[layout] Prevent recursion of callbacks in PressShell.

[gfx] Clean up cairo-win32-printing-surface.c
- Reformat code for readability. - Check allocations in _cairo_win32_printing_surface_paint_linear_pattern.
2026-11-04 08:52:01 -05:00 · 2026-08-21 21:18:20 +02:00 · 2026-08-21 15:46:36 +02:00 · 2026-08-20 15:45:42 +02:00 · 2026-08-20 15:13:25 +02:00 · 2026-08-19 15:31:24 +00:00
201 changed files with 5400 additions and 1923 deletions
@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.

-Clobber for Idle GC backout
+Clobber for removal of network tickler
@@ -18,10 +18,6 @@
 #endif
 #include <gtk/gtk.h>

-#if (MOZ_WIDGET_GTK == 3)
-extern "C" __attribute__((weak,visibility("default"))) int atk_bridge_adaptor_init(int*, char **[]);
-#endif
-
 using namespace mozilla;
 using namespace mozilla::a11y;

@@ -33,12 +29,20 @@ extern "C" {
 typedef GType (* AtkGetTypeType) (void);
 typedef void (*GnomeAccessibilityInit) (void);
 typedef void (*GnomeAccessibilityShutdown) (void);
+#if (MOZ_WIDGET_GTK == 3)
+typedef int (*AtkBridgeAdaptorInit) (int*, char***);
+#endif
 }

 static PRLibrary* sATKLib = nullptr;
 static const char sATKLibName[] = "libatk-1.0.so.0";
 static const char sATKHyperlinkImplGetTypeSymbol[] =
  "atk_hyperlink_impl_get_type";
+#if (MOZ_WIDGET_GTK == 3)
+static PRLibrary* sAtkBridgeAdaptorLib = nullptr;
+static const char sAtkBridgeAdaptorLibName[] = "libatk-bridge-2.0.so.0";
+static const char sAtkBridgeAdaptorInitSymbol[] = "atk_bridge_adaptor_init";
+#endif

 gboolean toplevel_event_watcher(GSignalInvocationHint*, guint, const GValue*,
                                gpointer);
@@ -127,6 +131,38 @@ LoadGtkModule(GnomeAccessibilityModule& aModule)
    return NS_OK;
 }

+#if (MOZ_WIDGET_GTK == 3)
+static bool
+InitAtkBridgeAdaptor()
+{
+  AtkBridgeAdaptorInit initBridge =
+    reinterpret_cast<AtkBridgeAdaptorInit>(
+      PR_FindFunctionSymbolAndLibrary(sAtkBridgeAdaptorInitSymbol,
+                                      &sAtkBridgeAdaptorLib));
+
+  if (!initBridge) {
+    sAtkBridgeAdaptorLib = PR_LoadLibrary(sAtkBridgeAdaptorLibName);
+    if (sAtkBridgeAdaptorLib) {
+      initBridge =
+        reinterpret_cast<AtkBridgeAdaptorInit>(
+          PR_FindFunctionSymbol(sAtkBridgeAdaptorLib,
+                                sAtkBridgeAdaptorInitSymbol));
+      if (!initBridge) {
+        PR_UnloadLibrary(sAtkBridgeAdaptorLib);
+        sAtkBridgeAdaptorLib = nullptr;
+      }
+    }
+  }
+
+  if (!initBridge) {
+    return false;
+  }
+
+  initBridge(nullptr, nullptr);
+  return true;
+}
+#endif
+
 void
 a11y::PlatformInit()
 {
@@ -181,9 +217,7 @@ a11y::PlatformInit()
  // Init atk-bridge now
  PR_SetEnv("NO_AT_BRIDGE=0");
 #if (MOZ_WIDGET_GTK == 3)
-  if (atk_bridge_adaptor_init) {
-    atk_bridge_adaptor_init(nullptr, nullptr);
-  } else
+  if (!InitAtkBridgeAdaptor())
 #endif
  {
    nsresult rv = LoadGtkModule(sAtkBridge);
@@ -228,6 +262,13 @@ a11y::PlatformShutdown()
        sAtkBridge.init = nullptr;
        sAtkBridge.shutdown = nullptr;
    }
+#if (MOZ_WIDGET_GTK == 3)
+    if (sAtkBridgeAdaptorLib) {
+        // Do not shutdown/unload atk-bridge; an exit function registered by
+        // the bridge will take care of it.
+        sAtkBridgeAdaptorLib = nullptr;
+    }
+#endif
 #if (MOZ_WIDGET_GTK == 2)
    if (sGail.lib) {
        // Do not shutdown gail because
@@ -164,6 +164,7 @@ def old_configure_options(*options):
    '--enable-negotiateauth',
    '--enable-nfc',
    '--enable-npapi',
+    '--enable-npapi-gtk2',
    '--enable-nspr-build',
    '--enable-official-branding',
    '--enable-official-vendor',
@@ -81,7 +81,7 @@ $(addprefix install-,$(INSTALL_MANIFESTS)): install-%: $(addprefix $(TOPOBJDIR)/
 		--track install_$(subst /,_,$*).track \
 		$(TOPOBJDIR)/$* \
 		-DAB_CD=en-US \
-		-DBOOKMARKS_INCLUDE_DIR=$(TOPSRCDIR)/browser/locales/en-US/profile \
+		-DBOOKMARKS_INCLUDE_DIR=$(TOPSRCDIR)/$(MOZ_BUILD_APP)/locales/en-US/profile \
 		$(ACDEFINES) \
 		install_$(subst /,_,$*)

@@ -143,7 +143,8 @@ TooltipsOverlay.prototype = {
    // Font preview tooltip
    if (type === VIEW_NODE_VALUE_TYPE && prop.property === "font-family") {
      let value = prop.value.toLowerCase();
-      if (value !== "inherit" && value !== "unset" && value !== "initial" && value !== "revert") {
+      if (value !== "inherit" && value !== "unset" && value !== "initial" &&
+          value !== "revert" && value !== "revert-layer") {
        tooltipType = TOOLTIP_FONTFAMILY_TYPE;
      }
    }
@@ -3,6 +3,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-JS_PREFERENCE_PP_FILES += [
+JS_PREFERENCE_FILES += [
    'devtools.js',
 ]
@@ -10,7 +10,8 @@ const SPECIALVALUES = new Set([
  "initial",
  "inherit",
  "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);

 const {getCSSLexer} = require("devtools/shared/css/lexer");
@@ -99,7 +99,14 @@ const filterList = [
 ];

 // Valid values that shouldn't be parsed for filters.
-const SPECIAL_VALUES = new Set(["none", "unset", "initial", "inherit", "revert"]);
+const SPECIAL_VALUES = new Set([
+  "none",
+  "unset",
+  "initial",
+  "inherit",
+  "revert",
+  "revert-layer"
+]);

 /**
 * A CSS Filter editor widget used to add/remove/modify
@@ -20,7 +20,8 @@ const SPECIALVALUES = new Set([
  "inherit",
  "transparent",
  "unset",
-  "revert"
+  "revert",
+  "revert-layer"
 ]);

 /**
@@ -43,7 +43,7 @@ class MachCommands(MachCommandBase):
        if not os.path.exists(generated_dir):
            generated_dir = mozpath.join(self.topsrcdir, 'platform',
                'devtools/shared/css/generated')
-        else:
+        if not os.path.exists(generated_dir):
            raise Exception('Directory expected at %s does not exist.' % generated_dir)
        self.generated_dir = generated_dir

@@ -75,6 +75,9 @@ class MachCommands(MachCommandBase):
        contents = subprocess.check_output([xpcshell_path, '-g', gre_path,
                                            '-a', browser_path, script_path],
                                           env = sub_env)
+        if not isinstance(contents, str):
+            contents = contents.decode('utf-8')
+
        # Extract just the output between the delimiters as the xpcshell output can
        # have extra output that we don't want.
        contents = contents.split('DEVTOOLS_CSS_DB_DELIMITER')[1]
@@ -88,13 +91,13 @@ class MachCommands(MachCommandBase):
        destination_path = mozpath.join(self.generated_dir,
            'properties-db.js')

-        with open(js_template_path, 'rb') as handle:
+        with open(js_template_path, 'r') as handle:
            js_template = handle.read()

        preamble = '/* THIS IS AN AUTOGENERATED FILE.  DO NOT EDIT */\n\n'
        contents = string.Template(js_template).substitute(substitutions)

-        with open(destination_path, 'wb') as destination:
+        with open(destination_path, 'w') as destination:
            destination.write(preamble + contents)

        print(('The database was successfully generated at ' + destination_path))
@@ -5,13 +5,19 @@

 #include "DocumentOrShadowRoot.h"
 #include "mozilla/EventStateManager.h"
+#include "mozilla/CSSStyleSheet.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/CSSStyleSheetBinding.h"
 #include "mozilla/dom/StyleSheetList.h"
+#include "mozilla/dom/ToJSValue.h"
 #include "nsDocument.h"
 #include "nsFocusManager.h"
 #include "ShadowRoot.h"
 #include "XULDocument.h"
 #include "nsLayoutUtils.h"
 #include "nsSVGUtils.h"
+#include "jsapi.h"

 class nsINode;
 class nsIDocument;
@@ -43,6 +49,99 @@ DocumentOrShadowRoot::EnsureDOMStyleSheets()
  return *mDOMStyleSheets;
 }

+void
+DocumentOrShadowRoot::GetAdoptedStyleSheets(
+    JSContext* aCx,
+    JS::MutableHandle<JSObject*> aResult,
+    ErrorResult& aRv) const
+{
+  JS::Rooted<JS::Value> value(aCx);
+  if (!ToJSValue(aCx, mAdoptedStyleSheets, &value)) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
+  MOZ_ASSERT(value.isObject());
+  aResult.set(&value.toObject());
+}
+
+void
+DocumentOrShadowRoot::SetAdoptedStyleSheets(
+    JSContext* aCx,
+    JS::Handle<JSObject*> aSheets,
+    ErrorResult& aRv)
+{
+  bool isArray = false;
+  if (!JS_IsArrayObject(aCx, aSheets, &isArray)) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  if (!isArray) {
+    aRv.ThrowTypeError<MSG_NOT_SEQUENCE>(
+      NS_LITERAL_STRING("DocumentOrShadowRoot.adoptedStyleSheets"));
+    return;
+  }
+
+  uint32_t length = 0;
+  if (!JS_GetArrayLength(aCx, aSheets, &length)) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsIDocument* document = AsNode().OwnerDoc();
+  nsTArray<RefPtr<CSSStyleSheet>> newSheets;
+  if (!newSheets.SetCapacity(length, fallible)) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(aCx);
+  for (uint32_t i = 0; i < length; ++i) {
+    if (!JS_GetElement(aCx, aSheets, i, &value)) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+
+    if (!value.isObject()) {
+      aRv.ThrowTypeError<MSG_DOES_NOT_IMPLEMENT_INTERFACE>(
+        NS_LITERAL_STRING("Element of DocumentOrShadowRoot.adoptedStyleSheets"),
+        NS_LITERAL_STRING("CSSStyleSheet"));
+      return;
+    }
+
+    RefPtr<CSSStyleSheet> sheet;
+    nsresult rv = UnwrapObject<prototypes::id::CSSStyleSheet,
+                               CSSStyleSheet>(&value.toObject(), sheet);
+    if (NS_FAILED(rv)) {
+      aRv.ThrowTypeError<MSG_DOES_NOT_IMPLEMENT_INTERFACE>(
+        NS_LITERAL_STRING("Element of DocumentOrShadowRoot.adoptedStyleSheets"),
+        NS_LITERAL_STRING("CSSStyleSheet"));
+      return;
+    }
+
+    if (!sheet->IsConstructed() || sheet->ConstructorDocument() != document) {
+      aRv.Throw(NS_ERROR_DOM_NOT_ALLOWED_ERR);
+      return;
+    }
+
+    newSheets.AppendElement(sheet);
+  }
+
+  nsTArray<RefPtr<CSSStyleSheet>> oldSheets;
+  oldSheets.SwapElements(mAdoptedStyleSheets);
+  mAdoptedStyleSheets.SwapElements(newSheets);
+
+  if (mKind == Kind::Document) {
+    static_cast<nsDocument&>(AsNode()).AdoptedStyleSheetsChanged(oldSheets,
+                                                                 mAdoptedStyleSheets);
+    return;
+  }
+
+  static_cast<ShadowRoot&>(AsNode()).AdoptedStyleSheetsChanged(oldSheets,
+                                                              mAdoptedStyleSheets);
+}
+
 Element*
 DocumentOrShadowRoot::GetElementById(const nsAString& aElementId)
 {
@@ -11,11 +11,14 @@
 #include "nsContentListDeclarations.h"
 #include "nsNameSpaceManager.h"
 #include "mozilla/dom/NameSpaceConstants.h"
+#include "js/RootingAPI.h"

 class nsContentList;
 class nsINode;

 namespace mozilla {
+class CSSStyleSheet;
+class ErrorResult;
 class StyleSheet;

 namespace dom {
@@ -83,6 +86,18 @@ public:

  StyleSheetList& EnsureDOMStyleSheets();

+  void GetAdoptedStyleSheets(JSContext* aCx,
+                             JS::MutableHandle<JSObject*> aResult,
+                             mozilla::ErrorResult& aRv) const;
+  void SetAdoptedStyleSheets(JSContext* aCx,
+                             JS::Handle<JSObject*> aSheets,
+                             mozilla::ErrorResult& aRv);
+
+  const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& AdoptedStyleSheets() const
+  {
+    return mAdoptedStyleSheets;
+  }
+
  Element* GetElementById(const nsAString& aElementId);

  /**
@@ -151,6 +166,7 @@ protected:
  Element* GetRetargetedFocusedElement();

  nsTArray<RefPtr<mozilla::StyleSheet>> mStyleSheets;
+  nsTArray<RefPtr<mozilla::CSSStyleSheet>> mAdoptedStyleSheets;
  RefPtr<mozilla::dom::StyleSheetList> mDOMStyleSheets;

  /*
@@ -18,6 +18,7 @@
 #include "mozilla/dom/StyleSheetList.h"
 #include "nsXBLPrototypeBinding.h"
 #include "mozilla/BasicEvents.h"
+#include "mozilla/CSSStyleSheet.h"
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/StyleSheet.h"
 #include "mozilla/StyleSheetInlines.h"
@@ -30,6 +31,7 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(ShadowRoot)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(ShadowRoot,
                                                  DocumentFragment)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDOMStyleSheets)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAdoptedStyleSheets)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAssociatedBinding)
  for (auto iter = tmp->mIdentifierMap.ConstIter(); !iter.Done();
       iter.Next()) {
@@ -42,6 +44,10 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(ShadowRoot)
    tmp->GetHost()->RemoveMutationObserver(tmp);
  }
  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)
+  for (CSSStyleSheet* sheet : tmp->mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(tmp);
+  }
+  tmp->mAdoptedStyleSheets.Clear();
  NS_IMPL_CYCLE_COLLECTION_UNLINK(mAssociatedBinding)
  tmp->mIdentifierMap.Clear();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END_INHERITED(DocumentFragment)
@@ -90,6 +96,11 @@ ShadowRoot::~ShadowRoot()
    host->RemoveMutationObserver(this);
  }

+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(this);
+  }
+  mAdoptedStyleSheets.Clear();
+
  UnsetFlags(NODE_IS_IN_SHADOW_TREE);

  // nsINode destructor expects mSubtreeRoot == this.
@@ -270,15 +281,20 @@ ShadowRoot::InsertSheet(StyleSheet* aSheet,

  linkingElement->SetStyleSheet(aSheet); // This sets the ownerNode on the sheet

-  MOZ_DIAGNOSTIC_ASSERT(mProtoBinding->SheetCount() == DocumentOrShadowRoot::SheetCount());
+  MOZ_DIAGNOSTIC_ASSERT(mProtoBinding->SheetCount() ==
+                        DocumentOrShadowRoot::SheetCount() +
+                        mAdoptedStyleSheets.Length());
 #ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
-  // FIXME(emilio, bug 1425759): For now we keep them duplicated, the proto
-  // binding will disappear soon (tm).
+  // FIXME(emilio, bug 1425759): For now we keep regular sheets duplicated;
+  // adopted sheets are stored as a suffix on the proto binding only.
  {
    size_t i = 0;
    for (RefPtr<StyleSheet>& sheet : mStyleSheets) {
      MOZ_DIAGNOSTIC_ASSERT(sheet.get() == mProtoBinding->StyleSheetAt(i++));
    }
+    for (RefPtr<CSSStyleSheet>& sheet : mAdoptedStyleSheets) {
+      MOZ_DIAGNOSTIC_ASSERT(sheet.get() == mProtoBinding->StyleSheetAt(i++));
+    }
  }
 #endif

@@ -287,7 +303,7 @@ ShadowRoot::InsertSheet(StyleSheet* aSheet,
  for (size_t i = 0; i <= SheetCount(); i++) {
    if (i == SheetCount()) {
      AppendStyleSheet(*aSheet);
-      mProtoBinding->AppendStyleSheet(aSheet);
+      mProtoBinding->InsertStyleSheetAt(i, aSheet);
      break;
    }

