partly import changes from tenfourfox:

- #651: M1767365+backbugs M1757604 M1771774 M1776658 (bc6daa0ae)

dom/bindings/ToJSValue.h

@@ -118,7 +118,7 @@ ToJSValue(JSContext* aCx,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(aArgument));
   return true;
 }
 

dom/canvas/CanvasRenderingContext2D.cpp

@@ -6075,8 +6075,8 @@ CanvasRenderingContext2D::PutImageData_explicit(int32_t aX, int32_t aY, uint32_t
     return NS_ERROR_FAILURE;
   }
 
-  uint32_t copyX = dirtyRect.x - aX;
+  uint32_t copyX = dirtyRect.x;
-  uint32_t copyY = dirtyRect.y - aY;
+  uint32_t copyY = dirtyRect.y;
   //uint8_t *src = aArray->Data();
   uint8_t *dst = imgsurf->Data();
   uint8_t* srcLine = aArray->Data() + copyY * (aW * 4) + copyX * 4;

dom/indexedDB/KeyPath.cpp

@@ -108,7 +108,7 @@ GetJSValFromKeyPathString(JSContext* aCx,
       // step 4 substep 1: check for .length on a String value.
       if (currentVal.isString() && !tokenizer.hasMoreTokens() &&
           token.EqualsLiteral("length") && aOptions == DoNotCreateProperties) {
-        aKeyJSVal->setNumber(double(JS_GetStringLength(currentVal.toString())));
+        aKeyJSVal->setNumber(uint32_t(JS_GetStringLength(currentVal.toString())));
         break;
       }
 

gfx/2d/BaseRect.h

@@ -134,6 +134,8 @@ struct BaseRect {
     result.y = std::max<T>(y, aRect.y);
     T right = std::min<T>(x + width, aRect.x + aRect.width);
     T bottom = std::min<T>(y + height, aRect.y + aRect.height);
+    // See bug 1457110, this function expects to -only- size to 0,0 if the
+    // width/height is explicitly negative.
     if (right < result.x || bottom < result.y) {
       result.width = 0;
       result.height = 0;
@@ -149,6 +151,9 @@ struct BaseRect {
   // of the x/y of *this and aRect.
   //
   // 'this' can be the same object as either aRect1 or aRect2
+  // Note: bug 1457110 changed this due to a regression from bug 1387399,
+  // but we never used that code, and it was subsequently backed out. We have
+  // SafeIntersect only so we can implement bug 1767365.
   bool IntersectRect(const Sub& aRect1, const Sub& aRect2)
   {
     *static_cast<Sub*>(this) = aRect1.Intersect(aRect2);

js/xpconnect/src/XPCConvert.cpp

@@ -137,7 +137,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
         d.setNumber(*static_cast<const float*>(s));
         return true;
     case nsXPTType::T_DOUBLE:
-        d.setNumber(*static_cast<const double*>(s));
+        d.set(JS_NumberValue(*static_cast<const double*>(s)));
         return true;
     case nsXPTType::T_BOOL  :
         d.setBoolean(*static_cast<const bool*>(s));

js/xpconnect/src/XPCVariant.cpp

@@ -436,7 +436,7 @@ XPCVariant::VariantDataToJS(nsIVariant* variant,
             double d;
             if (NS_FAILED(variant->GetAsDouble(&d)))
                 return false;
-            pJSVal.setNumber(d);
+            pJSVal.set(JS_NumberValue(d));
             return true;
         }
         case nsIDataType::VTYPE_BOOL:

modules/libjar/moz.build

@@ -41,6 +41,10 @@ SOURCES += [
     'nsZipArchive.cpp',
 ]
 
+LOCAL_INCLUDES += [
+    '/netwerk/base',
+]
+
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'

modules/libjar/nsJARChannel.cpp

@@ -24,6 +24,7 @@
 #include "nsITabChild.h"
 #include "private/pprio.h"
 #include "nsInputStreamPump.h"
+#include "nsStandardURL.h"
 
 using namespace mozilla;
 using namespace mozilla::net;
@@ -79,6 +80,24 @@ public:
                 fullJarURI->GetAsciiSpec(mJarDirSpec);
             NS_ASSERTION(NS_SUCCEEDED(rv), "this shouldn't fail");
         }
+        /* implement bug 1771774 without NS_MutateURI: use asciispec above */
+        if (ENTRY_IS_DIRECTORY(mJarEntry) && fullJarURI) {
+            RefPtr<nsStandardURL> cleanuri = new nsStandardURL();
+
+            if (NS_SUCCEEDED(cleanuri->Init(
+                             nsIStandardURL::URLTYPE_NO_AUTHORITY, -1,
+                             mJarDirSpec, nullptr, nullptr))) {
+                cleanuri->SetQuery(NS_LITERAL_CSTRING(""));
+                cleanuri->SetRef(NS_LITERAL_CSTRING(""));
+#ifdef DEBUG
+                nsresult rv =
+#endif
+                    cleanuri->GetAsciiSpec(mJarDirSpec);
+                NS_ASSERTION(NS_SUCCEEDED(rv), "this shouldn't fail either");
+            } else {
+                MOZ_CRASH("failed to clean jar URI");
+            }
+        }
     }
 
     int64_t GetContentLength()
@@ -577,48 +596,50 @@ nsJARChannel::GetSecurityInfo(nsISupports **aSecurityInfo)
     return NS_OK;
 }
 
