From owner-svn-ports-all@freebsd.org Sat Nov 11 20:42:36 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A903EE7352B; Sat, 11 Nov 2017 20:42:36 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 49F276E2E5; Sat, 11 Nov 2017 20:42:36 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vABKgZFV007416; Sat, 11 Nov 2017 20:42:35 GMT (envelope-from jbeich@FreeBSD.org) Received: (from jbeich@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vABKgYvi007400; Sat, 11 Nov 2017 20:42:34 GMT (envelope-from jbeich@FreeBSD.org) Message-Id: <201711112042.vABKgYvi007400@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jbeich set sender to jbeich@FreeBSD.org using -f From: Jan Beich Date: Sat, 11 Nov 2017 20:42:34 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r454000 - in head/www/firefox: . files X-SVN-Group: ports-head X-SVN-Commit-Author: jbeich X-SVN-Commit-Paths: in head/www/firefox: . files X-SVN-Commit-Revision: 454000 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Nov 2017 20:42:36 -0000 Author: jbeich Date: Sat Nov 11 20:42:33 2017 New Revision: 454000 URL: https://svnweb.freebsd.org/changeset/ports/454000 Log: www/firefox: backport some FF57+ fixes PR: 222859 Security: f78eac48-c3d1-4666-8de5-63ceea25a578 MFH: 2017Q4 Added: head/www/firefox/files/patch-bug1261175 (contents, props changed) head/www/firefox/files/patch-bug1343147 (contents, props changed) head/www/firefox/files/patch-bug1355576 (contents, props changed) head/www/firefox/files/patch-bug1369561 (contents, props changed) head/www/firefox/files/patch-bug1375146 (contents, props changed) head/www/firefox/files/patch-bug1387799 (contents, props changed) head/www/firefox/files/patch-bug1394265 (contents, props changed) head/www/firefox/files/patch-bug1394530 (contents, props changed) head/www/firefox/files/patch-bug1395138 (contents, props changed) head/www/firefox/files/patch-bug1397811 (contents, props changed) head/www/firefox/files/patch-bug1400003 (contents, props changed) head/www/firefox/files/patch-bug1400554 (contents, props changed) head/www/firefox/files/patch-bug1401804 (contents, props changed) head/www/firefox/files/patch-bug1402442 (contents, props changed) head/www/firefox/files/patch-bug1404324 (contents, props changed) head/www/firefox/files/patch-bug1404636 (contents, props changed) head/www/firefox/files/patch-bug1404910 (contents, props changed) head/www/firefox/files/patch-bug1406398 (contents, props changed) head/www/firefox/files/patch-bug1406750 (contents, props changed) head/www/firefox/files/patch-bug1407375 (contents, props changed) head/www/firefox/files/patch-bug1407740 (contents, props changed) head/www/firefox/files/patch-bug1407751 (contents, props changed) head/www/firefox/files/patch-bug1408005 (contents, props changed) head/www/firefox/files/patch-bug1408412 (contents, props changed) head/www/firefox/files/patch-bug1408990 (contents, props changed) head/www/firefox/files/patch-bug1411458 (contents, props changed) head/www/firefox/files/patch-bug1412252 (contents, props changed) Modified: head/www/firefox/Makefile (contents, props changed) Modified: head/www/firefox/Makefile ============================================================================== --- head/www/firefox/Makefile Sat Nov 11 20:41:59 2017 (r453999) +++ head/www/firefox/Makefile Sat Nov 11 20:42:33 2017 (r454000) @@ -4,7 +4,7 @@ PORTNAME= firefox DISTVERSION= 56.0.2 DISTVERSIONSUFFIX=.source -PORTREVISION= 8 +PORTREVISION= 9 PORTEPOCH= 1 CATEGORIES= www ipv6 MASTER_SITES= MOZILLA/${PORTNAME}/releases/${DISTVERSION}/source \ Added: head/www/firefox/files/patch-bug1261175 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1261175 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,25 @@ +commit deccfad4c8ba +Author: Matt Woodrow +Date: Thu Oct 12 13:10:27 2017 +1300 + + Bug 1261175. r=tnikkel, a=ritu + + --HG-- + extra : source : 8281ed36bd4946af69af747b199814cc1a51fb52 +--- + view/nsViewManager.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git view/nsViewManager.cpp view/nsViewManager.cpp +index f3540f3478da..230512c0dcc0 100644 +--- view/nsViewManager.cpp ++++ view/nsViewManager.cpp +@@ -100,7 +100,7 @@ nsViewManager::~nsViewManager() + gViewManagers = nullptr; + } + +- mPresShell = nullptr; ++ MOZ_RELEASE_ASSERT(!mPresShell, "Releasing nsViewManager without having called Destroy on the PresShell!"); + } + + // We don't hold a reference to the presentation context because it Added: head/www/firefox/files/patch-bug1343147 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1343147 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,117 @@ +commit e215b167b9b9 +Author: cku +Date: Tue Oct 3 11:29:19 2017 +0800 + + Bug 1343147 - Do not double applying transform vector of the root frame in a glyph mask into the target context. r=mstange, a=ritu + + When we generate the glyph mask for a transformed frame in + GenerateAndPushTextMask, the transform vector had been applied into aContext[1], + so we should find a way to prevent applying the vector again when painting the + glyph mask. + + In bug 1299715, I tried to prevent double apply at [2], it caused two problems: + 1. We only skip generating nsDisplayTransform, but we may still create a + nsDisplayPerspactive bellow. Since the parent of a nsDisplayPerspective must be + a nsDisplayTransform, which have been ignored, so we hit this assertion. + 2. We skip all transform for all frames while painting the glyph mask, which is + not correct. We should only skip double applying transform vector of the root + frame. + + This patch fixes both of these issues: + a. We will still create a nsDisplayTransform for the root frame if need. But + the transform matrix we apply into the target context will be an identity + matrix, so we fix #1 above. + b. In #a, we change the transform matrix to an identity matrix only for the root + frame of the glyph mask, so we fix #2. + + [1] + https://hg.mozilla.org/mozilla-central/file/59e5ec5729db/layout/painting/nsDisplayList.cpp#l752 + [2] + https://hg.mozilla.org/mozilla-central/file/ce2c129f0a87/layout/generic/nsFrame.cpp#l2806 + + MozReview-Commit-ID: 973lkQQxLB6 + + --HG-- + extra : source : 84451d723686bc47b81c44ed2ddf6c61f3e35915 +--- + layout/generic/nsFrame.cpp | 13 +++++-------- + layout/painting/nsDisplayList.cpp | 9 ++++++++- + 2 files changed, 13 insertions(+), 9 deletions(-) + +diff --git layout/generic/nsFrame.cpp layout/generic/nsFrame.cpp +index 37f2e2801220..dbfd61b7e142 100644 +--- layout/generic/nsFrame.cpp ++++ layout/generic/nsFrame.cpp +@@ -2803,14 +2803,11 @@ nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder* aBuilder, + buildingDisplayList.SetReferenceFrameAndCurrentOffset(outerReferenceFrame, + GetOffsetToCrossDoc(outerReferenceFrame)); + +- if (!aBuilder->IsForGenerateGlyphMask() && +- !aBuilder->IsForPaintingSelectionBG()) { +- nsDisplayTransform *transformItem = +- new (aBuilder) nsDisplayTransform(aBuilder, this, +- &resultList, dirtyRect, 0, +- allowAsyncAnimation); +- resultList.AppendNewToTop(transformItem); +- } ++ nsDisplayTransform *transformItem = ++ new (aBuilder) nsDisplayTransform(aBuilder, this, ++ &resultList, dirtyRect, 0, ++ allowAsyncAnimation); ++ resultList.AppendNewToTop(transformItem); + + if (hasPerspective) { + if (clipCapturedBy == ContainerItemType::ePerspective) { +diff --git layout/painting/nsDisplayList.cpp layout/painting/nsDisplayList.cpp +index 801e1ea2fb4d..6477bda52f01 100644 +--- layout/painting/nsDisplayList.cpp ++++ layout/painting/nsDisplayList.cpp +@@ -7976,11 +7976,18 @@ already_AddRefed nsDisplayTransform::BuildLayer(nsDisplayListBuilder *aBu + LayerManager *aManager, + const ContainerLayerParameters& aContainerParameters) + { ++ // While generating a glyph mask, the transform vector of the root frame had ++ // been applied into the target context, so stop applying it again here. ++ const bool shouldSkipTransform = ++ (aBuilder->RootReferenceFrame() == mFrame) && ++ (aBuilder->IsForGenerateGlyphMask() || aBuilder->IsForPaintingSelectionBG()); ++ + /* For frames without transform, it would not be removed for + * backface hidden here. But, it would be removed by the init + * function of nsDisplayTransform. + */ +- const Matrix4x4& newTransformMatrix = GetTransformForRendering(); ++ const Matrix4x4 newTransformMatrix = ++ shouldSkipTransform ? Matrix4x4(): GetTransformForRendering(); + + uint32_t flags = FrameLayerBuilder::CONTAINER_ALLOW_PULL_BACKGROUND_COLOR; + RefPtr container = aManager->GetLayerBuilder()-> +diff --git dom/svg/crashtests/1343147.svg dom/svg/crashtests/1343147.svg +new file mode 100644 +index 000000000000..d9c2611ca822 +--- /dev/null ++++ dom/svg/crashtests/1343147.svg +@@ -0,0 +1,13 @@ ++ ++ ++ hello ++ +diff --git dom/svg/crashtests/crashtests.list dom/svg/crashtests/crashtests.list +index 1727a206ec4f..57ab320161e2 100644 +--- dom/svg/crashtests/crashtests.list ++++ dom/svg/crashtests/crashtests.list +@@ -90,4 +90,5 @@ load 1329849-5.svg + load 1329849-6.svg + load 1329093-1.html + load 1329093-2.html ++load 1343147.svg + load 1402798.html Added: head/www/firefox/files/patch-bug1355576 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1355576 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,262 @@ +commit e530ba4d4394 +Author: Thomas Wisniewski +Date: Tue Jul 4 20:59:26 2017 -0400 + + Bug 1355576 - Add ability to clear all localStorage with the browsingData API; r=bsilverberg,janv + + MozReview-Commit-ID: 4UUqg62yIo9 + + --HG-- + extra : rebase_source : 9c6154bbe878fc3921d22027fdc90dbdaed05be9 +--- + browser/components/extensions/ext-browsingData.js | 10 +++ + .../extensions/schemas/browsing_data.json | 1 - + .../extensions/test/browser/browser-common.ini | 1 + + .../browser_ext_browsingData_localStorage.js | 93 ++++++++++++++++++++++ + .../test/xpcshell/test_ext_browsingData.js | 4 +- + dom/storage/LocalStorageManager.cpp | 3 +- + dom/storage/StorageObserver.cpp | 12 +++ + .../extensions/schemas/browsing_data.json | 1 - + 8 files changed, 120 insertions(+), 5 deletions(-) + +diff --git browser/components/extensions/ext-browsingData.js browser/components/extensions/ext-browsingData.js +index fd59141dd15d..109ec9601487 100644 +--- browser/components/extensions/ext-browsingData.js ++++ browser/components/extensions/ext-browsingData.js +@@ -83,6 +83,10 @@ const clearHistory = options => { + return sanitizer.items.history.clear(makeRange(options)); + }; + ++const clearLocalStorage = async function(options) { ++ Services.obs.notifyObservers(null, "extension:purge-localStorage"); ++}; ++ + const clearPasswords = async function(options) { + let loginManager = Services.logins; + let yieldCounter = 0; +@@ -152,6 +156,9 @@ const doRemoval = (options, dataToRemove, extension) => { + case "history": + removalPromises.push(clearHistory(options)); + break; ++ case "localStorage": ++ removalPromises.push(clearLocalStorage(options)); ++ break; + case "passwords": + removalPromises.push(clearPasswords(options)); + break; +@@ -225,6 +232,9 @@ this.browsingData = class extends ExtensionAPI { + removeHistory(options) { + return doRemoval(options, {history: true}); + }, ++ removeLocalStorage(options) { ++ return doRemoval(options, {localStorage: true}); ++ }, + removePasswords(options) { + return doRemoval(options, {passwords: true}); + }, +diff --git browser/components/extensions/schemas/browsing_data.json browser/components/extensions/schemas/browsing_data.json +index a780f5640c8f..7755714eb898 100644 +--- browser/components/extensions/schemas/browsing_data.json ++++ browser/components/extensions/schemas/browsing_data.json +@@ -341,7 +341,6 @@ + "description": "Clears websites' local storage data.", + "type": "function", + "async": "callback", +- "unsupported": true, + "parameters": [ + { + "$ref": "RemovalOptions", +diff --git browser/components/extensions/test/browser/browser-common.ini browser/components/extensions/test/browser/browser-common.ini +index 464b8ba18f37..e3f7700f3939 100644 +--- browser/components/extensions/test/browser/browser-common.ini ++++ browser/components/extensions/test/browser/browser-common.ini +@@ -46,6 +46,7 @@ skip-if = (os == 'win' && !debug) # bug 1352668 + [browser_ext_browserAction_theme_icons.js] + [browser_ext_browsingData_formData.js] + [browser_ext_browsingData_history.js] ++[browser_ext_browsingData_localStorage.js] + [browser_ext_browsingData_pluginData.js] + [browser_ext_browsingData_serviceWorkers.js] + [browser_ext_commands_execute_browser_action.js] +diff --git browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js +new file mode 100644 +index 000000000000..215f26d1fcb6 +--- /dev/null ++++ browser/components/extensions/test/browser/browser_ext_browsingData_localStorage.js +@@ -0,0 +1,93 @@ ++/* -*- Mode: indent-tabs-mode: nil; js-indent-level: 2 -*- */ ++/* vim: set sts=2 sw=2 et tw=80: */ ++"use strict"; ++ ++add_task(async function testLocalStorage() { ++ async function background() { ++ function openTabs() { ++ let promise = new Promise(resolve => { ++ let tabURLs = [ ++ "http://example.com/", ++ "http://example.net/", ++ ]; ++ ++ let tabs; ++ let waitingCount = tabURLs.length; ++ ++ let listener = async msg => { ++ if (msg !== "content-script-ready" || --waitingCount) { ++ return; ++ } ++ browser.runtime.onMessage.removeListener(listener); ++ resolve(Promise.all(tabs)); ++ }; ++ ++ browser.runtime.onMessage.addListener(listener); ++ ++ tabs = tabURLs.map(url => { ++ return browser.tabs.create({url: url}); ++ }); ++ }); ++ ++ return promise; ++ } ++ ++ function sendMessageToTabs(tabs, message) { ++ return Promise.all( ++ tabs.map(tab => { return browser.tabs.sendMessage(tab.id, message); })); ++ } ++ ++ let tabs = await openTabs(); ++ ++ await sendMessageToTabs(tabs, "resetLocalStorage"); ++ await sendMessageToTabs(tabs, "checkLocalStorageSet"); ++ await browser.browsingData.removeLocalStorage({}); ++ await sendMessageToTabs(tabs, "checkLocalStorageCleared"); ++ ++ await sendMessageToTabs(tabs, "resetLocalStorage"); ++ await sendMessageToTabs(tabs, "checkLocalStorageSet"); ++ await browser.browsingData.remove({}, {localStorage: true}); ++ await sendMessageToTabs(tabs, "checkLocalStorageCleared"); ++ ++ browser.tabs.remove(tabs.map(tab => tab.id)); ++ ++ browser.test.notifyPass("done"); ++ } ++ ++ function contentScript() { ++ browser.runtime.onMessage.addListener(msg => { ++ if (msg === "resetLocalStorage") { ++ localStorage.clear(); ++ localStorage.setItem("test", "test"); ++ } else if (msg === "checkLocalStorageSet") { ++ browser.test.assertEq("test", localStorage.getItem("test")); ++ } else if (msg === "checkLocalStorageCleared") { ++ browser.test.assertEq(null, localStorage.getItem("test")); ++ } ++ }); ++ browser.runtime.sendMessage("content-script-ready"); ++ } ++ ++ let extension = ExtensionTestUtils.loadExtension({ ++ background, ++ manifest: { ++ "permissions": ["browsingData"], ++ "content_scripts": [{ ++ "matches": [ ++ "http://example.com/", ++ "http://example.net/", ++ ], ++ "js": ["content-script.js"], ++ "run_at": "document_start", ++ }], ++ }, ++ files: { ++ "content-script.js": contentScript, ++ }, ++ }); ++ ++ await extension.startup(); ++ await extension.awaitFinish("done"); ++ await extension.unload(); ++}); ++ +diff --git browser/components/extensions/test/xpcshell/test_ext_browsingData.js browser/components/extensions/test/xpcshell/test_ext_browsingData.js +index 0c1c4874ca44..0b8972058e64 100644 +--- browser/components/extensions/test/xpcshell/test_ext_browsingData.js ++++ browser/components/extensions/test/xpcshell/test_ext_browsingData.js +@@ -44,7 +44,7 @@ add_task(async function testInvalidArguments() { + + add_task(async function testUnimplementedDataType() { + function background() { +- browser.browsingData.remove({}, {localStorage: true}); ++ browser.browsingData.remove({}, {indexedDB: true}); + browser.test.sendMessage("finished"); + } + +@@ -61,6 +61,6 @@ add_task(async function testUnimplementedDataType() { + await extension.unload(); + }); + +- let warningObserved = messages.find(line => /Firefox does not support dataTypes: localStorage/.test(line)); ++ let warningObserved = messages.find(line => /Firefox does not support dataTypes: indexedDB/.test(line)); + ok(warningObserved, "Warning issued when calling remove with an unimplemented dataType."); + }); +diff --git dom/storage/LocalStorageManager.cpp dom/storage/LocalStorageManager.cpp +index a161de2bc596..f366e7874a90 100644 +--- dom/storage/LocalStorageManager.cpp ++++ dom/storage/LocalStorageManager.cpp +@@ -386,7 +386,8 @@ LocalStorageManager::Observe(const char* aTopic, + } + + // Clear everything, caches + database +- if (!strcmp(aTopic, "cookie-cleared")) { ++ if (!strcmp(aTopic, "cookie-cleared") || ++ !strcmp(aTopic, "extension:purge-localStorage-caches")) { + ClearCaches(LocalStorageCache::kUnloadComplete, pattern, EmptyCString()); + return NS_OK; + } +diff --git dom/storage/StorageObserver.cpp dom/storage/StorageObserver.cpp +index e5b010f88c7b..48d484748209 100644 +--- dom/storage/StorageObserver.cpp ++++ dom/storage/StorageObserver.cpp +@@ -66,6 +66,7 @@ StorageObserver::Init() + obs->AddObserver(sSelf, "browser:purge-domain-data", true); + obs->AddObserver(sSelf, "last-pb-context-exited", true); + obs->AddObserver(sSelf, "clear-origin-attributes-data", true); ++ obs->AddObserver(sSelf, "extension:purge-localStorage", true); + + // Shutdown + obs->AddObserver(sSelf, "profile-after-change", true); +@@ -270,6 +271,23 @@ StorageObserver::Observe(nsISupports* aSubject, + + Notify("session-only-cleared", NS_ConvertUTF8toUTF16(originSuffix), + originScope); ++ ++ return NS_OK; ++ } ++ ++ if (!strcmp(aTopic, "extension:purge-localStorage")) { ++ StorageDBChild* storageChild = StorageDBChild::GetOrCreate(); ++ if (NS_WARN_IF(!storageChild)) { ++ return NS_ERROR_FAILURE; ++ } ++ ++ storageChild->AsyncClearAll(); ++ ++ if (XRE_IsParentProcess()) { ++ storageChild->SendClearAll(); ++ } ++ ++ Notify("extension:purge-localStorage-caches"); + + return NS_OK; + } +diff --git mobile/android/components/extensions/schemas/browsing_data.json mobile/android/components/extensions/schemas/browsing_data.json +index 483a462d422c..1019c1a23953 100644 +--- mobile/android/components/extensions/schemas/browsing_data.json ++++ mobile/android/components/extensions/schemas/browsing_data.json +@@ -345,7 +345,6 @@ + "description": "Clears websites' local storage data.", + "type": "function", + "async": "callback", +- "unsupported": true, + "parameters": [ + { + "$ref": "RemovalOptions", Added: head/www/firefox/files/patch-bug1369561 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1369561 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,66 @@ +commit 4a1737e0c456 +Author: David Keeler +Date: Fri Sep 15 14:47:54 2017 -0700 + + Bug 1369561 - Address misc. SnprintfLiteral correctness nits. r=jld, r=froydnj, a=ritu + + --HG-- + extra : source : f5533b6cd09c35eef381e311940b5bd5231d3553 +--- + security/sandbox/linux/SandboxUtil.cpp | 17 ++++++++++------- + xpcom/base/nsSystemInfo.cpp | 2 +- + 2 files changed, 11 insertions(+), 8 deletions(-) + +diff --git security/sandbox/linux/SandboxUtil.cpp security/sandbox/linux/SandboxUtil.cpp +index ad6003ecaad5..999329882364 100644 +--- security/sandbox/linux/SandboxUtil.cpp ++++ security/sandbox/linux/SandboxUtil.cpp +@@ -62,7 +62,6 @@ UnshareUserNamespace() + uid_t uid = getuid(); + gid_t gid = getgid(); + char buf[80]; +- size_t len; + + if (syscall(__NR_unshare, CLONE_NEWUSER) != 0) { + return false; +@@ -84,17 +83,21 @@ UnshareUserNamespace() + // current