@@ -322,6 +338,39 @@ ShadowRoot::RemoveSheet(StyleSheet* aSheet)
  }
 }

+void
+ShadowRoot::AdoptedStyleSheetsChanged(
+    const nsTArray<RefPtr<CSSStyleSheet>>& aOldSheets,
+    const nsTArray<RefPtr<CSSStyleSheet>>& aNewSheets)
+{
+  OwnerDoc()->BeginUpdate(UPDATE_STYLE);
+
+  bool applicableChange = false;
+  for (size_t i = 0; i < aOldSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aOldSheets[i];
+    if (aOldSheets.IndexOf(sheet) == i) {
+      mProtoBinding->RemoveStyleSheet(sheet);
+    }
+    applicableChange = applicableChange || sheet->IsApplicable();
+    sheet->RemoveAdopter(this);
+  }
+
+  for (size_t i = 0; i < aNewSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aNewSheets[i];
+    sheet->AddAdopter(this);
+    if (aNewSheets.IndexOf(sheet) == i) {
+      mProtoBinding->AppendStyleSheet(sheet);
+    }
+    applicableChange = applicableChange || sheet->IsApplicable();
+  }
+
+  if (applicableChange) {
+    StyleSheetChanged();
+  }
+
+  OwnerDoc()->EndUpdate(UPDATE_STYLE);
+}
+
 void
 ShadowRoot::AddToIdTable(Element* aElement, nsIAtom* aId)
 {
@@ -21,6 +21,7 @@ class nsXBLPrototypeBinding;

 namespace mozilla {

+class CSSStyleSheet;
 class EventChainPreVisitor;

 namespace dom {
@@ -59,6 +60,9 @@ public:
  // [deprecated] Shadow DOM v0
  void InsertSheet(StyleSheet* aSheet, nsIContent* aLinkingContent);
  void RemoveSheet(StyleSheet* aSheet);
+  void AdoptedStyleSheetsChanged(
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aOldSheets,
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aNewSheets);
  StyleSheetList* StyleSheets()
  {
    return &DocumentOrShadowRoot::EnsureDOMStyleSheets();
@@ -173,4 +177,3 @@ protected:
 } // namespace mozilla

 #endif // mozilla_dom_shadowroot_h__
-
@@ -274,7 +274,7 @@ public:
    }

    template<typename T,
-             typename = typename std::enable_if<std::is_enum<T>::value>::type>
+             typename = typename std::enable_if_t<std::is_enum_v<T>>>
    EnumTable(const char* aTag, T aValue)
      : tag(aTag)
      , value(static_cast<int16_t>(aValue))
@@ -13,6 +13,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/AutoRestore.h"
 #include "mozilla/BinarySearch.h"
+#include "mozilla/CSSStyleSheet.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/EffectSet.h"
 #include "mozilla/IntegerRange.h"
@@ -1402,6 +1403,10 @@ nsDocument::~nsDocument()
  for (StyleSheet* sheet : mStyleSheets) {
    sheet->ClearAssociatedDocument();
  }
+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(this);
+  }
+  mAdoptedStyleSheets.Clear();
  for (auto& sheets : mAdditionalSheets) {
    for (StyleSheet* sheet : sheets) {
    sheet->ClearAssociatedDocument();
@@ -1635,6 +1640,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)

  // Traverse all our nsCOMArrays.
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleSheets)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAdoptedStyleSheets)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOnDemandBuiltInUASheets)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPreloadingImages)

@@ -1740,6 +1746,11 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)

  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)

+  for (CSSStyleSheet* sheet : tmp->mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(tmp);
+  }
+  tmp->mAdoptedStyleSheets.Clear();
+
  if (tmp->mStyleSheetSetList) {
    tmp->mStyleSheetSetList->Disconnect();
    tmp->mStyleSheetSetList = nullptr;
@@ -2205,6 +2216,12 @@ nsDocument::FillStyleSet(nsStyleSet* aStyleSet)
  AppendSheetsToStyleSet(aStyleSet, mAdditionalSheets[eAuthorSheet],
                         SheetType::Doc);

+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    if (sheet->IsApplicable()) {
+      aStyleSet->AppendStyleSheet(SheetType::Doc, sheet);
+    }
+  }
+
  mStyleSetFilled = true;
 }

@@ -3872,6 +3889,37 @@ nsDocument::RemoveStyleSheetFromStyleSets(StyleSheet* aSheet)
  }
 }

+void
+nsDocument::AdoptedStyleSheetsChanged(
+    const nsTArray<RefPtr<CSSStyleSheet>>& aOldSheets,
+    const nsTArray<RefPtr<CSSStyleSheet>>& aNewSheets)
+{
+  BeginUpdate(UPDATE_STYLE);
+
+  nsCOMPtr<nsIPresShell> shell = GetShell();
+  nsStyleSet* styleSet = shell ? shell->StyleSet() : nullptr;
+
+  for (size_t i = 0; i < aOldSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aOldSheets[i];
+    if (styleSet && sheet->IsApplicable() &&
+        aOldSheets.IndexOf(sheet) == i) {
+      styleSet->RemoveStyleSheet(SheetType::Doc, sheet);
+    }
+    sheet->RemoveAdopter(this);
+  }
+
+  for (size_t i = 0; i < aNewSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aNewSheets[i];
+    sheet->AddAdopter(this);
+    if (styleSet && sheet->IsApplicable() &&
+        aNewSheets.IndexOf(sheet) == i) {
+      styleSet->AppendStyleSheet(SheetType::Doc, sheet);
+    }
+  }
+
+  EndUpdate(UPDATE_STYLE);
+}
+
 void
 nsDocument::RemoveStyleSheet(StyleSheet* aSheet)
 {
@@ -3961,6 +4009,18 @@ nsDocument::SetStyleSheetApplicableState(StyleSheet* aSheet,
    } else {
      RemoveStyleSheetFromStyleSets(aSheet);
    }
+  } else if (mAdoptedStyleSheets.IndexOf(aSheet->AsConcrete()) !=
+             mAdoptedStyleSheets.NoIndex) {
+    nsCOMPtr<nsIPresShell> shell = GetShell();
+    if (shell) {
+      if (aApplicable) {
+        shell->StyleSet()->AppendStyleSheet(SheetType::Doc,
+                                            aSheet->AsConcrete());
+      } else {
+        shell->StyleSet()->RemoveStyleSheet(SheetType::Doc,
+                                            aSheet->AsConcrete());
+      }
+    }
  }

  // We have to always notify, since this will be called for sheets
@@ -95,6 +95,7 @@ class nsISecurityConsoleMessage;
 class nsPIBoxObject;

 namespace mozilla {
+class CSSStyleSheet;
 class EventChainPreVisitor;
 namespace dom {
 class BoxObject;
@@ -471,6 +472,9 @@ public:
      nsTArray<RefPtr<mozilla::StyleSheet>>& aNewSheets) override;
  virtual void AddStyleSheetToStyleSets(mozilla::StyleSheet* aSheet);
  virtual void RemoveStyleSheetFromStyleSets(mozilla::StyleSheet* aSheet);
+  void AdoptedStyleSheetsChanged(
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aOldSheets,
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aNewSheets);

  virtual void InsertStyleSheetAt(mozilla::StyleSheet* aSheet,
                                  size_t aIndex) override;
@@ -444,6 +444,7 @@ GK_ATOM(handheldFriendly, "HandheldFriendly")
 GK_ATOM(handler, "handler")
 GK_ATOM(handlers, "handlers")
 GK_ATOM(HARD, "HARD")
+GK_ATOM(hasSelectorDependency, "has-selector-dependency")
 GK_ATOM(hasSameNode, "has-same-node")
 GK_ATOM(hbox, "hbox")
 GK_ATOM(head, "head")
@@ -6162,7 +6162,6 @@ nsGlobalWindow::CheckSecurityWidthAndHeight(int32_t* aWidth, int32_t* aHeight, b
  // This one is easy. Just ensure the variable is greater than 100;
  if ((aWidth && *aWidth < 100) || (aHeight && *aHeight < 100)) {
    // Check security state for use in determing window dimensions
-
    if (!nsContentUtils::IsCallerChrome()) {
      //sec check failed
      if (aWidth && *aWidth < 100) {
@@ -6173,6 +6172,21 @@ nsGlobalWindow::CheckSecurityWidthAndHeight(int32_t* aWidth, int32_t* aHeight, b
      }
    }
  }
+  
+  // Check for the screen dimensions and keep the size in the range of the
+  // screen size the window is on. We allow twice the screen size because the
+  // size we get for a screen is not always accurate, on Wayland in particular,
+  // and all we need is to keep the size in a reasonable range.
+  nsCOMPtr<nsIDOMScreen> screen = GetScreen();
+  int32_t screenWidth, screenHeight;
+  screen->GetAvailWidth(&screenWidth);
+  screen->GetAvailHeight(&screenHeight);
+  if (aWidth && *aWidth > 2 * screenWidth) {
+    *aWidth = 2 * screenWidth;
+  }
+  if (aHeight && *aHeight > 2 * screenHeight) {
+    *aHeight = 2 * screenHeight;
+  }  
 }

 // NOTE: Arguments to this function should have values in device pixels
@@ -8091,8 +8105,10 @@ nsGlobalWindow::ResizeByOuter(int32_t aWidthDif, int32_t aHeightDif,

  nsIntSize cssSize(DevToCSSIntPixels(nsIntSize(width, height)));

-  cssSize.width += aWidthDif;
-  cssSize.height += aHeightDif;
+  // The deltas come from content and can be large enough to overflow a 32-bit
+  // add, so do the arithmetic in 64 bits and keep the result in range.
+  cssSize.width = int32_t(std::clamp<int64_t>(int64_t(cssSize.width) + aWidthDif, 0, INT32_MAX));
+  cssSize.height = int32_t(std::clamp<int64_t>(int64_t(cssSize.height) + aHeightDif, 0, INT32_MAX));

  CheckSecurityWidthAndHeight(&cssSize.width, &cssSize.height, aCallerIsChrome);

@@ -46,6 +46,9 @@ nsIDocument::FindDocStyleSheetInsertionPoint(
          break;
        }
      }
+      if (sheet->IsConstructed()) {
+        break;
+      }
      if (sheet == GetFirstAdditionalAuthorSheet()) {
        break;
      }
@@ -97,7 +97,7 @@ ToJSValue(JSContext* aCx,
  return true;
 }

-// accept floating point types
+// Accept floating point types
 inline bool
 ToJSValue(JSContext* aCx,
          float aArgument,
@@ -106,7 +106,7 @@ ToJSValue(JSContext* aCx,
  // Make sure we're called in a compartment
  MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));

-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(double(aArgument)));
  return true;
 }

@@ -876,20 +876,12 @@ HTMLImageElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
  return HTMLImageElementBinding::Wrap(aCx, this, aGivenProto);
 }

-#ifdef DEBUG
-nsIDOMHTMLFormElement*
-HTMLImageElement::GetForm() const
-{
-  return mForm;
-}
-#endif
-
 void
 HTMLImageElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  NS_ASSERTION(!mForm,
-               "We don't support switching from one non-null form to another.");
+  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
+             "We don't support switching from one non-null form to another.");

  mForm = static_cast<HTMLFormElement*>(aForm);
 }
@@ -216,9 +216,8 @@ public:
    SetHTMLAttr(nsGkAtoms::lowsrc, aLowsrc, aError);
  }

-#ifdef DEBUG
-  nsIDOMHTMLFormElement* GetForm() const;
-#endif
+  HTMLFormElement* GetForm() const { return mForm; };
+
  void SetForm(nsIDOMHTMLFormElement* aForm);
  void ClearForm(bool aRemoveFromForm);

@@ -1487,8 +1487,15 @@ nsGenericHTMLElement::MapImageSizeAttributesInto(const nsMappedAttributes* aAttr
    }

    if (w && h && *w != 0 && *h != 0) {
-      nsCSSValue* aspect_ratio = aData->ValueForAspectRatio();
-      aspect_ratio->SetFloatValue((float(*w) / float(*h)), eCSSUnit_Number);
+      nsCSSValue width;
+      width.SetFloatValue(float(*w), eCSSUnit_Number);
+      nsCSSValue height;
+      height.SetFloatValue(float(*h), eCSSUnit_Number);
+      nsCSSValue ratio;
+      ratio.SetPairValue(width, height);
+      nsCSSValue autoValue;
+      autoValue.SetAutoValue();
+      aData->ValueForAspectRatio()->SetPairValue(autoValue, ratio);
    }
  }
 }
@@ -1824,8 +1831,8 @@ void
 nsGenericHTMLFormElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
  NS_PRECONDITION(aForm, "Don't pass null here");
-  NS_ASSERTION(!mForm,
-               "We don't support switching from one non-null form to another.");
+  MOZ_ASSERT(!mForm && !HasFlag(ADDED_TO_FORM),
+             "We don't support switching from one non-null form to another.");

  // keep a *weak* ref to the form here
  mForm = static_cast<HTMLFormElement*>(aForm);
@@ -2455,7 +2455,7 @@ ContentChild::RecvUpdateWindow(const uintptr_t& aChildId)
  if (parentInstance) {
  // sync! update call to the plugin instance that forces the
  // plugin to paint its child window.
-  parentInstance->CallUpdateWindow();
+  Unused << parentInstance->CallUpdateWindow();
  }
  return true;
 #else
@@ -367,12 +367,13 @@ public:
  {
  }

+  static const uint32_t MIN_RATE = 8000;
  static const uint32_t MAX_RATE = 640000;

  bool IsValid() const override
  {
    return mChannels > 0 && mChannels <= MAX_AUDIO_CHANNELS
-           && mRate > 0 && mRate <= MAX_RATE;
+           && mRate >= MIN_RATE && mRate <= MAX_RATE;
  }

  AudioInfo* GetAsAudioInfo() override
@@ -179,12 +179,18 @@ IsValidVideoRegion(const nsIntSize& aFrame, const nsIntRect& aPicture,
    aFrame.height <= PlanarYCbCrImage::MAX_DIMENSION &&
    aFrame.width * aFrame.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aFrame.width * aFrame.height != 0 &&
+    aPicture.width > 0 &&
    aPicture.width <= PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.x >= 0 &&
    aPicture.x < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.x + aPicture.width < PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.XMost() <= aFrame.width &&
+    aPicture.height > 0 &&
    aPicture.height <= PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.y >= 0 &&
    aPicture.y < PlanarYCbCrImage::MAX_DIMENSION &&
    aPicture.y + aPicture.height < PlanarYCbCrImage::MAX_DIMENSION &&
+    aPicture.YMost() <= aFrame.height &&
    aPicture.width * aPicture.height <= MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT &&
    aPicture.width * aPicture.height != 0 &&
    aDisplay.width <= PlanarYCbCrImage::MAX_DIMENSION &&
@@ -439,7 +439,7 @@ private:
    Maybe<size_t> mInitOffset;
    Maybe<size_t> mMediaOffset;
    bool mValid = true;
-    char mLastInvalidBox[5];
+    char mLastInvalidBox[5]{};
  };

 public:
@@ -20,6 +20,7 @@
 #include "WebMBufferedParser.h"
 #include "gfx2DGlue.h"
 #include "mozilla/Atomics.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/EndianUtils.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/SharedThreadPool.h"
@@ -352,19 +353,27 @@ WebMDemuxer::ReadMetadata()
          mInfo.mVideo.mExtraData = new MediaByteBuffer(length);
          mInfo.mVideo.mExtraData->AppendElements(data, length);
          break;
-	}
+        }
        default:
          NS_WARNING("Unknown WebM video codec");
          return NS_ERROR_FAILURE;
      }
      // Picture region, taking into account cropping, before scaling
      // to the display size.
-      unsigned int cropH = params.crop_right + params.crop_left;
-      unsigned int cropV = params.crop_bottom + params.crop_top;
+      CheckedInt<uint32_t> cropH = CheckedInt<uint32_t>(params.crop_left) + params.crop_right;
+      CheckedInt<uint32_t> cropV = CheckedInt<uint32_t>(params.crop_top) + params.crop_bottom;
+      if (!cropH.isValid() || !cropV.isValid() ||
+          cropH.value() >= params.width || cropV.value() >= params.height) {
+        WEBM_DEBUG("Invalid crop values left: {} right: {} top: {} bottom: {}",
+                   params.crop_left, params.crop_right, params.crop_top,
+                   params.crop_bottom);
+        // Ignore invalid crop parameters.
+        continue;
+      }
      nsIntRect pictureRect(params.crop_left,
                            params.crop_top,
-                            params.width - cropH,
-                            params.height - cropV);
+                            params.width - cropH.value(),
+                            params.height - cropV.value());

      // If the cropping data appears invalid then use the frame data
      if (pictureRect.width <= 0 ||
@@ -55,7 +55,12 @@ using namespace std;
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
 #include "gtk2xtbin.h"
+#endif

 #elif defined(OS_WIN)

@@ -208,7 +213,9 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
    memset(&mWsInfo, 0, sizeof(mWsInfo));
 #ifdef MOZ_WIDGET_GTK
    mWsInfo.display = nullptr;
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    mXtClient.top_widget = nullptr;
+#endif
 #else
    mWsInfo.display = DefaultXDisplay();
 #endif
@@ -620,15 +627,17 @@ PluginInstanceChild::NPN_SetValue(NPPVariable aVar, void* aValue)
        NPWindowType newWindowType = windowed ? NPWindowTypeWindow : NPWindowTypeDrawable;
 #ifdef MOZ_WIDGET_GTK
        if (mWindow.type != newWindowType && mWsInfo.display) {
-           // plugin type has been changed but we already have a valid display
-           // so update it for the recent plugin mode
-           if (mXEmbed || !windowed) {
-               // Use default GTK display for XEmbed and windowless plugins
-               mWsInfo.display = DefaultXDisplay();
-           }
-           else {
-               mWsInfo.display = xt_client_get_display();
-           }
+            // plugin type has been changed but we already have a valid display
+            // so update it for the recent plugin mode
+#ifdef MOZ_ENABLE_NPAPI_GTK2
+            if (!mXEmbed && windowed) {
+                mWsInfo.display = xt_client_get_display();
+            } else
+#endif
+            {
+                // Use default GTK display for XEmbed and windowless plugins.
+                mWsInfo.display = DefaultXDisplay();
+            }
        }
 #endif
        mWindow.type = newWindowType;
@@ -1214,12 +1223,18 @@ bool PluginInstanceChild::CreateWindow(const NPRemoteWindow& aWindow)
    if (mXEmbed) {
        mWindow.window = reinterpret_cast<void*>(aWindow.window);
    }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        Window browserSocket = (Window)(aWindow.window);
        xt_client_init(&mXtClient, mWsInfo.visual, mWsInfo.colormap, mWsInfo.depth);
        xt_client_create(&mXtClient, browserSocket, mWindow.width, mWindow.height); 
        mWindow.window = (void *)XtWindow(mXtClient.child_widget);
-    }  
+    }
+#else
+    else {
+        mWindow.window = reinterpret_cast<void*>(aWindow.window);
+    }
+#endif
 #else
    mWindow.window = reinterpret_cast<void*>(aWindow.window);
 #endif
@@ -1239,7 +1254,7 @@ void PluginInstanceChild::DeleteWindow()
  if (!mWindow.window)
      return;

