Merge branch 'master' of github.com:classilla/tenfourfox

Testcases aren't included because they require async/await.

References:
https://bugzilla.mozilla.org/show_bug.cgi?id=1520960 (Allow saving passwords in private windows with a dismissed-by-default doorhanger)
https://hg.mozilla.org/mozilla-central/rev/b4645dc802f9 (Allow login capture from form submissions in private browsing when pref'd on.)
https://hg.mozilla.org/mozilla-central/rev/5656f8b5c547 (Allow login capture from HTTP auth prompts in private browsing when pref'd on.)
https://bugzilla.mozilla.org/show_bug.cgi?id=1660998 (Option to save logins does not keep state in private mode)
https://hg.mozilla.org/mozilla-central/rev/d67d3463b4aa (Don't disable the password manager checkbox in permanent private browsing mode.)

104fx_import_esr102_stspreload.pl

@@ -10,7 +10,7 @@ print <<'EOF';
 /* nsSiteSecurityService.cpp, you shouldn't be #including it.                */
 /*****************************************************************************/
 
-/* imported from ESR68 by TenFourFox conversion script */
+/* imported from ESR102 by TenFourFox conversion script */
 
 #include <stdint.h>
 EOF

104fx_import_esr115_stspreload.pl

@@ -10,7 +10,7 @@ print <<'EOF';
 /* nsSiteSecurityService.cpp, you shouldn't be #including it.                */
 /*****************************************************************************/
 
-/* imported from ESR78 by TenFourFox conversion script */
+/* imported from ESR115 by TenFourFox conversion script */
 
 #include <stdint.h>
 EOF

104fx_import_shavar_cryptominers.pl

@@ -390,7 +390,14 @@ if (!defined($json_ref->{'license'}) ||
 
 select(STDOUT); $|++;
 %dupedupe = ();
-foreach $a (@{ $json_ref->{'categories'}->{'Cryptomining'} }) {
+&emit('Cryptomining');
+&emit('FingerprintingInvasive');
+# considering
+#&emit('Analytics');
+
+sub emit {
+my $cat = shift(@_);
+foreach $a (@{ $json_ref->{'categories'}->{$cat} }) {
 	foreach $b (keys(%{ $a })) {
 		die("illegal newline: $b\n") if ($b =~ /[\r\n]/s);
 		print "// $b\n";
@@ -404,8 +411,15 @@ foreach $a (@{ $json_ref->{'categories'}->{'Cryptomining'} }) {
 				die("illegal quote: $d\n") if ($d =~ /"/);
 				next if ($dupedupe{$d}++);
 
+				# whitelist (with regrets)
+				next if (0 ||
+					$d eq 'ibm.com' ||
+					$d eq 'godaddy.com' ||
+				0);
 				print "        BLOK(\"$d\") ||\n";
+				print "        BLOKD(\".$d\") ||\n";
 			}
 		}
 	}
 }
+}

104fx_upcerts.sh

@@ -10,7 +10,7 @@ endif
 # if we update NSS, we need to remove that patch (TenFourFox issue 512).
 
 set verbose
-set release_url=https://hg.mozilla.org/releases/mozilla-esr78/raw-file/tip/
+set release_url=https://hg.mozilla.org/releases/mozilla-esr115/raw-file/tip/
 
 # self test to ensure certificates and encryption methods are correct
 curl ${release_url}/config/milestone.txt || exit
@@ -18,6 +18,6 @@ curl ${release_url}/config/milestone.txt || exit
 curl ${release_url}/security/manager/ssl/StaticHPKPins.h > security/manager/ssl/StaticHPKPins.h
 curl ${release_url}/security/nss/lib/ckfw/builtins/certdata.txt > security/nss/lib/ckfw/builtins/certdata.txt
 curl ${release_url}/netwerk/dns/effective_tld_names.dat > netwerk/dns/effective_tld_names.dat
-curl ${release_url}/security/manager/ssl/nsSTSPreloadList.inc | perl ./104fx_import_esr78_stspreload.pl > security/manager/ssl/nsSTSPreloadList.inc
+curl ${release_url}/security/manager/ssl/nsSTSPreloadList.inc | perl ./104fx_import_esr102_stspreload.pl > security/manager/ssl/nsSTSPreloadList.inc
 perl ./104fx_import_shavar_cryptominers.pl > caps/shavar-blocklist.h
 

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Merge day clobber
+Rebuild for 115ESR base

README.md

@@ -4,9 +4,9 @@ A fork of Firefox to maintain support for the Power Mac, supporting Mac OS X 10.
 
