Merge mozilla-inbound to mozilla-central. a=merge

dom/base/Document.cpp

@@ -6741,7 +6741,9 @@ nsINode* Document::AdoptNode(nsINode& aAdoptedNode, ErrorResult& rv) {
       // It's kind of irrelevant, given that we're passing aAllowWrapping =
       // false, and documents should always insist on being wrapped in an
       // canonical scope. But we try to pass something sane anyway.
-      JSAutoRealm ar(cx, GetScopeObject()->GetGlobalJSObject());
+      JSObject* globalObject = GetScopeObject()->GetGlobalJSObject();
+      JS::ExposeObjectToActiveJS(globalObject);
+      JSAutoRealm ar(cx, globalObject);
       JS::Rooted<JS::Value> v(cx);
       rv = nsContentUtils::WrapNative(cx, ToSupports(this), this, &v,
                                       /* aAllowWrapping = */ false);

dom/base/nsJSEnvironment.cpp

@@ -2066,11 +2066,11 @@ void nsJSContext::MaybePokeCC() {
 
   // If GC hasn't run recently and forget skippable only cycle was run,
   // don't start a new cycle too soon.
-  if (sCleanupsSinceLastGC > NS_MAJOR_FORGET_SKIPPABLE_CALLS) {
+  if ((sCleanupsSinceLastGC > NS_MAJOR_FORGET_SKIPPABLE_CALLS) &&
+      !sLastForgetSkippableCycleEndTime.IsNull()) {
     uint32_t sinceLastForgetSkippableCycle =
         TimeUntilNow(sLastForgetSkippableCycleEndTime);
-    if (sinceLastForgetSkippableCycle &&
-        sinceLastForgetSkippableCycle <
+    if (sinceLastForgetSkippableCycle <
             NS_TIME_BETWEEN_FORGET_SKIPPABLE_CYCLES) {
       return;
     }

dom/base/nsWrapperCacheInlines.h

@@ -14,9 +14,9 @@ inline JSObject* nsWrapperCache::GetWrapperPreserveColor() const {
   JSObject* obj = GetWrapperMaybeDead();
   if (obj && js::gc::EdgeNeedsSweepUnbarriered(&obj)) {
     // The object has been found to be dead and is in the process of being
-    // finalized, so don't let the caller see it. As an optimisation, remove it
-    // from the cache so we don't have to do this check in future.
-    const_cast<nsWrapperCache*>(this)->ClearWrapper();
+    // finalized, so don't let the caller see it.
+    // Don't clear the cache though: this happens when a new wrapper is created
+    // for this native or when the wrapper is finalized.
     return nullptr;
   }
   MOZ_ASSERT(obj == mWrapper);

dom/bindings/BindingUtils.h

@@ -1384,8 +1384,6 @@ inline mozilla::dom::ReflectionScope GetReflectionScope(
 
 template <class T>
 inline void ClearWrapper(T* p, nsWrapperCache* cache, JSObject* obj) {
-  JS::AutoAssertGCCallback inCallback;
-
   // Skip clearing the wrapper when replaying. This method is called during
   // finalization of |obj|, and when replaying a strong reference is kept on
   // the contents of the cache: since |obj| is being finalized, the cache
@@ -1394,13 +1392,15 @@ inline void ClearWrapper(T* p, nsWrapperCache* cache, JSObject* obj) {
   // released, if we are finalizing later than we did while recording, and the
   // cache may have already been deleted.
   if (!recordreplay::IsReplaying()) {
+    MOZ_ASSERT(cache->GetWrapperMaybeDead() == obj);
     cache->ClearWrapper(obj);
   }
 }
 
 template <class T>
 inline void ClearWrapper(T* p, void*, JSObject* obj) {
-  JS::AutoAssertGCCallback inCallback;
+  // QueryInterface to nsWrapperCache can't GC, we hope.
+  JS::AutoSuppressGCAnalysis nogc;
 
   // Skip clearing the wrapper when replaying, for the same reason as in the
   // overload above: |p| may have been deleted and we cannot QI it.
@@ -2591,7 +2591,8 @@ class MOZ_STACK_CLASS BindingJSObjectCreator {
     }
 
     if (size_t mallocBytes = BindingJSObjectMallocBytes(aNative)) {
-      JS_updateMallocCounter(aCx, mallocBytes);
+      JS::AddAssociatedMemory(aReflector, mallocBytes,
+                              JS::MemoryUse::DOMBinding);
     }
   }
 