-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
  if (mXtClient.top_widget) {     
      xt_client_unrealize(&mXtClient);
      xt_client_destroy(&mXtClient); 
@@ -1321,7 +1336,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
        CreateWindow(aWindow);
    }

-#ifdef MOZ_WIDGET_GTK
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    if (mXEmbed && gtk_check_version(2,18,7) != nullptr) { // older
        if (aWindow.type == NPWindowTypeWindow) {
            GdkWindow* socket_window = gdk_window_lookup(static_cast<GdkNativeWindow>(aWindow.window));
@@ -1456,19 +1471,27 @@ PluginInstanceChild::Initialize()
    if (mWindow.type == NPWindowTypeWindow) {
        AnswerNPP_GetValue_NPPVpluginNeedsXEmbed(&mXEmbed, &rv);

+#ifdef MOZ_ENABLE_NPAPI_GTK2
        // Set up Xt loop for windowed plugins without XEmbed support
        if (!mXEmbed) {
           xt_client_xloop_create();
        }
+#endif
    }

-    // Use default GTK display for XEmbed and windowless plugins
+    // Use default GTK display for XEmbed and windowless plugins.
    if (mXEmbed || mWindow.type != NPWindowTypeWindow) {
        mWsInfo.display = DefaultXDisplay();
    }
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    else {
        mWsInfo.display = xt_client_get_display();
    }
+#else
+    else {
+        mWsInfo.display = DefaultXDisplay();
+    }
+#endif
 #endif 

    return true;
@@ -4656,7 +4679,7 @@ PluginInstanceChild::Destroy()

    mPendingAsyncCalls.Clear();
    
-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
    if (mWindow.type == NPWindowTypeWindow && !mXEmbed) {
      xt_client_xloop_destroy();
    }
@@ -36,7 +36,7 @@

 #include <map>

-#ifdef MOZ_WIDGET_GTK
+#if defined(MOZ_WIDGET_GTK) && defined(MOZ_ENABLE_NPAPI_GTK2)
 #include "gtk2xtbin.h"
 #endif

@@ -462,6 +462,8 @@ private:
    NPSetWindowCallbackStruct mWsInfo;
 #ifdef MOZ_WIDGET_GTK
    bool mXEmbed;
+#endif
+#ifdef MOZ_ENABLE_NPAPI_GTK2
    XtClient mXtClient;
 #endif
 #elif defined(OS_WIN)
@@ -12,6 +12,9 @@

 #ifdef MOZ_WIDGET_GTK
 #include <gtk/gtk.h>
+#if (GTK_MAJOR_VERSION == 3)
+#include <gtk/gtkx.h>
+#endif
 #endif

 #include "nsIFile.h"
@@ -1101,7 +1104,11 @@ _getvalue(NPP aNPP,
                return InstCast(aNPP)->NPN_GetValue(aVariable, aValue);
            } 
            else {
+#ifdef MOZ_ENABLE_NPAPI_GTK2
                *(void **)aValue = xt_client_get_display();
+#else
+                *(void **)aValue = DefaultXDisplay();
+#endif
            }          
            return NPERR_NO_ERROR;
        }
@@ -143,11 +143,13 @@ LOCAL_INCLUDES += [

 DEFINES['FORCE_PR_LOG'] = True

-if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gtk3':
-    CXXFLAGS += CONFIG['TK_CFLAGS']
-else:
+if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk3' and
+        CONFIG['MOZ_ENABLE_NPAPI'] and
+        CONFIG['MOZ_ENABLE_NPAPI_GTK2']):
    # Force build against gtk+2 for struct offsets and such.
    CXXFLAGS += CONFIG['MOZ_GTK2_CFLAGS']
+else:
+    CXXFLAGS += CONFIG['TK_CFLAGS']

 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

@@ -1789,17 +1789,26 @@ URL::IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
  return URLWorker::IsValidURL(aGlobal, aURL, aRv);
 }

-bool
-URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
-              const Optional<nsAString>& aBase) {
+already_AddRefed<URL>
+URL::Parse(const GlobalObject& aGlobal, const nsAString& aURL,
+           const Optional<nsAString>& aBase)
+{
  ErrorResult rv;
  RefPtr<URL> parsed = URL::Constructor(aGlobal, aURL, aBase, rv);
  if (rv.Failed() || !parsed) {
    rv.SuppressException();
-    return false;
+    return nullptr;
  }

-  return true;
+  return parsed.forget();
+}
+
+bool
+URL::CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
+              const Optional<nsAString>& aBase)
+{
+  RefPtr<URL> parsed = URL::Parse(aGlobal, aURL, aBase);
+  return !!parsed;
 }

 already_AddRefed<URLSearchParams>
@@ -88,6 +88,10 @@ public:
  IsValidURL(const GlobalObject& aGlobal, const nsAString& aURL,
             ErrorResult& aRv);

+  static already_AddRefed<URL>
+  Parse(const GlobalObject& aGlobal, const nsAString& aURL,
+        const Optional<nsAString>& aBase);
+
  static bool
  CanParse(const GlobalObject& aGlobal, const nsAString& aURL,
           const Optional<nsAString>& aBase);
@@ -448,6 +448,34 @@
                !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
                "URL.canParse rejects root-relative input against opaque mailto: base",
            );
+            ok("parse" in URL, "URL.parse exists");
+            is(URL.parse.length, 1, "URL.parse has one required argument");
+            var parsed = URL.parse("/static/client/runtime.js", "x:/");
+            ok(parsed instanceof URL, "URL.parse returns a URL object on success");
+            is(parsed.href, "x:/static/client/runtime.js", "URL.parse resolves against a base");
+            is(URL.parse("/static/client/runtime.js"), null, "URL.parse returns null for invalid input");
+            is(
+                URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
+                null,
+                "URL.parse returns null for an invalid base/input combination",
+            );
+
+            var conversionOrder = [];
+            parsed = URL.parse(
+                { toString: function() { conversionOrder.push("url"); return "child"; } },
+                { toString: function() { conversionOrder.push("base"); return "https://example.com/root/"; } },
+            );
+            is(conversionOrder.join(","), "url,base", "URL.parse converts its arguments in order");
+            is(parsed.href, "https://example.com/root/child", "URL.parse uses converted arguments");
+
+            var sentinel = {};
+            var thrown;
+            try {
+                URL.parse({ toString: function() { throw sentinel; } });
+            } catch (e) {
+                thrown = e;
+            }
+            is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
            SimpleTest.doesThrow(() => {
                new URL("/static/client/runtime.js", "mailto:test@example.com");
            }, "constructor rejects root-relative input against opaque mailto: base");
@@ -301,6 +301,64 @@ onmessage = function () {
    !URL.canParse("/static/client/runtime.js", "mailto:test@example.com"),
    "URL.canParse rejects root-relative input against opaque mailto: base",
  );
+  ok("parse" in URL, "URL.parse exists");
+  is(URL.parse.length, 1, "URL.parse has one required argument");
+  let parsed = URL.parse("/static/client/runtime.js", "x:/");
+  ok(parsed instanceof URL, "URL.parse returns a URL object on success");
+  is(
+    parsed.href,
+    "x:/static/client/runtime.js",
+    "URL.parse resolves against a base",
+  );
+  is(
+    URL.parse("/static/client/runtime.js"),
+    null,
+    "URL.parse returns null for invalid input",
+  );
+  is(
+    URL.parse("/static/client/runtime.js", "mailto:test@example.com"),
+    null,
+    "URL.parse returns null for an invalid base/input combination",
+  );
+
+  const conversionOrder = [];
+  parsed = URL.parse(
+    {
+      toString() {
+        conversionOrder.push("url");
+        return "child";
+      },
+    },
+    {
+      toString() {
+        conversionOrder.push("base");
+        return "https://example.com/root/";
+      },
+    },
+  );
+  is(
+    conversionOrder.join(","),
+    "url,base",
+    "URL.parse converts its arguments in order",
+  );
+  is(
+    parsed.href,
+    "https://example.com/root/child",
+    "URL.parse uses converted arguments",
+  );
+
+  const sentinel = {};
+  let thrown;
+  try {
+    URL.parse({
+      toString() {
+        throw sentinel;
+      },
+    });
+  } catch (e) {
+    thrown = e;
+  }
+  is(thrown, sentinel, "URL.parse propagates argument conversion exceptions");
  let mailtoRelativeFailed = false;
  try {
    new URL("/static/client/runtime.js", "mailto:test@example.com");
@@ -25,6 +25,8 @@ interface CSSStyleSheet : StyleSheet {
  unsigned long insertRule(DOMString rule, optional unsigned long index = 0);
  [Throws, NeedsSubjectPrincipal]
  void deleteRule(unsigned long index);
+  [Throws]
+  void replaceSync(DOMString text);

  // Non-standard WebKit things, see https://github.com/w3c/csswg-drafts/pull/3900.
  [Throws, NeedsSubjectPrincipal, BinaryName="cssRules"]
@@ -18,6 +18,8 @@ interface mixin DocumentOrShadowRoot {

  readonly attribute Element? activeElement;
  readonly attribute StyleSheetList styleSheets;
+  [Throws]
+  attribute object adoptedStyleSheets;

  readonly attribute Element? pointerLockElement;
  [LenientSetter, Func="nsDocument::IsUnprefixedFullscreenEnabled"]
@@ -23,6 +23,7 @@ interface URL {
  [Throws]
  stringifier;
  
+  static URL? parse(USVString url, optional USVString base);
  static boolean canParse(USVString url, optional USVString base);

  [Throws]
@@ -1117,6 +1117,7 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                        kCGImageAlphaOnly :
                        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host;

+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
  mCG = CGBitmapContextCreateWithData(mCanvasData,
                                      mCGSize.width,
                                      mCGSize.height,
@@ -1126,6 +1127,15 @@ DrawTargetSkia::BorrowCGContext(const DrawOptions &aOptions)
                                      bitmapInfo,
                                      NULL, /* Callback when released */
                                      NULL);
+#else
+  mCG = CGBitmapContextCreate(mCanvasData,
+                              mCGSize.width,
+                              mCGSize.height,
+                              8, /* bits per component */
+                              stride,
+                              mColorSpace,
+                              bitmapInfo);
+#endif
  if (!mCG) {
    ReleaseBits(mCanvasData);
    NS_WARNING("Could not create bitmap around skia data\n");
@@ -115,7 +115,7 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
  return ScaledFontBase::GetPathForGlyphs(aBuffer, aTarget);
 }

-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
 void
 ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
 {
@@ -32,7 +32,7 @@ public:
  virtual SkTypeface* GetSkTypeface();
 #endif
  virtual already_AddRefed<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-#if !defined(MAC_OS_X_VERSION_10_7) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
+#ifndef USE_SKIA
  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
 #endif
  virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);
@@ -632,9 +632,13 @@ NVImage::GetAsSourceSurface()

  // Convert the current NV12 or NV21 data to YUV420P so that we can follow the
  // logics in PlanarYCbCrImage::GetAsSourceSurface().
-  const int bufferLength = mData.mYSize.height * mData.mYStride +
-                           mData.mCbCrSize.height * mData.mCbCrSize.width * 2;
-  uint8_t* buffer = new uint8_t[bufferLength];
+  auto bufferLength = CheckedInt<uint32_t>(mData.mYSize.height) * mData.mYStride +
+                      CheckedInt<uint32_t>(mData.mCbCrSize.height) * mData.mCbCrSize.width * 2;
+  if (!bufferLength.isValid()) {
+    NS_ERROR("Image buffer length exceeds integer limits.");
+    return nullptr;
+  }
+  uint8_t* buffer = new uint8_t[bufferLength.value()];

  Data aData = mData;
  aData.mCbCrStride = aData.mCbCrSize.width;
@@ -24,15 +24,21 @@
 *  Skia's 32bit backend only supports 1 sizzle order at a time (compile-time).
 *  This is specified by 4 defines SK_A32_SHIFT, SK_R32_SHIFT, ... for G and B.
 *
- *  For easier compatibility with Skia's GPU backend, we further restrict these
- *  to either (in memory-byte-order) RGBA or BGRA. Note that this "order" does
- *  not directly correspond to the same shift-order, since we have to take endianess
- *  into account.
+ *  For easier compatibility with Skia's GPU backend, Skia normally restricts
+ *  these to either (in memory-byte-order) RGBA or BGRA. Mozilla's big-endian
+ *  PowerPC port uses CoreGraphics' native ARGB pixels, so we also accept ARGB.
+ *  Note that this "order" does not directly correspond to the same shift-order,
+ *  since we have to take endianess into account.
 *
 *  Here we enforce this constraint.
 */

 #ifdef SK_CPU_BENDIAN
+    #define SK_ARGB_A32_SHIFT   24
+    #define SK_ARGB_R32_SHIFT   16
+    #define SK_ARGB_G32_SHIFT   8
+    #define SK_ARGB_B32_SHIFT   0
+
    #define SK_RGBA_R32_SHIFT   24
    #define SK_RGBA_G32_SHIFT   16
    #define SK_RGBA_B32_SHIFT   8
@@ -43,6 +49,11 @@
    #define SK_BGRA_R32_SHIFT   8
    #define SK_BGRA_A32_SHIFT   0
 #else
+    #define SK_ARGB_A32_SHIFT   0
+    #define SK_ARGB_R32_SHIFT   8
+    #define SK_ARGB_G32_SHIFT   16
+    #define SK_ARGB_B32_SHIFT   24
+
    #define SK_RGBA_R32_SHIFT   0
    #define SK_RGBA_G32_SHIFT   8
    #define SK_RGBA_B32_SHIFT   16
@@ -54,10 +65,18 @@
    #define SK_BGRA_A32_SHIFT   24
 #endif

-#if defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)
-    #error "can't define PMCOLOR to be RGBA and BGRA"
+#if (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_BGRA)) || \
+    (defined(SK_PMCOLOR_IS_RGBA) && defined(SK_PMCOLOR_IS_ARGB)) || \
+    (defined(SK_PMCOLOR_IS_BGRA) && defined(SK_PMCOLOR_IS_ARGB))
+    #error "can't define PMCOLOR to more than one byte order"
 #endif

+#define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB  \
+    (SK_A32_SHIFT == SK_ARGB_A32_SHIFT &&    \
+     SK_R32_SHIFT == SK_ARGB_R32_SHIFT &&    \
+     SK_G32_SHIFT == SK_ARGB_G32_SHIFT &&    \
+     SK_B32_SHIFT == SK_ARGB_B32_SHIFT)
+
 #define LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA  \
    (SK_A32_SHIFT == SK_RGBA_A32_SHIFT &&    \
     SK_R32_SHIFT == SK_RGBA_R32_SHIFT &&    \
@@ -76,6 +95,10 @@
 #define SK_G_INDEX  (SK_G32_SHIFT/8)
 #define SK_B_INDEX  (SK_B32_SHIFT/8)

+#if defined(SK_PMCOLOR_IS_ARGB) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+    #error "SK_PMCOLOR_IS_ARGB does not match SK_*32_SHIFT values"
+#endif
+
 #if defined(SK_PMCOLOR_IS_RGBA) && !LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
    #error "SK_PMCOLOR_IS_RGBA does not match SK_*32_SHIFT values"
 #endif
@@ -84,19 +107,22 @@
    #error "SK_PMCOLOR_IS_BGRA does not match SK_*32_SHIFT values"
 #endif

-#if !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
+#if !defined(SK_PMCOLOR_IS_ARGB) && !defined(SK_PMCOLOR_IS_RGBA) && !defined(SK_PMCOLOR_IS_BGRA)
    // deduce which to define from the _SHIFT defines

-    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
+    #if LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
+        #define SK_PMCOLOR_IS_ARGB
+    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
        #define SK_PMCOLOR_IS_RGBA
    #elif LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA
        #define SK_PMCOLOR_IS_BGRA
    #else
-        #error "need 32bit packing to be either RGBA or BGRA"
+        #error "need 32bit packing to be either ARGB, RGBA, or BGRA"
    #endif
 #endif

 // hide these now that we're done
+#undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_ARGB
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_RGBA
 #undef LOCAL_PMCOLOR_SHIFTS_EQUIVALENT_TO_BGRA

@@ -131,19 +157,38 @@ static inline uint32_t SkPackARGB_as_BGRA(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
           (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
 }

+static inline SkPMColor SkPackARGB_as_PMColor(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
+    SkASSERT_IS_BYTE(a);
+    SkASSERT_IS_BYTE(r);
+    SkASSERT_IS_BYTE(g);
+    SkASSERT_IS_BYTE(b);
+    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
+           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+}
+
 static inline SkPMColor SkSwizzle_RGBA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_RGBA
    return c;
-#else
+#elif defined(SK_PMCOLOR_IS_BGRA)
    return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_RGBA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_RGBA_B32_SHIFT) & 0xFF);
 #endif
 }

 static inline SkPMColor SkSwizzle_BGRA_to_PMColor(uint32_t c) {
 #ifdef SK_PMCOLOR_IS_BGRA
    return c;
-#else
+#elif defined(SK_PMCOLOR_IS_RGBA)
    return SkSwizzle_RB(c);
+#else
+    return SkPackARGB_as_PMColor((c >> SK_BGRA_A32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_R32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_G32_SHIFT) & 0xFF,
+                                 (c >> SK_BGRA_B32_SHIFT) & 0xFF);
 #endif
 }

@@ -412,8 +457,7 @@ static inline SkPMColor SkPackARGB32(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
    SkASSERT(g <= a);
    SkASSERT(b <= a);

