[layout] Prevent recursion of callbacks in PressShell.

- Reformat code for readability.
- Check allocations in _cairo_win32_printing_surface_paint_linear_pattern.

dom/base/DocumentOrShadowRoot.cpp

@@ -5,13 +5,19 @@
 
 #include "DocumentOrShadowRoot.h"
 #include "mozilla/EventStateManager.h"
+#include "mozilla/CSSStyleSheet.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/CSSStyleSheetBinding.h"
 #include "mozilla/dom/StyleSheetList.h"
+#include "mozilla/dom/ToJSValue.h"
 #include "nsDocument.h"
 #include "nsFocusManager.h"
 #include "ShadowRoot.h"
 #include "XULDocument.h"
 #include "nsLayoutUtils.h"
 #include "nsSVGUtils.h"
+#include "jsapi.h"
 
 class nsINode;
 class nsIDocument;
@@ -43,6 +49,99 @@ DocumentOrShadowRoot::EnsureDOMStyleSheets()
   return *mDOMStyleSheets;
 }
 
+void
+DocumentOrShadowRoot::GetAdoptedStyleSheets(
+    JSContext* aCx,
+    JS::MutableHandle<JSObject*> aResult,
+    ErrorResult& aRv) const
+{
+  JS::Rooted<JS::Value> value(aCx);
+  if (!ToJSValue(aCx, mAdoptedStyleSheets, &value)) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
+  MOZ_ASSERT(value.isObject());
+  aResult.set(&value.toObject());
+}
+
+void
+DocumentOrShadowRoot::SetAdoptedStyleSheets(
+    JSContext* aCx,
+    JS::Handle<JSObject*> aSheets,
+    ErrorResult& aRv)
+{
+  bool isArray = false;
+  if (!JS_IsArrayObject(aCx, aSheets, &isArray)) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  if (!isArray) {
+    aRv.ThrowTypeError<MSG_NOT_SEQUENCE>(
+      NS_LITERAL_STRING("DocumentOrShadowRoot.adoptedStyleSheets"));
+    return;
+  }
+
+  uint32_t length = 0;
+  if (!JS_GetArrayLength(aCx, aSheets, &length)) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsIDocument* document = AsNode().OwnerDoc();
+  nsTArray<RefPtr<CSSStyleSheet>> newSheets;
+  if (!newSheets.SetCapacity(length, fallible)) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
+  JS::Rooted<JS::Value> value(aCx);
+  for (uint32_t i = 0; i < length; ++i) {
+    if (!JS_GetElement(aCx, aSheets, i, &value)) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+
+    if (!value.isObject()) {
+      aRv.ThrowTypeError<MSG_DOES_NOT_IMPLEMENT_INTERFACE>(
+        NS_LITERAL_STRING("Element of DocumentOrShadowRoot.adoptedStyleSheets"),
+        NS_LITERAL_STRING("CSSStyleSheet"));
+      return;
+    }
+
+    RefPtr<CSSStyleSheet> sheet;
+    nsresult rv = UnwrapObject<prototypes::id::CSSStyleSheet,
+                               CSSStyleSheet>(&value.toObject(), sheet);
+    if (NS_FAILED(rv)) {
+      aRv.ThrowTypeError<MSG_DOES_NOT_IMPLEMENT_INTERFACE>(
+        NS_LITERAL_STRING("Element of DocumentOrShadowRoot.adoptedStyleSheets"),
+        NS_LITERAL_STRING("CSSStyleSheet"));
+      return;
+    }
+
+    if (!sheet->IsConstructed() || sheet->ConstructorDocument() != document) {
+      aRv.Throw(NS_ERROR_DOM_NOT_ALLOWED_ERR);
+      return;
+    }
+
+    newSheets.AppendElement(sheet);
+  }
+
+  nsTArray<RefPtr<CSSStyleSheet>> oldSheets;
+  oldSheets.SwapElements(mAdoptedStyleSheets);
+  mAdoptedStyleSheets.SwapElements(newSheets);
+
+  if (mKind == Kind::Document) {
+    static_cast<nsDocument&>(AsNode()).AdoptedStyleSheetsChanged(oldSheets,
+                                                                 mAdoptedStyleSheets);
+    return;
+  }
+
+  static_cast<ShadowRoot&>(AsNode()).AdoptedStyleSheetsChanged(oldSheets,
+                                                              mAdoptedStyleSheets);
+}
+
 Element*
 DocumentOrShadowRoot::GetElementById(const nsAString& aElementId)
 {

dom/base/DocumentOrShadowRoot.h

@@ -11,11 +11,14 @@
 #include "nsContentListDeclarations.h"
 #include "nsNameSpaceManager.h"
 #include "mozilla/dom/NameSpaceConstants.h"
+#include "js/RootingAPI.h"
 
 class nsContentList;
 class nsINode;
 
 namespace mozilla {
+class CSSStyleSheet;
+class ErrorResult;
 class StyleSheet;
 
 namespace dom {
@@ -83,6 +86,18 @@ public:
 
   StyleSheetList& EnsureDOMStyleSheets();
 
+  void GetAdoptedStyleSheets(JSContext* aCx,
+                             JS::MutableHandle<JSObject*> aResult,
+                             mozilla::ErrorResult& aRv) const;
+  void SetAdoptedStyleSheets(JSContext* aCx,
+                             JS::Handle<JSObject*> aSheets,
+                             mozilla::ErrorResult& aRv);
+
+  const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& AdoptedStyleSheets() const
+  {
+    return mAdoptedStyleSheets;
+  }
+
   Element* GetElementById(const nsAString& aElementId);
 
   /**
@@ -151,6 +166,7 @@ protected:
   Element* GetRetargetedFocusedElement();
 
   nsTArray<RefPtr<mozilla::StyleSheet>> mStyleSheets;
+  nsTArray<RefPtr<mozilla::CSSStyleSheet>> mAdoptedStyleSheets;
   RefPtr<mozilla::dom::StyleSheetList> mDOMStyleSheets;
 
