merge mozilla-inbound to mozilla-central. r=merge a=merge

MozReview-Commit-ID: CmMBcpJapLy

accessible/tests/browser/bounds/browser.ini

@@ -8,4 +8,4 @@ support-files =
 
 [browser_test_zoom.js]
 [browser_test_zoom_text.js]
-skip-if = true # Bug 1372296, Bug 1379808, Bug 1391453
+skip-if = e10s && os == 'win' # bug 1372296

accessible/tests/mochitest/common.js

@@ -191,6 +191,18 @@ function isObject(aObj, aExpectedObj, aMsg) {
             "', expected '" + prettyName(aExpectedObj) + "'");
 }
 
+/**
+ * is() function checking the expected value is within the range.
+ */
+function isWithin(aExpected, aGot, aWithin, aMsg) {
+  if (Math.abs(aGot - aExpected) <= aWithin) {
+    ok(true, `${aMsg} - Got ${aGot}`);
+  } else {
+    ok(false,
+       `${aMsg} - Got ${aGot}, expected ${aExpected} with error of ${aWithin}`);
+  }
+}
+
 // //////////////////////////////////////////////////////////////////////////////
 // Helpers for getting DOM node/accessible
 

accessible/tests/mochitest/layout.js

@@ -150,23 +150,29 @@ function testTextBounds(aID, aStartOffset, aEndOffset, aRect, aCoordOrigin) {
   var hyperText = getAccessible(aID, [nsIAccessibleText]);
   hyperText.getRangeExtents(aStartOffset, aEndOffset,
                             xObj, yObj, widthObj, heightObj, aCoordOrigin);
+
+  // x
   is(xObj.value, expectedX,
      "Wrong x coordinate of text between offsets (" + aStartOffset + ", " +
      aEndOffset + ") for " + prettyName(aID));
-  is(yObj.value, expectedY,
-     "Wrong y coordinate of text between offsets (" + aStartOffset + ", " +
-     aEndOffset + ") for " + prettyName(aID));
 
+  // y
+  isWithin(yObj.value, expectedY, 1,
+           `y coord of text between offsets (${aStartOffset}, ${aEndOffset}) ` +
+           `for ${prettyName(aID)}`);
+
+  // Width
   var msg = "Wrong width of text between offsets (" + aStartOffset + ", " +
     aEndOffset + ") for " + prettyName(aID);
   if (widthObj.value == expectedWidth)
     ok(true, msg);
   else
     todo(false, msg); // fails on some windows machines
 
-  is(heightObj.value, expectedHeight,
-     "Wrong height of text between offsets (" + aStartOffset + ", " +
-     aEndOffset + ") for " + prettyName(aID));
+  // Height
+  isWithin(heightObj.value, expectedHeight, 1,
+           `height of text between offsets (${aStartOffset}, ${aEndOffset}) ` +
+           `for ${prettyName(aID)}`);
 }
 
 /**

browser/components/customizableui/CustomizableUI.jsm

@@ -4353,7 +4353,7 @@ OverflowableToolbar.prototype = {
   _onResize(aEvent) {
     if (!this._lazyResizeHandler) {
       this._lazyResizeHandler = new DeferredTask(this._onLazyResize.bind(this),
-                                                 LAZY_RESIZE_INTERVAL_MS);
+                                                 LAZY_RESIZE_INTERVAL_MS, 0);
     }
     this._lazyResizeHandler.arm();
   },

browser/components/extensions/ext-browser.js

@@ -517,9 +517,7 @@ class TabTracker extends TabTrackerBase {
     if (browser.ownerDocument.documentURI === "about:addons") {
       // When we're loaded into a <browser> inside about:addons, we need to go up
       // one more level.
-      browser = browser.ownerGlobal.QueryInterface(Ci.nsIInterfaceRequestor)
-                       .getInterface(Ci.nsIDocShell)
-                       .chromeEventHandler;
+      browser = browser.ownerDocument.docShell.chromeEventHandler;
     }
 
     let result = {

browser/components/extensions/ext-browsingData.js

@@ -50,10 +50,7 @@ const clearCookies = async function(options) {
 
   if (options.since || options.hostnames) {
     // Iterate through the cookies and delete any created after our cutoff.
-    let cookiesEnum = cookieMgr.enumerator;
-    while (cookiesEnum.hasMoreElements()) {
-      let cookie = cookiesEnum.getNext().QueryInterface(Ci.nsICookie2);
-
+    for (const cookie of XPCOMUtils.IterSimpleEnumerator(cookieMgr.enumerator, Ci.nsICookie2)) {
       if ((!options.since || cookie.creationTime >= PlacesUtils.toPRTime(options.since)) &&
           (!options.hostnames || options.hostnames.includes(cookie.host.replace(/^\./, "")))) {
         // This cookie was created after our cutoff, clear it.

