Issue #1803 - Convert std::*<T>::value/::type to _v and _t suffixes.

This excludes uses in third-party libs in our tree.

TRADEMARK

@@ -0,0 +1,8 @@
+TRADEMARK NOTICE
+================
+
+The name "Goanna" and visual representations (logo) have not been
+registered by the Copyright owners as a trademark in any jurisdiction.
+However, because Goanna has been distributed and maintained world-wide,
+continually since 2015, the Copyright owners claim "common-law trademark
+protection" in any jurisdiction where common-law trademark is recognized.

accessible/atk/Platform.cpp

@@ -18,10 +18,6 @@
 #endif
 #include <gtk/gtk.h>
 
-#if (MOZ_WIDGET_GTK == 3)
-extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
-#endif
-
 using namespace mozilla;
 using namespace mozilla::a11y;
 
@@ -33,12 +29,20 @@ extern "C" {
 typedef GType (* AtkGetTypeType) (void);
 typedef void (*GnomeAccessibilityInit) (void);
 typedef void (*GnomeAccessibilityShutdown) (void);
+#if (MOZ_WIDGET_GTK == 3)
+typedef int (*AtkBridgeAdaptorInit) (int*, char***);
+#endif
 }
 
 static PRLibrary* sATKLib = nullptr;
 static const char sATKLibName[] = "libatk-1.0.so.0";
 static const char sATKHyperlinkImplGetTypeSymbol[] =
   "atk_hyperlink_impl_get_type";
+#if (MOZ_WIDGET_GTK == 3)
+static PRLibrary* sAtkBridgeAdaptorLib = nullptr;
+static const char sAtkBridgeAdaptorLibName[] = "libatk-bridge-2.0.so.0";
+static const char sAtkBridgeAdaptorInitSymbol[] = "atk_bridge_adaptor_init";
+#endif
 
 gboolean toplevel_event_watcher(GSignalInvocationHint*, guint, const GValue*,
                                 gpointer);
@@ -127,6 +131,38 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
     return NS_OK;
 }
 
+#if (MOZ_WIDGET_GTK == 3)
+static bool
+InitAtkBridgeAdaptor()
+{
+  AtkBridgeAdaptorInit initBridge =
+    reinterpret_cast<AtkBridgeAdaptorInit>(
+      PR_FindFunctionSymbolAndLibrary(sAtkBridgeAdaptorInitSymbol,
+                                      &sAtkBridgeAdaptorLib));
+
+  if (!initBridge) {
+    sAtkBridgeAdaptorLib = PR_LoadLibrary(sAtkBridgeAdaptorLibName);
+    if (sAtkBridgeAdaptorLib) {
+      initBridge =
+        reinterpret_cast<AtkBridgeAdaptorInit>(
+          PR_FindFunctionSymbol(sAtkBridgeAdaptorLib,
+                                sAtkBridgeAdaptorInitSymbol));
+      if (!initBridge) {
+        PR_UnloadLibrary(sAtkBridgeAdaptorLib);
+        sAtkBridgeAdaptorLib = nullptr;
+      }
+    }
+  }
+
+  if (!initBridge) {
+    return false;
+  }
+
+  initBridge(nullptr, nullptr);
+  return true;
+}
+#endif
+
 void
 a11y::PlatformInit()
 {
@@ -181,9 +217,7 @@ a11y::PlatformInit()
   // Init atk-bridge now
   PR_SetEnv("NO_AT_BRIDGE=0");
 #if (MOZ_WIDGET_GTK == 3)
-  if (atk_bridge_adaptor_init) {
-    atk_bridge_adaptor_init(nullptr, nullptr);
-  } else
+  if (!InitAtkBridgeAdaptor())
 #endif
   {
     nsresult rv = LoadGtkModule(sAtkBridge);
@@ -228,6 +262,13 @@ a11y::PlatformShutdown()
         sAtkBridge.init = nullptr;
         sAtkBridge.shutdown = nullptr;
     }
+#if (MOZ_WIDGET_GTK == 3)
+    if (sAtkBridgeAdaptorLib) {
+        // Do not shutdown/unload atk-bridge; an exit function registered by
+        // the bridge will take care of it.
+        sAtkBridgeAdaptorLib = nullptr;
+    }
+#endif
 #if (MOZ_WIDGET_GTK == 2)
     if (sGail.lib) {
         // Do not shutdown gail because

build/moz.configure/old.configure

@@ -164,6 +164,7 @@ def old_configure_options(*options):
     '--enable-negotiateauth',
     '--enable-nfc',
     '--enable-npapi',
+    '--enable-npapi-gtk2',
     '--enable-nspr-build',
     '--enable-official-branding',
     '--enable-official-vendor',

devtools/client/inspector/shared/tooltips-overlay.js

@@ -143,7 +143,8 @@ TooltipsOverlay.prototype = {
     // Font preview tooltip
     if (type === VIEW_NODE_VALUE_TYPE && prop.property === "font-family") {
       let value = prop.value.toLowerCase();
-      if (value !== "inherit" && value !== "unset" && value !== "initial" && value !== "revert") {
+      if (value !== "inherit" && value !== "unset" && value !== "initial" &&
+          value !== "revert" && value !== "revert-layer") {
         tooltipType = TOOLTIP_FONTFAMILY_TYPE;
       }
     }

devtools/client/jsonview/converter-child.js

@@ -204,21 +204,22 @@ function initialHTML(doc) {
     os = "linux";
   }
 
-  let base = doc.createElement("base");
-  base.href = "resource://devtools/client/jsonview/";
+  // The appRoot URI is prepended to all URIs instead of using a <base> element
+  // because the latter can cause spurious network requests (UXP Issue #3122)
+  let appRoot = "resource://devtools/client/jsonview/";
 
   let style = doc.createElement("link");
   style.rel = "stylesheet";
   style.type = "text/css";
-  style.href = "css/main.css";
+  style.href = appRoot +"css/main.css";
 
   let script = doc.createElement("script");
-  script.src = "lib/require.js";
-  script.dataset.main = "viewer-config";
+  script.src = appRoot + "lib/require.js";
+  script.dataset.main = appRoot + "viewer-config.js";
   script.defer = true;
 
   let head = doc.createElement("head");
-  head.append(base, style, script);
+  head.append(style, script);
 
   return "<!DOCTYPE html>\n" +
     startTag("html", {

devtools/client/jsonview/test/browser.ini

@@ -4,6 +4,8 @@ subsuite = devtools
 support-files =
   array_json.json
   array_json.json^headers^
+  csp_json.json
+  csp_json.json^headers^
   doc_frame_script.js
   head.js
   invalid_json.json
@@ -22,6 +24,7 @@ subsuite = clipboard
 subsuite = clipboard
 [browser_jsonview_copy_rawdata.js]
 subsuite = clipboard
+[browser_jsonview_csp_json.js]
 [browser_jsonview_filter.js]
 [browser_jsonview_invalid_json.js]
 [browser_jsonview_valid_json.js]

devtools/client/jsonview/test/browser_jsonview_csp_json.js

@@ -0,0 +1,17 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const TEST_JSON_URL = URL_ROOT + "csp_json.json";
+
+add_task(function* () {
+  info("Test CSP JSON started");
+
+  yield addJsonViewTab(TEST_JSON_URL);
+
+  let count = yield getElementCount(".jsonPanelBox .treeTable .treeRow");
+  is(count, 1, "There must be one row");
+});

devtools/client/jsonview/test/csp_json.json

@@ -0,0 +1 @@
+{"csp": true}

devtools/client/jsonview/test/csp_json.json^headers^

@@ -0,0 +1,2 @@
+Content-Type: application/json
+Content-Security-Policy: default-src 'none'; base-uri 'none';

devtools/client/jsonview/viewer-config.js

@@ -23,7 +23,7 @@
  * of the code base, so it's consistent and modules can be easily reused.
  */
 require.config({
-  baseUrl: ".",
+  baseUrl: "resource://devtools/client/jsonview/",
   paths: {
     "devtools/client/shared": "resource://devtools/client/shared",
     "devtools/shared": "resource://devtools/shared",

devtools/client/shared/css-angle.js

@@ -10,7 +10,8 @@ const SPECIALVALUES = new Set([
   "initial",
   "inherit",
   "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);
 
 const {getCSSLexer} = require("devtools/shared/css/lexer");

devtools/client/shared/widgets/FilterWidget.js

@@ -99,7 +99,14 @@ const filterList = [
 ];
 
 // Valid values that shouldn't be parsed for filters.
-const SPECIAL_VALUES = new Set(["none", "unset", "initial", "inherit", "revert"]);
+const SPECIAL_VALUES = new Set([
+  "none",
+  "unset",
+  "initial",
+  "inherit",
+  "revert",
+  "revert-layer"
+]);
 
 /**
  * A CSS Filter editor widget used to add/remove/modify

devtools/client/styleeditor/StyleSheetEditor.jsm

@@ -103,12 +103,6 @@ function StyleSheetEditor(styleSheet, win, file, isNew, walker, highlighter) {
     }
   };
 
-  this._styleSheetFilePath = null;
-  if (styleSheet.href &&
-      Services.io.extractScheme(this.styleSheet.href) == "file") {
-    this._styleSheetFilePath = this.styleSheet.href;
-  }
-
   this._onPropertyChange = this._onPropertyChange.bind(this);
   this._onError = this._onError.bind(this);
   this._onMediaRuleMatchesChange = this._onMediaRuleMatchesChange.bind(this);
@@ -664,8 +658,7 @@ StyleSheetEditor.prototype = {
     if (this._friendlyName) {
       defaultName = OS.Path.basename(this._friendlyName);
     }
-    showFilePicker(file || this._styleSheetFilePath, true, this._window,
-                   onFile, defaultName);
+    showFilePicker(file, true, this._window, onFile, defaultName);
   },
 
   /**

devtools/client/styleeditor/test/browser_styleeditor_filesave.js

@@ -1,98 +1,112 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/ */
-"use strict";
-
-// Test that 'Save' function works.
-
-const TESTCASE_URI_HTML = TEST_BASE_HTTP + "simple.html";
-const TESTCASE_URI_CSS = TEST_BASE_HTTP + "simple.css";
-
-var tempScope = {};
-Components.utils.import("resource://gre/modules/FileUtils.jsm", tempScope);
-Components.utils.import("resource://gre/modules/NetUtil.jsm", tempScope);
-var FileUtils = tempScope.FileUtils;
-var NetUtil = tempScope.NetUtil;
-
-add_task(function* () {
-  let htmlFile = yield copy(TESTCASE_URI_HTML, "simple.html");
-  yield copy(TESTCASE_URI_CSS, "simple.css");
-  let uri = Services.io.newFileURI(htmlFile);
-  let filePath = uri.resolve("");
-
-  let { ui } = yield openStyleEditorForURL(filePath);
-
-  let editor = ui.editors[0];
-  yield editor.getSourceEditor();
-
-  info("Editing the style sheet.");
-  let dirty = editor.sourceEditor.once("dirty-change");
-  let beginCursor = {line: 0, ch: 0};
-  editor.sourceEditor.replaceText("DIRTY TEXT", beginCursor, beginCursor);
-
-  yield dirty;
-
-  is(editor.sourceEditor.isClean(), false, "Editor is dirty.");
-  ok(editor.summary.classList.contains("unsaved"),
-     "Star icon is present in the corresponding summary.");
-
-  info("Saving the changes.");
-  dirty = editor.sourceEditor.once("dirty-change");
-
-  editor.saveToFile(null, function (file) {
-    ok(file, "file should get saved directly when using a file:// URI");
-  });
-
-  yield dirty;
-
-  is(editor.sourceEditor.isClean(), true, "Editor is clean.");
-  ok(!editor.summary.classList.contains("unsaved"),
-     "Star icon is not present in the corresponding summary.");
-});
-
-function copy(srcChromeURL, destFileName) {
-  let deferred = defer();
-  let destFile = FileUtils.getFile("ProfD", [destFileName]);
-  write(read(srcChromeURL), destFile, deferred.resolve);
-
-  return deferred.promise;
-}
-
-function read(srcChromeURL) {
-  let scriptableStream = Cc["@mozilla.org/scriptableinputstream;1"]
-    .getService(Ci.nsIScriptableInputStream);
-
-  let channel = NetUtil.newChannel({
-    uri: srcChromeURL,
-    loadUsingSystemPrincipal: true
-  });
-  let input = channel.open2();
-  scriptableStream.init(input);
-
-  let data = "";
-  while (input.available()) {
-    data = data.concat(scriptableStream.read(input.available()));
-  }
-  scriptableStream.close();
-  input.close();
-
-  return data;
-}
-
-function write(data, file, callback) {
-  let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
-    .createInstance(Ci.nsIScriptableUnicodeConverter);
-
-  converter.charset = "UTF-8";
-
-  let istream = converter.convertToInputStream(data);
-  let ostream = FileUtils.openSafeFileOutputStream(file);
-
-  NetUtil.asyncCopy(istream, ostream, function (status) {
-    if (!Components.isSuccessCode(status)) {
-      info("Couldn't write to " + file.path);
-      return;
-    }
-
-    callback(file);
-  });
-}
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+"use strict";
+
+// Test that 'Save' function works.
+
+const TESTCASE_URI_HTML = TEST_BASE_HTTP + "simple.html";
+const TESTCASE_URI_CSS = TEST_BASE_HTTP + "simple.css";
+
+var tempScope = {};
+Components.utils.import("resource://gre/modules/FileUtils.jsm", tempScope);
+Components.utils.import("resource://gre/modules/NetUtil.jsm", tempScope);
+var FileUtils = tempScope.FileUtils;
+var NetUtil = tempScope.NetUtil;
+
+add_task(function* () {
+  let htmlFile = yield copy(TESTCASE_URI_HTML, "simple.html");
+  const cssFile = await copy(TESTCASE_URI_CSS, "simple.css");
+  let uri = Services.io.newFileURI(htmlFile);
+  let filePath = uri.resolve("");
+
+  let { ui } = yield openStyleEditorForURL(filePath);
+
+  let editor = ui.editors[0];
+  yield editor.getSourceEditor();
+
+  is(
+    editor.savedFile,
+    null,
+    "savedFile should not be pre-populated from the source file"
+  );
+
+  info("Editing the style sheet.");
+  let dirty = editor.sourceEditor.once("dirty-change");
+  let beginCursor = {line: 0, ch: 0};
+  editor.sourceEditor.replaceText("DIRTY TEXT", beginCursor, beginCursor);
+
+  yield dirty;
+
+  is(editor.sourceEditor.isClean(), false, "Editor is dirty.");
+  ok(editor.summary.classList.contains("unsaved"),
+     "Star icon is present in the corresponding summary.");
+
+  info(
+    "Saving the changes with an explicit file (simulating a user-chosen save location)."
+  );
+  dirty = editor.sourceEditor.once("dirty-change");
+
+  editor.saveToFile(cssFile, function (file) {
+    ok(file, "file should get saved when explicitly passing a file");
+  });
+
+  yield dirty;
+
+  is(editor.sourceEditor.isClean(), true, "Editor is clean.");
+  ok(!editor.summary.classList.contains("unsaved"),
+     "Star icon is not present in the corresponding summary.");
+
+  is(
+    editor.savedFile?.path,
+    cssFile.path,
+    "savedFile should now be set on the editor"
+  );
+});
+
+function copy(srcChromeURL, destFileName) {
+  let deferred = defer();
+  let destFile = FileUtils.getFile("ProfD", [destFileName]);
+  write(read(srcChromeURL), destFile, deferred.resolve);
+
+  return deferred.promise;
+}
+
+function read(srcChromeURL) {
+  let scriptableStream = Cc["@mozilla.org/scriptableinputstream;1"]
+    .getService(Ci.nsIScriptableInputStream);
+
+  let channel = NetUtil.newChannel({
+    uri: srcChromeURL,
+    loadUsingSystemPrincipal: true
+  });
+  let input = channel.open2();
+  scriptableStream.init(input);
+
+  let data = "";
+  while (input.available()) {
+    data = data.concat(scriptableStream.read(input.available()));
+  }
+  scriptableStream.close();
+  input.close();
+
+  return data;
+}
+
+function write(data, file, callback) {
+  let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
+    .createInstance(Ci.nsIScriptableUnicodeConverter);
+
+  converter.charset = "UTF-8";
+
+  let istream = converter.convertToInputStream(data);
+  let ostream = FileUtils.openSafeFileOutputStream(file);
+
+  NetUtil.asyncCopy(istream, ostream, function (status) {
+    if (!Components.isSuccessCode(status)) {
+      info("Couldn't write to " + file.path);
+      return;
+    }
+
+    callback(file);
+  });
+}

devtools/client/styleeditor/test/browser_styleeditor_sourcemap_watching.js

@@ -28,7 +28,10 @@ add_task(function* () {
   let HTMLFile = yield copy(TESTCASE_URI_HTML, ["sourcemaps.html"]);
   let CSSFile = yield copy(TESTCASE_URI_CSS,
     ["sourcemap-css", "sourcemaps.css"]);
-  yield copy(TESTCASE_URI_SCSS, ["sourcemap-sass", "sourcemaps.scss"]);
+  const SCSSFile = await copy(TESTCASE_URI_SCSS, [
+    "sourcemap-sass",
+    "sourcemaps.scss",
+  ]);
   yield copy(TESTCASE_URI_MAP, ["sourcemap-css", "sourcemaps.css.map"]);
   yield copy(TESTCASE_URI_REG_CSS, ["simple.css"]);
 
@@ -59,7 +62,7 @@ add_task(function* () {
 
   // Edit and save Sass in the editor. This will start off a file-watching
   // process waiting for the CSS file to change.
-  yield editSCSS(editor);
+  yield editSCSS(SCSSFile, editor);
 
   // We can't run Sass or another compiler, so we fake it by just
   // directly changing the CSS file.
@@ -73,12 +76,12 @@ add_task(function* () {
   is(color, "rgb(0, 0, 255)", "div is blue after saving file");
 });
 
-function editSCSS(editor) {
+function editSCSS(SCSSFile, editor) {
   let deferred = defer();
 
   editor.sourceEditor.setText(CSS_TEXT);
 
-  editor.saveToFile(null, function (file) {
+  editor.saveToFile(SCSSFile, function (file) {
     ok(file, "Scss file should be saved");
     deferred.resolve();
   });

devtools/shared/css/color.js

@@ -20,7 +20,8 @@ const SPECIALVALUES = new Set([
   "inherit",
   "transparent",
   "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);
 
 /**

devtools/shared/css/generated/mach_commands.py

@@ -43,7 +43,7 @@ class MachCommands(MachCommandBase):
         if not os.path.exists(generated_dir):
             generated_dir = mozpath.join(self.topsrcdir, 'platform',
                 'devtools/shared/css/generated')
-        else:
+        if not os.path.exists(generated_dir):
             raise Exception('Directory expected at %s does not exist.' % generated_dir)
         self.generated_dir = generated_dir
 
@@ -75,6 +75,9 @@ class MachCommands(MachCommandBase):
         contents = subprocess.check_output([xpcshell_path, '-g', gre_path,
                                             '-a', browser_path, script_path],
                                            env = sub_env)
+        if not isinstance(contents, str):
+            contents = contents.decode('utf-8')
+
         # Extract just the output between the delimiters as the xpcshell output can
         # have extra output that we don't want.
         contents = contents.split('DEVTOOLS_CSS_DB_DELIMITER')[1]
@@ -88,13 +91,13 @@ class MachCommands(MachCommandBase):
         destination_path = mozpath.join(self.generated_dir,
             'properties-db.js')
 
-        with open(js_template_path, 'rb') as handle:
+        with open(js_template_path, 'r') as handle:
             js_template = handle.read()
 
         preamble = '/* THIS IS AN AUTOGENERATED FILE.  DO NOT EDIT */\n\n'
         contents = string.Template(js_template).substitute(substitutions)
 
-        with open(destination_path, 'wb') as destination:
+        with open(destination_path, 'w') as destination:
             destination.write(preamble + contents)
 
         print(('The database was successfully generated at ' + destination_path))

dom/base/MutableBlobStorage.cpp

@@ -196,7 +196,7 @@ public:
   {
     MOZ_ASSERT(!NS_IsMainThread());
 
-    int32_t written = PR_Write(mFD, mData, mLength);
+    int32_t written = mLength < INT32_MAX ? PR_Write(mFD, mData, mLength) : -1;
     if (NS_WARN_IF(written < 0 || uint32_t(written) != mLength)) {
       return NS_DispatchToMainThread(
         new ErrorPropagationRunnable(mBlobStorage, NS_ERROR_FAILURE));

dom/base/nsAttrValue.h

@@ -274,7 +274,7 @@ public:
     }
 
     template<typename T,
-             typename = typename std::enable_if<std::is_enum<T>::value>::type>
+             typename = typename std::enable_if_t<std::is_enum_v<T>>>
     EnumTable(const char* aTag, T aValue)
       : tag(aTag)
       , value(static_cast<int16_t>(aValue))

dom/canvas/WebGLTransformFeedback.cpp

@@ -39,6 +39,44 @@ WebGLTransformFeedback::Delete()
 
 ////////////////////////////////////////
 
+// Validation helper for beginning/resuming the TF and computing the
+// vertex capacity.
+bool
+WebGLTransformFeedback::PrepareTransformFeedback() {
+    const auto& prog = mContext->mCurrentProgram;
+    if (!prog ||
+        !prog->IsLinked() ||
+        !prog->LinkInfo()->componentsPerTFVert.size()) {
+        mContext->ErrorInvalidOperation("Current program not valid for transform feedback.");
+        return false;
+    }
+
+    const auto& linkInfo = prog->LinkInfo();
+    const auto& componentsPerTFVert = linkInfo->componentsPerTFVert;
+    
+    mActive_VertCapacity = 0;
+
+    size_t minVertCapacity = SIZE_MAX;
+    for (size_t i = 0; i < componentsPerTFVert.size(); i++) {
+        const auto& indexedBinding = mIndexedBindings[i];
+        const auto& componentsPerVert = componentsPerTFVert[i];
+
+        const auto& buffer = indexedBinding.mBufferBinding;
+        if (!buffer) {
+            mContext->ErrorInvalidOperation("No buffer attached to required transform feedback index %u.",
+                                            (uint32_t)i);
+            return false;
+        }
+
+        const size_t vertCapacity = buffer->ByteLength() / 4 / componentsPerVert;
+        minVertCapacity = std::min(minVertCapacity, vertCapacity);
+    }
+    
+    mActive_VertCapacity = minVertCapacity;
+    
+    return true;
+}
+
 void
 WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
 {
@@ -59,37 +97,10 @@ WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
         return;
     }
 
-    const auto& prog = mContext->mCurrentProgram;
-    if (!prog ||
-        !prog->IsLinked() ||
-        !prog->LinkInfo()->componentsPerTFVert.size())
-    {
-        mContext->ErrorInvalidOperation("%s: Current program not valid for transform"
-                                        " feedback.",
-                                        funcName);
+    if (!PrepareTransformFeedback()) {
         return;
     }
 
-    const auto& linkInfo = prog->LinkInfo();
-    const auto& componentsPerTFVert = linkInfo->componentsPerTFVert;
-
-    size_t minVertCapacity = SIZE_MAX;
-    for (size_t i = 0; i < componentsPerTFVert.size(); i++) {
-        const auto& indexedBinding = mIndexedBindings[i];
-        const auto& componentsPerVert = componentsPerTFVert[i];
-
-        const auto& buffer = indexedBinding.mBufferBinding;
-        if (!buffer) {
-            mContext->ErrorInvalidOperation("%s: No buffer attached to required transform"
-                                            " feedback index %u.",
-                                            funcName, (uint32_t)i);
-            return;
-        }
-
-        const size_t vertCapacity = buffer->ByteLength() / 4 / componentsPerVert;
-        minVertCapacity = std::min(minVertCapacity, vertCapacity);
-    }
-
     ////
 
     const auto& gl = mContext->gl;
@@ -101,10 +112,9 @@ WebGLTransformFeedback::BeginTransformFeedback(GLenum primMode)
     mIsActive = true;
     MOZ_ASSERT(!mIsPaused);
 
-    mActive_Program = prog;
+    mActive_Program = mContext->mCurrentProgram;
     mActive_PrimMode = primMode;
     mActive_VertPosition = 0;
-    mActive_VertCapacity = minVertCapacity;
 
     ////
 
@@ -173,6 +183,12 @@ WebGLTransformFeedback::ResumeTransformFeedback()
         return;
     }
 
+    // Re-run prepare in case some of the buffers have been modified
+    // while the TF was paused.
+    if (!PrepareTransformFeedback()) {
+        return;
+    }
+
     ////
 
     const auto& gl = mContext->gl;

dom/canvas/WebGLTransformFeedback.h

@@ -44,6 +44,7 @@ public:
     WebGLTransformFeedback(WebGLContext* webgl, GLuint tf);
 private:
     ~WebGLTransformFeedback();
+    bool PrepareTransformFeedback();
 
 public:
     NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(WebGLTransformFeedback)

dom/html/HTMLSharedElement.cpp

@@ -18,6 +18,8 @@
 #include "nsContentUtils.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIURI.h"
+#include "nsNetUtil.h"
+#include "nsIProtocolHandler.h"
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(Shared)
 
@@ -186,6 +188,8 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocument* aDocument, nsIContent* aMustMatch)
         newBaseURI = nullptr;
       }
       if (csp && newBaseURI) {
+        bool isLocalResource = false;
+        rv = NS_URIChainHasFlags(newBaseURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &isLocalResource);
         // base-uri is only enforced if explicitly defined in the
         // policy - do *not* consult default-src, see:
         // http://www.w3.org/TR/CSP2/#directive-default-src
@@ -193,7 +197,7 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocument* aDocument, nsIContent* aMustMatch)
         rv = csp->Permits(newBaseURI, nsIContentSecurityPolicy::BASE_URI_DIRECTIVE,
                           true /* aSpecific */, true /* aSendViolationReports */,
                           &cspPermitsBaseURI);
-        if (NS_FAILED(rv) || !cspPermitsBaseURI) {
+        if ((NS_FAILED(rv) || !cspPermitsBaseURI) && !isLocalResource) {
           newBaseURI = nullptr;
         }
       }

dom/media/webaudio/AudioNodeEngine.cpp

@@ -26,7 +26,7 @@ ThreadSharedFloatArrayBufferList::Create(uint32_t aChannelCount,
     new ThreadSharedFloatArrayBufferList(aChannelCount);
 
   for (uint32_t i = 0; i < aChannelCount; ++i) {
-    float* channelData = js_pod_malloc<float>(aLength);
+    float* channelData = js_pod_calloc<float>(aLength);
     if (!channelData) {
       return nullptr;
     }

dom/media/webaudio/AudioNodeEngine.h

@@ -40,8 +40,8 @@ public:
   }
   /**
    * Create with buffers suitable for transfer to
-   * JS_NewArrayBufferWithContents().  The buffer contents are uninitialized
-   * and so should be set using GetDataForWrite().
+   * JS_NewArrayBufferWithContents().  The buffer contents are
+   * zero-initialized; callers should set them using GetDataForWrite().
    */
   static already_AddRefed<ThreadSharedFloatArrayBufferList>
   Create(uint32_t aChannelCount, size_t aLength, const mozilla::fallible_t&);

dom/plugins/ipc/PluginInstanceChild.cpp

@@ -55,7 +55,12 @@ using namespace std;
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
+#endif
 
 #elif defined(OS_WIN)
 
@@ -208,7 +213,9 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
     memset(&mWsInfo, 0, sizeof(mWsInfo));
 #ifdef MOZ_WIDGET_GTK
     mWsInfo.display = nullptr;
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     mXtClient.top_widget = nullptr;
+#endif
 #else
     mWsInfo.display = DefaultXDisplay();
 #endif
@@ -620,15 +627,17 @@ PluginInstanceChild::NPN_SetValue(NPPVariable aVar, void* aValue)
         NPWindowType newWindowType = windowed ? NPWindowTypeWindow : NPWindowTypeDrawable;
 #ifdef MOZ_WIDGET_GTK
         if (mWindow.type != newWindowType && mWsInfo.display) {
-           // plugin type has been changed but we already have a valid display
-           // so update it for the recent plugin mode
-           if (mXEmbed || !windowed) {
-               // Use default GTK display for XEmbed and windowless plugins
-               mWsInfo.display = DefaultXDisplay();
-           }
-           else {
-               mWsInfo.display = xt_client_get_display();
-           }
+            // plugin type has been changed but we already have a valid display
+            // so update it for the recent plugin mode
+#ifdef MOZ_ENABLE_NPAPI_GTK2
+            if (!mXEmbed && windowed) {
+                mWsInfo.display = xt_client_get_display();
+            } else
+#endif
+            {
+                // Use default GTK display for XEmbed and windowless plugins.
+                mWsInfo.display = DefaultXDisplay();
+            }
         }
 #endif
         mWindow.type = newWindowType;
@@ -1214,12 +1223,18 @@ bool PluginInstanceChild::CreateWindow(const NPRemoteWindow& aWindow)
     if (mXEmbed) {
         mWindow.window = reinterpret_cast<void*>(aWindow.window);
     }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     else {
         Window browserSocket = (Window)(aWindow.window);
         xt_client_init(&mXtClient, mWsInfo.visual, mWsInfo.colormap, mWsInfo.depth);
         xt_client_create(&mXtClient, browserSocket, mWindow.width, mWindow.height); 
         mWindow.window = (void *)XtWindow(mXtClient.child_widget);
-    }  
+    }
+#else
+    else {
+        mWindow.window = reinterpret_cast<void*>(aWindow.window);
+    }
+#endif
 #else
     mWindow.window = reinterpret_cast<void*>(aWindow.window);
 #endif
@@ -1239,7 +1254,7 @@ void PluginInstanceChild::DeleteWindow()
   if (!mWindow.window)
       return;
 
-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
   if (mXtClient.top_widget) {     
       xt_client_unrealize(&mXtClient);
       xt_client_destroy(&mXtClient); 
@@ -1321,7 +1336,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
         CreateWindow(aWindow);
     }
 
-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     if (mXEmbed && gtk_check_version(2,18,7) != nullptr) { // older
         if (aWindow.type == NPWindowTypeWindow) {
             GdkWindow* socket_window = gdk_window_lookup(static_cast<GdkNativeWindow>(aWindow.window));
@@ -1456,19 +1471,27 @@ PluginInstanceChild::Initialize()
     if (mWindow.type == NPWindowTypeWindow) {
         AnswerNPP_GetValue_NPPVpluginNeedsXEmbed(&mXEmbed, &rv);
 
+#ifdef MOZ_ENABLE_NPAPI_GTK2
         // Set up Xt loop for windowed plugins without XEmbed support
         if (!mXEmbed) {
            xt_client_xloop_create();
         }
+#endif
     }
 
-    // Use default GTK display for XEmbed and windowless plugins
+    // Use default GTK display for XEmbed and windowless plugins.
     if (mXEmbed || mWindow.type != NPWindowTypeWindow) {
         mWsInfo.display = DefaultXDisplay();
     }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     else {
         mWsInfo.display = xt_client_get_display();
     }
+#else
+    else {
+        mWsInfo.display = DefaultXDisplay();
+    }
+#endif
 #endif 
 
     return true;
@@ -4656,7 +4679,7 @@ PluginInstanceChild::Destroy()
 
     mPendingAsyncCalls.Clear();
     
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
     if (mWindow.type == NPWindowTypeWindow && !mXEmbed) {
       xt_client_xloop_destroy();
     }

dom/plugins/ipc/PluginInstanceChild.h

@@ -36,7 +36,7 @@
 
 #include <map>
 
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
 #include "gtk2xtbin.h"
 #endif
 
@@ -462,6 +462,8 @@ private:
     NPSetWindowCallbackStruct mWsInfo;
 #ifdef MOZ_WIDGET_GTK
     bool mXEmbed;
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
     XtClient mXtClient;
 #endif
 #elif defined(OS_WIN)

dom/plugins/ipc/PluginModuleChild.cpp

@@ -12,6 +12,9 @@
 
 #ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
 #endif
 
 #include "nsIFile.h"
@@ -1101,7 +1104,11 @@ _getvalue(NPP aNPP,
                 return InstCast(aNPP)->NPN_GetValue(aVariable, aValue);
             } 
             else {
+#ifdef MOZ_ENABLE_NPAPI_GTK2
                 *(void **)aValue = xt_client_get_display();
+#else
+                *(void **)aValue = DefaultXDisplay();
+#endif
             }          
             return NPERR_NO_ERROR;
         }

dom/plugins/ipc/moz.build

@@ -143,11 +143,13 @@ LOCAL_INCLUDES += [
 
 DEFINES['FORCE_PR_LOG'] = True
 
-if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gtk3':
-    CXXFLAGS += CONFIG['TK_CFLAGS']
-else:
+if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk3' and
+        CONFIG['MOZ_ENABLE_NPAPI'] and
+        CONFIG['MOZ_ENABLE_NPAPI_GTK2']):
     # Force build against gtk+2 for struct offsets and such.
     CXXFLAGS += CONFIG['MOZ_GTK2_CFLAGS']
+else:
+    CXXFLAGS += CONFIG['TK_CFLAGS']
 
 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
 

dom/url/URL.cpp

@@ -1789,17 +1789,26 @@ URL::IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
   return URLWorker::IsValidURL(aGlobal, aURL, aRv);
 }
 
-bool
-URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
-              const Optional<nsAString>& aBase) {
+already_AddRefed<URL>
+URL::Parse(const GlobalObject& aGlobal, const nsAString& aURL,
+           const Optional<nsAString>& aBase)
+{
   ErrorResult rv;
   RefPtr<URL> parsed = URL::Constructor(aGlobal, aURL, aBase, rv);
   if (rv.Failed() || !parsed) {
     rv.SuppressException();
-    return false;
+    return nullptr;
   }
 
-  return true;
+  return parsed.forget();
+}
+
+bool
+URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
+              const Optional<nsAString>& aBase)
+{
+  RefPtr<URL> parsed = URL::Parse(aGlobal, aURL, aBase);
+  return !!parsed;
 }
 
 already_AddRefed<URLSearchParams>

dom/url/URL.h

@@ -88,6 +88,10 @@ public:
   IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
              ErrorResult& aRv);
 
+  static already_AddRefed<URL>
+  Parse(const GlobalObject& aGlobal, const nsAString& aURL,
+        const Optional<nsAString>& aBase);
+
   static bool
   CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
            const Optional<nsAString>& aBase);

dom/url/tests/test_url.html

@@ -448,6 +448,34 @@
                 !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
                 "URL.canParse rejects root-relative input against opaque mailto: base",
             );
+            ok("parse" in URL, "URL.parse exists");
+            is(URL.parse.length, 1, "URL.parse has one required argument");
+            var parsed = URL.parse("/static/client/runtime.js", "x:/");
+            ok(parsed instanceof URL, "URL.parse returns a URL object on success");
+            is(parsed.href, "x:/static/client/runtime.js", "URL.parse resolves against a base");
+            is(URL.parse("/static/client/runtime.js"), null, "URL.parse returns null for invalid input");
+            is(
+                URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
+                null,
+                "URL.parse returns null for an invalid base/input combination",
+            );
+
+            var conversionOrder = [];
+            parsed = URL.parse(
+                { toString: function() { conversionOrder.push("url"); return "child"; } },
+                { toString: function() { conversionOrder.push("base"); return "https://example.com/root/"; } },
+            );
+            is(conversionOrder.join(","), "url,base", "URL.parse converts its arguments in order");
+            is(parsed.href, "https://example.com/root/child", "URL.parse uses converted arguments");
+
+            var sentinel = {};
+            var thrown;
+            try {
+                URL.parse({ toString: function() { throw sentinel; } });
+            } catch (e) {
+                thrown = e;
+            }
+            is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
             SimpleTest.doesThrow(() => {
                 new URL("/static/client/runtime.js", "mailto:test@example.com");
             }, "constructor rejects root-relative input against opaque mailto: base");

dom/url/tests/urlApi_worker.js

@@ -301,6 +301,64 @@ onmessage = function () {
     !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
     "URL.canParse rejects root-relative input against opaque mailto: base",
   );
+  ok("parse" in URL, "URL.parse exists");
+  is(URL.parse.length, 1, "URL.parse has one required argument");
+  let parsed = URL.parse("/static/client/runtime.js", "x:/");
+  ok(parsed instanceof URL, "URL.parse returns a URL object on success");
+  is(
+    parsed.href,
+    "x:/static/client/runtime.js",
+    "URL.parse resolves against a base",
+  );
+  is(
+    URL.parse("/static/client/runtime.js"),
+    null,
+    "URL.parse returns null for invalid input",
+  );
+  is(
+    URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
+    null,
+    "URL.parse returns null for an invalid base/input combination",
+  );
+
+  const conversionOrder = [];
+  parsed = URL.parse(
+    {
+      toString() {
+        conversionOrder.push("url");
+        return "child";
+      },
+    },
+    {
+      toString() {
+        conversionOrder.push("base");
+        return "https://example.com/root/";
+      },
+    },
+  );
+  is(
+    conversionOrder.join(","),
+    "url,base",
+    "URL.parse converts its arguments in order",
+  );
+  is(
+    parsed.href,
+    "https://example.com/root/child",
+    "URL.parse uses converted arguments",
+  );
+
+  const sentinel = {};
+  let thrown;
+  try {
+    URL.parse({
+      toString() {
+        throw sentinel;
+      },
+    });
+  } catch (e) {
+    thrown = e;
+  }
+  is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
   let mailtoRelativeFailed = false;
   try {
     new URL("/static/client/runtime.js", "mailto:test@example.com");

dom/webidl/Element.webidl

@@ -34,7 +34,6 @@ interface Element : Node {
 
   [SameObject]
   readonly attribute NamedNodeMap attributes;
-  [Pure]
   sequence<DOMString> getAttributeNames();
   [Pure]
   DOMString? getAttribute(DOMString name);
@@ -159,7 +158,7 @@ interface Element : Node {
    * this property returns an object with computed values for grid
    * tracks and lines.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   sequence<Grid> getGridFragments();
 };
 

dom/webidl/HTMLElement.webidl

@@ -23,7 +23,7 @@ interface HTMLElement : Element {
   [CEReactions, SetterThrows, Pure]
            attribute DOMString dir;
 