   /*

dom/base/ShadowRoot.cpp

@@ -18,6 +18,7 @@
 #include "mozilla/dom/StyleSheetList.h"
 #include "nsXBLPrototypeBinding.h"
 #include "mozilla/BasicEvents.h"
+#include "mozilla/CSSStyleSheet.h"
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/StyleSheet.h"
 #include "mozilla/StyleSheetInlines.h"
@@ -30,6 +31,7 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(ShadowRoot)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(ShadowRoot,
                                                   DocumentFragment)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDOMStyleSheets)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAdoptedStyleSheets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAssociatedBinding)
   for (auto iter = tmp->mIdentifierMap.ConstIter(); !iter.Done();
        iter.Next()) {
@@ -42,6 +44,10 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(ShadowRoot)
     tmp->GetHost()->RemoveMutationObserver(tmp);
   }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)
+  for (CSSStyleSheet* sheet : tmp->mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(tmp);
+  }
+  tmp->mAdoptedStyleSheets.Clear();
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mAssociatedBinding)
   tmp->mIdentifierMap.Clear();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END_INHERITED(DocumentFragment)
@@ -90,6 +96,11 @@ ShadowRoot::~ShadowRoot()
     host->RemoveMutationObserver(this);
   }
 
+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(this);
+  }
+  mAdoptedStyleSheets.Clear();
+
   UnsetFlags(NODE_IS_IN_SHADOW_TREE);
 
   // nsINode destructor expects mSubtreeRoot == this.
@@ -270,15 +281,20 @@ ShadowRoot::InsertSheet(StyleSheet* aSheet,
 
   linkingElement->SetStyleSheet(aSheet); // This sets the ownerNode on the sheet
 
-  MOZ_DIAGNOSTIC_ASSERT(mProtoBinding->SheetCount() == DocumentOrShadowRoot::SheetCount());
+  MOZ_DIAGNOSTIC_ASSERT(mProtoBinding->SheetCount() ==
+                        DocumentOrShadowRoot::SheetCount() +
+                        mAdoptedStyleSheets.Length());
 #ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
-  // FIXME(emilio, bug 1425759): For now we keep them duplicated, the proto
-  // binding will disappear soon (tm).
+  // FIXME(emilio, bug 1425759): For now we keep regular sheets duplicated;
+  // adopted sheets are stored as a suffix on the proto binding only.
   {
     size_t i = 0;
     for (RefPtr<StyleSheet>& sheet : mStyleSheets) {
       MOZ_DIAGNOSTIC_ASSERT(sheet.get() == mProtoBinding->StyleSheetAt(i++));
     }
+    for (RefPtr<CSSStyleSheet>& sheet : mAdoptedStyleSheets) {
+      MOZ_DIAGNOSTIC_ASSERT(sheet.get() == mProtoBinding->StyleSheetAt(i++));
+    }
   }
 #endif
 
@@ -287,7 +303,7 @@ ShadowRoot::InsertSheet(StyleSheet* aSheet,
   for (size_t i = 0; i <= SheetCount(); i++) {
     if (i == SheetCount()) {
       AppendStyleSheet(*aSheet);
-      mProtoBinding->AppendStyleSheet(aSheet);
+      mProtoBinding->InsertStyleSheetAt(i, aSheet);
       break;
     }
 
@@ -322,6 +338,39 @@ ShadowRoot::RemoveSheet(StyleSheet* aSheet)
   }
 }
 
+void
+ShadowRoot::AdoptedStyleSheetsChanged(
+    const nsTArray<RefPtr<CSSStyleSheet>>& aOldSheets,
+    const nsTArray<RefPtr<CSSStyleSheet>>& aNewSheets)
+{
+  OwnerDoc()->BeginUpdate(UPDATE_STYLE);
+
+  bool applicableChange = false;
+  for (size_t i = 0; i < aOldSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aOldSheets[i];
+    if (aOldSheets.IndexOf(sheet) == i) {
+      mProtoBinding->RemoveStyleSheet(sheet);
+    }
+    applicableChange = applicableChange || sheet->IsApplicable();
+    sheet->RemoveAdopter(this);
+  }
+
+  for (size_t i = 0; i < aNewSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aNewSheets[i];
+    sheet->AddAdopter(this);
+    if (aNewSheets.IndexOf(sheet) == i) {
+      mProtoBinding->AppendStyleSheet(sheet);
+    }
+    applicableChange = applicableChange || sheet->IsApplicable();
+  }
+
+  if (applicableChange) {
+    StyleSheetChanged();
+  }
+
+  OwnerDoc()->EndUpdate(UPDATE_STYLE);
+}
+
 void
 ShadowRoot::AddToIdTable(Element* aElement, nsIAtom* aId)
 {

dom/base/ShadowRoot.h

@@ -21,6 +21,7 @@ class nsXBLPrototypeBinding;
 
 namespace mozilla {
 
+class CSSStyleSheet;
 class EventChainPreVisitor;
 
 namespace dom {
@@ -59,6 +60,9 @@ public:
   // [deprecated] Shadow DOM v0
   void InsertSheet(StyleSheet* aSheet, nsIContent* aLinkingContent);
   void RemoveSheet(StyleSheet* aSheet);
+  void AdoptedStyleSheetsChanged(
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aOldSheets,
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aNewSheets);
   StyleSheetList* StyleSheets()
   {
     return &DocumentOrShadowRoot::EnsureDOMStyleSheets();
@@ -173,4 +177,3 @@ protected:
 } // namespace mozilla
 
 #endif // mozilla_dom_shadowroot_h__
-

dom/base/nsDocument.cpp

@@ -13,6 +13,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/AutoRestore.h"
 #include "mozilla/BinarySearch.h"
+#include "mozilla/CSSStyleSheet.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/EffectSet.h"
 #include "mozilla/IntegerRange.h"
@@ -1402,6 +1403,10 @@ nsDocument::~nsDocument()
   for (StyleSheet* sheet : mStyleSheets) {
     sheet->ClearAssociatedDocument();
   }
+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(this);
+  }
+  mAdoptedStyleSheets.Clear();
   for (auto& sheets : mAdditionalSheets) {
     for (StyleSheet* sheet : sheets) {
     sheet->ClearAssociatedDocument();
@@ -1635,6 +1640,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
 
   // Traverse all our nsCOMArrays.
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleSheets)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAdoptedStyleSheets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOnDemandBuiltInUASheets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPreloadingImages)
 
@@ -1740,6 +1746,11 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)
 
+  for (CSSStyleSheet* sheet : tmp->mAdoptedStyleSheets) {
+    sheet->RemoveAdopter(tmp);
+  }
+  tmp->mAdoptedStyleSheets.Clear();
+
   if (tmp->mStyleSheetSetList) {
     tmp->mStyleSheetSetList->Disconnect();
     tmp->mStyleSheetSetList = nullptr;
@@ -2205,6 +2216,12 @@ nsDocument::FillStyleSet(nsStyleSet* aStyleSet)
   AppendSheetsToStyleSet(aStyleSet, mAdditionalSheets[eAuthorSheet],
                          SheetType::Doc);
 
