Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 11 Nov 2017 20:42:34 +0000 (UTC)
From:      Jan Beich <jbeich@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r454000 - in head/www/firefox: . files
Message-ID:  <201711112042.vABKgYvi007400@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: jbeich
Date: Sat Nov 11 20:42:33 2017
New Revision: 454000
URL: https://svnweb.freebsd.org/changeset/ports/454000

Log:
  www/firefox: backport some FF57+ fixes
  
  PR:		222859
  Security:	f78eac48-c3d1-4666-8de5-63ceea25a578
  MFH:		2017Q4

Added:
  head/www/firefox/files/patch-bug1261175   (contents, props changed)
  head/www/firefox/files/patch-bug1343147   (contents, props changed)
  head/www/firefox/files/patch-bug1355576   (contents, props changed)
  head/www/firefox/files/patch-bug1369561   (contents, props changed)
  head/www/firefox/files/patch-bug1375146   (contents, props changed)
  head/www/firefox/files/patch-bug1387799   (contents, props changed)
  head/www/firefox/files/patch-bug1394265   (contents, props changed)
  head/www/firefox/files/patch-bug1394530   (contents, props changed)
  head/www/firefox/files/patch-bug1395138   (contents, props changed)
  head/www/firefox/files/patch-bug1397811   (contents, props changed)
  head/www/firefox/files/patch-bug1400003   (contents, props changed)
  head/www/firefox/files/patch-bug1400554   (contents, props changed)
  head/www/firefox/files/patch-bug1401804   (contents, props changed)
  head/www/firefox/files/patch-bug1402442   (contents, props changed)
  head/www/firefox/files/patch-bug1404324   (contents, props changed)
  head/www/firefox/files/patch-bug1404636   (contents, props changed)
  head/www/firefox/files/patch-bug1404910   (contents, props changed)
  head/www/firefox/files/patch-bug1406398   (contents, props changed)
  head/www/firefox/files/patch-bug1406750   (contents, props changed)
  head/www/firefox/files/patch-bug1407375   (contents, props changed)
  head/www/firefox/files/patch-bug1407740   (contents, props changed)
  head/www/firefox/files/patch-bug1407751   (contents, props changed)
  head/www/firefox/files/patch-bug1408005   (contents, props changed)
  head/www/firefox/files/patch-bug1408412   (contents, props changed)
  head/www/firefox/files/patch-bug1408990   (contents, props changed)
  head/www/firefox/files/patch-bug1411458   (contents, props changed)
  head/www/firefox/files/patch-bug1412252   (contents, props changed)
Modified:
  head/www/firefox/Makefile   (contents, props changed)

Modified: head/www/firefox/Makefile
==============================================================================
--- head/www/firefox/Makefile	Sat Nov 11 20:41:59 2017	(r453999)
+++ head/www/firefox/Makefile	Sat Nov 11 20:42:33 2017	(r454000)
@@ -4,7 +4,7 @@
 PORTNAME=	firefox
 DISTVERSION=	56.0.2
 DISTVERSIONSUFFIX=.source
-PORTREVISION=	8
+PORTREVISION=	9
 PORTEPOCH=	1
 CATEGORIES=	www ipv6
 MASTER_SITES=	MOZILLA/${PORTNAME}/releases/${DISTVERSION}/source \

Added: head/www/firefox/files/patch-bug1261175
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1261175	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,25 @@
+commit deccfad4c8ba
+Author: Matt Woodrow <mwoodrow@mozilla.com>
+Date:   Thu Oct 12 13:10:27 2017 +1300
+
+    Bug 1261175. r=tnikkel, a=ritu
+    
+    --HG--
+    extra : source : 8281ed36bd4946af69af747b199814cc1a51fb52
+---
+ view/nsViewManager.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git view/nsViewManager.cpp view/nsViewManager.cpp
+index f3540f3478da..230512c0dcc0 100644
+--- view/nsViewManager.cpp
++++ view/nsViewManager.cpp
+@@ -100,7 +100,7 @@ nsViewManager::~nsViewManager()
+     gViewManagers = nullptr;
+   }
+ 
+-  mPresShell = nullptr;
++  MOZ_RELEASE_ASSERT(!mPresShell, "Releasing nsViewManager without having called Destroy on the PresShell!");
+ }
+ 
+ // We don't hold a reference to the presentation context because it