-  [CEReactions, GetterThrows, Pure]
+  [CEReactions, GetterThrows]
            attribute [TreatNullAs=EmptyString] DOMString innerText;
 
   // user interaction

dom/webidl/HTMLInputElement.webidl

@@ -51,7 +51,7 @@ interface HTMLInputElement : HTMLElement {
            attribute boolean formNoValidate;
   [CEReactions, Pure, SetterThrows]
            attribute DOMString formTarget;
-  [CEReactions, Pure, SetterThrows]
+  [CEReactions, SetterThrows]
            attribute unsigned long height;
   [Pure]
            attribute boolean indeterminate;

dom/webidl/URL.webidl

@@ -23,6 +23,7 @@ interface URL {
   [Throws]
   stringifier;
   
+  static URL? parse(USVString url, optional USVString base);
   static boolean canParse(USVString url, optional USVString base);
 
   [Throws]

gfx/2d/DrawTargetSkia.cpp

@@ -1117,6 +1117,7 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                         kCGImageAlphaOnly :
                         kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host;
 
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
   mCG = CGBitmapContextCreateWithData(mCanvasData,
                                       mCGSize.width,
                                       mCGSize.height,
@@ -1126,6 +1127,15 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                                       bitmapInfo,
                                       NULL, /* Callback when released */
                                       NULL);
+#else
+  mCG = CGBitmapContextCreate(mCanvasData,
+                              mCGSize.width,
+                              mCGSize.height,
+                              8, /* bits per component */
+                              stride,
+                              mColorSpace,
+                              bitmapInfo);
+#endif
   if (!mCG) {
     ReleaseBits(mCanvasData);
     NS_WARNING("Could not create bitmap around skia data\n");

gfx/2d/ScaledFontMac.cpp

@@ -115,7 +115,7 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
   return ScaledFontBase::GetPathForGlyphs(aBuffer, aTarget);
 }
 
-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
 void
 ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
 {

gfx/2d/ScaledFontMac.h

@@ -32,7 +32,7 @@ public:
   virtual SkTypeface* GetSkTypeface();
 #endif
   virtual already_AddRefed<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
   virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
 #endif
   virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);

gfx/cairo/cairo/src/cairo-cff-subset.c

@@ -805,6 +805,10 @@ cairo_cff_font_read_cid_fontdict (cairo_cff_font_t *font, unsigned char *ptr)
         }
         operand = decode_integer (operand, &size);
         decode_integer (operand, &offset);
+        if (unlikely (offset < 0 || (unsigned long)offset > font->data_length)) {
+            status = CAIRO_INT_STATUS_UNSUPPORTED;
+            goto fail;
+        }
         status = cff_dict_init (&font->fd_private_dict[i]);
 	if (unlikely (status))
             goto fail;
@@ -866,6 +870,8 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
     operand = cff_dict_get_operands (font->top_dict, CHARSTRINGS_OP, &size);
     decode_integer (operand, &offset);
     p = font->data + offset;
+    if (unlikely (p < font->data || p > font->data_end))
+        return CAIRO_INT_STATUS_UNSUPPORTED;
     status = cff_index_read (&font->charstrings_index, &p, font->data_end);
     if (unlikely (status))
         goto fail;
@@ -874,49 +880,58 @@ cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
     if (font->is_cid) {
         operand = cff_dict_get_operands (font->top_dict, FDSELECT_OP, &size);
         decode_integer (operand, &offset);
-        status = cairo_cff_font_read_fdselect (font, font->data + offset);
-	if (unlikely (status))
-	    goto fail;
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
+        status = cairo_cff_font_read_fdselect (font, p);
+        if (unlikely (status))
+            goto fail;
 
         operand = cff_dict_get_operands (font->top_dict, FDARRAY_OP, &size);
         decode_integer (operand, &offset);
-        status = cairo_cff_font_read_cid_fontdict (font, font->data + offset);
-	if (unlikely (status))
-	    goto fail;
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
+        status = cairo_cff_font_read_cid_fontdict (font, p);
+        if (unlikely (status))
+            goto fail;
     } else {
         operand = cff_dict_get_operands (font->top_dict, PRIVATE_OP, &size);
         operand = decode_integer (operand, &size);
         decode_integer (operand, &offset);
+        p = font->data + offset;
+        if (unlikely (p < font->data || p > font->data_end))
+            return CAIRO_INT_STATUS_UNSUPPORTED;
         status = cairo_cff_font_read_private_dict (font,
                                                    font->private_dict,
-						   &font->local_sub_index,
-						   font->data + offset,
-						   size);
-	if (unlikely (status))
-	    goto fail;
+                                                   &font->local_sub_index,
+                                                   p,
+                                                   size);
+        if (unlikely (status))
+            goto fail;
     }
 
     /* Use maximum sized encoding to reserve space for later modification. */
     end_buf = encode_integer_max (buf, 0);
     status = cff_dict_set_operands (font->top_dict,
-	                            CHARSTRINGS_OP, buf, end_buf - buf);
+                                    CHARSTRINGS_OP, buf, end_buf - buf);
     if (unlikely (status))
-	goto fail;
+        goto fail;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            FDSELECT_OP, buf, end_buf - buf);
+                                    FDSELECT_OP, buf, end_buf - buf);
     if (unlikely (status))
-	goto fail;
+        goto fail;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            FDARRAY_OP, buf, end_buf - buf);
+                                    FDARRAY_OP, buf, end_buf - buf);
     if (unlikely (status))
-	goto fail;
+        goto fail;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            CHARSET_OP, buf, end_buf - buf);
+                                    CHARSET_OP, buf, end_buf - buf);
     if (unlikely (status))
-	goto fail;
+        goto fail;
 
     cff_dict_remove (font->top_dict, ENCODING_OP);
     cff_dict_remove (font->top_dict, PRIVATE_OP);
@@ -985,26 +1000,26 @@ cairo_cff_font_set_ros_strings (cairo_cff_font_t *font)
                                     (unsigned char *)registry,
                                     strlen(registry));
     if (unlikely (status))
-	return status;
+        return status;
 
     sid2 = NUM_STD_STRINGS + _cairo_array_num_elements (&font->strings_subset_index);
     status = cff_index_append_copy (&font->strings_subset_index,
                                     (unsigned char *)ordering,
-				    strlen(ordering));
+                                    strlen(ordering));
     if (unlikely (status))
-	return status;
+        return status;
 
     p = encode_integer (buf, sid1);
     p = encode_integer (p, sid2);
     p = encode_integer (p, 0);
     status = cff_dict_set_operands (font->top_dict, ROS_OP, buf, p - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     p = encode_integer (buf, font->scaled_font_subset->num_glyphs);
     status = cff_dict_set_operands (font->top_dict, CIDCOUNT_OP, buf, p - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     return CAIRO_STATUS_SUCCESS;
 }
@@ -1038,7 +1053,7 @@ cairo_cff_font_subset_dict_string(cairo_cff_font_t   *font,
     p = encode_integer (buf, sid);
     status = cff_dict_set_operands (dict, operator, buf, p - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     return CAIRO_STATUS_SUCCESS;
 }
@@ -1101,19 +1116,19 @@ cairo_cff_font_subset_fontdict (cairo_cff_font_t  *font)
     font->fdselect_subset = calloc (font->scaled_font_subset->num_glyphs,
                                      sizeof (int));
     if (unlikely (font->fdselect_subset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     font->fd_subset_map = calloc (font->num_fontdicts, sizeof (int));
     if (unlikely (font->fd_subset_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     font->private_dict_offset = calloc (font->num_fontdicts, sizeof (int));
     if (unlikely (font->private_dict_offset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     reverse_map = calloc (font->num_fontdicts, sizeof (int));
     if (unlikely (reverse_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     for (i = 0; i < font->num_fontdicts; i++)
         reverse_map[i] = -1;
@@ -1143,22 +1158,22 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
     font->num_fontdicts = 1;
     font->fd_dict = malloc (sizeof (cairo_hash_table_t *));
     if (unlikely (font->fd_dict == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     if (cff_dict_init (&font->fd_dict[0])) {
-	free (font->fd_dict);
-	font->fd_dict = NULL;
-	font->num_fontdicts = 0;
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        free (font->fd_dict);
+        font->fd_dict = NULL;
+        font->num_fontdicts = 0;
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
 
     font->fd_subset_map = malloc (sizeof (int));
     if (unlikely (font->fd_subset_map == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     font->private_dict_offset = malloc (sizeof (int));
     if (unlikely (font->private_dict_offset == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     font->fd_subset_map[0] = 0;
     font->num_subset_fontdicts = 1;
@@ -1169,7 +1184,7 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
     end_buf = encode_integer_max (end_buf, 0);
     status = cff_dict_set_operands (font->fd_dict[0], PRIVATE_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     return CAIRO_STATUS_SUCCESS;
 }
@@ -1208,7 +1223,7 @@ cairo_cff_font_subset_font (cairo_cff_font_t  *font)
 
     status = cairo_cff_font_set_ros_strings (font);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cairo_cff_font_subset_charstrings (font);
     if (unlikely (status))
@@ -1219,7 +1234,7 @@ cairo_cff_font_subset_font (cairo_cff_font_t  *font)
     else
         status = cairo_cff_font_create_cid_fontdict (font);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cairo_cff_font_subset_strings (font);
     if (unlikely (status))
@@ -1271,7 +1286,7 @@ cairo_cff_font_write_name (cairo_cff_font_t *font)
                                     (unsigned char *) font->subset_font_name,
                                     strlen(font->subset_font_name));
     if (unlikely (status))
-	goto FAIL;
+        goto FAIL;
 
     status = cff_index_write (&index, &font->output);
     if (unlikely (status))
@@ -1464,9 +1479,9 @@ cairo_cff_font_write_cid_fontdict (cairo_cff_font_t *font)
         if (unlikely (status))
             return status;
 
-	offset_array_ptr = (uint32_t *) _cairo_array_index (&font->output, offset_array);
+        offset_array_ptr = (uint32_t *) _cairo_array_index (&font->output, offset_array);
         *offset_array_ptr = cpu_to_be32(_cairo_array_num_elements (&font->output) - offset_base);
-	offset_array += sizeof(uint32_t);
+        offset_array += sizeof(uint32_t);
     }
 
     return CAIRO_STATUS_SUCCESS;
@@ -1566,15 +1581,15 @@ cairo_cff_font_write_cid_private_dict_and_local_sub (cairo_cff_font_t  *font)
                                                     0,
                                                     font->fd_dict[0],
                                                     font->private_dict);
-	if (unlikely (status))
-	    return status;
+        if (unlikely (status))
+            return status;
 
         status = cairo_cff_font_write_local_sub (font,
                                                  0,
                                                  font->private_dict,
                                                  &font->local_sub_index);
-	if (unlikely (status))
-	    return status;
+        if (unlikely (status))
+            return status;
     }
 
     return CAIRO_STATUS_SUCCESS;
@@ -1698,7 +1713,7 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
 
     backend = scaled_font_subset->scaled_font->backend;
     if (!backend->load_truetype_table)
-	return CAIRO_INT_STATUS_UNSUPPORTED;
+        return CAIRO_INT_STATUS_UNSUPPORTED;
 
     data_length = 0;
     status = backend->load_truetype_table( scaled_font_subset->scaled_font,
@@ -1736,12 +1751,12 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
     _cairo_array_init (&font->output, sizeof (char));
     status = _cairo_array_grow_by (&font->output, 4096);
     if (unlikely (status))
-	goto fail2;
+        goto fail2;
 
     font->subset_font_name = strdup (subset_name);
     if (unlikely (font->subset_font_name == NULL)) {
         status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        goto fail2;
     }
     font->x_min = (int16_t) be16_to_cpu (head.x_min);
     font->y_min = (int16_t) be16_to_cpu (head.y_min);
@@ -1755,18 +1770,18 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
 
     font->font_name = NULL;
     status = _cairo_truetype_read_font_name (scaled_font_subset->scaled_font,
-					     &font->ps_name,
-					     &font->font_name);
+                                             &font->ps_name,
+                                             &font->font_name);
     if (_cairo_status_is_error (status))
-	goto fail3;
+        goto fail3;
 
     /* If the PS name is not found, create a CairoFont-x-y name. */
     if (font->ps_name == NULL) {
         font->ps_name = malloc (30);
         if (unlikely (font->ps_name == NULL)) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+            status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
             goto fail3;
-	}
+        }
 
         snprintf(font->ps_name, 30, "CairoFont-%u-%u",
                  scaled_font_subset->font_id,
@@ -1781,7 +1796,7 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
 
     status = cairo_cff_font_create_set_widths (font);
     if (unlikely (status))
-	goto fail5;
+        goto fail5;
 
     font->data_length = data_length;
     font->data = malloc (data_length);
@@ -1799,11 +1814,11 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
 
     status = cff_dict_init (&font->top_dict);
     if (unlikely (status))
-	goto fail6;
+        goto fail6;
 
     status = cff_dict_init (&font->private_dict);
     if (unlikely (status))
-	goto fail7;
+        goto fail7;
 
     cff_index_init (&font->strings_index);
     cff_index_init (&font->charstrings_index);
@@ -1831,7 +1846,7 @@ fail5:
     free (font->widths);
 fail4:
     if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
 fail3:
     free (font->subset_font_name);
 fail2:
@@ -1848,7 +1863,7 @@ cairo_cff_font_destroy (cairo_cff_font_t *font)
 
     free (font->widths);
     if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
     free (font->ps_name);
     free (font->subset_font_name);
     _cairo_array_fini (&font->output);
@@ -1902,7 +1917,7 @@ cairo_cff_font_destroy (cairo_cff_font_t *font)
 
 cairo_status_t
 _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
-                        const char		    *subset_name,
+                        const char                    *subset_name,
                         cairo_scaled_font_subset_t  *font_subset)
 {
     cairo_cff_font_t *font = NULL; /* squelch bogus compiler warning */
@@ -1913,32 +1928,32 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
 
     status = _cairo_cff_font_create (font_subset, &font, subset_name);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cairo_cff_font_generate (font, &data, &length);
     if (unlikely (status))
-	goto fail1;
+        goto fail1;
 
     cff_subset->ps_name = strdup (font->ps_name);
     if (unlikely (cff_subset->ps_name == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail1;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail1;
     }
 
     if (font->font_name) {
-	cff_subset->font_name = strdup (font->font_name);
-	if (cff_subset->font_name == NULL) {
-	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	    goto fail2;
-	}
+        cff_subset->font_name = strdup (font->font_name);
+        if (cff_subset->font_name == NULL) {
+            status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+            goto fail2;
+        }
     } else {
-	cff_subset->font_name = NULL;
+        cff_subset->font_name = NULL;
     }
 
     cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
     if (unlikely (cff_subset->widths == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail3;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail3;
     }
     for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
         cff_subset->widths[i] = (double)font->widths[i]/font->units_per_em;
@@ -1952,8 +1967,8 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
 
     cff_subset->data = malloc (length);
     if (unlikely (cff_subset->data == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail4;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail4;
     }
 
     memcpy (cff_subset->data, data, length);
@@ -1967,7 +1982,7 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
     free (cff_subset->widths);
  fail3:
     if (cff_subset->font_name)
-	free (cff_subset->font_name);
+        free (cff_subset->font_name);
  fail2:
     free (cff_subset->ps_name);
  fail1:
@@ -1981,7 +1996,7 @@ _cairo_cff_subset_fini (cairo_cff_subset_t *subset)
 {
     free (subset->ps_name);
     if (subset->font_name)
-	free (subset->font_name);
+        free (subset->font_name);
     free (subset->widths);
     free (subset->data);
 }
@@ -1996,7 +2011,7 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset
 
     font = calloc (1, sizeof (cairo_cff_font_t));
     if (unlikely (font == NULL))
-	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     font->backend = NULL;
     font->scaled_font_subset = scaled_font_subset;
@@ -2004,18 +2019,18 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset
     _cairo_array_init (&font->output, sizeof (char));
     status = _cairo_array_grow_by (&font->output, 4096);
     if (unlikely (status))
-	goto fail1;
+        goto fail1;
 
     font->subset_font_name = strdup (subset_name);
     if (unlikely (font->subset_font_name == NULL)) {
         status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail1;
+        goto fail1;
     }
 
     font->ps_name = strdup (subset_name);
     if (unlikely (font->ps_name == NULL)) {
         status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        goto fail2;
     }
     font->font_name = NULL;
 
@@ -2038,11 +2053,11 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset
 
     status = cff_dict_init (&font->top_dict);
     if (unlikely (status))
-	goto fail4;
+        goto fail4;
 
     status = cff_dict_init (&font->private_dict);
     if (unlikely (status))
-	goto fail5;
+        goto fail5;
 
     cff_index_init (&font->strings_index);
     cff_index_init (&font->charstrings_index);
@@ -2068,7 +2083,7 @@ fail4:
     free (font->widths);
 fail3:
     if (font->font_name)
-	free (font->font_name);
+        free (font->font_name);
     free (font->ps_name);
 fail2:
     free (font->subset_font_name);
@@ -2105,39 +2120,39 @@ cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,
     end_buf = encode_integer (end_buf, type2_subset->x_max);
     end_buf = encode_integer (end_buf, type2_subset->y_max);
     status = cff_dict_set_operands (font->top_dict,
-	                            FONTBBOX_OP, buf, end_buf - buf);
+                                    FONTBBOX_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     end_buf = encode_integer_max (buf, 0);
     status = cff_dict_set_operands (font->top_dict,
-	                            CHARSTRINGS_OP, buf, end_buf - buf);
+                                    CHARSTRINGS_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            FDSELECT_OP, buf, end_buf - buf);
+                                    FDSELECT_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            FDARRAY_OP, buf, end_buf - buf);
+                                    FDARRAY_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cff_dict_set_operands (font->top_dict,
-	                            CHARSET_OP, buf, end_buf - buf);
+                                    CHARSET_OP, buf, end_buf - buf);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = cairo_cff_font_set_ros_strings (font);
     if (unlikely (status))
-	return status;
+        return status;
 
     /* Create CID FD dictionary */
     status = cairo_cff_font_create_cid_fontdict (font);
     if (unlikely (status))
-	return status;
+        return status;
 
     /* Create charstrings */
     for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
@@ -2163,7 +2178,7 @@ cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,
 
 cairo_status_t
 _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
-                          const char		      *subset_name,
+                          const char                      *subset_name,
                           cairo_scaled_font_subset_t  *font_subset)
 {
     cairo_cff_font_t *font = NULL; /* squelch bogus compiler warning */
@@ -2175,27 +2190,27 @@ _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
 
     status = _cairo_cff_font_fallback_create (font_subset, &font, subset_name);
     if (unlikely (status))
-	return status;
+        return status;
 
     status = _cairo_type2_charstrings_init (&type2_subset, font_subset);
     if (unlikely (status))
-	goto fail1;
+        goto fail1;
 
     status = cairo_cff_font_fallback_generate (font, &type2_subset, &data, &length);
     if (unlikely (status))
-	goto fail2;
+        goto fail2;
 
     cff_subset->font_name = NULL;
     cff_subset->ps_name = strdup (font->ps_name);
     if (unlikely (cff_subset->ps_name == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail2;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail2;
     }
 
     cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
     if (unlikely (cff_subset->widths == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail3;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail3;
     }
 
     for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
@@ -2210,8 +2225,8 @@ _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
 
     cff_subset->data = malloc (length);
     if (unlikely (cff_subset->data == NULL)) {
-	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-	goto fail4;
+        status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+        goto fail4;
     }
 
     memcpy (cff_subset->data, data, length);

gfx/skia/skia/include/core/SkColorPriv.h

@@ -24,15 +24,21 @@
  *  Skia's 32bit backend only supports 1 sizzle order at a time (compile-time).
  *  This is specified by 4 defines SK_A32_SHIFT, SK_R32_SHIFT, ... for G and B.
  *
- *  For easier compatibility with Skia's GPU backend, we further restrict these
- *  to either (in memory-byte-order) RGBA or BGRA. Note that this "order" does
- *  not directly correspond to the same shift-order, since we have to take endianess
- *  into account.
+ *  For easier compatibility with Skia's GPU backend, Skia normally restricts
+ *  these to either (in memory-byte-order) RGBA or BGRA. Mozilla's big-endian
+ *  PowerPC port uses CoreGraphics' native ARGB pixels, so we also accept ARGB.
+ *  Note that this "order" does not directly correspond to the same shift-order,
+ *  since we have to take endianess into account.
  *
  *  Here we enforce this constraint.
  */
 
 #ifdef SK_CPU_BENDIAN
+    #define SK_ARGB_A32_SHIFT   24
+    #define SK_ARGB_R32_SHIFT   16
+    #define SK_ARGB_G32_SHIFT   8
+    #define SK_ARGB_B32_SHIFT   0
+
     #define SK_RGBA_R32_SHIFT   24
     #define SK_RGBA_G32_SHIFT   16
     #define SK_RGBA_B32_SHIFT   8
@@ -43,6 +49,11 @@
     #define SK_BGRA_R32_SHIFT   8
     #define SK_BGRA_A32_SHIFT   0
 #else
+    #define SK_ARGB_A32_SHIFT   0
+    #define SK_ARGB_R32_SHIFT   8
+    #define SK_ARGB_G32_SHIFT   16
+    #define SK_ARGB_B32_SHIFT   24
+
     #define SK_RGBA_R32_SHIFT   0
     #define SK_RGBA_G32_SHIFT   8
     #define SK_RGBA_B32_SHIFT   16
@@ -54,10 +65,18 @@
     #define SK_BGRA_A32_SHIFT   24
 #endif
 
-#if defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)
-    #error "can't define PMCOLOR to be RGBA and BGRA"
+#if (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)) || \
+    (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_ARGB)) || \
+    (defined(SK_PMCOLOR_IS_BGRA) && defined(SK_PMCOLOR_IS_ARGB))
+    #error "can't define PMCOLOR to more than one byte order"
 #endif
 
+#define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB  \
+    (SK_A32_SHIFT == SK_ARGB_A32_SHIFT &&    \
+     SK_R32_SHIFT == SK_ARGB_R32_SHIFT &&    \
+     SK_G32_SHIFT == SK_ARGB_G32_SHIFT &&    \
+     SK_B32_SHIFT == SK_ARGB_B32_SHIFT)
+
 #define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA  \
     (SK_A32_SHIFT == SK_RGBA_A32_SHIFT &&    \
      SK_R32_SHIFT == SK_RGBA_R32_SHIFT &&    \
@@ -76,6 +95,10 @@
 #define SK_G_INDEX  (SK_G32_SHIFT/8)
 #define SK_B_INDEX  (SK_B32_SHIFT/8)
 
+#if defined(SK_PMCOLOR_IS_ARGB) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+    #error "SK_PMCOLOR_IS_ARGB does not match SK_*32_SHIFT values"
+#endif
+
 #if defined(SK_PMCOLOR_IS_RGBA) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
     #error "SK_PMCOLOR_IS_RGBA does not match SK_*32_SHIFT values"
 #endif
@@ -84,19 +107,22 @@
     #error "SK_PMCOLOR_IS_BGRA does not match SK_*32_SHIFT values"
 #endif
 
-#if !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
+#if !defined(SK_PMCOLOR_IS_ARGB) && !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
     // deduce which to define from the _SHIFT defines
 
-    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
+    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+        #define SK_PMCOLOR_IS_ARGB
+    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
         #define SK_PMCOLOR_IS_RGBA
     #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
         #define SK_PMCOLOR_IS_BGRA
     #else
-        #error "need 32bit packing to be either RGBA or BGRA"
+        #error "need 32bit packing to be either ARGB, RGBA, or BGRA"
     #endif
 #endif
 
 // hide these now that we're done
+#undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
 
@@ -131,19 +157,38 @@ static inline uint32_t SkPackARGB_as_BGRA(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
            (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
 }
 
+static inline SkPMColor SkPackARGB_as_PMColor(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
+    SkASSERT_IS_BYTE(a);
+    SkASSERT_IS_BYTE(r);
+    SkASSERT_IS_BYTE(g);
+    SkASSERT_IS_BYTE(b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+}
+
 static inline SkPMColor SkSwizzle_RGBA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_RGBA
     return c;
-#else
+#elif defined(SK_PMCOLOR_IS_BGRA)
     return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_RGBA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_B32_SHIFT) & 0xFF);
 #endif
 }
 
 static inline SkPMColor SkSwizzle_BGRA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_BGRA
     return c;
-#else
+#elif defined(SK_PMCOLOR_IS_RGBA)
     return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_BGRA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_B32_SHIFT) & 0xFF);
 #endif
 }
 
@@ -412,8 +457,7 @@ static inline SkPMColor SkPackARGB32(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
     SkASSERT(g <= a);
     SkASSERT(b <= a);
 
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }
 
 static inline uint32_t SkPackPMColor_as_RGBA(SkPMColor c) {
@@ -547,8 +591,7 @@ static inline SkPMColor SkFastFourByteInterp(SkPMColor src,
  *  values are premultiplied in the debug version.
  */
 static inline SkPMColor SkPackARGB32NoCheck(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }
 
 static inline

gfx/skia/skia/include/core/SkImageInfo.h

@@ -82,8 +82,13 @@ enum SkColorType {
     kN32_SkColorType = kBGRA_8888_SkColorType,
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
     kN32_SkColorType = kRGBA_8888_SkColorType,
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Big-endian PowerPC Mozilla surfaces use native uint32 ARGB memory.
+    // Moz2D's legacy A8R8G8B8_UINT32 format aliases to B8G8R8A8, so keep
+    // kN32 on Skia's BGRA path while the channel shifts above describe ARGB.
+    kN32_SkColorType = kBGRA_8888_SkColorType,
 #else
-    #error "SK_*32_SHFIT values must correspond to BGRA or RGBA byte order"
+    #error "SK_*32_SHIFT values must correspond to BGRA, RGBA, or Mozilla ARGB byte order"
 #endif
 };
 

gfx/skia/skia/include/gpu/GrTypes.h

@@ -275,17 +275,19 @@ enum GrPixelConfig {
 static const int kGrPixelConfigCnt = kLast_GrPixelConfig + 1;
 
 // Aliases for pixel configs that match skia's byte order.
-#ifndef SK_CPU_LENDIAN
-    #error "Skia gpu currently assumes little endian"
-#endif
 #if SK_PMCOLOR_BYTE_ORDER(B,G,R,A)
     static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
     static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
     static const GrPixelConfig kSkia8888_GrPixelConfig = kRGBA_8888_GrPixelConfig;
     static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSRGBA_8888_GrPixelConfig;
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Mozilla's big-endian PowerPC path stores native 32-bit pixels as ARGB,
+    // while Moz2D routes those surfaces through Skia's BGRA color type.
+    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
+    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #else
-    #error "SK_*32_SHIFT values must correspond to GL_BGRA or GL_RGBA format."
+    #error "SK_*32_SHIFT values must correspond to GL_BGRA, GL_RGBA, or Mozilla ARGB format."
 #endif
 
 // Returns true if the pixel config is a GPU-specific compressed format

gfx/skia/skia/src/codec/SkCodecPriv.h

@@ -306,7 +306,11 @@ static inline SkPMColor premultiply_argb_as_bgra(U8CPU a, U8CPU r, U8CPU g, U8CP
         b = SkMulDiv255Round(b, a);
     }
 
+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(a, r, g, b);
+#else
     return SkPackARGB_as_BGRA(a, r, g, b);
+#endif
 }
 
 static inline bool is_rgba(SkColorType colorType) {

gfx/skia/skia/src/core/SkPM4f.h

@@ -51,10 +51,16 @@ struct SkPM4f {
     Sk4f to4f_pmorder() const { return swizzle_rb_if_bgra(this->to4f()); }
 
     SkPMColor toPMColor() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+        Sk4f value = this->to4f();
+        Sk4b bytes = SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f));
+        return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
         Sk4f value = swizzle_rb_if_bgra(this->to4f());
         SkPMColor result;
         SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f)).store(&result);
         return result;
+#endif
     }
 
     void toF16(uint16_t[4]) const;

gfx/skia/skia/src/core/SkPM4fPriv.h

@@ -22,29 +22,50 @@ static inline float get_alpha(const Sk4f& px) {
 
 
 static inline Sk4f Sk4f_fromL32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk4f(SkGetPackedR32(px), SkGetPackedG32(px),
+                SkGetPackedB32(px), SkGetPackedA32(px)) * (1/255.0f);
+#else
     return SkNx_cast<float>(Sk4b::Load(&px)) * (1/255.0f);
+#endif
 }
 
 static inline Sk4f Sk4f_fromS32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return { sk_linear_from_srgb[SkGetPackedR32(px)],
+             sk_linear_from_srgb[SkGetPackedG32(px)],
+             sk_linear_from_srgb[SkGetPackedB32(px)],
+                    (1/255.0f) * SkGetPackedA32(px) };
+#else
     return { sk_linear_from_srgb[(px >>  0) & 0xff],
              sk_linear_from_srgb[(px >>  8) & 0xff],
              sk_linear_from_srgb[(px >> 16) & 0xff],
                     (1/255.0f) * (px >> 24)          };
+#endif
 }
 
 static inline uint32_t Sk4f_toL32(const Sk4f& px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    Sk4b bytes = SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f));
+    return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
     uint32_t l32;
     SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f)).store(&l32);
     return l32;
+#endif
 }
 
 static inline uint32_t Sk4f_toS32(const Sk4f& px) {
     Sk4i  rgb = sk_linear_to_srgb(px),
          srgb = { rgb[0], rgb[1], rgb[2], (int)(255.0f * px[3] + 0.5f) };
 
+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(srgb[3], srgb[0], srgb[1], srgb[2]);
+#else
     uint32_t s32;
     SkNx_cast<uint8_t>(srgb).store(&s32);
     return s32;
+#endif
 }
 
 

gfx/skia/skia/src/core/SkTextBlob.cpp

@@ -121,9 +121,10 @@ SkDEBUGCODE(static const unsigned kRunRecordMagic = 0xb10bcafe;)
 namespace {
 struct RunRecordStorageEquivalent {
     RunFont  fFont;
-    SkPoint  fOffset;
     uint32_t fCount;
-    uint32_t fFlags;
+    SkPoint  fOffset;
+    SkTextBlob::GlyphPositioning fPositioning;
+    bool     fExtended;
     SkDEBUGCODE(unsigned fMagic;)
 };
 }

gfx/skia/skia/src/core/SkXfermode4f.cpp

@@ -44,6 +44,25 @@ static Sk4x4f load_4_srgb(const void* vptr) {
 
     Sk4x4f rgba;
 
+#ifdef SK_PMCOLOR_IS_ARGB
+    rgba.r = { sk_linear_from_srgb[SkGetPackedR32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[3])] };
+
+    rgba.g = { sk_linear_from_srgb[SkGetPackedG32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[3])] };
+
+    rgba.b = { sk_linear_from_srgb[SkGetPackedB32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[3])] };
+
+    rgba.a = SkNx_cast<float>(Sk4i(SkGetPackedA32(ptr[0]), SkGetPackedA32(ptr[1]),
+                                   SkGetPackedA32(ptr[2]), SkGetPackedA32(ptr[3]))) * (1/255.0f);
+#else
     rgba.r = { sk_linear_from_srgb[(ptr[0] >>  0) & 0xff],
                sk_linear_from_srgb[(ptr[1] >>  0) & 0xff],
                sk_linear_from_srgb[(ptr[2] >>  0) & 0xff],
@@ -60,15 +79,28 @@ static Sk4x4f load_4_srgb(const void* vptr) {
                sk_linear_from_srgb[(ptr[3] >> 16) & 0xff] };
 
     rgba.a = SkNx_cast<float>((Sk4i::Load(ptr) >> 24) & 0xff) * (1/255.0f);
+#endif
 
     return rgba;
 }
 
 static void store_4_srgb(void* ptr, const Sk4x4f& p) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    uint32_t* dst = (uint32_t*)ptr;
+    Sk4i r = sk_linear_to_srgb(p.r);
+    Sk4i g = sk_linear_to_srgb(p.g);
+    Sk4i b = sk_linear_to_srgb(p.b);
+    Sk4i a = Sk4f_round(255.0f*p.a);
+    dst[0] = SkPackARGB_as_PMColor(a[0], r[0], g[0], b[0]);
+    dst[1] = SkPackARGB_as_PMColor(a[1], r[1], g[1], b[1]);
+    dst[2] = SkPackARGB_as_PMColor(a[2], r[2], g[2], b[2]);
+    dst[3] = SkPackARGB_as_PMColor(a[3], r[3], g[3], b[3]);
+#else
     ( sk_linear_to_srgb(p.r) <<  0
     | sk_linear_to_srgb(p.g) <<  8
     | sk_linear_to_srgb(p.b) << 16
     | Sk4f_round(255.0f*p.a) << 24).store(ptr);
+#endif
 }
 
 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -391,7 +423,7 @@ SkXfermode::D32Proc SkXfermode::GetD32Proc(SkXfermode* xfer, uint32_t flags) {
 #include "SkColorPriv.h"
 
 static Sk4f lcd16_to_unit_4f(uint16_t rgb) {
-#ifdef SK_PMCOLOR_IS_RGBA
+#if defined(SK_PMCOLOR_IS_RGBA) || defined(SK_PMCOLOR_IS_ARGB)
     Sk4i rgbi = Sk4i(SkGetPackedR16(rgb), SkGetPackedG16(rgb), SkGetPackedB16(rgb), 0);
 #else
     Sk4i rgbi = Sk4i(SkGetPackedB16(rgb), SkGetPackedG16(rgb), SkGetPackedR16(rgb), 0);

gfx/skia/skia/src/gpu/GrDrawTarget.cpp

@@ -251,7 +251,7 @@ bool GrDrawTarget::drawBatches(GrBatchFlushState* flushState) {
             if (currentRT) {
                 static const GrGpuCommandBuffer::LoadAndStoreInfo kBasicLoadStoreInfo
                     { GrGpuCommandBuffer::LoadOp::kLoad,GrGpuCommandBuffer::StoreOp::kStore,
-                      GrColor_ILLEGAL };
+                      static_cast<GrColor>(GrColor_ILLEGAL) };
                 commandBuffer.reset(fGpu->createCommandBuffer(currentRT,
                                                               kBasicLoadStoreInfo,   // Color
                                                               kBasicLoadStoreInfo)); // Stencil

gfx/skia/skia/src/opts/Sk4px_none.h

@@ -69,11 +69,18 @@ inline Sk4px Sk4px::Wide::div255() const {
 }
 
 inline Sk4px Sk4px::alphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], (*this)[ 0], (*this)[ 0], (*this)[ 0],
+                 (*this)[ 4], (*this)[ 4], (*this)[ 4], (*this)[ 4],
+                 (*this)[ 8], (*this)[ 8], (*this)[ 8], (*this)[ 8],
+                 (*this)[12], (*this)[12], (*this)[12], (*this)[12]);
+#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b((*this)[ 3], (*this)[ 3], (*this)[ 3], (*this)[ 3],
                  (*this)[ 7], (*this)[ 7], (*this)[ 7], (*this)[ 7],
                  (*this)[11], (*this)[11], (*this)[11], (*this)[11],
                  (*this)[15], (*this)[15], (*this)[15], (*this)[15]);
+#endif
 }
 
 inline Sk4px Sk4px::Load4Alphas(const SkAlpha a[4]) {
@@ -91,19 +98,33 @@ inline Sk4px Sk4px::Load2Alphas(const SkAlpha a[2]) {
 }
 
 inline Sk4px Sk4px::zeroAlphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b(0, (*this)[ 1], (*this)[ 2], (*this)[ 3],
+                 0, (*this)[ 5], (*this)[ 6], (*this)[ 7],
+                 0, (*this)[ 9], (*this)[10], (*this)[11],
+                 0, (*this)[13], (*this)[14], (*this)[15]);
+#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b((*this)[ 0], (*this)[ 1], (*this)[ 2], 0,
                  (*this)[ 4], (*this)[ 5], (*this)[ 6], 0,
                  (*this)[ 8], (*this)[ 9], (*this)[10], 0,
                  (*this)[12], (*this)[13], (*this)[14], 0);
+#endif
 }
 
 inline Sk4px Sk4px::zeroColors() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], 0,0,0,
+                 (*this)[ 4], 0,0,0,
+                 (*this)[ 8], 0,0,0,
+                 (*this)[12], 0,0,0);
+#else
     static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
     return Sk16b(0,0,0, (*this)[ 3],
                  0,0,0, (*this)[ 7],
                  0,0,0, (*this)[11],
                  0,0,0, (*this)[15]);
+#endif
 }
 