+  for (CSSStyleSheet* sheet : mAdoptedStyleSheets) {
+    if (sheet->IsApplicable()) {
+      aStyleSet->AppendStyleSheet(SheetType::Doc, sheet);
+    }
+  }
+
   mStyleSetFilled = true;
 }
 
@@ -3872,6 +3889,37 @@ nsDocument::RemoveStyleSheetFromStyleSets(StyleSheet* aSheet)
   }
 }
 
+void
+nsDocument::AdoptedStyleSheetsChanged(
+    const nsTArray<RefPtr<CSSStyleSheet>>& aOldSheets,
+    const nsTArray<RefPtr<CSSStyleSheet>>& aNewSheets)
+{
+  BeginUpdate(UPDATE_STYLE);
+
+  nsCOMPtr<nsIPresShell> shell = GetShell();
+  nsStyleSet* styleSet = shell ? shell->StyleSet() : nullptr;
+
+  for (size_t i = 0; i < aOldSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aOldSheets[i];
+    if (styleSet && sheet->IsApplicable() &&
+        aOldSheets.IndexOf(sheet) == i) {
+      styleSet->RemoveStyleSheet(SheetType::Doc, sheet);
+    }
+    sheet->RemoveAdopter(this);
+  }
+
+  for (size_t i = 0; i < aNewSheets.Length(); ++i) {
+    CSSStyleSheet* sheet = aNewSheets[i];
+    sheet->AddAdopter(this);
+    if (styleSet && sheet->IsApplicable() &&
+        aNewSheets.IndexOf(sheet) == i) {
+      styleSet->AppendStyleSheet(SheetType::Doc, sheet);
+    }
+  }
+
+  EndUpdate(UPDATE_STYLE);
+}
+
 void
 nsDocument::RemoveStyleSheet(StyleSheet* aSheet)
 {
@@ -3961,6 +4009,18 @@ nsDocument::SetStyleSheetApplicableState(StyleSheet* aSheet,
     } else {
       RemoveStyleSheetFromStyleSets(aSheet);
     }
+  } else if (mAdoptedStyleSheets.IndexOf(aSheet->AsConcrete()) !=
+             mAdoptedStyleSheets.NoIndex) {
+    nsCOMPtr<nsIPresShell> shell = GetShell();
+    if (shell) {
+      if (aApplicable) {
+        shell->StyleSet()->AppendStyleSheet(SheetType::Doc,
+                                            aSheet->AsConcrete());
+      } else {
+        shell->StyleSet()->RemoveStyleSheet(SheetType::Doc,
+                                            aSheet->AsConcrete());
+      }
+    }
   }
 
   // We have to always notify, since this will be called for sheets

dom/base/nsDocument.h

@@ -95,6 +95,7 @@ class nsISecurityConsoleMessage;
 class nsPIBoxObject;
 
 namespace mozilla {
+class CSSStyleSheet;
 class EventChainPreVisitor;
 namespace dom {
 class BoxObject;
@@ -471,6 +472,9 @@ public:
       nsTArray<RefPtr<mozilla::StyleSheet>>& aNewSheets) override;
   virtual void AddStyleSheetToStyleSets(mozilla::StyleSheet* aSheet);
   virtual void RemoveStyleSheetFromStyleSets(mozilla::StyleSheet* aSheet);
+  void AdoptedStyleSheetsChanged(
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aOldSheets,
+      const nsTArray<RefPtr<mozilla::CSSStyleSheet>>& aNewSheets);
 
   virtual void InsertStyleSheetAt(mozilla::StyleSheet* aSheet,
                                   size_t aIndex) override;

dom/base/nsGlobalWindow.cpp

@@ -6162,7 +6162,6 @@ nsGlobalWindow::CheckSecurityWidthAndHeight(int32_t* aWidth, int32_t* aHeight, b
   // This one is easy. Just ensure the variable is greater than 100;
   if ((aWidth && *aWidth < 100) || (aHeight && *aHeight < 100)) {
     // Check security state for use in determing window dimensions
-
     if (!nsContentUtils::IsCallerChrome()) {
       //sec check failed
       if (aWidth && *aWidth < 100) {
@@ -6173,6 +6172,21 @@ nsGlobalWindow::CheckSecurityWidthAndHeight(int32_t* aWidth, int32_t* aHeight, b
       }
     }
   }
+  
+  // Check for the screen dimensions and keep the size in the range of the
+  // screen size the window is on. We allow twice the screen size because the
+  // size we get for a screen is not always accurate, on Wayland in particular,
+  // and all we need is to keep the size in a reasonable range.
+  nsCOMPtr<nsIDOMScreen> screen = GetScreen();
+  int32_t screenWidth, screenHeight;
+  screen->GetAvailWidth(&screenWidth);
+  screen->GetAvailHeight(&screenHeight);
+  if (aWidth && *aWidth > 2 * screenWidth) {
+    *aWidth = 2 * screenWidth;
+  }
+  if (aHeight && *aHeight > 2 * screenHeight) {
+    *aHeight = 2 * screenHeight;
+  }  
 }
 
 // NOTE: Arguments to this function should have values in device pixels
@@ -8091,8 +8105,10 @@ nsGlobalWindow::ResizeByOuter(int32_t aWidthDif, int32_t aHeightDif,
 
   nsIntSize cssSize(DevToCSSIntPixels(nsIntSize(width, height)));
 
-  cssSize.width += aWidthDif;
-  cssSize.height += aHeightDif;
+  // The deltas come from content and can be large enough to overflow a 32-bit
+  // add, so do the arithmetic in 64 bits and keep the result in range.
+  cssSize.width = int32_t(std::clamp<int64_t>(int64_t(cssSize.width) + aWidthDif, 0, INT32_MAX));
+  cssSize.height = int32_t(std::clamp<int64_t>(int64_t(cssSize.height) + aHeightDif, 0, INT32_MAX));
 
   CheckSecurityWidthAndHeight(&cssSize.width, &cssSize.height, aCallerIsChrome);
 

dom/base/nsIDocumentInlines.h

@@ -46,6 +46,9 @@ nsIDocument::FindDocStyleSheetInsertionPoint(
           break;
         }
       }
+      if (sheet->IsConstructed()) {
+        break;
+      }
       if (sheet == GetFirstAdditionalAuthorSheet()) {
         break;
       }

dom/webidl/DocumentOrShadowRoot.webidl

@@ -18,6 +18,8 @@ interface mixin DocumentOrShadowRoot {
 
   readonly attribute Element? activeElement;
   readonly attribute StyleSheetList styleSheets;
+  [Throws]
+  attribute object adoptedStyleSheets;
 
   readonly attribute Element? pointerLockElement;
   [LenientSetter, Func="nsDocument::IsUnprefixedFullscreenEnabled"]

gfx/layers/ImageContainer.cpp

@@ -632,9 +632,13 @@ NVImage::GetAsSourceSurface()
 