Added: head/www/firefox/files/patch-bug1343147
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1343147	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,117 @@
+commit e215b167b9b9
+Author: cku <cku@mozilla.com>
+Date:   Tue Oct 3 11:29:19 2017 +0800
+
+    Bug 1343147 - Do not double applying transform vector of the root frame in a glyph mask into the target context. r=mstange, a=ritu
+    
+    When we generate the glyph mask for a transformed frame in
+    GenerateAndPushTextMask, the transform vector had been applied into aContext[1],
+    so we should find a way to prevent applying the vector again when painting the
+    glyph mask.
+    
+    In bug 1299715, I tried to prevent double apply at [2], it caused two problems:
+    1. We only skip generating nsDisplayTransform, but we may still create a
+    nsDisplayPerspactive bellow. Since the parent of a nsDisplayPerspective must be
+    a nsDisplayTransform, which have been ignored, so we hit this assertion.
+    2. We skip all transform for all frames while painting the glyph mask, which is
+    not correct. We should only skip double applying transform vector of the root
+    frame.
+    
+    This patch fixes both of these issues:
+    a. We will still create a nsDisplayTransform for the root frame if need. But
+    the transform matrix we apply into the target context will be an identity
+    matrix, so we fix #1 above.
+    b. In #a, we change the transform matrix to an identity matrix only for the root
+    frame of the  glyph mask, so we fix #2.
+    
+    [1]
+    https://hg.mozilla.org/mozilla-central/file/59e5ec5729db/layout/painting/nsDisplayList.cpp#l752
+    [2]
+    https://hg.mozilla.org/mozilla-central/file/ce2c129f0a87/layout/generic/nsFrame.cpp#l2806
+    
+    MozReview-Commit-ID: 973lkQQxLB6
+    
+    --HG--
+    extra : source : 84451d723686bc47b81c44ed2ddf6c61f3e35915
+---
+ layout/generic/nsFrame.cpp        | 13 +++++--------
+ layout/painting/nsDisplayList.cpp |  9 ++++++++-
+ 2 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git layout/generic/nsFrame.cpp layout/generic/nsFrame.cpp
+index 37f2e2801220..dbfd61b7e142 100644
+--- layout/generic/nsFrame.cpp
++++ layout/generic/nsFrame.cpp
+@@ -2803,14 +2803,11 @@ nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder* aBuilder,
+     buildingDisplayList.SetReferenceFrameAndCurrentOffset(outerReferenceFrame,
+       GetOffsetToCrossDoc(outerReferenceFrame));
+ 
+-    if (!aBuilder->IsForGenerateGlyphMask() &&
+-        !aBuilder->IsForPaintingSelectionBG()) {
+-      nsDisplayTransform *transformItem =
+-        new (aBuilder) nsDisplayTransform(aBuilder, this,
+-                                          &resultList, dirtyRect, 0,
+-                                          allowAsyncAnimation);
+-      resultList.AppendNewToTop(transformItem);
+-    }
++    nsDisplayTransform *transformItem =
++      new (aBuilder) nsDisplayTransform(aBuilder, this,
++                                        &resultList, dirtyRect, 0,
++                                        allowAsyncAnimation);
++    resultList.AppendNewToTop(transformItem);
+ 
+     if (hasPerspective) {
+       if (clipCapturedBy == ContainerItemType::ePerspective) {
+diff --git layout/painting/nsDisplayList.cpp layout/painting/nsDisplayList.cpp
+index 801e1ea2fb4d..6477bda52f01 100644
+--- layout/painting/nsDisplayList.cpp
++++ layout/painting/nsDisplayList.cpp
+@@ -7976,11 +7976,18 @@ already_AddRefed<Layer> nsDisplayTransform::BuildLayer(nsDisplayListBuilder *aBu
+                                                        LayerManager *aManager,
+                                                        const ContainerLayerParameters& aContainerParameters)
+ {
++  // While generating a glyph mask, the transform vector of the root frame had
++  // been applied into the target context, so stop applying it again here.
++  const bool shouldSkipTransform =
++    (aBuilder->RootReferenceFrame() == mFrame) &&
++    (aBuilder->IsForGenerateGlyphMask() || aBuilder->IsForPaintingSelectionBG());
++
+   /* For frames without transform, it would not be removed for
+    * backface hidden here.  But, it would be removed by the init
+    * function of nsDisplayTransform.
+    */
+-  const Matrix4x4& newTransformMatrix = GetTransformForRendering();
++  const Matrix4x4 newTransformMatrix =
++    shouldSkipTransform ? Matrix4x4(): GetTransformForRendering();
+ 
+   uint32_t flags = FrameLayerBuilder::CONTAINER_ALLOW_PULL_BACKGROUND_COLOR;
+   RefPtr<ContainerLayer> container = aManager->GetLayerBuilder()->
+diff --git dom/svg/crashtests/1343147.svg dom/svg/crashtests/1343147.svg
+new file mode 100644
+index 000000000000..d9c2611ca822
+--- /dev/null
++++ dom/svg/crashtests/1343147.svg
+@@ -0,0 +1,13 @@
++<svg xmlns="http://www.w3.org/2000/svg">;
++<style>
++<![CDATA[
++  svg {
++    background-image: linear-gradient(lime, lime);
++    background-clip: text;
++  }
++  text { transform: skewy(30grad); }
++  g { perspective: 0; }
++]]>
++</style>
++  <g><text>hello</text></g>
++</svg>
+diff --git dom/svg/crashtests/crashtests.list dom/svg/crashtests/crashtests.list
+index 1727a206ec4f..57ab320161e2 100644
+--- dom/svg/crashtests/crashtests.list
++++ dom/svg/crashtests/crashtests.list
+@@ -90,4 +90,5 @@ load 1329849-5.svg
+ load 1329849-6.svg
+ load 1329093-1.html
+ load 1329093-2.html
++load 1343147.svg
+ load 1402798.html