 }  // namespace

gfx/skia/skia/src/opts/SkColorCubeFilter_opts.h

@@ -72,6 +72,10 @@ static void color_cube_filter_span(const SkPMColor src[],
         // color is BGRA (SkColor order), dst is SkPMColor order, so may need to swap R+B.
     #if defined(SK_PMCOLOR_IS_RGBA)
         color = SkNx_shuffle<2,1,0,3>(color);
+    #elif defined(SK_PMCOLOR_IS_ARGB)
+        Sk4b bytes = SkNx_cast<uint8_t>(color);
+        dst[i] = SkPackARGB32NoCheck(a, bytes[2], bytes[1], bytes[0]);
+        continue;
     #endif
         uint8_t* dstBytes = (uint8_t*)(dst+i);
         SkNx_cast<uint8_t>(color).store(dstBytes);

gfx/skia/skia/src/ports/SkFontHost_mac.cpp

@@ -73,7 +73,39 @@ static CFArrayRef SkCTFontManagerCopyAvailableFontFamilyNames() {
 #ifdef SK_BUILD_FOR_IOS
     return CFArrayCreate(nullptr, nullptr, 0, nullptr);
 #else
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
     return CTFontManagerCopyAvailableFontFamilyNames();
+#else
+    CFMutableArrayRef familyNames =
+            CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+    if (!familyNames) {
+        return nullptr;
+    }
+
+    ATSFontFamilyIterator iterator;
+    OSStatus status = ATSFontFamilyIteratorCreate(kATSFontContextGlobal,
+                                                  nullptr,
+                                                  nullptr,
+                                                  kATSOptionFlagsDefaultScope,
+                                                  &iterator);
+    if (status != noErr) {
+        CFRelease(familyNames);
+        return nullptr;
+    }
+
+    ATSFontFamilyRef family;
+    while (ATSFontFamilyIteratorNext(iterator, &family) == noErr) {
+        CFStringRef familyName = nullptr;
+        if (ATSFontFamilyGetName(family, kATSOptionFlagsDefault, &familyName) == noErr &&
+            familyName) {
+            CFArrayAppendValue(familyNames, familyName);
+            CFRelease(familyName);
+        }
+    }
+
+    ATSFontFamilyIteratorRelease(&iterator);
+    return familyNames;
+#endif
 #endif
 }
 
@@ -908,6 +940,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
 
         // Skia handles quantization and subpixel positioning,
         // so disable quantization and enabe subpixel positioning in CG.
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
         CGContextSetAllowsFontSubpixelQuantization(fCG, false);
         CGContextSetShouldSubpixelQuantizeFonts(fCG, false);
 
@@ -916,6 +949,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
         // then CG cannot draw the glyph in the correct location without subpixel positioning.
         CGContextSetAllowsFontSubpixelPositioning(fCG, true);
         CGContextSetShouldSubpixelPositionFonts(fCG, true);
+#endif
 
         CGContextSetTextDrawingMode(fCG, kCGTextFill);
 
@@ -971,7 +1005,13 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
     // So always make the font transform identity and place the transform on the context.
     point = CGPointApplyAffineTransform(point, context.fInvTransform);
 
+#if defined(MAC_OS_X_VERSION_10_7) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7)
     CTFontDrawGlyphs(context.fCTFont, &glyphID, &point, 1, fCG);
+#else
+    CGContextSetFont(fCG, CTFontCopyGraphicsFont(context.fCTFont, NULL));
+    CGContextSetFontSize(fCG, CTFontGetSize(context.fCTFont));
+    CGContextShowGlyphsAtPositions(fCG, &glyphID, &point, 1);
+#endif
 
     SkASSERT(rowBytesPtr);
     *rowBytesPtr = rowBytes;
@@ -1682,6 +1722,7 @@ SkAdvancedTypefaceMetrics* SkTypeface_Mac::onGetAdvancedTypefaceMetrics(
 
 static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
     CTFontRef ctFont = typeface->fFontRef.get();
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
     AutoCFRelease<CFNumberRef> fontFormatRef(
             static_cast<CFNumberRef>(CTFontCopyAttribute(ctFont, kCTFontFormatAttribute)));
     if (!fontFormatRef) {
@@ -1711,6 +1752,35 @@ static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
             //Just the presence of the FontForge 'FFTM' table seems to throw it off.
             return SkSFNTHeader::fontType_WindowsTrueType::TAG;
     }
+#else
+    AutoCFRelease<CFStringRef> postScriptName(CTFontCopyPostScriptName(ctFont));
+    if (!postScriptName) {
+        return 0;
+    }
+
+    ATSFontRef atsFont =
+            ATSFontFindFromPostScriptName(postScriptName, kATSOptionFlagsDefault);
+    if (atsFont == kInvalidFont) {
+        return 0;
+    }
+
+    SkSFNTHeader header;
+    ByteCount headerSize = sizeof(header);
+    if (ATSFontGetTableDirectory(atsFont, headerSize, &header, &headerSize) != noErr ||
+        headerSize < sizeof(header.fontType)) {
+        return 0;
+    }
+
+    switch (header.fontType) {
+        case SkSFNTHeader::fontType_OpenTypeCFF::TAG:
+        case SkSFNTHeader::fontType_WindowsTrueType::TAG:
+        case SkSFNTHeader::fontType_MacTrueType::TAG:
+        case SkSFNTHeader::fontType_PostScript::TAG:
+            return header.fontType;
+        default:
+            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
+    }
+#endif
 }
 
 SkStreamAsset* SkTypeface_Mac::onOpenStream(int* ttcIndex) const {

js/src/jit-test/tests/ion/bug1106171-sink.js

@@ -1,4 +1,3 @@
-// |jit-test| --ion-sink=on
 // Sink Algorithm should not move instruction into merge blocks
 // which have no corresponding pc.
 

js/src/jit/CodeGenerator.cpp

@@ -2439,7 +2439,7 @@ static const VMFunction GetOrCreateModuleMetaObjectInfo =
 void
 CodeGenerator::visitModuleMetadata(LModuleMetadata* lir)
 {
-    pushArg(ImmPtr(lir->mir()->module()));
+    pushArg(ImmGCPtr(lir->mir()->module()));
     callVM(GetOrCreateModuleMetaObjectInfo, lir);
 }
 
@@ -8185,7 +8185,7 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleT(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleT> || std::is_same_v<T, LFallibleStoreElementT>,
                   "emitStoreElementHoleT called with unexpected argument type");
 
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -8244,7 +8244,7 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleV(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleV> || std::is_same_v<T, LFallibleStoreElementV>,
                   "emitStoreElementHoleV called with unexpected parameter type");
 
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);

js/src/jit/IonOptimizationLevels.cpp

@@ -34,7 +34,6 @@ OptimizationInfo::initNormalOptimizationInfo()
     rangeAnalysis_ = true;
     reordering_ = true;
     sincos_ = true;
-    sink_ = true;
 
     registerAllocator_ = RegisterAllocator_Backtracking;
 
@@ -69,7 +68,6 @@ OptimizationInfo::initWasmOptimizationInfo()
     eliminateRedundantChecks_ = false;
     scalarReplacement_ = false;        // wasm has no objects.
     sincos_ = false;
-    sink_ = false;
 }
 
 uint32_t

js/src/jit/IonOptimizationLevels.h

@@ -86,9 +86,6 @@ class OptimizationInfo
     // Toggles whether sincos is used.
     bool sincos_;
 
-    // Toggles whether sink is used.
-    bool sink_;
-
     // Describes which register allocator to use.
     IonRegisterAllocator registerAllocator_;
 
@@ -194,10 +191,6 @@ class OptimizationInfo
         return sincos_ && !JitOptions.disableSincos;
     }
 
-    bool sinkEnabled() const {
-        return sink_ && !JitOptions.disableSink;
-    }
-
     bool eaaEnabled() const {
         return eaa_ && !JitOptions.disableEaa;
     }

js/src/jit/JitOptions.cpp

@@ -130,9 +130,6 @@ DefaultJitOptions::DefaultJitOptions()
         SET_DEFAULT(disableSincos, true);
     #endif
 
-    // Toggles whether sink code motion is globally disabled.
-    SET_DEFAULT(disableSink, true);
-
     // Whether functions are compiled immediately.
     SET_DEFAULT(eagerCompilation, false);
 

js/src/jit/JitOptions.h

@@ -63,7 +63,6 @@ struct DefaultJitOptions
     bool disableCacheIR;
     bool disableSharedStubs;
     bool disableSincos;
-    bool disableSink;
     bool eagerCompilation;
     bool forceInlineCaches;
     bool limitScriptSize;

js/src/jit/Sink.cpp

@@ -44,9 +44,6 @@ CommonDominator(MBasicBlock* commonDominator, MBasicBlock* defBlock)
 bool
 Sink(MIRGenerator* mir, MIRGraph& graph)
 {
-    TempAllocator& alloc = graph.alloc();
-    bool sinkEnabled = mir->optimizationInfo().sinkEnabled();
-
     for (PostorderIterator block = graph.poBegin(); block != graph.poEnd(); block++) {
         if (mir->shouldCancel("Sink"))
             return false;
@@ -106,125 +103,6 @@ Sink(MIRGenerator* mir, MIRGraph& graph)
                 JitSpewDef(JitSpew_Sink, "  No live uses, recover the instruction on bailout\n", ins);
                 continue;
             }
-
-            // This guard is temporarly moved here as the above code deals with
-            // Dead Code elimination, which got moved into this Sink phase, as
-            // the Dead Code elimination used to move instructions with no-live
-            // uses to the bailout path.
-            if (!sinkEnabled)
-                continue;
-
-            // To move an effectful instruction, we would have to verify that the
-            // side-effect is not observed. In the mean time, we just inhibit
-            // this optimization on effectful instructions.
-            if (ins->isEffectful())
-                continue;
-
-            // If all the uses are under a loop, we might not want to work
-            // against LICM by moving everything back into the loop, but if the
-            // loop is it-self inside an if, then we still want to move the
-            // computation under this if statement.
-            while (block->loopDepth() < usesDominator->loopDepth()) {
-                MOZ_ASSERT(usesDominator != usesDominator->immediateDominator());
-                usesDominator = usesDominator->immediateDominator();
-            }
-
-            // Only move instructions if there is a branch between the dominator
-            // of the uses and the original instruction. This prevent moving the
-            // computation of the arguments into an inline function if there is
-            // no major win.
-            MBasicBlock* lastJoin = usesDominator;
-            while (*block != lastJoin && lastJoin->numPredecessors() == 1) {
-                MOZ_ASSERT(lastJoin != lastJoin->immediateDominator());
-                MBasicBlock* next = lastJoin->immediateDominator();
-                if (next->numSuccessors() > 1)
-                    break;
-                lastJoin = next;
-            }
-            if (*block == lastJoin)
-                continue;
-
-            // Skip to the next instruction if we cannot find a common dominator
-            // for all the uses of this instruction, or if the common dominator
-            // correspond to the block of the current instruction.
-            if (!usesDominator || usesDominator == *block)
-                continue;
-
-            // Only instruction which can be recovered on bailout and which are
-            // sinkable can be moved into blocks which are below while filling
-            // the resume points with a clone which is recovered on bailout.
-
-            // If the instruction has live uses and if it is clonable, then we
-            // can clone the instruction for all non-dominated uses and move the
-            // instruction into the block which is dominating all live uses.
-            if (!ins->canClone())
-                continue;
-
-            // If the block is a split-edge block, which is created for folding
-            // test conditions, then the block has no resume point and has
-            // multiple predecessors.  In such case, we cannot safely move
-            // bailing instruction to these blocks as we have no way to bailout.
-            if (!usesDominator->entryResumePoint() && usesDominator->numPredecessors() != 1)
-                continue;
-
-            JitSpewDef(JitSpew_Sink, "  Can Clone & Recover, sink instruction\n", ins);
-            JitSpew(JitSpew_Sink, "  into Block %u", usesDominator->id());
-
-            // Copy the arguments and clone the instruction.
-            MDefinitionVector operands(alloc);
-            for (size_t i = 0, end = ins->numOperands(); i < end; i++) {
-                if (!operands.append(ins->getOperand(i)))
-                    return false;
-            }
-
-            MInstruction* clone = ins->clone(alloc, operands);
-            ins->block()->insertBefore(ins, clone);
-            clone->setRecoveredOnBailout();
-
-            // We should not update the producer of the entry resume point, as
-            // it cannot refer to any instruction within the basic block excepts
-            // for Phi nodes.
-            MResumePoint* entry = usesDominator->entryResumePoint();
-
-            // Replace the instruction by its clone in all the resume points /
-            // recovered-on-bailout instructions which are not in blocks which
-            // are dominated by the usesDominator block.
-            for (MUseIterator i(ins->usesBegin()), e(ins->usesEnd()); i != e; ) {
-                MUse* use = *i++;
-                MNode* consumer = use->consumer();
-
-                // If the consumer is a Phi, then we look for the index of the
-                // use to find the corresponding predecessor block, which is
-                // then used as the consumer block.
-                MBasicBlock* consumerBlock = consumer->block();
-                if (consumer->isDefinition() && consumer->toDefinition()->isPhi()) {
-                    consumerBlock = consumerBlock->getPredecessor(
-                        consumer->toDefinition()->toPhi()->indexOf(use));
-                }
-
-                // Keep the current instruction for all dominated uses, except
-                // for the entry resume point of the block in which the
-                // instruction would be moved into.
-                if (usesDominator->dominates(consumerBlock) &&
-                    (!consumer->isResumePoint() || consumer->toResumePoint() != entry))
-                {
-                    continue;
-                }
-
-                use->replaceProducer(clone);
-            }
-
-            // As we move this instruction in a different block, we should
-            // verify that we do not carry over a resume point which would refer
-            // to an outdated state of the control flow.
-            if (ins->resumePoint())
-                ins->clearResumePoint();
-
-            // Now, that all uses which are not dominated by usesDominator are
-            // using the cloned instruction, we can safely move the instruction
-            // into the usesDominator block.
-            MInstruction* at = usesDominator->safeInsertTop(nullptr, MBasicBlock::IgnoreRecover);
-            block->moveBefore(at, ins);
         }
     }
 

js/src/jsgc.cpp

@@ -4761,11 +4761,14 @@ GCRuntime::sweepFinalizationRegistries()
             if (!obj || !obj->is<FinalizationRegistryObject>()) {
                 zone->finalizationRegistries.erase(zone->finalizationRegistries.begin() + i);
                 continue;
-            }
-
-            obj->as<FinalizationRegistryObject>().sweepAfterGC(rt);
+            } 
             i++;
         }
+        for (size_t i = 0; i < zone->finalizationRegistries.length(); i++) {
+            JSObject* obj = zone->finalizationRegistries[i].unbarrieredGet();
+            obj->as<FinalizationRegistryObject>().sweepAfterGC(rt);
+        }
+        zone->finalizationRegistries.clear();
     }
 }
 

js/src/jsstr.cpp

@@ -2871,8 +2871,8 @@ static JSString* ReplaceAll(JSContext* cx, JSLinearString* str,
 
     // Step 13.
     StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-      std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+      std::is_same_v<RepChar, char16_t>) {
         if (!result.ensureTwoByteChars()) {
           return nullptr;
         }
@@ -2954,8 +2954,8 @@ static JSString* ReplaceAllInterleave(JSContext* cx, JSLinearString* str,
 
     // Step 13.
     StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-        std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+        std::is_same_v<RepChar, char16_t>) {
         if (!result.ensureTwoByteChars()) {
             return nullptr;
         }

js/src/shell/js.cpp

@@ -7709,15 +7709,6 @@ SetContextOptions(JSContext* cx, const OptionParser& op)
             return OptionFailure("ion-sincos", str);
     }
 
-    if (const char* str = op.getStringOption("ion-sink")) {
-        if (strcmp(str, "on") == 0)
-            jit::JitOptions.disableSink = false;
-        else if (strcmp(str, "off") == 0)
-            jit::JitOptions.disableSink = true;
-        else
-            return OptionFailure("ion-sink", str);
-    }
-
     if (const char* str = op.getStringOption("ion-loop-unrolling")) {
         if (strcmp(str, "on") == 0)
             jit::JitOptions.disableLoopUnrolling = false;
@@ -8093,8 +8084,6 @@ main(int argc, char** argv, char** envp)
         || !op.addStringOption('\0', "ion-sincos", "on/off",
                                "Replace sin(x)/cos(x) to sincos(x) (default: off, on to enable)")
 #endif
-        || !op.addStringOption('\0', "ion-sink", "on/off",
-                               "Sink code motion (default: off, on to enable)")
         || !op.addStringOption('\0', "ion-loop-unrolling", "on/off",
                                "Loop unrolling (default: off, on to enable)")
         || !op.addStringOption('\0', "ion-instruction-reordering", "on/off",

js/src/vm/CharacterEncoding.cpp

@@ -309,26 +309,26 @@ InflateUTF8StringToBuffer(ContextT* cx, const UTF8Chars src, CharT* dst, size_t*
             while (v & (0x80 >> n))
                 n++;
 
-        #define INVALID(report, arg, n2)                                \
-            do {                                                        \
-                if (Action == CountAndReportInvalids) {                 \
-                    report(cx, arg);                                    \
-                    return false;                                       \
-                } else if (Action == AssertNoInvalids) {                \
-                    MOZ_CRASH("invalid UTF-8 string: " # report);       \
-                } else {                                                \
-                    if (Action == Copy) {                               \
-                        if (std::is_same<decltype(dst[0]), Latin1Char>::value) \
-                            dst[j] = CharT(REPLACE_UTF8_LATIN1);        \
-                        else                                            \
-                            dst[j] = CharT(REPLACE_UTF8);               \
-                    } else {                                            \
-                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||  \
-                                   Action == FindEncoding);             \
-                    }                                                   \
-                    n = n2;                                             \
-                    goto invalidMultiByteCodeUnit;                      \
-                }                                                       \
+        #define INVALID(report, arg, n2)                                  \
+            do {                                                          \
+                if (Action == CountAndReportInvalids) {                   \
+                    report(cx, arg);                                      \
+                    return false;                                         \
+                } else if (Action == AssertNoInvalids) {                  \
+                    MOZ_CRASH("invalid UTF-8 string: " # report);         \
+                } else {                                                  \
+                    if (Action == Copy) {                                 \
+                        if (std::is_same_v<decltype(dst[0]), Latin1Char>) \
+                            dst[j] = CharT(REPLACE_UTF8_LATIN1);          \
+                        else                                              \
+                            dst[j] = CharT(REPLACE_UTF8);                 \
+                    } else {                                              \
+                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||    \
+                                   Action == FindEncoding);               \
+                    }                                                     \
+                    n = n2;                                               \
+                    goto invalidMultiByteCodeUnit;                        \
+                }                                                         \
             } while (0)
 
             // Check the leading byte.

js/src/vm/String.h

@@ -1138,7 +1138,7 @@ class StaticStrings
     }
 
     template <typename CharT,
-              typename = typename std::enable_if<!std::is_const<CharT>::value>::type>
+              typename = typename std::enable_if_t<!std::is_const_v<CharT>>>
     MOZ_ALWAYS_INLINE JSAtom* lookup(CharT* chars, size_t length) {
         // Collapse the remaining |CharT*| to |const CharT*| to avoid excess
         // instantiations.

js/src/vm/TypedArrayCommon.h

@@ -677,12 +677,12 @@ class ElementSpecific
             return true;
         }
 
-        if (std::is_same<T, int64_t>::value) {
+        if (std::is_same_v<T, int64_t>) {
             JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigInt64(cx, v));
             return true;
         }
 
-        if (std::is_same<T, uint64_t>::value) {
+        if (std::is_same_v<T, uint64_t>) {
             JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigUint64(cx, v));
             return true;
         }

layout/inspector/inDOMUtils.cpp

@@ -953,11 +953,12 @@ inDOMUtils::GetCSSValuesForProperty(const nsAString& aProperty,
       GetOtherValuesForProperty(propertyParserVariant, array);
     }
   }
-  // All CSS properties take initial, inherit, unset, and revert.
+  // All CSS properties take initial, inherit, unset, revert, and revert-layer.
   InsertNoDuplicates(array, NS_LITERAL_STRING("initial"));
   InsertNoDuplicates(array, NS_LITERAL_STRING("inherit"));
   InsertNoDuplicates(array, NS_LITERAL_STRING("unset"));
   InsertNoDuplicates(array, NS_LITERAL_STRING("revert"));
+  InsertNoDuplicates(array, NS_LITERAL_STRING("revert-layer"));
 
   *aLength = array.Length();
   char16_t** ret =

layout/style/CSSVariableDeclarations.cpp

@@ -8,19 +8,227 @@
 #include "CSSVariableDeclarations.h"
 
 #include "CSSVariableResolver.h"
+#include "CSSVariableValues.h"
 #include "nsCSSScanner.h"
 #include "nsRuleData.h"
 
-// These four special string values are used to represent specified values of
-// 'initial', 'inherit', 'unset', and 'revert'.  (Note that none of these are
-// valid variable values.)
+// These special string values are used to represent specified values of
+// CSS-wide keywords.  (Note that none of these are valid variable values.)
 #define INITIAL_VALUE "!"
 #define INHERIT_VALUE ";"
 #define UNSET_VALUE   ")"
 #define REVERT_VALUE  ">"
+#define REVERT_LAYER_VALUE  "]"
+
+static const int32_t kRevertLayerMask = 0x000fffff;
+static const int32_t kRevertLayerImportant = 0x00100000;
+static const int32_t kRevertLayerOriginShift = 21;
+static const int32_t kLayerIndexMax = 0x000fffff;
+static const int32_t kCascadeRankStride = kLayerIndexMax + 1;
 
 namespace mozilla {
 
+static bool
+IsRevertLayerValue(const nsString& aValue)
+{
+  return StringBeginsWith(aValue, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
+}
+
+static bool
+ValueMightResolveToRevertLayer(const nsString& aValue)
+{
+  return IsRevertLayerValue(aValue) ||
+         aValue.Find(NS_LITERAL_STRING("revert-layer")) != kNotFound;
+}
+
+static int32_t
+PackRevertLayerData(SheetType aLevel, bool aIsImportant,
+                    int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask);
+  return (uint32_t(aLevel) << kRevertLayerOriginShift) |
+         (aIsImportant ? kRevertLayerImportant : 0) |
+         (aLayerIndex & kRevertLayerMask);
+}
+
+static void
+SetRevertLayerData(nsString& aValue, const nsRuleData* aRuleData)
+{
+  aValue.AssignLiteral(REVERT_LAYER_VALUE);
+  aValue.AppendInt(PackRevertLayerData(aRuleData->mLevel,
+                                       aRuleData->mIsImportantRule,
+                                       aRuleData->mLayerIndex));
+}
+
+static bool
+UnpackRevertLayerData(const nsString& aValue, SheetType& aLevel,
+                      bool& aIsImportant, int32_t& aLayerIndex)
+{
+  if (!IsRevertLayerValue(aValue) ||
+      aValue.Length() == NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()) {
+    return false;
+  }
+
+  nsresult rv;
+  nsAutoString metadata;
+  metadata.Assign(Substring(aValue,
+                            NS_LITERAL_STRING(REVERT_LAYER_VALUE).Length()));
+  int32_t packed = metadata.ToInteger(&rv);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  aLevel = SheetType(uint32_t(packed) >> kRevertLayerOriginShift);
+  aIsImportant = (packed & kRevertLayerImportant) != 0;
+  aLayerIndex = packed & kRevertLayerMask;
+  return true;
+}
+
+static int32_t
+LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0);
+  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
+  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
+}
+
+static int32_t
+CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
+                      int32_t aLayerIndex)
+{
+  int32_t bucket = 0;
+  bool isLayeredOrigin = false;
+
+  switch (aLevel) {
+    case SheetType::Agent:
+      bucket = aIsImportant ? 14 : 0;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::User:
+      bucket = aIsImportant ? 13 : 1;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::PresHint:
+      bucket = 2;
+      break;
+    case SheetType::SVGAttrAnimation:
+      bucket = 3;
+      break;
+    case SheetType::Doc:
+      bucket = aIsImportant ? 10 : 4;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::ScopedDoc:
+      bucket = aIsImportant ? 9 : 5;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::StyleAttr:
+      bucket = aIsImportant ? 11 : 6;
+      break;
+    case SheetType::Override:
+      bucket = aIsImportant ? 12 : 7;
+      break;
+    case SheetType::Animation:
+      bucket = 8;
+      break;
+    case SheetType::Transition:
+      bucket = 15;
+      break;
+    default:
+      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
+      break;
+  }
+
+  return bucket * kCascadeRankStride +
+         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
+}
+
+static bool
+ShouldIgnoreForRevertLayerData(SheetType aSourceLevel,
+                               bool aSourceImportant,
+                               int32_t aSourceLayerIndex,
+                               SheetType aCandidateLevel,
+                               bool aCandidateImportant,
+                               int32_t aCandidateLayerIndex)
+{
+  int32_t candidateRank =
+    CascadePrecedenceRank(aCandidateLevel, aCandidateImportant,
+                          aCandidateLayerIndex);
+  int32_t sourceRank =
+    CascadePrecedenceRank(aSourceLevel, aSourceImportant, aSourceLayerIndex);
+
+  if (candidateRank >= sourceRank) {
+    return true;
+  }
+
+  if (!aSourceImportant) {
+    return false;
+  }
+
+  if (aSourceLevel == SheetType::StyleAttr) {
+    return aCandidateLevel == SheetType::StyleAttr ||
+           aCandidateLevel == SheetType::Animation;
+  }
+
+  int32_t normalBoundary =
+    CascadePrecedenceRank(aSourceLevel, false, aSourceLayerIndex);
+  return candidateRank >= normalBoundary;
+}
+
+static bool
+ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
+                                SheetType aCandidateLevel,
+                                bool aCandidateImportant,
+                                int32_t aCandidateLayerIndex)
+{
+  SheetType sourceLevel;
+  bool sourceImportant;
+  int32_t sourceLayerIndex;
+  if (!UnpackRevertLayerData(aTargetValue, sourceLevel, sourceImportant,
+                             sourceLayerIndex)) {
+    return false;
+  }
+
+  return ShouldIgnoreForRevertLayerData(sourceLevel, sourceImportant,
+                                        sourceLayerIndex, aCandidateLevel,
+                                        aCandidateImportant,
+                                        aCandidateLayerIndex);
+}
+
+static bool
+ShouldIgnoreForRevertLayerValue(const nsString& aTargetValue,
+                                const nsRuleData* aRuleData)
+{
+  return ShouldIgnoreForRevertLayerValue(aTargetValue, aRuleData->mLevel,
+                                         aRuleData->mIsImportantRule,
+                                         aRuleData->mLayerIndex);
+}
+
+static bool
+ShouldIgnoreForRevertLayerSourceValue(const nsString& aTargetValue,
+                                      const nsString& aCandidateValue)
+{
+  SheetType candidateLevel;
+  bool candidateImportant;
+  int32_t candidateLayerIndex;
+  if (!UnpackRevertLayerData(aCandidateValue, candidateLevel,
+                             candidateImportant, candidateLayerIndex)) {
+    return false;
+  }
+
+  return ShouldIgnoreForRevertLayerValue(aTargetValue, candidateLevel,
+                                         candidateImportant,
+                                         candidateLayerIndex);
+}
+
+static bool
+IsComputedRevertLayerValue(const nsString& aValue)
+{
+  nsAutoString trimmed(aValue);
+  trimmed.CompressWhitespace(true, true);
+  return trimmed.EqualsLiteral("revert-layer");
+}
+
 CSSVariableDeclarations::CSSVariableDeclarations()
 {
   MOZ_COUNT_CTOR(CSSVariableDeclarations);
@@ -47,6 +255,8 @@ CSSVariableDeclarations::operator=(const CSSVariableDeclarations& aOther)
   }
 
   mVariables.Clear();
+  mRevertLayerSources.Clear();
+  mRevertLayerFallbacks.Clear();
   CopyVariablesFrom(aOther);
   return *this;
 }
@@ -57,6 +267,15 @@ CSSVariableDeclarations::CopyVariablesFrom(const CSSVariableDeclarations& aOther
   for (auto iter = aOther.mVariables.ConstIter(); !iter.Done(); iter.Next()) {
     mVariables.Put(iter.Key(), iter.UserData());
   }
+  for (auto iter = aOther.mRevertLayerSources.ConstIter();
+       !iter.Done(); iter.Next()) {
+    mRevertLayerSources.Put(iter.Key(), iter.UserData());
+  }
+  for (auto iter = aOther.mRevertLayerFallbacks.ConstIter();
+       !iter.Done(); iter.Next()) {
+    RevertLayerFallbackList* list = mRevertLayerFallbacks.LookupOrAdd(iter.Key());
+    list->mItems = iter.UserData()->mItems;
+  }
 }
 
 bool
@@ -87,6 +306,9 @@ CSSVariableDeclarations::Get(const nsAString& aName,
   } else if (value.EqualsLiteral(REVERT_VALUE)) {
     aType = eRevert;
     aTokenStream.Truncate();
+  } else if (IsRevertLayerValue(value)) {
+    aType = eRevertLayer;
+    aTokenStream.Truncate();
   } else {
     aType = eTokenStream;
     aTokenStream = value;
@@ -101,7 +323,8 @@ CSSVariableDeclarations::PutTokenStream(const nsAString& aName,
   MOZ_ASSERT(!aTokenStream.EqualsLiteral(INITIAL_VALUE) &&
              !aTokenStream.EqualsLiteral(INHERIT_VALUE) &&
              !aTokenStream.EqualsLiteral(UNSET_VALUE) &&
-             !aTokenStream.EqualsLiteral(REVERT_VALUE));
+             !aTokenStream.EqualsLiteral(REVERT_VALUE) &&
+             !aTokenStream.EqualsLiteral(REVERT_LAYER_VALUE));
   mVariables.Put(aName, aTokenStream);
 }
 
@@ -129,6 +352,12 @@ CSSVariableDeclarations::PutRevert(const nsAString& aName)
   mVariables.Put(aName, NS_LITERAL_STRING(REVERT_VALUE));
 }
 
+void
+CSSVariableDeclarations::PutRevertLayer(const nsAString& aName)
+{
+  mVariables.Put(aName, NS_LITERAL_STRING(REVERT_LAYER_VALUE));
+}
+
 void
 CSSVariableDeclarations::Remove(const nsAString& aName)
 {
@@ -143,16 +372,49 @@ CSSVariableDeclarations::MapRuleInfoInto(nsRuleData* aRuleData)
   }
 
   if (!aRuleData->mVariables) {
-    aRuleData->mVariables = new CSSVariableDeclarations(*this);
-  } else {
-    for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
-      nsDataHashtable<nsStringHashKey, nsString>& variables =
-        aRuleData->mVariables->mVariables;
-      const nsAString& aName = iter.Key();
-      if (!variables.Contains(aName)) {
-        variables.Put(aName, iter.UserData());
+    aRuleData->mVariables = new CSSVariableDeclarations;
+  }
+
+  for (auto iter = mVariables.Iter(); !iter.Done(); iter.Next()) {
+    nsDataHashtable<nsStringHashKey, nsString>& variables =
+      aRuleData->mVariables->mVariables;
+    const nsAString& name = iter.Key();
+    nsString value = iter.UserData();
+    nsString valueSource;
+    SetRevertLayerData(valueSource, aRuleData);
+    if (value.EqualsLiteral(REVERT_LAYER_VALUE)) {
+      value = valueSource;
+      aRuleData->mConditions.SetUncacheable();
+    }
+
+    nsString existingValue;
+    if (variables.Get(name, &existingValue)) {
+      if (IsRevertLayerValue(existingValue)) {
+        if (ShouldIgnoreForRevertLayerValue(existingValue, aRuleData)) {
+          continue;
+        }
+      } else {
+        nsString sourceValue;
+        if (aRuleData->mVariables->mRevertLayerSources.Get(name,
+                                                           &sourceValue) &&
+            !ShouldIgnoreForRevertLayerValue(sourceValue, aRuleData)) {
+          RevertLayerFallbackList* fallbacks =
+            aRuleData->mVariables->mRevertLayerFallbacks.LookupOrAdd(name);
+          RevertLayerFallback* fallback = fallbacks->mItems.AppendElement();
+          fallback->mValue = value;
+          fallback->mSource = valueSource;
+        }
+        continue;
       }
     }
+
+    variables.Put(name, value);
+    if (ValueMightResolveToRevertLayer(value)) {
+      aRuleData->mVariables->mRevertLayerSources.Put(name, valueSource);
+    } else {
+      aRuleData->mVariables->mRevertLayerSources.Remove(name);
+      aRuleData->mVariables->mRevertLayerFallbacks.Remove(name);
+    }
   }
 }
 
@@ -172,8 +434,9 @@ CSSVariableDeclarations::AddVariablesToResolver(
                      false);
     } else if (value.EqualsLiteral(INHERIT_VALUE) ||
                value.EqualsLiteral(UNSET_VALUE) ||
-               value.EqualsLiteral(REVERT_VALUE)) {
-      // Values of 'inherit', 'unset', and 'revert' don't need any handling,
+               value.EqualsLiteral(REVERT_VALUE) ||
+               IsRevertLayerValue(value)) {
+      // Values of 'inherit', 'unset', 'revert', and 'revert-layer' don't need any handling,
       // since it means we just need to keep whatever value is currently in
       // the resolver.  This is because the specified variable declarations
       // already have only the winning declaration for the variable and no
@@ -190,6 +453,83 @@ CSSVariableDeclarations::AddVariablesToResolver(
   }
 }
 
+void
+CSSVariableDeclarations::ResolveRevertLayerFallbacks(
+                                             const CSSVariableValues* aInherited,
+                                             CSSVariableValues* aOutput) const
+{
+  for (auto iter = mRevertLayerSources.ConstIter();
+       !iter.Done(); iter.Next()) {
+    const nsAString& name = iter.Key();
+    nsString value;
+    nsCSSTokenSerializationType firstToken, lastToken;
+    if (!aOutput->Get(name, value, firstToken, lastToken)) {
+      continue;
+    }
+
+    if (!IsComputedRevertLayerValue(value)) {
+      continue;
+    }
+
+    const RevertLayerFallbackList* fallbacks = mRevertLayerFallbacks.Get(name);
+    if (fallbacks) {
+      nsString sourceValue = iter.UserData();
+      bool foundFallback = false;
+      for (uint32_t i = 0, n = fallbacks->mItems.Length(); i < n; i++) {
+        const RevertLayerFallback& fallback = fallbacks->mItems[i];
+        if (ShouldIgnoreForRevertLayerSourceValue(sourceValue,
+                                                 fallback.mSource)) {
+          continue;
+        }
+
+        if (IsRevertLayerValue(fallback.mValue)) {
+          sourceValue = fallback.mSource;
+          continue;
+        }
+
+        CSSVariableValues inheritedValues(*aOutput);
+        if (aInherited->Get(name, value, firstToken, lastToken)) {
+          inheritedValues.Put(name, value, firstToken, lastToken);
+        } else {
+          inheritedValues.Remove(name);
+        }
+
+        CSSVariableDeclarations fallbackDeclarations;
+        fallbackDeclarations.mVariables.Put(name, fallback.mValue);
+
+        CSSVariableValues fallbackValues;
+        CSSVariableResolver resolver(&fallbackValues);
+        resolver.Resolve(&inheritedValues, &fallbackDeclarations);
+
+        if (!fallbackValues.Get(name, value, firstToken, lastToken)) {
+          aOutput->Remove(name);
+          foundFallback = true;
+          break;
+        }
+
+        if (IsComputedRevertLayerValue(value)) {
+          sourceValue = fallback.mSource;
+          continue;
+        }
+
+        aOutput->Put(name, value, firstToken, lastToken);
+        foundFallback = true;
+        break;
+      }
+
+      if (foundFallback) {
+        continue;
+      }
+    }
+
+    if (aInherited->Get(name, value, firstToken, lastToken)) {
+      aOutput->Put(name, value, firstToken, lastToken);
+    } else {
+      aOutput->Remove(name);
+    }
+  }
+}
+
 size_t
 CSSVariableDeclarations::SizeOfIncludingThis(
                                       mozilla::MallocSizeOf aMallocSizeOf) const
@@ -200,6 +540,22 @@ CSSVariableDeclarations::SizeOfIncludingThis(
     n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
     n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
   }
+  n += mRevertLayerSources.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  for (auto iter = mRevertLayerSources.ConstIter(); !iter.Done(); iter.Next()) {
+    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    n += iter.Data().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+  }
+  n += mRevertLayerFallbacks.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  for (auto iter = mRevertLayerFallbacks.ConstIter(); !iter.Done(); iter.Next()) {
+    n += iter.Key().SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    const RevertLayerFallbackList* list = iter.UserData();
+    n += aMallocSizeOf(list);
+    n += list->mItems.ShallowSizeOfExcludingThis(aMallocSizeOf);
+    for (uint32_t i = 0, len = list->mItems.Length(); i < len; i++) {
+      n += list->mItems[i].mValue.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+      n += list->mItems[i].mSource.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    }
+  }
   return n;
 }
 

layout/style/CSSVariableDeclarations.h

@@ -7,10 +7,13 @@
 #ifndef mozilla_CSSVariableDeclarations_h
 #define mozilla_CSSVariableDeclarations_h
 
+#include "nsClassHashtable.h"
 #include "nsDataHashtable.h"
+#include "nsTArray.h"
 
 namespace mozilla {
 class CSSVariableResolver;
+class CSSVariableValues;
 } // namespace mozilla
 struct nsRuleData;
 
@@ -43,7 +46,8 @@ public:
     eInitial,      // 'initial'
     eInherit,      // 'inherit'
     eUnset,        // 'unset'
-    eRevert        // 'revert'
+    eRevert,       // 'revert'
+    eRevertLayer   // 'revert-layer'
   };
 
   /**
@@ -97,6 +101,15 @@ public:
    */
   void PutRevert(const nsAString& aName);
 