-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }

 static inline uint32_t SkPackPMColor_as_RGBA(SkPMColor c) {
@@ -547,8 +591,7 @@ static inline SkPMColor SkFastFourByteInterp(SkPMColor src,
 *  values are premultiplied in the debug version.
 */
 static inline SkPMColor SkPackARGB32NoCheck(U8CPU a, U8CPU r, U8CPU g, U8CPU b) {
-    return (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
-           (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
+    return SkPackARGB_as_PMColor(a, r, g, b);
 }

 static inline
@@ -82,8 +82,13 @@ enum SkColorType {
    kN32_SkColorType = kBGRA_8888_SkColorType,
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    kN32_SkColorType = kRGBA_8888_SkColorType,
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Big-endian PowerPC Mozilla surfaces use native uint32 ARGB memory.
+    // Moz2D's legacy A8R8G8B8_UINT32 format aliases to B8G8R8A8, so keep
+    // kN32 on Skia's BGRA path while the channel shifts above describe ARGB.
+    kN32_SkColorType = kBGRA_8888_SkColorType,
 #else
-    #error "SK_*32_SHFIT values must correspond to BGRA or RGBA byte order"
+    #error "SK_*32_SHIFT values must correspond to BGRA, RGBA, or Mozilla ARGB byte order"
 #endif
 };

@@ -275,17 +275,19 @@ enum GrPixelConfig {
 static const int kGrPixelConfigCnt = kLast_GrPixelConfig + 1;

 // Aliases for pixel configs that match skia's byte order.
-#ifndef SK_CPU_LENDIAN
-    #error "Skia gpu currently assumes little endian"
-#endif
 #if SK_PMCOLOR_BYTE_ORDER(B,G,R,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #elif SK_PMCOLOR_BYTE_ORDER(R,G,B,A)
    static const GrPixelConfig kSkia8888_GrPixelConfig = kRGBA_8888_GrPixelConfig;
    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSRGBA_8888_GrPixelConfig;
+#elif defined(MOZ_SKIA) && SK_PMCOLOR_BYTE_ORDER(A,R,G,B)
+    // Mozilla's big-endian PowerPC path stores native 32-bit pixels as ARGB,
+    // while Moz2D routes those surfaces through Skia's BGRA color type.
+    static const GrPixelConfig kSkia8888_GrPixelConfig = kBGRA_8888_GrPixelConfig;
+    static const GrPixelConfig kSkiaGamma8888_GrPixelConfig = kSBGRA_8888_GrPixelConfig;
 #else
-    #error "SK_*32_SHIFT values must correspond to GL_BGRA or GL_RGBA format."
+    #error "SK_*32_SHIFT values must correspond to GL_BGRA, GL_RGBA, or Mozilla ARGB format."
 #endif

 // Returns true if the pixel config is a GPU-specific compressed format
@@ -306,7 +306,11 @@ static inline SkPMColor premultiply_argb_as_bgra(U8CPU a, U8CPU r, U8CPU g, U8CP
        b = SkMulDiv255Round(b, a);
    }

+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(a, r, g, b);
+#else
    return SkPackARGB_as_BGRA(a, r, g, b);
+#endif
 }

 static inline bool is_rgba(SkColorType colorType) {
@@ -51,10 +51,16 @@ struct SkPM4f {
    Sk4f to4f_pmorder() const { return swizzle_rb_if_bgra(this->to4f()); }

    SkPMColor toPMColor() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+        Sk4f value = this->to4f();
+        Sk4b bytes = SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f));
+        return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
        Sk4f value = swizzle_rb_if_bgra(this->to4f());
        SkPMColor result;
        SkNx_cast<uint8_t>(value * Sk4f(255) + Sk4f(0.5f)).store(&result);
        return result;
+#endif
    }

    void toF16(uint16_t[4]) const;
@@ -22,29 +22,50 @@ static inline float get_alpha(const Sk4f& px) {


 static inline Sk4f Sk4f_fromL32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk4f(SkGetPackedR32(px), SkGetPackedG32(px),
+                SkGetPackedB32(px), SkGetPackedA32(px)) * (1/255.0f);
+#else
    return SkNx_cast<float>(Sk4b::Load(&px)) * (1/255.0f);
+#endif
 }

 static inline Sk4f Sk4f_fromS32(uint32_t px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return { sk_linear_from_srgb[SkGetPackedR32(px)],
+             sk_linear_from_srgb[SkGetPackedG32(px)],
+             sk_linear_from_srgb[SkGetPackedB32(px)],
+                    (1/255.0f) * SkGetPackedA32(px) };
+#else
    return { sk_linear_from_srgb[(px >>  0) & 0xff],
             sk_linear_from_srgb[(px >>  8) & 0xff],
             sk_linear_from_srgb[(px >> 16) & 0xff],
                    (1/255.0f) * (px >> 24)          };
+#endif
 }

 static inline uint32_t Sk4f_toL32(const Sk4f& px) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    Sk4b bytes = SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f));
+    return SkPackARGB_as_PMColor(bytes[3], bytes[0], bytes[1], bytes[2]);
+#else
    uint32_t l32;
    SkNx_cast<uint8_t>(Sk4f_round(px * 255.0f)).store(&l32);
    return l32;
+#endif
 }

 static inline uint32_t Sk4f_toS32(const Sk4f& px) {
    Sk4i  rgb = sk_linear_to_srgb(px),
         srgb = { rgb[0], rgb[1], rgb[2], (int)(255.0f * px[3] + 0.5f) };

+#ifdef SK_PMCOLOR_IS_ARGB
+    return SkPackARGB_as_PMColor(srgb[3], srgb[0], srgb[1], srgb[2]);
+#else
    uint32_t s32;
    SkNx_cast<uint8_t>(srgb).store(&s32);
    return s32;
+#endif
 }


@@ -121,9 +121,10 @@ SkDEBUGCODE(static const unsigned kRunRecordMagic = 0xb10bcafe;)
 namespace {
 struct RunRecordStorageEquivalent {
    RunFont  fFont;
-    SkPoint  fOffset;
    uint32_t fCount;
-    uint32_t fFlags;
+    SkPoint  fOffset;
+    SkTextBlob::GlyphPositioning fPositioning;
+    bool     fExtended;
    SkDEBUGCODE(unsigned fMagic;)
 };
 }
@@ -44,6 +44,25 @@ static Sk4x4f load_4_srgb(const void* vptr) {

    Sk4x4f rgba;

+#ifdef SK_PMCOLOR_IS_ARGB
+    rgba.r = { sk_linear_from_srgb[SkGetPackedR32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedR32(ptr[3])] };
+
+    rgba.g = { sk_linear_from_srgb[SkGetPackedG32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedG32(ptr[3])] };
+
+    rgba.b = { sk_linear_from_srgb[SkGetPackedB32(ptr[0])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[1])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[2])],
+               sk_linear_from_srgb[SkGetPackedB32(ptr[3])] };
+
+    rgba.a = SkNx_cast<float>(Sk4i(SkGetPackedA32(ptr[0]), SkGetPackedA32(ptr[1]),
+                                   SkGetPackedA32(ptr[2]), SkGetPackedA32(ptr[3]))) * (1/255.0f);
+#else
    rgba.r = { sk_linear_from_srgb[(ptr[0] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[1] >>  0) & 0xff],
               sk_linear_from_srgb[(ptr[2] >>  0) & 0xff],
@@ -60,15 +79,28 @@ static Sk4x4f load_4_srgb(const void* vptr) {
               sk_linear_from_srgb[(ptr[3] >> 16) & 0xff] };

    rgba.a = SkNx_cast<float>((Sk4i::Load(ptr) >> 24) & 0xff) * (1/255.0f);
+#endif

    return rgba;
 }

 static void store_4_srgb(void* ptr, const Sk4x4f& p) {
+#ifdef SK_PMCOLOR_IS_ARGB
+    uint32_t* dst = (uint32_t*)ptr;
+    Sk4i r = sk_linear_to_srgb(p.r);
+    Sk4i g = sk_linear_to_srgb(p.g);
+    Sk4i b = sk_linear_to_srgb(p.b);
+    Sk4i a = Sk4f_round(255.0f*p.a);
+    dst[0] = SkPackARGB_as_PMColor(a[0], r[0], g[0], b[0]);
+    dst[1] = SkPackARGB_as_PMColor(a[1], r[1], g[1], b[1]);
+    dst[2] = SkPackARGB_as_PMColor(a[2], r[2], g[2], b[2]);
+    dst[3] = SkPackARGB_as_PMColor(a[3], r[3], g[3], b[3]);
+#else
    ( sk_linear_to_srgb(p.r) <<  0
    | sk_linear_to_srgb(p.g) <<  8
    | sk_linear_to_srgb(p.b) << 16
    | Sk4f_round(255.0f*p.a) << 24).store(ptr);
+#endif
 }

 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -391,7 +423,7 @@ SkXfermode::D32Proc SkXfermode::GetD32Proc(SkXfermode* xfer, uint32_t flags) {
 #include "SkColorPriv.h"

 static Sk4f lcd16_to_unit_4f(uint16_t rgb) {
-#ifdef SK_PMCOLOR_IS_RGBA
+#if defined(SK_PMCOLOR_IS_RGBA) || defined(SK_PMCOLOR_IS_ARGB)
    Sk4i rgbi = Sk4i(SkGetPackedR16(rgb), SkGetPackedG16(rgb), SkGetPackedB16(rgb), 0);
 #else
    Sk4i rgbi = Sk4i(SkGetPackedB16(rgb), SkGetPackedG16(rgb), SkGetPackedR16(rgb), 0);
@@ -251,7 +251,7 @@ bool GrDrawTarget::drawBatches(GrBatchFlushState* flushState) {
            if (currentRT) {
                static const GrGpuCommandBuffer::LoadAndStoreInfo kBasicLoadStoreInfo
                    { GrGpuCommandBuffer::LoadOp::kLoad,GrGpuCommandBuffer::StoreOp::kStore,
-                      GrColor_ILLEGAL };
+                      static_cast<GrColor>(GrColor_ILLEGAL) };
                commandBuffer.reset(fGpu->createCommandBuffer(currentRT,
                                                              kBasicLoadStoreInfo,   // Color
                                                              kBasicLoadStoreInfo)); // Stencil
@@ -69,11 +69,18 @@ inline Sk4px Sk4px::Wide::div255() const {
 }

 inline Sk4px Sk4px::alphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], (*this)[ 0], (*this)[ 0], (*this)[ 0],
+                 (*this)[ 4], (*this)[ 4], (*this)[ 4], (*this)[ 4],
+                 (*this)[ 8], (*this)[ 8], (*this)[ 8], (*this)[ 8],
+                 (*this)[12], (*this)[12], (*this)[12], (*this)[12]);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 3], (*this)[ 3], (*this)[ 3], (*this)[ 3],
                 (*this)[ 7], (*this)[ 7], (*this)[ 7], (*this)[ 7],
                 (*this)[11], (*this)[11], (*this)[11], (*this)[11],
                 (*this)[15], (*this)[15], (*this)[15], (*this)[15]);
+#endif
 }

 inline Sk4px Sk4px::Load4Alphas(const SkAlpha a[4]) {
@@ -91,19 +98,33 @@ inline Sk4px Sk4px::Load2Alphas(const SkAlpha a[2]) {
 }

 inline Sk4px Sk4px::zeroAlphas() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b(0, (*this)[ 1], (*this)[ 2], (*this)[ 3],
+                 0, (*this)[ 5], (*this)[ 6], (*this)[ 7],
+                 0, (*this)[ 9], (*this)[10], (*this)[11],
+                 0, (*this)[13], (*this)[14], (*this)[15]);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b((*this)[ 0], (*this)[ 1], (*this)[ 2], 0,
                 (*this)[ 4], (*this)[ 5], (*this)[ 6], 0,
                 (*this)[ 8], (*this)[ 9], (*this)[10], 0,
                 (*this)[12], (*this)[13], (*this)[14], 0);
+#endif
 }

 inline Sk4px Sk4px::zeroColors() const {
+#ifdef SK_PMCOLOR_IS_ARGB
+    return Sk16b((*this)[ 0], 0,0,0,
+                 (*this)[ 4], 0,0,0,
+                 (*this)[ 8], 0,0,0,
+                 (*this)[12], 0,0,0);
+#else
    static_assert(SK_A32_SHIFT == 24, "This method assumes little-endian.");
    return Sk16b(0,0,0, (*this)[ 3],
                 0,0,0, (*this)[ 7],
                 0,0,0, (*this)[11],
                 0,0,0, (*this)[15]);
+#endif
 }

 }  // namespace
@@ -72,6 +72,10 @@ static void color_cube_filter_span(const SkPMColor src[],
        // color is BGRA (SkColor order), dst is SkPMColor order, so may need to swap R+B.
    #if defined(SK_PMCOLOR_IS_RGBA)
        color = SkNx_shuffle<2,1,0,3>(color);
+    #elif defined(SK_PMCOLOR_IS_ARGB)
+        Sk4b bytes = SkNx_cast<uint8_t>(color);
+        dst[i] = SkPackARGB32NoCheck(a, bytes[2], bytes[1], bytes[0]);
+        continue;
    #endif
        uint8_t* dstBytes = (uint8_t*)(dst+i);
        SkNx_cast<uint8_t>(color).store(dstBytes);
@@ -73,7 +73,39 @@ static CFArrayRef SkCTFontManagerCopyAvailableFontFamilyNames() {
 #ifdef SK_BUILD_FOR_IOS
    return CFArrayCreate(nullptr, nullptr, 0, nullptr);
 #else
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    return CTFontManagerCopyAvailableFontFamilyNames();
+#else
+    CFMutableArrayRef familyNames =
+            CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+    if (!familyNames) {
+        return nullptr;
+    }
+
+    ATSFontFamilyIterator iterator;
+    OSStatus status = ATSFontFamilyIteratorCreate(kATSFontContextGlobal,
+                                                  nullptr,
+                                                  nullptr,
+                                                  kATSOptionFlagsDefaultScope,
+                                                  &iterator);
+    if (status != noErr) {
+        CFRelease(familyNames);
+        return nullptr;
+    }
+
+    ATSFontFamilyRef family;
+    while (ATSFontFamilyIteratorNext(iterator, &family) == noErr) {
+        CFStringRef familyName = nullptr;
+        if (ATSFontFamilyGetName(family, kATSOptionFlagsDefault, &familyName) == noErr &&
+            familyName) {
+            CFArrayAppendValue(familyNames, familyName);
+            CFRelease(familyName);
+        }
+    }
+
+    ATSFontFamilyIteratorRelease(&iterator);
+    return familyNames;
+#endif
 #endif
 }

@@ -908,6 +940,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&

        // Skia handles quantization and subpixel positioning,
        // so disable quantization and enabe subpixel positioning in CG.
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
        CGContextSetAllowsFontSubpixelQuantization(fCG, false);
        CGContextSetShouldSubpixelQuantizeFonts(fCG, false);

@@ -916,6 +949,7 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
        // then CG cannot draw the glyph in the correct location without subpixel positioning.
        CGContextSetAllowsFontSubpixelPositioning(fCG, true);
        CGContextSetShouldSubpixelPositionFonts(fCG, true);
+#endif

        CGContextSetTextDrawingMode(fCG, kCGTextFill);

@@ -971,7 +1005,13 @@ CGRGBPixel* Offscreen::getCG(const SkScalerContext_Mac& context, const SkGlyph&
    // So always make the font transform identity and place the transform on the context.
    point = CGPointApplyAffineTransform(point, context.fInvTransform);

+#if defined(MAC_OS_X_VERSION_10_7) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_7)
    CTFontDrawGlyphs(context.fCTFont, &glyphID, &point, 1, fCG);
+#else
+    CGContextSetFont(fCG, CTFontCopyGraphicsFont(context.fCTFont, NULL));
+    CGContextSetFontSize(fCG, CTFontGetSize(context.fCTFont));
+    CGContextShowGlyphsAtPositions(fCG, &glyphID, &point, 1);
+#endif

    SkASSERT(rowBytesPtr);
    *rowBytesPtr = rowBytes;
@@ -1682,6 +1722,7 @@ SkAdvancedTypefaceMetrics* SkTypeface_Mac::onGetAdvancedTypefaceMetrics(

 static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
    CTFontRef ctFont = typeface->fFontRef.get();
+#if defined(MAC_OS_X_VERSION_10_6) && (MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6)
    AutoCFRelease<CFNumberRef> fontFormatRef(
            static_cast<CFNumberRef>(CTFontCopyAttribute(ctFont, kCTFontFormatAttribute)));
    if (!fontFormatRef) {
@@ -1711,6 +1752,35 @@ static SK_SFNT_ULONG get_font_type_tag(const SkTypeface_Mac* typeface) {
            //Just the presence of the FontForge 'FFTM' table seems to throw it off.
            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
    }
+#else
+    AutoCFRelease<CFStringRef> postScriptName(CTFontCopyPostScriptName(ctFont));
+    if (!postScriptName) {
+        return 0;
+    }
+
+    ATSFontRef atsFont =
+            ATSFontFindFromPostScriptName(postScriptName, kATSOptionFlagsDefault);
+    if (atsFont == kInvalidFont) {
+        return 0;
+    }
+
+    SkSFNTHeader header;
+    ByteCount headerSize = sizeof(header);
+    if (ATSFontGetTableDirectory(atsFont, headerSize, &header, &headerSize) != noErr ||
+        headerSize < sizeof(header.fontType)) {
+        return 0;
+    }
+
+    switch (header.fontType) {
+        case SkSFNTHeader::fontType_OpenTypeCFF::TAG:
+        case SkSFNTHeader::fontType_WindowsTrueType::TAG:
+        case SkSFNTHeader::fontType_MacTrueType::TAG:
+        case SkSFNTHeader::fontType_PostScript::TAG:
+            return header.fontType;
+        default:
+            return SkSFNTHeader::fontType_WindowsTrueType::TAG;
+    }
+#endif
 }

