#416: M1378147 M1371890 M1380426

dom/html/ImageDocument.cpp

@@ -597,12 +597,17 @@ ImageDocument::UpdateSizeFromLayout()
 {
   // Pull an updated size from the content frame to account for any size
   // change due to CSS properties like |image-orientation|.
-  Element* contentElement = mImageContent->AsElement();
-  if (!contentElement) {
+  if (!mImageContent) {
     return;
   }
 
-  nsIFrame* contentFrame = contentElement->GetPrimaryFrame(Flush_Frames);
+  // Need strong ref, because GetPrimaryFrame can run script.
+  nsCOMPtr<Element> imageContent = mImageContent->AsElement();
+  if (!imageContent) {
+    return;
+  }
+
+  nsIFrame* contentFrame = imageContent->GetPrimaryFrame(Flush_Frames);
   if (!contentFrame) {
     return;
   }

netwerk/base/nsStreamListenerWrapper.h

@@ -23,7 +23,7 @@ public:
     NS_ASSERTION(mListener, "no stream listener specified");
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_FORWARD_NSIREQUESTOBSERVER(mListener->)
   NS_FORWARD_NSISTREAMLISTENER(mListener->)
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER

netwerk/streamconv/converters/nsFTPDirListingConv.cpp

@@ -299,6 +299,13 @@ nsFTPDirListingConv::DigestBufferLines(char *aBuffer, nsCString &aString) {
 
         // MODIFIED DATE
         char buffer[256] = "";
+
+        // ParseFTPList can return time structure with invalid values.
+        // PR_NormalizeTime will set all values into valid limits.
+        result.fe_time.tm_params.tp_gmt_offset = 0;
+        result.fe_time.tm_params.tp_dst_offset = 0;
+        PR_NormalizeTime(&result.fe_time, PR_GMTParameters);
+
         // Note: The below is the RFC822/1123 format, as required by
         // the application/http-index-format specs
         // viewers of such a format can then reformat this into the