@@ -2607,7 +2608,8 @@ class MOZ_STACK_CLASS BindingJSObjectCreator {
     }
 
     if (size_t mallocBytes = BindingJSObjectMallocBytes(aNative)) {
-      JS_updateMallocCounter(aCx, mallocBytes);
+      JS::AddAssociatedMemory(aReflector, mallocBytes,
+                              JS::MemoryUse::DOMBinding);
     }
   }
 

dom/bindings/Codegen.py

@@ -1730,7 +1730,7 @@ def generate_code(self):
 
 
 def finalizeHook(descriptor, hookName, freeOp, obj):
-    finalize = ""
+    finalize = "js::SetReservedSlot(%s, DOM_OBJECT_SLOT, JS::UndefinedValue());\n" % obj
     if descriptor.interface.getExtendedAttribute('OverrideBuiltins'):
         finalize += fill(
             """
@@ -1757,6 +1757,14 @@ def finalizeHook(descriptor, hookName, freeOp, obj):
         finalize += "ClearWrapper(self, self, %s);\n" % obj
     if descriptor.isGlobal():
         finalize += "mozilla::dom::FinalizeGlobal(CastToJSFreeOp(%s), %s);\n" % (freeOp, obj)
+    finalize += fill(
+        """
+        if (size_t mallocBytes = BindingJSObjectMallocBytes(self)) {
+          JS::RemoveAssociatedMemory(${obj}, mallocBytes,
+                                     JS::MemoryUse::DOMBinding);
+        }
+        """,
+        obj=obj)
     finalize += ("AddForDeferredFinalization<%s>(self);\n" %
                  descriptor.nativeType)
     return CGIfWrapper(CGGeneric(finalize), "self")
@@ -3847,6 +3855,11 @@ def definition_body(self):
             return false;
             """)
 
+        if self.descriptor.proxy:
+            finalize = "DOMProxyHandler::getInstance()->finalize"
+        else:
+            finalize = FINALIZE_HOOK_NAME
+
         return fill(
             """
             static_assert(!IsBaseOf<NonRefcountedDOMObject, ${nativeType}>::value,
@@ -3860,6 +3873,17 @@ def definition_body(self):
             MOZ_ASSERT(ToSupportsIsOnPrimaryInheritanceChain(aObject, aCache),
                        "nsISupports must be on our primary inheritance chain");
 
+            // If the wrapper cache contains a dead reflector then finalize that
+            // now, ensuring that the finalizer for the old reflector always
+            // runs before the new reflector is created and attached. This
+            // avoids the awkward situation where there are multiple reflector
+            // objects that contain pointers to the same native.
+
+            if (JSObject* oldReflector = aCache->GetWrapperMaybeDead()) {
+              ${finalize}(nullptr /* unused */, oldReflector);
+              MOZ_ASSERT(!aCache->GetWrapperMaybeDead());
+            }
+
             JS::Rooted<JSObject*> global(aCx, FindAssociatedGlobal(aCx, aObject->GetParentObject()));
             if (!global) {
               return false;
@@ -3907,7 +3931,8 @@ def definition_body(self):
             createObject=CreateBindingJSObject(self.descriptor, self.properties),
             unforgeable=CopyUnforgeablePropertiesToInstance(self.descriptor,
                                                             failureCode),
-            slots=InitMemberSlots(self.descriptor, failureCode))
+            slots=InitMemberSlots(self.descriptor, failureCode),
+            finalize=finalize)
 
 
 class CGWrapMethod(CGAbstractMethod):
@@ -12869,14 +12894,14 @@ def getBody(self):
             }
 
             JS_MarkCrossZoneId(cx, id);
-            
+
             return dom::DOMProxyHandler::set(cx, proxy, id, wrappedValue, wrappedReceiver, result);
             """)
 
 
 class CGDOMJSProxyHandler_EnsureHolder(ClassMethod):
     """
-    Implementation of set().  We only use this for cross-origin objects. 
+    Implementation of set().  We only use this for cross-origin objects.
     """
     def __init__(self, descriptor):
         args = [Argument('JSContext*', 'cx'),

dom/canvas/CanvasRenderingContext2D.cpp

@@ -1486,8 +1486,22 @@ void CanvasRenderingContext2D::ClearTarget(int32_t aWidth, int32_t aHeight) {
 
