKeyword_default:
        case eCSSKeyword_revert:
+        case eCSSKeyword_revert_layer:
        case eCSSKeyword__moz_use_system_font:
          return false;
        case eCSSKeyword_unset:
@@ -18340,7 +18368,8 @@ bool CSSParserImpl::ParseTransformOrigin(bool aPerspective)
  if (position.mXValue.GetUnit() == eCSSUnit_Inherit ||
      position.mXValue.GetUnit() == eCSSUnit_Initial ||
      position.mXValue.GetUnit() == eCSSUnit_Unset ||
-      position.mXValue.GetUnit() == eCSSUnit_Revert) {
+      position.mXValue.GetUnit() == eCSSUnit_Revert ||
+      position.mXValue.GetUnit() == eCSSUnit_RevertLayer) {
    MOZ_ASSERT(position.mXValue == position.mYValue,
               "inherit/initial/unset/revert only half?");
    AppendValue(prop, position.mXValue);
@@ -18564,14 +18593,15 @@ CSSParserImpl::ParseTransitionProperty()
      }
      if (cur->mValue.GetUnit() == eCSSUnit_Ident) {
        nsDependentString str(cur->mValue.GetStringBufferValue());
-        // Exclude 'none', 'inherit', 'initial', 'unset', and 'revert'
-        // according to the same rules as for 'counter-reset' in CSS 2.1.
+        // Exclude CSS-wide keywords and 'none' according to the same rules
+        // as for 'counter-reset' in CSS 2.1.
        if (str.LowerCaseEqualsLiteral("none") ||
            str.LowerCaseEqualsLiteral("inherit") ||
            str.LowerCaseEqualsLiteral("initial") ||
            (str.LowerCaseEqualsLiteral("unset") &&
             nsLayoutUtils::UnsetValueEnabled()) ||
-            str.LowerCaseEqualsLiteral("revert")) {
+            str.LowerCaseEqualsLiteral("revert") ||
+            str.LowerCaseEqualsLiteral("revert-layer")) {
          return false;
        }
      }
@@ -19484,8 +19514,7 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
    }
  }

-  // Look for 'initial', 'inherit', 'unset', or 'revert' as the first
-  // non-white space token.
+  // Look for CSS-wide keywords as the first non-white space token.
  CSSVariableDeclarations::Type type = CSSVariableDeclarations::eTokenStream;
  if (mToken.mType == eCSSToken_Ident) {
    if (mToken.mIdent.LowerCaseEqualsLiteral("initial")) {
@@ -19496,6 +19525,8 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
      type = CSSVariableDeclarations::eUnset;
    } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert")) {
      type = CSSVariableDeclarations::eRevert;
+    } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert-layer")) {
+      type = CSSVariableDeclarations::eRevertLayer;
    }
  }

@@ -44,7 +44,7 @@
 // 'inherit' and 'initial'
 #define VARIANT_OPACITY         0x008000  // Take floats and percents as input, output float.
 #define VARIANT_AUTO            0x010000  // A
-#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert
+#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert, eCSSUnit_RevertLayer
 #define VARIANT_NONE            0x040000  // O
 #define VARIANT_NORMAL          0x080000  // M
 #define VARIANT_SYSFONT         0x100000  // eCSSUnit_System_Font
@@ -364,7 +364,7 @@ public:
    }

    template<typename T,
-             typename = typename std::enable_if<std::is_enum<T>::value>::type>
+             typename = typename std::enable_if_t<std::is_enum_v<T>>>
    KTableEntry(nsCSSKeyword aKeyword, T aValue)
      : mKeyword(aKeyword)
      , mValue(static_cast<int16_t>(aValue))
@@ -451,7 +451,7 @@ public:
  static nsCSSKeyword ValueToKeywordEnum(int32_t aValue,
                                         const KTableEntry aTable[]);
  template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
  static nsCSSKeyword ValueToKeywordEnum(T aValue,
                                         const KTableEntry aTable[])
  {
@@ -463,7 +463,7 @@ public:
  static const nsAFlatCString& ValueToKeyword(int32_t aValue,
                                              const KTableEntry aTable[]);
  template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
  static const nsAFlatCString& ValueToKeyword(T aValue,
                                              const KTableEntry aTable[])
  {
@@ -192,6 +192,9 @@ nsCSSValue::nsCSSValue(const nsCSSValue& aCopy)
  else if (eCSSUnit_Revert == mUnit) {
    mValue.mCascadeOrigin = aCopy.mValue.mCascadeOrigin;
  }
+  else if (eCSSUnit_RevertLayer == mUnit) {
+    mValue.mInt = aCopy.mValue.mInt;
+  }
  else if (UnitHasArrayValue()) {
    mValue.mArray = aCopy.mValue.mArray;
    mValue.mArray->AddRef();
@@ -316,6 +319,9 @@ bool nsCSSValue::operator==(const nsCSSValue& aOther) const
    else if (eCSSUnit_Revert == mUnit) {
      return mValue.mCascadeOrigin == aOther.mValue.mCascadeOrigin;
    }
+    else if (eCSSUnit_RevertLayer == mUnit) {
+      return mValue.mInt == aOther.mValue.mInt;
+    }
    else if (UnitHasArrayValue()) {
      return *mValue.mArray == *aOther.mValue.mArray;
    }
@@ -593,6 +599,31 @@ nsCSSValue::SetCascadeOriginValue(mozilla::SheetType aValue, nsCSSUnit aUnit)
  mValue.mCascadeOrigin = aValue;
 }