Added: head/www/firefox/files/patch-bug1355576
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1355576	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,262 @@
+commit e530ba4d4394
+Author: Thomas Wisniewski <wisniewskit@gmail.com>
+Date:   Tue Jul 4 20:59:26 2017 -0400
+
+    Bug 1355576 - Add ability to clear all localStorage with the browsingData API; r=bsilverberg,janv
+    
+    MozReview-Commit-ID: 4UUqg62yIo9
+    
+    --HG--
+    extra : rebase_source : 9c6154bbe878fc3921d22027fdc90dbdaed05be9
+---
+ browser/components/extensions/ext-browsingData.js  | 10 +++
+ .../extensions/schemas/browsing_data.json          |  1 -
+ .../extensions/test/browser/browser-common.ini     |  1 +
+ .../browser_ext_browsingData_localStorage.js       | 93 ++++++++++++++++++++++
+ .../test/xpcshell/test_ext_browsingData.js         |  4 +-
+ dom/storage/LocalStorageManager.cpp                |  3 +-
+ dom/storage/StorageObserver.cpp                    | 12 +++
+ .../extensions/schemas/browsing_data.json          |  1 -
+ 8 files changed, 120 insertions(+), 5 deletions(-)
+
+diff --git browser/components/extensions/ext-browsingData.js browser/components/extensions/ext-browsingData.js
+index fd59141dd15d..109ec9601487 100644
+--- browser/components/extensions/ext-browsingData.js
++++ browser/components/extensions/ext-browsingData.js
+@@ -83,6 +83,10 @@ const clearHistory = options => {
+   return sanitizer.items.history.clear(makeRange(options));
+ };
+ 
++const clearLocalStorage = async function(options) {
++  Services.obs.notifyObservers(null, "extension:purge-localStorage");
++};
++
+ const clearPasswords = async function(options) {
+   let loginManager = Services.logins;
+   let yieldCounter = 0;
+@@ -152,6 +156,9 @@ const doRemoval = (options, dataToRemove, extension) => {
+         case "history":
+           removalPromises.push(clearHistory(options));
+           break;
++        case "localStorage":
++          removalPromises.push(clearLocalStorage(options));
++          break;
+         case "passwords":
+           removalPromises.push(clearPasswords(options));
+           break;
+@@ -225,6 +232,9 @@ this.browsingData = class extends ExtensionAPI {
+         removeHistory(options) {
+           return doRemoval(options, {history: true});
+         },
++        removeLocalStorage(options) {
++          return doRemoval(options, {localStorage: true});
++        },
+         removePasswords(options) {
+           return doRemoval(options, {passwords: true});
+         },
+diff --git browser/components/extensions/schemas/browsing_data.json browser/components/extensions/schemas/browsing_data.json
+index a780f5640c8f..7755714eb898 100644
+--- browser/components/extensions/schemas/browsing_data.json
++++ browser/components/extensions/schemas/browsing_data.json
+@@ -341,7 +341,6 @@
+         "description": "Clears websites' local storage data.",
+         "type": "function",
+         "async": "callback",
+-        "unsupported": true,
+         "parameters": [
+           {
+             "$ref": "RemovalOptions",
+diff --git browser/components/extensions/test/browser/browser-common.ini browser/components/extensions/test/browser/browser-common.ini
+index 464b8ba18f37..e3f7700f3939 100644
+--- browser/components/extensions/test/browser/browser-common.ini
++++ browser/components/extensions/test/browser/browser-common.ini
+@@ -46,6 +46,7 @@ skip-if = (os == 'win' && !debug) # bug 1352668
+ [browser_ext_browserAction_theme_icons.js]
+ [browser_ext_browsingData_formData.js]
+ [browser_ext_browsingData_history.js]
++[browser_ext_browsingData_localStorage.js]
+ [browser_ext_browsingData_pluginData.js]
+ [browser_ext_browsingData_serviceWorkers.js]
+ [browser_ext_commands_execute_browser_action.js]
+diff --git browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js
+new file mode 100644
+index 000000000000..215f26d1fcb6
+--- /dev/null
++++ browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js
+@@ -0,0 +1,93 @@
++/* -*- Mode: indent-tabs-mode: nil; js-indent-level: 2 -*- */
++/* vim: set sts=2 sw=2 et tw=80: */
++"use strict";
++
++add_task(async function testLocalStorage() {
++  async function background() {
++    function openTabs() {
++      let promise = new Promise(resolve => {
++        let tabURLs = [
++          "http://example.com/",
++          "http://example.net/",
++        ];
++
++        let tabs;
++        let waitingCount = tabURLs.length;
++
++        let listener = async msg => {
++          if (msg !== "content-script-ready" || --waitingCount) {
++            return;
++          }
++          browser.runtime.onMessage.removeListener(listener);
++          resolve(Promise.all(tabs));
++        };
++
++        browser.runtime.onMessage.addListener(listener);
++
++        tabs = tabURLs.map(url => {
++          return browser.tabs.create({url: url});
++        });
++      });
++
++      return promise;
++    }
++
++    function sendMessageToTabs(tabs, message) {
++      return Promise.all(
++        tabs.map(tab => { return browser.tabs.sendMessage(tab.id, message); }));
++    }
++
++    let tabs = await openTabs();
++
++    await sendMessageToTabs(tabs, "resetLocalStorage");
++    await sendMessageToTabs(tabs, "checkLocalStorageSet");
++    await browser.browsingData.removeLocalStorage({});
++    await sendMessageToTabs(tabs, "checkLocalStorageCleared");
++
++    await sendMessageToTabs(tabs, "resetLocalStorage");
++    await sendMessageToTabs(tabs, "checkLocalStorageSet");
++    await browser.browsingData.remove({}, {localStorage: true});
++    await sendMessageToTabs(tabs, "checkLocalStorageCleared");
++
++    browser.tabs.remove(tabs.map(tab => tab.id));
++
++    browser.test.notifyPass("done");
++  }
++
++  function contentScript() {
++    browser.runtime.onMessage.addListener(msg => {
++      if (msg === "resetLocalStorage") {
++        localStorage.clear();
++        localStorage.setItem("test", "test");
++      } else if (msg === "checkLocalStorageSet") {
++        browser.test.assertEq("test", localStorage.getItem("test"));
++      } else if (msg === "checkLocalStorageCleared") {
++        browser.test.assertEq(null, localStorage.getItem("test"));
++      }
++    });
++    browser.runtime.sendMessage("content-script-ready");
++  }
++
++  let extension = ExtensionTestUtils.loadExtension({
++    background,
++    manifest: {
++      "permissions": ["browsingData"],
++      "content_scripts": [{
++        "matches": [
++          "http://example.com/",
++          "http://example.net/",
++        ],
++        "js": ["content-script.js"],
++        "run_at": "document_start",
++      }],
++    },
++    files: {
++      "content-script.js": contentScript,
++    },
++  });
++
++  await extension.startup();
++  await extension.awaitFinish("done");
++  await extension.unload();
++});
++
+diff --git browser/components/extensions/test/xpcshell/test_ext_browsingData.js browser/components/extensions/test/xpcshell/test_ext_browsingData.js
+index 0c1c4874ca44..0b8972058e64 100644
+--- browser/components/extensions/test/xpcshell/test_ext_browsingData.js
++++ browser/components/extensions/test/xpcshell/test_ext_browsingData.js
+@@ -44,7 +44,7 @@ add_task(async function testInvalidArguments() {
+ 
+ add_task(async function testUnimplementedDataType() {
+   function background() {
+-    browser.browsingData.remove({}, {localStorage: true});
++    browser.browsingData.remove({}, {indexedDB: true});
+     browser.test.sendMessage("finished");
+   }
+ 
+@@ -61,6 +61,6 @@ add_task(async function testUnimplementedDataType() {
+     await extension.unload();
+   });
+ 
+-  let warningObserved = messages.find(line => /Firefox does not support dataTypes: localStorage/.test(line));
++  let warningObserved = messages.find(line => /Firefox does not support dataTypes: indexedDB/.test(line));
+   ok(warningObserved, "Warning issued when calling remove with an unimplemented dataType.");
+ });
+diff --git dom/storage/LocalStorageManager.cpp dom/storage/LocalStorageManager.cpp
+index a161de2bc596..f366e7874a90 100644
+--- dom/storage/LocalStorageManager.cpp
++++ dom/storage/LocalStorageManager.cpp
+@@ -386,7 +386,8 @@ LocalStorageManager::Observe(const char* aTopic,
+   }
+ 
+   // Clear everything, caches + database
+-  if (!strcmp(aTopic, "cookie-cleared")) {
++  if (!strcmp(aTopic, "cookie-cleared") ||
++      !strcmp(aTopic, "extension:purge-localStorage-caches")) {
+     ClearCaches(LocalStorageCache::kUnloadComplete, pattern, EmptyCString());
+     return NS_OK;
+   }
+diff --git dom/storage/StorageObserver.cpp dom/storage/StorageObserver.cpp
+index e5b010f88c7b..48d484748209 100644
+--- dom/storage/StorageObserver.cpp
++++ dom/storage/StorageObserver.cpp
+@@ -66,6 +66,7 @@ StorageObserver::Init()
+   obs->AddObserver(sSelf, "browser:purge-domain-data", true);
+   obs->AddObserver(sSelf, "last-pb-context-exited", true);
+   obs->AddObserver(sSelf, "clear-origin-attributes-data", true);
++  obs->AddObserver(sSelf, "extension:purge-localStorage", true);
+ 
+   // Shutdown
+   obs->AddObserver(sSelf, "profile-after-change", true);
+@@ -270,6 +271,23 @@ StorageObserver::Observe(nsISupports* aSubject,
+ 
+     Notify("session-only-cleared", NS_ConvertUTF8toUTF16(originSuffix),
+            originScope);
++
++    return NS_OK;
++  }
++
++  if (!strcmp(aTopic, "extension:purge-localStorage")) {
++    StorageDBChild* storageChild = StorageDBChild::GetOrCreate();
++    if (NS_WARN_IF(!storageChild)) {
++      return NS_ERROR_FAILURE;
++    }
++
++    storageChild->AsyncClearAll();
++
++    if (XRE_IsParentProcess()) {
++      storageChild->SendClearAll();
++    }
++
++    Notify("extension:purge-localStorage-caches");
+ 
+     return NS_OK;
+   }
+diff --git mobile/android/components/extensions/schemas/browsing_data.json mobile/android/components/extensions/schemas/browsing_data.json
+index 483a462d422c..1019c1a23953 100644
+--- mobile/android/components/extensions/schemas/browsing_data.json
++++ mobile/android/components/extensions/schemas/browsing_data.json
+@@ -345,7 +345,6 @@
+         "description": "Clears websites' local storage data.",
+         "type": "function",
+         "async": "callback",
+-        "unsupported": true,
+         "parameters": [
+           {
+             "$ref": "RemovalOptions",