 SkStreamAsset* SkTypeface_Mac::onOpenStream(int* ttcIndex) const {
@@ -587,8 +587,9 @@ gfxFontUtils::MapCharToGlyphFormat4(const uint8_t* aBuf, uint32_t aLength,
    const AutoSwap_PRUint16* idDelta = &startCodes[segCount];
    const AutoSwap_PRUint16* idRangeOffset = &idDelta[segCount];

-    // Sanity-check that the fixed-size arrays don't exceed the buffer.
-    const uint8_t* const limit = aBuf + aLength;
+    // Sanity-check that the fixed-size arrays don't exceed the buffer or the
+    // current subtable.
+    const uint8_t* const limit = aBuf + std::min(aLength, uint32_t(cmap4->length));
    if ((const uint8_t*)(&idRangeOffset[segCount]) > limit) {
        return 0; // broken font, just bail out safely
    }
@@ -336,7 +336,20 @@ gfxGraphiteShaper::SetGlyphsFromSegment(DrawTarget      *aDrawTarget,
            // not a one-to-one mapping with simple metrics: use DetailedGlyph
            AutoTArray<gfxShapedText::DetailedGlyph,8> details;
            float clusterLoc;
-            for (uint32_t j = c.baseGlyph; j < c.baseGlyph + c.nGlyphs; ++j) {
+
+            uint32_t glyph_start = c.baseGlyph;
+            uint32_t glyph_end = glyph_start + c.nGlyphs;
+            if (glyph_end < glyph_start) {
+                return NS_ERROR_ILLEGAL_VALUE;
+            }
+            if (glyph_end - glyph_start > 0xFFFF) {
+                return NS_ERROR_ILLEGAL_VALUE;
+            }
+            if (!details.SetCapacity(glyph_end - glyph_start, fallible)) {
+                return NS_ERROR_OUT_OF_MEMORY;
+            }
+
+            for (uint32_t j = glyph_start; j < glyph_end; ++j) {
                gfxShapedText::DetailedGlyph* d = details.AppendElement();
                d->mGlyphID = gids[j];
                d->mYOffset = roundY ? NSToIntRound(-yLocs[j]) * dev2appUnits :
@@ -231,11 +231,13 @@ gfxTextRun::ComputeLigatureData(Range aPartRange,
    LigatureData result;
    const CompressedGlyph *charGlyphs = mCharacterGlyphs;

-    uint32_t i;
-    for (i = aPartRange.start; !charGlyphs[i].IsLigatureGroupStart(); --i) {
-        NS_ASSERTION(i > 0, "Ligature at the start of the run??");
+    uint32_t i = aPartRange.start;
+    while (i && !charGlyphs[i].IsLigatureGroupStart()) {
+        --i;
    }
+    NS_ASSERTION(charGlyphs[i].IsLigatureGroupStart(), "Ligature at run start?");
    result.mRange.start = i;
+
    for (i = aPartRange.start + 1;
         i < GetLength() && !charGlyphs[i].IsLigatureGroupStart(); ++i) {
    }
@@ -1704,21 +1706,27 @@ gfxFontGroup::GetFontAt(int32_t i, uint32_t aCh)

    RefPtr<gfxFont> font = ff.Font();
    if (!font) {
-        gfxFontEntry* fe = mFonts[i].FontEntry();
-        gfxCharacterMap* unicodeRangeMap = nullptr;
+        RefPtr<gfxFontEntry> fe = ff.FontEntry();
+        if (!fe) {
+            return nullptr;
+        }
+        RefPtr<gfxCharacterMap> unicodeRangeMap;
        if (fe->mIsUserFontContainer) {
-            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe);
+            // This raw pointer is OK because fe holds a strong ref to the object.
+            gfxUserFontEntry* ufe = static_cast<gfxUserFontEntry*>(fe.get());
            if (ufe->LoadState() == gfxUserFontEntry::STATUS_NOT_LOADED &&
                ufe->CharacterInUnicodeRange(aCh) &&
                !FontLoadingForFamily(ff.Family(), aCh)) {
                ufe->Load();
                ff.CheckState(mSkipDrawing);
            }
+            unicodeRangeMap = ufe->GetUnicodeRangeMap();
+            // Update fe to refer to the actual platform font entry, rather than the
+            // webfont wrapper. After this, we no longer have a strong ref to ufe.
            fe = ufe->GetPlatformFontEntry();
            if (!fe) {
                return nullptr;
            }
-            unicodeRangeMap = ufe->GetUnicodeRangeMap();
        }
        font = fe->FindOrMakeFont(&mStyle, mFonts[i].NeedsBold(),
                                  unicodeRangeMap);
@@ -2753,7 +2761,7 @@ gfxFontGroup::FindFontForChar(uint32_t aCh, uint32_t aPrevCh, uint32_t aNextCh,
                    ufe->Load();
                    ff.CheckState(mSkipDrawing);
                }
-                gfxFontEntry* pfe = ufe->GetPlatformFontEntry();
+                RefPtr<gfxFontEntry> pfe = ufe->GetPlatformFontEntry();
                if (pfe && pfe->HasCharacter(aCh)) {
                    font = GetFontAt(i, aCh);
                    if (font) {
@@ -44,7 +44,8 @@ class ExpandingMemoryStream : public ots::OTSStream {
 public:
    ExpandingMemoryStream(size_t initial, size_t limit)
        : mLength(initial), mLimit(limit), mOff(0) {
-        mPtr = moz_xmalloc(mLength);
+        mPtr = moz_xmalloc(initial);
+        std::memset(mPtr, 0, initial);
    }

    ~ExpandingMemoryStream() {
@@ -74,6 +75,7 @@ public:
                newLength = mLimit;
            }
            mPtr = moz_xrealloc(mPtr, newLength);
+            std::memset(static_cast<char*>(mPtr) + mLength, 0, newLength - mLength);
            mLength = newLength;
            return WriteRaw(data, length);
        }
@@ -1637,10 +1637,13 @@ RasterImage::NotifyDecodeComplete(const DecoderFinalStatus& aStatus,

  if (!(aDecoderFlags & DecoderFlags::FIRST_FRAME_ONLY) &&
      mHasBeenDecoded && mAnimationState) {
-    // We've finished a full decode of all animation frames and our AnimationState
-    // has been notified about them all, so let it know not to expect anymore.
-    mAnimationState->NotifyDecodeComplete();
-    mAnimationState->UpdateState(mAnimationFinished, this, mSize);
+    // If we've successfully finished a full decode of all animation frames
+    // then let our animation state know it's complete and to not to expect
+    // any more frames.
+    if (aStatus.mFinished && !aStatus.mHadError) {
+      mAnimationState->NotifyDecodeComplete();
+      mAnimationState->UpdateState(mAnimationFinished, this, mSize);
+    }
  }

  // Only act on errors if we have no usable frames from the decoder.
@@ -238,16 +238,21 @@ static inline JS::Value PoisonedObjectValue(JSObject* obj);
 namespace detail {

 constexpr int CanonicalizedNaNSignBit = 0;
-#if defined(__mips__) && !defined(__mips_nan2008)
-constexpr uint64_t CanonicalizedNaNSignificand = 0x7FFFFFFFFFFFFULL;
-#else
 constexpr uint64_t CanonicalizedNaNSignificand = 0x8000000000000ULL;
-#endif

+// A legacy MIPS ABI can run on hardware whose native NaN encoding does not
+// match the encoding selected by the compiler. Determine the canonical NaN
+// from an actual floating-point operation during JS initialization.
+#if defined(__mips__) && !defined(__mips_nan2008) && \
+    !defined(__mips_nan_2008)
+# define JS_RUNTIME_CANONICAL_NAN
+extern JS_PUBLIC_DATA(uint64_t) CanonicalizedNaNBits;
+#else
 constexpr uint64_t CanonicalizedNaNBits =
    mozilla::SpecificNaNBits<double,
                             detail::CanonicalizedNaNSignBit,
                             detail::CanonicalizedNaNSignificand>::value;
+#endif

 } // namespace detail

@@ -260,8 +265,7 @@ constexpr uint64_t CanonicalizedNaNBits =
 static MOZ_ALWAYS_INLINE double
 GenericNaN()
 {
-  return mozilla::SpecificNaN<double>(detail::CanonicalizedNaNSignBit,
-                                      detail::CanonicalizedNaNSignificand);
+  return mozilla::BitwiseCast<double>(detail::CanonicalizedNaNBits);
 }

 /* MSVC with PGO miscompiles this function. */
@@ -355,6 +359,11 @@ class MOZ_NON_PARAM alignas(8) Value
    }

    void setDouble(double d) {
+#if defined(JS_RUNTIME_CANONICAL_NAN) && defined(JS_PUNBOX64)
+        // A non-canonical NaN can overlap the punbox64 tag space. Normalize
+        // it before storing it so it cannot be mistaken for a GC pointer.
+        d = CanonicalizeNaN(d);
+#endif
        // Don't assign to data.asDouble to fix a miscompilation with
        // GCC 5.2.1 and 5.3.1. See bug 1312488.
        data = layout(d);
@@ -8,8 +8,11 @@
 #include "mozilla/CheckedInt.h"
 #include "mozilla/TypeTraits.h"

+#include <algorithm>
+
 #include "jscntxt.h"

+#include "builtin/SelfHostingDefines.h"
 #include "irregexp/RegExpParser.h"
 #include "jit/InlinableNatives.h"
 #include "vm/RegExpStatics.h"
@@ -1754,7 +1757,9 @@ js::RegExpGetSubstitution(JSContext* cx, HandleArrayObject matchResult, HandleLi
    // Step 6.
    MOZ_ASSERT(position <= string->length());

-    uint32_t nCaptures = matchResultLength - 1;
+    // String substitutions can only reference $1 through $99.
+    uint32_t nCaptures = std::min<uint32_t>(matchResultLength - 1,
+                                            REGEXP_MAX_SUBSTITUTION_CAPTURES);
    Rooted<CapturesVector> captures(cx, CapturesVector(cx));
    if (!captures.reserve(nCaptures))
        return false;
@@ -463,6 +463,12 @@ function RegExpGetComplexReplacement(result, matched, S, position,
    // Step 14.k.i (reordered).
    _DefineDataProperty(captures, capturesLength++, matched);

+    // String substitutions can only reference $1 through $99. Keep getting and
+    // stringifying all captures because those operations are observable.
+    var storedCaptures = functionalReplace ?
+                           nCaptures :
+                           std_Math_min(nCaptures, REGEXP_MAX_SUBSTITUTION_CAPTURES);
+
    // Step 14.g, 14.i, 14.i.iv.
    for (var n = 1; n <= nCaptures; n++) {
        // Step 14.i.i.
@@ -473,7 +479,9 @@ function RegExpGetComplexReplacement(result, matched, S, position,
            capN = ToString(capN);

        // Step 14.i.iii.
-        _DefineDataProperty(captures, capturesLength++, capN);
+        if (n <= storedCaptures) {
+            _DefineDataProperty(captures, capturesLength++, capN);
+        }
    }

    // Step 14.j.
@@ -79,6 +79,8 @@

 #define REGEXP_FLAGS_SLOT 2

+#define REGEXP_MAX_SUBSTITUTION_CAPTURES 99
+
 #define REGEXP_IGNORECASE_FLAG  0x01
 #define REGEXP_GLOBAL_FLAG      0x02
 #define REGEXP_MULTILINE_FLAG   0x04
@@ -8185,7 +8185,7 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleT(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleT> || std::is_same_v<T, LFallibleStoreElementT>,
                  "emitStoreElementHoleT called with unexpected argument type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -8244,7 +8244,7 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 template <typename T> void
 CodeGenerator::emitStoreElementHoleV(T* lir)
 {
-    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
+    static_assert(std::is_same_v<T, LStoreElementHoleV> || std::is_same_v<T, LFallibleStoreElementV>,
                  "emitStoreElementHoleV called with unexpected parameter type");

    OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
@@ -494,6 +494,9 @@ OnLeaveBaselineFrame(JSContext* cx, const JitFrameIterator& frame, jsbytecode* p
 {
    BaselineFrame* baselineFrame = frame.baselineFrame();
    if (jit::DebugEpilogue(cx, baselineFrame, pc, frameOk)) {
+        if (!baselineFrame->hasReturnValue()) {
+            baselineFrame->setReturnValue(UndefinedValue());
+        }
        rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
        rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
        rfe->stackPointer = reinterpret_cast<uint8_t*>(baselineFrame);
@@ -902,8 +902,8 @@ class MacroAssembler : public MacroAssemblerSpecific

    inline void rotateLeft(Imm32 count, Register input, Register dest) PER_SHARED_ARCH;
    inline void rotateLeft(Register count, Register input, Register dest) PER_SHARED_ARCH;
-    inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
-    inline void rotateLeft64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
+    inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
+    inline void rotateLeft64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
    inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest, Register temp)
        DEFINED_ON(x86, x64, arm, mips32, mips64, loongarch64);
    inline void rotateLeft64(Register count, Register64 input, Register64 dest, Register temp)
@@ -911,8 +911,8 @@ class MacroAssembler : public MacroAssemblerSpecific

    inline void rotateRight(Imm32 count, Register input, Register dest) PER_SHARED_ARCH;
    inline void rotateRight(Register count, Register input, Register dest) PER_SHARED_ARCH;
-    inline void rotateRight64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
-    inline void rotateRight64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
+    inline void rotateRight64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
+    inline void rotateRight64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
    inline void rotateRight64(Imm32 count, Register64 input, Register64 dest, Register temp)
        DEFINED_ON(x86, x64, arm, mips32, mips64, loongarch64);
    inline void rotateRight64(Register count, Register64 input, Register64 dest, Register temp)
@@ -874,6 +874,13 @@ MacroAssembler::branchTestSymbol(Condition cond, Register tag, Label* label)
    ma_b(tag, ImmTag(JSVAL_TAG_SYMBOL), label, cond);
 }

+void
+MacroAssembler::branchTestBigInt(Condition cond, Register tag, Label* label)
+{
+    MOZ_ASSERT(cond == Equal || cond == NotEqual);
+    ma_b(tag, ImmTag(JSVAL_TAG_BIGINT), label, cond);
+}
+
 void
 MacroAssembler::branchTestSymbol(Condition cond, const BaseIndex& address, Label* label)
 {
@@ -614,6 +614,25 @@ CodeGeneratorMIPS64::visitExtendInt32ToInt64(LExtendInt32ToInt64* lir)
        masm.ma_sll(output, ToRegister(input), Imm32(0));
 }

+void
+CodeGeneratorMIPS64::visitSignExtendInt64(LSignExtendInt64* lir)
+{
+    Register64 input = ToRegister64(lir->getInt64Operand(0));
+    Register64 output = ToOutRegister64(lir);
+
+    switch (lir->mode()) {
+      case MSignExtendInt64::Byte:
+        masm.move8SignExtend(input.reg, output.reg);
+        break;
+      case MSignExtendInt64::Half:
+        masm.move16SignExtend(input.reg, output.reg);
+        break;
+      case MSignExtendInt64::Word:
+        masm.ma_sll(output.reg, input.reg, Imm32(0));
+        break;
+    }
+}
+
 void
 CodeGeneratorMIPS64::visitWrapInt64ToInt32(LWrapInt64ToInt32* lir)
 {
@@ -62,6 +62,7 @@ class CodeGeneratorMIPS64 : public CodeGeneratorMIPSShared
    void visitWasmReinterpretFromI64(LWasmReinterpretFromI64* lir);
    void visitWasmReinterpretToI64(LWasmReinterpretToI64* lir);
    void visitExtendInt32ToInt64(LExtendInt32ToInt64* lir);
+    void visitSignExtendInt64(LSignExtendInt64* lir);
    void visitWrapInt64ToInt32(LWrapInt64ToInt32* lir);
    void visitClzI64(LClzI64* lir);
    void visitCtzI64(LCtzI64* lir);
@@ -184,3 +184,9 @@ LIRGeneratorMIPS64::visitRandom(MRandom* ins)
                                        temp());
    defineFixed(lir, ins, LFloatReg(ReturnDoubleReg));
 }
+
+void
+LIRGeneratorMIPS64::visitSignExtendInt64(MSignExtendInt64* ins)
+{
+    defineInt64(new(alloc()) LSignExtendInt64(useInt64RegisterAtStart(ins->input())), ins);
+}
@@ -46,6 +46,7 @@ class LIRGeneratorMIPS64 : public LIRGeneratorMIPSShared
    void visitUnbox(MUnbox* unbox);
    void visitReturn(MReturn* ret);
    void visitRandom(MRandom* ins);
+    void visitSignExtendInt64(MSignExtendInt64* ins);
 };

 typedef LIRGeneratorMIPS64 LIRGeneratorSpecific;
@@ -364,6 +364,18 @@ MacroAssembler::rshift64Arithmetic(Register shift, Register64 dest)
 // ===============================================================
 // Rotation functions

+void
+MacroAssembler::rotateLeft64(Imm32 count, Register64 src, Register64 dest)
+{
+    rotateLeft64(count, src, dest, InvalidReg);
+}
+
+void
+MacroAssembler::rotateLeft64(Register count, Register64 src, Register64 dest)
+{
+    rotateLeft64(count, src, dest, InvalidReg);
+}
+
 void
 MacroAssembler::rotateLeft64(Imm32 count, Register64 src, Register64 dest, Register temp)
 {
@@ -382,6 +394,18 @@ MacroAssembler::rotateLeft64(Register count, Register64 src, Register64 dest, Re
    ma_drol(dest.reg, src.reg, count);
 }