+  /**
+   * Adds or modifies an existing entry in this set of variable declarations
+   * to have the value 'revert-layer'.
+   *
+   * @param aName The variable name (not including any "--" prefix that would
+   *   be part of the custom property name) whose value is to be set.
+   */
+  void PutRevertLayer(const nsAString& aName);
+
   /**
    * Adds or modifies an existing entry in this set of variable declarations
    * to have a token stream value.
@@ -132,15 +145,36 @@ public:
    */
   void AddVariablesToResolver(CSSVariableResolver* aResolver) const;
 
+  /**
+   * Applies stored lower-priority declarations for custom property values that
+   * resolved to 'revert-layer'.
+   */
+  void ResolveRevertLayerFallbacks(const CSSVariableValues* aInherited,
+                                   CSSVariableValues* aOutput) const;
+
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
 private:
+  struct RevertLayerFallback
+  {
+    nsString mValue;
+    nsString mSource;
+  };
+
+  struct RevertLayerFallbackList
+  {
+    nsTArray<RevertLayerFallback> mItems;
+  };
+
   /**
    * Adds all the variable declarations from aOther into this object.
    */
   void CopyVariablesFrom(const CSSVariableDeclarations& aOther);
 
   nsDataHashtable<nsStringHashKey, nsString> mVariables;
+  nsDataHashtable<nsStringHashKey, nsString> mRevertLayerSources;
+  nsClassHashtable<nsStringHashKey, RevertLayerFallbackList>
+    mRevertLayerFallbacks;
 };
 
 } // namespace mozilla

layout/style/CSSVariableValues.cpp

@@ -121,6 +121,21 @@ CSSVariableValues::Put(const nsAString& aName,
   }
 }
 
+void
+CSSVariableValues::Remove(const nsAString& aName)
+{
+  size_t id;
+  if (!mVariableIDs.Get(aName, &id)) {
+    return;
+  }
+
+  mVariables.RemoveElementAt(id);
+  mVariableIDs.Clear();
+  for (size_t i = 0, n = mVariables.Length(); i < n; i++) {
+    mVariableIDs.Put(mVariables[i].mVariableName, i);
+  }
+}
+
 void
 CSSVariableValues::CopyVariablesFrom(const CSSVariableValues& aOther)
 {

layout/style/CSSVariableValues.h

@@ -94,6 +94,11 @@ public:
            nsCSSTokenSerializationType aFirstToken,
            nsCSSTokenSerializationType aLastToken);
 
+  /**
+   * Removes an entry in this set of variable values.
+   */
+  void Remove(const nsAString& aName);
+
   /**
    * Copies the variables from this object into aResolver, marking them as
    * computed, inherited values.

layout/style/Declaration.cpp

@@ -576,6 +576,7 @@ Declaration::GetPropertyValueInternal(
   const nsCSSValue* tokenStream = nullptr;
   uint32_t totalCount = 0, importantCount = 0,
            initialCount = 0, inheritCount = 0, unsetCount = 0, revertCount = 0,
+           revertLayerCount = 0,
            matchingTokenStreamCount = 0, nonMatchingTokenStreamCount = 0;
   CSSPROPS_FOR_SHORTHAND_SUBPROPERTIES(p, aProperty,
                                        CSSEnabledState::eForAllContent) {
@@ -603,6 +604,8 @@ Declaration::GetPropertyValueInternal(
       ++unsetCount;
     } else if (val->GetUnit() == eCSSUnit_Revert) {
       ++revertCount;
+    } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
+      ++revertLayerCount;
     } else if (val->GetUnit() == eCSSUnit_TokenStream) {
       if (val->GetTokenStreamValue()->mShorthandPropertyID == aProperty) {
         tokenStream = val;
@@ -640,9 +643,19 @@ Declaration::GetPropertyValueInternal(
                                               nsCSSValue::eNormalized);
     return;
   }
+  if (revertLayerCount == totalCount) {
+    // Simplify serialization below by serializing revert-layer up-front.
+    nsCSSValue revertLayer;
+    revertLayer.SetRevertLayerValue();
+    revertLayer.AppendToString(eCSSProperty_UNKNOWN, aValue,
+                               nsCSSValue::eNormalized);
+    return;
+  }
   if (initialCount != 0 || inheritCount != 0 || unsetCount != 0 ||
-      revertCount != 0 || nonMatchingTokenStreamCount != 0) {
-    // Case (2): partially initial, inherit, unset, revert, or token stream.
+      revertCount != 0 || revertLayerCount != 0 ||
+      nonMatchingTokenStreamCount != 0) {
+    // Case (2): partially initial, inherit, unset, revert, revert-layer,
+    // or token stream.
     return;
   }
   if (tokenStream) {
@@ -1535,6 +1548,7 @@ Declaration::GetPropertyValueInternal(
           case eCSSUnit_Initial:
           case eCSSUnit_Unset:
           case eCSSUnit_Revert:
+          case eCSSUnit_RevertLayer:
             return true;
           case eCSSUnit_Enumerated:
             // return false if there is a fallback value or <overflow-position>
@@ -1749,6 +1763,10 @@ Declaration::AppendVariableAndValueToString(const nsAString& aName,
       aResult.AppendLiteral("revert");
       break;
 
+    case CSSVariableDeclarations::eRevertLayer:
+      aResult.AppendLiteral("revert-layer");
+      break;
+
     default:
       MOZ_ASSERT(false, "unexpected variable value type");
   }
@@ -1989,6 +2007,10 @@ Declaration::GetVariableValue(const nsAString& aName, nsAString& aValue) const
         aValue.AppendLiteral("revert");
         break;
 
+      case CSSVariableDeclarations::eRevertLayer:
+        aValue.AppendLiteral("revert-layer");
+        break;
+
       default:
         MOZ_ASSERT(false, "unexpected variable value type");
     }
@@ -2059,6 +2081,11 @@ Declaration::AddVariable(const nsAString& aName,
       variables->PutRevert(aName);
       break;
 
+    case CSSVariableDeclarations::eRevertLayer:
+      MOZ_ASSERT(aValue.IsEmpty());
+      variables->PutRevertLayer(aName);
+      break;
+
     default:
       MOZ_ASSERT(false, "unexpected aType value");
   }

layout/style/StyleAnimationValue.h

@@ -489,7 +489,7 @@ public:
   void SetNoneValue();
   void SetIntValue(int32_t aInt, Unit aUnit);
   template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
   void SetIntValue(T aInt, Unit aUnit)
   {
     static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,

layout/style/nsCSSDataBlock.cpp

@@ -48,6 +48,102 @@ ShouldIgnoreColors(nsRuleData *aRuleData)
          !aRuleData->mPresContext->UseDocumentColors();
 }
 
+static const int32_t kLayerIndexMax = 0x000fffff;
+static const int32_t kCascadeRankStride = kLayerIndexMax + 1;
+
+static int32_t
+LayerIndexRank(bool aIsImportant, int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0);
+  MOZ_ASSERT(aLayerIndex <= kLayerIndexMax);
+  return aIsImportant ? kLayerIndexMax - aLayerIndex : aLayerIndex;
+}
+
+static int32_t
+CascadePrecedenceRank(SheetType aLevel, bool aIsImportant,
+                      int32_t aLayerIndex)
+{
+  int32_t bucket = 0;
+  bool isLayeredOrigin = false;
+
+  switch (aLevel) {
+    case SheetType::Agent:
+      bucket = aIsImportant ? 14 : 0;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::User:
+      bucket = aIsImportant ? 13 : 1;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::PresHint:
+      bucket = 2;
+      break;
+    case SheetType::SVGAttrAnimation:
+      bucket = 3;
+      break;
+    case SheetType::Doc:
+      bucket = aIsImportant ? 10 : 4;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::ScopedDoc:
+      bucket = aIsImportant ? 9 : 5;
+      isLayeredOrigin = true;
+      break;
+    case SheetType::StyleAttr:
+      bucket = aIsImportant ? 11 : 6;
+      break;
+    case SheetType::Override:
+      bucket = aIsImportant ? 12 : 7;
+      break;
+    case SheetType::Animation:
+      bucket = 8;
+      break;
+    case SheetType::Transition:
+      bucket = 15;
+      break;
+    default:
+      MOZ_ASSERT_UNREACHABLE("unexpected cascade level");
+      break;
+  }
+
+  return bucket * kCascadeRankStride +
+         (isLayeredOrigin ? LayerIndexRank(aIsImportant, aLayerIndex) : 0);
+}
+
+static bool
+ShouldIgnoreForRevertLayer(const nsCSSValue& aTargetValue,
+                           const nsRuleData* aRuleData)
+{
+  SheetType sourceLevel = aTargetValue.GetRevertLayerOriginValue();
+  bool sourceImportant = aTargetValue.GetRevertLayerImportanceValue();
+  int32_t sourceLayerIndex = aTargetValue.GetRevertLayerLayerIndexValue();
+  MOZ_ASSERT(sourceLevel != SheetType::Unknown,
+             "revert-layer should have cascade metadata before mapping");
+
+  int32_t candidateRank =
+    CascadePrecedenceRank(aRuleData->mLevel, aRuleData->mIsImportantRule,
+                          aRuleData->mLayerIndex);
+  int32_t sourceRank =
+    CascadePrecedenceRank(sourceLevel, sourceImportant, sourceLayerIndex);
+
+  if (candidateRank >= sourceRank) {
+    return true;
+  }
+
+  if (!sourceImportant) {
+    return false;
+  }
+
+  if (sourceLevel == SheetType::StyleAttr) {
+    return aRuleData->mLevel == SheetType::StyleAttr ||
+           aRuleData->mLevel == SheetType::Animation;
+  }
+
+  int32_t normalBoundary =
+    CascadePrecedenceRank(sourceLevel, false, sourceLayerIndex);
+  return candidateRank >= normalBoundary;
+}
+
 /**
  * Tries to call |nsCSSValue::StartImageLoad()| on an image source.
  * Image sources are specified by |url()| or |-moz-image-rect()| function.
@@ -175,7 +271,8 @@ MapSinglePropertyInto(nsCSSPropertyID aTargetProp,
   // CSSVariableImageTable, to give them the appropriate lifetime.
   MOZ_ASSERT(aTargetValue->GetUnit() == eCSSUnit_TokenStream ||
              aTargetValue->GetUnit() == eCSSUnit_Null ||
-             aTargetValue->GetUnit() == eCSSUnit_Revert,
+             aTargetValue->GetUnit() == eCSSUnit_Revert ||
+             aTargetValue->GetUnit() == eCSSUnit_RevertLayer,
              "aTargetValue must only be a token stream (when re-parsing "
              "properties with variable references) or null");
 
@@ -365,6 +462,10 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
         if (aRuleData->mLevel >= target->GetCascadeOriginValue()) {
           continue;
         }
+      } else if (target->GetUnit() == eCSSUnit_RevertLayer) {
+        if (ShouldIgnoreForRevertLayer(*target, aRuleData)) {
+          continue;
+        }
       } else if (target->GetUnit() != eCSSUnit_Null) {
         continue;
       }
@@ -377,8 +478,18 @@ nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData *aRuleData) const
       // the rule walking will have just updated aRuleData.
       if (val->GetUnit() == eCSSUnit_TokenStream) {
         val->GetTokenStreamValue()->mLevel = aRuleData->mLevel;
+        val->GetTokenStreamValue()->mIsImportant = aRuleData->mIsImportantRule;
+        val->GetTokenStreamValue()->mLayerIndex = aRuleData->mLayerIndex;
       } else if (val->GetUnit() == eCSSUnit_Revert) {
         aRuleData->mConditions.SetUncacheable();
+      } else if (val->GetUnit() == eCSSUnit_RevertLayer) {
+        nsCSSValue revertLayer;
+        revertLayer.SetRevertLayerValue(aRuleData->mLevel,
+                                        aRuleData->mIsImportantRule,
+                                        aRuleData->mLayerIndex);
+        aRuleData->mConditions.SetUncacheable();
+        MapSinglePropertyInto(iProp, &revertLayer, target, aRuleData);
+        continue;
       }
       MapSinglePropertyInto(iProp, val, target, aRuleData);
     }
@@ -819,6 +930,17 @@ nsCSSExpandedDataBlock::MapRuleInfoInto(nsCSSPropertyID aPropID,
   MOZ_ASSERT(dest->GetUnit() == eCSSUnit_TokenStream &&
              dest->GetTokenStreamValue()->mPropertyID == aPropID);
 
+  if (src->GetUnit() == eCSSUnit_RevertLayer) {
+    nsCSSValueTokenStream* tokenStream = dest->GetTokenStreamValue();
+    nsCSSValue revertLayer;
+    revertLayer.SetRevertLayerValue(tokenStream->mLevel,
+                                    tokenStream->mIsImportant,
+                                    tokenStream->mLayerIndex);
+    aRuleData->mConditions.SetUncacheable();
+    MapSinglePropertyInto(physicalProp, &revertLayer, dest, aRuleData);
+    return;
+  }
+
   CSSVariableImageTable::ReplaceAll(aRuleData->mStyleContext, aPropID, [=] {
     MapSinglePropertyInto(physicalProp, src, dest, aRuleData);
   });

layout/style/nsCSSKeywordList.h

@@ -481,6 +481,7 @@ CSS_KEY(repeat-x, repeat_x)
 CSS_KEY(repeat-y, repeat_y)
 CSS_KEY(reverse, reverse)
 CSS_KEY(revert, revert)
+CSS_KEY(revert-layer, revert_layer)
 CSS_KEY(ridge, ridge)
 CSS_KEY(right, right)
 CSS_KEY(rl, rl)
@@ -814,4 +815,3 @@ CSS_KEY(text-before-edge, text_before_edge)
 CSS_KEY(use-script, use_script)
 CSS_KEY(-moz-crisp-edges, _moz_crisp_edges)
 CSS_KEY(space, space)
-

layout/style/nsCSSParser.cpp

@@ -9126,6 +9126,10 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
           aValue.SetRevertValue(mLevel);
           return CSSParseResult::Ok;
         }
+        else if (eCSSKeyword_revert_layer == keyword) {
+          aValue.SetRevertLayerValue();
+          return CSSParseResult::Ok;
+        }
       }
       if ((aVariantMask & VARIANT_NONE) != 0) {
         if (eCSSKeyword_none == keyword) {
@@ -9330,7 +9334,8 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
          tk->mIdent.LowerCaseEqualsLiteral("initial") ||
          (tk->mIdent.LowerCaseEqualsLiteral("unset") &&
           nsLayoutUtils::UnsetValueEnabled()) ||
-         tk->mIdent.LowerCaseEqualsLiteral("revert")))) {
+         tk->mIdent.LowerCaseEqualsLiteral("revert") ||
+         tk->mIdent.LowerCaseEqualsLiteral("revert-layer")))) {
     aValue.SetStringValue(tk->mIdent, eCSSUnit_Ident);
     return CSSParseResult::Ok;
   }
@@ -9406,6 +9411,7 @@ CSSParserImpl::ParseCustomIdent(nsCSSValue& aValue,
       keyword == eCSSKeyword_initial ||
       keyword == eCSSKeyword_unset ||
       keyword == eCSSKeyword_revert ||
+      keyword == eCSSKeyword_revert_layer ||
       keyword == eCSSKeyword_default ||
       (aPropertyKTable &&
         nsCSSProps::FindIndexOfKeyword(keyword, aPropertyKTable) >= 0)) {
@@ -12595,6 +12601,12 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
         }
         found = ((1 << aNumIDs) - 1);
       }
+      else if (eCSSUnit_RevertLayer == aValues[0].GetUnit()) { // one revert-layer, all revert-layer
+        for (loop = 1; loop < aNumIDs; loop++) {
+          aValues[loop].SetRevertLayerValue();
+        }
+        found = ((1 << aNumIDs) - 1);
+      }
     }
     else {  // more than one value, verify no inherits, initials, unsets, or reverts
       for (loop = 0; loop < aNumIDs; loop++) {
@@ -12610,7 +12622,8 @@ CSSParserImpl::ParseChoice(nsCSSValue aValues[],
           found = -1;
           break;
         }
-        else if (eCSSUnit_Revert == aValues[loop].GetUnit()) {
+        else if (eCSSUnit_Revert == aValues[loop].GetUnit() ||
+                 eCSSUnit_RevertLayer == aValues[loop].GetUnit()) {
           found = -1;
           break;
         }
@@ -12658,7 +12671,8 @@ CSSParserImpl::ParseBoxProperties(const nsCSSPropertyID aPropIDs[])
       if (eCSSUnit_Inherit == unit ||
           eCSSUnit_Initial == unit ||
           eCSSUnit_Unset == unit ||
-          eCSSUnit_Revert == unit) {
+          eCSSUnit_Revert == unit ||
+          eCSSUnit_RevertLayer == unit) {
         return false;
       }
     }
@@ -12766,7 +12780,8 @@ CSSParserImpl::ParseBoxCornerRadius(nsCSSPropertyID aPropID)
   if (dimenX.GetUnit() != eCSSUnit_Inherit &&
       dimenX.GetUnit() != eCSSUnit_Initial &&
       dimenX.GetUnit() != eCSSUnit_Unset &&
-      dimenX.GetUnit() != eCSSUnit_Revert) {
+      dimenX.GetUnit() != eCSSUnit_Revert &&
+      dimenX.GetUnit() != eCSSUnit_RevertLayer) {
     if (ParseNonNegativeVariant(dimenY, VARIANT_LP | VARIANT_CALC, nullptr) ==
         CSSParseResult::Error) {
       return false;
@@ -12831,7 +12846,8 @@ CSSParserImpl::ParseBoxCornerRadiiInternals(nsCSSValue array[])
     if (eCSSUnit_Inherit == unit ||
         eCSSUnit_Initial == unit ||
         eCSSUnit_Unset == unit ||
-        eCSSUnit_Revert == unit)
+        eCSSUnit_Revert == unit ||
+        eCSSUnit_RevertLayer == unit)
       return false;
   }
 
@@ -13642,6 +13658,7 @@ CSSParserImpl::ParseFontDescriptorValue(nsCSSFontDesc aDescID,
             aValue.GetUnit() != eCSSUnit_Initial &&
             aValue.GetUnit() != eCSSUnit_Unset &&
             aValue.GetUnit() != eCSSUnit_Revert &&
+            aValue.GetUnit() != eCSSUnit_RevertLayer &&
             (aValue.GetUnit() != eCSSUnit_Enumerated ||
              (aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_BOLDER &&
               aValue.GetIntValue() != NS_STYLE_FONT_WEIGHT_LIGHTER)));
@@ -13905,7 +13922,8 @@ CSSParserImpl::ParseImageLayersItem(
       if (keyword == eCSSKeyword_inherit ||
           keyword == eCSSKeyword_initial ||
           keyword == eCSSKeyword_unset ||
-          keyword == eCSSKeyword_revert) {
+          keyword == eCSSKeyword_revert ||
+          keyword == eCSSKeyword_revert_layer) {
         return false;
       } else if (keyword == eCSSKeyword_none) {
         if (haveImage)
@@ -14262,7 +14280,8 @@ bool CSSParserImpl::ParseBoxPositionValues(nsCSSValuePair &aOut,
     if (eCSSUnit_Inherit == xValue.GetUnit() ||
         eCSSUnit_Initial == xValue.GetUnit() ||
         eCSSUnit_Unset == xValue.GetUnit() ||
-        eCSSUnit_Revert == xValue.GetUnit()) {  // both are inherit, initial, unset, or revert
+        eCSSUnit_Revert == xValue.GetUnit() ||
+        eCSSUnit_RevertLayer == xValue.GetUnit()) {
       yValue = xValue;
       return true;
     }
@@ -15094,6 +15113,7 @@ CSSParserImpl::ParseBorderSide(const nsCSSPropertyID aPropIDs[],
     case eCSSUnit_Initial:
     case eCSSUnit_Unset:
     case eCSSUnit_Revert:
+    case eCSSUnit_RevertLayer:
       extraValue = values[0];
       // Set value of border-image properties to initial/inherit/unset/revert
       AppendValue(eCSSProperty_border_image_source, extraValue);
@@ -15860,7 +15880,8 @@ CSSParserImpl::ParseFont()
     if (eCSSUnit_Inherit == family.GetUnit() ||
         eCSSUnit_Initial == family.GetUnit() ||
         eCSSUnit_Unset == family.GetUnit() ||
-        eCSSUnit_Revert == family.GetUnit()) {
+        eCSSUnit_Revert == family.GetUnit() ||
+        eCSSUnit_RevertLayer == family.GetUnit()) {
       AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
       AppendValue(eCSSProperty_font_family, family);
       AppendValue(eCSSProperty_font_style, family);
@@ -15929,7 +15950,8 @@ CSSParserImpl::ParseFont()
       eCSSUnit_Inherit == values[kFontStyleIndex].GetUnit() ||
       eCSSUnit_Initial == values[kFontStyleIndex].GetUnit() ||
       eCSSUnit_Unset == values[kFontStyleIndex].GetUnit() ||
-      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ) { // illegal data
+      eCSSUnit_Revert == values[kFontStyleIndex].GetUnit() ||
+      eCSSUnit_RevertLayer == values[kFontStyleIndex].GetUnit() ) { // illegal data
     return false;
   }
   if ((found & (1 << kFontStyleIndex)) == 0) {
@@ -15988,7 +16010,8 @@ CSSParserImpl::ParseFont()
     if (eCSSUnit_Inherit != family.GetUnit() &&
         eCSSUnit_Initial != family.GetUnit() &&
         eCSSUnit_Unset != family.GetUnit() &&
-        eCSSUnit_Revert != family.GetUnit()) {
+        eCSSUnit_Revert != family.GetUnit() &&
+        eCSSUnit_RevertLayer != family.GetUnit()) {
       AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
       AppendValue(eCSSProperty_font_family, family);
       AppendValue(eCSSProperty_font_style, values[kFontStyleIndex]);
@@ -16034,7 +16057,8 @@ CSSParserImpl::ParseFontSynthesis(nsCSSValue& aValue)
       eCSSUnit_Initial == aValue.GetUnit() ||
       eCSSUnit_Inherit == aValue.GetUnit() ||
       eCSSUnit_Unset == aValue.GetUnit() ||
-      eCSSUnit_Revert == aValue.GetUnit() )
+      eCSSUnit_Revert == aValue.GetUnit() ||
+      eCSSUnit_RevertLayer == aValue.GetUnit() )
   {
     return true;
   }
@@ -16657,6 +16681,9 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
       case eCSSKeyword_revert:
         aValue.SetRevertValue(mLevel);
         return true;
+      case eCSSKeyword_revert_layer:
+        aValue.SetRevertLayerValue();
+        return true;
       case eCSSKeyword__moz_use_system_font:
         if (!IsParsingCompoundProperty()) {
           aValue.SetSystemFontValue();
@@ -16691,6 +16718,7 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
         case eCSSKeyword_initial:
         case eCSSKeyword_default:
         case eCSSKeyword_revert:
+        case eCSSKeyword_revert_layer:
         case eCSSKeyword__moz_use_system_font:
           return false;
         case eCSSKeyword_unset:
@@ -18340,7 +18368,8 @@ bool CSSParserImpl::ParseTransformOrigin(bool aPerspective)
   if (position.mXValue.GetUnit() == eCSSUnit_Inherit ||
       position.mXValue.GetUnit() == eCSSUnit_Initial ||
       position.mXValue.GetUnit() == eCSSUnit_Unset ||
-      position.mXValue.GetUnit() == eCSSUnit_Revert) {
+      position.mXValue.GetUnit() == eCSSUnit_Revert ||
+      position.mXValue.GetUnit() == eCSSUnit_RevertLayer) {
     MOZ_ASSERT(position.mXValue == position.mYValue,
                "inherit/initial/unset/revert only half?");
     AppendValue(prop, position.mXValue);
@@ -18564,14 +18593,15 @@ CSSParserImpl::ParseTransitionProperty()
       }
       if (cur->mValue.GetUnit() == eCSSUnit_Ident) {
         nsDependentString str(cur->mValue.GetStringBufferValue());
-        // Exclude 'none', 'inherit', 'initial', 'unset', and 'revert'
-        // according to the same rules as for 'counter-reset' in CSS 2.1.
+        // Exclude CSS-wide keywords and 'none' according to the same rules
+        // as for 'counter-reset' in CSS 2.1.
         if (str.LowerCaseEqualsLiteral("none") ||
             str.LowerCaseEqualsLiteral("inherit") ||
             str.LowerCaseEqualsLiteral("initial") ||
             (str.LowerCaseEqualsLiteral("unset") &&
              nsLayoutUtils::UnsetValueEnabled()) ||
-            str.LowerCaseEqualsLiteral("revert")) {
+            str.LowerCaseEqualsLiteral("revert") ||
+            str.LowerCaseEqualsLiteral("revert-layer")) {
           return false;
         }
       }
@@ -19484,8 +19514,7 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
     }
   }
 
-  // Look for 'initial', 'inherit', 'unset', or 'revert' as the first
-  // non-white space token.
+  // Look for CSS-wide keywords as the first non-white space token.
   CSSVariableDeclarations::Type type = CSSVariableDeclarations::eTokenStream;
   if (mToken.mType == eCSSToken_Ident) {
     if (mToken.mIdent.LowerCaseEqualsLiteral("initial")) {
@@ -19496,6 +19525,8 @@ CSSParserImpl::ParseValueWithVariables(CSSVariableDeclarations::Type* aType,
       type = CSSVariableDeclarations::eUnset;
     } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert")) {
       type = CSSVariableDeclarations::eRevert;
+    } else if (mToken.mIdent.LowerCaseEqualsLiteral("revert-layer")) {
+      type = CSSVariableDeclarations::eRevertLayer;
     }
   }
 

layout/style/nsCSSProps.h

@@ -44,7 +44,7 @@
 // 'inherit' and 'initial'
 #define VARIANT_OPACITY         0x008000  // Take floats and percents as input, output float.
 #define VARIANT_AUTO            0x010000  // A
-#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert
+#define VARIANT_INHERIT         0x020000  // H eCSSUnit_Initial, eCSSUnit_Inherit, eCSSUnit_Unset, eCSSUnit_Revert, eCSSUnit_RevertLayer
 #define VARIANT_NONE            0x040000  // O
 #define VARIANT_NORMAL          0x080000  // M
 #define VARIANT_SYSFONT         0x100000  // eCSSUnit_System_Font
@@ -364,7 +364,7 @@ public:
     }
 
     template<typename T,
-             typename = typename std::enable_if<std::is_enum<T>::value>::type>
+             typename = typename std::enable_if_t<std::is_enum_v<T>>>
     KTableEntry(nsCSSKeyword aKeyword, T aValue)
       : mKeyword(aKeyword)
       , mValue(static_cast<int16_t>(aValue))
@@ -451,7 +451,7 @@ public:
   static nsCSSKeyword ValueToKeywordEnum(int32_t aValue,
                                          const KTableEntry aTable[]);
   template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
   static nsCSSKeyword ValueToKeywordEnum(T aValue,
                                          const KTableEntry aTable[])
   {
@@ -463,7 +463,7 @@ public:
   static const nsAFlatCString& ValueToKeyword(int32_t aValue,
                                               const KTableEntry aTable[]);
   template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
   static const nsAFlatCString& ValueToKeyword(T aValue,
                                               const KTableEntry aTable[])
   {

layout/style/nsCSSValue.cpp

@@ -192,6 +192,9 @@ nsCSSValue::nsCSSValue(const nsCSSValue& aCopy)
   else if (eCSSUnit_Revert == mUnit) {
     mValue.mCascadeOrigin = aCopy.mValue.mCascadeOrigin;
   }
+  else if (eCSSUnit_RevertLayer == mUnit) {
+    mValue.mInt = aCopy.mValue.mInt;
+  }
   else if (UnitHasArrayValue()) {
     mValue.mArray = aCopy.mValue.mArray;
     mValue.mArray->AddRef();
@@ -316,6 +319,9 @@ bool nsCSSValue::operator==(const nsCSSValue& aOther) const
     else if (eCSSUnit_Revert == mUnit) {
       return mValue.mCascadeOrigin == aOther.mValue.mCascadeOrigin;
     }
+    else if (eCSSUnit_RevertLayer == mUnit) {
+      return mValue.mInt == aOther.mValue.mInt;
+    }
     else if (UnitHasArrayValue()) {
       return *mValue.mArray == *aOther.mValue.mArray;
     }
@@ -593,6 +599,31 @@ nsCSSValue::SetCascadeOriginValue(mozilla::SheetType aValue, nsCSSUnit aUnit)
   mValue.mCascadeOrigin = aValue;
 }
 
+static const int32_t kRevertLayerMask = 0x000fffff;
+static const int32_t kRevertLayerImportant = 0x00100000;
+static const int32_t kRevertLayerOriginShift = 21;
+
+mozilla::SheetType
+nsCSSValue::GetRevertLayerOriginValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return mozilla::SheetType(uint32_t(mValue.mInt) >> kRevertLayerOriginShift);
+}
+
+bool
+nsCSSValue::GetRevertLayerImportanceValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return (mValue.mInt & kRevertLayerImportant) != 0;
+}
+
+int32_t
+nsCSSValue::GetRevertLayerLayerIndexValue() const
+{
+  MOZ_ASSERT(mUnit == eCSSUnit_RevertLayer, "not a revert-layer value");
+  return mValue.mInt & kRevertLayerMask;
+}
+
 void nsCSSValue::SetArrayValue(nsCSSValue::Array* aValue, nsCSSUnit aUnit)
 {
   Reset();
@@ -663,7 +694,9 @@ void nsCSSValue::SetPairValue(const nsCSSValuePair* aValue)
              aValue->mXValue.GetUnit() != eCSSUnit_Unset &&
              aValue->mYValue.GetUnit() != eCSSUnit_Unset &&
              aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mYValue.GetUnit() != eCSSUnit_Revert,
+             aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
+             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer,
              "missing or inappropriate pair value");
   Reset();
   mUnit = eCSSUnit_Pair;
@@ -683,7 +716,9 @@ void nsCSSValue::SetPairValue(const nsCSSValue& xValue,
              xValue.GetUnit() != eCSSUnit_Unset &&
              yValue.GetUnit() != eCSSUnit_Unset &&
              xValue.GetUnit() != eCSSUnit_Revert &&
-             yValue.GetUnit() != eCSSUnit_Revert,
+             yValue.GetUnit() != eCSSUnit_Revert &&
+             xValue.GetUnit() != eCSSUnit_RevertLayer &&
+             yValue.GetUnit() != eCSSUnit_RevertLayer,
              "inappropriate pair value");
   Reset();
   mUnit = eCSSUnit_Pair;
@@ -709,7 +744,10 @@ void nsCSSValue::SetTripletValue(const nsCSSValueTriplet* aValue)
              aValue->mZValue.GetUnit() != eCSSUnit_Unset &&
              aValue->mXValue.GetUnit() != eCSSUnit_Revert &&
              aValue->mYValue.GetUnit() != eCSSUnit_Revert &&
-             aValue->mZValue.GetUnit() != eCSSUnit_Revert,
+             aValue->mZValue.GetUnit() != eCSSUnit_Revert &&
+             aValue->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mYValue.GetUnit() != eCSSUnit_RevertLayer &&
+             aValue->mZValue.GetUnit() != eCSSUnit_RevertLayer,
              "missing or inappropriate triplet value");
   Reset();
   mUnit = eCSSUnit_Triplet;
@@ -735,7 +773,10 @@ void nsCSSValue::SetTripletValue(const nsCSSValue& xValue,
              zValue.GetUnit() != eCSSUnit_Unset &&
              xValue.GetUnit() != eCSSUnit_Revert &&
              yValue.GetUnit() != eCSSUnit_Revert &&
-             zValue.GetUnit() != eCSSUnit_Revert,
+             zValue.GetUnit() != eCSSUnit_Revert &&
+             xValue.GetUnit() != eCSSUnit_RevertLayer &&
+             yValue.GetUnit() != eCSSUnit_RevertLayer &&
+             zValue.GetUnit() != eCSSUnit_RevertLayer,
              "inappropriate triplet value");
   Reset();
   mUnit = eCSSUnit_Triplet;
@@ -851,6 +892,26 @@ nsCSSValue::SetRevertValue(mozilla::SheetType aValue)
   SetCascadeOriginValue(aValue, eCSSUnit_Revert);
 }
 
+void
+nsCSSValue::SetRevertLayerValue()
+{
+  SetRevertLayerValue(mozilla::SheetType::Unknown, false, 0);
+}
+
+void
+nsCSSValue::SetRevertLayerValue(mozilla::SheetType aLevel,
+                                bool aIsImportant,
+                                int32_t aLayerIndex)
+{
+  MOZ_ASSERT(aLayerIndex >= 0 && aLayerIndex <= kRevertLayerMask,
+             "cascade layer index is out of range");
+  Reset();
+  mUnit = eCSSUnit_RevertLayer;
+  mValue.mInt = (uint32_t(aLevel) << kRevertLayerOriginShift) |
+                (aIsImportant ? kRevertLayerImportant : 0) |
+                (aLayerIndex & kRevertLayerMask);
+}
+
 void nsCSSValue::SetNoneValue()
 {
   Reset();
@@ -2234,6 +2295,7 @@ nsCSSValue::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
     case eCSSUnit_Initial:      aResult.AppendLiteral("initial");  break;
     case eCSSUnit_Unset:        aResult.AppendLiteral("unset");    break;
     case eCSSUnit_Revert:       aResult.AppendLiteral("revert");   break;
+    case eCSSUnit_RevertLayer:  aResult.AppendLiteral("revert-layer"); break;
     case eCSSUnit_None:         aResult.AppendLiteral("none");     break;
     case eCSSUnit_Normal:       aResult.AppendLiteral("normal");   break;
     case eCSSUnit_System_Font:  aResult.AppendLiteral("-moz-use-system-font"); break;
@@ -2511,6 +2573,7 @@ nsCSSValue::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
 
     // Cascade Origin: nothing extra to measure.
     case eCSSUnit_Revert:
+    case eCSSUnit_RevertLayer:
       break;
 
     // Float: nothing extra to measure.
@@ -2836,7 +2899,8 @@ nsCSSRect::AppendToString(nsCSSPropertyID aProperty, nsAString& aResult,
              mTop.GetUnit() != eCSSUnit_Inherit &&
              mTop.GetUnit() != eCSSUnit_Initial &&
              mTop.GetUnit() != eCSSUnit_Unset &&
-             mTop.GetUnit() != eCSSUnit_Revert,
+             mTop.GetUnit() != eCSSUnit_Revert &&
+             mTop.GetUnit() != eCSSUnit_RevertLayer,
              "parser should have used a bare value");
 
   if (eCSSProperty_border_image_slice == aProperty ||
@@ -3007,6 +3071,7 @@ nsCSSValuePairList::AppendToString(nsCSSPropertyID aProperty,
         item->mXValue.GetUnit() != eCSSUnit_Initial &&
         item->mXValue.GetUnit() != eCSSUnit_Unset &&
         item->mXValue.GetUnit() != eCSSUnit_Revert &&
+        item->mXValue.GetUnit() != eCSSUnit_RevertLayer &&
         item->mYValue.GetUnit() != eCSSUnit_Null) {
       aResult.Append(char16_t(' '));
       item->mYValue.AppendToString(aProperty, aResult, aSerialization);
@@ -3443,6 +3508,8 @@ nsCSSValueTokenStream::nsCSSValueTokenStream()
   : mPropertyID(eCSSProperty_UNKNOWN)
   , mShorthandPropertyID(eCSSProperty_UNKNOWN)
   , mLevel(SheetType::Count)
+  , mIsImportant(false)
+  , mLayerIndex(0)
 {
   MOZ_COUNT_CTOR(nsCSSValueTokenStream);
 }

layout/style/nsCSSValue.h

@@ -490,6 +490,7 @@ enum nsCSSUnit {
   eCSSUnit_GridTemplateAreas   = 44,   // (GridTemplateAreasValue*)
                                        // for grid-template-areas
   eCSSUnit_Revert       = 45,     // (SheetType) value is the current cascade origin
+  eCSSUnit_RevertLayer  = 46,     // (int32_t) packed cascade layer rollback data
 
   eCSSUnit_Pair         = 50,     // (nsCSSValuePair*) pair of values
   eCSSUnit_Triplet      = 51,     // (nsCSSValueTriplet*) triplet of values
@@ -939,6 +940,9 @@ public:
     MOZ_ASSERT(mUnit == eCSSUnit_Revert, "not a cascade origin value");
     return mValue.mCascadeOrigin;
   }
+  mozilla::SheetType GetRevertLayerOriginValue() const;
+  bool GetRevertLayerImportanceValue() const;
+  int32_t GetRevertLayerLayerIndexValue() const;
 
   void Reset()  // sets to null
   {
@@ -951,7 +955,7 @@ private:
 public:
   void SetIntValue(int32_t aValue, nsCSSUnit aUnit);
   template<typename T,
-           typename = typename std::enable_if<std::is_enum<T>::value>::type>
+           typename = typename std::enable_if_t<std::is_enum_v<T>>>
   void SetIntValue(T aValue, nsCSSUnit aUnit)
   {
     static_assert(mozilla::EnumTypeFitsWithin<T, int32_t>::value,
@@ -994,6 +998,10 @@ public:
   void SetInitialValue();
   void SetUnsetValue();
   void SetRevertValue(mozilla::SheetType aValue);
+  void SetRevertLayerValue();
+  void SetRevertLayerValue(mozilla::SheetType aLevel,
+                           bool aIsImportant,
+                           int32_t aLayerIndex);
   void SetNoneValue();
   void SetAllValue();
   void SetNormalValue();
@@ -1837,6 +1845,8 @@ public:
            mShorthandPropertyID == aOther.mShorthandPropertyID &&
            mTokenStream.Equals(aOther.mTokenStream) &&
            mLevel == aOther.mLevel &&
+           mIsImportant == aOther.mIsImportant &&
+           mLayerIndex == aOther.mLayerIndex &&
            (mBaseURI == aOther.mBaseURI ||
             (mBaseURI && aOther.mBaseURI &&
              NS_SUCCEEDED(mBaseURI->Equals(aOther.mBaseURI, &eq)) &&
@@ -1886,6 +1896,8 @@ public:
   uint32_t mLineNumber;
   uint32_t mLineOffset;
   mozilla::SheetType mLevel;
+  bool mIsImportant;
+  int32_t mLayerIndex;
 
 private:
   nsCSSValueTokenStream(const nsCSSValueTokenStream& aOther) = delete;

layout/style/nsRuleData.cpp

@@ -28,6 +28,9 @@ nsRuleData::GetPoisonOffset()
 nsRuleData::nsRuleData(uint32_t aSIDs, nsCSSValue* aValueStorage,
                        nsPresContext* aContext, nsStyleContext* aStyleContext)
   : mSIDs(aSIDs),
+    mIsImportantRule(false),
+    mLevel(mozilla::SheetType::Unknown),
+    mLayerIndex(0),
     mPresContext(aContext),
     mStyleContext(aStyleContext),
     mValueStorage(aValueStorage)

layout/style/nsRuleData.h

@@ -31,6 +31,7 @@ struct nsRuleData
   mozilla::RuleNodeCacheConditions mConditions;
   bool mIsImportantRule;
   mozilla::SheetType mLevel;
+  int32_t mLayerIndex;
   nsPresContext* const mPresContext;
   nsStyleContext* const mStyleContext;
 

layout/style/nsRuleNode.cpp

@@ -188,9 +188,10 @@ nsRuleNode::ChildrenHashHashKey(const void *aKey)
 {
   const nsRuleNode::Key *key =
     static_cast<const nsRuleNode::Key*>(aKey);
-  // Disagreement on importance and level for the same rule is extremely
-  // rare, so hash just on the rule.
-  return PLDHashTable::HashVoidPtrKeyStub(key->mRule);
+  return PLDHashTable::HashVoidPtrKeyStub(key->mRule) ^
+         (uint32_t(key->mLayerIndex) << 4) ^
+         (uint32_t(key->mLevel) << 1) ^
+         (key->mIsImportantRule ? 1 : 0);
 }
 