 This project is specifically for Mac OS X 10.4+. If you're looking for a browser for Mac OS 8.6-10.3, look at our sister project, [Classilla](http://www.classilla.org/).
 
-Our Github project site houses our source code, [documentation wiki](https://github.com/classilla/tenfourfox/wiki) and [issues list](https://github.com/classilla/tenfourfox/issues). For downloads and archived versions, visit our [SourceForge download repository](https://sourceforge.net/projects/tenfourfox/files/). **The most current downloads are always linked on [the main TenFourFox home page](http://www.tenfourfox.com/).**
+**TenFourFox is a "hobby" project: you build it yourself, with no guarantees on updates, update frequency, security or stability.** Our Github project site houses our source code, [documentation wiki](https://github.com/classilla/tenfourfox/wiki) with complete build instructions, and [the current worklist](https://github.com/classilla/tenfourfox/issues). For archived downloads, language packs and contributed tools, visit our [SourceForge download repository](https://sourceforge.net/projects/tenfourfox/files/). **There is no support for any version of TenFourFox.** The current update source is Firefox 115ESR.
 
-**If you are an end-user, or otherwise not an official contributor, do _not_ file issues on Github.** Please visit [our Tenderapp support site](http://tenfourfox.tenderapp.com/) and one of our helpful volunteers will assist. Issues opened by end users may be closed as invalid if they have not been adequately vetted.
+**If you file a Github issue without a patch, or without declaring your intention to file a pull request addressing that issue, it may be summarily closed or deleted at the maintainer's sole discretion.** The issue list is an active worklist, and if no work will occur on an issue, even if the issue is real and verifiable, it will be closed. There are lots of acknowledged deficiencies in TenFourFox and not everyone is going to prioritize a deficiency the way you might. If you are not willing or able to fix your most important issues yourself, you may not want to use this browser.
 
 The `wiki/` branch contains old documentation and release notes from our former Google Code wiki. They are no longer updated or maintained. Take care as links in those documents have probably rotted.
 

browser/app/profile/firefox.js

@@ -51,7 +51,7 @@ pref("extensions.getAddons.recommended.url", "https://services.addons.mozilla.or
 pref("extensions.getAddons.link.url", "https://addons.mozilla.org/%LOCALE%/firefox/");
 
 // Blocklist preferences
-pref("extensions.blocklist.enabled", true);
+pref("extensions.blocklist.enabled", false);
 // OneCRL freshness checking depends on this value, so if you change it,
 // please also update security.onecrl.maximum_staleness_in_seconds.
 pref("extensions.blocklist.interval", 86400);
@@ -86,7 +86,7 @@ pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/f
 
 // At startup, should we check to see if the installation
 // date is older than some threshold
-pref("app.update.checkInstallTime", true);
+pref("app.update.checkInstallTime", false);
 
 // The number of days a binary is permitted to be old without checking is defined in
 // firefox-branding.js (app.update.checkInstallTime.days)
@@ -122,18 +122,18 @@ pref("app.update.cert.requireBuiltIn", false);
 pref("app.update.cert.checkAttributes", false);
 
 // Whether or not app updates are enabled
-pref("app.update.enabled", true);
+pref("app.update.enabled", false);
 
 // This preference turns on app.update.mode and allows automatic download and
 // install to take place. We use a separate boolean toggle for this to make
 // the UI easier to construct.
-pref("app.update.auto", true);
+pref("app.update.auto", false);
 
 // See chart in nsUpdateService.js source for more details
 pref("app.update.mode", 2);
 
 // If set to true, the Update Service will present no UI for any event.
-pref("app.update.silent", false);
+pref("app.update.silent", true);
 
 // If set to true, the hamburger button will show badges for update events.
 #ifndef RELEASE_BUILD
@@ -177,7 +177,7 @@ pref("app.update.incompatible.mode", 0);
 
 // Whether or not to attempt using the service for updates.
 #ifdef MOZ_MAINTENANCE_SERVICE
-pref("app.update.service.enabled", true);
+pref("app.update.service.enabled", false);
 #endif
 