+nsresult
+nsJARChannel::SetContentTypeGuess() {
+    //
+    // generate content type and set it
+    //
+    const char *ext = nullptr, *fileName = mJarEntry.get();
+    int32_t len = mJarEntry.Length();
+
+    // check if we're displaying a directory
+    // mJarEntry will be empty if we're trying to display
+    // the topmost directory in a zip, e.g. jar:foo.zip!/
+    if (ENTRY_IS_DIRECTORY(mJarEntry)) {
+        mContentType.AssignLiteral(APPLICATION_HTTP_INDEX_FORMAT);
+    } else {
+        // not a directory, take a guess by its extension
+        for (int32_t i = len-1; i >= 0; i--) {
+            if (fileName[i] == '.') {
+                ext = &fileName[i + 1];
+                break;
+            }
+        }
+        if (ext) {
+            nsIMIMEService *mimeServ = gJarHandler->MimeService();
+            if (mimeServ)
+                mimeServ->GetTypeFromExtension(nsDependentCString(ext), mContentType);
+        }
+        if (mContentType.IsEmpty())
+            mContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
+    }
+
+    return NS_OK;
+}
+
 NS_IMETHODIMP
-nsJARChannel::GetContentType(nsACString &result)
+nsJARChannel::GetContentType(nsACString &aResult)
 {
     // If the Jar file has not been open yet,
     // We return application/x-unknown-content-type
-    if (!mOpened) {
+    if (!mOpened || mContentType.IsEmpty()) {
-      result.Assign(UNKNOWN_CONTENT_TYPE);
+      aResult.Assign(UNKNOWN_CONTENT_TYPE);
       return NS_OK;
     }
 
-    if (mContentType.IsEmpty()) {
+    aResult = mContentType;
-
-        //
-        // generate content type and set it
-        //
-        const char *ext = nullptr, *fileName = mJarEntry.get();
-        int32_t len = mJarEntry.Length();
-
-        // check if we're displaying a directory
-        // mJarEntry will be empty if we're trying to display
-        // the topmost directory in a zip, e.g. jar:foo.zip!/
-        if (ENTRY_IS_DIRECTORY(mJarEntry)) {
-            mContentType.AssignLiteral(APPLICATION_HTTP_INDEX_FORMAT);
-        }
-        else {
-            // not a directory, take a guess by its extension
-            for (int32_t i = len-1; i >= 0; i--) {
-                if (fileName[i] == '.') {
-                    ext = &fileName[i + 1];
-                    break;
-                }
-            }
-            if (ext) {
-                nsIMIMEService *mimeServ = gJarHandler->MimeService();
-                if (mimeServ)
-                    mimeServ->GetTypeFromExtension(nsDependentCString(ext), mContentType);
-            }
-            if (mContentType.IsEmpty())
-                mContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
-        }
-    }
-    result = mContentType;
     return NS_OK;
 }
 
@@ -729,7 +750,7 @@ nsJARChannel::Open(nsIInputStream **stream)
         return rv;
 
     input.forget(stream);
-    mOpened = true;
+    SetOpened();
     // local files are always considered safe
     mIsUnsafe = false;
     return NS_OK;
@@ -744,6 +765,14 @@ nsJARChannel::Open2(nsIInputStream** aStream)
     return Open(aStream);
 }
 
+void
+nsJARChannel::SetOpened() {
+    MOZ_ASSERT(!mOpened, "Opening channel twice?");
+    mOpened = true;
+    // Compute the content type now.
+    NS_ASSERTION(NS_SUCCEEDED(SetContentTypeGuess()), "content type guess failure");
+}
+
 NS_IMETHODIMP
 nsJARChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *ctx)
 {
@@ -826,7 +855,7 @@ nsJARChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *ctx)
     if (mLoadGroup)
         mLoadGroup->AddRequest(this, nullptr);
 
-    mOpened = true;
+    SetOpened();
 
     return NS_OK;
 }

modules/libjar/nsJARChannel.h

@@ -66,6 +66,9 @@ private:
                                     mozilla::net::MemoryDownloader::Data aData)
         override;
 
+    nsresult SetContentTypeGuess();
+    void SetOpened();
+
     nsCString                       mSpec;
 
     bool                            mOpened;