 /* static */ bool
@@ -2270,18 +2271,19 @@ already_AddRefed<nsRuleNode>
 nsRuleNode::CreateRootNode(nsPresContext* aPresContext)
 {
   return do_AddRef(new (aPresContext)
-    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false));
+    nsRuleNode(aPresContext, nullptr, nullptr, SheetType::Unknown, false, 0));
 }
 
 nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,
                        nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportant)
+                       bool aIsImportant, int32_t aLayerIndex)
   : mPresContext(aContext),
     mParent(aParent),
     mRule(aRule),
     mNextSibling(nullptr),
     mDependentBits((uint32_t(aLevel) << NS_RULE_NODE_LEVEL_SHIFT) |
                    (aIsImportant ? NS_RULE_NODE_IS_IMPORTANT : 0)),
+    mLayerIndex(aLayerIndex),
     mNoneBits(aParent ? aParent->mNoneBits & NS_RULE_NODE_HAS_ANIMATION_DATA :
                         0),
     mRefCnt(0)
@@ -2295,6 +2297,8 @@ nsRuleNode::nsRuleNode(nsPresContext* aContext, nsRuleNode* aParent,
 
   NS_ASSERTION(IsRoot() || GetLevel() == aLevel, "not enough bits");
   NS_ASSERTION(IsRoot() || IsImportantRule() == aIsImportant, "yikes");
+  NS_ASSERTION(IsRoot() || GetLayerIndex() == aLayerIndex,
+               "bad layer index");
   aContext->StyleSet()->RuleNodeUnused(this, /* aMayGC = */ false);
 
   // nsStyleSet::GetContext depends on there being only one animation
@@ -2319,7 +2323,7 @@ nsRuleNode::~nsRuleNode()
 
 nsRuleNode*
 nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
-                       bool aIsImportantRule)
+                       bool aIsImportantRule, int32_t aLayerIndex)
 {
 #ifdef DEBUG
   {
@@ -2330,7 +2334,7 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
 #endif
 
   nsRuleNode* next = nullptr;
-  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule);
+  nsRuleNode::Key key(aRule, aLevel, aIsImportantRule, aLayerIndex);
 
   if (HaveChildren() && !ChildrenAreHashed()) {
     int32_t numKids = 0;
@@ -2357,12 +2361,14 @@ nsRuleNode::Transition(nsIStyleRule* aRule, SheetType aLevel,
       next = entry->mRuleNode;
     } else {
       next = entry->mRuleNode = new (mPresContext)
-        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
+        nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
+                   aLayerIndex);
     }
   } else if (!next) {
     // Create the new entry in our list.
     next = new (mPresContext)
-      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule);
+      nsRuleNode(mPresContext, this, aRule, aLevel, aIsImportantRule,
+                 aLayerIndex);
     next->mNextSibling = ChildrenList();
     SetChildrenList(next);
   }
@@ -2545,7 +2551,8 @@ ExamineCSSValue(const nsCSSValue& aValue,
       ++aInheritedCount;
     } else if (aValue.GetUnit() == eCSSUnit_Unset) {
       ++aUnsetCount;
-    } else if (aValue.GetUnit() == eCSSUnit_Revert) {
+    } else if (aValue.GetUnit() == eCSSUnit_Revert ||
+               aValue.GetUnit() == eCSSUnit_RevertLayer) {
       ++aRevertCount;
     }
   }
@@ -3021,7 +3028,11 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
                "Token stream should have a defined level");
 
     AutoRestore<SheetType> saveLevel(aRuleData->mLevel);
+    AutoRestore<bool> saveImportant(aRuleData->mIsImportantRule);
+    AutoRestore<int32_t> saveLayerIndex(aRuleData->mLayerIndex);
     aRuleData->mLevel = tokenStream->mLevel;
+    aRuleData->mIsImportantRule = tokenStream->mIsImportant;
+    aRuleData->mLayerIndex = tokenStream->mLayerIndex;
 
     // Note that ParsePropertyWithVariableReferences relies on the fact
     // that the nsCSSValue in aRuleData for the property we are re-parsing
@@ -3045,6 +3056,114 @@ nsRuleNode::ResolveVariableReferences(const nsStyleStructID aSID,
   return anyTokenStreams;
 }
 
+static nsCSSPropertyID
+PropertyAtIndexInStruct(nsStyleStructID aSID, size_t aIndex)
+{
+  for (int32_t prop = 0; prop < eCSSProperty_COUNT_no_shorthands; prop++) {
+    nsCSSPropertyID property = nsCSSPropertyID(prop);
+    if (nsCSSProps::kSIDTable[property] == aSID &&
+        nsCSSProps::PropertyIndexInStruct(property) == aIndex) {
+      return property;
+    }
+  }
+  MOZ_ASSERT_UNREACHABLE("no property for style struct index");
+  return eCSSProperty_UNKNOWN;
+}
+
+/* static */ bool
+nsRuleNode::ResolveRevertLayerValues(const nsStyleStructID aSID,
+                                     nsRuleData* aRuleData,
+                                     nsStyleContext* aContext,
+                                     nsRuleNode* aStartRuleNode)
+{
+  MOZ_ASSERT(aSID != eStyleStruct_Variables);
+
+  size_t nprops = nsCSSProps::PropertyCountInStruct(aSID);
+  bool resolvedAny = false;
+
+  for (size_t pass = 0; pass <= nprops; pass++) {
+    bool resolvedThisPass = false;
+    bool needsVariableResolution = false;
+
+    for (size_t index = 0; index < nprops; index++) {
+      nsCSSValue* target = aRuleData->mValueStorage + index;
+      if (target->GetUnit() != eCSSUnit_RevertLayer) {
+        continue;
+      }
+
+      nsCSSPropertyID property = PropertyAtIndexInStruct(aSID, index);
+      if (property == eCSSProperty_UNKNOWN) {
+        continue;
+      }
+
+      AutoTArray<nsCSSValue, 64> tempValues;
+      tempValues.SetLength(nprops);
+      for (size_t i = 0; i < nprops; i++) {
+        tempValues[i].SetDummyValue();
+      }
+      tempValues[index] = *target;
+
+      nsRuleData tempRuleData(nsCachedStyleData::GetBitForSID(aSID),
+                              tempValues.Elements(),
+                              aStartRuleNode->mPresContext, aContext);
+      tempRuleData.mValueOffsets[aSID] = 0;
+
+      uint32_t bit = nsCachedStyleData::GetBitForSID(aSID);
+      for (nsRuleNode* ruleNode = aStartRuleNode; ruleNode;
+           ruleNode = ruleNode->GetParent()) {
+        if (ruleNode->mNoneBits & bit) {
+          break;
+        }
+
+        nsIStyleRule* rule = ruleNode->mRule;
+        if (rule) {
+          tempRuleData.mLevel = ruleNode->GetLevel();
+          tempRuleData.mIsImportantRule = ruleNode->IsImportantRule();
+          tempRuleData.mLayerIndex = ruleNode->GetLayerIndex();
+          rule->MapRuleInfoInto(&tempRuleData);
+        }
+
+        if (tempValues[index].GetUnit() != eCSSUnit_RevertLayer) {
+          break;
+        }
+      }
+
+      if (tempValues[index].GetUnit() == eCSSUnit_RevertLayer) {
+        tempValues[index].SetRevertValue(
+          target->GetRevertLayerOriginValue());
+      } else if (tempValues[index].GetUnit() == eCSSUnit_TokenStream) {
+        needsVariableResolution = true;
+      }
+
+      *target = tempValues[index];
+      aRuleData->mConditions.SetUncacheable();
+      resolvedThisPass = true;
+      resolvedAny = true;
+    }
+
+    if (!resolvedThisPass) {
+      break;
+    }
+
+    if (needsVariableResolution &&
+        ResolveVariableReferences(aSID, aRuleData, aContext)) {
+      resolvedAny = true;
+      continue;
+    }
+  }
+
+  for (size_t index = 0; index < nprops; index++) {
+    nsCSSValue* target = aRuleData->mValueStorage + index;
+    if (target->GetUnit() == eCSSUnit_RevertLayer) {
+      target->SetRevertValue(target->GetRevertLayerOriginValue());
+      aRuleData->mConditions.SetUncacheable();
+      resolvedAny = true;
+    }
+  }
+
+  return resolvedAny;
+}
+
 const void*
 nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
                          nsStyleContext* aContext)
@@ -3118,6 +3237,7 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
     if (rule) {
       ruleData.mLevel = ruleNode->GetLevel();
       ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+      ruleData.mLayerIndex = ruleNode->GetLayerIndex();
       rule->MapRuleInfoInto(&ruleData);
     }
 
@@ -3154,6 +3274,11 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
     recomputeDetail = ResolveVariableReferences(aSID, &ruleData, aContext);
   }
 
+  if (aSID != eStyleStruct_Variables &&
+      ResolveRevertLayerValues(aSID, &ruleData, aContext, this)) {
+    recomputeDetail = true;
+  }
+
   // If needed, unset the properties that don't have a flag that allows
   // them to be set for this style context.  (For example, only some
   // properties apply to :first-line and :first-letter.)
@@ -4889,6 +5014,7 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
       if (rule) {
         ruleData.mLevel = ruleNode->GetLevel();
         ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+        ruleData.mLayerIndex = ruleNode->GetLayerIndex();
         rule->MapRuleInfoInto(&ruleData);
       }
     }
@@ -4902,6 +5028,8 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
     }
 
     ResolveVariableReferences(eStyleStruct_Font, &ruleData, aContext);
+    ResolveRevertLayerValues(eStyleStruct_Font, &ruleData, aContext,
+                             context->RuleNode());
 
     RuleNodeCacheConditions dummy;
     nsRuleNode::SetFont(aPresContext, context,
@@ -11081,6 +11209,8 @@ nsRuleNode::ComputeVariablesData(void* aStartStruct,
   CSSVariableResolver resolver(&variables->mVariables);
   resolver.Resolve(&parentVariables->mVariables,
                    aRuleData->mVariables);
+  aRuleData->mVariables->ResolveRevertLayerFallbacks(&parentVariables->mVariables,
+                                                     &variables->mVariables);
   conditions.SetUncacheable();
 
   COMPUTE_END_INHERITED(Variables, variables)
@@ -11473,6 +11603,7 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
       if (rule) {
         ruleData.mLevel = ruleNode->GetLevel();
         ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+        ruleData.mLayerIndex = ruleNode->GetLayerIndex();
 
         rule->MapRuleInfoInto(&ruleData);
 
@@ -11485,11 +11616,13 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
             nsCSSUnit unit = values[i]->GetUnit();
             if (unit != eCSSUnit_Null &&
                 unit != eCSSUnit_Revert &&
+                unit != eCSSUnit_RevertLayer &&
                 unit != eCSSUnit_Dummy &&
                 unit != eCSSUnit_DummyInherit) {
               if (unit == eCSSUnit_Inherit ||
                   (i >= inheritedOffset && unit == eCSSUnit_Unset) ||
-                  (i >= inheritedOffset && unit == eCSSUnit_Revert)) {
+                  (i >= inheritedOffset && unit == eCSSUnit_Revert) ||
+                  (i >= inheritedOffset && unit == eCSSUnit_RevertLayer)) {
                 haveExplicitUAInherit = true;
                 values[i]->SetDummyInheritValue();
               } else {
@@ -11504,7 +11637,8 @@ nsRuleNode::HasAuthorSpecifiedRules(nsStyleContext* aStyleContext,
             if (values[i]->GetUnit() != eCSSUnit_Null &&
                 values[i]->GetUnit() != eCSSUnit_Dummy && // see above
                 values[i]->GetUnit() != eCSSUnit_DummyInherit &&
-                values[i]->GetUnit() != eCSSUnit_Revert) {
+                values[i]->GetUnit() != eCSSUnit_Revert &&
+                values[i]->GetUnit() != eCSSUnit_RevertLayer) {
               // If author colors are not allowed, only claim to have
               // author-specified rules if we're looking at a non-color
               // property or if we're looking at the background color and it's
@@ -11596,6 +11730,7 @@ nsRuleNode::ComputePropertiesOverridingAnimation(
     if (rule) {
       ruleData.mLevel = ruleNode->GetLevel();
       ruleData.mIsImportantRule = ruleNode->IsImportantRule();
+      ruleData.mLayerIndex = ruleNode->GetLayerIndex();
 
       // Transitions are the only non-!important level overriding
       // animations in the cascade ordering.  They also don't actually

layout/style/nsRuleNode.h

@@ -441,16 +441,20 @@ private:
   struct Key {
     nsIStyleRule* mRule;
     mozilla::SheetType mLevel;
+    int32_t mLayerIndex;
     bool mIsImportantRule;
 
-    Key(nsIStyleRule* aRule, mozilla::SheetType aLevel, bool aIsImportantRule)
-      : mRule(aRule), mLevel(aLevel), mIsImportantRule(aIsImportantRule)
+    Key(nsIStyleRule* aRule, mozilla::SheetType aLevel,
+        bool aIsImportantRule, int32_t aLayerIndex)
+      : mRule(aRule), mLevel(aLevel), mLayerIndex(aLayerIndex),
+        mIsImportantRule(aIsImportantRule)
     {}
 
     bool operator==(const Key& aOther) const
     {
       return mRule == aOther.mRule &&
              mLevel == aOther.mLevel &&
+             mLayerIndex == aOther.mLayerIndex &&
              mIsImportantRule == aOther.mIsImportantRule;
     }
 
@@ -469,7 +473,7 @@ private:
   static const PLDHashTableOps ChildrenHashOps;
 
   Key GetKey() const {
-    return Key(mRule, GetLevel(), IsImportantRule());
+    return Key(mRule, GetLevel(), IsImportantRule(), GetLayerIndex());
   }
 
   // The children of this node are stored in either a hashtable or list
@@ -528,6 +532,8 @@ private:
   uint32_t mDependentBits; // Used to cache the fact that we can look up
                            // cached data under a parent rule.
 
+  int32_t mLayerIndex;
+
   uint32_t mNoneBits; // Used to cache the fact that the branch to this
                       // node specifies no non-inherited data for a
                       // given struct type.  (This usually implies that
@@ -585,6 +591,10 @@ protected:
   static bool ResolveVariableReferences(const nsStyleStructID aSID,
                                         nsRuleData* aRuleData,
                                         nsStyleContext* aContext);
+  static bool ResolveRevertLayerValues(const nsStyleStructID aSID,
+                                       nsRuleData* aRuleData,
+                                       nsStyleContext* aContext,
+                                       nsRuleNode* aStartRuleNode);
 
   const void*
     WalkRuleTree(const nsStyleStructID aSID, nsStyleContext* aContext);
@@ -792,7 +802,8 @@ protected:
 
 private:
   nsRuleNode(nsPresContext* aPresContext, nsRuleNode* aParent,
-             nsIStyleRule* aRule, mozilla::SheetType aLevel, bool aIsImportant);
+             nsIStyleRule* aRule, mozilla::SheetType aLevel,
+             bool aIsImportant, int32_t aLayerIndex);
   ~nsRuleNode();
 
 public:
@@ -805,7 +816,7 @@ public:
 
   // Transition never returns null; on out of memory it'll just return |this|.
   nsRuleNode* Transition(nsIStyleRule* aRule, mozilla::SheetType aLevel,
-                         bool aIsImportantRule);
+                         bool aIsImportantRule, int32_t aLayerIndex);
   nsRuleNode* GetParent() const { return mParent; }
   bool IsRoot() const { return mParent == nullptr; }
 
@@ -825,6 +836,10 @@ public:
     NS_ASSERTION(!IsRoot(), "can't call on root");
     return (mDependentBits & NS_RULE_NODE_IS_IMPORTANT) != 0;
   }
+  int32_t GetLayerIndex() const {
+    NS_ASSERTION(!IsRoot(), "can't call on root");
+    return mLayerIndex;
+  }
 
   /**
    * Has this rule node at some time in its lifetime been the mRuleNode

layout/style/nsRuleWalker.h

@@ -28,7 +28,8 @@ public:
 
 protected:
   void DoForward(nsIStyleRule* aRule) {
-    mCurrent = mCurrent->Transition(aRule, mLevel, mImportance);
+    mCurrent = mCurrent->Transition(aRule, mLevel, mImportance,
+                                    mLayerIndex);
     NS_POSTCONDITION(mCurrent, "Transition messed up");
   }
 
@@ -61,10 +62,16 @@ public:
                  "important rules");
     mLevel = aLevel;
     mImportance = aImportance;
+    mLayerIndex = 0;
     mCheckForImportantRules = aCheckForImportantRules;
   }
   mozilla::SheetType GetLevel() const { return mLevel; }
   bool GetImportance() const { return mImportance; }
+  void SetLayerIndex(int32_t aLayerIndex) {
+    MOZ_ASSERT(aLayerIndex >= 0, "negative cascade layer index");
+    mLayerIndex = aLayerIndex;
+  }
+  int32_t GetLayerIndex() const { return mLayerIndex; }
   bool GetCheckForImportantRules() const { return mCheckForImportantRules; }
 
   bool AuthorStyleDisabled() const { return mAuthorStyleDisabled; }
@@ -87,6 +94,7 @@ private:
   nsRuleNode* mCurrent; // Our current position.  Never null.
   nsRuleNode* mRoot; // The root of the tree we're walking.
   mozilla::SheetType mLevel;
+  int32_t mLayerIndex;
   bool mImportance;
   bool mCheckForImportantRules; // If true, check for important rules as
                                 // we walk and set to false if we find
@@ -97,6 +105,10 @@ public:
   nsRuleWalker(nsRuleNode* aRoot, bool aAuthorStyleDisabled)
     : mCurrent(aRoot)
     , mRoot(aRoot)
+    , mLevel(mozilla::SheetType::Unknown)
+    , mLayerIndex(0)
+    , mImportance(false)
+    , mCheckForImportantRules(false)
     , mAuthorStyleDisabled(aAuthorStyleDisabled)
   {
     NS_ASSERTION(mCurrent, "Caller screwed up and gave us null node");

layout/style/nsStyleSet.cpp

@@ -847,14 +847,14 @@ ReplaceAnimationRule(nsRuleNode *aOldRuleNode,
              "wrong level");
 
   if (aNewAnimRule) {
-    n = n->Transition(aNewAnimRule, SheetType::Animation, false);
+    n = n->Transition(aNewAnimRule, SheetType::Animation, false, 0);
     n->SetIsAnimationRule();
   }
 
   for (uint32_t i = moreSpecificNodes.Length(); i-- != 0; ) {
     nsRuleNode *oldNode = moreSpecificNodes[i];
     n = n->Transition(oldNode->GetRule(), oldNode->GetLevel(),
-                      oldNode->IsImportantRule());
+                      oldNode->IsImportantRule(), oldNode->GetLayerIndex());
   }
 
   return n;
@@ -1124,6 +1124,7 @@ FileRulesFromAllChildProcessors(
         if (i > 0) {
           aRuleWalker->SetLevel(aLevel, false, true);
         }
+        aRuleWalker->SetLayerIndex(i);
         nsCOMPtr<nsIStyleRuleProcessor> processor = (*processors)[i];
         (*aCollectorFunc)(processor, aData);
         TrackRuleNodeForCurrentOrigin(aRuleWalker,
@@ -1307,6 +1308,7 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   if (haveAnyImportantDocRules) {
     for (uint32_t i = lastDocRNs.Length(); i-- != 0; ) {
       aRuleWalker->SetLevel(SheetType::Doc, true, false);
+      aRuleWalker->SetLayerIndex(i);
       nsRuleNode* startRN = lastDocRNs[i];
       nsRuleNode* endRN = i == 0 ? lastSVGAttrAnimationRN : lastDocRNs[i - 1];
       if (haveImportantDocRules[i]) {
@@ -1352,6 +1354,7 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   if (haveAnyImportantUserRules) {
     for (uint32_t i = lastUserRNs.Length(); i-- != 0;) {
       aRuleWalker->SetLevel(SheetType::User, true, false);
+      aRuleWalker->SetLayerIndex(i);
       nsRuleNode* startRN = lastUserRNs[i];
       nsRuleNode* endRN = i == 0 ? lastAgentRN : lastUserRNs[i - 1];
       if (haveImportantUserRules[i]) {
@@ -1373,6 +1376,7 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   if (haveAnyImportantAgentRules) {
     for (uint32_t i = lastAgentRNs.Length(); i-- != 0;) {
       aRuleWalker->SetLevel(SheetType::Agent, true, false);
+      aRuleWalker->SetLayerIndex(i);
       nsRuleNode* startRN = lastAgentRNs[i];
       nsRuleNode* endRN = i == 0 ? lastRestrictionRN : lastAgentRNs[i - 1];
       if (haveImportantAgentRules[i]) {
@@ -1585,6 +1589,7 @@ nsStyleSet::ResolveStyleByAddingRules(nsStyleContext* aBaseContext,
 struct RuleNodeInfo {
   nsIStyleRule* mRule;
   SheetType mLevel;
+  int32_t mLayerIndex;
   bool mIsImportant;
   bool mIsAnimationRule;
 };
@@ -1657,6 +1662,7 @@ nsStyleSet::RuleNodeWithReplacement(Element* aElement,
     RuleNodeInfo* curRule = rules.AppendElement();
     curRule->mRule = ruleNode->GetRule();
     curRule->mLevel = ruleNode->GetLevel();
+    curRule->mLayerIndex = ruleNode->GetLayerIndex();
     curRule->mIsImportant = ruleNode->IsImportantRule();
     curRule->mIsAnimationRule = ruleNode->IsAnimationRule();
   }
@@ -1771,6 +1777,7 @@ nsStyleSet::RuleNodeWithReplacement(Element* aElement,
       }
 
       if (!doReplace) {
+        ruleWalker.SetLayerIndex(ruleInfo.mLayerIndex);
         ruleWalker.ForwardOnPossiblyCSSRule(ruleInfo.mRule);
         if (ruleInfo.mIsAnimationRule) {
           ruleWalker.CurrentNode()->SetIsAnimationRule();

layout/style/test/mochitest.ini

@@ -245,6 +245,7 @@ support-files =
 support-files = redundant_font_download.sjs
 [test_rem_unit.html]
 [test_restyles_in_smil_animation.html]
+[test_revert_layer.html]
 [test_root_node_display.html]
 [test_rule_insertion.html]
 [test_rule_serialization.html]

layout/style/test/test_css_supports.html

@@ -37,6 +37,7 @@ function runTest()
     "(unknown:) or (color: green)",
     "(unknown) or (color: green)",
     "(font: 16px serif)",
+    "(all: revert-layer)",
     "(color:) or (color: green)",
     "not (@page)",
     "not ({ something @with [ balanced ] brackets })",
@@ -69,6 +70,7 @@ function runTest()
     "not ({ something @with (unbalanced brackets })",
     "(color: green) or an-extension(that is [unbalanced)",
     "not(unknown: unknown)",
+    "not (all: revert-layer)",
     "(color: green) or(color: blue)",
     "(color: green;)",
     "(font-family: 'Helvetica\n",
@@ -87,7 +89,9 @@ function runTest()
     ["font", "16px serif"],
     ["font", "16px /* comment */ serif"],
     ["font", "16px\nserif"],
-    ["color", "\\0067reen"]
+    ["color", "\\0067reen"],
+    ["all", "revert-layer"],
+    ["color", "revert-layer"]
   ];
 
   var failingDeclarations = [

layout/style/test/test_revert_layer.html

@@ -0,0 +1,127 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test CSS revert-layer cascade behavior</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<div id="display"></div>
+<pre id="test">
+<script type="application/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+let fixtureCount = 0;
+
+function runFixture(css, callback) {
+  const id = "revert-layer-fixture-" + (++fixtureCount);
+  const style = document.createElement("style");
+  style.textContent = css.replace(/__ID__/g, id);
+  document.head.appendChild(style);
+
+  const element = document.createElement("div");
+  element.id = id;
+  document.getElementById("display").appendChild(element);
+
+  try {
+    callback(element, getComputedStyle(element));
+  } finally {
+    element.remove();
+    style.remove();
+  }
+}
+
+ok(CSS.supports("color", "revert-layer"), "revert-layer parses as a CSS-wide keyword");
+ok(CSS.supports("all", "revert-layer"), "all accepts revert-layer");
+ok(!CSS.supports("not (all: revert-layer)"), "supports negation sees revert-layer support");
+
+runFixture(`
+  @layer { #__ID__ { color: rgb(0, 128, 0); } }
+  @layer { #__ID__ { color: red; color: revert-layer; } }
+`, function(element, cs) {
+  is(cs.color, "rgb(0, 128, 0)", "revert-layer rolls back to a previous explicit layer");
+});
+
+runFixture(`
+  @layer { #__ID__ { color: rgb(0, 128, 0); } }
+  #__ID__ { color: red; color: revert-layer; }
+`, function(element, cs) {
+  is(cs.color, "rgb(0, 128, 0)", "revert-layer rolls back from the implicit outer layer");
+});
+
+runFixture(`
+  @layer {
+    #__ID__ { color: rgb(0, 128, 0); width: 5px; height: 6px; }
+  }
+  @layer {
+    #__ID__ { color: red; width: 50px; height: 60px; }
+    #__ID__ { all: revert-layer; }
+  }
+`, function(element, cs) {
+  is(cs.color, "rgb(0, 128, 0)", "all: revert-layer rolls color back");
+  is(cs.width, "5px", "all: revert-layer rolls width back");
+  is(cs.height, "6px", "all: revert-layer rolls height back");
+});
+
+runFixture(`
+  @layer { #__ID__ { height: 7px; } }
+  @layer { #__ID__ { block-size: revert-layer; } }
+`, function(element, cs) {
+  is(cs.height, "7px", "revert-layer on a logical alias rolls back the physical property");
+});
+
+runFixture(`
+  @layer { #__ID__ { color: rgb(0, 128, 0) !important; } }
+  @layer { #__ID__ { color: red !important; color: revert-layer !important; } }
+`, function(element, cs) {
+  is(cs.color, "rgb(0, 128, 0)", "important revert-layer uses reversed layer order");
+});
+
+runFixture(`
+  @layer { #__ID__ { color: rgb(0, 128, 0); } }
+`, function(element, cs) {
+  element.style.color = "revert-layer";
+  is(cs.color, "rgb(0, 128, 0)", "normal style attribute revert-layer rolls back to author rules");
+});
+
+runFixture(`
+  @layer { #__ID__ { color: rgb(0, 128, 0) !important; } }
+`, function(element, cs) {
+  element.style.setProperty("color", "revert-layer", "important");
+  is(cs.color, "rgb(0, 128, 0)",
+     "important style attribute revert-layer does not skip author important rules");
+});
+
+runFixture(`
+  @layer {
+    #__ID__ { --x:PASS; margin: 1px; padding-left: 1px; }
+  }
+  @layer {
+    #__ID__ {
+      --x: var(--unknown, revert-layer);
+      margin: var(--unknown, revert-layer);
+      padding-left: var(--unknown, revert-layer);
+    }
+  }
+`, function(element, cs) {
+  is(cs.getPropertyValue("--x"), "PASS", "custom property var() fallback can resolve to revert-layer");
+  is(cs.marginLeft, "1px", "shorthand var() fallback can resolve to revert-layer");
+  is(cs.paddingLeft, "1px", "longhand var() fallback can resolve to revert-layer");
+});
+
+runFixture(`
+  @layer { #__ID__ { --x:PASS; } }
+  @layer { #__ID__ { --x: var(--unknown-a, revert-layer); } }
+  @layer { #__ID__ { --x: var(--unknown-b, revert-layer); } }
+`, function(element, cs) {
+  is(cs.getPropertyValue("--x"), "PASS",
+     "custom property fallback continues past lower declarations that also resolve to revert-layer");
+});
+
+SimpleTest.finish();
+
+</script>
+</pre>
+</body>
+</html>

media/libpng/AUTHORS

@@ -0,0 +1,76 @@
+PNG REFERENCE LIBRARY AUTHORS
+=============================
+
+This is the list of PNG Reference Library ("libpng") Contributing
+Authors, for copyright and licensing purposes.
+
+ * Adam Richter
+ * Alexander Smorkalov
+ * Andreas Dilger
+ * Chris Blume
+ * Cosmin Truta
+ * Dave Martindale
+ * Eric S. Raymond
+ * Gilles Vollant
+ * Glenn Randers-Pehrson
+ * Greg Roelofs
+ * Guy Eric Schalnat
+ * Halil Oktay
+ * James Yu
+ * John Bowler
+ * Joshua Inscoe
+ * Kevin Bracey
+ * Lucas Chollet
+ * Magnus Holmgren
+ * Mandar Sahastrabuddhe
+ * Manfred Schlaegl
+ * Mans Rullgard
+ * Matt Sarett
+ * Mike Klein
+ * Mohammad Seet
+ * Pascal Massimino
+ * Paul Schmidt
+ * Petr Simecek
+ * Philippe Antoine
+ * Qiang Zhou
+ * Sam Bushell
+ * Samuel Williams
+ * Simon-Pierre Cadieux
+ * Taegu Ha (하태구)
+ * Tim Wegner
+ * Tobias Stoeckmann
+ * Tom Lane
+ * Tom Tanner
+ * Vadim Barkov
+ * Willem van Schaik
+ * Yuelin Wang (王跃林)
+ * Zhijie Liang
+ * Apple Inc.
+    - Zixu Wang (王子旭)
+ * Arm Holdings
+    - Richard Townsend
+ * Google LLC
+    - Dan Field
+    - Dragoș Tiselice
+    - Leon Scroggins III
+    - Matt Sarett
+    - Mike Klein
+    - Sami Boukortt
+    - Wan-Teh Chang
+ * Loongson Technology Corporation Ltd.
+    - GuXiWei (顾希伟)
+    - JinBo (金波)
+    - ZhangLixia (张利霞)
+ * Samsung Group
+    - Filip Wasil
+ * SpacemiT Hangzhou Technology, Co.
+    - Liang Junzhao (梁俊钊)
+
+The build projects, the build scripts, the test scripts, and other
+files in the "projects", "scripts" and "tests" directories, have
+other copyright owners, but are released under the libpng license.
+
+Some files in the "ci" and "contrib" directories, as well as some
+of the tools-generated files that are distributed with libpng, have
+other copyright owners, and are released under other open source
+licenses.

media/libpng/CHANGES

@@ -943,7 +943,7 @@ Version 1.0.8 [July 24, 2000]
 Version 1.0.9beta1 [November 10, 2000]
   Fixed typo in scripts/makefile.hpux
   Updated makevms.com in scripts and contrib/* and contrib/* (Martin Zinser)
-  Fixed seqence-point bug in contrib/pngminus/png2pnm (Martin Zinser)
+  Fixed sequence-point bug in contrib/pngminus/png2pnm (Martin Zinser)
   Changed "cdrom.com" in documentation to "libpng.org"
   Revised pnggccrd.c to get it all working, and updated makefile.gcmmx (Greg).
   Changed type of "params" from voidp to png_voidp in png_read|write_png().
@@ -1454,7 +1454,7 @@ Version 1.2.6beta4 [July 28, 2004]
     sequential read support.
   Added some "#if PNG_WRITE_SUPPORTED" blocks.
   Added #ifdef to remove some redundancy in png_malloc_default().
-  Use png_malloc instead of png_zalloc to allocate the pallete.
+  Use png_malloc instead of png_zalloc to allocate the palette.
 
 Version 1.0.16rc1 and 1.2.6rc1 [August 4, 2004]
   Fixed buffer overflow vulnerability (CVE-2004-0597) in png_handle_tRNS().
@@ -2296,7 +2296,7 @@ Version 1.4.0beta58 [May 14, 2009]
   Clarified usage of sig_bit versus sig_bit_p in example.c (Vincent Torri)
 
 Version 1.4.0beta59 [May 15, 2009]
-  Reformated sources in libpng style (3-space intentation, comment format)
+  Reformatted sources in libpng style (3-space indentation, comment format)
   Fixed typo in libpng docs (PNG_FILTER_AVE should be PNG_FILTER_AVG)
   Added sections about the git repository and our coding style to the
     documentation
@@ -2662,7 +2662,7 @@ Version 1.4.1beta06 [January 28, 2010]
 
 Version 1.4.1beta07 [February 6, 2010]
   Folded some long lines in the source files.
-  Added defineable PNG_USER_CHUNK_CACHE_MAX, PNG_USER_CHUNK_MALLOC_MAX,
+  Added definable PNG_USER_CHUNK_CACHE_MAX, PNG_USER_CHUNK_MALLOC_MAX,
     and a PNG_USER_LIMITS_SUPPORTED flag.
   Eliminated use of png_ptr->irowbytes and reused the slot in png_ptr as
     png_ptr->png_user_chunk_malloc_max.
@@ -3259,7 +3259,7 @@ Version 1.5.2beta01 [February 13, 2011]
   Revised PNG_EXPORTA macro to not use an empty parameter, to accommodate the
     old VisualC++ preprocessor.
   Turned on interlace handling in png_read_png().
-  Fixed gcc pendantic warnings.
+  Fixed gcc pedantic warnings.
   Handle longjmp in Cygwin.
   Fixed png_get_current_row_number() in the interlaced case.
   Cleaned up ALPHA flags and transformations.
@@ -3359,7 +3359,7 @@ Version 1.5.3beta05 [May 6, 2011]
   Pass "" instead of '\0' to png_default_error() in png_err().  This mistake
     was introduced in libpng-1.2.20beta01.  This fixes CVE-2011-2691.
   Added PNG_WRITE_OPTIMIZE_CMF_SUPPORTED macro to make the zlib "CMF" byte
-    optimization configureable.
+    optimization configurable.
   IDAT compression failed if preceded by a compressed text chunk (bug
     introduced in libpng-1.5.3beta01-02).  This was because the attempt to
     reset the zlib stream in png_write_IDAT happened after the first IDAT
@@ -3643,7 +3643,7 @@ Version 1.5.6beta05 [October 12, 2011]
   Fixed bug in png_write_chunk_header() debug print, introduced in 1.5.6beta01.
 