   // Update dimensions only if new (strictly positive) values were passed.
   if (aWidth > 0 && aHeight > 0) {
+    // Update the memory size associated with the wrapper object when we change
+    // the dimensions. Note that we need to keep updating dying wrappers before
+    // they are finalized so that the memory accounting balances out.
+    JSObject* wrapper = GetWrapperMaybeDead();
+    if (wrapper) {
+      JS::RemoveAssociatedMemory(wrapper, BindingJSObjectMallocBytes(this),
+                                 JS::MemoryUse::DOMBinding);
+    }
+
     mWidth = aWidth;
     mHeight = aHeight;
+
+    if (wrapper) {
+      JS::AddAssociatedMemory(wrapper, BindingJSObjectMallocBytes(this),
+                              JS::MemoryUse::DOMBinding);
+    }
   }
 
   if (!mCanvasElement || !mCanvasElement->IsInComposedDoc()) {

dom/events/PointerEventHandler.cpp

@@ -507,10 +507,9 @@ void PointerEventHandler::DispatchPointerFromMouseOrTouch(
         !aEvent->IsAllowedToDispatchDOMEvent()) {
       return;
     }
-    int16_t button = mouseEvent->mButton;
+
     switch (mouseEvent->mMessage) {
       case eMouseMove:
-        button = MouseButton::eNotPressed;
         pointerMessage = ePointerMove;
         break;
       case eMouseUp:
@@ -519,7 +518,7 @@ void PointerEventHandler::DispatchPointerFromMouseOrTouch(
       case eMouseDown:
         pointerMessage =
             mouseEvent->mButtons &
-                    ~nsContentUtils::GetButtonsFlagForButton(button)
+                    ~nsContentUtils::GetButtonsFlagForButton(mouseEvent->mButton)
                 ? ePointerMove
                 : ePointerDown;
         break;

dom/file/Blob.cpp

@@ -13,6 +13,7 @@
 #include "nsPIDOMWindow.h"
 #include "StreamBlobImpl.h"
 #include "StringBlobImpl.h"
+#include "js/GCAPI.h"
 
 namespace mozilla {
 namespace dom {
@@ -229,6 +230,12 @@ void Blob::CreateInputStream(nsIInputStream** aStream, ErrorResult& aRv) {
 
 size_t BindingJSObjectMallocBytes(Blob* aBlob) {
   MOZ_ASSERT(aBlob);
+
+  // TODO: The hazard analysis currently can't see that none of the
+  // implementations of the GetAllocationSize virtual method call can GC (see
+  // bug 1531951).
+  JS::AutoSuppressGCAnalysis nogc;
+
   return aBlob->GetAllocationSize();
 }
 

dom/file/StreamBlobImpl.cpp

@@ -146,7 +146,7 @@ StreamBlobImpl::CollectReports(nsIHandleReportCallback* aHandleReport,
 
   MOZ_COLLECT_REPORT(
       "explicit/dom/memory-file-data/stream", KIND_HEAP, UNITS_BYTES,
-      stringInputStream->SizeOfIncludingThis(MallocSizeOf),
+      stringInputStream->SizeOfIncludingThisIfUnshared(MallocSizeOf),
       "Memory used to back a File/Blob based on an input stream.");
 
   return NS_OK;
@@ -159,7 +159,7 @@ size_t StreamBlobImpl::GetAllocationSize() const {
     return 0;
   }
 
-  return stringInputStream->SizeOfIncludingThis(MallocSizeOf);
+  return stringInputStream->SizeOfIncludingThisEvenIfShared(MallocSizeOf);
 }
 
 void StreamBlobImpl::GetBlobImplType(nsAString& aBlobImplType) const {

dom/ipc/SharedMap.cpp

@@ -45,6 +45,7 @@ SharedMap::SharedMap(nsIGlobalObject* aGlobal, const FileDescriptor& aMapFile,
 }
 
 bool SharedMap::Has(const nsACString& aName) {
+  Unused << MaybeRebuild();
   return mEntries.Contains(aName);
 }
 

dom/ipc/tests/test_sharedMap.js

@@ -26,6 +26,10 @@ function getKey(key, sharedData = Services.cpmm.sharedData) {
   return sharedData.get(key);
 }
 