+void
+MacroAssembler::rotateRight64(Imm32 count, Register64 src, Register64 dest)
+{
+    rotateRight64(count, src, dest, InvalidReg);
+}
+
+void
+MacroAssembler::rotateRight64(Register count, Register64 src, Register64 dest)
+{
+    rotateRight64(count, src, dest, InvalidReg);
+}
+
 void
 MacroAssembler::rotateRight64(Imm32 count, Register64 src, Register64 dest, Register temp)
 {
@@ -1497,17 +1497,17 @@ MacroAssemblerMIPS64Compat::unboxSymbol(Register src, Register dest)

 void MacroAssemblerMIPS64Compat::unboxBigInt(const ValueOperand& operand, Register dest)
 {
-  unboxNonDouble(operand, dest, JSVAL_TYPE_BIGINT);
+  unboxNonDouble(operand, dest);
 }

 void MacroAssemblerMIPS64Compat::unboxBigInt(Register src, Register dest)
 {
-  unboxNonDouble(src, dest, JSVAL_TYPE_BIGINT);
+  ma_dext(dest, src, Imm32(0), Imm32(JSVAL_TAG_SHIFT));
 }

 void MacroAssemblerMIPS64Compat::unboxBigInt(const Address& src, Register dest)
 {
-  unboxNonDouble(src, dest, JSVAL_TYPE_BIGINT);
+  unboxNonDouble(src, dest);
 }

 void
@@ -1559,6 +1559,11 @@ MacroAssemblerMIPS64Compat::unboxPrivate(const ValueOperand& src, Register dest)
 void
 MacroAssemblerMIPS64Compat::boxDouble(FloatRegister src, const ValueOperand& dest)
 {
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+    // Legacy-ABI MIPS hardware can produce NaN payloads that overlap the
+    // punbox64 tag space. Normalize them before creating a JS::Value.
+    asMasm().canonicalizeDouble(src);
+#endif
    as_dmfc1(dest.valueReg(), src);
 }

@@ -173,6 +173,18 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler& masm)
        masm.neg32(ExtractTemp0);
        masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
        break;
+      case JSOP_INC: {
+        masm.unboxInt32(R0, ExtractTemp0);
+        masm.ma_addTestOverflow(ExtractTemp0, ExtractTemp0, Imm32(1), &failure);
+        masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
+        break;
+      }
+      case JSOP_DEC: {
+        masm.unboxInt32(R0, ExtractTemp0);
+        masm.ma_subTestOverflow(ExtractTemp0, ExtractTemp0, Imm32(1), &failure);
+        masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
+        break;
+      }
      default:
        MOZ_CRASH("Unexpected op");
        return false;
@@ -312,12 +312,19 @@ cvt_s(SprintfState* ss, const char* s, int width, int prec, int flags)
        s = generic_null_str(s);

    // Limit string length by precision value
-    int slen = int(generic_strlen(s));
-    if (0 < prec && prec < slen)
-        slen = prec;
+    // We'd want to use strnlen() here, but it is not supported by all targets
+    // (Most notably old OS X), so use memchr instead.
+    // Replace with `size_t slen = strnlen(s, size_t(prec));` once we no longer
+    // need to cater to this.
+    const char* sptr = (const char*)memchr(s, 0, size_t(prec));
+    size_t slen = sptr ? sptr - s : size_t(prec);
+    
+    if (slen > INT_MAX) {
+        return false;
+    }

    // and away we go
-    return fill2(ss, s, slen, width, flags);
+    return fill2(ss, s, int(slen), width, flags);
 }

 /*
@@ -2871,8 +2871,8 @@ static JSString* ReplaceAll(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-      std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+      std::is_same_v<RepChar, char16_t>) {
        if (!result.ensureTwoByteChars()) {
          return nullptr;
        }
@@ -2954,8 +2954,8 @@ static JSString* ReplaceAllInterleave(JSContext* cx, JSLinearString* str,

    // Step 13.
    StringBuffer result(cx);
-    if (std::is_same<StrChar, char16_t>::value ||
-        std::is_same<RepChar, char16_t>::value) {
+    if (std::is_same_v<StrChar, char16_t> ||
+        std::is_same_v<RepChar, char16_t>) {
        if (!result.ensureTwoByteChars()) {
            return nullptr;
        }
@@ -309,26 +309,26 @@ InflateUTF8StringToBuffer(ContextT* cx, const UTF8Chars src, CharT* dst, size_t*
            while (v & (0x80 >> n))
                n++;

-        #define INVALID(report, arg, n2)                                \
-            do {                                                        \
-                if (Action == CountAndReportInvalids) {                 \
-                    report(cx, arg);                                    \
-                    return false;                                       \
-                } else if (Action == AssertNoInvalids) {                \
-                    MOZ_CRASH("invalid UTF-8 string: " # report);       \
-                } else {                                                \
-                    if (Action == Copy) {                               \
-                        if (std::is_same<decltype(dst[0]), Latin1Char>::value) \
-                            dst[j] = CharT(REPLACE_UTF8_LATIN1);        \
-                        else                                            \
-                            dst[j] = CharT(REPLACE_UTF8);               \
-                    } else {                                            \
-                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||  \
-                                   Action == FindEncoding);             \
-                    }                                                   \
-                    n = n2;                                             \
-                    goto invalidMultiByteCodeUnit;                      \
-                }                                                       \
+        #define INVALID(report, arg, n2)                                  \
+            do {                                                          \
+                if (Action == CountAndReportInvalids) {                   \
+                    report(cx, arg);                                      \
+                    return false;                                         \
+                } else if (Action == AssertNoInvalids) {                  \
+                    MOZ_CRASH("invalid UTF-8 string: " # report);         \
+                } else {                                                  \
+                    if (Action == Copy) {                                 \
+                        if (std::is_same_v<decltype(dst[0]), Latin1Char>) \
+                            dst[j] = CharT(REPLACE_UTF8_LATIN1);          \
+                        else                                              \
+                            dst[j] = CharT(REPLACE_UTF8);                 \
+                    } else {                                              \
+                        MOZ_ASSERT(Action == CountAndIgnoreInvalids ||    \
+                                   Action == FindEncoding);               \
+                    }                                                     \
+                    n = n2;                                               \
+                    goto invalidMultiByteCodeUnit;                        \
+                }                                                         \
            } while (0)

            // Check the leading byte.
@@ -8,6 +8,8 @@
 #include "js/Initialization.h"

 #include "mozilla/Assertions.h"
+#include "mozilla/Casting.h"
+#include "mozilla/FloatingPoint.h"

 #include <ctype.h>

@@ -19,6 +21,7 @@
 #include "jit/ExecutableAllocator.h"
 #include "jit/Ion.h"
 #include "js/Utility.h"
+#include "js/Value.h"
 #include "unicode/uclean.h"
 #include "unicode/utypes.h"
 #include "vm/DateTime.h"
@@ -34,6 +37,31 @@ using js::FutexRuntime;

 InitState JS::detail::libraryInitState;

+// MIPS-specific
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+namespace JS {
+namespace detail {
+JS_PUBLIC_DATA(uint64_t) CanonicalizedNaNBits;
+} // namespace detail
+} // namespace JS
+
+// MIPS-specific
+static void
+SetupCanonicalNaN()
+{
+    // Use a real hardware operation. A legacy MIPS ABI can run on hardware
+    // whose NaN behavior does not match the compiler's predefined NAN value.
+    volatile double infinity = mozilla::PositiveInfinity<double>();
+    volatile double hardwareNaN = infinity - infinity;
+    uint64_t hardwareNaNBits = mozilla::BitwiseCast<uint64_t>(hardwareNaN);
+    hardwareNaNBits &= ~mozilla::FloatingPoint<double>::kSignBit;
+
+    // The selected NaN must remain a double in the JS::Value representation.
+    MOZ_RELEASE_ASSERT(JS::Value::fromRawBits(hardwareNaNBits).isDouble());
+    JS::detail::CanonicalizedNaNBits = hardwareNaNBits;
+}
+#endif
+
 #ifdef DEBUG
 static unsigned
 MessageParameterCount(const char* format)
@@ -76,6 +104,11 @@ JS::detail::InitWithFailureDiagnostic(bool isDebugBuild)
    MOZ_ASSERT(!JSRuntime::hasLiveRuntimes(),
               "how do we have live runtimes before JS_Init?");

+// MIPS-specific
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+    SetupCanonicalNaN();
+#endif
+
    PRMJ_NowInit();

    // The first invocation of `ProcessCreation` creates a temporary thread
@@ -1138,7 +1138,7 @@ class StaticStrings
    }

    template <typename CharT,
-              typename = typename std::enable_if<!std::is_const<CharT>::value>::type>
+              typename = typename std::enable_if_t<!std::is_const_v<CharT>>>
    MOZ_ALWAYS_INLINE JSAtom* lookup(CharT* chars, size_t length) {
        // Collapse the remaining |CharT*| to |const CharT*| to avoid excess
        // instantiations.
@@ -677,12 +677,12 @@ class ElementSpecific
            return true;
        }

-        if (std::is_same<T, int64_t>::value) {
+        if (std::is_same_v<T, int64_t>) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigInt64(cx, v));
            return true;
        }

-        if (std::is_same<T, uint64_t>::value) {
+        if (std::is_same_v<T, uint64_t>) {
            JS_TRY_VAR_OR_RETURN_FALSE(cx, *result, ToBigUint64(cx, v));
            return true;
        }
@@ -411,6 +411,13 @@ DottedCornerFinder::FindBestOverlap(Float aMinR, Float aMinBorderRadius,
        mCount = mMaxCount;
        break;
      }
+      // GetCountAndLastOverlap() failed without writing |count| and
+      // |actualOverlap|: the walk needed more than mMaxCount circles, i.e.
+      // this overlap produces too many circles.  Narrow the search toward
+      // smaller overlaps.
+      upper = overlap;
+      overlap = (upper + lower) / 2.0f;
+      continue;
    }

    if (j == 0) {
@@ -13,6 +13,7 @@
 #include <algorithm> // For std::max
 #include "mozilla/EffectSet.h"
 #include "mozilla/EventStates.h"
+#include "mozilla/dom/ShadowRoot.h"
 #include "nsLayoutUtils.h"
 #include "AnimationCommon.h" // For GetLayerAnimationInfo
 #include "FrameLayerBuilder.h"
@@ -260,6 +261,7 @@ RestyleManager::ContentStateChanged(nsIContent* aContent,
  ContentStateChangedInternal(aElement, aStateMask, &changeHint, &restyleHint);

  PostRestyleEvent(aElement, restyleHint, changeHint);
+  RestyleForHasPseudoClassChange(aElement);
 }

 // Forwarded nsIMutationObserver method, to handle restyling.
@@ -371,6 +373,30 @@ RestyleManager::AttributeChanged(Element* aElement,
                                           aOldValue,
                                           rsdata);
  PostRestyleEvent(aElement, rshint, hint, &rsdata);
+  RestyleForHasPseudoClassChange(aElement);
+}
+
+bool
+RestyleManager::RestyleForHasPseudoClassChange(nsINode* aNode)
+{
+  Element* affectedRoot = nullptr;
+  for (nsINode* node = aNode; node; node = node->GetParentNode()) {
+    if (!node->GetProperty(nsGkAtoms::hasSelectorDependency)) {
+      continue;
+    }
+    if (node->IsElement()) {
+      affectedRoot = node->AsElement();
+    } else if (ShadowRoot* shadow = ShadowRoot::FromNode(node)) {
+      affectedRoot = shadow->GetHost();
+    }
+  }
+
+  if (!affectedRoot) {
+    return false;
+  }
+
+  PostRestyleEvent(affectedRoot, eRestyle_Subtree, nsChangeHint(0));
+  return true;
 }

 /* static */ uint64_t
@@ -399,6 +425,10 @@ RestyleManager::RestyleForAppend(nsIContent* aContainer,
                                 nsIContent* aFirstNewContent)
 {
  // The container cannot be a document, but might be a ShadowRoot.
+  if (RestyleForHasPseudoClassChange(aContainer)) {
+    return;
+  }
+
  if (!aContainer->IsElement()) {
    return;
  }
@@ -488,6 +518,10 @@ RestyleManager::RestyleForInsertOrChange(nsINode* aContainer,
                                         nsIContent* aChild)
 {
  // The container might be a document or a ShadowRoot.
+  if (RestyleForHasPseudoClassChange(aContainer)) {
+    return;
+  }
+
  if (!aContainer->IsElement()) {
    return;
  }
@@ -578,6 +612,10 @@ RestyleManager::ContentRemoved(nsINode* aContainer,
                               nsIContent* aFollowingSibling)
 {
  // The container might be a document or a ShadowRoot.
+  if (RestyleForHasPseudoClassChange(aContainer)) {
+    return;
+  }
+
  if (!aContainer->IsElement()) {
    return;
  }
@@ -314,6 +314,10 @@ public:
  // the container is null, no work is needed.
  void RestyleForAppend(nsIContent* aContainer, nsIContent* aFirstNewContent);

+  // Restyle a subtree containing any :has() anchor affected by a change at
+  // or below aNode. Returns true when such a restyle was posted.
+  bool RestyleForHasPseudoClassChange(nsINode* aNode);
+
  // Process any pending restyles. This should be called after
  // CreateNeededFrames.
  // Note: It's the caller's responsibility to make sure to wrap a
@@ -5107,19 +5107,28 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
           styleMinBSize.GetCoordValue() == 0)) ||
        styleMaxBSize.GetUnit() != eStyleUnit_None) {

-      AspectRatio ratio = aFrame->GetIntrinsicRatio();
+      AspectRatio ratio = aFrame->GetAspectRatio();
      if (ratio) {
-        // Convert 'ratio' if necessary, so that it's storing ISize/BSize:
-        if (!horizontalAxis) {
-          ratio = ratio.Inverted();
-        }
        AddStateBitToAncestors(aFrame,
            NS_FRAME_DESCENDANT_INTRINSIC_ISIZE_DEPENDS_ON_BSIZE);

+        const WritingMode wm = aFrame->GetWritingMode();
+        LogicalSize boxSizingAdjust(wm);
+        boxSizingAdjust.ISize(wm) =
+          GetDefiniteSizeTakenByBoxSizing(boxSizing, aFrame, isInlineAxis,
+                                          aFlags & IGNORE_PADDING,
+                                          aPercentageBasis);
        nscoord bSizeTakenByBoxSizing =
          GetDefiniteSizeTakenByBoxSizing(boxSizing, aFrame, !isInlineAxis,
                                          aFlags & IGNORE_PADDING,
                                          aPercentageBasis);
+        boxSizingAdjust.BSize(wm) = bSizeTakenByBoxSizing;
+        auto iSizeFromBSize = [&](nscoord aBSize) {
+          LogicalAxis dependentAxis =
+            isInlineAxis ? eLogicalAxisInline : eLogicalAxisBlock;
+          return ratio.ComputeRatioDependentSize(
+              dependentAxis, wm, aBSize, boxSizingAdjust);
+        };
        // NOTE: This is only the minContentSize if we've been passed MIN_INTRINSIC_ISIZE
        // (which is fine, because this should only be used inside a check for that flag).
        nscoord minContentSize = result;
@@ -5128,14 +5137,14 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
            (aPercentageBasis.isNothing() &&
             GetPercentBSize(styleBSize, aFrame, horizontalAxis, h))) {
          h = std::max(0, h - bSizeTakenByBoxSizing);
-          result = ratio.ApplyTo(h);
+          result = iSizeFromBSize(h);
        }

        if (GetDefiniteSize(styleMaxBSize, aFrame, !isInlineAxis, aPercentageBasis, &h) ||
            (aPercentageBasis.isNothing() &&
             GetPercentBSize(styleMaxBSize, aFrame, horizontalAxis, h))) {
          h = std::max(0, h - bSizeTakenByBoxSizing);
-          nscoord maxISize = ratio.ApplyTo(h);
+          nscoord maxISize = iSizeFromBSize(h);
          if (maxISize < result) {
            result = maxISize;
          }
@@ -5148,7 +5157,7 @@ nsLayoutUtils::IntrinsicForAxis(PhysicalAxis              aAxis,
            (aPercentageBasis.isNothing() &&
             GetPercentBSize(styleMinBSize, aFrame, horizontalAxis, h))) {
          h = std::max(0, h - bSizeTakenByBoxSizing);
-          nscoord minISize = ratio.ApplyTo(h);
+          nscoord minISize = iSizeFromBSize(h);
          if (minISize > result) {
            result = minISize;
          }
@@ -8938,7 +8938,11 @@ PresShell::DidDoReflow(bool aInterruptible)
 {
  mFrameConstructor->EndUpdate();

-  HandlePostedReflowCallbacks(aInterruptible);
+  if (!mHandlingCallbacks) {
+    mHandlingCallbacks = true; // Prevent recursion
+    HandlePostedReflowCallbacks(aInterruptible);
+    mHandlingCallbacks = false;
+  }

  nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
  if (docShell) {
@@ -926,6 +926,8 @@ protected:

  bool                      mAsyncResizeTimerIsActive : 1;
  bool                      mInResize : 1;
+  
+  bool                      mHandlingCallbacks : 1;

  bool                      mApproximateFrameVisibilityVisited : 1;

@@ -234,7 +234,18 @@ nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext* aPresContext,
 {
  WritingMode wm = GetWritingMode();
  LogicalSize availSize = aButtonReflowInput.ComputedSize(wm);
-  availSize.BSize(wm) = NS_INTRINSICSIZE;
+
+  // Identify if the inner anonymous block is actually functioning as a flex or grid container.
+  nsIAtom* kidType = aFirstKid->GetType();
+  bool isFlexOrGrid = (kidType == nsGkAtoms::flexContainerFrame ||
+                       kidType == nsGkAtoms::gridContainerFrame);
+
+  // Preserve the button's definite BSize ONLY for flex/grid children so they
+  // see a definite containing block main size. For standard buttons, clobber
+  // to intrinsic so standard vertical centering (extraSpace) calculations work.
+  if (!isFlexOrGrid || aButtonReflowInput.ComputedBSize() == NS_INTRINSICSIZE) {
+    availSize.BSize(wm) = NS_INTRINSICSIZE;
+  }

  // shorthand for a value we need to use in a bunch of places
  const LogicalMargin& clbp = aButtonReflowInput.ComputedLogicalBorderPadding();
@@ -248,6 +259,12 @@ nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext* aPresContext,
                                  aFirstKid,
                                  availSize);

