From 7758ebb12e9019b099bfb8a08a67ea090d83d867 Mon Sep 17 00:00:00 2001
From: Cameron Kaiser <classilla@floodgap.com>
Date: Wed, 27 Nov 2019 17:22:03 -0800
Subject: [PATCH] #578: M1322864 M1585106 M1597043

---
 accessible/generic/RootAccessible.cpp |  9 +++++++++
 dom/base/nsContentUtils.cpp           |  9 ++++++++-
 netwerk/base/ProxyAutoConfig.cpp      | 17 ++++++++++++-----
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/accessible/generic/RootAccessible.cpp b/accessible/generic/RootAccessible.cpp
index b2077824e..8de0d47f1 100644
--- a/accessible/generic/RootAccessible.cpp
+++ b/accessible/generic/RootAccessible.cpp
@@ -366,6 +366,15 @@ RootAccessible::ProcessDOMEvent(nsIDOMEvent* aDOMEvent)
     if (FocusMgr()->HasDOMFocus(targetNode)) {
       nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSel =
         do_QueryInterface(targetNode);
+      if (!multiSel) {
+        // This shouldn't be possible. All XUL trees should have
+        // nsIDOMXULMultiSelectControlElement, and the tree is focused, so it
+        // shouldn't be dying. Nevertheless, this sometimes happens in the wild
+        // (bug 1597043).
+        MOZ_ASSERT_UNREACHABLE(
+            "XUL tree doesn't have nsIDOMXULMultiSelectControlElement");
+        return;
+      }
       nsAutoString selType;
       multiSel->GetSelType(selType);
       if (selType.IsEmpty() || !selType.EqualsLiteral("single")) {
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 436d764ed..be516d479 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -3184,7 +3184,14 @@ nsContentUtils::GetImageFromContent(nsIImageLoadingContent* aContent,
   }
 
   if (aRequest) {
-    imgRequest.swap(*aRequest);
+    // If the consumer wants the request, verify it has actually loaded
+    // successfully.
+    uint32_t imgStatus;
+    imgRequest->GetImageStatus(&imgStatus);
+    if (imgStatus & imgIRequest::STATUS_FRAME_COMPLETE &&
+        !(imgStatus & imgIRequest::STATUS_ERROR)) {
+      imgRequest.swap(*aRequest);
+    }
   }
 
   return imgContainer.forget();
diff --git a/netwerk/base/ProxyAutoConfig.cpp b/netwerk/base/ProxyAutoConfig.cpp
index 9006f0a75..26701d3ae 100644
--- a/netwerk/base/ProxyAutoConfig.cpp
+++ b/netwerk/base/ProxyAutoConfig.cpp
@@ -265,7 +265,8 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
 
   PACResolver()
-    : mStatus(NS_ERROR_FAILURE)
+    : mStatus(NS_ERROR_FAILURE),
+      mMutex("PACResolver::Mutex")
   {
   }
 
@@ -274,12 +275,17 @@ public:
                                  nsIDNSRecord *record,
                                  nsresult status) override
   {
-    if (mTimer) {
-      mTimer->Cancel();
-      mTimer = nullptr;
+    nsCOMPtr<nsITimer> timer;
+    {
+      MutexAutoLock lock(mMutex);
+      timer.swap(mTimer);
+      mRequest = nullptr;
+    }
+
+    if (timer) {
+      timer->Cancel();
     }
 
-    mRequest = nullptr;
     mStatus = status;
     mResponse = record;
     return NS_OK;
@@ -298,6 +304,7 @@ public:
   nsCOMPtr<nsICancelable> mRequest;
   nsCOMPtr<nsIDNSRecord>  mResponse;
   nsCOMPtr<nsITimer>      mTimer;
+  Mutex                   mMutex;
 
 private:
   ~PACResolver() {}