Added: head/www/firefox/files/patch-bug1369561
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1369561	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,66 @@
+commit 4a1737e0c456
+Author: David Keeler <dkeeler@mozilla.com>
+Date:   Fri Sep 15 14:47:54 2017 -0700
+
+    Bug 1369561 - Address misc. SnprintfLiteral correctness nits. r=jld, r=froydnj, a=ritu
+    
+    --HG--
+    extra : source : f5533b6cd09c35eef381e311940b5bd5231d3553
+---
+ security/sandbox/linux/SandboxUtil.cpp | 17 ++++++++++-------
+ xpcom/base/nsSystemInfo.cpp            |  2 +-
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git security/sandbox/linux/SandboxUtil.cpp security/sandbox/linux/SandboxUtil.cpp
+index ad6003ecaad5..999329882364 100644
+--- security/sandbox/linux/SandboxUtil.cpp
++++ security/sandbox/linux/SandboxUtil.cpp
+@@ -62,7 +62,6 @@ UnshareUserNamespace()
+   uid_t uid = getuid();
+   gid_t gid = getgid();
+   char buf[80];
+-  size_t len;
+ 
+   if (syscall(__NR_unshare, CLONE_NEWUSER) != 0) {
+     return false;
+@@ -84,17 +83,21 @@ UnshareUserNamespace()
+   // current thread.  However, CLONE_NEWUSER can be unshared only in a
+   // single-threaded process, so those are equivalent if we reach this
+   // point.
+-  len = size_t(SprintfLiteral(buf, "%u %u 1\n", uid, uid));
+-  MOZ_ASSERT(len < sizeof(buf));
+-  if (!WriteStringToFile("/proc/self/uid_map", buf, len)) {
++  int len = SprintfLiteral(buf, "%u %u 1\n", uid, uid);
++  if (len >= int(sizeof(buf)) || len < 0) {
++    return false;
++  }
++  if (!WriteStringToFile("/proc/self/uid_map", buf, size_t(len))) {
+     MOZ_CRASH("Failed to write /proc/self/uid_map");
+   }
+ 
+   Unused << WriteStringToFile("/proc/self/setgroups", "deny", 4);
+ 
+-  len = size_t(SprintfLiteral(buf, "%u %u 1\n", gid, gid));
+-  MOZ_ASSERT(len < sizeof(buf));
+-  if (!WriteStringToFile("/proc/self/gid_map", buf, len)) {
++  len = SprintfLiteral(buf, "%u %u 1\n", gid, gid);
++  if (len >= int(sizeof(buf)) || len < 0) {
++    return false;
++  }
++  if (!WriteStringToFile("/proc/self/gid_map", buf, size_t(len))) {
+     MOZ_CRASH("Failed to write /proc/self/gid_map");
+   }
+   return true;
+diff --git xpcom/base/nsSystemInfo.cpp xpcom/base/nsSystemInfo.cpp
+index e5a7fe97be03..782dc9abf37d 100644
+--- xpcom/base/nsSystemInfo.cpp
++++ xpcom/base/nsSystemInfo.cpp
+@@ -706,7 +706,7 @@ nsSystemInfo::Init()
+   }
+ 
+   nsAutoCString secondaryLibrary;
+-  if (gtkver_len > 0) {
++  if (gtkver_len > 0 && gtkver_len < int(sizeof(gtkver))) {
+     secondaryLibrary.Append(nsDependentCSubstring(gtkver, gtkver_len));
+   }
+ 