+  // Apply the definite BSize directly on the inner reflow input ONLY if it's
+  // a flex or grid container, allowing it to be used as-is.
+  if (isFlexOrGrid && aButtonReflowInput.ComputedBSize() != NS_INTRINSICSIZE) {
+    contentsReflowInput.SetComputedBSize(aButtonReflowInput.ComputedBSize());
+  }
+
  nsReflowStatus contentsReflowStatus;
  ReflowOutput contentsDesiredSize(aButtonReflowInput);
  childPos.B(wm) = 0; // This will be set properly later, after reflowing the
@@ -0,0 +1,39 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/AspectRatio.h"
+
+#include "mozilla/WritingModes.h"
+
+namespace mozilla {
+
+nscoord
+AspectRatio::ComputeRatioDependentSize(
+    LogicalAxis aRatioDependentAxis,
+    const WritingMode& aWM,
+    nscoord aRatioDeterminingSize,
+    const LogicalSize& aContentBoxToBoxSizingAdjust) const
+{
+  MOZ_DIAGNOSTIC_ASSERT(*this);
+
+  LogicalSize adjust(aWM);
+  if (mUseBoxSizing == UseBoxSizing::Yes) {
+    adjust = aContentBoxToBoxSizingAdjust;
+  }
+
+  AspectRatio logicalRatio = aWM.IsVertical() ? Inverted() : *this;
+  nscoord result;
+  if (aRatioDependentAxis == eLogicalAxisInline) {
+    result = logicalRatio.ApplyTo(aRatioDeterminingSize +
+                                  adjust.BSize(aWM)) -
+             adjust.ISize(aWM);
+  } else {
+    result = logicalRatio.Inverted().ApplyTo(aRatioDeterminingSize +
+                                             adjust.ISize(aWM)) -
+             adjust.BSize(aWM);
+  }
+  return std::max(nscoord(0), result);
+}
+
+} // namespace mozilla
@@ -9,21 +9,46 @@
 /* The aspect ratio of a box, in a "width / height" format. */

 #include "mozilla/Attributes.h"
+#include "mozilla/LogicalTypes.h"
 #include "nsCoord.h"
+#include "nsSize.h"
 #include <algorithm>
 #include <limits>

 namespace mozilla {

-struct AspectRatio {
-  AspectRatio() : mRatio(0.0f) {}
-  explicit AspectRatio(float aRatio) : mRatio(std::max(aRatio, 0.0f)) {}
+class LogicalSize;
+class WritingMode;

-  static AspectRatio FromSize(float aWidth, float aHeight) {
+enum class UseBoxSizing : uint8_t {
+  // Natural ratios and "auto <ratio>" always use content-box dimensions.
+  No,
+  // A specified <ratio> uses the dimensions selected by box-sizing.
+  Yes,
+};
+
+struct AspectRatio {
+  AspectRatio()
+    : mRatio(0.0f)
+    , mUseBoxSizing(UseBoxSizing::No)
+  {}
+
+  explicit AspectRatio(float aRatio,
+                       UseBoxSizing aUseBoxSizing = UseBoxSizing::No)
+    : mRatio(std::max(aRatio, 0.0f))
+    , mUseBoxSizing(aUseBoxSizing)
+  {}
+
+  static AspectRatio FromSize(float aWidth, float aHeight,
+                              UseBoxSizing aUseBoxSizing = UseBoxSizing::No) {
    if (aWidth == 0.0f || aHeight == 0.0f) {
      return AspectRatio();
    }
-    return AspectRatio(aWidth / aHeight);
+    float ratio = aWidth / aHeight;
+    if (!std::isfinite(ratio)) {
+      return AspectRatio();
+    }
+    return AspectRatio(ratio, aUseBoxSizing);
  }

  static AspectRatio FromSize(nsSize aSize) {
@@ -55,11 +80,23 @@ struct AspectRatio {
    // 0.0f in the division here (so that valid ratios always generate other
    // valid ratios when inverted).
    return AspectRatio(
-        std::max(std::numeric_limits<float>::epsilon(), 1.0f / mRatio));
+        std::max(std::numeric_limits<float>::epsilon(), 1.0f / mRatio),
+        mUseBoxSizing);
  }

+  /**
+   * Computes a content-box size in the ratio-dependent axis from a
+   * content-box size in the ratio-determining axis.
+   */
+  nscoord ComputeRatioDependentSize(
+      LogicalAxis aRatioDependentAxis,
+      const WritingMode& aWM,
+      nscoord aRatioDeterminingSize,
+      const LogicalSize& aContentBoxToBoxSizingAdjust) const;
+
  bool operator==(const AspectRatio& aOther) const {
-    return mRatio == aOther.mRatio;
+    return mRatio == aOther.mRatio &&
+           mUseBoxSizing == aOther.mUseBoxSizing;
  }

  bool operator!=(const AspectRatio& aOther) const {
@@ -73,6 +110,7 @@ struct AspectRatio {
 private:
  // 0.0f represents no aspect ratio.
  float mRatio;
+  UseBoxSizing mUseBoxSizing;
 };

 }  // namespace mozilla
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_LogicalTypes_h
+#define mozilla_LogicalTypes_h
+
+namespace mozilla {
+
+// Logical axis, edge, side and corner constants for use in various places.
+enum LogicalAxis {
+  eLogicalAxisBlock  = 0x0,
+  eLogicalAxisInline = 0x1
+};
+enum LogicalEdge {
+  eLogicalEdgeStart  = 0x0,
+  eLogicalEdgeEnd    = 0x1
+};
+enum LogicalSide {
+  eLogicalSideBStart = (eLogicalAxisBlock  << 1) | eLogicalEdgeStart,  // 0x0
+  eLogicalSideBEnd   = (eLogicalAxisBlock  << 1) | eLogicalEdgeEnd,    // 0x1
+  eLogicalSideIStart = (eLogicalAxisInline << 1) | eLogicalEdgeStart,  // 0x2
+  eLogicalSideIEnd   = (eLogicalAxisInline << 1) | eLogicalEdgeEnd     // 0x3
+};
+
+enum LogicalCorner
+{
+  eLogicalCornerBStartIStart = 0,
+  eLogicalCornerBStartIEnd   = 1,
+  eLogicalCornerBEndIEnd     = 2,
+  eLogicalCornerBEndIStart   = 3
+};
+
+} // namespace mozilla
+
+#endif // mozilla_LogicalTypes_h
@@ -6,6 +6,7 @@
 #ifndef WritingModes_h_
 #define WritingModes_h_

+#include "mozilla/LogicalTypes.h"
 #include "nsRect.h"
 #include "nsStyleContext.h"
 #include "nsBidiUtils.h"
@@ -110,6 +110,7 @@ EXPORTS += [
 EXPORTS.mozilla += [
    'AspectRatio.h',
    'CSSAlignUtils.h',
+    'LogicalTypes.h',
    'ReflowInput.h',
    'ReflowOutput.h',
    'WritingModes.h',
@@ -124,6 +125,7 @@ EXPORTS.mozilla.layout += [
 ]

 UNIFIED_SOURCES += [
+    'AspectRatio.cpp',
    'AsyncScrollBase.cpp',
    'BlockReflowInput.cpp',
    'CSSAlignUtils.cpp',
@@ -1945,7 +1945,7 @@ FlexItem::FlexItem(ReflowInput& aFlexItemReflowInput,
  : mFrame(aFlexItemReflowInput.mFrame),
    mFlexGrow(aFlexGrow),
    mFlexShrink(aFlexShrink),
-    mIntrinsicRatio(mFrame->GetIntrinsicRatio()),
+    mIntrinsicRatio(mFrame->GetAspectRatio()),
    mBorderPadding(aFlexItemReflowInput.ComputedPhysicalBorderPadding()),
    mMargin(aFlexItemReflowInput.ComputedPhysicalMargin()),
    mMainMinSize(aMainMinSize),
@@ -4655,10 +4655,44 @@ nsFrame::GetIntrinsicSize()
 /* virtual */ AspectRatio
 nsFrame::GetIntrinsicRatio()
 {
-  const nsStylePosition* stylePos = StylePosition();
-  return stylePos->mAspectRatio == 0.0f
-         ? AspectRatio()
-         : AspectRatio(stylePos->mAspectRatio);
+  return AspectRatio();
+}
+
+AspectRatio
+nsIFrame::GetAspectRatio()
+{
+  // The property does not apply to inline boxes or internal ruby/table boxes.
+  nsIAtom* type = GetType();
+  if (type == nsGkAtoms::inlineFrame ||
+      RubyUtils::IsRubyBox(type) ||
+      type == nsGkAtoms::tableCellFrame ||
+      type == nsGkAtoms::tableColFrame ||
+      type == nsGkAtoms::tableColGroupFrame ||
+      type == nsGkAtoms::tableRowFrame ||
+      type == nsGkAtoms::tableRowGroupFrame) {
+    return AspectRatio();
+  }
+
+  const StyleAspectRatio& styleRatio = StylePosition()->mAspectRatio;
+
+  // A non-auto, non-degenerate ratio overrides the natural ratio and uses the
+  // box selected by box-sizing.
+  if (!styleRatio.mAuto && styleRatio.HasUsableRatio()) {
+    return AspectRatio::FromSize(styleRatio.mWidth, styleRatio.mHeight,
+                                 UseBoxSizing::Yes);
+  }
+
+  if (AspectRatio intrinsicRatio = GetIntrinsicRatio()) {
+    return intrinsicRatio;
+  }
+
+  // The fallback in "auto <ratio>" always operates on the content box.
+  if (styleRatio.HasUsableRatio()) {
+    return AspectRatio::FromSize(styleRatio.mWidth, styleRatio.mHeight,
+                                 UseBoxSizing::No);
+  }
+
+  return AspectRatio();
 }

 void
@@ -4727,11 +4761,11 @@ nsFrame::ComputeSize(nsRenderingContext* aRenderingContext,
                     const LogicalSize&  aPadding,
                     ComputeSizeFlags    aFlags)
 {
-  AspectRatio intrinsicRatio = GetIntrinsicRatio();
-  if (intrinsicRatio) {
+  AspectRatio aspectRatio = GetAspectRatio();
+  if (aspectRatio) {
    return ComputeSizeWithIntrinsicDimensions(aRenderingContext, aWM,
                                              GetIntrinsicSize(),
-                                              intrinsicRatio,
+                                              aspectRatio,
                                              aCBSize, aMargin,
                                              aBorder, aPadding,
                                              aFlags);
@@ -4976,8 +5010,6 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
                                            const LogicalSize&   aPadding,
                                            ComputeSizeFlags     aFlags)
 {
-  auto logicalRatio =
-      aWM.IsVertical() ? aIntrinsicRatio.Inverted() : aIntrinsicRatio;
  const nsStylePosition* stylePos = StylePosition();
  const nsStyleCoord* inlineStyleCoord = &stylePos->ISize(aWM);
  const nsStyleCoord* blockStyleCoord = &stylePos->BSize(aWM);
@@ -5039,6 +5071,14 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
  if (stylePos->mBoxSizing == StyleBoxSizing::Border) {
    boxSizingAdjust = aBorder + aPadding;
  }
+  auto iSizeFromBSize = [&](nscoord aBSize) {
+    return aIntrinsicRatio.ComputeRatioDependentSize(
+        eLogicalAxisInline, aWM, aBSize, boxSizingAdjust);
+  };
+  auto bSizeFromISize = [&](nscoord aISize) {
+    return aIntrinsicRatio.ComputeRatioDependentSize(
+        eLogicalAxisBlock, aWM, aISize, boxSizingAdjust);
+  };
  nscoord boxSizingToMarginEdgeISize =
    aMargin.ISize(aWM) + aBorder.ISize(aWM) + aPadding.ISize(aWM) -
      boxSizingAdjust.ISize(aWM);
@@ -5129,7 +5169,8 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
    bSize = nsLayoutUtils::ComputeBSizeValue(aCBSize.BSize(aWM),
                boxSizingAdjust.BSize(aWM),
                *blockStyleCoord);
-  } else if (MOZ_UNLIKELY(isGridItem)) {
+  } else if (MOZ_UNLIKELY(isGridItem) &&
+             !(aFlags & nsIFrame::eUseAutoBSize)) {
    MOZ_ASSERT(!IS_TRUE_OVERFLOW_CONTAINER(this));
    // 'auto' block-size for grid-level box - apply 'stretch' as needed:
    auto cbSize = aCBSize.BSize(aWM);
@@ -5230,9 +5271,9 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte

      if (hasIntrinsicISize) {
        tentISize = intrinsicISize;
-      } else if (hasIntrinsicBSize && logicalRatio) {
-        tentISize = logicalRatio.ApplyTo(intrinsicBSize);
-      } else if (logicalRatio) {
+      } else if (hasIntrinsicBSize && aIntrinsicRatio) {
+        tentISize = iSizeFromBSize(intrinsicBSize);
+      } else if (aIntrinsicRatio) {
        tentISize = aCBSize.ISize(aWM) - boxSizingToMarginEdgeISize; // XXX scrollbar?
        if (tentISize < 0) tentISize = 0;
      } else {
@@ -5249,8 +5290,8 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte

      if (hasIntrinsicBSize) {
        tentBSize = intrinsicBSize;
-      } else if (logicalRatio) {
-        tentBSize = logicalRatio.Inverted().ApplyTo(tentISize);
+      } else if (aIntrinsicRatio) {
+        tentBSize = bSizeFromISize(tentISize);
      } else {
        tentBSize = nsPresContext::CSSPixelsToAppUnits(150);
      }
@@ -5261,39 +5302,39 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
        stretchB = (stretchI == eStretch ? eStretch : eStretchPreservingRatio);
      }

-      if (logicalRatio) {
+      if (aIntrinsicRatio) {
        if (stretchI == eStretch) {
          tentISize = iSize;  // * / 'stretch'
          if (stretchB == eStretch) {
            tentBSize = bSize;  // 'stretch' / 'stretch'
          } else if (stretchB == eStretchPreservingRatio) {
            // 'normal' / 'stretch'
-            tentBSize = logicalRatio.Inverted().ApplyTo(iSize);
+            tentBSize = bSizeFromISize(iSize);
          }
        } else if (stretchB == eStretch) {
          tentBSize = bSize;  // 'stretch' / * (except 'stretch')
          if (stretchI == eStretchPreservingRatio) {
            // 'stretch' / 'normal'
-            tentISize = logicalRatio.ApplyTo(bSize);
+            tentISize = iSizeFromBSize(bSize);
          }
        } else if (stretchI == eStretchPreservingRatio) {
          tentISize = iSize;  // * (except 'stretch') / 'normal'
-          tentBSize = logicalRatio.Inverted().ApplyTo(iSize);
+          tentBSize = bSizeFromISize(iSize);
          if (stretchB == eStretchPreservingRatio && tentBSize > bSize) {
            // Stretch within the CB size with preserved intrinsic ratio.
            tentBSize = bSize;  // 'normal' / 'normal'
-            tentISize = logicalRatio.ApplyTo(bSize);
+            tentISize = iSizeFromBSize(bSize);
          }
        } else if (stretchB == eStretchPreservingRatio) {
          tentBSize = bSize;  // 'normal' / * (except 'normal' and 'stretch')
-          tentISize = logicalRatio.ApplyTo(bSize);
+          tentISize = iSizeFromBSize(bSize);
        }
      }

      // ComputeAutoSizeWithIntrinsicDimensions preserves the ratio when applying
      // the min/max-size.  We don't want that when we have 'stretch' in either
      // axis because tentISize/tentBSize is likely not according to ratio now.
-      if (logicalRatio && stretchI != eStretch && stretchB != eStretch) {
+      if (aIntrinsicRatio && stretchI != eStretch && stretchB != eStretch) {
        nsSize autoSize = nsLayoutUtils::
          ComputeAutoSizeWithIntrinsicDimensions(minISize, minBSize,
                                                 maxISize, maxBSize,
@@ -5314,8 +5355,8 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
      // 'auto' iSize, non-'auto' bSize
      bSize = NS_CSS_MINMAX(bSize, minBSize, maxBSize);
      if (stretchI != eStretch) {
-        if (logicalRatio) {
-          iSize = logicalRatio.ApplyTo(bSize);
+        if (aIntrinsicRatio) {
+          iSize = iSizeFromBSize(bSize);
        } else if (hasIntrinsicISize) {
          if (!((aFlags & ComputeSizeFlags::eIClampMarginBoxMinSize) &&
                intrinsicISize > iSize)) {
@@ -5334,8 +5375,8 @@ nsFrame::ComputeSizeWithIntrinsicDimensions(nsRenderingContext*  aRenderingConte
      // non-'auto' iSize, 'auto' bSize
      iSize = NS_CSS_MINMAX(iSize, minISize, maxISize);
      if (stretchB != eStretch) {
-        if (logicalRatio) {
-          bSize = logicalRatio.Inverted().ApplyTo(iSize);
+        if (aIntrinsicRatio) {
+          bSize = bSizeFromISize(iSize);
        } else if (hasIntrinsicBSize) {
          if (!((aFlags & ComputeSizeFlags::eBClampMarginBoxMinSize) &&
                intrinsicBSize > bSize)) {
@@ -318,7 +318,11 @@ nsHTMLFramesetFrame::Init(nsIContent*       aContent,
        mChildFrameborder[mChildCount] = GetFrameBorder(child);
        mChildBorderColors[mChildCount].Set(GetBorderColor(child));
      }
-      child->SetPrimaryFrame(frame);
+      if (MOZ_LIKELY(!child->GetPrimaryFrame())) {
+        // Child might have a pre-existing primary frame if we're doing fixed-pos
+        // replication... So, only set it if there is no primary frame yet.
+        child->SetPrimaryFrame(frame);
+      }

      mFrames.AppendFrame(nullptr, frame);

@@ -225,7 +225,7 @@ nsHTMLCanvasFrame::ComputeSize(nsRenderingContext *aRenderingContext,
  intrinsicSize.width.SetCoordValue(nsPresContext::CSSPixelsToAppUnits(size.width));
  intrinsicSize.height.SetCoordValue(nsPresContext::CSSPixelsToAppUnits(size.height));