browser/components/extensions/ext-tabs.js

@@ -734,9 +734,7 @@ this.tabs = class extends ExtensionAPI {
             // For non-remote browsers, this event is dispatched on the document
             // rather than on the <browser>.
             if (browser instanceof Ci.nsIDOMDocument) {
-              browser = browser.defaultView.QueryInterface(Ci.nsIInterfaceRequestor)
-                               .getInterface(Ci.nsIDocShell)
-                               .chromeEventHandler;
+              browser = browser.docShell.chromeEventHandler;
             }
 
             let {gBrowser} = browser.ownerGlobal;

browser/installer/windows/nsis/shared.nsh

@@ -113,9 +113,12 @@
 
   RmDir /r /REBOOTOK "$INSTDIR\${TO_BE_DELETED}"
 
-  ; Register AccessibleHandler.dll with COM (this writes to HKLM)
+  ; Register AccessibleHandler.dll with COM (this requires write access to HKLM)
   ${RegisterAccessibleHandler}
 
+  ; Register AccessibleMarshal.dll with COM (this requires write access to HKLM)
+  ${RegisterAccessibleMarshal}
+
 !ifdef MOZ_MAINTENANCE_SERVICE
   Call IsUserAdmin
   Pop $R0
@@ -1014,6 +1017,11 @@
 !macroend
 !define RegisterAccessibleHandler "!insertmacro RegisterAccessibleHandler"
 
+!macro RegisterAccessibleMarshal
+  ${RegisterDLL} "$INSTDIR\AccessibleMarshal.dll"
+!macroend
+!define RegisterAccessibleMarshal "!insertmacro RegisterAccessibleMarshal"
+
 ; Removes various registry entries for reasons noted below (does not use SHCTX).
 !macro RemoveDeprecatedKeys
   StrCpy $0 "SOFTWARE\Classes"

devtools/client/framework/test/browser.ini

@@ -72,7 +72,6 @@ skip-if = debug # Bug 1282269
 [browser_target_remote.js]
 [browser_target_support.js]
 [browser_toolbox_custom_host.js]
-skip-if = true # Bug 1386410
 [browser_toolbox_dynamic_registration.js]
 [browser_toolbox_getpanelwhenready.js]
 [browser_toolbox_highlight.js]

devtools/server/performance/memory.js

@@ -195,7 +195,7 @@ Memory.prototype = {
         this._poller.disarm();
       }
       this._poller = new DeferredTask(this._emitAllocations,
-                                      this.drainAllocationsTimeoutTimer);
+                                      this.drainAllocationsTimeoutTimer, 0);
       this._poller.arm();
     }
 

devtools/server/performance/profiler.js

@@ -387,7 +387,7 @@ const ProfilerManager = (function () {
       if (this._profilerStatusSubscribers > 0 && nsIProfilerModule.IsActive()) {
         if (!this._poller) {
           this._poller = new DeferredTask(this._emitProfilerStatus.bind(this),
-                                          this._profilerStatusInterval);
+                                          this._profilerStatusInterval, 0);
         }
         this._poller.arm();
       } else if (this._poller) {

dom/base/nsGlobalWindow.cpp

@@ -12764,7 +12764,7 @@ nsGlobalWindow::GetParentInternal()
   if (IsInnerWindow()) {
     nsGlobalWindow* outer = GetOuterWindowInternal();
     if (!outer) {
-      NS_WARNING("No outer window available!");
+      // No outer window available!
       return nullptr;
     }
     return outer->GetParentInternal();

dom/ipc/CoalescedMouseData.cpp

@@ -26,9 +26,6 @@ CoalescedMouseData::Coalesce(const WidgetMouseEvent& aEvent,
     MOZ_ASSERT(mCoalescedInputEvent->mModifiers == aEvent.mModifiers);
     MOZ_ASSERT(mCoalescedInputEvent->mReason == aEvent.mReason);
     MOZ_ASSERT(mCoalescedInputEvent->inputSource == aEvent.inputSource);
-
-    // Assuming button changes should trigger other mouse events and dispatch
-    // the coalesced mouse move events.
     MOZ_ASSERT(mCoalescedInputEvent->button == aEvent.button);
     MOZ_ASSERT(mCoalescedInputEvent->buttons == aEvent.buttons);
     mCoalescedInputEvent->mTimeStamp = aEvent.mTimeStamp;
@@ -47,6 +44,8 @@ CoalescedMouseData::CanCoalesce(const WidgetMouseEvent& aEvent,
          (mCoalescedInputEvent->mModifiers == aEvent.mModifiers &&
           mCoalescedInputEvent->inputSource == aEvent.inputSource &&
           mCoalescedInputEvent->pointerId == aEvent.pointerId &&
+          mCoalescedInputEvent->button == aEvent.button &&
+          mCoalescedInputEvent->buttons == aEvent.buttons &&
           mGuid == aGuid &&
           mInputBlockId == aInputBlockId);
 }