   // Convert the current NV12 or NV21 data to YUV420P so that we can follow the
   // logics in PlanarYCbCrImage::GetAsSourceSurface().
-  const int bufferLength = mData.mYSize.height * mData.mYStride +
-                           mData.mCbCrSize.height * mData.mCbCrSize.width * 2;
-  uint8_t* buffer = new uint8_t[bufferLength];
+  auto bufferLength = CheckedInt<uint32_t>(mData.mYSize.height) * mData.mYStride +
+                      CheckedInt<uint32_t>(mData.mCbCrSize.height) * mData.mCbCrSize.width * 2;
+  if (!bufferLength.isValid()) {
+    NS_ERROR("Image buffer length exceeds integer limits.");
+    return nullptr;
+  }
+  uint8_t* buffer = new uint8_t[bufferLength.value()];
 
   Data aData = mData;
   aData.mCbCrStride = aData.mCbCrSize.width;

gfx/thebes/gfxFontUtils.cpp

@@ -587,8 +587,9 @@ gfxFontUtils::MapCharToGlyphFormat4(const uint8_t* aBuf, uint32_t aLength,
     const AutoSwap_PRUint16* idDelta = &startCodes[segCount];
     const AutoSwap_PRUint16* idRangeOffset = &idDelta[segCount];
 
-    // Sanity-check that the fixed-size arrays don't exceed the buffer.
-    const uint8_t* const limit = aBuf + aLength;
+    // Sanity-check that the fixed-size arrays don't exceed the buffer or the
+    // current subtable.
+    const uint8_t* const limit = aBuf + std::min(aLength, uint32_t(cmap4->length));
     if ((const uint8_t*)(&idRangeOffset[segCount]) > limit) {
         return 0; // broken font, just bail out safely
     }

gfx/thebes/gfxTextRun.cpp

@@ -2761,7 +2761,7 @@ gfxFontGroup::FindFontForChar(uint32_t aCh, uint32_t aPrevCh, uint32_t aNextCh,
                     ufe->Load();
                     ff.CheckState(mSkipDrawing);
                 }
-                gfxFontEntry* pfe = ufe->GetPlatformFontEntry();
+                RefPtr<gfxFontEntry> pfe = ufe->GetPlatformFontEntry();
                 if (pfe && pfe->HasCharacter(aCh)) {
                     font = GetFontAt(i, aCh);
                     if (font) {

gfx/thebes/gfxUserFontSet.cpp

@@ -44,7 +44,8 @@ class ExpandingMemoryStream : public ots::OTSStream {
 public:
     ExpandingMemoryStream(size_t initial, size_t limit)
         : mLength(initial), mLimit(limit), mOff(0) {
-        mPtr = moz_xmalloc(mLength);
+        mPtr = moz_xmalloc(initial);
+        std::memset(mPtr, 0, initial);
     }
 
     ~ExpandingMemoryStream() {
@@ -74,6 +75,7 @@ public:
                 newLength = mLimit;
             }
             mPtr = moz_xrealloc(mPtr, newLength);
+            std::memset(static_cast<char*>(mPtr) + mLength, 0, newLength - mLength);
             mLength = newLength;
             return WriteRaw(data, length);
         }

js/public/Value.h

@@ -238,16 +238,21 @@ static inline JS::Value PoisonedObjectValue(JSObject* obj);
 namespace detail {
 
 constexpr int CanonicalizedNaNSignBit = 0;
-#if defined(__mips__) && !defined(__mips_nan2008)
-constexpr uint64_t CanonicalizedNaNSignificand = 0x7FFFFFFFFFFFFULL;
-#else
 constexpr uint64_t CanonicalizedNaNSignificand = 0x8000000000000ULL;
-#endif
 
+// A legacy MIPS ABI can run on hardware whose native NaN encoding does not
+// match the encoding selected by the compiler. Determine the canonical NaN
+// from an actual floating-point operation during JS initialization.
+#if defined(__mips__) && !defined(__mips_nan2008) && \
+    !defined(__mips_nan_2008)
+# define JS_RUNTIME_CANONICAL_NAN
+extern JS_PUBLIC_DATA(uint64_t) CanonicalizedNaNBits;
+#else
 constexpr uint64_t CanonicalizedNaNBits =
     mozilla::SpecificNaNBits<double,
                              detail::CanonicalizedNaNSignBit,
                              detail::CanonicalizedNaNSignificand>::value;
+#endif
 
 } // namespace detail
 
@@ -260,8 +265,7 @@ constexpr uint64_t CanonicalizedNaNBits =
 static MOZ_ALWAYS_INLINE double
 GenericNaN()
 {
-  return mozilla::SpecificNaN<double>(detail::CanonicalizedNaNSignBit,
-                                      detail::CanonicalizedNaNSignificand);
+  return mozilla::BitwiseCast<double>(detail::CanonicalizedNaNBits);
 }
 
 /* MSVC with PGO miscompiles this function. */
@@ -355,6 +359,11 @@ class MOZ_NON_PARAM alignas(8) Value
     }
 
     void setDouble(double d) {
+#if defined(JS_RUNTIME_CANONICAL_NAN) && defined(JS_PUNBOX64)
+        // A non-canonical NaN can overlap the punbox64 tag space. Normalize
+        // it before storing it so it cannot be mistaken for a GC pointer.
+        d = CanonicalizeNaN(d);
+#endif
         // Don't assign to data.asDouble to fix a miscompilation with
         // GCC 5.2.1 and 5.3.1. See bug 1312488.
         data = layout(d);

js/src/jit/MacroAssembler.h

@@ -902,8 +902,8 @@ class MacroAssembler : public MacroAssemblerSpecific
 
     inline void rotateLeft(Imm32 count, Register input, Register dest) PER_SHARED_ARCH;
     inline void rotateLeft(Register count, Register input, Register dest) PER_SHARED_ARCH;
-    inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
-    inline void rotateLeft64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
+    inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
+    inline void rotateLeft64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
     inline void rotateLeft64(Imm32 count, Register64 input, Register64 dest, Register temp)
         DEFINED_ON(x86, x64, arm, mips32, mips64, loongarch64);
     inline void rotateLeft64(Register count, Register64 input, Register64 dest, Register temp)
@@ -911,8 +911,8 @@ class MacroAssembler : public MacroAssemblerSpecific
 