+static const int32_t kRevertLayerMask = 0x000fffff;
+static const int32_t kRevertLayerImportant = 0x00100000;
+static const int32_t kRevertLayerOriginShift = 21;
+
+mozilla::SheetType
+nsCSSValue::GetRevertLayerOriginValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return mozilla::SheetType(uint32_t(mValue.mInt) >> kRevertLayerOriginShift);
+}
+
+bool
+nsCSSValue::GetRevertLayerImportanceValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return (mValue.mInt & kRevertLayerImportant) != 0;
+}
+
+int32_t
+nsCSSValue::GetRevertLayerLayerIndexValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return mValue.mInt & kRevertLayerMask;
+}
+
 void nsCSSValue::SetArrayValue(nsCSSValue::Array* aValue, nsCSSUnit aUnit)
 {
  Reset();
@@ -663,7 +694,9 @@ void nsCSSValue::SetPairValue(const nsCSSValuePair* aValue)
             aValue->mXValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mYValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mYValue.GetUnit() != eCSSUnit_Revert,
+             aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
+             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer,
             "missing or inappropriate pair value");
  Reset();
  mUnit = eCSSUnit_Pair;
@@ -683,7 +716,9 @@ void nsCSSValue::SetPairValue(const nsCSSValue& xValue,
             xValue.GetUnit() != eCSSUnit_Unset &&
             yValue.GetUnit() != eCSSUnit_Unset &&
             xValue.GetUnit() != eCSSUnit_Revert &&
-             yValue.GetUnit() != eCSSUnit_Revert,
+             yValue.GetUnit() != eCSSUnit_Revert &&
+             xValue.GetUnit() != eCSSUnit_RevertLayer &&
+             yValue.GetUnit() != eCSSUnit_RevertLayer,
             "inappropriate pair value");
  Reset();
  mUnit = eCSSUnit_Pair;
@@ -709,7 +744,10 @@ void nsCSSValue::SetTripletValue(const nsCSSValueTriplet* aValue)
             aValue->mZValue.GetUnit() != eCSSUnit_Unset &&
             aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
             aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mZValue.GetUnit() != eCSSUnit_Revert,
+             aValue->mZValue.GetUnit() != eCSSUnit_Revert &&
+             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mZValue.GetUnit() != eCSSUnit_RevertLayer,
             "missing or inappropriate triplet value");
  Reset();
  mUnit = eCSSUnit_Triplet;
@@ -735,7 +773,10 @@ void nsCSSValue::SetTripletValue(const nsCSSValue& xValue,
             zValue.GetUnit() != eCSSUnit_Unset &&
             xValue.GetUnit() != eCSSUnit_Revert &&
             yValue.GetUnit() != eCSSUnit_Revert &&
-             zValue.GetUnit() != eCSSUnit_Revert,
+             zValue.GetUnit() != eCSSUnit_Revert &&
+             xValue.GetUnit() != eCSSUnit_RevertLayer &&
+             yValue.GetUnit() != eCSSUnit_RevertLayer &&
+             zValue.GetUnit() != eCSSUnit_RevertLayer,
             "inappropriate triplet value");
  Reset();
  mUnit = eCSSUnit_Triplet;
@@ -851,6 +892,26 @@ nsCSSValue::SetRevertValue(mozilla::SheetType aValue)
  SetCascadeOriginValue(aValue, eCSSUnit_Revert);
 }

+void
+nsCSSValue::SetRevertLayerValue()
+{
+  SetRevertLayerValue(mozilla::SheetType::Unknown, false, 0);
+}
+
+void
+nsCSSValue::SetRevertLayerValue(mozilla::SheetType aLevel,
+                                bool aIsImportant,
+                                int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask,
+             "cascade layer index is out of range");
+  Reset();
+  mUnit = eCSSUnit_RevertLayer;
+  mValue.mInt = (uint32_t(aLevel) << kRevertLayerOriginShift) |
+                (aIsImportant ? kRevertLayerImportant : 0) |
+                (aLayerIndex & kRevertLayerMask);
+}
+
 void nsCSSValue::SetNoneValue()
 {
  Reset();
@@ -2234,6 +2295,7 @@ nsCSSValue::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
    case eCSSUnit_Initial:      aResult.AppendLiteral("initial");  break;
    case eCSSUnit_Unset:        aResult.AppendLiteral("unset");    break;
    case eCSSUnit_Revert:       aResult.AppendLiteral("revert");   break;
+    case eCSSUnit_RevertLayer:  aResult.AppendLiteral("revert-layer"); break;
    case eCSSUnit_None:         aResult.AppendLiteral("none");     break;
    case eCSSUnit_Normal:       aResult.AppendLiteral("normal");   break;
    case eCSSUnit_System_Font:  aResult.AppendLiteral("-moz-use-system-font"); break;
@@ -2511,6 +2573,7 @@ nsCSSValue::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const

    // Cascade Origin: nothing extra to measure.
    case eCSSUnit_Revert:
+    case eCSSUnit_RevertLayer:
      break;

    // Float: nothing extra to measure.
@@ -2836,7 +2899,8 @@ nsCSSRect::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
             mTop.GetUnit() != eCSSUnit_Inherit &&
             mTop.GetUnit() != eCSSUnit_Initial &&
             mTop.GetUnit() != eCSSUnit_Unset &&
-             mTop.GetUnit() != eCSSUnit_Revert,
+             mTop.GetUnit() != eCSSUnit_Revert &&
+             mTop.GetUnit() != eCSSUnit_RevertLayer,
             "parser should have used a bare value");

  if (eCSSProperty_border_image_slice == aProperty ||
@@ -3007,6 +3071,7 @@ nsCSSValuePairList::AppendToString(nsCSSPropertyID aProperty,
        item->mXValue.GetUnit() != eCSSUnit_Initial &&
        item->mXValue.GetUnit() != eCSSUnit_Unset &&
        item->mXValue.GetUnit() != eCSSUnit_Revert &&
+        item->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
        item->mYValue.GetUnit() != eCSSUnit_Null) {
      aResult.Append(char16_t(' '));
      item->mYValue.AppendToString(aProperty, aResult, aSerialization);
@@ -3443,6 +3508,8 @@ nsCSSValueTokenStream::nsCSSValueTokenStream()
  : mPropertyID(eCSSProperty_UNKNOWN)
  , mShorthandPropertyID(eCSSProperty_UNKNOWN)
  , mLevel(SheetType::Count)
+  , mIsImportant(false)
+  , mLayerIndex(0)
 {
  MOZ_COUNT_CTOR(nsCSSValueTokenStream);
 }
@@ -490,6 +490,7 @@ enum nsCSSUnit {
  eCSSUnit_GridTemplateAreas   = 44,   // (GridTemplateAreasValue*)
                                       // for grid-template-areas
  eCSSUnit_Revert       = 45,     // (SheetType) value is the current cascade origin
+  eCSSUnit_RevertLayer  = 46,     // (int32_t) packed cascade layer rollback data