thread. However, CLONE_NEWUSER can be unshared only in a + // single-threaded process, so those are equivalent if we reach this + // point. +- len = size_t(SprintfLiteral(buf, "%u %u 1\n", uid, uid)); +- MOZ_ASSERT(len < sizeof(buf)); +- if (!WriteStringToFile("/proc/self/uid_map", buf, len)) { ++ int len = SprintfLiteral(buf, "%u %u 1\n", uid, uid); ++ if (len >= int(sizeof(buf)) || len < 0) { ++ return false; ++ } ++ if (!WriteStringToFile("/proc/self/uid_map", buf, size_t(len))) { + MOZ_CRASH("Failed to write /proc/self/uid_map"); + } + + Unused << WriteStringToFile("/proc/self/setgroups", "deny", 4); + +- len = size_t(SprintfLiteral(buf, "%u %u 1\n", gid, gid)); +- MOZ_ASSERT(len < sizeof(buf)); +- if (!WriteStringToFile("/proc/self/gid_map", buf, len)) { ++ len = SprintfLiteral(buf, "%u %u 1\n", gid, gid); ++ if (len >= int(sizeof(buf)) || len < 0) { ++ return false; ++ } ++ if (!WriteStringToFile("/proc/self/gid_map", buf, size_t(len))) { + MOZ_CRASH("Failed to write /proc/self/gid_map"); + } + return true; +diff --git xpcom/base/nsSystemInfo.cpp xpcom/base/nsSystemInfo.cpp +index e5a7fe97be03..782dc9abf37d 100644 +--- xpcom/base/nsSystemInfo.cpp ++++ xpcom/base/nsSystemInfo.cpp +@@ -706,7 +706,7 @@ nsSystemInfo::Init() + } + + nsAutoCString secondaryLibrary; +- if (gtkver_len > 0) { ++ if (gtkver_len > 0 && gtkver_len < int(sizeof(gtkver))) { + secondaryLibrary.Append(nsDependentCSubstring(gtkver, gtkver_len)); + } + Added: head/www/firefox/files/patch-bug1375146 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1375146 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,37 @@ +commit b481800095d4 +Author: Stone Shih +Date: Tue Sep 19 15:41:52 2017 +0800 + + Bug 1375146 - Revise sending drag event. r=smaug, a=ritu + + --HG-- + extra : source : d4496b8befbf0ef5ae124a9fbda37ad5b885f9e1 +--- + dom/events/EventStateManager.cpp | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git dom/events/EventStateManager.cpp dom/events/EventStateManager.cpp +index b94dc0c88e01..1f48884058de 100644 +--- dom/events/EventStateManager.cpp ++++ dom/events/EventStateManager.cpp +@@ -1292,8 +1292,9 @@ EventStateManager::DispatchCrossProcessEvent(WidgetEvent* aEvent, + return; + } + case eDragEventClass: { +- if (remote->Manager()->IsContentParent()) { +- remote->Manager()->AsContentParent()->MaybeInvokeDragSession(remote); ++ RefPtr tabParent = remote; ++ if (tabParent->Manager()->IsContentParent()) { ++ tabParent->Manager()->AsContentParent()->MaybeInvokeDragSession(tabParent); + } + + nsCOMPtr dragSession = nsContentUtils::GetDragSession(); +@@ -1309,7 +1310,7 @@ EventStateManager::DispatchCrossProcessEvent(WidgetEvent* aEvent, + } + } + +- remote->SendRealDragEvent(*aEvent->AsDragEvent(), action, dropEffect); ++ tabParent->SendRealDragEvent(*aEvent->AsDragEvent(), action, dropEffect); + return; + } + case ePluginEventClass: { Added: head/www/firefox/files/patch-bug1387799 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1387799 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,49 @@ +commit e1c252eab1f4 +Author: Milan Sreckovic +Date: Mon Oct 23 16:22:47 2017 -0400 + + Bug 1387799 - Keep an extra reference. r=jrmuizel, a=ritu + + --HG-- + extra : source : 8199078921c6b4c0ee4c984100d33750dfe8e144 +--- + gfx/layers/ipc/CompositorBridgeChild.cpp | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git gfx/layers/ipc/CompositorBridgeChild.cpp gfx/layers/ipc/CompositorBridgeChild.cpp +index 9419f4b2da36..55fd9c10871b 100644 +--- gfx/layers/ipc/CompositorBridgeChild.cpp ++++ gfx/layers/ipc/CompositorBridgeChild.cpp +@@ -523,10 +523,14 @@ CompositorBridgeChild::RecvHideAllPlugins(const uintptr_t& aParentWidget) + } + + mozilla::ipc::IPCResult +-CompositorBridgeChild::RecvDidComposite(const uint64_t& aId, const uint64_t& aTransactionId, ++CompositorBridgeChild::RecvDidComposite(const uint64_t& aId, ++ const uint64_t& aTransactionId, + const TimeStamp& aCompositeStart, + const TimeStamp& aCompositeEnd) + { ++ // Hold a reference to keep texture pools alive. See bug 1387799 ++ AutoTArray,2> texturePools = mTexturePools; ++ + if (mLayerManager) { + MOZ_ASSERT(aId == 0); + MOZ_ASSERT(mLayerManager->GetBackendType() == LayersBackend::LAYERS_CLIENT || +@@ -541,13 +545,14 @@ CompositorBridgeChild::RecvDidComposite(const uint64_t& aId, const uint64_t& aTr + } + } + +- for (size_t i = 0; i < mTexturePools.Length(); i++) { +- mTexturePools[i]->ReturnDeferredClients(); ++ for (size_t i = 0; i < texturePools.Length(); i++) { ++ texturePools[i]->ReturnDeferredClients(); + } + + return IPC_OK(); + } + ++ + void + CompositorBridgeChild::ActorDestroy(ActorDestroyReason aWhy) + { Added: head/www/firefox/files/patch-bug1394265 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1394265 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,24 @@ +commit a51675964a63 +Author: Jeff Gilbert +Date: Tue Oct 17 17:14:29 2017 -0700 + + Bug 1394265 - Set MAX_COMBINED_TEXTURE_IMAGE_UNITS to 0 if GetIntegeriv fails. - r=daoshengmu a=ritu + + MozReview-Commit-ID: 5h6UPXczKhb +--- + dom/canvas/WebGLContextValidate.