-  AspectRatio intrinsicRatio = GetIntrinsicRatio();
+  AspectRatio intrinsicRatio = GetAspectRatio();

  return ComputeSizeWithIntrinsicDimensions(aRenderingContext, aWM,
                                            intrinsicSize, intrinsicRatio,
@@ -424,4 +424,3 @@ nsHTMLCanvasFrame::GetFrameName(nsAString& aResult) const
  return MakeFrameName(NS_LITERAL_STRING("HTMLCanvas"), aResult);
 }
 #endif
-
Author	SHA1	Message	Date
Moonchild	a9b7af2c28	[layout] Prevent recursion of callbacks in PressShell.	2026-08-21 21:18:20 +02:00
Moonchild	501212e324	[gfx] Clean up cairo-win32-printing-surface.c - Reformat code for readability. - Check allocations in _cairo_win32_printing_surface_paint_linear_pattern.	2026-08-21 15:46:36 +02:00
Moonchild	7158edf5c8	[gfx fonts] Check format 4 subtable length and Zero newly-allocated range.	2026-08-20 15:45:42 +02:00
Moonchild	fcc96573dd	[gfx] Add buffer integer limit check to NVImage::GetAsSourceSurface.	2026-08-20 15:13:25 +02:00
Moonchild	79c57f2dab	Merge pull request 'Restore the ability to compile on MIPS targets' (#3166 ) from Basilisk-Dev/UXP-contrib:mips-fix into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3166	2026-08-19 15:31:24 +00:00
Moonchild	ed63bc8a89	[gfx] Hold a strong ref to platform font entry.	2026-08-19 15:24:35 +02:00
Moonchild	1de3a27f36	[DOM] Keep resized windows within reasonable bounds. The size is now clamped to twice the available area of the screen the window is on. Twice rather than exactly the screen, because the size we get for a screen is not always accurate, on Wayland in particular... (¬_¬)	2026-08-19 11:18:02 +02:00
Moonchild	e9d47c2c07	Merge pull request 'K.I.S.S.: Spot-fix jsprf for OS X 10.5 and 10.6' (#3164 ) from strnlen-kiss into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3164	2026-08-19 08:36:02 +00:00
Basilisk-Dev	1ba68a43cd	Issue #3062 - Fix sspidermonkey and JIT issues when compiling on MIPS	2026-08-18 10:24:05 -04:00
Basilisk-Dev	e60dbff022	Issue #3062 - Fix GNU assembler issues in libvpx on MIPS	2026-08-18 10:24:05 -04:00
Basilisk-Dev	b3aad357ab	Issue #3062 - Fix MIPS compilation in ffvpx	2026-08-18 10:24:00 -04:00
Moonchild	4c346cc711	Replace strnlen with memchr. See code comment.	2026-08-15 10:22:56 +02:00
Moonchild	ca36b1f452	Merge pull request 'Implement support for adoptedStyleSheets' (#3161 ) from Basilisk-Dev/UXP-contrib:adoptedstylesheets into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3161	2026-08-13 13:05:05 +00:00
Basilisk-Dev	27195b1e7a	Issue #3157 - Implement support for adoptedStyleSheets	2026-08-12 08:58:52 -04:00
Moonchild	948559c22c	Revert "[parser] Restrict subtree root check to DOM image elements only." As it turns out, the reported regression was actually noncompliant HTML and the initial implementation was correct. This reverts commit `fc25f50e5f`.	2026-08-11 17:39:55 +02:00
Moonchild	5d7a1ca5a9	Merge pull request 'Several Python 3-related fixes to the build system' (#3160 ) from FranklinDM/UXP-contrib:work_python3-fixes-build1 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3160	2026-08-10 12:40:05 +00:00
Francis Dominic Fajardo	613443c5eb	No issue - Remove old Python 2 workaround that encodes environment vars in bytes This should fix installer packaging.	2026-08-10 19:10:18 +08:00
Basilisk-Dev	d7884bb96c	No issue - Fix faster build packaging on Python 3	2026-08-10 19:10:11 +08:00
Moonchild	fc25f50e5f	[parser] Restrict subtree root check to DOM image elements only. This was too broadly applied, resulting in named form elements not being accessible through the DOM tree if not in the same subtree root.	2026-08-09 18:50:50 +02:00
Moonchild	b70b3a5aa1	Merge pull request 'Clean up NSIS scripting.' (#3121 ) from nsis-cleanup into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3121	2026-08-06 13:50:39 +00:00
Moonchild	88ae39ed04	Merge pull request 'Implement :has() CSS pseudo class' (#3152 ) from Basilisk-Dev/UXP-contrib:css-has into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3152	2026-08-06 06:34:14 +00:00
Basilisk-Dev	d893526f82	Issue #2473 - Inline functions in CSS :has() implementation	2026-07-29 16:48:12 -04:00
Moonchild	4d5b1cc5d8	Merge branch 'nss-3.125-port'	2026-07-28 10:50:50 +02:00
Moonchild	0e521f6302	Bump NSS (UXP) patch level.	2026-07-28 10:10:27 +02:00
Moonchild	9cacfcff57	Merge remote-tracking branch 'dbsoft/flex-button-fix2'	2026-07-28 10:08:00 +02:00
John Schanck	21ad7adc90	Bug 2043887 - guard against integer overflow in CERT_Hexify.	2026-07-28 10:03:44 +02:00
Benjamin Beurdouche	9a29430751	Bug 2027353 - clamp input.len to testString size in pk11_mergeSecretKey.	2026-07-28 09:59:51 +02:00
Benjamin Beurdouche	481d4868b0	Bug 2029433 - Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey.	2026-07-28 09:57:10 +02:00
Anna Weine	d148c11717	Bug 2028954 - CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing.	2026-07-28 09:53:26 +02:00
Moonchild	bc322e58f8	Bug 2027364 - Set tail pointer to null in static slot lists when deallocating.	2026-07-28 09:22:56 +02:00
John Schanck	e48a6f26a5	Bug 2032110 - fix two integer overflows on LLP64 systems.	2026-07-27 23:58:14 +02:00
John Schanck	d85edd01df	Bug 2030102 - avoid leaving a dangling ss->sec.ci.sid on allocation failure.	2026-07-27 23:49:55 +02:00
Maurice Dauer	296379d751	Bug 2027325 - Reject empty nickname in PK11_TraverseCertsForNicknameInSlot.	2026-07-27 23:46:32 +02:00
Moonchild	7ba9fc2801	Bug 2030563 - Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib.	2026-07-27 23:22:58 +02:00
Brian Smith	a9ac8b390f	Issue #3153 - Make sure buttons report a definite size for flex containers. Second try, this time ONLY do it for flex container or grids. This should prevent layout problems in non-flex scenarios.	2026-07-27 12:36:24 -05:00
Benjamin Beurdouche	71c0f8246c	Bug 2029807 - Guard padding read against empty output in SEC_PKCS7DecryptContents.	2026-07-27 19:12:42 +02:00
Benjamin Beurdouche	6cda35442f	Bug 2027346 - validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen.	2026-07-27 19:05:33 +02:00
Benjamin Beurdouche	1dba423327	Bug 2027371 - rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow.	2026-07-27 18:56:08 +02:00
Benjamin Beurdouche	e2af0b28bf	Bug 2027373 - guard space subtraction in ssl_CallCustomExtensionSenders.	2026-07-27 18:51:32 +02:00
Benjamin Beurdouche	5ea9b7b80a	Bug 2029901 - Guard against keySize overflow in IKE PRF/PRF+ output sizing.	2026-07-27 18:44:55 +02:00
Benjamin Beurdouche	b799e100ad	Bug 2027362 - bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity.	2026-07-27 18:39:10 +02:00
Benjamin Beurdouche	1c500a6abb	Bug 2027349 - reject empty nickname in PK11_TraverseCertsForNicknameInSlot.	2026-07-27 18:27:47 +02:00
Moonchild	b909fccc92	Revert "Issue #3153 - Make sure buttons report a definite size for flex containers." This reverts commit `3e223cbfb4`.	2026-07-27 17:59:43 +02:00
Moonchild	abddee43b4	Merge remote-tracking branch 'dbsoft/flex-button-fix'	2026-07-27 14:41:27 +02:00
Moonchild	49d184e550	[network] Fix CacheEntry::mDoomCallback data race.	2026-07-27 14:32:51 +02:00
Brian Smith	3e223cbfb4	Issue #3153 - Make sure buttons report a definite size for flex containers.	2026-07-27 05:38:09 -05:00
Basilisk-Dev	7341809f67	Issue #2473 - implement :has() CSS pseudo class	2026-07-26 14:35:40 -04:00
Moonchild	dd9099a7d3	[layout] Fix nsFrameSetFrame primary frame handling of replicated children.	2026-07-26 19:55:49 +02:00
Moonchild	31558a1521	Merge pull request 'Issue #3061 Follow-up: Remove network tickler prefs' (#3151 ) from Shadow/UXP-contrib:contrib into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3151	2026-07-26 15:45:08 +00:00
Shadow	0e683bf699	Issue #3061 Follow-up: Remove network tickler prefs	2026-07-26 15:39:39 +00:00
Moonchild	6459dec5bb	[DOM media] Perform more thorough checks on video regions.	2026-07-26 15:04:18 +02:00
az	0e930fba3f	Bug 2045742	2026-07-26 10:08:13 +02:00
Moonchild	3b683bbe59	Merge pull request 'Align aspect-ratio to spec' (#3150 ) from Basilisk-Dev/UXP-contrib:css-aspect-ratio into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3150	2026-07-26 07:06:00 +00:00
Basilisk-Dev	0042e54c38	Issue #2404 - Split aspect ratio enum types into a separate header to fix compilation issues	2026-07-25 12:24:15 -04:00
Andrew McCreight	e75201f7d1	Bug 2049523 - Make ToJSValue for float consistent with double.	2026-07-25 17:04:14 +02:00
Moonchild	28c47723b2	Fix comment (nit)	2026-07-25 16:12:08 +02:00
Randell Jesup	3d872ff7b0	Bug 2029734: Flush before calling sctp_process_init()	2026-07-25 14:52:29 +02:00
Moonchild	beb684c29e	No issue - Use `strnlen` instead of `strnlen_s`. Apparently, GCC doesn't like the _s variants.	2026-07-25 13:08:15 +02:00
Moonchild	775588b75d	[image] Make sure the image was fully and cleanly decoded before finalizing its animation state as complete.	2026-07-25 10:01:55 +02:00
Basilisk-Dev	8a2a5d837c	Issue #2404 - Fix aspect ratio sizing for grid items	2026-07-25 00:58:20 -04:00
Basilisk-Dev	8add755c81	Issue #2404 - Improvements to CSS aspect-ratio spec compliance	2026-07-25 00:57:58 -04:00
Moonchild	257c64567e	[parser] Associate image elements with form only if the form and the intended parent are in the same tree.	2026-07-24 21:12:04 +02:00
Moonchild	d0b61d4a68	No issue - CallUpdateWindow is [[nodiscard]], but we don't need to use the result here.	2026-07-24 19:29:00 +02:00
Moonchild	3b5f50cc35	Merge pull request 'No Issue - Remove the half-life experiment in HTTP cache' (#3149 ) from Shadow/UXP-contrib:master into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3149	2026-07-24 14:32:21 +00:00
Moonchild	27c6a7f477	[DOM media] Stop accepting audio samples with too low sample rates. This sets the floor to 8kHz audio, which is generally considered to be the lowest acceptable "phone quality"/"walkie-talkie" audio rate. Audio outside the range will refuse to decode after this commit and give a console error. This avoids a whole class of potential bugs.	2026-07-24 14:52:40 +02:00
Moonchild	c65f84214e	[layout] Add corner-case correctness check in DottedCornerFinder::FindBestOverlap.	2026-07-24 13:17:54 +02:00
Moonchild	a317c65fd7	[network] Add usrsctp TSN gap check.	2026-07-24 12:58:20 +02:00
Shadow	0ec35ce534	No Issue - Remove the half-life experiment in HTTP cache Reviewed-on: https://repo.palemoon.org/Shadow/UXP-contrib/pulls/1	2026-07-24 09:49:48 +00:00
Moonchild	bf0c040722	[js] Clamp length of regexp captures array for dollar substitution.	2026-07-22 22:37:50 +02:00
Moonchild	ebadd51401	[js] Initialize BaselineFrame return value slot in OnLeaveBaselineFrame.	2026-07-22 20:26:07 +02:00
Moonchild	5ed0bf8b44	[DOM] Make parser update form owner properly	2026-07-22 17:12:32 +02:00
Moonchild	f877c1dba5	[gfx] Hold a strong ref during GetFontAt lookup.	2026-07-22 10:27:53 +02:00
Moonchild	4c14f8f89b	[gfx] Add bounds checks and limit reverse scanning of ligature data.	2026-07-22 09:43:54 +02:00
Moonchild	c119728965	Merge pull request 'Implement CSSStyleSheet replaceSync' (#3145 ) from Basilisk-Dev/UXP-contrib:replacesync into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3145	2026-07-22 06:02:21 +00:00
Moonchild	fa55b9c2e8	[js] Guard against OOB string sizes in internal Printf	2026-07-22 01:39:03 +02:00
Basilisk-Dev	16aba76fc5	Issue #3144 - Implement CSSStyleSheet replaceSync	2026-07-21 04:23:19 -04:00
Moonchild	995def99cd	No issue - Exclude some files from the preprocessor that don't have directives in them.	2026-07-19 15:57:10 +02:00
Moonchild	923e52789c	Merge pull request 'Convert std::*<T>::value/::type to _v and _t suffixes.' (#3143 ) from 1803 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3143	2026-07-19 07:40:35 +00:00
Moonchild	22d945430b	Issue #3061 - Remove network tickler. Resolves #3061	2026-07-19 08:17:05 +02:00
Moonchild	65d7d93760	Issue #1803 - Convert std::*<T>::value/::type to _v and _t suffixes. This excludes uses in third-party libs in our tree.	2026-07-15 11:20:06 +02:00
Moonchild	dfd0ea4e8a	Merge pull request 'implement URL.parse()' (#3141 ) from Basilisk-Dev/UXP-contrib:urlparse into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3141	2026-07-14 21:05:40 +00:00
Basilisk-Dev	12a49709cb	Issue #3140 - implement URL.parse()	2026-07-14 16:07:45 -04:00
Moonchild	2a70c8a6f0	Merge pull request 'Implement CSS4 revert-layer keyword' (#3139 ) from Basilisk-Dev/UXP-contrib:revert-layer into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3139	2026-07-13 12:44:06 +00:00
Moonchild	1f639d78ca	Merge pull request 'Allow Skia on Mac OS X 10.5 Leopard / big endian PPC' (#3138 ) from Jazzzny/UXP:skia-leopard-ppc into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3138	2026-07-13 12:43:15 +00:00
Basilisk-Dev	65e8245153	Issue #2829 - Regenerate devtools CSS database for revert-layer	2026-07-11 10:41:52 -04:00
Basilisk-Dev	bce5dbad0b	Issue #2829 - Use layer index naming for revert-layer metadata	2026-07-11 10:41:46 -04:00
Basilisk-Dev	0b25b5f8db	Issue #2829 - Handle revert-layer variable fallbacks	2026-07-10 09:59:20 -04:00
Basilisk-Dev	7345874098	Issue #2829 - Implement CSS revert-layer cascade rollback	2026-07-10 09:59:14 -04:00
Basilisk-Dev	edb82fd1c9	Issue #2829 - Support revert-layer in CSS-wide parsing	2026-07-10 09:59:03 -04:00
Jazzzny	35ebdcac66	Fix build issues in Skia code	2026-07-09 12:32:44 -04:00
Jazzzny	a095661e86	Use Skia macros where appropriate	2026-07-08 13:43:07 -04:00
Jazzzny	205a0d66bb	Add support for big endian in Skia	2026-07-08 04:38:00 -04:00
Jazzzny	54945a0808	Unblock Skia for big endian	2026-07-08 04:38:00 -04:00
Jazzzny	84c1eedac6	Fixes for Skia on 10.5	2026-07-08 04:38:00 -04:00
Moonchild	ddf5d6256e	Whitespace fix	2026-07-03 09:24:24 +02:00
Moonchild	0eae777fd0	Issue #3132 Follow-up: only include gtk2xtbin.h on GTK targets. PR #3133 caused build breakage on non-gtk platforms by unconditionally including the header (because the def defaults to true in configure) This also reorganizes the configure script to add a check for MOZ_WIDGET_GTK (hoisted up a little) so the new configure entry is simply ignored on non-GTK targets.	2026-07-03 09:19:54 +02:00
Moonchild	b2594a4ace	Merge pull request 'Revert gtk file dialog change and set default to cancel' (#3137 ) from 3136 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3137	2026-06-30 13:54:19 +00:00
Moonchild	30e29845c4	Merge pull request 'Decouple NPAPI from GTK2' (#3133 ) from Basilisk-Dev/UXP-contrib:npapi-no-gtk2 into master Reviewed-on: https://repo.palemoon.org/MoonchildProductions/UXP/pulls/3133	2026-06-30 13:51:11 +00:00
Basilisk-Dev	d8662c5dd9	Issue #3132 - use ENABLE check for npapi gtk2 builds instead of a dedicated DISABLE check to match other config options	2026-06-30 09:15:45 -04:00
Basilisk-Dev	0a5e50a9fe	Issue #3132 - Resolve GTK3 ATK bridge dynamically	2026-06-26 13:49:15 -04:00
Basilisk-Dev	3f5b7ed020	Issue #3132 - Add GTK2 NPAPI build toggle	2026-06-26 13:09:49 -04:00
Moonchild	21743e0b7c	Issue #3120 - Clean up NSIS scripting. Removes Quicklaunch shortcut code, UAC guards (always supported on target OSes) and LSP guards (ditto). Resolves #3120	2026-06-13 12:19:53 +02:00