 // Symmetric (can be overridden by individual extensions) update preferences.
@@ -1622,6 +1622,8 @@ pref("browser.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4");
 pref("browser.pocket.useLocaleList", true);
 pref("browser.pocket.enabledLocales", "cs de en-GB en-US en-ZA es-ES es-MX fr hu it ja ja-JP-mac ko nl pl pt-BR pt-PT ru zh-CN zh-TW");
 
+pref("signon.privateBrowsingCapture.enabled", true);
+
 pref("view_source.tab", true);
 
 pref("dom.webnotifications.serviceworker.enabled", true);

browser/base/content/baseMenuOverlay.xul

@@ -84,6 +84,7 @@
                   stopaccesskey="&helpSafeMode.stop.accesskey;"
                   stoplabel="&helpSafeMode.stop.label;"
                   oncommand="safeModeRestart();"/>
+#ifdef NO_MORE_OFFICIAL_BUILDS
         <menuseparator id="updateSeparator"/>
 #ifdef XP_MACOSX
 #ifdef MOZ_UPDATER
@@ -92,6 +93,7 @@
                   class="menuitem-iconic"
                   oncommand="checkForUpdates();"/>
 #endif
+#endif
 #endif
         <menuseparator id="aboutSeparator"/>
         <menuitem id="aboutName"

browser/base/content/browser-context.inc

@@ -118,27 +118,33 @@
       <menu id="context-media-playbackrate" label="&mediaPlaybackRate.label;" accesskey="&mediaPlaybackRate.accesskey;">
         <menupopup>
           <menuitem id="context-media-playbackrate-050x"
-                    label="&mediaPlaybackRate050x.label;"
-                    accesskey="&mediaPlaybackRate050x.accesskey;"
+                    label="&mediaPlaybackRate050x2.label;"
+                    accesskey="&mediaPlaybackRate050x2.accesskey;"
                     type="radio"
                     name="playbackrate"
                     oncommand="gContextMenu.mediaCommand('playbackRate', 0.5);"/>
           <menuitem id="context-media-playbackrate-100x"
-                    label="&mediaPlaybackRate100x.label;"
-                    accesskey="&mediaPlaybackRate100x.accesskey;"
+                    label="&mediaPlaybackRate100x2.label;"
+                    accesskey="&mediaPlaybackRate100x2.accesskey;"
                     type="radio"
                     name="playbackrate"
                     checked="true"
                     oncommand="gContextMenu.mediaCommand('playbackRate', 1.0);"/>
+          <menuitem id="context-media-playbackrate-125x"
+                    label="&mediaPlaybackRate125x2.label;"
+                    accesskey="&mediaPlaybackRate125x2.accesskey;"
+                    type="radio"
+                    name="playbackrate"
+                    oncommand="gContextMenu.mediaCommand('playbackRate', 1.25);"/>
           <menuitem id="context-media-playbackrate-150x"
-                    label="&mediaPlaybackRate150x.label;"
-                    accesskey="&mediaPlaybackRate150x.accesskey;"
+                    label="&mediaPlaybackRate150x2.label;"
+                    accesskey="&mediaPlaybackRate150x2.accesskey;"
                     type="radio"
                     name="playbackrate"
                     oncommand="gContextMenu.mediaCommand('playbackRate', 1.5);"/>
           <menuitem id="context-media-playbackrate-200x"
-                    label="&mediaPlaybackRate200x.label;"
-                    accesskey="&mediaPlaybackRate200x.accesskey;"
+                    label="&mediaPlaybackRate200x2.label;"
+                    accesskey="&mediaPlaybackRate200x2.accesskey;"
                     type="radio"
                     name="playbackrate"
                     oncommand="gContextMenu.mediaCommand('playbackRate', 2.0);"/>

browser/base/content/browser-menubar.inc

@@ -322,8 +322,10 @@
                           observes="View:FullScreen"/>
 #endif
                 <menuitem id="menu_readerModeItem"
+                          hidden="true"
                           observes="View:ReaderView"
-                          hidden="true"/>
+                          key="key_toggleReaderMode"
+                          label="&toggleReaderMode.label;"/>
                 <menuitem id="menu_showAllTabs"
                           hidden="true"
                           accesskey="&showAllTabsCmd.accesskey;"