     inline void rotateRight(Imm32 count, Register input, Register dest) PER_SHARED_ARCH;
     inline void rotateRight(Register count, Register input, Register dest) PER_SHARED_ARCH;
-    inline void rotateRight64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
-    inline void rotateRight64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, loongarch64);
+    inline void rotateRight64(Imm32 count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
+    inline void rotateRight64(Register count, Register64 input, Register64 dest) DEFINED_ON(x64, mips64, loongarch64);
     inline void rotateRight64(Imm32 count, Register64 input, Register64 dest, Register temp)
         DEFINED_ON(x86, x64, arm, mips32, mips64, loongarch64);
     inline void rotateRight64(Register count, Register64 input, Register64 dest, Register temp)

js/src/jit/mips-shared/MacroAssembler-mips-shared-inl.h

@@ -874,6 +874,13 @@ MacroAssembler::branchTestSymbol(Condition cond, Register tag, Label* label)
     ma_b(tag, ImmTag(JSVAL_TAG_SYMBOL), label, cond);
 }
 
+void
+MacroAssembler::branchTestBigInt(Condition cond, Register tag, Label* label)
+{
+    MOZ_ASSERT(cond == Equal || cond == NotEqual);
+    ma_b(tag, ImmTag(JSVAL_TAG_BIGINT), label, cond);
+}
+
 void
 MacroAssembler::branchTestSymbol(Condition cond, const BaseIndex& address, Label* label)
 {

js/src/jit/mips64/CodeGenerator-mips64.cpp

@@ -614,6 +614,25 @@ CodeGeneratorMIPS64::visitExtendInt32ToInt64(LExtendInt32ToInt64* lir)
         masm.ma_sll(output, ToRegister(input), Imm32(0));
 }
 
+void
+CodeGeneratorMIPS64::visitSignExtendInt64(LSignExtendInt64* lir)
+{
+    Register64 input = ToRegister64(lir->getInt64Operand(0));
+    Register64 output = ToOutRegister64(lir);
+
+    switch (lir->mode()) {
+      case MSignExtendInt64::Byte:
+        masm.move8SignExtend(input.reg, output.reg);
+        break;
+      case MSignExtendInt64::Half:
+        masm.move16SignExtend(input.reg, output.reg);
+        break;
+      case MSignExtendInt64::Word:
+        masm.ma_sll(output.reg, input.reg, Imm32(0));
+        break;
+    }
+}
+
 void
 CodeGeneratorMIPS64::visitWrapInt64ToInt32(LWrapInt64ToInt32* lir)
 {

js/src/jit/mips64/CodeGenerator-mips64.h

@@ -62,6 +62,7 @@ class CodeGeneratorMIPS64 : public CodeGeneratorMIPSShared
     void visitWasmReinterpretFromI64(LWasmReinterpretFromI64* lir);
     void visitWasmReinterpretToI64(LWasmReinterpretToI64* lir);
     void visitExtendInt32ToInt64(LExtendInt32ToInt64* lir);
+    void visitSignExtendInt64(LSignExtendInt64* lir);
     void visitWrapInt64ToInt32(LWrapInt64ToInt32* lir);
     void visitClzI64(LClzI64* lir);
     void visitCtzI64(LCtzI64* lir);

js/src/jit/mips64/Lowering-mips64.cpp

@@ -184,3 +184,9 @@ LIRGeneratorMIPS64::visitRandom(MRandom* ins)
                                         temp());
     defineFixed(lir, ins, LFloatReg(ReturnDoubleReg));
 }
+
+void
+LIRGeneratorMIPS64::visitSignExtendInt64(MSignExtendInt64* ins)
+{
+    defineInt64(new(alloc()) LSignExtendInt64(useInt64RegisterAtStart(ins->input())), ins);
+}

js/src/jit/mips64/Lowering-mips64.h

@@ -46,6 +46,7 @@ class LIRGeneratorMIPS64 : public LIRGeneratorMIPSShared
     void visitUnbox(MUnbox* unbox);
     void visitReturn(MReturn* ret);
     void visitRandom(MRandom* ins);
+    void visitSignExtendInt64(MSignExtendInt64* ins);
 };
 
 typedef LIRGeneratorMIPS64 LIRGeneratorSpecific;

js/src/jit/mips64/MacroAssembler-mips64-inl.h

@@ -364,6 +364,18 @@ MacroAssembler::rshift64Arithmetic(Register shift, Register64 dest)
 // ===============================================================
 // Rotation functions
 
+void
+MacroAssembler::rotateLeft64(Imm32 count, Register64 src, Register64 dest)
+{
+    rotateLeft64(count, src, dest, InvalidReg);
+}
+
+void
+MacroAssembler::rotateLeft64(Register count, Register64 src, Register64 dest)
+{
+    rotateLeft64(count, src, dest, InvalidReg);
+}
+
 void
 MacroAssembler::rotateLeft64(Imm32 count, Register64 src, Register64 dest, Register temp)
 {
@@ -382,6 +394,18 @@ MacroAssembler::rotateLeft64(Register count, Register64 src, Register64 dest, Re
     ma_drol(dest.reg, src.reg, count);
 }
 
+void
+MacroAssembler::rotateRight64(Imm32 count, Register64 src, Register64 dest)
+{
+    rotateRight64(count, src, dest, InvalidReg);
+}
+
+void
+MacroAssembler::rotateRight64(Register count, Register64 src, Register64 dest)
+{
+    rotateRight64(count, src, dest, InvalidReg);
+}
+
 void
 MacroAssembler::rotateRight64(Imm32 count, Register64 src, Register64 dest, Register temp)
 {

js/src/jit/mips64/MacroAssembler-mips64.cpp

@@ -1497,17 +1497,17 @@ MacroAssemblerMIPS64Compat::unboxSymbol(Register src, Register dest)
 
 void MacroAssemblerMIPS64Compat::unboxBigInt(const ValueOperand& operand, Register dest)
 {
-  unboxNonDouble(operand, dest, JSVAL_TYPE_BIGINT);
+  unboxNonDouble(operand, dest);
 }
 
 void MacroAssemblerMIPS64Compat::unboxBigInt(Register src, Register dest)
 {
-  unboxNonDouble(src, dest, JSVAL_TYPE_BIGINT);
+  ma_dext(dest, src, Imm32(0), Imm32(JSVAL_TAG_SHIFT));
 }
 