dom/ipc/ContentChild.cpp

@@ -2310,6 +2310,8 @@ ContentChild::ActorDestroy(ActorDestroyReason why)
   }
 
 #ifndef NS_FREE_PERMANENT_DATA
+  CompositorManagerChild::Shutdown();
+
   // In release builds, there's no point in the content process
   // going through the full XPCOM shutdown path, because it doesn't
   // keep persistent state.

dom/media/mediasink/DecodedStream.cpp

@@ -412,7 +412,7 @@ DecodedStream::DestroyData(UniquePtr<DecodedStreamData> aData)
   data->Forget();
   nsCOMPtr<nsIRunnable> r = NS_NewRunnableFunction("DecodedStream::DestroyData",
                                                    [=]() { delete data; });
-  mAbstractMainThread->Dispatch(r.forget());
+  NS_DispatchToMainThread(r.forget());
 }
 
 void

dom/media/test/crashtests/1378826.html

@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Bug 1378826 : Removing last video track from recorder stream crashes.</title>
+</head>
+<body>
+<canvas id="canvas"></canvas>
+<script type="text/javascript">
+
+function wait(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function boom() {
+  let canvas = document.getElementById("canvas");
+  let ctx = canvas.getContext('2d');
+  ctx.fillRect(10, 10, 100, 100);
+  let stream = canvas.captureStream();
+  let rec = new MediaRecorder(stream);
+  // At the time of fixing this bug onstop would fire, but this may change in
+  // future. As such defensively listen for onerror too to prevent this test
+  // timing out.
+  let stoppedPromise = new Promise(y => (rec.onstop = y,
+                                         rec.onerror = e => y));
+  rec.onstart = () => {
+    // Remove the video track from the stream we're recording
+    stream.removeTrack(stream.getTracks()[0]);
+    // Recorder should stop or error in response to the above
+    return stoppedPromise
+    .then(() => {
+      // Little wait to help get bad writes if they're going to happen
+      wait(100)
+      .then(() => {
+        // Didn't crash, finish
+        document.documentElement.removeAttribute("class");
+      });
+    });
+  };
+  rec.start();
+}
+
+window.onload = boom;
+
+</script>
+</body>
+</html>

dom/media/test/crashtests/crashtests.list

@@ -85,6 +85,7 @@ load 1304948.html
 load 1319486.html
 load 1368490.html
 load 1291702.html
+load 1378826.html
 load 1384248.html
 load disconnect-wrong-destination.html
 load analyser-channels-1.html

ipc/glue/GeckoChildProcessHost.cpp

@@ -1119,6 +1119,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
   if (shouldSandboxCurrentProcess) {
     if (mSandboxBroker.LaunchApp(cmdLine.program().c_str(),
                                  cmdLine.command_line_string().c_str(),
+                                 mProcessType,
                                  mEnableSandboxLogging,
                                  &process)) {
       EnvironmentLog("MOZ_PROCESS_LOG").print(

ipc/mscom/oop/Handler.cpp

@@ -355,9 +355,12 @@ Handler::Register(REFCLSID aClsid)
     return HRESULT_FROM_WIN32(lastError);
   }
 
+  // The result of GetModuleFileName excludes the null terminator
+  DWORD valueSizeWithNullInBytes = (size + 1) * sizeof(wchar_t);
+
   result = RegSetValueEx(inprocHandlerKey, L"", 0, REG_EXPAND_SZ,
                          reinterpret_cast<const BYTE*>(absLibPath),
-                         sizeof(absLibPath));
+                         valueSizeWithNullInBytes);
   if (result != ERROR_SUCCESS) {
     Unregister(aClsid);
     return HRESULT_FROM_WIN32(result);

js/src/jit/JitcodeMap.cpp

@@ -1658,14 +1658,17 @@ JS_PUBLIC_API(void)
 JS::ForEachProfiledFrame(JSContext* cx, void* addr, ForEachProfiledFrameOp& op)
 {
     js::jit::JitcodeGlobalTable* table = cx->runtime()->jitRuntime()->getJitcodeGlobalTable();
-    js::jit::JitcodeGlobalEntry& entry = table->lookupInfallible(addr);
+    js::jit::JitcodeGlobalEntry* entry = table->lookup(addr);
+
+    if (!entry)
+        return;
 