browser/base/content/browser-sets.inc

@@ -367,6 +367,7 @@
     <key id="key_fullScreen_old" key="&fullScreenCmd.macCommandKey;" command="View:FullScreen" modifiers="accel,shift"/>
     <key keycode="VK_F11" command="View:FullScreen"/>
 #endif
+    <key id="key_toggleReaderMode" key="&toggleReaderMode.key;" command="View:ReaderView" modifiers="accel,alt" disabled="true"/>
     <key key="&reloadCmd.commandkey;" command="Browser:Reload" modifiers="accel" id="key_reload"/>
     <key key="&reloadCmd.commandkey;" command="Browser:ReloadSkipCache" modifiers="accel,shift"/>
     <key id="key_viewSource" key="&pageSourceCmd.commandkey;" command="View:PageSource" modifiers="accel"/>

browser/base/content/browser.js

@@ -5414,6 +5414,7 @@ const nodeToTooltipMap = {
   "tabs-newtab-button": "newTabButton.tooltip",
   "fullscreen-button": "fullscreenButton.tooltip",
   "downloads-button": "downloads.tooltip",
+  "reader-mode-button": "reader-mode-button.tooltip",
 };
 const nodeToShortcutMap = {
   "bookmarks-menu-button": "manBookmarkKb",
@@ -5421,7 +5422,8 @@ const nodeToShortcutMap = {
   "new-tab-button": "key_newNavigatorTab",
   "tabs-newtab-button": "key_newNavigatorTab",
   "fullscreen-button": "key_fullScreen",
-  "downloads-button": "key_openDownloads"
+  "downloads-button": "key_openDownloads",
+  "reader-mode-button": "key_toggleReaderMode",
 };
 
 //if (AppConstants.platform == "macosx") {

browser/base/content/browser.xul

@@ -733,6 +733,7 @@
                        onclick="gPopupBlockerObserver.onReportButtonClick(event);"/>
                 <image id="reader-mode-button"
                        class="urlbar-icon"
+                       tooltip="dynamic-shortcut-tooltip"
                        hidden="true"
                        onclick="ReaderParent.buttonClick(event);"/>
               </hbox>

browser/base/content/nsContextMenu.js

@@ -525,6 +525,7 @@ nsContextMenu.prototype = {
     if (onMedia) {
       this.setItemAttr("context-media-playbackrate-050x", "checked", this.target.playbackRate == 0.5);
       this.setItemAttr("context-media-playbackrate-100x", "checked", this.target.playbackRate == 1.0);
+      this.setItemAttr("context-media-playbackrate-125x", "checked", this.target.playbackRate == 1.25);
       this.setItemAttr("context-media-playbackrate-150x", "checked", this.target.playbackRate == 1.5);
       this.setItemAttr("context-media-playbackrate-200x", "checked", this.target.playbackRate == 2.0);
       var hasError = this.target.error != null ||
@@ -536,6 +537,7 @@ nsContextMenu.prototype = {
       this.setItemAttr("context-media-playbackrate", "disabled", hasError);
       this.setItemAttr("context-media-playbackrate-050x", "disabled", hasError);
       this.setItemAttr("context-media-playbackrate-100x", "disabled", hasError);
+      this.setItemAttr("context-media-playbackrate-125x", "disabled", hasError);
       this.setItemAttr("context-media-playbackrate-150x", "disabled", hasError);
       this.setItemAttr("context-media-playbackrate-200x", "disabled", hasError);
       this.setItemAttr("context-media-showcontrols", "disabled", hasError);

browser/base/content/tab-content.js

@@ -13,6 +13,8 @@ Cu.import("resource://gre/modules/ExtensionContent.jsm");
 
 const g104FxForcePref = "tenfourfox.reader.force-enable"; // TenFourFox issue 583
 const g104FxStickyPref = "tenfourfox.reader.sticky"; // TenFourFox issue 620
+const g104FxAutoPref = "tenfourfox.reader.auto."; // TenFourFox issue 636
+
 Cu.import("resource://gre/modules/Preferences.jsm");
 
 XPCOMUtils.defineLazyModuleGetter(this, "E10SUtils",
@@ -262,6 +264,7 @@ var AboutReaderListener = {
   _articlePromise: null,
   _alwaysAllowReaderMode: true, // TenFourFox issue 583
   _stickyReaderMode: true, // TenFourFox issue 620
+  _currentURISpec: null, // TenFourFox issue 636
 
   init: function() {
     addEventListener("AboutReaderContentLoaded", this, false, true);
@@ -273,12 +276,15 @@ var AboutReaderListener = {
     Services.prefs.addObserver(g104FxForcePref, this, false);
     Services.prefs.addObserver(g104FxStickyPref, this, false);
     Services.obs.addObserver(this, "AboutReader:Ready", false);
+    /* content-document-global-created seems to NS_ASSERT */
+    Services.obs.addObserver(this, "document-element-inserted", false);
   },
 