Added: head/www/firefox/files/patch-bug1375146
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1375146	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,37 @@
+commit b481800095d4
+Author: Stone Shih <sshih@mozilla.com>
+Date:   Tue Sep 19 15:41:52 2017 +0800
+
+    Bug 1375146 - Revise sending drag event. r=smaug, a=ritu
+    
+    --HG--
+    extra : source : d4496b8befbf0ef5ae124a9fbda37ad5b885f9e1
+---
+ dom/events/EventStateManager.cpp | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git dom/events/EventStateManager.cpp dom/events/EventStateManager.cpp
+index b94dc0c88e01..1f48884058de 100644
+--- dom/events/EventStateManager.cpp
++++ dom/events/EventStateManager.cpp
+@@ -1292,8 +1292,9 @@ EventStateManager::DispatchCrossProcessEvent(WidgetEvent* aEvent,
+     return;
+   }
+   case eDragEventClass: {
+-    if (remote->Manager()->IsContentParent()) {
+-      remote->Manager()->AsContentParent()->MaybeInvokeDragSession(remote);
++    RefPtr<TabParent> tabParent = remote;
++    if (tabParent->Manager()->IsContentParent()) {
++      tabParent->Manager()->AsContentParent()->MaybeInvokeDragSession(tabParent);
+     }
+ 
+     nsCOMPtr<nsIDragSession> dragSession = nsContentUtils::GetDragSession();
+@@ -1309,7 +1310,7 @@ EventStateManager::DispatchCrossProcessEvent(WidgetEvent* aEvent,
+       }
+     }
+ 
+-    remote->SendRealDragEvent(*aEvent->AsDragEvent(), action, dropEffect);
++    tabParent->SendRealDragEvent(*aEvent->AsDragEvent(), action, dropEffect);
+     return;
+   }
+   case ePluginEventClass: {

Added: head/www/firefox/files/patch-bug1387799
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1387799	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,49 @@
+commit e1c252eab1f4
+Author: Milan Sreckovic <milan@mozilla.com>
+Date:   Mon Oct 23 16:22:47 2017 -0400
+
+    Bug 1387799 - Keep an extra reference. r=jrmuizel, a=ritu
+    
+    --HG--
+    extra : source : 8199078921c6b4c0ee4c984100d33750dfe8e144
+---
+ gfx/layers/ipc/CompositorBridgeChild.cpp | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git gfx/layers/ipc/CompositorBridgeChild.cpp gfx/layers/ipc/CompositorBridgeChild.cpp
+index 9419f4b2da36..55fd9c10871b 100644
+--- gfx/layers/ipc/CompositorBridgeChild.cpp
++++ gfx/layers/ipc/CompositorBridgeChild.cpp
+@@ -523,10 +523,14 @@ CompositorBridgeChild::RecvHideAllPlugins(const uintptr_t& aParentWidget)
+ }
+ 
+ mozilla::ipc::IPCResult
+-CompositorBridgeChild::RecvDidComposite(const uint64_t& aId, const uint64_t& aTransactionId,
++CompositorBridgeChild::RecvDidComposite(const uint64_t& aId,
++                                        const uint64_t& aTransactionId,
+                                         const TimeStamp& aCompositeStart,
+                                         const TimeStamp& aCompositeEnd)
+ {
++  // Hold a reference to keep texture pools alive.  See bug 1387799
++  AutoTArray<RefPtr<TextureClientPool>,2> texturePools = mTexturePools;
++
+   if (mLayerManager) {
+     MOZ_ASSERT(aId == 0);
+     MOZ_ASSERT(mLayerManager->GetBackendType() == LayersBackend::LAYERS_CLIENT ||
+@@ -541,13 +545,14 @@ CompositorBridgeChild::RecvDidComposite(const uint64_t& aId, const uint64_t& aTr
+     }
+   }
+ 
+-  for (size_t i = 0; i < mTexturePools.Length(); i++) {
+-    mTexturePools[i]->ReturnDeferredClients();
++  for (size_t i = 0; i < texturePools.Length(); i++) {
++    texturePools[i]->ReturnDeferredClients();
+   }
+ 
+   return IPC_OK();
+ }
+ 
++
+ void
+ CompositorBridgeChild::ActorDestroy(ActorDestroyReason aWhy)
+ {

Added: head/www/firefox/files/patch-bug1394265
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1394265	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,24 @@
+commit a51675964a63
+Author: Jeff Gilbert <jgilbert@mozilla.com>
+Date:   Tue Oct 17 17:14:29 2017 -0700
+
+    Bug 1394265 - Set MAX_COMBINED_TEXTURE_IMAGE_UNITS to 0 if GetIntegeriv fails. - r=daoshengmu a=ritu
+    
+    MozReview-Commit-ID: 5h6UPXczKhb
+---
+ dom/canvas/WebGLContextValidate.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git dom/canvas/WebGLContextValidate.cpp dom/canvas/WebGLContextValidate.cpp
+index a8334e546414..ebf0aa8c2d78 100644
+--- dom/canvas/WebGLContextValidate.cpp
++++ dom/canvas/WebGLContextValidate.cpp
+@@ -554,7 +554,7 @@ WebGLContext::InitAndValidateGL(FailureReason* const out_failReason)
+     if (MinCapabilityMode())
+         mGLMaxTextureUnits = MINVALUE_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS;
+     else
+-        gl->fGetIntegerv(LOCAL_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &mGLMaxTextureUnits);
++        mGLMaxTextureUnits = gl->GetIntAs<GLint>(LOCAL_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS);
+ 
+     if (mGLMaxTextureUnits < 8) {
+         const nsPrintfCString reason("GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS: %d is < 8!",