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git dom/canvas/WebGLContextValidate.cpp dom/canvas/WebGLContextValidate.cpp +index a8334e546414..ebf0aa8c2d78 100644 +--- dom/canvas/WebGLContextValidate.cpp ++++ dom/canvas/WebGLContextValidate.cpp +@@ -554,7 +554,7 @@ WebGLContext::InitAndValidateGL(FailureReason* const out_failReason) + if (MinCapabilityMode()) + mGLMaxTextureUnits = MINVALUE_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS; + else +- gl->fGetIntegerv(LOCAL_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &mGLMaxTextureUnits); ++ mGLMaxTextureUnits = gl->GetIntAs(LOCAL_GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS); + + if (mGLMaxTextureUnits < 8) { + const nsPrintfCString reason("GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS: %d is < 8!", Added: head/www/firefox/files/patch-bug1394530 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1394530 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,60 @@ +commit a2b75aa9409c +Author: Tooru Fujisawa +Date: Sun Sep 17 19:52:04 2017 +0900 + + Bug 1394530 - Stop using optimized path for non PromiseObject. r=till, a=sledru + + --HG-- + extra : source : 079ff8998fd50540948d3262a3a8b1f4d61b43e9 +--- + js/src/builtin/Promise.cpp | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git js/src/builtin/Promise.cpp js/src/builtin/Promise.cpp +index 1cb1cff0682e..e316f090504d 100644 +--- js/src/builtin/Promise.cpp ++++ js/src/builtin/Promise.cpp +@@ -2365,6 +2365,15 @@ NewReactionRecord(JSContext* cx, HandleObject resultPromise, HandleValue onFulfi + HandleValue onRejected, HandleObject resolve, HandleObject reject, + HandleObject incumbentGlobalObject) + { ++ // Either of the following conditions must be met: ++ // * resultPromise is a PromiseObject ++ // * resolve and reject are callable ++ // except for Async Generator, there resultPromise can be nullptr. ++ MOZ_ASSERT_IF(resultPromise && !resultPromise->is(), resolve); ++ MOZ_ASSERT_IF(resultPromise && !resultPromise->is(), IsCallable(resolve)); ++ MOZ_ASSERT_IF(resultPromise && !resultPromise->is(), reject); ++ MOZ_ASSERT_IF(resultPromise && !resultPromise->is(), IsCallable(reject)); ++ + Rooted reaction(cx, NewObjectWithClassProto(cx)); + if (!reaction) + return nullptr; +@@ -3072,7 +3081,7 @@ BlockOnPromise(JSContext* cx, HandleValue promiseVal, HandleObject blockedPromis + // rejected promises list. + bool addToDependent = true; + +- if (C == PromiseCtor) { ++ if (C == PromiseCtor && resultPromise->is()) { + addToDependent = false; + } else { + // 25.4.5.3., step 4. +@@ -3131,12 +3140,14 @@ BlockOnPromise(JSContext* cx, HandleValue promiseVal, HandleObject blockedPromis + return false; + } + +- // If the object to depend on isn't a, maybe-wrapped, Promise instance, +- // we ignore it. All this does is lose some small amount of debug +- // information in scenarios that are highly unlikely to occur in useful +- // code. ++ // If either the object to depend on or the object that gets blocked isn't ++ // a, maybe-wrapped, Promise instance, we ignore it. All this does is lose ++ // some small amount of debug information in scenarios that are highly ++ // unlikely to occur in useful code. + if (!unwrappedPromiseObj->is()) + return true; ++ if (!blockedPromise_->is()) ++ return true; + + Rooted promise(cx, &unwrappedPromiseObj->as()); + return AddPromiseReaction(cx, promise, UndefinedHandleValue, UndefinedHandleValue, Added: head/www/firefox/files/patch-bug1395138 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1395138 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,49 @@ +commit 8ab8a207d511 +Author: Jamie Nicol +Date: Mon Oct 9 17:48:59 2017 +0100 + + Bug 1395138 - Hold reference to layers in ContainerLayerComposite::mPrepared. r=mattwoodrow, a=sledru + + MozReview-Commit-ID: 6qUDRnRcFAw +--- + gfx/layers/composite/ContainerLayerComposite.cpp | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git gfx/layers/composite/ContainerLayerComposite.cpp gfx/layers/composite/ContainerLayerComposite.cpp +index aad2993629fc..28d9e79925a0 100755 +--- gfx/layers/composite/ContainerLayerComposite.cpp ++++ gfx/layers/composite/ContainerLayerComposite.cpp +@@ -161,12 +161,12 @@ static gfx::IntRect ContainerVisibleRect(ContainerT* aContainer) + /* all of the per-layer prepared data we need to maintain */ + struct PreparedLayer + { +- PreparedLayer(LayerComposite *aLayer, ++ PreparedLayer(Layer *aLayer, + RenderTargetIntRect aClipRect, + Maybe&& aGeometry) + : mLayer(aLayer), mClipRect(aClipRect), mGeometry(Move(aGeometry)) {} + +- LayerComposite* mLayer; ++ RefPtr mLayer; + RenderTargetIntRect mClipRect; + Maybe mGeometry; + }; +@@ -230,7 +230,8 @@ ContainerPrepare(ContainerT* aContainer, + CULLING_LOG("Preparing sublayer %p\n", layerToRender->GetLayer()); + + layerToRender->Prepare(clipRect); +- aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender, clipRect, ++ aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender->GetLayer(), ++ clipRect, + Move(layer.geometry))); + } + +@@ -408,7 +409,7 @@ RenderLayers(ContainerT* aContainer, LayerManagerComposite* aManager, + PreparedLayer& preparedData = aContainer->mPrepared->mLayers[i]; + + const gfx::IntRect clipRect = preparedData.mClipRect.ToUnknownRect(); +- LayerComposite* layerToRender = preparedData.mLayer; ++ LayerComposite* layerToRender = static_cast(preparedData.mLayer->ImplData()); + const Maybe& childGeometry = preparedData.mGeometry; + + Layer* layer = layerToRender->GetLayer(); Added: head/www/firefox/files/patch-bug1397811 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1397811 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,48 @@ +commit 2bffd0136caf +Author: Olli Pettay +Date: Fri Oct 20 11:02:29 2017 +0100 + + Bug 1397811 - In order to not leak properties, ensure all the properties of adopted nodes are removed in case the adopt call fails. r=bz, a=lizzard + + --HG-- + extra : source : b609906f34b50f8e4236d0fee8d01338181dd906 +--- + dom/base/nsNodeUtils.cpp | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git dom/base/nsNodeUtils.cpp dom/base/nsNodeUtils.cpp +index dd958aa443ce..20e714d54065 100644 +--- dom/base/nsNodeUtils.cpp ++++ dom/base/nsNodeUtils.cpp +@@ -605,6 +605,15 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep, + } + } + ++ if (aNodesWithProperties && aNode->HasProperties()) { ++ bool ok = aNodesWithProperties->AppendObject(aNode); ++ MOZ_RELEASE_ASSERT(ok, "Out of memory"); ++ if (aClone) { ++ ok = aNodesWithProperties->AppendObject(clone); ++ MOZ_RELEASE_ASSERT(ok, "Out of memory"); ++ } ++ } ++ + if (aDeep && (!aClone || !aNode->IsNodeOfType(nsINode::eATTRIBUTE))) { + // aNode's children. + for (nsIContent* cloneChild = aNode->GetFirstChild(); +@@ -664,15 +673,6 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep, + } + #endif + +- if (aNodesWithProperties && aNode->HasProperties()) { +- bool ok = aNodesWithProperties->AppendObject(aNode); +- if (aClone) { +- ok = ok && aNodesWithProperties->AppendObject(clone); +- } +- +- NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY); +- } +- + clone.forget(aResult); + + return NS_OK; Added: head/www/firefox/files/patch-bug1400003 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1400003 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,120 @@ +commit 677c707a4f11 +Author: Jon Coppeard +Date: Mon Oct 9 10:03:20 2017 +0100 + + Bug 1400003 - Mark Heap and barrier classes as MOZ_NON_MEMMOVABLE. r=sfink, r=froydnj, a=lizzard + + --HG-- + extra : source : 6ad5b916c9659aeb4b901d8f9ec7f121dc2c4418 +--- + js/public/RootingAPI.h | 10 +++++++++- + js/src/gc/Barrier.h | 5 ++++- + xpcom/ds/nsTArray.h | 27 +++++++++++++-------------- + 3 files changed, 26 insertions(+), 16 deletions(-) + +diff --git js/public/RootingAPI.h js/public/RootingAPI.h +index 74a61af93703..f8ec7c5a1f5b 100644 +--- js/public/RootingAPI.h ++++ js/public/RootingAPI.h +@@ -231,7 +231,7 @@ AssertGCThingIsNotAnObjectSubclass(js::gc::Cell* cell) {} + * Type T must be a public GC pointer type. + */ + template +-class Heap : public js::HeapBase> ++class MOZ_NON_MEMMOVABLE Heap : public js::HeapBase> + { + // Please note: this can actually also be used by nsXBLMaybeCompiled, for legacy reasons. + static_assert(js::IsHeapConstructibleType::value, +@@ -1246,6 +1246,14 @@ class JS_PUBLIC_API(ObjectPtr) + + explicit ObjectPtr(JSObject* obj) : value(obj) {} + ++ ObjectPtr(const ObjectPtr& other) : value(other.value) {} ++ ++ ObjectPtr(ObjectPtr&& other) ++ : value(other.value) ++ { ++ other.value = nullptr; ++ } ++ + /* Always call finalize before the destructor. */ + ~ObjectPtr() { MOZ_ASSERT(!value); } + +diff --git js/src/gc/Barrier.h js/src/gc/Barrier.h +index 9c4f53975752..1740315c14e9 100644 +--- js/src/gc/Barrier.h ++++ js/src/gc/Barrier.h +@@ -318,8 +318,11 @@ struct InternalBarrierMethods + }; + + // Base class of all barrier types. ++// ++// This is marked non-memmovable since post barriers added by derived classes ++// can add pointers to class instances to the store buffer. + template +-class BarrieredBase ++class MOZ_NON_MEMMOVABLE BarrieredBase + { + protected: + // BarrieredBase is not directly instantiable. +diff --git xpcom/ds/nsTArray.h xpcom/ds/nsTArray.h +index 424a50ba421e..4e9b57126bfb 100644 +--- xpcom/ds/nsTArray.h ++++ xpcom/ds/nsTArray.h +@@ -37,6 +37,7 @@ + namespace JS { + template + class Heap; ++class ObjectPtr; + } /* namespace JS */ + + class nsRegion; +@@ -708,7 +709,7 @@ struct nsTArray_CopyWithConstructors + template + struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser + { +- typedef nsTArray_CopyWithMemutils