 void MacroAssemblerMIPS64Compat::unboxBigInt(const Address& src, Register dest)
 {
-  unboxNonDouble(src, dest, JSVAL_TYPE_BIGINT);
+  unboxNonDouble(src, dest);
 }
 
 void
@@ -1559,6 +1559,11 @@ MacroAssemblerMIPS64Compat::unboxPrivate(const ValueOperand& src, Register dest)
 void
 MacroAssemblerMIPS64Compat::boxDouble(FloatRegister src, const ValueOperand& dest)
 {
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+    // Legacy-ABI MIPS hardware can produce NaN payloads that overlap the
+    // punbox64 tag space. Normalize them before creating a JS::Value.
+    asMasm().canonicalizeDouble(src);
+#endif
     as_dmfc1(dest.valueReg(), src);
 }
 

js/src/jit/mips64/SharedIC-mips64.cpp

@@ -173,6 +173,18 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler& masm)
         masm.neg32(ExtractTemp0);
         masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
         break;
+      case JSOP_INC: {
+        masm.unboxInt32(R0, ExtractTemp0);
+        masm.ma_addTestOverflow(ExtractTemp0, ExtractTemp0, Imm32(1), &failure);
+        masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
+        break;
+      }
+      case JSOP_DEC: {
+        masm.unboxInt32(R0, ExtractTemp0);
+        masm.ma_subTestOverflow(ExtractTemp0, ExtractTemp0, Imm32(1), &failure);
+        masm.tagValue(JSVAL_TYPE_INT32, ExtractTemp0, R0);
+        break;
+      }
       default:
         MOZ_CRASH("Unexpected op");
         return false;

js/src/jsprf.cpp

@@ -312,7 +312,13 @@ cvt_s(SprintfState* ss, const char* s, int width, int prec, int flags)
         s = generic_null_str(s);
 
     // Limit string length by precision value
-    size_t slen = strnlen(s, size_t(prec));
+    // We'd want to use strnlen() here, but it is not supported by all targets
+    // (Most notably old OS X), so use memchr instead.
+    // Replace with `size_t slen = strnlen(s, size_t(prec));` once we no longer
+    // need to cater to this.
+    const char* sptr = (const char*)memchr(s, 0, size_t(prec));
+    size_t slen = sptr ? sptr - s : size_t(prec);
+    
     if (slen > INT_MAX) {
         return false;
     }

js/src/vm/Initialization.cpp

@@ -8,6 +8,8 @@
 #include "js/Initialization.h"
 
 #include "mozilla/Assertions.h"
+#include "mozilla/Casting.h"
+#include "mozilla/FloatingPoint.h"
 
 #include <ctype.h>
 
@@ -19,6 +21,7 @@
 #include "jit/ExecutableAllocator.h"
 #include "jit/Ion.h"
 #include "js/Utility.h"
+#include "js/Value.h"
 #include "unicode/uclean.h"
 #include "unicode/utypes.h"
 #include "vm/DateTime.h"
@@ -34,6 +37,31 @@ using js::FutexRuntime;
 
 InitState JS::detail::libraryInitState;
 
+// MIPS-specific
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+namespace JS {
+namespace detail {
+JS_PUBLIC_DATA(uint64_t) CanonicalizedNaNBits;
+} // namespace detail
+} // namespace JS
+
+// MIPS-specific
+static void
+SetupCanonicalNaN()
+{
+    // Use a real hardware operation. A legacy MIPS ABI can run on hardware
+    // whose NaN behavior does not match the compiler's predefined NAN value.
+    volatile double infinity = mozilla::PositiveInfinity<double>();
+    volatile double hardwareNaN = infinity - infinity;
+    uint64_t hardwareNaNBits = mozilla::BitwiseCast<uint64_t>(hardwareNaN);
+    hardwareNaNBits &= ~mozilla::FloatingPoint<double>::kSignBit;
+
+    // The selected NaN must remain a double in the JS::Value representation.
+    MOZ_RELEASE_ASSERT(JS::Value::fromRawBits(hardwareNaNBits).isDouble());
+    JS::detail::CanonicalizedNaNBits = hardwareNaNBits;
+}
+#endif
+
 #ifdef DEBUG
 static unsigned
 MessageParameterCount(const char* format)
@@ -76,6 +104,11 @@ JS::detail::InitWithFailureDiagnostic(bool isDebugBuild)
     MOZ_ASSERT(!JSRuntime::hasLiveRuntimes(),
                "how do we have live runtimes before JS_Init?");
 
+// MIPS-specific
+#if defined(JS_RUNTIME_CANONICAL_NAN)
+    SetupCanonicalNaN();
+#endif
+
     PRMJ_NowInit();
 
     // The first invocation of `ProcessCreation` creates a temporary thread

layout/base/nsPresShell.cpp

@@ -8938,7 +8938,11 @@ PresShell::DidDoReflow(bool aInterruptible)
 {
   mFrameConstructor->EndUpdate();
 
-  HandlePostedReflowCallbacks(aInterruptible);
+  if (!mHandlingCallbacks) {
+    mHandlingCallbacks = true; // Prevent recursion
+    HandlePostedReflowCallbacks(aInterruptible);
+    mHandlingCallbacks = false;
+  }
 
   nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
   if (docShell) {

layout/base/nsPresShell.h

@@ -926,6 +926,8 @@ protected:
 
   bool                      mAsyncResizeTimerIsActive : 1;
   bool                      mInResize : 1;
+  
+  bool                      mHandlingCallbacks : 1;
 
   bool                      mApproximateFrameVisibilityVisited : 1;
 

layout/style/CSSStyleSheet.cpp

@@ -1781,6 +1781,7 @@ CSSStyleSheet::DidDirty()
   MOZ_ASSERT(!mInner->mComplete || mDirty,
              "caller must have called WillDirty()");
   ClearRuleCascades();
+  NotifyAdopterRuleChanged();
 }
 
 void
@@ -1877,6 +1878,11 @@ CSSStyleSheet::InsertRuleInternal(const nsAString& aRule,
   // Hierarchy checking.
   int32_t newType = rule->GetType();
 