  eCSSUnit_Pair         = 50,     // (nsCSSValuePair*) pair of values
  eCSSUnit_Triplet      = 51,     // (nsCSSValueTriplet*) triplet of values
@@ -939,6 +940,9 @@ public:
    MOZ_ASSERT(mUnit == eCSSUnit_Revert, "not a cascade origin value");
    return mValue.mCascadeOrigin;
  }
+  mozilla::SheetType GetRevertLayerOriginValue() const;
+  bool GetRevertLayerImportanceValue() const;
+  int32_t GetRevertLayerLayerIndexValue() const;

  void Reset()  // sets to null
  {
@@ -951,7 +955,7 @@ private:
 public:
  void SetIntValue(int32_t aValue, nsCSSUnit aUnit);
  template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
  void SetIntValue(T aValue, nsCSSUnit aUnit)
  {
    static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,
@@ -994,6 +998,10 @@ public:
  void SetInitialValue();
  void SetUnsetValue();
  void SetRevertValue(mozilla::SheetType aValue);
+  void SetRevertLayerValue();
+  void SetRevertLayerValue(mozilla::SheetType aLevel,
+                           bool aIsImportant,
+                           int32_t aLayerIndex);
  void SetNoneValue();
  void SetAllValue();
  void SetNormalValue();
@@ -1837,6 +1845,8 @@ public:
           mShorthandPropertyID == aOther.mShorthandPropertyID &&
           mTokenStream.Equals(aOther.mTokenStream) &&
           mLevel == aOther.mLevel &&
+           mIsImportant == aOther.mIsImportant &&
+           mLayerIndex == aOther.mLayerIndex &&
           (mBaseURI == aOther.mBaseURI ||
            (mBaseURI && aOther.mBaseURI &&
             NS_SUCCEEDED(mBaseURI->Equals(aOther.mBaseURI, &eq)) &&
@@ -1886,6 +1896,8 @@ public:
  uint32_t mLineNumber;
  uint32_t mLineOffset;
  mozilla::SheetType mLevel;
+  bool mIsImportant;
+  int32_t mLayerIndex;

 private:
  nsCSSValueTokenStream(const nsCSSValueTokenStream& aOther) = delete;
@@ -28,6 +28,9 @@ nsRuleData::GetPoisonOffset()
 nsRuleData::nsRuleData(uint32_t aSIDs, nsCSSValue* aValueStorage,
                       nsPresContext* aContext, nsStyleContext* aStyleContext)
  : mSIDs(aSIDs),
+    mIsImportantRule(false),
+    mLevel(mozilla::SheetType::Unknown),
+    mLayerIndex(0),
    mPresContext(aContext),
    mStyleContext(aStyleContext),
    mValueStorage(aValueStorage)
@@ -31,6 +31,7 @@ struct nsRuleData
  mozilla::RuleNodeCacheConditions mConditions;
  bool mIsImportantRule;
  mozilla::SheetType mLevel;
+  int32_t mLayerIndex;
  nsPresContext* const mPresContext;
  nsStyleContext* const mStyleContext;

@@ -188,9 +188,10 @@ nsRuleNode::ChildrenHashHashKey(const void *aKey)
 {
  const nsRuleNode::Key *key =
    static_cast<const nsRuleNode::Key*>(aKey);
-  // Disagreement on importance and level for the same rule is extremely
-  // rare, so hash just on the rule.
-  return PLDHashTable::HashVoidPtrKeyStub(key->mRule);
+  return PLDHashTable::HashVoidPtrKeyStub(key->mRule) ^
+         (uint32_t(key->mLayerIndex) << 4) ^
+         (uint32_t(key->mLevel) << 1) ^
+         (key->mIsImportantRule ? 1 : 0);
 }

 /* static */ bool
@@ -2270,18 +2271,19 @@ already_AddRefed<nsRuleNode>
 nsRuleNode::CreateRootNode(nsPresContext* aPresContext)
 {
  return do_AddRef(new (aPresContext)
-    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false));
+    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false, 0));
 }

 nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,
                       nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportant)
+                       bool aIsImportant, int32_t aLayerIndex)
  : mPresContext(aContext),
    mParent(aParent),
    mRule(aRule),
    mNextSibling(nullptr),
    mDependentBits((uint32_t(aLevel) << NS_RULE_NODE_LEVEL_SHIFT) |
                   (aIsImportant ? NS_RULE_NODE_IS_IMPORTANT : 0)),
+    mLayerIndex(aLayerIndex),
    mNoneBits(aParent ? aParent->mNoneBits & NS_RULE_NODE_HAS_ANIMATION_DATA :
                        0),
    mRefCnt(0)
@@ -2295,6 +2297,8 @@ nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,

  NS_ASSERTION(IsRoot() || GetLevel() == aLevel, "not enough bits");
  NS_ASSERTION(IsRoot() || IsImportantRule() == aIsImportant, "yikes");
+  NS_ASSERTION(IsRoot() || GetLayerIndex() == aLayerIndex,
+               "bad layer index");
  aContext->StyleSet()->RuleNodeUnused(this, /* aMayGC = */ false);