-  // TenFourFox issue 583
+  // TenFourFox issue 583 + 636
   uninit: function() {
     Services.prefs.removeObserver(g104FxForcePref, this, false);
     Services.obs.removeObserver(this, "AboutReader:Ready");
+    Services.obs.removeObserver(this, "document-element-inserted");
   },
   observe: function(subject, topic, data) { // jshint ignore:line
     if (topic === "nsPref:changed") {
@@ -288,6 +294,54 @@ var AboutReaderListener = {
     if (topic === "AboutReader:Ready") {
       this.stickyReaderLinks();
     }
+    if (topic === "document-element-inserted") { // TenFourFox issue 636
+      this.doAutoReaderView();
+    }
+  },
+
+  // TenFourFox issue 636
+  doAutoReaderView: function() {
+    if (!content || this.isAboutReader)
+      return;
+
+    if (!content.document.documentURI.startsWith("http:") &&
+        !content.document.documentURI.startsWith("https")) {
+      /* could be another about: page, could be ftp, ... */
+      this._currentURISpec = null;
+      return;
+    }
+
+    /* if we ended up back here because we explicitly exited Reader View on
+       the same URL, then honour what the user probably wants. */
+    let loc = content.document.location;
+    if (this._currentURISpec == loc.href) return;
+    this._currentURISpec = loc.href;
+
+    /* process into an nsIURI. this gives us a reliable host *and* spec w/o ref */
+    let uri = Services.io.newURI(loc.href, null, null);
+    if (uri && uri.host && uri.host.length && uri.host.length > 0) {
+      let w = null;
+      try {
+        w = Services.prefs.getCharPref(g104FxAutoPref + uri.host);
+      } catch(e) { }
+      if (w && w.length && w.length > 0) {
+        if (w == "y") {
+          this._currentURISpec = uri.specIgnoringRef; // might change
+          loc.replace("about:reader?url="+encodeURIComponent(uri.specIgnoringRef));
+          return;
+        }
+        if (w == "s") {
+          if (uri.path && uri.path.length && uri.path != "" && uri.path != "/"
+              && !uri.path.startsWith("/?")
+              && !uri.path.toLowerCase().startsWith("/index.")
+             ) {
+            this._currentURISpec = uri.specIgnoringRef; // might change
+            loc.replace("about:reader?url="+encodeURIComponent(uri.specIgnoringRef));
+            return;
+          }
+        }
+      }
+    }
   },
 
   receiveMessage: function(message) {
@@ -342,6 +396,24 @@ var AboutReaderListener = {
         }
         break;
       case "DOMContentLoaded":
+	// Post-load fixups can go here.
+
+	// TenFourFox issue 654: defeat lozad.js lazy image loading.
+	Array.forEach(content.document.getElementsByTagName('img'),
+	function(i) {
+		let j;
+
+		try {
+			// Convert data-src to src.
+			j = i.getAttribute("data-src");
+			if (j) {
+				i.src = j;
+				i.setAttribute("data-loaded") = "true";
+			}
+		} catch(e) { }
+	});
+
+	// Do this last.
         this.updateReaderButton();
         break;
 