 Version 1.5.6beta06 [October 17, 2011]
-  Removed two redundant tests for unitialized row.
+  Removed two redundant tests for uninitialized row.
   Fixed a relatively harmless memory overwrite in compressed text writing
     with a 1 byte zlib buffer.
   Add ability to call png_read_update_info multiple times to pngvalid.c.
@@ -3689,7 +3689,7 @@ Version 1.5.7beta01 [November 4, 2011]
     crash.  The pngmem.c implementation of png_malloc() included a cast
     to png_size_t which would fail on large allocations on 16-bit systems.
   Fix for the preprocessor of the Intel C compiler. The preprocessor
-    splits adjacent @ signs with a space; this changes the concatentation
+    splits adjacent @ signs with a space; this changes the concatenation
     token from @-@-@ to PNG_JOIN; that should work with all compiler
     preprocessors.
   Paeth filter speed improvements from work by Siarhei Siamashka. This
@@ -3735,7 +3735,7 @@ Version 1.5.7beta03 [November 17, 2011]
     gray (on palette) itself.
   Fixes for C++ compilation using g++ When libpng source is compiled
     using g++. The compiler imposes C++ rules on the C source; thus it
-    is desireable to make the source work with either C or C++ rules
+    is desirable to make the source work with either C or C++ rules
     without throwing away useful error information.  This change adds
     png_voidcast to allow C semantic (void*) cases or the corresponding
     C++ static_cast operation, as appropriate.
@@ -3887,7 +3887,7 @@ Version 1.6.0beta06 [January 24, 2012]
 Version 1.6.0beta07 [January 28, 2012]
   Eliminated Intel icc/icl compiler warnings. The Intel (GCC derived)
     compiler issues slightly different warnings from those issued by the
-    current vesions of GCC. This eliminates those warnings by
+    current versions of GCC. This eliminates those warnings by
     adding/removing casts and small code rewrites.
   Updated configure.ac from autoupdate: added --enable-werror option.
     Also some layout regularization and removal of introduced tab characters
@@ -3920,7 +3920,7 @@ Version 1.6.0beta08 [February 1, 2012]
     version checking to configure.ac
   Improved pngstest speed by not doing redundant tests and add const to
     the background parameter of png_image_finish_read. The --background
-    option is now done automagically only when required, so that commandline
+    option is now done automagically only when required, so that command-line
     option no longer exists.
   Cleaned up pngpriv.h to consistently declare all functions and data.
     Also eliminated PNG_CONST_DATA, which is apparently not needed but we
@@ -4053,7 +4053,7 @@ Version 1.6.0beta16 [March 6, 2012]
     (in fact this is harmless, but the PNG data produced may be sub-optimal).
 
 Version 1.6.0beta17 [March 10, 2012]
-  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition. 
+  Fixed PNG_LIBPNG_BUILD_BASE_TYPE definition.
   Reject all iCCP chunks after the first, even if the first one is invalid.
   Deflate/inflate was reworked to move common zlib calls into single
     functions [rw]util.c.  A new shared keyword check routine was also added
@@ -4061,7 +4061,7 @@ Version 1.6.0beta17 [March 10, 2012]
     possible to call png_inflate() incrementally.  A warning is no longer
     issued if the language tag or translated keyword in the iTXt chunk
     has zero length.
-  If benign errors are disabled use maximum window on ancilliary inflate.
+  If benign errors are disabled use maximum window on ancillary inflate.
     This works round a bug introduced in 1.5.4 where compressed ancillary
     chunks could end up with a too-small windowBits value in the deflate
     header.
@@ -4176,7 +4176,7 @@ Version 1.6.0beta27 [August 11, 2012]
     declared even though the functions are never actually defined.  This
     change provides a dummy definition so that the declarations work, yet any
     implementation will fail to compile because of an incomplete type.
-  Re-eliminated the use of strcpy() in pngtest.c.  An unncessary use of
+  Re-eliminated the use of strcpy() in pngtest.c.  An unnecessary use of
     strcpy() was accidentally re-introduced in libpng16; this change replaces
     it with strncpy().
   Eliminated use of png_sizeof(); use sizeof() instead.
@@ -4309,7 +4309,7 @@ Version 1.6.0beta31 [November 1, 2012]
     resulting in VS2010 having to update the files.
   Removed non-working ICC profile support code that was mostly added to
     libpng-1.6.0beta29 and beta30. There was too much code for too little
-    gain; implementing full ICC color correction may be desireable but is left
+    gain; implementing full ICC color correction may be desirable but is left
     up to applications.
 
 Version 1.6.0beta32 [November 25, 2012]
@@ -4592,7 +4592,7 @@ Version 1.6.3beta07 [June 8, 2013]
     the optimizations ('check' vs 'api') are exposed in the public header files
     except that the new setting PNG_ARM_NEON_OPT documents how libpng makes the
     decision about whether or not to use the optimizations.
-  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS useage.
+  Protect symbol prefixing against CC/CPPFLAGS/CFLAGS usage.
     Previous iOS/Xcode fixes for the ARM NEON optimizations moved the test
     on __ARM_NEON__ from configure time to compile time.  This breaks symbol
     prefixing because the definition of the special png_init_filter_functions
@@ -4963,7 +4963,7 @@ Version 1.6.13beta01 [July 4, 2014]
   Changed "if defined(__ARM_NEON__)" to
     "if (defined(__ARM_NEON__) || defined(__ARM_NEON))" (James Wu).
   Fixed clang no-warning builds: png_digit was defined but never used.
-    
+
 Version 1.6.13beta02 [July 21, 2014]
   Fixed an incorrect separator ("/" should be "\") in scripts/makefile.vcwin32
     (bug report from Wolfgang S. Kechel).  Bug was introduced in libpng-1.6.11.
@@ -5454,7 +5454,7 @@ Version 1.6.21beta01 [December 11, 2015]
 Version 1.6.21beta02 [December 14, 2015]
   Moved png_check_keyword() from pngwutil.c to pngset.c
   Removed LE/BE dependencies in pngvalid, to 'fix' the current problem
-    in the BigEndian tests by not testing it, making the BE code the same 
+    in the BigEndian tests by not testing it, making the BE code the same
     as the LE version.
   Fixes to pngvalid for various reduced build configurations (eliminate unused
     statics) and a fix for the case in rgb_to_gray when the digitize option
@@ -5518,7 +5518,7 @@ Version 1.6.22beta03 [March 9, 2016]
   Added a common-law trademark notice and export control information
     to the LICENSE file, png.h, and the man page.
   Restored "& 0xff" in png_save_uint_16() and png_save_uint_32() that
-    were accidentally removed from libpng-1.6.17. 
+    were accidentally removed from libpng-1.6.17.
   Changed PNG_INFO_cHNK and PNG_FREE_cHNK from 0xnnnn to 0xnnnnU in png.h
     (Robert C. Seacord).
   Removed dubious "#if INT_MAX" test from png.h that was added to
@@ -5635,7 +5635,7 @@ Version 1.6.24beta02 [June 23, 2016]
     to All and adds a list of the warnings that need to be turned off.  This is
     semi-documentary; the intent is to tell libpng users which warnings have
     been examined and judged non-fixable at present.  The warning about
-    structure padding is fixable, but it would be a signficant change (moving
+    structure padding is fixable, but it would be a significant change (moving
     structure members around).
 
 Version 1.6.24beta03 [July 4, 2016]
@@ -5754,11 +5754,641 @@ Version 1.6.26 [October 20, 2016]
   Cosmetic change, "ptr != 0" to "ptr != NULL" in png.c and pngrutil.c
   Despammed email addresses (replaced "@" with " at ").
 
-Send comments/corrections/commendations to png-mng-implement at lists.sf.net
-(subscription required; visit
-https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe)
-or to glennrp at users.sourceforge.net
+Version 1.6.27beta01 [November 2, 2016]
+  Restrict the new ADLER32-skipping to IDAT chunks.  It broke iCCP chunk
+    handling: an erroneous iCCP chunk would throw a png_error and reject the
+    entire PNG image instead of rejecting just the iCCP chunk with a warning,
+    if built with zlib-1.2.8.1.
 
-Glenn R-P
+Version 1.6.27rc01 [December 27, 2016]
+  Control ADLER32 checking with new PNG_IGNORE_ADLER32 option. Fixes
+    an endless loop when handling erroneous ADLER32 checksums; bug
+    introduced in libpng-1.6.26.
+  Removed the use of a macro containing the pre-processor 'defined'
+    operator.  It is unclear whether this is valid; a macro that
+    "generates" 'defined' is not permitted, but the use of the word
+    "generates" within the C90 standard seems to imply more than simple
+    substitution of an expression itself containing a well-formed defined
+    operation.
+  Added ARM support to CMakeLists.txt (Andreas Franek).
+
+Version 1.6.27 [December 29, 2016]
+  Fixed a potential null pointer dereference in png_set_text_2() (bug report
+    and patch by Patrick Keshishian, CVE-2016-10087).
+
+Version 1.6.28rc01 [January 3, 2017]
+  Fixed arm/aarch64 detection in CMakeLists.txt (Gianfranco Costamagna).
+  Added option to Cmake build allowing a custom location of zlib to be
+    specified in a scenario where libpng is being built as a subproject
+    alongside zlib by another project (Sam Serrels).
+  Changed png_ptr->options from a png_byte to png_uint_32, to accommodate
+    up to 16 options.
+
+Version 1.6.28rc02 [January 4, 2017]
+  Added "include(GNUInstallDirs)" to CMakeLists.txt (Gianfranco Costamagna).
+  Moved SSE2 optimization code into the main libpng source directory.
+    Configure libpng with "configure --enable-intel-sse" or compile
+    libpng with "-DPNG_INTEL_SSE" in CPPFLAGS to enable it.
+
+Version 1.6.28rc03 [January 4, 2017]
+  Backed out the SSE optimization and last CMakeLists.txt to allow time for QA.
+
+Version 1.6.28 [January 5, 2017]
+  No changes.
+
+Version 1.6.29beta01 [January 12, 2017]
+  Readded "include(GNUInstallDirs)" to CMakeLists.txt (Gianfranco Costamagna).
+  Moved SSE2 optimization code into the main libpng source directory.
+    Configure libpng with "configure --enable-intel-sse" or compile
+    libpng with "-DPNG_INTEL_SSE" in CPPFLAGS to enable it.
+  Simplified conditional compilation in pngvalid.c, for AIX (Michael Felt).
+
+Version 1.6.29beta02 [February 22, 2017]
+  Avoid conditional directives that break statements in pngrutil.c (Romero
+    Malaquias)
+  The contrib/examples/pngtopng.c recovery code was in the wrong "if"
+    branches; the comments were correct.
+  Added code for PowerPC VSX optimisation (Vadim Barkov).
+
+Version 1.6.29beta03 [March 1, 2017]
+  Avoid potential overflow of shift operations in png_do_expand() (Aaron Boxer).
+  Change test ZLIB_VERNUM >= 0x1281 to ZLIB_VERNUM >= 0x1290 in pngrutil.c
+    because Solaris 11 distributes zlib-1.2.8.f that is older than 1.2.8.1,
+    as suggested in zlib FAQ, item 24.
+  Suppress clang warnings about implicit sign changes in png.c
+
+Version 1.6.29 [March 16, 2017]
+  No changes.
+
+Version 1.6.30beta01 [April 1, 2017]
+  Added missing "$(CPPFLAGS)" to the compile line for c.pic.o in
+    makefile.linux and makefile.solaris-x86 (Cosmin).
+  Revised documentation of png_get_error_ptr() in the libpng manual.
+  Silence clang -Wcomma and const drop warnings (Viktor Szakats).
+  Update Sourceforge URLs in documentation (https instead of http).
+
+Version 1.6.30beta02 [April 22, 2017]
+  Document need to check for integer overflow when allocating a pixel
+    buffer for multiple rows in contrib/gregbook, contrib/pngminus,
+    example.c, and in the manual (suggested by Jaeseung Choi). This
+    is similar to the bug reported against pngquant in CVE-2016-5735.
+  Removed reference to the obsolete PNG_SAFE_LIMITS macro in the documentation.
+
+Version 1.6.30beta03 [May 22, 2017]
+  Check for integer overflow in contrib/visupng and contrib/tools/genpng.
+  Do not double evaluate CMAKE_SYSTEM_PROCESSOR in CMakeLists.txt.
+  Test CMAKE_HOST_WIN32 instead of WIN32 in CMakeLists.txt.
+  Fix some URL in documentation.
+
+Version 1.6.30beta04 [June 7, 2017]
+  Avoid writing an empty IDAT when the last IDAT exactly fills the
+    compression buffer (bug report by Brian Baird). This bug was
+    introduced in libpng-1.6.0.
+
+Version 1.6.30rc01 [June 14, 2017]
+  No changes.
+
+Version 1.6.30rc02 [June 25, 2017]
+  Update copyright year in pnglibconf.h, make ltmain.sh executable.
+  Add a reference to the libpng.download site in README.
+
+Version 1.6.30 [June 28, 2017]
+  No changes.
+
+Version 1.6.31beta01 [July 5, 2017]
+  Guard the definition of _POSIX_SOURCE in pngpriv.h (AIX already defines it;
+    bug report by Michael Felt).
+  Revised pngpriv.h to work around failure to compile arm/filter_neon.S
+    ("typedef" directive is unrecognized by the assembler). The problem
+    was introduced in libpng-1.6.30beta01.
+  Added "Requires: zlib" to libpng.pc.in (Pieter Neerincx).
+  Added special case for FreeBSD in arm/filter_neon.S (Maya Rashish).
+
+Version 1.6.31beta02 [July 8, 2017]
+  Added instructions for disabling hardware optimizations in INSTALL.
+  Added "--enable-hardware-optimizations" configuration flag to enable
+    or disable all hardware optimizations with one flag.
+
+Version 1.6.31beta03 [July 9, 2017]
+  Updated CMakeLists.txt to add INTEL_SSE and MIPS_MSA platforms.
+  Changed "int" to "png_size_t" in intel/filter_sse2.c to prevent
+    possible integer overflow (Bug report by John Bowler).
+  Quieted "declaration after statement" warnings in intel/filter_sse2.c.
+  Added scripts/makefile-linux-opt, which has hardware optimizations enabled.
+
+Version 1.6.31beta04 [July 11, 2017]
+  Removed one of the GCC-7.1.0 'strict-overflow' warnings that result when
+    integers appear on both sides of a compare.  Worked around the others by
+    forcing the strict-overflow setting in the relevant functions to a level
+    where they are not reported (John Bowler).
+  Changed "FALL THROUGH" comments to "FALLTHROUGH" because GCC doesn't like
+    the space.
+  Worked around some C-style casts from (void*) because g++ 5.4.0 objects
+    to them.
+  Increased the buffer size for 'sprint' to pass the gcc 7.1.0 'sprint
+    overflow' check that is on by default with -Wall -Wextra.
+
+Version 1.6.31beta05 [July 13, 2017]
+  Added eXIf chunk support.
+
+Version 1.6.31beta06 [July 17, 2017]
+  Added a minimal eXIf chunk (with Orientation and FocalLengthIn35mmFilm
+    tags) to pngtest.png.
+
+Version 1.6.31beta07 [July 18, 2017]
+  Revised the eXIf chunk in pngtest.png to fix "Bad IFD1 Directory" warning.
+
+Version 1.6.31rc01 [July 19, 2017]
+  No changes.
+
+Version 1.6.31rc02 [July 25, 2017]
+  Fixed typo in example.c (png_free_image should be png_image_free) (Bug
+    report by John Smith)
+
+Version 1.6.31 [July 27, 2017]
+  No changes.
+
+Version 1.6.32beta01 [July 31, 2017]
+  Avoid possible NULL dereference in png_handle_eXIf when benign_errors
+    are allowed. Avoid leaking the input buffer "eXIf_buf".
+  Eliminated png_ptr->num_exif member from pngstruct.h and added num_exif
+    to arguments for png_get_eXIf() and png_set_eXIf().
+  Added calls to png_handle_eXIf(() in pngread.c and png_write_eXIf() in
+    pngwrite.c, and made various other fixes to png_write_eXIf().
+  Changed name of png_get_eXIF and png_set_eXIf() to png_get_eXIf_1() and
+    png_set_eXIf_1(), respectively, to avoid breaking API compatibility
+    with libpng-1.6.31.
+
+Version 1.6.32beta02 [August 1, 2017]
+  Updated contrib/libtests/pngunknown.c with eXIf chunk.
+
+Version 1.6.32beta03 [August 2, 2017]
+  Initialized btoa[] in pngstest.c
+  Stop memory leak when returning from png_handle_eXIf() with an error
+    (Bug report from the OSS-fuzz project).
+
+Version 1.6.32beta04 [August 2, 2017]
+  Replaced local eXIf_buf with info_ptr->eXIf_buf in png_handle_eXIf().
+  Update libpng.3 and libpng-manual.txt about eXIf functions.
+
+Version 1.6.32beta05 [August 2, 2017]
+  Restored png_get_eXIf() and png_set_eXIf() to maintain API compatibility.
+
+Version 1.6.32beta06 [August 2, 2017]
+  Removed png_get_eXIf_1() and png_set_eXIf_1().
+
+Version 1.6.32beta07 [August 3, 2017]
+  Check length of all chunks except IDAT against user limit to fix an
+    OSS-fuzz issue (Fixes CVE-2017-12652).
+
+Version 1.6.32beta08 [August 3, 2017]
+  Check length of IDAT against maximum possible IDAT size, accounting
+    for height, rowbytes, interlacing and zlib/deflate overhead.
+  Restored png_get_eXIf_1() and png_set_eXIf_1(), because strlen(eXIf_buf)
+    does not work (the eXIf chunk data can contain zeroes).
+
+Version 1.6.32beta09 [August 3, 2017]
+  Require cmake-2.8.8 in CMakeLists.txt. Revised symlink creation,
+    no longer using deprecated cmake LOCATION feature (Clifford Yapp).
+  Fixed five-byte error in the calculation of IDAT maximum possible size.
+
+Version 1.6.32beta10 [August 5, 2017]
+  Moved chunk-length check into a png_check_chunk_length() private
+    function (Suggested by Max Stepin).
+  Moved bad pngs from tests to contrib/libtests/crashers
+  Moved testing of bad pngs into a separate tests/pngtest-badpngs script
+  Added the --xfail (expected FAIL) option to pngtest.c. It writes XFAIL
+    in the output but PASS for the libpng test.
+  Require cmake-3.0.2 in CMakeLists.txt (Clifford Yapp).
+  Fix "const" declaration info_ptr argument to png_get_eXIf_1() and the
+    num_exif argument to png_get_eXIf_1() (Github Issue 171).
+
+Version 1.6.32beta11 [August 7, 2017]
+  Added "eXIf" to "chunks_to_ignore[]" in png_set_keep_unknown_chunks().
+  Added huge_IDAT.png and empty_ancillary_chunks.png to testpngs/crashers.
+  Make pngtest --strict, --relax, --xfail options imply -m (multiple).
+  Removed unused chunk_name parameter from png_check_chunk_length().
+  Relocated setting free_me for eXIf data, to stop an OSS-fuzz leak.
+  Initialize profile_header[] in png_handle_iCCP() to fix OSS-fuzz issue.
+  Initialize png_ptr->row_buf[0] to 255 in png_read_row() to fix OSS-fuzz UMR.
+  Attempt to fix a UMR in png_set_text_2() to fix OSS-fuzz issue.
+  Increase minimum zlib stream from 9 to 14 in png_handle_iCCP(), to account
+    for the minimum 'deflate' stream, and relocate the test to a point
+    after the keyword has been read.
+  Check that the eXIf chunk has at least 2 bytes and begins with "II" or "MM".
+
+Version 1.6.32rc01 [August 18, 2017]
+  Added a set of "huge_xxxx_chunk.png" files to contrib/testpngs/crashers,
+    one for each known chunk type, with length = 2GB-1.
+  Check for 0 return from png_get_rowbytes() and added some (size_t) typecasts
+    in contrib/pngminus/*.c to stop some Coverity issues (162705, 162706,
+    and 162707).
+  Renamed chunks in contrib/testpngs/crashers to avoid having files whose
+    names differ only in case; this causes problems with some platforms
+    (github issue #172).
+
+Version 1.6.32rc02 [August 22, 2017]
+  Added contrib/oss-fuzz directory which contains files used by the oss-fuzz
+    project <https://github.com/google/oss-fuzz/tree/master/projects/libpng>.
+
+Version 1.6.32 [August 24, 2017]
+  No changes.
+
+Version 1.6.33beta01 [August 28, 2017]
+  Added PNGMINUS_UNUSED macro to contrib/pngminus/p*.c and added missing
+    parenthesis in contrib/pngminus/pnm2png.c (bug report by Christian Hesse).
+  Fixed off-by-one error in png_do_check_palette_indexes() (Bug report
+    by Mick P., Source Forge Issue #269).
+
+Version 1.6.33beta02 [September 3, 2017]
+  Initialize png_handler.row_ptr in contrib/oss-fuzz/libpng_read_fuzzer.cc
+    to fix shortlived oss-fuzz issue 3234.
+  Compute a larger limit on IDAT because some applications write a deflate
+    buffer for each row (Bug report by Andrew Church).
+  Use current date (DATE) instead of release-date (RDATE) in last
+    changed date of contrib/oss-fuzz files.
+  Enabled ARM support in CMakeLists.txt (Bernd Kuhls).
+
+Version 1.6.33beta03 [September 14, 2017]
+  Fixed incorrect typecast of some arguments to png_malloc() and
+    png_calloc() that were png_uint_32 instead of png_alloc_size_t
+    (Bug report by "irwir" in Github libpng issue #175).
+  Use pnglibconf.h.prebuilt when building for ANDROID with cmake (Github
+    issue 162, by rcdailey).
+
+Version 1.6.33rc01 [September 20, 2017]
+  Initialize memory allocated by png_inflate to zero, using memset, to
+    stop an oss-fuzz "use of uninitialized value" detection in png_set_text_2()
+    due to truncated iTXt or zTXt chunk.
+  Initialize memory allocated by png_read_buffer to zero, using memset, to
+    stop an oss-fuzz "use of uninitialized value" detection in
+    png_icc_check_tag_table() due to truncated iCCP chunk.
+  Removed a redundant test (suggested by "irwir" in Github issue #180).
+
+Version 1.6.33rc02 [September 23, 2017]
+  Added an interlaced version of each file in contrib/pngsuite.
+  Relocate new memset() call in pngrutil.c.
+  Removed more redundant tests (suggested by "irwir" in Github issue #180).
+  Add support for loading images with associated alpha in the Simplified
+    API (Samuel Williams).
+
+Version 1.6.33 [September 28, 2017]
+  Revert contrib/oss-fuzz/libpng_read_fuzzer.cc to libpng-1.6.32 state.
+  Initialize png_handler.row_ptr in contrib/oss-fuzz/libpng_read_fuzzer.cc
+  Add end_info structure and png_read_end() to the libpng fuzzer.
+
+Version 1.6.34 [September 29, 2017]
+  Removed contrib/pngsuite/i*.png; some of them caused test failures.
+
+Version 1.6.35beta01 [March 6, 2018]
+  Restored 21 of the contrib/pngsuite/i*.png, which do not cause test
+    failures. Placed the remainder in contrib/pngsuite/interlaced/i*.png.
+  Added calls to png_set_*() transforms commonly used by browsers to
+    the fuzzer.
+  Removed some unnecessary brackets in pngrtran.c
+  Fixed miscellaneous typos (Patch by github user "luzpaz").
+  Change "ASM C" to "C ASM" in CMakeLists.txt
+  Fixed incorrect handling of bKGD chunk in sub-8-bit files (Cosmin)
+  Added hardware optimization directories to zip and 7z distributions.
+  Fixed incorrect bitmask for options.
+  Fixed many spelling typos.
+
+Version 1.6.35beta02 [March 28, 2018]
+  Make png_get_iCCP consistent with man page (allow compression-type argument
+  to be NULL, bug report by Lenard Szolnoki).
+
+Version 1.6.35 [July 15, 2018]
+  Replaced the remaining uses of png_size_t with size_t (Cosmin)
+  Fixed the calculation of row_factor in png_check_chunk_length
+    (reported by Thuan Pham in SourceForge issue #278)
+  Added missing parentheses to a macro definition
+    (suggested by "irwir" in GitHub issue #216)
+
+Version 1.6.36 [December 1, 2018]
+  Optimized png_do_expand_palette for ARM processors.
+  Improved performance by around 10-22% on a recent ARM Chromebook.
+    (Contributed by Richard Townsend, ARM Holdings)
+  Fixed manipulation of machine-specific optimization options.
+    (Contributed by Vicki Pfau)
+  Used memcpy instead of manual pointer arithmetic on Intel SSE2.
+    (Contributed by Samuel Williams)
+  Fixed build errors with MSVC on ARM64.
+    (Contributed by Zhijie Liang)
+  Fixed detection of libm in CMakeLists.
+    (Contributed by Cameron Cawley)
+  Fixed incorrect creation of pkg-config file in CMakeLists.
+    (Contributed by Kyle Bentley)
+  Fixed the CMake build on Windows MSYS by avoiding symlinks.
+  Fixed a build warning on OpenBSD.
+    (Contributed by Theo Buehler)
+  Fixed various typos in comments.
+    (Contributed by "luz.paz")
+  Raised the minimum required CMake version from 3.0.2 to 3.1.
+  Removed yet more of the vestigial support for pre-ANSI C compilers.
+  Removed ancient makefiles for ancient systems that have been broken
+    across all previous libpng-1.6.x versions.
+  Removed the Y2K compliance statement and the export control
+    information.
+  Applied various code style and documentation fixes.
+
+Version 1.6.37 [April 14, 2019]
+  Fixed a use-after-free vulnerability (CVE-2019-7317) in png_image_free.
+  Fixed a memory leak in the ARM NEON implementation of png_do_expand_palette.
+  Fixed a memory leak in pngtest.c.
+  Fixed two vulnerabilities (CVE-2018-14048, CVE-2018-14550) in
+    contrib/pngminus; refactor.
+  Changed the license of contrib/pngminus to MIT; refresh makefile and docs.
+    (Contributed by Willem van Schaik)
+  Fixed a typo in the libpng license v2.
+    (Contributed by Miguel Ojeda)
+  Added makefiles for AddressSanitizer-enabled builds.
+  Cleaned up various makefiles.
+
+Version 1.6.38 [September 14, 2022]
+  Added configurations and scripts for continuous integration.
+  Fixed various errors in the handling of tRNS, hIST and eXIf.
+  Implemented many stability improvements across all platforms.
+  Updated the internal documentation.
+
+Version 1.6.39 [November 20, 2022]
+  Changed the error handler of oversized chunks (i.e. larger than
+    PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
+  Fixed a buffer overflow error in contrib/tools/pngfix.
+  Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
+  Disabled the ARM Neon optimizations by default in the CMake file,
+    following the default behavior of the configure script.
+  Allowed configure.ac to work with the trunk version of autoconf.
+  Removed the support for "install" targets from the legacy makefiles;
+    removed the obsolete makefile.cegcc.
+  Cleaned up the code and updated the internal documentation.
+
+Version 1.6.40 [June 21, 2023]
+  Fixed the eXIf chunk multiplicity checks.
+  Fixed a memory leak in pCAL processing.
+  Corrected the validity report about tRNS inside png_get_valid().
+  Fixed various build issues on *BSD, Mac and Windows.
+  Updated the configurations and the scripts for continuous integration.
+  Cleaned up the code, the build scripts, and the documentation.
+
+Version 1.6.41 [January 24, 2024]
+  Added SIMD-optimized code for the LoongArch LSX hardware.
+    (Contributed by GuXiWei, JinBo and ZhangLixia)
+  Fixed the run-time discovery of MIPS MSA hardware.
+    (Contributed by Sui Jingfeng)
+  Fixed an off-by-one error in the function png_do_check_palette_indexes(),
+    which failed to recognize errors that might have existed in the first
+    column of a broken palette-encoded image. This was a benign regression
+    accidentally introduced in libpng-1.6.33. No pixel was harmed.
+    (Contributed by Adam Richter; reviewed by John Bowler)
+  Fixed, improved and modernized the contrib/pngminus programs, i.e.,
+    png2pnm.c and pnm2png.c
+  Removed old and peculiar portability hacks that were meant to silence
+    warnings issued by gcc version 7.1 alone.
+    (Contributed by John Bowler)
+  Fixed and modernized the CMake file, and raised the minimum required
+    CMake version from 3.1 to 3.6.
+    (Contributed by Clinton Ingram, Timothy Lyanguzov, Tyler Kropp, et al.)
+  Allowed the configure script to disable the building of auxiliary tools
+    and tests, thus catching up with the CMake file.
+    (Contributed by Carlo Bramini)
+  Fixed a build issue on Mac.
+    (Contributed by Zixu Wang)
+  Moved the Autoconf macro files to scripts/autoconf.
+  Moved the CMake files (except for the main CMakeLists.txt) to
+    scripts/cmake and moved the list of their contributing authors to
+    scripts/cmake/AUTHORS.md
+  Updated the CI configurations and scripts.
+  Relicensed the CI scripts to the MIT License.
+  Improved the test coverage.
+    (Contributed by John Bowler)
+
+Version 1.6.42 [January 29, 2024]
+  Fixed the implementation of the macro function png_check_sig().
+    This was an API regression, introduced in libpng-1.6.41.
+    (Reported by Matthieu Darbois)
+  Fixed and updated the libpng manual.
+
+Version 1.6.43 [February 23, 2024]
+  Fixed the row width check in png_check_IHDR().
+    This corrected a bug that was specific to the 16-bit platforms,
+    and removed a spurious compiler warning from the 64-bit builds.
+    (Reported by Jacek Caban; fixed by John Bowler)
+  Added eXIf chunk support to the push-mode reader in pngpread.c.
+    (Contributed by Chris Blume)
+  Added contrib/pngexif for the benefit of the users who would like
+    to inspect the content of eXIf chunks.
+  Added contrib/conftest/basic.dfa, a basic build-time configuration.
+    (Contributed by John Bowler)
+  Fixed a preprocessor condition in pngread.c that broke build-time
+    configurations like contrib/conftest/pngcp.dfa.
+    (Contributed by John Bowler)
+  Added CMake build support for LoongArch LSX.
+    (Contributed by GuXiWei)
+  Fixed a CMake build error that occurred under a peculiar state of the
+    dependency tree. This was a regression introduced in libpng-1.6.41.
+    (Contributed by Dan Rosser)
+  Marked the installed libpng headers as system headers in CMake.
+    (Contributed by Benjamin Buch)
+  Updated the build support for RISCOS.
+    (Contributed by Cameron Cawley)
+  Updated the makefiles to allow cross-platform builds to initialize
+    conventional make variables like AR and ARFLAGS.
+  Added various improvements to the CI scripts in areas like version
+    consistency verification and text linting.
+  Added version consistency verification to pngtest.c also.
+
+Version 1.6.44 [September 12, 2024]
+  Hardened calculations in chroma handling to prevent overflows, and
+    relaxed a constraint in cHRM validation to accomodate the standard
+    ACES AP1 set of color primaries.
+    (Contributed by John Bowler)
+  Removed the ASM implementation of ARM Neon optimizations and updated
+    the build accordingly. Only the remaining C implementation shall be
+    used from now on, thus ensuring the support of the PAC/BTI security
+    features on ARM64.
+    (Contributed by Ross Burton and John Bowler)
+  Fixed the pickup of the PNG_HARDWARE_OPTIMIZATIONS option in the
+    CMake build on FreeBSD/amd64. This is an important performance fix
+    on this platform.
+  Applied various fixes and improvements to the CMake build.
+    (Contributed by Eric Riff, Benjamin Buch and Erik Scholz)
+  Added fuzzing targets for the simplified read API.
+    (Contributed by Mikhail Khachayants)
+  Fixed a build error involving pngtest.c under a custom config.
+    This was a regression introduced in a code cleanup in libpng-1.6.43.
+    (Contributed by Ben Wagner)
+  Fixed and improved the config files for AppVeyor CI and Travis CI.
+
+Version 1.6.45 [January 7, 2025]
+  Added support for the cICP chunk.
+    (Contributed by Lucas Chollet and John Bowler)
+  Adjusted and improved various checks in colorspace calculations.
+    (Contributed by John Bowler)
+  Rearranged the write order of colorspace chunks for better conformance
+    with the PNG v3 draft specification.
+    (Contributed by John Bowler)
+  Raised the minimum required CMake version from 3.6 to 3.14.
+  Forked off a development branch for libpng version 1.8.
+
+Version 1.6.46 [January 23, 2025]
+  Added support for the mDCV and cLLI chunks.
+    (Contributed by John Bowler)
+  Fixed a build issue affecting C89 compilers.
+    This was a regression introduced in libpng-1.6.45.
+    (Contributed by John Bowler)
+  Added makefile.c89, specifically for testing C89 compilers.
+  Cleaned up contrib/pngminus: corrected an old typo, removed an old
+    workaround, and updated the CMake file.
+
+Version 1.6.47 [February 18, 2025]
+  Modified the behaviour of colorspace chunks in order to adhere
+    to the new precedence rules formulated in the latest draft of
+    the PNG Specification.
+    (Contributed by John Bowler)
+  Fixed a latent bug in `png_write_iCCP`.
+    This would have been a read-beyond-end-of-malloc vulnerability,
+    introduced early in the libpng-1.6.0 development, yet (fortunately!)
+    it was inaccessible before the above-mentioned modification of the
+    colorspace precedence rules, due to pre-existing colorspace checks.
+    (Reported by Bob Friesenhahn; fixed by John Bowler)
+
+Version 1.6.48 [April 30, 2025]
+  Fixed the floating-point version of the mDCv setter `png_set_mDCv`.
+    (Reported by Mohit Bakshi; fixed by John Bowler)
+  Added #error directives to discourage the inclusion of private
+    libpng implementation header files in PNG-supporting applications.
+  Added the CMake build option `PNG_LIBCONF_HEADER`, to be used as an
+    alternative to `DFA_XTRA`.
+  Removed the Travis CI configuration files, with heartfelt thanks for
+    their generous support of our project over the past five years!
+
+Version 1.6.49 [June 12, 2025]
+  Added SIMD-optimized code for the RISC-V Vector Extension (RVV).
+    (Contributed by Manfred Schlaegl, Dragos Tiselice and Filip Wasil)
+  Added various fixes and improvements to the build scripts and to
+    the sample code.
+
+Version 1.6.50 [July 1, 2025]
+  Improved the detection of the RVV Extension on the RISC-V platform.
+    (Contributed by Filip Wasil)
+  Replaced inline ASM with C intrinsics in the RVV code.
+    (Contributed by Filip Wasil)
+  Fixed a decoder defect in which unknown chunks trailing IDAT, set
+    to go through the unknown chunk handler, incorrectly triggered
+    out-of-place IEND errors.
+    (Contributed by John Bowler)
+  Fixed the CMake file for cross-platform builds that require `libm`.
+
+Version 1.6.51 [November 21, 2025]
+  Fixed CVE-2025-64505 (moderate severity):
+    Heap buffer overflow in `png_do_quantize` via malformed palette index.
+    (Reported by Samsung; analyzed by Fabio Gritti.)
+  Fixed CVE-2025-64506 (moderate severity):
+    Heap buffer over-read in `png_write_image_8bit` with 8-bit input and
+    `convert_to_8bit` enabled.
+    (Reported by Samsung and <weijinjinnihao@users.noreply.github.com>;
+    analyzed by Fabio Gritti.)
+  Fixed CVE-2025-64720 (high severity):
+    Buffer overflow in `png_image_read_composite` via incorrect palette
+    premultiplication.
+    (Reported by Samsung; analyzed by John Bowler.)
+  Fixed CVE-2025-65018 (high severity):
+    Heap buffer overflow in `png_combine_row` triggered via
+    `png_image_finish_read`.
+    (Reported by <yosiimich@users.noreply.github.com>.)
+  Fixed a memory leak in `png_set_quantize`.
+    (Reported by Samsung; analyzed by Fabio Gritti.)
+  Removed the experimental and incomplete ERROR_NUMBERS code.
+    (Contributed by Tobias Stoeckmann.)
+  Improved the RISC-V vector extension support; required RVV 1.0 or newer.
+    (Contributed by Filip Wasil.)
+  Added GitHub Actions workflows for automated testing.
+  Performed various refactorings and cleanups.
+
+Version 1.6.52 [December 3, 2025]
+  Fixed CVE-2025-66293 (high severity):
+    Out-of-bounds read in `png_image_read_composite`.
+    (Reported by flyfish101 <flyfish101@users.noreply.github.com>.)
+  Fixed the Paeth filter handling in the RISC-V RVV implementation.
+    (Reported by Filip Wasil; fixed by Liang Junzhao.)
+  Improved the performance of the RISC-V RVV implementation.
+    (Contributed by Liang Junzhao.)
+  Added allocation failure fuzzing to oss-fuzz.
+    (Contributed by Philippe Antoine.)
+
+Version 1.6.53 [December 5, 2025]
+  Fixed a build failure on RISC-V RVV caused by a misspelled intrinsic.
+    (Contributed by Alexander Smorkalov.)
+  Fixed a build failure with CMake 4.1 or newer, on Windows, when using
+    Visual C++ without MASM installed.
+
+Version 1.6.54 [January 12, 2026]
+  Fixed CVE-2026-22695 (medium severity):
+    Heap buffer over-read in `png_image_read_direct_scaled`.
+    (Reported and fixed by Petr Simecek.)
+  Fixed CVE-2026-22801 (medium severity):
+    Integer truncation causing heap buffer over-read in `png_image_write_*`.
+  Implemented various improvements in oss-fuzz.
+    (Contributed by Philippe Antoine.)
+
+Version 1.6.55 [February 9, 2026]
+  Fixed CVE-2026-25646 (high severity):
+    Heap buffer overflow in `png_set_quantize`.
+    (Reported and fixed by Joshua Inscoe.)
+  Resolved an oss-fuzz build issue involving nalloc.
+    (Contributed by Philippe Antoine.)
+
+Version 1.6.56 [March 25, 2026]
+  Fixed CVE-2026-33416 (high severity):
+    Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.
+    (Reported by Halil Oktay and Ryo Shimada;
+    fixed by Halil Oktay and Cosmin Truta.)
+  Fixed CVE-2026-33636 (high severity):
+    Out-of-bounds read/write in the palette expansion on ARM Neon.
+    (Reported by Taegu Ha; fixed by Taegu Ha and Cosmin Truta.)
+  Fixed uninitialized reads beyond `num_trans` in `trans_alpha` buffers.
+    (Contributed by Halil Oktay.)
+  Fixed stale `info_ptr->palette` after in-place gamma and background
+    transforms.
+  Fixed wrong channel indices in `png_image_read_and_map` RGB_ALPHA path.
+    (Contributed by Yuelin Wang.)
+  Fixed wrong background color in colormap read.
+    (Contributed by Yuelin Wang.)
+  Fixed dead loop in sPLT write.
+    (Contributed by Yuelin Wang.)
+  Added missing null pointer checks in four public API functions.
+    (Contributed by Yuelin Wang.)
+  Validated shift bit depths in `png_set_shift` to prevent infinite loop.
+    (Contributed by Yuelin Wang.)
+  Avoided undefined behavior in library and tests.
+  Deprecated the hardly-ever-tested POINTER_INDEXING config option.
+  Added negative-stride test coverage for the simplified API.
+  Fixed memory leaks and API misuse in oss-fuzz.
+    (Contributed by Owen Sanzas.)
+  Implemented various fixes and improvements in oss-fuzz.
+    (Contributed by Bob Friesenhahn and Philippe Antoine.)
+  Performed various refactorings and cleanups.
+
+Version 1.6.57 [April 8, 2026]
+  Fixed CVE-2026-34757 (medium severity):
+    Use-after-free in `png_set_PLTE`, `png_set_tRNS` and `png_set_hIST`
+    leading to corrupted chunk data and potential heap information disclosure.
+    Also hardened the append-style setters (`png_set_text`, `png_set_sPLT`,
+    `png_set_unknown_chunks`) against a theoretical variant of the same
+    aliasing pattern.
+    (Reported by Iv4n <Iv4n550@users.noreply.github.com>.)
+  Fixed integer overflow in rowbytes computation in read transforms.
+    (Contributed by Mohammad Seet.)
+
+Version 1.6.58 [April 15, 2026]
+  Fixed a regression introduced in version 1.6.56 that caused `png_get_PLTE`
+    to return stale palette data after applying gamma and background transforms
+    in-place.
+    (Reported by ralfjunker <ralfjunker@users.noreply.github.com>.)
+
+
+Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
+Subscription is required; visit
+<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
+to subscribe.
 #endif

