Merge remote-tracking branch 'origin/master' into custom

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Clobber for SpiderMonkey Update
+Clobber for NSS Update

config/external/nss/nss.symbols

@@ -216,7 +216,9 @@ NSS_CMSSignedData_Create
 NSS_CMSSignedData_CreateCertsOnly
 NSS_CMSSignedData_Destroy
 NSS_CMSSignedData_GetContentInfo
+NSS_CMSSignedData_GetDigestAlgs
 NSS_CMSSignedData_GetSignerInfo
+NSS_CMSSignedData_HasDigests
 NSS_CMSSignedData_ImportCerts
 NSS_CMSSignedData_SetDigestValue
 NSS_CMSSignedData_SignerInfoCount

dom/base/nsGlobalWindow.cpp

@@ -3224,6 +3224,12 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         newInnerWindow->mLocalStorage = nullptr;
         newInnerWindow->mSessionStorage = nullptr;
 
+        newInnerWindow->mPerformance = nullptr;
+
+        // This must be called after nulling the internal objects because
+        // we might recreate them here by calling the getter methods, and
+        // store them into the JS slots. If we null them after, the slot
+        // values and the objects will be out of sync.
         newInnerWindow->ClearDocumentDependentSlots(cx);
       }
     } else {
@@ -3364,10 +3370,16 @@ nsGlobalWindow::InnerSetNewDocument(JSContext* aCx, nsIDocument* aDocument)
   }
 
   mDoc = aDocument;
-  ClearDocumentDependentSlots(aCx);
   mFocusedNode = nullptr;
   mLocalStorage = nullptr;
   mSessionStorage = nullptr;
+  mPerformance = nullptr;
+
+  // This must be called after nulling the internal objects because we might
+  // recreate them here by calling the getter methods, and store them into the JS
+  // slots. If we null them after, the slot values and the objects will be
+  // out of sync.
+  ClearDocumentDependentSlots(aCx);
 
 #ifdef DEBUG
   mLastOpenedURI = aDocument->GetDocumentURI();

dom/canvas/WebGLContextBuffers.cpp

@@ -9,6 +9,8 @@
 #include "WebGLBuffer.h"
 #include "WebGLVertexArray.h"
 
+#include "mozilla/CheckedInt.h"
+
 namespace mozilla {
 
 WebGLRefPtr<WebGLBuffer>*
@@ -345,6 +347,16 @@ WebGLContext::BufferData(GLenum target, WebGLsizeiptr size, GLenum usage)
 
     ////
 
+    const auto checkedSize = CheckedInt<size_t>(size);
+    if (!checkedSize.isValid())
+      return ErrorOutOfMemory("%s: Size too large for platform.", funcName);
+     
+#if defined(XP_MACOSX)
+    if (gl->WorkAroundDriverBugs() && size > 1200000000) {
+      return ErrorOutOfMemory("Allocations larger than 1200000000 fail on MacOS.");
+    }
+#endif
+
     const UniqueBuffer zeroBuffer(calloc(size, 1));
     if (!zeroBuffer)
         return ErrorOutOfMemory("%s: Failed to allocate zeros.", funcName);

dom/indexedDB/IDBDatabase.cpp

@@ -1257,6 +1257,9 @@ IDBDatabase::LastRelease()
   AssertIsOnOwningThread();
 
   CloseInternal();
+  
+  // Make sure that file actors created after the database was closed are expired.
+  ExpireFileActors(/* aExpireAll */ true);
 
   ExpireFileActors(/* aExpireAll */ true);
 

js/src/jit/IonBuilder.cpp

@@ -8893,10 +8893,8 @@ IonBuilder::jsop_getimport(PropertyName* name)
 
     if (!emitted) {
         // This can happen if we don't have type information.
-        TypeSet::ObjectKey* staticKey = TypeSet::ObjectKey::get(targetEnv);
         TemporaryTypeSet* types = bytecodeTypes(pc);
-        BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), staticKey,
-                                                           name, types, /* updateObserved = */ true);
+        BarrierKind barrier = BarrierKind::TypeSet;
 
         if (!loadStaticSlot(targetEnv, barrier, types, shape->slot()))
             return false;

js/src/shell/OSObject.cpp

@@ -184,6 +184,11 @@ FileAsTypedArray(JSContext* cx, JS::HandleString pathnameStr)
                 return nullptr;
             JS_ReportErrorUTF8(cx, "can't seek start of %s", pathname.ptr());
         } else {
+            if (len > INT32_MAX) {
+                JS_ReportErrorUTF8(cx, "file %s is too large for a Uint8Array",
+                                   pathname.ptr());
+                return nullptr;
+            }        
             obj = JS_NewUint8Array(cx, len);
             if (!obj)
                 return nullptr;

modules/libpref/init/all.js

@@ -732,19 +732,19 @@ pref("gfx.layerscope.port", 23456);
 // This should be use to quickly find which slow paths are used by test cases.
 pref("gfx.perf-warnings.enabled", false);
 