Type; ++ using Type = nsTArray_CopyWithMemutils; + }; + + // +@@ -719,14 +720,18 @@ struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser + template<> \ + struct nsTArray_CopyChooser \ + { \ +- typedef nsTArray_CopyWithConstructors Type; \ ++ using Type = nsTArray_CopyWithConstructors; \ + }; + +-template +-struct nsTArray_CopyChooser> +-{ +- typedef nsTArray_CopyWithConstructors> Type; +-}; ++#define DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(T) \ ++ template \ ++ struct nsTArray_CopyChooser> \ ++ { \ ++ using Type = nsTArray_CopyWithConstructors>; \ ++ }; ++ ++DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(JS::Heap) ++DECLARE_USE_COPY_CONSTRUCTORS_FOR_TEMPLATE(std::function) + + DECLARE_USE_COPY_CONSTRUCTORS(nsRegion) + DECLARE_USE_COPY_CONSTRUCTORS(nsIntRegion) +@@ -740,13 +745,7 @@ DECLARE_USE_COPY_CONSTRUCTORS(mozilla::dom::indexedDB::SerializedStructuredClone + DECLARE_USE_COPY_CONSTRUCTORS(JSStructuredCloneData) + DECLARE_USE_COPY_CONSTRUCTORS(mozilla::dom::MessagePortMessage) + DECLARE_USE_COPY_CONSTRUCTORS(mozilla::SourceBufferTask) +- +-template +-struct nsTArray_CopyChooser> +-{ +- typedef nsTArray_CopyWithConstructors> Type; +-}; +- ++DECLARE_USE_COPY_CONSTRUCTORS(JS::ObjectPtr) + + // + // Base class for nsTArray_Impl that is templated on element type and derived Added: head/www/firefox/files/patch-bug1400554 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1400554 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,27 @@ +commit 62b41b600acc +Author: Dragana Damjanovic +Date: Mon Oct 9 14:59:32 2017 -0400 + + Bug 1400554 - Cancel a time in TLSFilterTransaction if transaction is canceled. r=mcmanus, a=ritu + + --HG-- + extra : source : 67315954145e9cae0efe8c5323452a70a13c5484 +--- + netwerk/protocol/http/TunnelUtils.cpp | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git netwerk/protocol/http/TunnelUtils.cpp netwerk/protocol/http/TunnelUtils.cpp +index d0f6ef0b1873..0cf3ea4f3008 100644 +--- netwerk/protocol/http/TunnelUtils.cpp ++++ netwerk/protocol/http/TunnelUtils.cpp +@@ -126,6 +126,10 @@ TLSFilterTransaction::Close(nsresult aReason) + return; + } + ++ if (mTimer) { ++ mTimer->Cancel(); ++ mTimer = nullptr; ++ } + mTransaction->Close(aReason); + mTransaction = nullptr; + } Added: head/www/firefox/files/patch-bug1401804 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1401804 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,31 @@ +commit 38e6bb85066b +Author: Jon Coppeard +Date: Fri Sep 22 13:09:44 2017 +0100 + + Bug 1401804 - Fix IsMarkedBlack check used in gray marking asserts r=sfink a=sylvestre +--- + js/src/gc/Barrier.cpp | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git js/src/gc/Barrier.cpp js/src/gc/Barrier.cpp +index 5a5dfbe9bed0..0c42d16e7117 100644 +--- js/src/gc/Barrier.cpp ++++ js/src/gc/Barrier.cpp +@@ -33,15 +33,8 @@ RuntimeFromActiveCooperatingThreadIsHeapMajorCollecting(JS::shadow::Zone* shadow + bool + IsMarkedBlack(JSObject* obj) + { +- // Note: we assume conservatively that Nursery things will be live. +- if (!obj->isTenured()) +- return true; +- +- gc::TenuredCell& tenured = obj->asTenured(); +- if (tenured.isMarkedAny() || tenured.arena()->allocatedDuringIncremental) +- return true; +- +- return false; ++ return obj->isMarkedBlack() || ++ (obj->isTenured() && obj->asTenured().arena()->allocatedDuringIncremental); + } + + bool Added: head/www/firefox/files/patch-bug1402442 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/firefox/files/patch-bug1402442 Sat Nov 11 20:42:33 2017 (r454000) @@ -0,0 +1,181 @@ +commit 44b4458e2d21 +Author: Emilio Cobos Álvarez +Date: Mon Sep 25 18:25:29 2017 +0200 + + Bug 1402442 - Properly remove display: contents pseudo-frames. r=mats, a=ritu + + MozReview-Commit-ID: 4pjVLQfv3YR + Signed-off-by: Emilio Cobos Álvarez + + --HG-- + extra : source : faa69ac1c14b79838cc0aac842b470a110542ebd + extra : amend_source : 3a76e0123bf3f7d10295000cc44fd8bdddf700df +--- + layout/base/nsCSSFrameConstructor.cpp | 26 +++++++++++++++------- + testing/web-platform/meta/MANIFEST.json | 25 +++++++++++++++++++++ + ...dynamic-generated-content-fieldset-001.html.ini | 4 ++++ + ...dynamic-generated-content-fieldset-001-ref.html | 16 +++++++++++++ + ...nts-dynamic-generated-content-fieldset-001.html | 26 ++++++++++++++++++++++ + 5 files changed, 89 insertions(+), 8 deletions(-) + +diff --git layout/base/nsCSSFrameConstructor.cpp layout/base/nsCSSFrameConstructor.cpp +index 99b1211b399b..4fce3fb381a7 100644 +--- layout/base/nsCSSFrameConstructor.cpp ++++ layout/base/nsCSSFrameConstructor.cpp +@@ -1698,6 +1698,17 @@ nsCSSFrameConstructor::NotifyDestroyingFrame(nsIFrame* aFrame) + nsFrameManager::NotifyDestroyingFrame(aFrame); + } + ++static bool ++HasGeneratedContent(const nsIContent* aChild) ++{ ++ if (!aChild->MayHaveAnonymousChildren()) { *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***