browser/base/content/test/general/test_contextmenu.html

@@ -173,6 +173,7 @@ function runTest(testNum) {
                           "context-media-playbackrate", null,
                               ["context-media-playbackrate-050x", true,
                                "context-media-playbackrate-100x", true,
+                               "context-media-playbackrate-125x", true,
                                "context-media-playbackrate-150x", true,
                                "context-media-playbackrate-200x", true], null,
                           "context-media-hidecontrols", true,
@@ -199,6 +200,7 @@ function runTest(testNum) {
                             "context-media-playbackrate", null,
                                 ["context-media-playbackrate-050x", true,
                                  "context-media-playbackrate-100x", true,
+                                 "context-media-playbackrate-125x", true,
                                  "context-media-playbackrate-150x", true,
                                  "context-media-playbackrate-200x", true], null,
                             "context-media-showcontrols", true,
@@ -219,6 +221,7 @@ function runTest(testNum) {
                           "context-media-playbackrate", null,
                               ["context-media-playbackrate-050x", false,
                                "context-media-playbackrate-100x", false,
+                               "context-media-playbackrate-125x", false,
                                "context-media-playbackrate-150x", false,
                                "context-media-playbackrate-200x", false], null,
                           "context-media-hidecontrols", false,
@@ -245,6 +248,7 @@ function runTest(testNum) {
                           "context-media-playbackrate", null,
                               ["context-media-playbackrate-050x", false,
                                "context-media-playbackrate-100x", false,
+                               "context-media-playbackrate-125x", false,
                                "context-media-playbackrate-150x", false,
                                "context-media-playbackrate-200x", false], null,
                           "context-media-hidecontrols", false,
@@ -305,6 +309,7 @@ function runTest(testNum) {
                           "context-media-playbackrate", null,
                               ["context-media-playbackrate-050x", true,
                                "context-media-playbackrate-100x", true,
+                               "context-media-playbackrate-125x", true,
                                "context-media-playbackrate-150x", true,
                                "context-media-playbackrate-200x", true], null,
                           "context-media-hidecontrols", true,

browser/base/content/utilityOverlay.js

@@ -670,7 +670,8 @@ function setupCheckForUpdates(checkForUpdates, aStringBundle)
   // Disable the UI if the update enabled pref has been locked by the 
   // administrator or if we cannot update for some other reason
   var canCheckForUpdates = updates.canCheckForUpdates;
-  checkForUpdates.setAttribute("disabled", !canCheckForUpdates);
+  try { checkForUpdates.setAttribute("disabled", !canCheckForUpdates); }
+      catch(e) { return; }
   if (!canCheckForUpdates)
     return; 
 

browser/branding/aurora/pref/firefox-branding.js

@@ -8,7 +8,7 @@ pref("startup.homepage_override_url", "");
 pref("startup.homepage_welcome_url", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 28800); // 8 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 // 0 means "download everything at once"

browser/branding/nightly/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 // 0 means "download everything at once"

browser/branding/official/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/firstrun/learnmore/");
 // Interval: Time between checks for a new version (in seconds)
-pref("app.update.interval", 43200); // 12 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 pref("app.update.download.backgroundInterval", 60);

browser/branding/unofficial/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 pref("app.update.download.backgroundInterval", 60);

browser/components/nsBrowserGlue.js

@@ -834,7 +834,7 @@ BrowserGlue.prototype = {
     webrtcUI.init();
     AboutHome.init();
 
-    DirectoryLinksProvider.init();
+    //DirectoryLinksProvider.init(); // disabled
     NewTabUtils.init();
     NewTabUtils.links.addProvider(DirectoryLinksProvider);
     AboutNewTab.init();

browser/components/preferences/in-content/security.js

@@ -99,23 +99,15 @@ var gSecurityPane = {
 
   /**
    * Enables/disables the Exceptions button used to configure sites where
-   * passwords are never saved. When browser is set to start in Private
-   * Browsing mode, the "Remember passwords" UI is useless, so we disable it.
+   * passwords are never saved.
    */
   readSavePasswords: function ()
   {
-    var pref = document.getElementById("signon.rememberSignons");
-    var excepts = document.getElementById("passwordExceptions");
+    var prefValue = document.getElementById("signon.rememberSignons").value;
+    document.getElementById("passwordExceptions").disabled = !prefValue;
 
-    if (PrivateBrowsingUtils.permanentPrivateBrowsing) {
-      document.getElementById("savePasswords").disabled = true;
-      excepts.disabled = true;
-      return false;
-    } else {
-      excepts.disabled = !pref.value;
-      // don't override pref value in UI
-      return undefined;
-    }
+    // don't override pref value in UI
+    return undefined;
   },
 
   /**

browser/components/preferences/in-content/tenfourfox.js

@@ -11,17 +11,44 @@ var gTenFourFoxPane = {
 
   init: function ()
   {
-    function setEventListener(aId, aEventType, aCallback) /* future expansion */
+    function setEventListener(aId, aEventType, aCallback)
     {
       document.getElementById(aId)
               .addEventListener(aEventType, aCallback.bind(gTenFourFoxPane));
     }
 