media/libpng/INSTALL

@@ -0,0 +1,467 @@
+    Installing libpng
+
+Contents
+
+       I. Simple installation
+      II. Rebuilding the configure scripts
+     III. Using scripts/makefile*
+      IV. Using cmake
+       V. Directory structure
+      VI. Building with project files
+     VII. Building with makefiles
+    VIII. Configuring libpng for 16-bit platforms
+      IX. Configuring for DOS
+       X. Configuring for Medium Model
+      XI. Prepending a prefix to exported symbols
+     XII. Configuring for compiler xxx:
+    XIII. Removing unwanted object code
+     XIV. Enabling or disabling hardware optimizations
+      XV. Changes to the build and configuration of libpng in libpng-1.5.x
+     XVI. Setjmp/longjmp issues
+    XVII. Common linking failures
+   XVIII. Other sources of information about libpng
+
+I. Simple installation
+
+On Unix/Linux and similar systems, you can simply type
+
+    ./configure [--prefix=/path]
+    make check
+    make install
+
+and ignore the rest of this document.  "/path" is the path to the directory
+where you want to install the libpng "lib", "include", and "bin"
+subdirectories.
+
+If you downloaded a GIT clone, you will need to run ./autogen.sh before
+running ./configure, to create "configure" and "Makefile.in" which are
+not included in the GIT repository.
+
+Note that "configure" is only included in the "*.tar" distributions and not
+in the "*.zip" or "*.7z" distributions. If you downloaded one of those
+distributions, see "Building with project files" or "Building with makefiles",
+below.
+
+II. Rebuilding the configure scripts
+
+If configure does not work on your system, or if you have a need to
+change configure.ac or Makefile.am, and you have a reasonably
+up-to-date set of tools, running ./autogen.sh in a git clone before
+running ./configure may fix the problem.  To be really sure that you
+aren't using any of the included pre-built scripts, especially if you
+are building from a tar distribution instead of a git distribution,
+do this:
+
+    ./configure --enable-maintainer-mode
+    make maintainer-clean
+    ./autogen.sh --maintainer --clean
+    ./autogen.sh --maintainer
+    ./configure [--prefix=/path] [other options]
+    make
+    make install
+    make check
+
+III. Using scripts/makefile*
+
+Instead, you can use one of the custom-built makefiles in the
+"scripts" directory
+
+    cp scripts/pnglibconf.h.prebuilt pnglibconf.h
+    cp scripts/makefile.system makefile
+    make test
+    make install
+
+The files that are presently available in the scripts directory
+are listed and described in scripts/README.txt.
+
+Or you can use one of the "projects" in the "projects" directory.
+
+Before installing libpng, you must first install zlib, if it
+is not already on your system.  zlib can usually be found
+wherever you got libpng; otherwise go to https://zlib.net/.  You can
+place zlib in the same directory as libpng or in another directory.
+
+If your system already has a preinstalled zlib you will still need
+to have access to the zlib.h and zconf.h include files that
+correspond to the version of zlib that's installed.
+
+If you wish to test with a particular zlib that is not first in the
+standard library search path, put ZLIBLIB, ZLIBINC, CPPFLAGS, LDFLAGS,
+and LD_LIBRARY_PATH in your environment before running "make test"
+or "make distcheck":
+
+    ZLIBLIB=/path/to/lib export ZLIBLIB
+    ZLIBINC=/path/to/include export ZLIBINC
+    CPPFLAGS="-I$ZLIBINC" export CPPFLAGS
+    LDFLAGS="-L$ZLIBLIB" export LDFLAGS
+    LD_LIBRARY_PATH="$ZLIBLIB:$LD_LIBRARY_PATH" export LD_LIBRARY_PATH
+
+If you are using one of the makefile scripts, put ZLIBLIB and ZLIBINC
+in your environment and type
+
+    make ZLIBLIB=$ZLIBLIB ZLIBINC=$ZLIBINC test
+
+IV. Using cmake
+
+If you want to use "cmake" (see www.cmake.org), type
+
+    cmake . -DCMAKE_INSTALL_PREFIX=/path
+    make
+    make install
+
+As when using the simple configure method described above, "/path" points to
+the installation directory where you want to put the libpng "lib", "include",
+and "bin" subdirectories.
+
+V. Directory structure
+
+You can rename the directories that you downloaded (they
+might be called "libpng-x.y.z" or "libpngNN" and "zlib-1.2.8"
+or "zlib128") so that you have directories called "zlib" and "libpng".
+
+Your directory structure should look like this:
+
+    .. (the parent directory)
+      libpng (this directory)
+          INSTALL (this file)
+          README
+          *.h, *.c  => libpng source files
+          CMakeLists.txt    =>  "cmake" script
+          ci
+             ci_*.sh
+          configuration files:
+             configure.ac, configure, Makefile.am, Makefile.in,
+             autogen.sh, config.guess, ltmain.sh, missing, libpng.pc.in,
+             libpng-config.in, aclocal.m4, config.h.in, config.sub,
+             depcomp, install-sh, mkinstalldirs, test-pngtest.sh, etc.
+          contrib
+             arm-neon, conftest, examples, gregbook, libtests, pngminim,
+             pngminus, pngsuite, tools, visupng, riscv-rvv
+          projects
+             owatcom, visualc71, vstudio
+          scripts
+             makefile.*
+             *.def (module definition files)
+             etc.
+          pngtest.png
+          etc.
+      zlib
+          README, *.h, *.c, contrib, etc.
+
+If the line endings in the files look funny, you may wish to get the other
+distribution of libpng.  It is available in both tar.gz (UNIX style line
+endings) and zip (DOS style line endings) formats.
+
+VI. Building with project files
+
+If you are building libpng with Microsoft Visual Studio, you can enter
+the directory projects\visualc71 or projects\vstudio and follow the
+instructions in README.txt.
+
+Otherwise, enter the zlib directory and follow the instructions in
+zlib/README, then come back here and run "configure" or choose the
+appropriate makefile in the scripts directory.
+
+VII. Building with makefiles
+
+Copy the file (or files) that you need from the
+scripts directory into this directory, for example
+
+UNIX example:
+
+    cp scripts/makefile.std Makefile
+    make
+
+Windows example:
+
+    nmake -f scripts\makefile.vcwin32
+
+Read the makefile to see if you need to change any source or
+target directories to match your preferences.
+
+Then read pnglibconf.dfa to see if you want to make any configuration
+changes.
+
+Then just run "make" which will create the libpng library in
+this directory and "make test" which will run a quick test that reads
+the "pngtest.png" file and writes a "pngout.png" file that should be
+identical to it.  Look for "9782 zero samples" in the output of the
+test.  For more confidence, you can run another test by typing
+"pngtest pngnow.png" and looking for "289 zero samples" in the output.
+Also, you can run "pngtest -m contrib/pngsuite/*.png" and compare
+your output with the result shown in contrib/pngsuite/README.
+
+Most of the makefiles used to allow you to run "make install" to put
+the library in its final resting place, but that feature is no longer
+supported.  The only tested and supported manners to install libpng are
+the conventional build and install procedures driven by the configure
+script or by the CMake file.
+
+VIII. Configuring for DOS and other 16-bit platforms
+
+Officially, the support for 16-bit platforms has been removed.
+
+For DOS users who only have access to the lower 640K, you will
+have to limit zlib's memory usage via a png_set_compression_mem_level()
+call.  See zlib.h or zconf.h in the zlib library for more information.
+
+You may be or may not be in luck if you target the "large" memory model,
+but all the smaller models ("small", "compact" and "medium") are known
+to be unworkable.  For DOS users who have access beyond the lower 640K,
+a "flat" 32-bit DOS model (such as DJGPP) is strongly recommended.
+
+For DOS users who only have access to the lower 640K, you will have to
+limit zlib's memory usage via a png_set_compression_mem_level() call.
+You will also have to look into zconf.h to tell zlib (and thus libpng)
+that it cannot allocate more than 64K at a time.  Even if you can, the
+memory won't be accessible.  Therefore, you should limit zlib and libpng
+to 64K by defining MAXSEG_64K.
+
+IX. Prepending a prefix to exported symbols
+
+Starting with libpng-1.6.0, you can configure libpng (when using the
+"configure" script) to prefix all exported symbols by means of the
+configuration option "--with-libpng-prefix=FOO_", where FOO_ can be any
+string beginning with a letter and containing only uppercase
+and lowercase letters, digits, and the underscore (i.e., a C language
+identifier).  This creates a set of macros in pnglibconf.h, so this is
+transparent to applications; their function calls get transformed by
+the macros to use the modified names.
+
+X. Configuring for compiler xxx:
+
+All includes for libpng are in pngconf.h.  If you need to add, change
+or delete an include, this is the place to do it.
+The includes that are not needed outside libpng are placed in pngpriv.h,
+which is only used by the routines inside libpng itself.
+The files in libpng proper only include pngpriv.h and png.h, which
+in turn includes pngconf.h and, as of libpng-1.5.0, pnglibconf.h.
+As of libpng-1.5.0, pngpriv.h also includes three other private header
+files, pngstruct.h, pnginfo.h, and pngdebug.h, which contain material
+that previously appeared in the public headers.
+
+XI. Removing unwanted object code
+
+There are a bunch of #define's in pngconf.h that control what parts of
+libpng are compiled.  All the defines end in _SUPPORTED.  If you are
+never going to use a capability, you can change the #define to #undef
+before recompiling libpng and save yourself code and data space, or
+you can turn off individual capabilities with defines that begin with
+"PNG_NO_".
+
+In libpng-1.5.0 and later, the #define's are in pnglibconf.h instead.
+
+You can also turn all of the transforms and ancillary chunk capabilities
+off en masse with compiler directives that define
+PNG_NO_READ[or WRITE]_TRANSFORMS, or PNG_NO_READ[or WRITE]_ANCILLARY_CHUNKS,
+or all four, along with directives to turn on any of the capabilities that
+you do want.  The PNG_NO_READ[or WRITE]_TRANSFORMS directives disable the
+extra transformations but still leave the library fully capable of reading
+and writing PNG files with all known public chunks. Use of the
+PNG_NO_READ[or WRITE]_ANCILLARY_CHUNKS directive produces a library
+that is incapable of reading or writing ancillary chunks.  If you are
+not using the progressive reading capability, you can turn that off
+with PNG_NO_PROGRESSIVE_READ (don't confuse this with the INTERLACING
+capability, which you'll still have).
+
+All the reading and writing specific code are in separate files, so the
+linker should only grab the files it needs.  However, if you want to
+make sure, or if you are building a stand alone library, all the
+reading files start with "pngr" and all the writing files start with "pngw".
+The files that don't match either (like png.c, pngtrans.c, etc.)
+are used for both reading and writing, and always need to be included.
+The progressive reader is in pngpread.c
+
+If you are creating or distributing a dynamically linked library (a .so
+or DLL file), you should not remove or disable any parts of the library,
+as this will cause applications linked with different versions of the
+library to fail if they call functions not available in your library.
+The size of the library itself should not be an issue, because only
+those sections that are actually used will be loaded into memory.
+
+XII. Enabling or disabling hardware optimizations
+
+Certain hardware capabilities, such as the Intel SSE instructions,
+are normally detected at run time. Enable them with configure options
+such as one of
+
+   --enable-arm-neon=yes
+   --enable-mips-msa=yes
+   --enable-intel-sse=yes
+   --enable-powerpc-vsx=yes
+   --enable-riscv-rvv=yes
+
+or enable them all at once with
+
+   --enable-hardware-optimizations=yes
+
+or, if you are not using "configure", you can use one
+or more of
+
+   CPPFLAGS += "-DPNG_ARM_NEON"
+   CPPFLAGS += "-DPNG_MIPS_MSA"
+   CPPFLAGS += "-DPNG_INTEL_SSE"
+   CPPFLAGS += "-DPNG_POWERPC_VSX"
+   CPPFLAGS += "-DPNG_RISCV_RVV"
+
+See for example scripts/makefile.linux-opt
+
+If you wish to avoid using them,
+you can disable them via the configure option
+
+   --disable-hardware-optimizations
+
+to disable them all, or
+
+   --enable-intel-sse=no
+
+to disable a particular one,
+or via compiler-command options such as
+
+   CPPFLAGS += "-DPNG_ARM_NEON_OPT=0, -DPNG_MIPS_MSA_OPT=0,
+   -DPNG_INTEL_SSE_OPT=0, -DPNG_POWERPC_VSX_OPT=0,
+   -DPNG_RISCV_RVV_OPT=0"
+
+If you are using cmake, hardware optimizations are "on"
+by default. To disable them, use
+
+    cmake . -DPNG_ARM_NEON=no -DPNG_INTEL_SSE=no \
+            -DPNG_MIPS_MSA=no -DPNG_POWERPC_VSX=no \
+            -DPNG_RISCV_RVV=no
+
+or disable them all at once with
+
+    cmake . -DPNG_HARDWARE_OPTIMIZATIONS=no
+
+XIII. Changes to the build and configuration of libpng in libpng-1.5.x
+
+Details of internal changes to the library code can be found in the CHANGES
+file and in the GIT repository logs.  These will be of no concern to the vast
+majority of library users or builders; however, the few who configure libpng
+to a non-default feature set may need to change how this is done.
+
+There should be no need for library builders to alter build scripts if
+these use the distributed build support - configure or the makefiles -
+however, users of the makefiles may care to update their build scripts
+to build pnglibconf.h where the corresponding makefile does not do so.
+
+Building libpng with a non-default configuration has changed completely.
+The old method using pngusr.h should still work correctly even though the
+way pngusr.h is used in the build has been changed; however, library
+builders will probably want to examine the changes to take advantage of
+new capabilities and to simplify their build system.
+
+A. Specific changes to library configuration capabilities
+
+The exact mechanism used to control attributes of API functions has
+changed.  A single set of operating system independent macro definitions
+is used and operating system specific directives are defined in
+pnglibconf.h
+
+As part of this the mechanism used to choose procedure call standards on
+those systems that allow a choice has been changed.  At present this only
+affects certain Microsoft (DOS, Windows) and IBM (OS/2) operating systems
+running on Intel processors.  As before, PNGAPI is defined where required
+to control the exported API functions; however, two new macros, PNGCBAPI
+and PNGCAPI, are used instead for callback functions (PNGCBAPI) and
+(PNGCAPI) for functions that must match a C library prototype (currently
+only png_longjmp_ptr, which must match the C longjmp function.)  The new
+approach is documented in pngconf.h
+
+Despite these changes, libpng 1.5.0 only supports the native C function
+calling standard on those platforms tested so far ("__cdecl" on Microsoft
+Windows).  This is because the support requirements for alternative
+calling conventions seem to no longer exist.  Developers who find it
+necessary to set PNG_API_RULE to 1 should advise the mailing list
+(png-mng-implement) of this and library builders who use Openwatcom and
+therefore set PNG_API_RULE to 2 should also contact the mailing list.
+
+B. Changes to the configuration mechanism
+
+Prior to libpng-1.5.0 library builders who needed to configure libpng
+had either to modify the exported pngconf.h header file to add system
+specific configuration or had to write feature selection macros into
+pngusr.h and cause this to be included into pngconf.h by defining
+PNG_USER_CONFIG. The latter mechanism had the disadvantage that an
+application built without PNG_USER_CONFIG defined would see the
+unmodified, default, libpng API and thus would probably fail to link.
+
+These mechanisms still work in the configure build and in any makefile
+build that builds pnglibconf.h, although the feature selection macros
+have changed somewhat as described above.  In 1.5.0, however, pngusr.h is
+processed only once, at the time the exported header file pnglibconf.h is
+built.  pngconf.h no longer includes pngusr.h; therefore, pngusr.h is ignored
+after the build of pnglibconf.h and it is never included in an application
+build.
+
+The formerly used alternative of adding a list of feature macros to the
+CPPFLAGS setting in the build also still works; however, the macros will be
+copied to pnglibconf.h and this may produce macro redefinition warnings
+when the individual C files are compiled.
+
+All configuration now only works if pnglibconf.h is built from
+scripts/pnglibconf.dfa.  This requires the program awk.  Brian Kernighan
+(the original author of awk) maintains C source code of that awk and this
+and all known later implementations (often called by subtly different
+names - nawk and gawk for example) are adequate to build pnglibconf.h.
+The Sun Microsystems (now Oracle) program 'awk' is an earlier version
+and does not work; this may also apply to other systems that have a
+functioning awk called 'nawk'.
+
+Configuration options are now documented in scripts/pnglibconf.dfa.  This
+file also includes dependency information that ensures a configuration is
+consistent; that is, if a feature is switched off, dependent features are
+also switched off.  As a recommended alternative to using feature macros in
+pngusr.h a system builder may also define equivalent options in pngusr.dfa
+(or, indeed, any file) and add that to the configuration by setting
+DFA_XTRA to the file name.  The makefiles in contrib/pngminim illustrate
+how to do this, and also illustrate a case where pngusr.h is still required.
+
+After you have built libpng, the definitions that were recorded in
+pnglibconf.h are available to your application (pnglibconf.h is included
+in png.h and gets installed alongside png.h and pngconf.h in your
+$PREFIX/include directory).  Do not edit pnglibconf.h after you have built
+libpng, because than the settings would not accurately reflect the settings
+that were used to build libpng.
+
+XIV. Setjmp/longjmp issues
+
+Libpng uses setjmp()/longjmp() for error handling.  Unfortunately setjmp()
+is known to be not thread-safe on some platforms and we don't know of
+any platform where it is guaranteed to be thread-safe.  Therefore, if
+your application is going to be using multiple threads, you should
+configure libpng with PNG_NO_SETJMP in your pngusr.dfa file, with
+-DPNG_NO_SETJMP on your compile line, or with
+
+    #undef PNG_SETJMP_SUPPORTED
+
+in your pnglibconf.h or pngusr.h.
+
+Starting with libpng-1.6.0, the library included a "simplified API".
+This requires setjmp/longjmp, so you must either build the library
+with PNG_SETJMP_SUPPORTED defined, or with PNG_SIMPLIFIED_READ_SUPPORTED
+and PNG_SIMPLIFIED_WRITE_SUPPORTED undefined.
+
+XV. Common linking failures
+
+If your application fails to find libpng or zlib entries while linking:
+
+  Be sure "-lz" appears after "-lpng" on your linking command.
+
+  Be sure you have built libpng, zlib, and your application for the
+  same platform (e.g., 32-bit or 64-bit).
+
+  If you are using the vstudio project, observe the WARNING in
+  project/vstudio/README.txt.
+
+XVI. Other sources of information about libpng:
+
+Further information can be found in the README and libpng-manual.txt
+files, in the individual makefiles, in png.h, and the manual pages
+libpng.3 and png.5.
+
+Copyright (c) 2022 Cosmin Truta
+Copyright (c) 1998-2002,2006-2016 Glenn Randers-Pehrson
+This document is released under the libpng license.
+For conditions of distribution and use, see the disclaimer
+and license in png.h.

media/libpng/LICENSE

@@ -1,4 +1,3 @@
-
 This copy of the libpng notices is provided for your convenience.  In case of
 any discrepancy between this copy and the notices in the file png.h that is
 included in the libpng distribution, the latter shall prevail.
@@ -24,43 +23,93 @@ Copyright (c) 2016 Google, Inc., and consist of the source files in the
 "sse2" subdirectory and added code in pngpriv.h delimited by
 #ifndef PNG_INTEL_SSE_OPT / #endif directives.
 
+This modified version of libpng code adds animated PNG support and is
+released under the libpng license described below. The modifications are
+Copyright (c) 2006-2007 Andrew Smith, Copyright (c) 2008-2016 Max Stepin,
+and are delimited by "#ifdef PNG_APNG_SUPPORTED / #endif" directives
+surrounding them in the modified libpng source files.
+
 This code is released under the libpng license.
 
-libpng versions 1.0.7, July 1, 2000 through 1.6.26, Octoaber 20, 2016 are
-Copyright (c) 2000-2002, 2004, 2006-2016 Glenn Randers-Pehrson, are
+COPYRIGHT NOTICE, DISCLAIMER, and LICENSE
+=========================================
+
+PNG Reference Library License version 2
+---------------------------------------
+
+ * Copyright (c) 1995-2026 The PNG Reference Library Authors.
+ * Copyright (c) 2018-2026 Cosmin Truta.
+ * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
+ * Copyright (c) 1996-1997 Andreas Dilger.
+ * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
+
+The software is supplied "as is", without warranty of any kind,
+express or implied, including, without limitation, the warranties
+of merchantability, fitness for a particular purpose, title, and
+non-infringement.  In no event shall the Copyright owners, or
+anyone distributing the software, be liable for any damages or
+other liability, whether in contract, tort or otherwise, arising
+from, out of, or in connection with the software, or the use or
+other dealings in the software, even if advised of the possibility
+of such damage.
+
+Permission is hereby granted to use, copy, modify, and distribute
+this software, or portions hereof, for any purpose, without fee,
+subject to the following restrictions:
+
+ 1. The origin of this software must not be misrepresented; you
+    must not claim that you wrote the original software.  If you
+    use this software in a product, an acknowledgment in the product
+    documentation would be appreciated, but is not required.
+
+ 2. Altered source versions must be plainly marked as such, and must
+    not be misrepresented as being the original software.
+
+ 3. This Copyright notice may not be removed or altered from any
+    source or altered source distribution.
+
+
+PNG Reference Library License version 1 (for libpng 0.5 through 1.6.35)
+-----------------------------------------------------------------------
+
+libpng versions 1.0.7, July 1, 2000, through 1.6.35, July 15, 2018 are
+Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
 derived from libpng-1.0.6, and are distributed according to the same
 disclaimer and license as libpng-1.0.6 with the following individuals
 added to the list of Contributing Authors:
 
-   Simon-Pierre Cadieux
-   Eric S. Raymond
-   Mans Rullgard
-   Cosmin Truta
-   Gilles Vollant
-   James Yu
+    Simon-Pierre Cadieux
+    Eric S. Raymond
+    Mans Rullgard
+    Cosmin Truta
+    Gilles Vollant
+    James Yu
+    Mandar Sahastrabuddhe
+    Google Inc.
+    Vadim Barkov
 
 and with the following additions to the disclaimer:
 
-   There is no warranty against interference with your enjoyment of the
-   library or against infringement.  There is no warranty that our
-   efforts or the library will fulfill any of your particular purposes
-   or needs.  This library is provided with all faults, and the entire
-   risk of satisfactory quality, performance, accuracy, and effort is with
-   the user.
+    There is no warranty against interference with your enjoyment of
+    the library or against infringement.  There is no warranty that our
+    efforts or the library will fulfill any of your particular purposes
+    or needs.  This library is provided with all faults, and the entire
+    risk of satisfactory quality, performance, accuracy, and effort is
+    with the user.
 
 Some files in the "contrib" directory and some configure-generated
-files that are distributed with libpng have other copyright owners and
+files that are distributed with libpng have other copyright owners, and
 are released under other open source licenses.
 
 libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
 Copyright (c) 1998-2000 Glenn Randers-Pehrson, are derived from
 libpng-0.96, and are distributed according to the same disclaimer and
-license as libpng-0.96, with the following individuals added to the list
-of Contributing Authors:
+license as libpng-0.96, with the following individuals added to the
+list of Contributing Authors:
 
-   Tom Lane
-   Glenn Randers-Pehrson
-   Willem van Schaik
+    Tom Lane
+    Glenn Randers-Pehrson
+    Willem van Schaik
 
 libpng versions 0.89, June 1996, through 0.96, May 1997, are
 Copyright (c) 1996-1997 Andreas Dilger, are derived from libpng-0.88,
@@ -68,14 +117,14 @@ and are distributed according to the same disclaimer and license as
 libpng-0.88, with the following individuals added to the list of
 Contributing Authors:
 
-   John Bowler
-   Kevin Bracey
-   Sam Bushell
-   Magnus Holmgren
-   Greg Roelofs
-   Tom Tanner
+    John Bowler
+    Kevin Bracey
+    Sam Bushell
+    Magnus Holmgren
+    Greg Roelofs
+    Tom Tanner
 
-Some files in the "scripts" directory have other copyright owners
+Some files in the "scripts" directory have other copyright owners,
 but are released under this license.
 
 libpng versions 0.5, May 1995, through 0.88, January 1996, are
@@ -84,63 +133,35 @@ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
 For the purposes of this copyright and license, "Contributing Authors"
 is defined as the following set of individuals:
 
-   Andreas Dilger
-   Dave Martindale
-   Guy Eric Schalnat
-   Paul Schmidt
-   Tim Wegner
+    Andreas Dilger
+    Dave Martindale
+    Guy Eric Schalnat
+    Paul Schmidt
+    Tim Wegner
 
-The PNG Reference Library is supplied "AS IS".  The Contributing Authors
-and Group 42, Inc. disclaim all warranties, expressed or implied,
-including, without limitation, the warranties of merchantability and of
-fitness for any purpose.  The Contributing Authors and Group 42, Inc.
-assume no liability for direct, indirect, incidental, special, exemplary,
-or consequential damages, which may result from the use of the PNG
-Reference Library, even if advised of the possibility of such damage.
+The PNG Reference Library is supplied "AS IS".  The Contributing
+Authors and Group 42, Inc. disclaim all warranties, expressed or
+implied, including, without limitation, the warranties of
+merchantability and of fitness for any purpose.  The Contributing
+Authors and Group 42, Inc. assume no liability for direct, indirect,
+incidental, special, exemplary, or consequential damages, which may
+result from the use of the PNG Reference Library, even if advised of
+the possibility of such damage.
 
 Permission is hereby granted to use, copy, modify, and distribute this
 source code, or portions hereof, for any purpose, without fee, subject
 to the following restrictions:
 
-  1. The origin of this source code must not be misrepresented.
+ 1. The origin of this source code must not be misrepresented.
 
-  2. Altered versions must be plainly marked as such and must not
-     be misrepresented as being the original source.
+ 2. Altered versions must be plainly marked as such and must not
+    be misrepresented as being the original source.
 
-  3. This Copyright notice may not be removed or altered from any
-     source or altered source distribution.
+ 3. This Copyright notice may not be removed or altered from any
+    source or altered source distribution.
 
-The Contributing Authors and Group 42, Inc. specifically permit, without
-fee, and encourage the use of this source code as a component to
-supporting the PNG file format in commercial products.  If you use this
-source code in a product, acknowledgment is not required but would be
-appreciated.
-
-END OF COPYRIGHT NOTICE, DISCLAIMER, and LICENSE.
-
-TRADEMARK:
-
-The name "libpng" has not been registered by the Copyright owner
-as a trademark in any jurisdiction.  However, because libpng has
-been distributed and maintained world-wide, continually since 1995,
-the Copyright owner claims "common-law trademark protection" in any
-jurisdiction where common-law trademark is recognized.
-
-OSI CERTIFICATION:
-
-Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is
-a certification mark of the Open Source Initiative. OSI has not addressed
-the additional disclaimers inserted at version 1.0.7.
-
-EXPORT CONTROL:
-
-The Copyright owner believes that the Export Control Classification
-Number (ECCN) for libpng is EAR99, which means not subject to export
-controls or International Traffic in Arms Regulations (ITAR) because
-it is open source, publicly available software, that does not contain
-any encryption software.  See the EAR, paragraphs 734.3(b)(3) and
-734.7(b).
-
-Glenn Randers-Pehrson
-glennrp at users.sourceforge.net
-October 20, 2016
+The Contributing Authors and Group 42, Inc. specifically permit,
+without fee, and encourage the use of this source code as a component
+to supporting the PNG file format in commercial products.  If you use
+this source code in a product, acknowledgment is not required but would
+be appreciated. 

media/libpng/MOZCHANGES

@@ -1,131 +0,0 @@
-
-Changes made to pristine libpng source by mozilla.org developers.
-
-2016/10/20  -- Synced with libpng-1.6.26 (bug #1311776).
-
-2016/09/01  -- Synced with libpng-1.6.25 (bug #1299590).
-
-2016/08/11  -- Enabled SSE2 support (bug #1276127).
-
-2016/08/06  -- Synced with libpng-1.6.24 (bug #1291986).
-
-2016/06/09  -- Synced with libpng-1.6.23 (bug #1275901).
-
-2016/01/16  -- Synced with libpng-1.6.21 (bug #1230757).
-
-2015/11/12  -- Synced with libpng-1.6.19 (bug #1224244).
-
-2015/07/30  -- Synced with libpng-1.6.18 (bug #1186977).
-
-2015/03/27  -- Synced with libpng-1.6.17 (bug #1147909).
-
-2014/12/22  -- Synced with libpng-1.6.16 (bug #1114360).
-               Added arm.patch file.
-
-2014/11/20  -- Synced with libpng-1.6.15 (bug #1102523).
-
-2014/10/23  -- Synced with libpng-1.6.14 (bug #1087841).
-
-2014/08/21  -- Synced with libpng-1.6.13 (bug #1021713).
-               Renamed mozpngconf.h to pnglibconf.h.
-               Revised system arm/filter_neon.S to include the lines
-               #define PNG_READ_SUPPORTED and  #define MOZ_PNG_HAVE_ARM_NEON
-               because the moz.build system doesn't yet pass -DDefined
-               macros to the assembler.
-
-2014/03/21  -- Synced with libpng-1.6.10 (bug #980488) and disabled
-               PNG_WARNINGS and PNG_ERROR_TEXT in non-debug builds.
-               Limit image dimensions to 32767 (bug #251381, #591822,
-               and #967656).
-
-2014/03/04  -- Enabled PNG_WARNINGS and other stuff in mozpngconf.h
-               as part of enabling Freetype2 with PNG (bug #969814).
-
-2014/03/03  -- Fixed hang with empty IDAT (bug #974825). This will be
-               fixed in libpng-1.6.10.
-
-2014/02/18  -- Exposed png_error(), etc. redefinitions to applications
-               (moved them from pngpriv.h to png.h). This will be fixed
-               in libpng-1.6.10.
-
-2014/02/18  -- Disabled PNG_FIXED_POINT_SUPPORTED in mozpngconf.h (we
-               don't need both FIXED and FLOATING_POINT support).
-
-2014/02/15  -- Synced with libpng-1.6.9 (bug #952505).
-
-2014/02/11  -- Fixed crash with empty PLTE, CVE-2013-6954 (bug #945912).
-               This will be fixed in libpng-1.6.9.
-
-2013/12/11  -- Enable ARM support (bug #832390).
-
-2013/11/17  -- Synced with libpng-1.6.7 (bug #938740).
-
-2013/09/21  -- Synced with libpng-1.6.6 (bug #841734).
-
-2013/07/17  -- Synced with libpng-1.5.17 (bug #886499).
-
-2013/06/06  -- Synced with libpng-1.5.16 (bug #873001).
-
-2013/04/11  -- Synced with libpng-1.5.15 (bug #858578).
-
-2013/01/24  -- Synced with libpng-1.5.14 (bug #832487).
-
-2013/01/23  -- Disabled TEXT support in mozpngconf.h (bug #833594).
-
-2012/10/02  -- Synced with libpng-1.5.13 (bug #775662).
-
-2012/07/16  -- Add an "APNG-aware app" flag (bug #759067).
-
-2012/07/04  -- Synced with libpng-1.5.11 (bug #771394).
-
-2012/04/13  -- Synced with libpng-1.5.10 (bug #745178).
-
-2012/02/19  -- Synced with libpng-1.5.9 (bug #648690).
-
-2011/07/20  -- Synced with libpng-1.4.8 (bug #669863).
-
-2011/04/08  -- Synced with libpng-1.4.7 (bug #624133).
-
-2010/06/30  -- Synced with libpng-1.4.3 (bug #564792).
-
-2010/02/26  -- Synced with libpng-1.4.1 (bug #544747).
-
-2010/01/04  -- Synced with libpng-1.4.0 (bug #532645).
-
-2009/09/10  -- Synced with libpng-1.2.40 (bug #492200 and #504805).
-               Moved location of acTL chunk to just after IHDR
-               in output PNG file.
-
-2009/06/01  -- Eliminated incorrect test and rejection of APNG
-               blend_op in opaque images (bug #441971 and #455140).
-
-2009/05/17  -- Always clear prev_row for each APNG frame (bug #463465).
-
-2009/02/19  -- Synced with libpng-1.2.35 (bug #478901).
-
-2008/08/21  -- Synced with libpng-1.2.31 (bug #418900).
-
-2008/03/29  -- Initialize prev_row for each APNG frame, only when
-               the frame size increases (bug #420416).
-
-2008/01/18  -- Synced with libpng-1.2.24 (bug #408429).
-
-2007/11/13  -- Synced with libpng-1.2.23; Removed pnggccrd.c and pngvcrd.c;
-               Reduced footprint by removing error and warning text in
-               non-debug builds via settings in mozpngconf.h (bug #403239).
-
-2007/11/06  -- Synced with libpng-1.2.22 (removes MMX support) (bug #386585).
-
-2007/07/27  -- Enabled cHRM and iCCP chunks for color management (bug #16769).
-
-2007/05/05  -- Zeroed png_ptr->num_trans on CRC error (bug #374810).
-
-2007/04/19  -- Synced with libpng-1.2.16 tree (bug #373249).
-
-2007/03/20  -- Added support for APNG (bug #257197).
-
-2006/06/27  -- Synced with libpng-1.2.12 tree (bug #334110).
-
-2004/10/07  -- Synced with libpng-1.2.7 tree (bug #261922).
-
-2004/10/07  -- Added mozpngconf.h (bug #208607).

media/libpng/README

@@ -1,56 +1,88 @@
-README for libpng version 1.6.26 - October 20, 2016 (shared library 16.0)
-See the note about version numbers near the top of png.h
+README for libpng version 1.6.58
+================================
 
-See INSTALL for instructions on how to install libpng.
+See the note about version numbers near the top of `png.h`.
+See `INSTALL` for instructions on how to install libpng.
 
-Libpng comes in several distribution formats.  Get libpng-*.tar.gz or
-libpng-*.tar.xz or if you want UNIX-style line endings in the text files,
-or lpng*.7z or lpng*.zip if you want DOS-style line endings.
+Libpng comes in several distribution formats.  Get `libpng-*.tar.gz`
+or `libpng-*.tar.xz` if you want UNIX-style line endings in the text
+files, or `lpng*.7z` or `lpng*.zip` if you want DOS-style line endings.
 
-Version 0.89 was the first official release of libpng.  Don't let the
-fact that it's the first release fool you.  The libpng library has been in
-extensive use and testing since mid-1995.  By late 1997 it had
-finally gotten to the stage where there hadn't been significant
-changes to the API in some time, and people have a bad feeling about
-libraries with versions < 1.0.  Version 1.0.0 was released in
-March 1998.
+For a detailed description on using libpng, read `libpng-manual.txt`.
+For examples of libpng in a program, see `example.c` and `pngtest.c`.
+For usage information and restrictions (what little they are) on libpng,
+see `png.h`.  For a description on using zlib (the compression library
+used by libpng) and zlib's restrictions, see `zlib.h`.
 