     // Extract the stack for the entry.  Assume maximum inlining depth is <64
     const char* labels[64];
-    uint32_t depth = entry.callStackAtAddr(cx->runtime(), addr, labels, 64);
+    uint32_t depth = entry->callStackAtAddr(cx->runtime(), addr, labels, 64);
     MOZ_ASSERT(depth < 64);
     for (uint32_t i = depth; i != 0; i--) {
-        JS::ForEachProfiledFrameOp::FrameHandle handle(cx->runtime(), entry, addr, labels[i - 1], i - 1);
+        JS::ForEachProfiledFrameOp::FrameHandle handle(cx->runtime(), *entry, addr, labels[i - 1], i - 1);
         op(handle);
     }
 }

js/src/jit/JitcodeMap.h

@@ -1042,7 +1042,7 @@ class JitcodeGlobalTable
         return skiplistSize_ == 0;
     }
 
-    const JitcodeGlobalEntry* lookup(void* ptr) {
+    JitcodeGlobalEntry* lookup(void* ptr) {
         return lookupInternal(ptr);
     }
 

js/xpconnect/loader/ScriptPreloader.cpp

@@ -601,8 +601,6 @@ ScriptPreloader::WriteCache()
 {
     MOZ_ASSERT(!NS_IsMainThread());
 
-    Unused << URLPreloader::GetSingleton().WriteCache();
-
     if (!mDataPrepared && !mSaveComplete) {
         MOZ_ASSERT(!mBlockedOnSyncDispatch);
         mBlockedOnSyncDispatch = true;
@@ -695,7 +693,10 @@ ScriptPreloader::Run()
         mal.Wait(10000);
     }
 
-    auto result = WriteCache();
+    auto result = URLPreloader::GetSingleton().WriteCache();
+    Unused << NS_WARN_IF(result.isErr());
+
+    result = WriteCache();
     Unused << NS_WARN_IF(result.isErr());
 
     result = mChildCache->WriteCache();

js/xpconnect/loader/URLPreloader.cpp

@@ -202,6 +202,20 @@ URLPreloader::WriteCache()
 {
     MOZ_ASSERT(!NS_IsMainThread());
 
+    // The script preloader might call us a second time, if it has to re-write
+    // its cache after a cache flush. We don't care about cache flushes, since
+    // our cache doesn't store any file data, only paths. And we currently clear
+    // our cached file list after the first write, which means that a second
+    // write would (aside from breaking the invariant that we never touch
+    // mCachedURLs off-main-thread after the first write, and trigger a data
+    // race) mean we get no pre-loading on the next startup.
+    if (mCacheWritten) {
+        return Ok();
+    }
+    mCacheWritten = true;
+
+    LOG(Debug, "Writing cache...");
+
     nsCOMPtr<nsIFile> cacheFile;
     MOZ_TRY_VAR(cacheFile, GetCacheFile(NS_LITERAL_STRING("-new.bin")));
 
@@ -256,6 +270,8 @@ URLPreloader::Cleanup()
 Result<Ok, nsresult>
 URLPreloader::ReadCache(LinkedList<URLEntry>& pendingURLs)
 {
+    LOG(Debug, "Reading cache...");
+
     nsCOMPtr<nsIFile> cacheFile;
     MOZ_TRY_VAR(cacheFile, FindCacheFile());
 
@@ -301,6 +317,8 @@ URLPreloader::ReadCache(LinkedList<URLEntry>& pendingURLs)
         while (!buf.finished()) {
             CacheKey key(buf);
 
+            LOG(Debug, "Cached file: %s %s", key.TypeString(), key.mPath.get());
+
             auto entry = mCachedURLs.LookupOrAdd(key, key);
             entry->mResultCode = NS_ERROR_NOT_INITIALIZED;
 
@@ -385,6 +403,8 @@ URLPreloader::BackgroundReadFiles()
 
         nsresult rv = NS_OK;
 
+        LOG(Debug, "Background reading %s file %s", entry->TypeString(), entry->mPath.get());
+
         if (entry->mType == entry->TypeFile) {
             auto result = entry->Read();
             if (result.isErr()) {

js/xpconnect/loader/URLPreloader.h

@@ -303,6 +303,9 @@ class URLPreloader final : public nsIObserver
     bool mStartupFinished = false;
     bool mReaderInitialized = false;
 
+    // Only to be accessed from the cache write thread.
+    bool mCacheWritten = false;
+
     // The prefix URLs for files in the GRE and App omni jar archives.
     nsCString mGREPrefix;
     nsCString mAppPrefix;