+  if (IsConstructed() && newType == css::Rule::IMPORT_RULE) {
+    aRv.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return 0;
+  }
+
   // check that we're not inserting before a charset rule
   css::Rule* nextRule = mInner->mOrderedRules.SafeObjectAt(aIndex);
   if (nextRule) {

layout/style/StyleSheet.cpp

@@ -28,6 +28,7 @@ StyleSheet::StyleSheet(css::SheetParsingMode aParsingMode)
   , mDisabled(false)
   , mConstructed(false)
   , mDisallowModification(false)
+  , mAdoptionCount(0)
   , mDocumentAssociationMode(NotOwnedByDocument)
 {
 }
@@ -42,6 +43,7 @@ StyleSheet::StyleSheet(const StyleSheet& aCopy,
   , mDisabled(aCopy.mDisabled)
   , mConstructed(aCopy.mConstructed)
   , mDisallowModification(false)
+  , mAdoptionCount(0)
     // We only use this constructor during cloning.  It's the cloner's
     // responsibility to notify us if we end up being owned by a document.
   , mDocumentAssociationMode(NotOwnedByDocument)
@@ -58,7 +60,7 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTING_ADDREF(StyleSheet)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(StyleSheet)
 
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(StyleSheet)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(StyleSheet, mConstructorDocument)
 
 mozilla::dom::CSSStyleSheetParsingMode
 StyleSheet::ParsingModeDOM()
@@ -259,10 +261,69 @@ StyleSheet::Constructor(const GlobalObject& aGlobal, ErrorResult& aRv)
   sheet->SetPrincipal(principal);
   sheet->SetComplete();
   sheet->SetConstructed();
+  sheet->SetConstructorDocument(document);
 
   return sheet.forget();
 }
 
+void
+StyleSheet::AddAdopter(nsIDocument* aDocument)
+{
+  MOZ_ASSERT(IsConstructed());
+  MOZ_ASSERT(aDocument);
+  MOZ_ASSERT(ConstructorDocument() == aDocument);
+
+  if (mAdoptionCount++ == 0) {
+    SetAssociatedDocument(aDocument, NotOwnedByDocument);
+  }
+}
+
+void
+StyleSheet::AddAdopter(dom::ShadowRoot* aShadowRoot)
+{
+  MOZ_ASSERT(aShadowRoot);
+
+  mAdopterShadowRoots.AppendElement(aShadowRoot);
+  AddAdopter(aShadowRoot->OwnerDoc());
+}
+
+void
+StyleSheet::RemoveAdopter(nsIDocument* aDocument)
+{
+  MOZ_ASSERT(IsConstructed());
+  MOZ_ASSERT(aDocument);
+  MOZ_ASSERT(ConstructorDocument() == aDocument);
+  MOZ_ASSERT(mAdoptionCount > 0);
+
+  if (mAdoptionCount == 0) {
+    return;
+  }
+
+  if (--mAdoptionCount == 0 && !IsOwnedByDocument()) {
+    ClearAssociatedDocument();
+  }
+}
+
+void
+StyleSheet::RemoveAdopter(dom::ShadowRoot* aShadowRoot)
+{
+  MOZ_ASSERT(aShadowRoot);
+
+  mAdopterShadowRoots.RemoveElement(aShadowRoot);
+  RemoveAdopter(aShadowRoot->OwnerDoc());
+}
+
+void
+StyleSheet::NotifyAdopterRuleChanged()
+{
+  for (size_t i = 0; i < mAdopterShadowRoots.Length(); ++i) {
+    dom::ShadowRoot* shadowRoot = mAdopterShadowRoots[i];
+    if (mAdopterShadowRoots.IndexOf(shadowRoot) == i) {
+      shadowRoot->StyleSheetChanged();
+    }
+  }
+}
+
 dom::CSSRuleList*
 StyleSheet::GetCssRules(nsIPrincipal& aSubjectPrincipal,
                         ErrorResult& aRv)

layout/style/StyleSheet.h

@@ -12,6 +12,7 @@
 #include "mozilla/CORSMode.h"
 
 #include "nsIDOMCSSStyleSheet.h"
+#include "nsTArray.h"
 #include "nsWrapperCache.h"
 
 class nsIDocument;
@@ -26,6 +27,7 @@ struct StyleSheetInfo;
 
 namespace dom {
 class CSSRuleList;
+class ShadowRoot;
 class SRIMetadata;
 } // namespace dom
 
@@ -193,6 +195,13 @@ public:
   inline void DidDirty();
   inline void AssertHasUniqueInner();
 
+  bool IsConstructed() const { return mConstructed; }
+  nsIDocument* ConstructorDocument() const { return mConstructorDocument; }
+  void AddAdopter(nsIDocument* aDocument);
+  void RemoveAdopter(nsIDocument* aDocument);
+  void AddAdopter(dom::ShadowRoot* aShadowRoot);
+  void RemoveAdopter(dom::ShadowRoot* aShadowRoot);
+
 private:
   // Get a handle to the various stylesheet bits which live on the 'inner' for
   // gecko stylesheets.
@@ -206,8 +215,12 @@ private:
   bool AreRulesAvailable(nsIPrincipal& aSubjectPrincipal,
                          ErrorResult& aRv);
 
-  bool IsConstructed() const { return mConstructed; }
   void SetConstructed() { mConstructed = true; }
+  void SetConstructorDocument(nsIDocument* aDocument)
+  {
+    MOZ_ASSERT(IsConstructed());
+    mConstructorDocument = aDocument;
+  }
   bool IsModificationDisallowed() const { return mDisallowModification; }
 
 protected:
@@ -217,10 +230,13 @@ protected:
   // it will set the principal of the inner to the subject principal.
   void SubjectSubsumesInnerPrincipal(nsIPrincipal& aSubjectPrincipal,
                                      ErrorResult& aRv);
+  void NotifyAdopterRuleChanged();
 
   nsString              mTitle;
   nsIDocument*          mDocument; // weak ref; parents maintain this for their children
+  RefPtr<nsIDocument>   mConstructorDocument;
   nsINode*              mOwningNode; // weak ref
+  nsTArray<dom::ShadowRoot*> mAdopterShadowRoots; // weak; roots unadopt on unlink/destruction
 
   // mParsingMode controls access to nonstandard style constructs that
   // are not safe for use on the public Web but necessary in UA sheets
@@ -230,6 +246,7 @@ protected:
   bool                  mDisabled;
   bool                  mConstructed;
   bool                  mDisallowModification;
+  uint32_t              mAdoptionCount;
 
   // mDocumentAssociationMode determines whether mDocument directly owns us (in
   // the sense that if it's known-live then we're known-live).  Always

layout/style/test/test_constructed_stylesheet.html

@@ -8,9 +8,13 @@
 </head>
 <body>
 <pre id="test"></pre>
+<div id="adopted-target"></div>
+<div id="shadow-host"></div>
 <script type="application/javascript">
 "use strict";
 