+function hasKey(key, sharedData = Services.cpmm.sharedData) {
+  return sharedData.has(key);
+}
+
 function getContents(sharedMap = Services.cpmm.sharedData) {
   return {
     keys: Array.from(sharedMap.keys()),
@@ -198,6 +202,15 @@ add_task(async function test_sharedMap() {
 
   checkParentMap(expected);
   await checkContentMaps(expected);
+
+  // Test that has() rebuilds map after a flush.
+  sharedData.set("grick", true);
+  sharedData.flush();
+  equal(await contentPage.spawn("grick", hasKey), true, "has() should see key after flush");
+
+  sharedData.set("grack", true);
+  sharedData.flush();
+  equal(await contentPage.spawn("gruck", hasKey), false, "has() should return false for nonexistent key");
 });
 
 add_task(async function test_blobs() {

gfx/2d/DrawTargetD2D1.cpp

@@ -1136,7 +1136,13 @@ already_AddRefed<GradientStops> DrawTargetD2D1::CreateGradientStops(
 
   RefPtr<ID2D1GradientStopCollection1> stopCollection;
 
-  HRESULT hr = Factory::GetD2DDeviceContext()->CreateGradientStopCollection(
+  RefPtr<ID2D1DeviceContext> dc = Factory::GetD2DDeviceContext();
+
+  if (!dc) {
+    return nullptr;
+  }
+
+  HRESULT hr = dc->CreateGradientStopCollection(
       stops, aNumStops, D2D1_COLOR_SPACE_SRGB, D2D1_COLOR_SPACE_SRGB,
       D2D1_BUFFER_PRECISION_8BPC_UNORM, D2DExtend(aExtendMode, Axis::BOTH),
       D2D1_COLOR_INTERPOLATION_MODE_PREMULTIPLIED,

gfx/2d/SourceSurfaceCapture.cpp

@@ -91,11 +91,6 @@ RefPtr<SourceSurface> SourceSurfaceCapture::Resolve(BackendType aBackendType) {
     backendType = mRefDT->GetBackendType();
   }
 
-  // If on the paint thread, we require that the owning DrawTarget be detached
-  // from this snapshot. This roughly approximates an assert that nothing can
-  // mutate the snapshot.
-  MOZ_RELEASE_ASSERT(NS_IsMainThread() || !mOwner);
-
   // Note: SurfaceType is not 1:1 with BackendType, so we can't easily decide
   // that they match. Instead we just cache the first thing to be requested.
   // We ensured no mResolved existed before.

gfx/wr/webrender/src/frame_builder.rs

@@ -28,7 +28,7 @@ use scene_builder::DocumentStats;
 use segment::SegmentBuilder;
 use std::{f32, mem};
 use std::sync::Arc;
-use tiling::{Frame, RenderPass, RenderPassKind, RenderTargetContext, RenderTarget};
+use tiling::{Frame, RenderPassKind, RenderTargetContext, RenderTarget};
 
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -558,41 +558,19 @@ impl FrameBuilder {
                                                            texture_cache_profile);
         }
 
-        let mut passes = vec![];
+        let mut passes;
         let mut deferred_resolves = vec![];
         let mut has_texture_cache_tasks = false;
         let mut prim_headers = PrimitiveHeaders::new();
 
         {
             profile_marker!("Batching");
 
-            // Add passes as required for our cached render tasks.
-            if !render_tasks.cacheable_render_tasks.is_empty() {
-                passes.push(RenderPass::new_off_screen(output_size, self.config.gpu_supports_fast_clears));
-                for cacheable_render_task in &render_tasks.cacheable_render_tasks {
-                    render_tasks.assign_to_passes(
-                        *cacheable_render_task,
-                        0,
-                        output_size,
-                        &mut passes,
-                        self.config.gpu_supports_fast_clears,
-                    );
-                }
-                passes.reverse();
-            }
-
-            if let Some(main_render_task_id) = main_render_task_id {
-                let passes_start = passes.len();
-                passes.push(RenderPass::new_main_framebuffer(output_size, self.config.gpu_supports_fast_clears));
-                render_tasks.assign_to_passes(
-                    main_render_task_id,
-                    passes_start,
-                    output_size,
-                    &mut passes,
-                    self.config.gpu_supports_fast_clears,
-                );
-                passes[passes_start..].reverse();
-            }
+            passes = render_tasks.generate_passes(
+                main_render_task_id,
+                output_size,
+                self.config.gpu_supports_fast_clears,
+            );
 
             // Used to generated a unique z-buffer value per primitive.
             let mut z_generator = ZBufferIdGenerator::new(layer);