  // nsStyleSet::GetContext depends on there being only one animation
@@ -2319,7 +2323,7 @@ nsRuleNode::~nsRuleNode()

 nsRuleNode*
 nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportantRule)
+                       bool aIsImportantRule, int32_t aLayerIndex)
 {
 #ifdef DEBUG
  {
@@ -2330,7 +2334,7 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
 #endif

  nsRuleNode* next = nullptr;
-  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule);
+  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule, aLayerIndex);

  if (HaveChildren() && !ChildrenAreHashed()) {
    int32_t numKids = 0;
@@ -2357,12 +2361,14 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
      next = entry->mRuleNode;
    } else {
      next = entry->mRuleNode = new (mPresContext)
-        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
+        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
+                   aLayerIndex);
    }
  } else if (!next) {
    // Create the new entry in our list.
    next = new (mPresContext)
-      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
+      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
+                 aLayerIndex);
    next->mNextSibling = ChildrenList();
    SetChildrenList(next);
  }
@@ -2545,7 +2551,8 @@ ExamineCSSValue(const nsCSSValue& aValue,
      ++aInheritedCount;
    } else if (aValue.GetUnit() == eCSSUnit_Unset) {
      ++aUnsetCount;
-    } else if (aValue.GetUnit() == eCSSUnit_Revert) {
+    } else if (aValue.GetUnit() == eCSSUnit_Revert ||
+               aValue.GetUnit() == eCSSUnit_RevertLayer) {
      ++aRevertCount;
    }
  }
@@ -3021,7 +3028,11 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
               "Token stream should have a defined level");

    AutoRestore<SheetType> saveLevel(aRuleData->mLevel);
+    AutoRestore<bool> saveImportant(aRuleData->mIsImportantRule);
+    AutoRestore<int32_t> saveLayerIndex(aRuleData->mLayerIndex);
    aRuleData->mLevel = tokenStream->mLevel;
+    aRuleData->mIsImportantRule = tokenStream->mIsImportant;
+    aRuleData->mLayerIndex = tokenStream->mLayerIndex;

    // Note that ParsePropertyWithVariableReferences relies on the fact
    // that the nsCSSValue in aRuleData for the property we are re-parsing
@@ -3045,6 +3056,114 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
  return anyTokenStreams;
 }

+static nsCSSPropertyID
+PropertyAtIndexInStruct(nsStyleStructID aSID, size_t aIndex)
+{
+  for (int32_t prop = 0; prop < eCSSProperty_COUNT_no_shorthands; prop++) {
+    nsCSSPropertyID property = nsCSSPropertyID(prop);
+    if (nsCSSProps::kSIDTable[property] == aSID &&
+        nsCSSProps::PropertyIndexInStruct(property) == aIndex) {
+      return property;
+    }
+  }
+  MOZ_ASSERT_UNREACHABLE("no property for style struct index");
+  return eCSSProperty_UNKNOWN;
+}
+
+/* static */ bool
+nsRuleNode::ResolveRevertLayerValues(const nsStyleStructID aSID,
+                                     nsRuleData* aRuleData,
+                                     nsStyleContext* aContext,
+                                     nsRuleNode* aStartRuleNode)
+{
+  MOZ_ASSERT(aSID != eStyleStruct_Variables);
+
+  size_t nprops = nsCSSProps::PropertyCountInStruct(aSID);
+  bool resolvedAny = false;
+
+  for (size_t pass = 0; pass <= nprops; pass++) {
+    bool resolvedThisPass = false;
+    bool needsVariableResolution = false;
+
+    for (size_t index = 0; index < nprops; index++) {
+      nsCSSValue* target = aRuleData->mValueStorage + index;
+      if (target->GetUnit() != eCSSUnit_RevertLayer) {
+        continue;
+      }
+
+      nsCSSPropertyID property = PropertyAtIndexInStruct(aSID, index);
+      if (property == eCSSProperty_UNKNOWN) {
+        continue;
+      }
+
+      AutoTArray<nsCSSValue, 64> tempValues;
+      tempValues.SetLength(nprops);
+      for (size_t i = 0; i < nprops; i++) {
+        tempValues[i].SetDummyValue();
+      }
+      tempValues[index] = *target;
+
+      nsRuleData tempRuleData(nsCachedStyleData::GetBitForSID(aSID),
+                              tempValues.Elements(),
+                              aStartRuleNode->mPresContext, aContext);
+      tempRuleData.mValueOffsets[aSID] = 0;
+
+      uint32_t bit = nsCachedStyleData::GetBitForSID(aSID);
+      for (nsRuleNode* ruleNode = aStartRuleNode; ruleNode;
+           ruleNode = ruleNode->GetParent()) {
+        if (ruleNode->mNoneBits & bit) {
+          break;
+        }
+
+        nsIStyleRule* rule = ruleNode->mRule;
+        if (rule) {
+          tempRuleData.mLevel = ruleNode->GetLevel();
+          tempRuleData.mIsImportantRule = ruleNode->IsImportantRule();
+          tempRuleData.mLayerIndex = ruleNode->GetLayerIndex();
+          rule->MapRuleInfoInto(&tempRuleData);
+        }
+
+        if (tempValues[index].GetUnit() != eCSSUnit_RevertLayer) {
+          break;
+        }
+      }
+
+      if (tempValues[index].GetUnit() == eCSSUnit_RevertLayer) {
+        tempValues[index].SetRevertValue(
+          target->GetRevertLayerOriginValue());
+      } else if (tempValues[index].GetUnit() == eCSSUnit_TokenStream) {
+        needsVariableResolution = true;
+      }
+
+      *target = tempValues[index];
+      aRuleData->mConditions.SetUncacheable();
+      resolvedThisPass = true;
+      resolvedAny = true;
+    }
+
+    if (!resolvedThisPass) {
+      break;
+    }
+
+    if (needsVariableResolution &&
+        ResolveVariableReferences(aSID, aRuleData, aContext)) {
+      resolvedAny = true;
+      continue;
+    }
+  }
+
+  for (size_t index = 0; index < nprops; index++) {
+    nsCSSValue* target = aRuleData->mValueStorage + index;
+    if (target->GetUnit() == eCSSUnit_RevertLayer) {
+      target->SetRevertValue(target->GetRevertLayerOriginValue());
+      aRuleData->mConditions.SetUncacheable();
+      resolvedAny = true;
+    }
+  }
+
+  return resolvedAny;
+}
+
 const void*
 nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
                         nsStyleContext* aContext)
@@ -3118,6 +3237,7 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
    if (rule) {
      ruleData.mLevel = ruleNode->GetLevel();
      ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+      ruleData.mLayerIndex = ruleNode->GetLayerIndex();
      rule->MapRuleInfoInto(&ruleData);
    }

