#578: M1322864 M1585106 M1597043

accessible/generic/RootAccessible.cpp

@@ -366,6 +366,15 @@ RootAccessible::ProcessDOMEvent(nsIDOMEvent* aDOMEvent)
     if (FocusMgr()->HasDOMFocus(targetNode)) {
       nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSel =
         do_QueryInterface(targetNode);
+      if (!multiSel) {
+        // This shouldn't be possible. All XUL trees should have
+        // nsIDOMXULMultiSelectControlElement, and the tree is focused, so it
+        // shouldn't be dying. Nevertheless, this sometimes happens in the wild
+        // (bug 1597043).
+        MOZ_ASSERT_UNREACHABLE(
+            "XUL tree doesn't have nsIDOMXULMultiSelectControlElement");
+        return;
+      }
       nsAutoString selType;
       multiSel->GetSelType(selType);
       if (selType.IsEmpty() || !selType.EqualsLiteral("single")) {

dom/base/nsContentUtils.cpp

@@ -3184,7 +3184,14 @@ nsContentUtils::GetImageFromContent(nsIImageLoadingContent* aContent,
   }
 
   if (aRequest) {
-    imgRequest.swap(*aRequest);
+    // If the consumer wants the request, verify it has actually loaded
+    // successfully.
+    uint32_t imgStatus;
+    imgRequest->GetImageStatus(&imgStatus);
+    if (imgStatus & imgIRequest::STATUS_FRAME_COMPLETE &&
+        !(imgStatus & imgIRequest::STATUS_ERROR)) {
+      imgRequest.swap(*aRequest);
+    }
   }
 
   return imgContainer.forget();

netwerk/base/ProxyAutoConfig.cpp

@@ -265,7 +265,8 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
 
   PACResolver()
-    : mStatus(NS_ERROR_FAILURE)
+    : mStatus(NS_ERROR_FAILURE),
+      mMutex("PACResolver::Mutex")
   {
   }
 
@@ -274,12 +275,17 @@ public:
                                  nsIDNSRecord *record,
                                  nsresult status) override
   {
-    if (mTimer) {
-      mTimer->Cancel();
-      mTimer = nullptr;
+    nsCOMPtr<nsITimer> timer;
+    {
+      MutexAutoLock lock(mMutex);
+      timer.swap(mTimer);
+      mRequest = nullptr;
+    }
+
+    if (timer) {
+      timer->Cancel();
     }
 
-    mRequest = nullptr;
     mStatus = status;
     mResponse = record;
     return NS_OK;
@@ -298,6 +304,7 @@ public:
   nsCOMPtr<nsICancelable> mRequest;
   nsCOMPtr<nsIDNSRecord>  mResponse;
   nsCOMPtr<nsITimer>      mTimer;
+  Mutex                   mMutex;
 
 private:
   ~PACResolver() {}