#443: M1395138 M1400554 M1400003 M1407751 M1261175

dom/system/OSFileConstants.cpp

@@ -350,6 +350,7 @@ void CleanupOSFileConstants()
 
   gInitialized = false;
   delete gPaths;
+  gPaths = nullptr;
 }
 
 
@@ -848,9 +849,7 @@ bool SetStringProperty(JSContext *cx, JS::Handle<JSObject*> aObject, const char
  */
 bool DefineOSFileConstants(JSContext *cx, JS::Handle<JSObject*> global)
 {
-  MOZ_ASSERT(gInitialized);
-
-  if (gPaths == nullptr) {
+  if (!gInitialized || gPaths == nullptr) {
     // If an initialization error was ignored, we may end up with
     // |gInitialized == true| but |gPaths == nullptr|. We cannot
     // |MOZ_ASSERT| this, as this would kill precompile_cache.js,

gfx/layers/composite/ContainerLayerComposite.cpp

@@ -127,9 +127,9 @@ static void PrintUniformityInfo(Layer* aLayer)
 /* all of the per-layer prepared data we need to maintain */
 struct PreparedLayer
 {
-  PreparedLayer(LayerComposite *aLayer, RenderTargetIntRect aClipRect) :
+  PreparedLayer(Layer *aLayer, RenderTargetIntRect aClipRect) :
     mLayer(aLayer), mClipRect(aClipRect) {}
-  LayerComposite* mLayer;
+  RefPtr<Layer> mLayer;
   RenderTargetIntRect mClipRect;
 };
 
@@ -374,7 +374,8 @@ ContainerPrepare(ContainerT* aContainer,
     CULLING_LOG("Preparing sublayer %p\n", layerToRender->GetLayer());
 
     layerToRender->Prepare(clipRect);
-    aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender, clipRect));
+    aContainer->mPrepared->mLayers.AppendElement(PreparedLayer(layerToRender->GetLayer(),
+                                                               clipRect));
   }
 
   CULLING_LOG("Preparing container layer %p\n", aContainer->GetLayer());
@@ -520,7 +521,7 @@ RenderLayers(ContainerT* aContainer,
 
   for (size_t i = 0u; i < aContainer->mPrepared->mLayers.Length(); i++) {
     PreparedLayer& preparedData = aContainer->mPrepared->mLayers[i];
-    LayerComposite* layerToRender = preparedData.mLayer;
+    LayerComposite* layerToRender = static_cast<LayerComposite*>(preparedData.mLayer->ImplData());
     const RenderTargetIntRect& clipRect = preparedData.mClipRect;
     Layer* layer = layerToRender->GetLayer();
 

js/public/RootingAPI.h

@@ -215,7 +215,7 @@ AssertGCThingIsNotAnObjectSubclass(js::gc::Cell* cell) {}
  * Type T must be one of: JS::Value, jsid, JSObject*, JSString*, JSScript*
  */
 template <typename T>
-class Heap : public js::HeapBase<T>
+class MOZ_NON_MEMMOVABLE Heap : public js::HeapBase<T>
 {
   public:
     Heap() {
@@ -1119,6 +1119,14 @@ class JS_PUBLIC_API(ObjectPtr)
 
     explicit ObjectPtr(JSObject* obj) : value(obj) {}
 
+    ObjectPtr(const ObjectPtr& other) : value(other.value) {}
+
+    ObjectPtr(ObjectPtr&& other)
+      : value(other.value)
+    {
+        other.value = nullptr;
+    }
+
     /* Always call finalize before the destructor. */
     ~ObjectPtr() { MOZ_ASSERT(!value); }
 

js/src/gc/Barrier.h

@@ -325,8 +325,11 @@ template <typename T>
 class BarrieredBaseMixins {};
 
 // Base class of all barrier types.
+//
+// This is marked non-memmovable since post barriers added by derived classes
+// can add pointers to class instances to the store buffer.
 template <typename T>
-class BarrieredBase : public BarrieredBaseMixins<T>
+class MOZ_NON_MEMMOVABLE BarrieredBase : public BarrieredBaseMixins<T>
 {
   protected:
     // BarrieredBase is not directly instantiable.

netwerk/protocol/http/TunnelUtils.cpp

@@ -123,6 +123,10 @@ TLSFilterTransaction::Close(nsresult aReason)
     return;
   }
 
+  if (mTimer) {
+    mTimer->Cancel();
+    mTimer = nullptr;
+  }
   mTransaction->Close(aReason);
   mTransaction = nullptr;
 }

view/nsViewManager.cpp

@@ -101,7 +101,7 @@ nsViewManager::~nsViewManager()
     gViewManagers = nullptr;
   }
 
-  mPresShell = nullptr;
+  MOZ_RELEASE_ASSERT(!mPresShell, "Releasing nsViewManager without having called Destroy on the PresShell!");
 }
 
 // We don't hold a reference to the presentation context because it

xpcom/glue/nsTArray.h

@@ -33,6 +33,7 @@
 namespace JS {
 template<class T>
 class Heap;
+class ObjectPtr;
 } /* namespace JS */
 
 class nsRegion;
@@ -659,7 +660,7 @@ struct nsTArray_CopyWithConstructors
 template<class E>
 struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser
 {
-  typedef nsTArray_CopyWithMemutils Type;
+  using Type = nsTArray_CopyWithMemutils;
 };
 
 //
@@ -669,25 +670,31 @@ struct MOZ_NEEDS_MEMMOVABLE_TYPE nsTArray_CopyChooser
 template<class E>
 struct nsTArray_CopyChooser<JS::Heap<E>>
 {
-  typedef nsTArray_CopyWithConstructors<JS::Heap<E>> Type;
+  using Type = nsTArray_CopyWithConstructors<JS::Heap<E>>;
+};
+
+template<>
+struct nsTArray_CopyChooser<JS::ObjectPtr>
+{
+  using Type = nsTArray_CopyWithConstructors<JS::ObjectPtr>;
 };
 
 template<>
 struct nsTArray_CopyChooser<nsRegion>
 {
-  typedef nsTArray_CopyWithConstructors<nsRegion> Type;
+  using Type = nsTArray_CopyWithConstructors<nsRegion>;
 };
 
 template<>
 struct nsTArray_CopyChooser<nsIntRegion>
 {
-  typedef nsTArray_CopyWithConstructors<nsIntRegion> Type;
+  using Type = nsTArray_CopyWithConstructors<nsIntRegion>;
 };
 
 template<>
 struct nsTArray_CopyChooser<mozilla::layers::TileClient>
 {
-  typedef nsTArray_CopyWithConstructors<mozilla::layers::TileClient> Type;
+  using Type = nsTArray_CopyWithConstructors<mozilla::layers::TileClient>;
 };