Added: head/www/firefox/files/patch-bug1394530
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1394530	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,60 @@
+commit a2b75aa9409c
+Author: Tooru Fujisawa <arai_a@mac.com>
+Date:   Sun Sep 17 19:52:04 2017 +0900
+
+    Bug 1394530 - Stop using optimized path for non PromiseObject. r=till, a=sledru
+    
+    --HG--
+    extra : source : 079ff8998fd50540948d3262a3a8b1f4d61b43e9
+---
+ js/src/builtin/Promise.cpp | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git js/src/builtin/Promise.cpp js/src/builtin/Promise.cpp
+index 1cb1cff0682e..e316f090504d 100644
+--- js/src/builtin/Promise.cpp
++++ js/src/builtin/Promise.cpp
+@@ -2365,6 +2365,15 @@ NewReactionRecord(JSContext* cx, HandleObject resultPromise, HandleValue onFulfi
+                   HandleValue onRejected, HandleObject resolve, HandleObject reject,
+                   HandleObject incumbentGlobalObject)
+ {
++    // Either of the following conditions must be met:
++    //   * resultPromise is a PromiseObject
++    //   * resolve and reject are callable
++    // except for Async Generator, there resultPromise can be nullptr.
++    MOZ_ASSERT_IF(resultPromise && !resultPromise->is<PromiseObject>(), resolve);
++    MOZ_ASSERT_IF(resultPromise && !resultPromise->is<PromiseObject>(), IsCallable(resolve));
++    MOZ_ASSERT_IF(resultPromise && !resultPromise->is<PromiseObject>(), reject);
++    MOZ_ASSERT_IF(resultPromise && !resultPromise->is<PromiseObject>(), IsCallable(reject));
++
+     Rooted<PromiseReactionRecord*> reaction(cx, NewObjectWithClassProto<PromiseReactionRecord>(cx));
+     if (!reaction)
+         return nullptr;
+@@ -3072,7 +3081,7 @@ BlockOnPromise(JSContext* cx, HandleValue promiseVal, HandleObject blockedPromis
+         // rejected promises list.
+         bool addToDependent = true;
+ 
+-        if (C == PromiseCtor) {
++        if (C == PromiseCtor && resultPromise->is<PromiseObject>()) {
+             addToDependent = false;
+         } else {
+             // 25.4.5.3., step 4.
+@@ -3131,12 +3140,14 @@ BlockOnPromise(JSContext* cx, HandleValue promiseVal, HandleObject blockedPromis
+             return false;
+     }
+ 
+-    // If the object to depend on isn't a, maybe-wrapped, Promise instance,
+-    // we ignore it. All this does is lose some small amount of debug
+-    // information in scenarios that are highly unlikely to occur in useful
+-    // code.
++    // If either the object to depend on or the object that gets blocked isn't
++    // a, maybe-wrapped, Promise instance, we ignore it. All this does is lose
++    // some small amount of debug information in scenarios that are highly
++    // unlikely to occur in useful code.
+     if (!unwrappedPromiseObj->is<PromiseObject>())
+         return true;
++    if (!blockedPromise_->is<PromiseObject>())
++        return true;
+ 
+     Rooted<PromiseObject*> promise(cx, &unwrappedPromiseObj->as<PromiseObject>());
+     return AddPromiseReaction(cx, promise, UndefinedHandleValue, UndefinedHandleValue,

Added: head/www/firefox/files/patch-bug1395138
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1395138	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,49 @@
+commit 8ab8a207d511
+Author: Jamie Nicol <jnicol@mozilla.com>
+Date:   Mon Oct 9 17:48:59 2017 +0100
+
+    Bug 1395138 - Hold reference to layers in ContainerLayerComposite::mPrepared. r=mattwoodrow, a=sledru
+    
+    MozReview-Commit-ID: 6qUDRnRcFAw
+---
+ gfx/layers/composite/ContainerLayerComposite.cpp | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git gfx/layers/composite/ContainerLayerComposite.cpp gfx/layers/composite/ContainerLayerComposite.cpp
+index aad2993629fc..28d9e79925a0 100755
+--- gfx/layers/composite/ContainerLayerComposite.cpp
++++ gfx/layers/composite/ContainerLayerComposite.cpp
+@@ -161,12 +161,12 @@ static gfx::IntRect ContainerVisibleRect(ContainerT* aContainer)
+ /* all of the per-layer prepared data we need to maintain */
+ struct PreparedLayer
+ {
+-  PreparedLayer(LayerComposite *aLayer,
++  PreparedLayer(Layer *aLayer,
+                 RenderTargetIntRect aClipRect,
+                 Maybe<gfx::Polygon>&& aGeometry)
+   : mLayer(aLayer), mClipRect(aClipRect), mGeometry(Move(aGeometry)) {}
+ 
+-  LayerComposite* mLayer;
++  RefPtr<Layer> mLayer;
+   RenderTargetIntRect mClipRect;
+   Maybe<Polygon> mGeometry;
+ };
+@@ -230,7 +230,8 @@ ContainerPrepare(ContainerT* aContainer,
+     CULLING_LOG("Preparing sublayer %p\n", layerToRender->GetLayer());
+ 
+     layerToRender->Prepare(clipRect);
+-    aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender, clipRect,
++    aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender->GetLayer(),
++                                                               clipRect,
+                                                                Move(layer.geometry)));
+   }
+ 
+@@ -408,7 +409,7 @@ RenderLayers(ContainerT* aContainer, LayerManagerComposite* aManager,
+     PreparedLayer& preparedData = aContainer->mPrepared->mLayers[i];
+ 
+     const gfx::IntRect clipRect = preparedData.mClipRect.ToUnknownRect();
+-    LayerComposite* layerToRender = preparedData.mLayer;
++    LayerComposite* layerToRender = static_cast<LayerComposite*>(preparedData.mLayer->ImplData());
+     const Maybe<gfx::Polygon>& childGeometry = preparedData.mGeometry;
+ 
+     Layer* layer = layerToRender->GetLayer();