+// Color Management System
 // 0 = Off, 1 = All Images, 2 = Tagged Images Only.
 // See eCMSMode in gfx/thebes/gfxPlatform.h
-#ifdef XP_WIN
+// Enabled by default on Windows and Mac, disabled elsewhere
+#if defined(XP_WIN) || defined(XP_MACOSX)
 pref("gfx.color_management.mode", 2);
+#else
+pref("gfx.color_management.mode", 0);
+#endif
 pref("gfx.color_management.display_profile", "");
 pref("gfx.color_management.rendering_intent", 0);
 pref("gfx.color_management.enablev4", true);
-#else
-pref("gfx.color_management.mode", 0);
-pref("gfx.color_management.display_profile", "");
-pref("gfx.color_management.rendering_intent", 0);
-pref("gfx.color_management.enablev4", false);
-#endif
+
 
 pref("gfx.downloadable_fonts.enabled", true);
 pref("gfx.downloadable_fonts.fallback_delay", 3000);

netwerk/protocol/http/Http2Session.cpp

@@ -2182,6 +2182,7 @@ Http2Session::RecvAltSvc(Http2Session *self)
     }
     
     if (NS_FAILED(self->SetInputFrameDataStream(self->mInputFrameID)) ||
+        !self->mInputFrameDataStream ||
         !self->mInputFrameDataStream->Transaction() ||
         !self->mInputFrameDataStream->Transaction()->RequestHead()) {
       LOG3(("Http2Session::RecvAltSvc %p got frame w/o origin on invalid stream", self));

toolkit/mozapps/installer/windows/nsis/common.nsh

@@ -5608,21 +5608,6 @@
       StrCpy $INSTDIR "$R9"
 !endif
 
-      ; If the user doesn't have write access to the installation directory set
-      ; the installation directory to a subdirectory of the All Users application
-      ; directory and if the user can't write to that location set the installation
-      ; directory to a subdirectory of the users local application directory
-      ; (e.g. non-roaming).
-      ${CanWriteToInstallDir} $R9
-      StrCmp "$R9" "false" +1 finish_check_install_dir
-
-      SetShellVarContext all      ; Set SHCTX to All Users
-      StrCpy $INSTDIR "$APPDATA\${BrandFullName}\"
-      ${CanWriteToInstallDir} $R9
-      StrCmp "$R9" "false" +2 +1
-      StrCpy $INSTDIR "$LOCALAPPDATA\${BrandFullName}\"
-
-      finish_check_install_dir:
       IfFileExists "$INSTDIR" +3 +1
       Pop $R9
       Return

toolkit/xre/nsUpdateDriver.cpp

@@ -75,21 +75,26 @@ GetUpdateLog()
 #endif
 
 static nsresult
-GetCurrentWorkingDir(char *buf, size_t size)
+GetCurrentWorkingDir(nsACString& aOutPath)
 {
   // Cannot use NS_GetSpecialDirectory because XPCOM is not yet initialized.
-  // This code is duplicated from xpcom/io/SpecialSystemDirectory.cpp:
-
+  
+  // Just in case junk has been passed in.
+  aOutPath.Truncate();
+  
 #if defined(XP_WIN)
   wchar_t wpath[MAX_PATH];
-  if (!_wgetcwd(wpath, size))
+  if (!_wgetcwd(wpath, ArrayLength(wpath)))
     return NS_ERROR_FAILURE;
-  NS_ConvertUTF16toUTF8 path(wpath);
-  strncpy(buf, path.get(), size);
+  CopyUTF16toUTF8(nsDependentString(wpath), aOutPath);
 #else
-  if(!getcwd(buf, size))
+  char path[MAXPATHLEN];
+  if (!getcwd(path, ArrayLength(path))) {
     return NS_ERROR_FAILURE;
+  }
+  aOutPath = path;
 #endif
+
   return NS_OK;
 }
 
@@ -535,8 +540,8 @@ SwitchToUpdatedApp(nsIFile *greDir, nsIFile *updateDir,
     return;
 
   // Get the current working directory.
-  char workingDirPath[MAXPATHLEN];
-  rv = GetCurrentWorkingDir(workingDirPath, sizeof(workingDirPath));
+  nsAutoCString workingDirPath;
+  rv = GetCurrentWorkingDir(workingDirPath);
   if (NS_FAILED(rv))
     return;
 
@@ -565,7 +570,7 @@ SwitchToUpdatedApp(nsIFile *greDir, nsIFile *updateDir,
   argv[3] = (char*) applyToDir.get();
   argv[4] = (char*) pid.get();
   if (appArgc) {
-    argv[5] = workingDirPath;
+    argv[5] = (char*) workingDirPath.get();
     argv[6] = (char*) appFilePath.get();
     for (int i = 1; i < appArgc; ++i)
       argv[6 + i] = appArgv[i];
@@ -743,8 +748,8 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile,
   }
 
   // Get the current working directory.
-  char workingDirPath[MAXPATHLEN];
-  rv = GetCurrentWorkingDir(workingDirPath, sizeof(workingDirPath));
+  nsAutoCString workingDirPath;
+  rv = GetCurrentWorkingDir(workingDirPath);
   if (NS_FAILED(rv))
     return;
 
@@ -786,7 +791,7 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile,
   argv[3] = (char*) applyToDir.get();
   argv[4] = (char*) pid.get();
   if (restart && appArgc) {
-    argv[5] = workingDirPath;
+    argv[5] = (char*) workingDirPath.get();
     argv[6] = (char*) appFilePath.get();
     for (int i = 1; i < appArgc; ++i)
       argv[6 + i] = appArgv[i];