@@ -3154,6 +3274,11 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
    recomputeDetail = ResolveVariableReferences(aSID, &ruleData, aContext);
  }

+  if (aSID != eStyleStruct_Variables &&
+      ResolveRevertLayerValues(aSID, &ruleData, aContext, this)) {
+    recomputeDetail = true;
+  }
+
  // If needed, unset the properties that don't have a flag that allows
  // them to be set for this style context.  (For example, only some
  // properties apply to :first-line and :first-letter.)
@@ -4889,6 +5014,7 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
      if (rule) {
        ruleData.mLevel = ruleNode->GetLevel();
        ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+        ruleData.mLayerIndex = ruleNode->GetLayerIndex();
        rule->MapRuleInfoInto(&ruleData);
      }
    }
@@ -4902,6 +5028,8 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
    }

    ResolveVariableReferences(eStyleStruct_Font, &ruleData, aContext);
+    ResolveRevertLayerValues(eStyleStruct_Font, &ruleData, aContext,
+                             context->RuleNode());

    RuleNodeCacheConditions dummy;
    nsRuleNode::SetFont(aPresContext, context,
@@ -11081,6 +11209,8 @@ nsRuleNode::ComputeVariablesData(void* aStartStruct,
  CSSVariableResolver resolver(&variables->mVariables);
  resolver.Resolve(&parentVariables->mVariables,
                   aRuleData->mVariables);
+  aRuleData->mVariables->ResolveRevertLayerFallbacks(&parentVariables->mVariables,
+                                                     &variables->mVariables);
  conditions.SetUncacheable();

  COMPUTE_END_INHERITED(Variables, variables)
@@ -11473,6 +11603,7 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
      if (rule) {
        ruleData.mLevel = ruleNode->GetLevel();
        ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+        ruleData.mLayerIndex = ruleNode->GetLayerIndex();

        rule->MapRuleInfoInto(&ruleData);

@@ -11485,11 +11616,13 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
            nsCSSUnit unit = values[i]->GetUnit();
            if (unit != eCSSUnit_Null &&
                unit != eCSSUnit_Revert &&
+                unit != eCSSUnit_RevertLayer &&
                unit != eCSSUnit_Dummy &&
                unit != eCSSUnit_DummyInherit) {
              if (unit == eCSSUnit_Inherit ||
                  (i >= inheritedOffset && unit == eCSSUnit_Unset) ||
-                  (i >= inheritedOffset && unit == eCSSUnit_Revert)) {
+                  (i >= inheritedOffset && unit == eCSSUnit_Revert) ||
+                  (i >= inheritedOffset && unit == eCSSUnit_RevertLayer)) {
                haveExplicitUAInherit = true;
                values[i]->SetDummyInheritValue();
              } else {
@@ -11504,7 +11637,8 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
            if (values[i]->GetUnit() != eCSSUnit_Null &&
                values[i]->GetUnit() != eCSSUnit_Dummy && // see above
                values[i]->GetUnit() != eCSSUnit_DummyInherit &&
-                values[i]->GetUnit() != eCSSUnit_Revert) {
+                values[i]->GetUnit() != eCSSUnit_Revert &&
+                values[i]->GetUnit() != eCSSUnit_RevertLayer) {
              // If author colors are not allowed, only claim to have
              // author-specified rules if we're looking at a non-color
              // property or if we're looking at the background color and it's
@@ -11596,6 +11730,7 @@ nsRuleNode::ComputePropertiesOverridingAnimation(
    if (rule) {
      ruleData.mLevel = ruleNode->GetLevel();
      ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+      ruleData.mLayerIndex = ruleNode->GetLayerIndex();