-****
-Note that some of the changes to the png_info structure render this
+You should use zlib 1.0.4 or later to run this, but it _may_ work with
+versions as old as zlib 0.95.  Even so, there are bugs in older zlib
+versions which can cause the output of invalid compression streams for
+some images.
+
+You should also note that zlib is a compression library that is useful
+for more things than just PNG files.  You can use zlib as a drop-in
+replacement for `fread()` and `fwrite()`, if you are so inclined.
+
+zlib should be available at the same place that libpng is, or at
+<https://zlib.net>.
+
+You may also want a copy of the PNG specification.  It is available
+as an RFC, a W3C Recommendation, and an ISO/IEC Standard.  You can find
+these at <http://www.libpng.org/pub/png/pngdocs.html>.
+
+This code is currently being archived at <https://libpng.sourceforge.io>
+in the download area, and at <http://libpng.download/src>.
+
+This release, based in a large way on Glenn's, Guy's and Andreas'
+earlier work, was created and will be supported by myself and the PNG
+development group.
+
+Send comments, corrections and commendations to `png-mng-implement`
+at `lists.sourceforge.net`.  (Subscription is required; visit
+<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
+to subscribe.)
+
+Send general questions about the PNG specification to `png-mng-misc`
+at `lists.sourceforge.net`.  (Subscription is required; visit
+<https://lists.sourceforge.net/lists/listinfo/png-mng-misc>
+to subscribe.)
+
+Historical notes
+----------------
+
+The libpng library has been in extensive use and testing since mid-1995.
+Version 0.89, published a year later, was the first official release.
+By late 1997, it had finally gotten to the stage where there hadn't
+been significant changes to the API in some time, and people have a bad
+feeling about libraries with versions below 1.0.  Version 1.0.0 was
+released in March 1998.
+
+Note that some of the changes to the `png_info` structure render this
 version of the library binary incompatible with libpng-0.89 or
 earlier versions if you are using a shared library.  The type of the
-"filler" parameter for png_set_filler() has changed from png_byte to
-png_uint_32, which will affect shared-library applications that use
-this function.
+`filler` parameter for `png_set_filler()` has changed from `png_byte`
+to `png_uint_32`, which will affect shared-library applications that
+use this function.
 
-To avoid problems with changes to the internals of png info_struct,
+To avoid problems with changes to the internals of the `info_struct`,
 new APIs have been made available in 0.95 to avoid direct application
-access to info_ptr.  These functions are the png_set_<chunk> and
-png_get_<chunk> functions.  These functions should be used when
-accessing/storing the info_struct data, rather than manipulating it
+access to `info_ptr`.  These functions are the `png_set_<chunk>` and
+`png_get_<chunk>` functions.  These functions should be used when
+accessing/storing the `info_struct` data, rather than manipulating it
 directly, to avoid such problems in the future.
 
 It is important to note that the APIs did not make current programs
 that access the info struct directly incompatible with the new
 library, through libpng-1.2.x.  In libpng-1.4.x, which was meant to
-be a transitional release, members of the png_struct and the
-info_struct can still be accessed, but the compiler will issue a
+be a transitional release, members of the `png_struct` and the
+`info_struct` can still be accessed, but the compiler will issue a
 warning about deprecated usage.  Since libpng-1.5.0, direct access
 to these structs is not allowed, and the definitions of the structs
-reside in private pngstruct.h and pnginfo.h header files that are not
-accessible to applications.  It is strongly suggested that new
-programs use the new APIs (as shown in example.c and pngtest.c), and
-older programs be converted to the new format, to facilitate upgrades
-in the future.
-****
-
-Additions since 0.90 include the ability to compile libpng as a
-Windows DLL, and new APIs for accessing data in the info struct.
-Experimental functions include the ability to set weighting and cost
-factors for row filter selection, direct reads of integers from buffers
-on big-endian processors that support misaligned data access, faster
-methods of doing alpha composition, and more accurate 16->8 bit color
-conversion.
+reside in private `pngstruct.h` and `pnginfo.h` header files that are
+not accessible to applications.  It is strongly suggested that new
+programs use the new APIs (as shown in `example.c` and `pngtest.c`),
+and older programs be converted to the new format, to facilitate
+upgrades in the future.
 
 The additions since 0.89 include the ability to read from a PNG stream
 which has had some (or all) of the signature bytes read by the calling
@@ -60,159 +92,93 @@ the library action on the detection of chunk CRC errors.  It is possible
 to set different actions based on whether the CRC error occurred in a
 critical or an ancillary chunk.
 
-The changes made to the library, and bugs fixed are based on discussions
-on the PNG-implement mailing list and not on material submitted
-privately to Guy, Andreas, or Glenn.  They will forward any good
-suggestions to the list.
+The additions since 0.90 include the ability to compile libpng as a
+Windows DLL, and new APIs for accessing data in the `info_struct`.
+Experimental functions included the ability to set weighting and cost
+factors for row filter selection, direct reads of integers from buffers
+on big-endian processors that support misaligned data access, faster
+methods of doing alpha composition, and more accurate 16-to-8 bit color
+conversion.  Some of these experimental functions, such as the weighted
+filter heuristics, have since been removed.
 
-For a detailed description on using libpng, read libpng-manual.txt.  For
-examples of libpng in a program, see example.c and pngtest.c.  For usage
-information and restrictions (what little they are) on libpng, see
-png.h.  For a description on using zlib (the compression library used by
-libpng) and zlib's restrictions, see zlib.h
+Files included in this distribution
+-----------------------------------
 
-I have included a general makefile, as well as several machine and
-compiler specific ones, but you may have to modify one for your own needs.
+    ANNOUNCE      =>  Announcement of this version, with recent changes
+    AUTHORS       =>  List of contributing authors
+    CHANGES       =>  Description of changes between libpng versions
+    INSTALL       =>  Instructions to install libpng
+    LICENSE       =>  License to use and redistribute libpng
+    README        =>  This file
+    TODO          =>  Things not implemented in the current library
+    TRADEMARK     =>  Trademark information
+    example.c     =>  Example code for using libpng functions
+    libpng.3      =>  Manual page for libpng (includes libpng-manual.txt)
+    libpng-manual.txt  =>  Description of libpng and its functions
+    libpngpf.3    =>  Manual page for libpng's private functions (deprecated)
+    png.5         =>  Manual page for the PNG format
+    png.c         =>  Basic interface functions common to library
+    png.h         =>  Library function and interface declarations (public)
+    pngpriv.h     =>  Library function and interface declarations (private)
+    pngconf.h     =>  System specific library configuration (public)
+    pngstruct.h   =>  png_struct declaration (private)
+    pnginfo.h     =>  png_info struct declaration (private)
+    pngdebug.h    =>  debugging macros (private)
+    pngerror.c    =>  Error/warning message I/O functions
+    pngget.c      =>  Functions for retrieving info from struct
+    pngmem.c      =>  Memory handling functions
+    pngbar.png    =>  PNG logo, 88x31
+    pngnow.png    =>  PNG logo, 98x31
+    pngpread.c    =>  Progressive reading functions
+    pngread.c     =>  Read data/helper high-level functions
+    pngrio.c      =>  Lowest-level data read I/O functions
+    pngrtran.c    =>  Read data transformation functions
+    pngrutil.c    =>  Read data utility functions
+    pngset.c      =>  Functions for storing data into the info_struct
+    pngtest.c     =>  Library test program
+    pngtest.png   =>  Library test sample image
+    pngtrans.c    =>  Common data transformation functions
+    pngwio.c      =>  Lowest-level write I/O functions
+    pngwrite.c    =>  High-level write functions
+    pngwtran.c    =>  Write data transformations
+    pngwutil.c    =>  Write utility functions
+    arm/          =>  Optimized code for ARM Neon
+    intel/        =>  Optimized code for INTEL SSE2
+    loongarch/    =>  Optimized code for LoongArch LSX
+    mips/         =>  Optimized code for MIPS MSA and MIPS MMI
+    powerpc/      =>  Optimized code for PowerPC VSX
+    riscv/        =>  Optimized code for the RISC-V platform
+    ci/           =>  Scripts for continuous integration
+    contrib/      =>  External contributions
+        arm-neon/     =>  Optimized code for the ARM-NEON platform
+        mips-msa/     =>  Optimized code for the MIPS-MSA platform
+        powerpc-vsx/  =>  Optimized code for the POWERPC-VSX platform
+        examples/     =>  Examples of libpng usage
+        gregbook/     =>  Source code for PNG reading and writing, from
+                          "PNG: The Definitive Guide" by Greg Roelofs,
+                          O'Reilly, 1999
+        libtests/     =>  Test programs
+        pngexif/      =>  Program to inspect the EXIF information in PNG files
+        pngminim/     =>  Minimal decoder, encoder, and progressive decoder
+                          programs demonstrating the use of pngusr.dfa
+        pngminus/     =>  Simple pnm2png and png2pnm programs
+        pngsuite/     =>  Test images
+        riscv-rvv/    =>  Optimized code for the RISC-V Vector platform
+        testpngs/     =>  Test images
+        tools/        =>  Various tools
+        visupng/      =>  VisualPng, a Windows viewer for PNG images
+    projects/     =>  Project files and workspaces for various IDEs
+        owatcom/      =>  OpenWatcom project
+        visualc71/    =>  Microsoft Visual C++ 7.1 workspace
+        vstudio/      =>  Microsoft Visual Studio workspace
+    scripts/      =>  Scripts and makefiles for building libpng
+                      (see scripts/README.txt for the complete list)
+    tests/        =>  Test scripts
 
-You should use zlib 1.0.4 or later to run this, but it MAY work with
-versions as old as zlib 0.95.  Even so, there are bugs in older zlib
-versions which can cause the output of invalid compression streams for
-some images.  You will definitely need zlib 1.0.4 or later if you are
-taking advantage of the MS-DOS "far" structure allocation for the small
-and medium memory models.  You should also note that zlib is a
-compression library that is useful for more things than just PNG files.
-You can use zlib as a drop-in replacement for fread() and fwrite() if
-you are so inclined.
+Good luck, and happy coding!
 
-zlib should be available at the same place that libpng is, or at zlib.net.
-
-You may also want a copy of the PNG specification.  It is available
-as an RFC, a W3C Recommendation, and an ISO/IEC Standard.  You can find
-these at http://www.libpng.org/pub/png/documents/
-
-This code is currently being archived at libpng.sf.net in the
-[DOWNLOAD] area, and at ftp://ftp.simplesystems.org.  If you can't find it
-in any of those places, e-mail me, and I'll help you find it.
-
-I am not a lawyer, but I believe that the Export Control Classification
-Number (ECCN) for libpng is EAR99, which means not subject to export
-controls or International Traffic in Arms Regulations (ITAR) because it
-is open source, publicly available software, that does not contain any
-encryption software.  See the EAR, paragraphs 734.3(b)(3) and 734.7(b).
-
-If you have any code changes, requests, problems, etc., please e-mail
-them to me.  Also, I'd appreciate any make files or project files,
-and any modifications you needed to make to get libpng to compile,
-along with a #define variable to tell what compiler/system you are on.
-If you needed to add transformations to libpng, or wish libpng would
-provide the image in a different way, drop me a note (and code, if
-possible), so I can consider supporting the transformation.
-Finally, if you get any warning messages when compiling libpng
-(note: not zlib), and they are easy to fix, I'd appreciate the
-fix.  Please mention "libpng" somewhere in the subject line.  Thanks.
-
-This release was created and will be supported by myself (of course
-based in a large way on Guy's and Andreas' earlier work), and the PNG
-development group.
-
-Send comments/corrections/commendations to png-mng-implement at
-lists.sourceforge.net (subscription required; visit
-https://lists.sourceforge.net/lists/listinfo/png-mng-implement
-to subscribe) or to glennrp at users.sourceforge.net
-
-You can't reach Guy, the original libpng author, at the addresses
-given in previous versions of this document.  He and Andreas will
-read mail addressed to the png-implement list, however.
-
-Please do not send general questions about PNG.  Send them to
-png-mng-misc at lists.sf.net (subscription required; visit
-https://lists.sourceforge.net/lists/listinfo/png-mng-misc to
-subscribe).  If you have a question about something
-in the PNG specification that is related to using libpng, send it
-to me.  Send me any questions that start with "I was using libpng,
-and ...".  If in doubt, send questions to me.  I'll bounce them
-to others, if necessary.
-
-Please do not send suggestions on how to change PNG.  We have
-been discussing PNG for twenty years now, and it is official and
-finished.  If you have suggestions for libpng, however, I'll
-gladly listen.  Even if your suggestion is not used immediately,
-it may be used later.
-
-Files in this distribution:
-
-      ANNOUNCE      =>  Announcement of this version, with recent changes
-      CHANGES       =>  Description of changes between libpng versions
-      KNOWNBUG      =>  List of known bugs and deficiencies
-      LICENSE       =>  License to use and redistribute libpng
-      README        =>  This file
-      TODO          =>  Things not implemented in the current library
-      Y2KINFO       =>  Statement of Y2K compliance
-      example.c     =>  Example code for using libpng functions
-      libpng.3      =>  manual page for libpng (includes libpng-manual.txt)
-      libpng-manual.txt  =>  Description of libpng and its functions
-      libpngpf.3    =>  manual page for libpng's private functions
-      png.5         =>  manual page for the PNG format
-      png.c         =>  Basic interface functions common to library
-      png.h         =>  Library function and interface declarations (public)
-      pngpriv.h     =>  Library function and interface declarations (private)
-      pngconf.h     =>  System specific library configuration (public)
-      pngstruct.h   =>  png_struct declaration (private)
-      pnginfo.h     =>  png_info struct declaration (private)
-      pngdebug.h    =>  debugging macros (private)
-      pngerror.c    =>  Error/warning message I/O functions
-      pngget.c      =>  Functions for retrieving info from struct
-      pngmem.c      =>  Memory handling functions
-      pngbar.png    =>  PNG logo, 88x31
-      pngnow.png    =>  PNG logo, 98x31
-      pngpread.c    =>  Progressive reading functions
-      pngread.c     =>  Read data/helper high-level functions
-      pngrio.c      =>  Lowest-level data read I/O functions
-      pngrtran.c    =>  Read data transformation functions
-      pngrutil.c    =>  Read data utility functions
-      pngset.c      =>  Functions for storing data into the info_struct
-      pngtest.c     =>  Library test program
-      pngtest.png   =>  Library test sample image
-      pngtrans.c    =>  Common data transformation functions
-      pngwio.c      =>  Lowest-level write I/O functions
-      pngwrite.c    =>  High-level write functions
-      pngwtran.c    =>  Write data transformations
-      pngwutil.c    =>  Write utility functions
-      arm           =>  Contains optimized code for the ARM platform
-      contrib       =>  Contributions
-       arm-neon         =>  Optimized code for ARM-NEON platform
-       examples         =>  Example programs
-       gregbook         =>  source code for PNG reading and writing, from
-                            Greg Roelofs' "PNG: The Definitive Guide",
-                            O'Reilly, 1999
-       intel            =>  Optimized code for INTEL-SSE2 platform
-       libtests         =>  Test programs
-       pngminim         =>  Minimal decoder, encoder, and progressive decoder
-                            programs demonstrating use of pngusr.dfa
-       pngminus         =>  Simple pnm2png and png2pnm programs
-       pngsuite         =>  Test images
-       testpngs
-       tools            =>  Various tools
-       visupng          =>  Contains a MSVC workspace for VisualPng
-      projects      =>  Contains project files and workspaces for
-                        building a DLL
-       owatcom          =>  Contains a WATCOM project for building libpng
-       visualc71        =>  Contains a Microsoft Visual C++ (MSVC)
-                            workspace for building libpng and zlib
-       vstudio          =>  Contains a Microsoft Visual C++ (MSVC)
-                            workspace for building libpng and zlib
-      scripts       =>  Directory containing scripts for building libpng:
-                            (see scripts/README.txt for the list of scripts)
-
-Good luck, and happy coding.
-
--Glenn Randers-Pehrson (current maintainer, since 1998)
- Internet: glennrp at users.sourceforge.net
-
--Andreas Eric Dilger (former maintainer, 1996-1997)
- Internet: adilger at enel.ucalgary.ca
- Web: http://www-mddsp.enel.ucalgary.ca/People/adilger/
-
--Guy Eric Schalnat (original author and former maintainer, 1995-1996)
- (formerly of Group 42, Inc)
- Internet: gschal at infinet.com
+ * Cosmin Truta (current maintainer, since 2018)
+ * Glenn Randers-Pehrson (former maintainer, 1998-2018)
+ * Andreas Eric Dilger (former maintainer, 1996-1997)
+ * Guy Eric Schalnat (original author and former maintainer, 1995-1996)
+   (formerly of Group 42, Inc.)

media/libpng/README.MCP

@@ -0,0 +1,11 @@
+This version of libpng has been patched to add APNG support.
+libpng will (eventually) support this natively, as a departure from
+the developers' initial stance on animation support, but the intended
+release publication (using very similar code to our patches) is not
+yet ready.
+
+Once libpng 2.0.x (originally 1.8.x) is ready, our client-side patches
+can likely be discarded and we can lean on upstream's direct support
+from that point forward.
+The apng.patch and arm.patch files are primarily for reference/as a
+starting point for any libpng updates in the meantime.

media/libpng/TRADEMARK

@@ -0,0 +1,8 @@
+TRADEMARK
+=========
+
+The name "libpng" has not been registered by the Copyright owners
+as a trademark in any jurisdiction.  However, because libpng has
+been distributed and maintained world-wide, continually since 1995,
+the Copyright owners claim "common-law trademark protection" in any
+jurisdiction where common-law trademark is recognized.

media/libpng/arm/arm_init.c

@@ -1,17 +1,15 @@
-
 /* arm_init.c - NEON optimised filter functions
  *
+ * Copyright (c) 2018-2022 Cosmin Truta
  * Copyright (c) 2014,2016 Glenn Randers-Pehrson
  * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.22 [May 26, 2016]
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
-/* Below, after checking __linux__, various non-C90 POSIX 1003.1 functions are
- * called.
- */
+
+/* This module requires POSIX 1003.1 functions. */
 #define _POSIX_SOURCE 1
 
 #include "../pngpriv.h"
@@ -32,25 +30,30 @@
  * has partial support is contrib/arm-neon/linux.c - a generic Linux
  * implementation which reads /proc/cpufino.
  */
+#include <signal.h> /* for sig_atomic_t */
+
 #ifndef PNG_ARM_NEON_FILE
-#  ifdef __linux__
-#     define PNG_ARM_NEON_FILE "linux.c"
+#  if defined(__aarch64__) || defined(_M_ARM64)
+     /* ARM Neon is expected to be unconditionally available on ARM64. */
+#    error PNG_ARM_NEON_CHECK_SUPPORTED must not be defined on ARM64
+#  elif defined(__ARM_NEON__) || defined(__ARM_NEON)
+     /* ARM Neon is expected to be available on the target CPU architecture. */
+#    error PNG_ARM_NEON_CHECK_SUPPORTED must not be defined on this CPU arch
+#  elif defined(__linux__)
+#    define PNG_ARM_NEON_FILE "linux.c"
+#  else
+#    error No support for run-time ARM Neon checking; use compile-time options
 #  endif
 #endif
 
-#ifdef PNG_ARM_NEON_FILE
-
-#include <signal.h> /* for sig_atomic_t */
 static int png_have_neon(png_structp png_ptr);
-#include PNG_ARM_NEON_FILE
-
-#else  /* PNG_ARM_NEON_FILE */
-#  error "PNG_ARM_NEON_FILE undefined: no support for run-time ARM NEON checks"
-#endif /* PNG_ARM_NEON_FILE */
+#ifdef PNG_ARM_NEON_FILE
+#  include PNG_ARM_NEON_FILE
+#endif
 #endif /* PNG_ARM_NEON_CHECK_SUPPORTED */
 
 #ifndef PNG_ALIGNED_MEMORY_SUPPORTED
-#  error "ALIGNED_MEMORY is required; set: -DPNG_ALIGNED_MEMORY_SUPPORTED"
+#  error ALIGNED_MEMORY is required; please define PNG_ALIGNED_MEMORY_SUPPORTED
 #endif
 
 void

media/libpng/arm/filter_neon.S

@@ -1,20 +1,30 @@
-
-/* filter_neon.S - NEON optimised filter functions
+/* filter_neon.S - placeholder file
  *
- * Copyright (c) 2014 Glenn Randers-Pehrson
- * Written by Mans Rullgard, 2011.
- * Last changed in libpng 1.6.16 [December 22, 2014]
+ * Copyright (c) 2024 Cosmin Truta
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
  */
 
-/* These are required because Mozilla's moz.build system doesn't pass
- * -DDefined macros to the assembler.
+/* IMPORTANT NOTE:
+ *
+ * Historically, the hand-coded assembler implementation of Neon optimizations
+ * in this module had not been in sync with the intrinsics-based implementation
+ * in filter_neon_intrinsics.c and palette_neon_intrinsics.c, at least since
+ * the introduction of riffled palette optimizations. Moreover, the assembler
+ * code used to work on 32-bit ARM only, and it caused problems, even if empty,
+ * on 64-bit ARM.
+ *
+ * All references to this module from our internal build scripts and projects
+ * have been removed.
+ *
+ * For the external projects that might still expect this module to be present,
+ * we leave this stub in place, for the remaining lifetime of libpng-1.6.x.
+ * Everything should continue to function normally, as long as there are no
+ * deliberate attempts to use the old hand-made assembler code. A build error
+ * will be raised otherwise.
  */
-#define PNG_READ_SUPPORTED
-#define MOZ_PNG_HAVE_ARM_NEON
 
 /* This is required to get the symbol renames, which are #defines, and the
  * definitions (or not) of PNG_ARM_NEON_OPT and PNG_ARM_NEON_IMPLEMENTATION.
@@ -22,238 +32,29 @@
 #define PNG_VERSION_INFO_ONLY
 #include "../pngpriv.h"
 
-#if defined(__linux__) && defined(__ELF__)
-.section .note.GNU-stack,"",%progbits /* mark stack as non-executable */
-#endif
-
 #ifdef PNG_READ_SUPPORTED
-
-/* Assembler NEON support - only works for 32-bit ARM (i.e. it does not work for
- * ARM64).  The code in arm/filter_neon_intrinsics.c supports ARM64, however it
- * only works if -mfpu=neon is specified on the GCC command line.  See pngpriv.h
- * for the logic which sets PNG_USE_ARM_NEON_ASM:
- */
 #if PNG_ARM_NEON_IMPLEMENTATION == 2 /* hand-coded assembler */
-
 #if PNG_ARM_NEON_OPT > 0
 
-#ifdef __ELF__
-#   define ELF
+#if defined(__clang__)
+#define GNUC_VERSION 0 /* not gcc, although it might pretend to be */
+#elif defined(__GNUC__)
+#define GNUC_MAJOR (__GNUC__ + 0)
+#define GNUC_MINOR (__GNUC_MINOR__ + 0)
+#define GNUC_PATCHLEVEL (__GNUC_PATCHLEVEL__ + 0)
+#define GNUC_VERSION (GNUC_MAJOR * 10000 + GNUC_MINOR * 100 + GNUC_PATCHLEVEL)
 #else
-#   define ELF @
+#define GNUC_VERSION 0 /* not gcc */
 #endif
 
-        .arch armv7-a
-        .fpu  neon
+#if (GNUC_VERSION > 0) && (GNUC_VERSION < 40300)
+#error "PNG_ARM_NEON is not supported with gcc versions earlier than 4.3.0"
+#elif GNUC_VERSION == 40504
+#error "PNG_ARM_NEON is not supported with gcc version 4.5.4"
+#else
+#error "Please use 'arm/*_neon_intrinsics.c' for PNG_ARM_NEON support"
+#endif
 
-.macro  func    name, export=0
-    .macro endfunc
-ELF     .size   \name, . - \name
-        .endfunc
-        .purgem endfunc
-    .endm
-        .text
-
-        /* Explicitly specifying alignment here because some versions of
-         * GAS don't align code correctly.  This is harmless in correctly
-         * written versions of GAS.
-         */
-        .align 2
-
-    .if \export
-        .global \name
-    .endif
-ELF     .type   \name, STT_FUNC
-        .func   \name
-\name:
-.endm
-
-func    png_read_filter_row_sub4_neon, export=1
-        ldr             r3,  [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-1:
-        vld4.32         {d4[],d5[],d6[],d7[]},    [r1,:128]
-        vadd.u8         d0,  d3,  d4
-        vadd.u8         d1,  d0,  d5
-        vadd.u8         d2,  d1,  d6
-        vadd.u8         d3,  d2,  d7
-        vst4.32         {d0[0],d1[0],d2[0],d3[0]},[r1,:128]!
-        subs            r3,  r3,  #16
-        bgt             1b
-
-        bx              lr
-endfunc
-
-func    png_read_filter_row_sub3_neon, export=1
-        ldr             r3,  [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-        mov             r0,  r1
-        mov             r2,  #3
-        mov             r12, #12
-        vld1.8          {q11},    [r0], r12
-1:
-        vext.8          d5,  d22, d23, #3
-        vadd.u8         d0,  d3,  d22
-        vext.8          d6,  d22, d23, #6
-        vadd.u8         d1,  d0,  d5
-        vext.8          d7,  d23, d23, #1
-        vld1.8          {q11},    [r0], r12
-        vst1.32         {d0[0]},  [r1,:32], r2
-        vadd.u8         d2,  d1,  d6
-        vst1.32         {d1[0]},  [r1], r2
-        vadd.u8         d3,  d2,  d7
-        vst1.32         {d2[0]},  [r1], r2
-        vst1.32         {d3[0]},  [r1], r2
-        subs            r3,  r3,  #12
-        bgt             1b
-
-        bx              lr
-endfunc
-
-func    png_read_filter_row_up_neon, export=1
-        ldr             r3,  [r0, #4]           @ rowbytes
-1:
-        vld1.8          {q0}, [r1,:128]
-        vld1.8          {q1}, [r2,:128]!
-        vadd.u8         q0,  q0,  q1
-        vst1.8          {q0}, [r1,:128]!
-        subs            r3,  r3,  #16
-        bgt             1b
-
-        bx              lr
-endfunc
-
-func    png_read_filter_row_avg4_neon, export=1
-        ldr             r12, [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-1:
-        vld4.32         {d4[],d5[],d6[],d7[]},    [r1,:128]
-        vld4.32         {d16[],d17[],d18[],d19[]},[r2,:128]!
-        vhadd.u8        d0,  d3,  d16
-        vadd.u8         d0,  d0,  d4
-        vhadd.u8        d1,  d0,  d17
-        vadd.u8         d1,  d1,  d5
-        vhadd.u8        d2,  d1,  d18
-        vadd.u8         d2,  d2,  d6
-        vhadd.u8        d3,  d2,  d19
-        vadd.u8         d3,  d3,  d7
-        vst4.32         {d0[0],d1[0],d2[0],d3[0]},[r1,:128]!
-        subs            r12, r12, #16
-        bgt             1b
-
-        bx              lr
-endfunc
-
-func    png_read_filter_row_avg3_neon, export=1
-        push            {r4,lr}
-        ldr             r12, [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-        mov             r0,  r1
-        mov             r4,  #3
-        mov             lr,  #12
-        vld1.8          {q11},    [r0], lr
-1:
-        vld1.8          {q10},    [r2], lr
-        vext.8          d5,  d22, d23, #3
-        vhadd.u8        d0,  d3,  d20
-        vext.8          d17, d20, d21, #3
-        vadd.u8         d0,  d0,  d22
-        vext.8          d6,  d22, d23, #6
-        vhadd.u8        d1,  d0,  d17
-        vext.8          d18, d20, d21, #6
-        vadd.u8         d1,  d1,  d5
-        vext.8          d7,  d23, d23, #1
-        vld1.8          {q11},    [r0], lr
-        vst1.32         {d0[0]},  [r1,:32], r4
-        vhadd.u8        d2,  d1,  d18
-        vst1.32         {d1[0]},  [r1], r4
-        vext.8          d19, d21, d21, #1
-        vadd.u8         d2,  d2,  d6
-        vhadd.u8        d3,  d2,  d19
-        vst1.32         {d2[0]},  [r1], r4
-        vadd.u8         d3,  d3,  d7
-        vst1.32         {d3[0]},  [r1], r4
-        subs            r12, r12, #12
-        bgt             1b
-
-        pop             {r4,pc}
-endfunc
-
-.macro  paeth           rx,  ra,  rb,  rc
-        vaddl.u8        q12, \ra, \rb           @ a + b
-        vaddl.u8        q15, \rc, \rc           @ 2*c
-        vabdl.u8        q13, \rb, \rc           @ pa
-        vabdl.u8        q14, \ra, \rc           @ pb
-        vabd.u16        q15, q12, q15           @ pc
-        vcle.u16        q12, q13, q14           @ pa <= pb
-        vcle.u16        q13, q13, q15           @ pa <= pc
-        vcle.u16        q14, q14, q15           @ pb <= pc
-        vand            q12, q12, q13           @ pa <= pb && pa <= pc
-        vmovn.u16       d28, q14
-        vmovn.u16       \rx, q12
-        vbsl            d28, \rb, \rc
-        vbsl            \rx, \ra, d28
-.endm
-
-func    png_read_filter_row_paeth4_neon, export=1
-        ldr             r12, [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-        vmov.i8         d20, #0
-1:
-        vld4.32         {d4[],d5[],d6[],d7[]},    [r1,:128]
-        vld4.32         {d16[],d17[],d18[],d19[]},[r2,:128]!
-        paeth           d0,  d3,  d16, d20
-        vadd.u8         d0,  d0,  d4
-        paeth           d1,  d0,  d17, d16
-        vadd.u8         d1,  d1,  d5
-        paeth           d2,  d1,  d18, d17
-        vadd.u8         d2,  d2,  d6
-        paeth           d3,  d2,  d19, d18
-        vmov            d20, d19
-        vadd.u8         d3,  d3,  d7
-        vst4.32         {d0[0],d1[0],d2[0],d3[0]},[r1,:128]!
-        subs            r12, r12, #16
-        bgt             1b
-
-        bx              lr
-endfunc
-
-func    png_read_filter_row_paeth3_neon, export=1
-        push            {r4,lr}
-        ldr             r12, [r0, #4]           @ rowbytes
-        vmov.i8         d3,  #0
-        vmov.i8         d4,  #0
-        mov             r0,  r1
-        mov             r4,  #3
-        mov             lr,  #12
-        vld1.8          {q11},    [r0], lr
-1:
-        vld1.8          {q10},    [r2], lr
-        paeth           d0,  d3,  d20, d4
-        vext.8          d5,  d22, d23, #3
-        vadd.u8         d0,  d0,  d22
-        vext.8          d17, d20, d21, #3
-        paeth           d1,  d0,  d17, d20
-        vst1.32         {d0[0]},  [r1,:32], r4
-        vext.8          d6,  d22, d23, #6
-        vadd.u8         d1,  d1,  d5
-        vext.8          d18, d20, d21, #6
-        paeth           d2,  d1,  d18, d17
-        vext.8          d7,  d23, d23, #1
-        vld1.8          {q11},    [r0], lr
-        vst1.32         {d1[0]},  [r1], r4
-        vadd.u8         d2,  d2,  d6
-        vext.8          d19, d21, d21, #1
-        paeth           d3,  d2,  d19, d18
-        vst1.32         {d2[0]},  [r1], r4
-        vmov            d4,  d19
-        vadd.u8         d3,  d3,  d7
-        vst1.32         {d3[0]},  [r1], r4
-        subs            r12, r12, #12
-        bgt             1b
-
-        pop             {r4,pc}
-endfunc
 #endif /* PNG_ARM_NEON_OPT > 0 */
-#endif /* PNG_ARM_NEON_IMPLEMENTATION == 2 (assembler) */
+#endif /* PNG_ARM_NEON_IMPLEMENTATION == 2 */
 #endif /* READ */

media/libpng/arm/filter_neon_intrinsics.c

@@ -1,12 +1,10 @@
-
 /* filter_neon_intrinsics.c - NEON optimised filter functions
  *
+ * Copyright (c) 2018 Cosmin Truta
  * Copyright (c) 2014,2016 Glenn Randers-Pehrson
  * Written by James Yu <james.yu at linaro.org>, October 2013.
  * Based on filter_neon.S, written by Mans Rullgard, 2011.
  *
- * Last changed in libpng 1.6.22 [May 26, 2016]
- *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
  * and license in png.h
@@ -19,7 +17,11 @@
 /* This code requires -mfpu=neon on the command line: */
 #if PNG_ARM_NEON_IMPLEMENTATION == 1 /* intrinsics code from pngpriv.h */
 
-#include <arm_neon.h>
+#if defined(_MSC_VER) && !defined(__clang__) && defined(_M_ARM64)
+#  include <arm64_neon.h>
+#else
+#  include <arm_neon.h>
+#endif
 
 /* libpng row pointers are not necessarily aligned to any particular boundary,
  * however this code will only work with appropriate alignment.  arm/arm_init.c
@@ -33,6 +35,11 @@
  * 'type'.  This is written this way just to hide the GCC strict aliasing
  * warning; note that the code is safe because there never is an alias between
  * the input and output pointers.
+ *
+ * When compiling with MSVC ARM64, the png_ldr macro can't be passed directly
+ * to vst4_lane_u32, because of an internal compiler error inside MSVC.
+ * To avoid this compiler bug, we use a temporary variable (vdest_val) to store
+ * the result of png_ldr.
  */
 #define png_ldr(type,pointer)\
    (temp_pointer = png_ptr(type,pointer), *temp_pointer)
@@ -41,7 +48,7 @@
 
 void
 png_read_filter_row_up_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_bytep rp_stop = row + row_info->rowbytes;
@@ -62,7 +69,7 @@ png_read_filter_row_up_neon(png_row_infop row_info, png_bytep row,
 
 void
 png_read_filter_row_sub3_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_bytep rp_stop = row + row_info->rowbytes;
@@ -109,7 +116,7 @@ png_read_filter_row_sub3_neon(png_row_infop row_info, png_bytep row,
 
 void
 png_read_filter_row_sub4_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_bytep rp_stop = row + row_info->rowbytes;
@@ -125,12 +132,15 @@ png_read_filter_row_sub4_neon(png_row_infop row_info, png_bytep row,
       uint8x8x4_t *vrpt = png_ptr(uint8x8x4_t,&vtmp);
       uint8x8x4_t vrp = *vrpt;
       uint32x2x4_t *temp_pointer;
+      uint32x2x4_t vdest_val;
 
       vdest.val[0] = vadd_u8(vdest.val[3], vrp.val[0]);
       vdest.val[1] = vadd_u8(vdest.val[0], vrp.val[1]);
       vdest.val[2] = vadd_u8(vdest.val[1], vrp.val[2]);
       vdest.val[3] = vadd_u8(vdest.val[2], vrp.val[3]);
-      vst4_lane_u32(png_ptr(uint32_t,rp), png_ldr(uint32x2x4_t,&vdest), 0);
+
+      vdest_val = png_ldr(uint32x2x4_t, &vdest);
+      vst4_lane_u32(png_ptr(uint32_t,rp), vdest_val, 0);
    }
 
    PNG_UNUSED(prev_row)
@@ -138,7 +148,7 @@ png_read_filter_row_sub4_neon(png_row_infop row_info, png_bytep row,
 
 void
 png_read_filter_row_avg3_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_const_bytep pp = prev_row;
@@ -206,7 +216,7 @@ png_read_filter_row_avg3_neon(png_row_infop row_info, png_bytep row,
 
 void
 png_read_filter_row_avg4_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_bytep rp_stop = row + row_info->rowbytes;
@@ -223,6 +233,7 @@ png_read_filter_row_avg4_neon(png_row_infop row_info, png_bytep row,
       uint8x8x4_t *vrpt, *vppt;
       uint8x8x4_t vrp, vpp;
       uint32x2x4_t *temp_pointer;
+      uint32x2x4_t vdest_val;
 
       vtmp = vld4_u32(png_ptr(uint32_t,rp));
       vrpt = png_ptr(uint8x8x4_t,&vtmp);
@@ -240,7 +251,8 @@ png_read_filter_row_avg4_neon(png_row_infop row_info, png_bytep row,
       vdest.val[3] = vhadd_u8(vdest.val[2], vpp.val[3]);
       vdest.val[3] = vadd_u8(vdest.val[3], vrp.val[3]);
 
-      vst4_lane_u32(png_ptr(uint32_t,rp), png_ldr(uint32x2x4_t,&vdest), 0);
+      vdest_val = png_ldr(uint32x2x4_t, &vdest);
+      vst4_lane_u32(png_ptr(uint32_t,rp), vdest_val, 0);
    }
 }
 
@@ -273,7 +285,7 @@ paeth(uint8x8_t a, uint8x8_t b, uint8x8_t c)
 
 void
 png_read_filter_row_paeth3_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_const_bytep pp = prev_row;
@@ -341,7 +353,7 @@ png_read_filter_row_paeth3_neon(png_row_infop row_info, png_bytep row,
 
 void
 png_read_filter_row_paeth4_neon(png_row_infop row_info, png_bytep row,
-   png_const_bytep prev_row)
+    png_const_bytep prev_row)
 {
    png_bytep rp = row;
    png_bytep rp_stop = row + row_info->rowbytes;
@@ -359,6 +371,7 @@ png_read_filter_row_paeth4_neon(png_row_infop row_info, png_bytep row,
       uint8x8x4_t *vrpt, *vppt;
       uint8x8x4_t vrp, vpp;
       uint32x2x4_t *temp_pointer;
+      uint32x2x4_t vdest_val;
 
       vtmp = vld4_u32(png_ptr(uint32_t,rp));
       vrpt = png_ptr(uint8x8x4_t,&vtmp);
@@ -378,7 +391,8 @@ png_read_filter_row_paeth4_neon(png_row_infop row_info, png_bytep row,
 
       vlast = vpp.val[3];
 
-      vst4_lane_u32(png_ptr(uint32_t,rp), png_ldr(uint32x2x4_t,&vdest), 0);
+      vdest_val = png_ldr(uint32x2x4_t, &vdest);
+      vst4_lane_u32(png_ptr(uint32_t,rp), vdest_val, 0);
    }
 }