Added: head/www/firefox/files/patch-bug1397811
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1397811	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,48 @@
+commit 2bffd0136caf
+Author: Olli Pettay <Olli.Pettay@helsinki.fi>
+Date:   Fri Oct 20 11:02:29 2017 +0100
+
+    Bug 1397811 - In order to not leak properties, ensure all the properties of adopted nodes are removed in case the adopt call fails. r=bz, a=lizzard
+    
+    --HG--
+    extra : source : b609906f34b50f8e4236d0fee8d01338181dd906
+---
+ dom/base/nsNodeUtils.cpp | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git dom/base/nsNodeUtils.cpp dom/base/nsNodeUtils.cpp
+index dd958aa443ce..20e714d54065 100644
+--- dom/base/nsNodeUtils.cpp
++++ dom/base/nsNodeUtils.cpp
+@@ -605,6 +605,15 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep,
+     }
+   }
+ 
++  if (aNodesWithProperties && aNode->HasProperties()) {
++    bool ok = aNodesWithProperties->AppendObject(aNode);
++    MOZ_RELEASE_ASSERT(ok, "Out of memory");
++    if (aClone) {
++      ok = aNodesWithProperties->AppendObject(clone);
++      MOZ_RELEASE_ASSERT(ok, "Out of memory");
++    }
++  }
++
+   if (aDeep && (!aClone || !aNode->IsNodeOfType(nsINode::eATTRIBUTE))) {
+     // aNode's children.
+     for (nsIContent* cloneChild = aNode->GetFirstChild();
+@@ -664,15 +673,6 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep,
+   }
+ #endif
+ 
+-  if (aNodesWithProperties && aNode->HasProperties()) {
+-    bool ok = aNodesWithProperties->AppendObject(aNode);
+-    if (aClone) {
+-      ok = ok && aNodesWithProperties->AppendObject(clone);
+-    }
+-
+-    NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
+-  }
+-
+   clone.forget(aResult);
+ 
+   return NS_OK;

Added: head/www/firefox/files/patch-bug1400003
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1400003	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,120 @@
+commit 677c707a4f11
+Author: Jon Coppeard <jcoppeard@mozilla.com>
+Date:   Mon Oct 9 10:03:20 2017 +0100
+
+    Bug 1400003 - Mark Heap<T> and barrier classes as MOZ_NON_MEMMOVABLE. r=sfink, r=froydnj, a=lizzard
+    
+    --HG--
+    extra : source : 6ad5b916c9659aeb4b901d8f9ec7f121dc2c4418
+---
+ js/public/RootingAPI.h | 10 +++++++++-
+ js/src/gc/Barrier.h    |  5 ++++-
+ xpcom/ds/nsTArray.h    | 27 +++++++++++++--------------
+ 3 files changed, 26 insertions(+), 16 deletions(-)
+
+diff --git js/public/RootingAPI.h js/public/RootingAPI.h
+index 74a61af93703..f8ec7c5a1f5b 100644
+--- js/public/RootingAPI.h
++++ js/public/RootingAPI.h
+@@ -231,7 +231,7 @@ AssertGCThingIsNotAnObjectSubclass(js::gc::Cell* cell) {}
+  * Type T must be a public GC pointer type.
+  */
+ template <typename T>
+-class Heap : public js::HeapBase<T, Heap<T>>
++class MOZ_NON_MEMMOVABLE Heap : public js::HeapBase<T, Heap<T>>
+ {
+     // Please note: this can actually also be used by nsXBLMaybeCompiled<T>, for legacy reasons.
+     static_assert(js::IsHeapConstructibleType<T>::value,
+@@ -1246,6 +1246,14 @@ class JS_PUBLIC_API(ObjectPtr)
+ 
+     explicit ObjectPtr(JSObject* obj) : value(obj) {}
+ 
++    ObjectPtr(const ObjectPtr& other) : value(other.value) {}
++
++    ObjectPtr(ObjectPtr&& other)
++      : value(other.value)
++    {
++        other.value = nullptr;
++    }
++
+     /* Always call finalize before the destructor. */
+     ~ObjectPtr() { MOZ_ASSERT(!value); }
+ 
+diff --git js/src/gc/Barrier.h js/src/gc/Barrier.h
+index 9c4f53975752..1740315c14e9 100644
+--- js/src/gc/Barrier.h
++++ js/src/gc/Barrier.h
+@@ -318,8 +318,11 @@ struct InternalBarrierMethods<jsid>
+ };
+ 
+ // Base class of all barrier types.
++//
++// This is marked non-memmovable since post barriers added by derived classes
++// can add pointers to class instances to the store buffer.
+ template <typename T>
+-class BarrieredBase
++class MOZ_NON_MEMMOVABLE BarrieredBase
+ {
+   protected:
+     // BarrieredBase is not directly instantiable.
+diff --git xpcom/ds/nsTArray.h xpcom/ds/nsTArray.h
+index 424a50ba421e..4e9b57126bfb 100644
+--- xpcom/ds/nsTArray.h
++++ xpcom/ds/nsTArray.h
+@@ -37,6 +37,7 @@
+ namespace JS {
+ template<class T>
+ class Heap;
++class ObjectPtr;
+ } /* namespace JS */
+ 
+ class nsRegion;
+@@ -708,7 +709,7 @@ struct nsTArray_CopyWithConstructors
+ template<class E>
+ struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser
+ {
+-  typedef nsTArray_CopyWithMemutils Type;
++  using Type = nsTArray_CopyWithMemutils;
+ };
+ 
+ //
+@@ -719,14 +720,18 @@ struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser
+   template<>                                            \
+   struct nsTArray_CopyChooser<T>                        \
+   {                                                     \
+-    typedef nsTArray_CopyWithConstructors<T> Type;      \
++    using Type = nsTArray_CopyWithConstructors<T>;      \
+   };
+ 
+-template<class E>
+-struct nsTArray_CopyChooser<JS::Heap<E>>
+-{
+-  typedef nsTArray_CopyWithConstructors<JS::Heap<E>> Type;
+-};
++#define DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(T)   \
++  template<typename S>                                  \
++  struct nsTArray_CopyChooser<T<S>>                     \
++  {                                                     \
++    using Type = nsTArray_CopyWithConstructors<T<S>>;   \
++  };
++
++DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(JS::Heap)
++DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(std::function)
+ 
+ DECLARE_USE_COPY_CONSTRUCTORS(nsRegion)
+ DECLARE_USE_COPY_CONSTRUCTORS(nsIntRegion)
+@@ -740,13 +745,7 @@ DECLARE_USE_COPY_CONSTRUCTORS(mozilla::dom::indexedDB::SerializedStructuredClone
+ DECLARE_USE_COPY_CONSTRUCTORS(JSStructuredCloneData)
+ DECLARE_USE_COPY_CONSTRUCTORS(mozilla::dom::MessagePortMessage)
+ DECLARE_USE_COPY_CONSTRUCTORS(mozilla::SourceBufferTask)
+-
+-template<typename T>
+-struct nsTArray_CopyChooser<std::function<T>>
+-{
+-  typedef nsTArray_CopyWithConstructors<std::function<T>> Type;
+-};
+-
++DECLARE_USE_COPY_CONSTRUCTORS(JS::ObjectPtr)
+ 
+ //
+ // Base class for nsTArray_Impl that is templated on element type and derived