+SimpleTest.waitForExplicitFinish();
+
 let sheet;
 
 try {
@@ -58,7 +62,105 @@ if (sheet) {
     is(e.name, "NotAllowedError",
        "replaceSync should reject non-constructed sheets with NotAllowedError");
   }
+
+  try {
+    sheet.insertRule("@import url('neverending_stylesheet_load.sjs');", 0);
+    ok(false, "insertRule should reject @import rules for constructed sheets");
+  } catch (e) {
+    is(e.name, "SyntaxError",
+       "insertRule should reject constructed-sheet @import rules with SyntaxError");
+  }
 }
+
+function colorFor(node) {
+  return getComputedStyle(node).color;
+}
+
+function runAdoptionTests() {
+  let target = document.getElementById("adopted-target");
+  let adopted = new CSSStyleSheet();
+
+  adopted.replaceSync("#adopted-target { color: rgb(12, 34, 56); }");
+  document.adoptedStyleSheets = [adopted];
+
+  is(document.adoptedStyleSheets.length, 1,
+     "document.adoptedStyleSheets should expose assigned sheets");
+  is(document.adoptedStyleSheets[0], adopted,
+     "document.adoptedStyleSheets should expose the same CSSStyleSheet object");
+  is(document.styleSheets.length, 1,
+     "document.styleSheets should not include adopted sheets");
+  is(colorFor(target), "rgb(12, 34, 56)",
+     "adopted document sheets should apply");
+
+  adopted.replaceSync("#adopted-target { color: rgb(20, 30, 40); }");
+  is(colorFor(target), "rgb(20, 30, 40)",
+     "mutating an adopted sheet should update document style");
+
+  let laterStyle = document.createElement("style");
+  laterStyle.textContent = "#adopted-target { color: rgb(1, 2, 3); }";
+  document.head.appendChild(laterStyle);
+  is(colorFor(target), "rgb(20, 30, 40)",
+     "adopted document sheets should cascade after ordinary document sheets");
+
+  try {
+    document.adoptedStyleSheets = [document.styleSheets[0]];
+    ok(false, "adopting a non-constructed sheet should throw");
+  } catch (e) {
+    is(e.name, "NotAllowedError",
+       "adopting a non-constructed sheet should throw NotAllowedError");
+  }
+
+  let iframe = document.createElement("iframe");
+  iframe.onload = function() {
+    let foreignSheet = new iframe.contentWindow.CSSStyleSheet();
+    try {
+      document.adoptedStyleSheets = [foreignSheet];
+      ok(false, "adopting a sheet from another document should throw");
+    } catch (e) {
+      is(e.name, "NotAllowedError",
+         "adopting a sheet from another document should throw NotAllowedError");
+    }
+    iframe.remove();
+
+    if ("attachShadow" in document.getElementById("shadow-host")) {
+      runShadowAdoptionTests();
+    } else {
+      finishAdoptionTests();
+    }
+  };
+  document.body.appendChild(iframe);
+}
+
+function runShadowAdoptionTests() {
+  let host = document.getElementById("shadow-host");
+  let root = host.attachShadow({ mode: "open" });
+  root.innerHTML = "<style>span { color: rgb(1, 2, 3); }</style><span>shadow</span>";
+
+  let shadowSheet = new CSSStyleSheet();
+  shadowSheet.replaceSync("span { color: rgb(45, 67, 89); }");
+  root.adoptedStyleSheets = [shadowSheet];
+
+  let span = root.querySelector("span");
+  is(root.adoptedStyleSheets.length, 1,
+     "shadowRoot.adoptedStyleSheets should expose assigned sheets");
+  is(root.styleSheets.length, 1,
+     "shadowRoot.styleSheets should not include adopted sheets");
+  is(colorFor(span), "rgb(45, 67, 89)",
+     "adopted shadow sheets should apply after ordinary shadow sheets");
+
+  shadowSheet.replaceSync("span { color: rgb(90, 80, 70); }");
+  is(colorFor(span), "rgb(90, 80, 70)",
+     "mutating an adopted shadow sheet should update shadow style");
+
+  finishAdoptionTests();
+}
+
+function finishAdoptionTests() {
+  document.adoptedStyleSheets = [];
+  SimpleTest.finish();
+}
+
+runAdoptionTests();
 </script>
 </body>
 </html>

media/ffvpx/config.h

@@ -49,6 +49,13 @@
 #include "config_unix_ppc.h"
 #elif defined(__sparcv9) || defined(__sparcv9__)
 #include "config_unix_sparc64.h"
+#elif defined(__mips__)
+// This is needed to avoid enabling x86 assembly on 64-bit MIPS.
+#include "config_unix32.h"
+#if defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+#undef HAVE_BIGENDIAN
+#define HAVE_BIGENDIAN 1
+#endif
 #elif defined(__loongarch64)
 #include "config_unix_loongarch64.h"
 #else

media/ffvpx/libavutil/avconfig.h

@@ -6,5 +6,9 @@
 #else
 #define AV_HAVE_BIGENDIAN 0
 #endif
+#if defined(__mips__)
+#define AV_HAVE_FAST_UNALIGNED 0
+#else
 #define AV_HAVE_FAST_UNALIGNED 1
+#endif
 #endif /* AVUTIL_AVCONFIG_H */

media/libvpx/libvpx/vpx_ports/asmdefs_mmi.h

@@ -16,6 +16,30 @@
 
 #if HAVE_MMI
 
+/*
+ * Clang's integrated assembler uses the prefixed spellings below, while
+ * GNU as names the same Loongson MMI instructions xor/and/or/dsrl/srl.
+ * Define GNU as aliases so the inline assembly works with either toolchain.
+ */
+#if defined(__GNUC__) && !defined(__clang__)
+__asm__(
+    ".macro pxor dst, src1, src2\n\t"
+    "xor \\dst, \\src1, \\src2\n\t"
+    ".endm\n\t"
+    ".macro pand dst, src1, src2\n\t"
+    "and \\dst, \\src1, \\src2\n\t"
+    ".endm\n\t"
+    ".macro por dst, src1, src2\n\t"
+    "or \\dst, \\src1, \\src2\n\t"
+    ".endm\n\t"
+    ".macro ssrld dst, src1, src2\n\t"
+    "dsrl \\dst, \\src1, \\src2\n\t"
+    ".endm\n\t"
+    ".macro ssrlw dst, src1, src2\n\t"
+    "srl \\dst, \\src1, \\src2\n\t"
+    ".endm\n\t");
+#endif
+
 #if HAVE_MIPS64
 #define mips_reg int64_t
 #define MMI_ADDU(reg1, reg2, reg3) \