      // Transitions are the only non-!important level overriding
      // animations in the cascade ordering.  They also don't actually
Author	SHA1	Message	Date
Moonchild	65d7d93760	Issue #1803 - Convert std::*<T>::value/::type to _v and _t suffixes. This excludes uses in third-party libs in our tree.	2026-07-15 11:20:06 +02:00
Moonchild	dfd0ea4e8a	Merge pull request 'implement URL.parse()' (#3141 ) from Basilisk-Dev/UXP-contrib:urlparse into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3141	2026-07-14 21:05:40 +00:00
Basilisk-Dev	12a49709cb	Issue #3140 - implement URL.parse()	2026-07-14 16:07:45 -04:00
Moonchild	2a70c8a6f0	Merge pull request 'Implement CSS4 revert-layer keyword' (#3139 ) from Basilisk-Dev/UXP-contrib:revert-layer into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3139	2026-07-13 12:44:06 +00:00
Moonchild	1f639d78ca	Merge pull request 'Allow Skia on Mac OS X 10.5 Leopard / big endian PPC' (#3138 ) from Jazzzny/UXP:skia-leopard-ppc into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3138	2026-07-13 12:43:15 +00:00
Basilisk-Dev	65e8245153	Issue #2829 - Regenerate devtools CSS database for revert-layer	2026-07-11 10:41:52 -04:00
Basilisk-Dev	bce5dbad0b	Issue #2829 - Use layer index naming for revert-layer metadata	2026-07-11 10:41:46 -04:00
Basilisk-Dev	0b25b5f8db	Issue #2829 - Handle revert-layer variable fallbacks	2026-07-10 09:59:20 -04:00
Basilisk-Dev	7345874098	Issue #2829 - Implement CSS revert-layer cascade rollback	2026-07-10 09:59:14 -04:00
Basilisk-Dev	edb82fd1c9	Issue #2829 - Support revert-layer in CSS-wide parsing	2026-07-10 09:59:03 -04:00
Jazzzny	35ebdcac66	Fix build issues in Skia code	2026-07-09 12:32:44 -04:00
Jazzzny	a095661e86	Use Skia macros where appropriate	2026-07-08 13:43:07 -04:00
Jazzzny	205a0d66bb	Add support for big endian in Skia	2026-07-08 04:38:00 -04:00
Jazzzny	54945a0808	Unblock Skia for big endian	2026-07-08 04:38:00 -04:00
Jazzzny	84c1eedac6	Fixes for Skia on 10.5	2026-07-08 04:38:00 -04:00
Moonchild	ddf5d6256e	Whitespace fix	2026-07-03 09:24:24 +02:00
Moonchild	0eae777fd0	Issue #3132 Follow-up: only include gtk2xtbin.h on GTK targets. PR #3133 caused build breakage on non-gtk platforms by unconditionally including the header (because the def defaults to true in configure) This also reorganizes the configure script to add a check for MOZ_WIDGET_GTK (hoisted up a little) so the new configure entry is simply ignored on non-GTK targets.	2026-07-03 09:19:54 +02:00
Moonchild	b2594a4ace	Merge pull request 'Revert gtk file dialog change and set default to cancel' (#3137 ) from 3136 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3137	2026-06-30 13:54:19 +00:00
Moonchild	ce61835a81	revert `8a2a9ead92` revert [gtk] Default the file dialog operation to cancelling the operation. While this could be an annoying default for users expecting fast-track dialog operations with hitting enter, it avoids potential social engineering attacks and unintended file operations.	2026-06-30 13:53:18 +00:00
Moonchild	30e29845c4	Merge pull request 'Decouple NPAPI from GTK2' (#3133 ) from Basilisk-Dev/UXP-contrib:npapi-no-gtk2 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3133	2026-06-30 13:51:11 +00:00
Basilisk-Dev	d8662c5dd9	Issue #3132 - use ENABLE check for npapi gtk2 builds instead of a dedicated DISABLE check to match other config options	2026-06-30 09:15:45 -04:00
Moonchild	8a2a9ead92	[gtk] Default the file dialog operation to cancelling the operation. While this could be an annoying default for users expecting fast-track dialog operations with hitting enter, it avoids potential social engineering attacks and unintended file operations.	2026-06-28 12:09:07 +02:00
Moonchild	efdbd34b0b	Revert "Bug 2033848 - Use non-default response ID for GTK file picker accept button. r=stransky" This reverts commit `789e976ace`.	2026-06-28 12:08:59 +02:00
Moonchild	d2fa69f593	Merge pull request 'Import missing libpng files for loongarch and plug them into moz.build' (#3135 ) from Basilisk-Dev/UXP-contrib:png-loongarch-fix into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3135	2026-06-27 07:25:51 +00:00
Basilisk-Dev	18d0a1a525	Issue #3134 - Import missing libpng files for loongarch and plug them into moz.build	2026-06-26 14:48:51 -04:00
Basilisk-Dev	0a5e50a9fe	Issue #3132 - Resolve GTK3 ATK bridge dynamically	2026-06-26 13:49:15 -04:00
Basilisk-Dev	3f5b7ed020	Issue #3132 - Add GTK2 NPAPI build toggle	2026-06-26 13:09:49 -04:00
Moonchild	9d9802c660	Issue #3129 - Follow-up: Add aarch64 to platforms enabling Neon in libpng.	2026-06-26 16:58:21 +02:00
Moonchild	27c579652a	Issue #3122 - Stop using <base> element in json viewer. Resolves #3122	2026-06-23 21:09:02 +02:00
Moonchild	8ffa6b3c13	Issue #3129 - Add palette_neon_intrinsics.c to moz.build	2026-06-23 10:23:17 +02:00
Moonchild	83f6efc33d	Issue #3122 - Put base paths in the json viewer client deps. The dependency modules are requested early. Seems CSP can block baseURL on these networking requests, so add the base manually to the resource paths to prevent network requests before the html base element is resolved and active.	2026-06-22 17:58:21 +02:00
Moonchild	47f1928610	Merge pull request 'Libpng update 1.6.58' (#3125 ) from libpng-update-1.6.58 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3125	2026-06-21 12:14:42 +00:00
Moonchild	7b3d961465	Bump NSS version for adopted changes.	2026-06-19 14:19:43 +02:00
Moonchild	22b2e18d91	[DOM] Clean up WebGL transform feedback validation.	2026-06-19 13:30:35 +02:00
John Schanck	f6c9c0c59f	Bug 2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf.	2026-06-19 12:56:26 +02:00