Added: head/www/firefox/files/patch-bug1400554
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1400554	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,27 @@
+commit 62b41b600acc
+Author: Dragana Damjanovic <dd.mozilla@gmail.com>
+Date:   Mon Oct 9 14:59:32 2017 -0400
+
+    Bug 1400554 - Cancel a time in TLSFilterTransaction if transaction is canceled. r=mcmanus, a=ritu
+    
+    --HG--
+    extra : source : 67315954145e9cae0efe8c5323452a70a13c5484
+---
+ netwerk/protocol/http/TunnelUtils.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git netwerk/protocol/http/TunnelUtils.cpp netwerk/protocol/http/TunnelUtils.cpp
+index d0f6ef0b1873..0cf3ea4f3008 100644
+--- netwerk/protocol/http/TunnelUtils.cpp
++++ netwerk/protocol/http/TunnelUtils.cpp
+@@ -126,6 +126,10 @@ TLSFilterTransaction::Close(nsresult aReason)
+     return;
+   }
+ 
++  if (mTimer) {
++    mTimer->Cancel();
++    mTimer = nullptr;
++  }
+   mTransaction->Close(aReason);
+   mTransaction = nullptr;
+ }

Added: head/www/firefox/files/patch-bug1401804
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1401804	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,31 @@
+commit 38e6bb85066b
+Author: Jon Coppeard <jcoppeard@mozilla.com>
+Date:   Fri Sep 22 13:09:44 2017 +0100
+
+    Bug 1401804 - Fix IsMarkedBlack check used in gray marking asserts r=sfink a=sylvestre
+---
+ js/src/gc/Barrier.cpp | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git js/src/gc/Barrier.cpp js/src/gc/Barrier.cpp
+index 5a5dfbe9bed0..0c42d16e7117 100644
+--- js/src/gc/Barrier.cpp
++++ js/src/gc/Barrier.cpp
+@@ -33,15 +33,8 @@ RuntimeFromActiveCooperatingThreadIsHeapMajorCollecting(JS::shadow::Zone* shadow
+ bool
+ IsMarkedBlack(JSObject* obj)
+ {
+-    // Note: we assume conservatively that Nursery things will be live.
+-    if (!obj->isTenured())
+-        return true;
+-
+-    gc::TenuredCell& tenured = obj->asTenured();
+-    if (tenured.isMarkedAny() || tenured.arena()->allocatedDuringIncremental)
+-        return true;
+-
+-    return false;
++    return obj->isMarkedBlack() ||
++           (obj->isTenured() && obj->asTenured().arena()->allocatedDuringIncremental);
+ }
+ 
+ bool

Added: head/www/firefox/files/patch-bug1402442
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/firefox/files/patch-bug1402442	Sat Nov 11 20:42:33 2017	(r454000)
@@ -0,0 +1,181 @@
+commit 44b4458e2d21
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Mon Sep 25 18:25:29 2017 +0200
+
+    Bug 1402442 - Properly remove display: contents pseudo-frames. r=mats, a=ritu
+    
+    MozReview-Commit-ID: 4pjVLQfv3YR
+    Signed-off-by: Emilio Cobos Álvarez <emilio@crisal.io>
+    
+    --HG--
+    extra : source : faa69ac1c14b79838cc0aac842b470a110542ebd
+    extra : amend_source : 3a76e0123bf3f7d10295000cc44fd8bdddf700df
+---
+ layout/base/nsCSSFrameConstructor.cpp              | 26 +++++++++++++++-------
+ testing/web-platform/meta/MANIFEST.json            | 25 +++++++++++++++++++++
+ ...dynamic-generated-content-fieldset-001.html.ini |  4 ++++
+ ...dynamic-generated-content-fieldset-001-ref.html | 16 +++++++++++++
+ ...nts-dynamic-generated-content-fieldset-001.html | 26 ++++++++++++++++++++++
+ 5 files changed, 89 insertions(+), 8 deletions(-)
+
+diff --git layout/base/nsCSSFrameConstructor.cpp layout/base/nsCSSFrameConstructor.cpp
+index 99b1211b399b..4fce3fb381a7 100644
+--- layout/base/nsCSSFrameConstructor.cpp
++++ layout/base/nsCSSFrameConstructor.cpp
+@@ -1698,6 +1698,17 @@ nsCSSFrameConstructor::NotifyDestroyingFrame(nsIFrame* aFrame)
+   nsFrameManager::NotifyDestroyingFrame(aFrame);
+ }
+ 
++static bool
++HasGeneratedContent(const nsIContent* aChild)
++{
++  if (!aChild->MayHaveAnonymousChildren()) {

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201711112042.vABKgYvi007400>