John Schanck	d8c9d24a9c	Bug 2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI.	2026-06-19 12:04:23 +02:00
John Schanck	a466b73267	Bug 2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.	2026-06-19 10:51:37 +02:00
Julian Descottes	1ce14fb014	[devtools] Consistently show filepicker on first save action from StyleEditor. Bug 2038133	2026-06-19 10:45:33 +02:00
Moonchild	8bbf60fb38	Issue #3127 - Add trademark notice to the tree. Resolves #3127	2026-06-19 08:37:27 +02:00
Moonchild	f2d7c02290	Apply (hopefully for the last time before 2.0.x) APNG support code. This commit also removes MOZCHANGES (old and irrelevant information) This commit also adds a new readme.	2026-06-18 22:57:29 +02:00
Moonchild	65ddfc21b6	Fresh import of libpng 1.6.58	2026-06-18 21:50:35 +02:00
Moonchild	163619de60	[network] Make HttpBaseChannel::mLoadFlags atomic.	2026-06-18 20:32:03 +02:00
Moonchild	29c4d554a0	[gfx] Check more offsets during CFF subsetting. Also fixes a bunch of whitespace (TAB -> spaces)	2026-06-18 19:35:49 +02:00
Moonchild	3e59569d0b	[DOM] Avoid over-optimizing some getter/function calls.	2026-06-18 13:45:20 +02:00
Moonchild	fb8483407b	[parser] Better align with spec definition of adding nodes.	2026-06-18 13:32:16 +02:00
Moonchild	ec8b7f86d0	No issue - Use ImmGCPtr for module meta data visits. This should make module GCs less touchy.	2026-06-17 23:46:18 +02:00
Moonchild	9899d59010	[DOM media] Zero-initialize ThreadSharedFloatArrayBufferList.	2026-06-17 18:13:15 +02:00
Kui-Feng Lee	789e976ace	Bug 2033848 - Use non-default response ID for GTK file picker accept button. r=stransky Replace GTK_RESPONSE_ACCEPT (-3) with a non-negative application-defined response ID (kFilePickerAccept = 0) for the accept button in the GTK file chooser dialog, and remove the gtk_dialog_set_default_response() call. GTK treats buttons with negative built-in response IDs as candidates for the dialog's default widget, which activates on Enter key press. By using a non-negative ID and not calling set_default_response(), the accept button is no longer pre-selected, preventing a page from tricking the user into confirming a file upload by holding Enter before the dialog appears. GTK's file chooser internally emits GTK_RESPONSE_ACCEPT via file_activated_cb when the user double-clicks a file, so we keep that case in DoneNonPortal() alongside kFilePickerAccept.	2026-06-17 12:47:03 +02:00
John Schanck	d5bf2555a3	Bug 2023478 - improve handling of escape sequences in pk11uri_ParseAttributes.	2026-06-17 12:17:06 +02:00
Moonchild	be672813f6	[DOM] Reject too large mLength in MutableBlobStorage::WriteRunnable.	2026-06-16 20:06:25 +02:00
John Schanck	746a7be08c	Bug 2030570 - use correct data for ID comparison in transfer_uri_certs_to_collection.	2026-06-16 19:54:44 +02:00
Moonchild	c222ee80fa	[network] Make keep-alive pref Atomic.	2026-06-16 19:50:55 +02:00
John Schanck	4950bd038d	Bug 2029765 - avoid refcount over-release in nssTokenObjectCache error path [@ nssToken_Destroy].	2026-06-16 18:52:25 +02:00
Nicolas B. Pierron	058336a071	Bug 2029066 - Remove Sinking of Live instructions. Instruction sinking was made possible by the introduction of recover instructions, which are moving instructions to be executed on bailout, but this is only possible for instructions which are not used. This feature, which is now removed, was made to sink instructions which are live, but only in a small set of branches, by moving the computation of these instructions to bailout paths, and to the concerned if branches. The current implementation never delivered and remained as dead-code for multiple years, without having a firm benefit on performance oriented benchmarks. Thus, this change removes the part of the Sink optimization which deals with live instructions but keeps the part of the Sink optimization which deals with instructions which are only used on bailout paths.	2026-06-16 13:37:21 +02:00
John Schanck	6823388a85	Bug 2029803 - add defensive info->len check in PK11_HPKE_SetupS and PK11_HPKE_SetupR.	2026-06-16 09:27:28 +02:00
Moonchild	b68d097eb6	Issue #3122 - Exclude local resources from <base> CSP checks. This avoids local-resource <base> URLs being restricted/nullified by remote CSP. This aligns the CSP handling with direct requests. Resolves #3122	2026-06-14 10:08:17 +02:00
Moonchild	c97a22776d	Merge pull request 'Re-introduce pref for WeakRef API spec.' (#3117 ) from weakref-finreg-pref into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3117	2026-06-12 15:46:16 +00:00
Moonchild	c484dbcca5	Issue #888 - Follow-up: Update about:license with AV1 codec licensing. LibAOM was actually omitted before (oops); added both.	2026-06-11 20:07:10 +02:00
Moonchild	54f15d7afe	Issue #3111 - Clean up logic in SweepFinalizationRegistries. Resolves #3111	2026-06-09 18:06:00 +02:00
Moonchild	05441188be	Issue #2306 - Enable full weakref by default in platform.	2026-06-07 23:54:52 +02:00
Moonchild	25a2d31be7	Issue #2306 - Re-introduce pref for WeakRef API spec. Effectively avoids doing any GC work if preffed off, and adopts the same for FinalizationRegistry which internally does similar work as WeakRefs.	2026-06-07 21:36:39 +02:00
Moonchild	58a4e0d545	[DOM] Provide more silent audio processing frames.	2026-06-05 12:29:30 +02:00
Moonchild	ad06b4ce5e	Revert "Bug 2027433 Treat null input channels as zero in InterleaveAndConvertBuffer()" This reverts commit `e76fc5637a`.	2026-06-05 11:28:55 +02:00
Moonchild	be3827b088	Revert "Bug 2027433 Treat null input channels as zero in AudioChannelsDownMix()" This reverts commit `ddd016a6f8`.	2026-06-05 11:28:42 +02:00
Moonchild	a136aaf502	Revert "Bug 2027433 use nullptr for silent up-mix channels" This reverts commit `5309640d6c`.	2026-06-05 11:28:35 +02:00
Moonchild	40d91a8eae	Merge pull request 'Always Uppercase Eszett' (#3114 ) from RealityRipple/UXP:capital-eszett into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3114	2026-06-04 08:15:36 +00:00
Moonchild	5b81a81ac4	Merge pull request 'Fix LoongArch64 debug build assertions' (#3115 ) from Basilisk-Dev/UXP-contrib:loongarch-asserts into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3115	2026-06-04 04:08:45 +00:00
Basilisk-Dev	328ddb2927	Issue #3095 followup - Fix LoongArch64 debug build assertions	2026-06-03 18:13:31 -04:00
Andy	06b9622302	Issue #2964 - Part 3: JS Override for `ToUpperCase`	2026-06-02 15:25:47 -07:00
Andy	1218649202	Issue #2964 - Part 2b: Improve `ToUpperCaseLength` Adds a method to force 16-bit characters, regardless of the type of the `chars` argument.	2026-06-02 15:21:44 -07:00
Andy	cbea8f5a53	Issue #2964 - Part 2a: Correctly Detect End of Buffer in `ToUpperCaseImpl` This code made two assumptions: - That the `SrcChar` type should determine the output type, as used in `CanUpperCaseSpecialCasing`. - That `AppendUpperCaseSpecialCasing` would always return a value larger than the previous value. The new code uses `DestChar`'s type for `CanUpperCaseSpecialCasing` and for a more accurate End of Buffer check.	2026-06-02 15:21:26 -07:00
Andy	f42e644486	Issue #2964 - Part 1: CSS Override for `uppercase` and `capitalize`	2026-06-02 15:20:45 -07:00
Moonchild	a40490b946	Merge pull request 'Fix a build failure for WebRTC on Python 3.14 on MacOS' (#3113 ) from Basilisk-Dev/UXP-contrib:webrtc-fix-mac into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3113	2026-06-01 09:09:29 +00:00
Basilisk-Dev	ad98693f3d	Issue #3105 followup - Fix a build failure for WebRTC on Python 3.14	2026-05-31 09:54:46 -04:00
Moonchild	7b4aaca975	Merge pull request 'Clamp border-radius value to Int32.MaxValue' (#3112 ) from border-radius-clamp into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3112	2026-05-30 08:42:57 +00:00
Moonchild	400e59a96d	Issue #3109 - Use CSS' internal length clamp value instead.	2026-05-29 23:53:22 +02:00
Moonchild	09276b72a6	Issue #3109 - Clamp border-radius value to Int32.MaxValue This avoids artifacts from out-of-bounds values. Resolves #3109	2026-05-29 22:53:43 +02:00
Moonchild	ec18304362	Merge pull request 'Cleanup references to IA64/HP-UX' (#3106 ) from Basilisk-Dev/UXP-contrib:ia64-cleanup into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3106	2026-05-27 10:46:31 +00:00
Moonchild	4cf411f393	Merge pull request 'Remove gonk/Android/iOS/NACL code in WebRTC' (#3105 ) from Basilisk-Dev/UXP-contrib:webrtc-cleanup-mobile into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3105	2026-05-27 10:45:37 +00:00
Basilisk-Dev	2b0935adf4	Issue #3007 - Remove HP-UX LDAP compatibility code	2026-05-23 17:08:16 -04:00
Basilisk-Dev	cbdc5fa85f	Issue #3007 - Remove HP-UX launcher setup	2026-05-23 17:06:16 -04:00
Basilisk-Dev	2a06c40a09	Issue #3007 - Remove IA64 runtime support paths	2026-05-23 17:04:19 -04:00
Basilisk-Dev	f499e3dd36	Issue #3007 - Remove IA64 from build configuration	2026-05-23 17:04:18 -04:00
Basilisk-Dev	48d21fa2bf	Issue #3008 - Prefer Windows memory barrier in WebRTC FIFO	2026-05-23 16:31:36 -04:00
Basilisk-Dev	c91c69272b	Issue #3008 - Remove stale B2G WebRTC camera comment	2026-05-23 16:25:35 -04:00
Basilisk-Dev	91f4fa744e	Issue #3008 - Remove mobile leftovers from DOM WebRTC	2026-05-23 16:25:35 -04:00
Basilisk-Dev	c2abd4aaa6	Issue #3008 - Remove stale Android WebView GYP guards	2026-05-23 16:25:34 -04:00
Basilisk-Dev	617ad84f96	Issue #3008 - Keep WebRTC audio FIFO after OpenSL removal	2026-05-23 16:25:33 -04:00
Basilisk-Dev	33b6bfa1b9	Issue #3008 - Fix GYP defaults after mobile cleanup	2026-05-23 16:25:33 -04:00
Basilisk-Dev	4e03afd191	Issue #3008 - Remove remaining mobile WebRTC build references	2026-05-23 16:25:32 -04:00
Basilisk-Dev	3512b73bc3	Issue #3008 - Remove stale iOS comments from WebRTC	2026-05-23 16:25:31 -04:00
Basilisk-Dev	d0ac45cb08	Issue #3008 - Remove iOS support from bundled GYP generators	2026-05-23 16:25:31 -04:00
Basilisk-Dev	ab3d950bd3	Issue #3008 - Remove mobile and NaCl defaults from WebRTC common gyp	2026-05-23 16:25:30 -04:00
Basilisk-Dev	44ddd79356	Issue #3008 - Remove stale iOS labels from WebRTC assembly	2026-05-23 16:25:29 -04:00
Basilisk-Dev	054ddf661f	Issue #3008 - Remove stale mobile notes from WebRTC metadata	2026-05-23 16:25:29 -04:00
Basilisk-Dev	da466a3bdd	Issue #3008 - Remove stale mobile references from WebRTC headers	2026-05-23 16:25:28 -04:00
Basilisk-Dev	42f0c2d78f	Issue #3008 - Remove mobile support from bundled WebRTC tools	2026-05-23 16:25:27 -04:00
Basilisk-Dev	5853784a31	Issue #3008 - Remove stale WebRTC mobile build metadata	2026-05-23 16:25:27 -04:00
Basilisk-Dev	5b20295620	Issue #3008 - Remove mobile guards from WebRTC voice tests	2026-05-23 16:25:26 -04:00
Basilisk-Dev	68e151c2a3	Issue #3008 - Remove mobile guards from WebRTC audio device tests	2026-05-23 16:25:25 -04:00
Basilisk-Dev	dd764a70a2	Issue #3008 - Remove mobile guards from WebRTC module tests	2026-05-23 16:25:24 -04:00
Basilisk-Dev	12defe0d12	Issue #3008 - Remove mobile guards from WebRTC audio tests	2026-05-23 16:25:24 -04:00
Basilisk-Dev	8868dd5785	Issue #3008 - Remove mobile guards from WebRTC tests	2026-05-23 16:25:23 -04:00
Basilisk-Dev	e787d585a4	Issue #3008 - Remove stale WebRTC mobile metadata	2026-05-23 16:25:22 -04:00
Basilisk-Dev	5eb7518ce2	Issue #3008 - Remove mobile WebRTC runtime conditionals	2026-05-23 16:25:21 -04:00
Basilisk-Dev	5be93da111	Issue #3008 - Remove obsolete mobile WebRTC source trees	2026-05-23 16:25:21 -04:00