-    /* setEventListener("historyDontRememberClear", "click", function () {
-      gPrivacyPane.clearPrivateDataNow(true);
-      return false;
-    }); */
+    setEventListener("siteSpecificUAs", "command", gTenFourFoxPane.showSSUAs);
+    setEventListener("autoReaderView", "command", gTenFourFoxPane.showAutoRV);
   },
+
+  showSSUAs: function ()
+  {
+    let bundle = document.getElementById("tenFourFoxBundle");
+    let params = { blockVisible   : true,
+                   sessionVisible : true,
+                   allowVisible   : true,
+                   prefilledHost  : "",
+                   type           : "ssua",
+                   windowTitle    : bundle.getString("TFFsiteSpecificUAs.title"),
+                   introText      : bundle.getString("TFFsiteSpecificUAs.prompt") };
+    gSubDialog.open("chrome://browser/content/preferences/tenfourfox-ssua.xul",
+                    null, params);
+  },
+
+  showAutoRV: function ()
+  {
+    let bundle = document.getElementById("tenFourFoxBundle");
+    let params = { blockVisible   : true,
+                   sessionVisible : true,
+                   allowVisible   : true,
+                   prefilledHost  : "",
+                   type           : "autorv",
+                   windowTitle    : bundle.getString("TFFautoReaderView.title"),
+                   introText      : bundle.getString("TFFautoReaderView.prompt") };
+    gSubDialog.open("chrome://browser/content/preferences/tenfourfox-autorv.xul",
+                    null, params);
+  },
+
   
   // We have to invert the sense for the pdfjs.disabled pref, since true equals DISabled.
 
@@ -37,18 +64,20 @@ var gTenFourFoxPane = {
   },
   
   // Find and set the appropriate UA string based on the UA template.
+  // Keep in sync with tenfourfox-ssua.xul and tenfourfox.xul
   validUA : {
       "fx" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Firefox/52.0",
       "fx60" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Firefox/60.0",
       "fx68" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Firefox/68.0",
       "fx78" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0",
+      "fx91" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0",
+      "fx102" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0",
       "classilla" : "NokiaN90-1/3.0545.5.1 Series60/2.8 Profile/MIDP-2.0 Configuration/CLDC-1.1 (en-US; rv:9.3.3) Clecko/20141026 Classilla/CFM",
       "ie8" : "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)",
       "ie11" : "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko",
       "android" : "Mozilla/5.0 (Linux; Android 8.1.0; Pixel XL Build/OPM1.171019.021) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36",
       "ipad" : "Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D100 Safari/604.1"
   },
-  _prefSvc: Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch),
   readUA: function ()
   {
     var pref = document.getElementById("tenfourfox.ua.template");
@@ -57,7 +86,7 @@ var gTenFourFoxPane = {
     // Synchronize the pref on entry in case it's stale.
     pref = pref.value;
     if (this.validUA[pref]) {
-        this._prefSvc.setCharPref("general.useragent.override", this.validUA[pref]);
+        Services.prefs.setCharPref("general.useragent.override", this.validUA[pref]);
         return pref;
     }
     return "";
@@ -66,10 +95,10 @@ var gTenFourFoxPane = {
   {
     var nupref = document.getElementById("uaBox").value;
     if (this.validUA[nupref]) {
-        this._prefSvc.setCharPref("general.useragent.override", this.validUA[nupref]);
+        Services.prefs.setCharPref("general.useragent.override", this.validUA[nupref]);
         return nupref;
     }
-    this._prefSvc.clearUserPref("general.useragent.override");
+    Services.prefs.clearUserPref("general.useragent.override");
     return "";
   }, 
 };

browser/components/preferences/in-content/tenfourfox.xul

@@ -24,6 +24,9 @@
 
 </preferences>
 
+<stringbundle id="tenFourFoxBundle"
+              src="chrome://browser/locale/TenFourFox.properties"/>
+
 <hbox id="header-tenfourfox"
       class="header"
       hidden="true"
@@ -63,6 +66,8 @@
                 preference="tenfourfox.ua.template">
           <menupopup>
               <menuitem label="&TFFuserAgent.default;" value=""/>
+              <menuitem label="Firefox 102ESR (Intel)" value="fx102"/>
+              <menuitem label="Firefox 91ESR (Intel)" value="fx91"/>
               <menuitem label="Firefox 78ESR (Intel)" value="fx78"/>
               <menuitem label="Firefox 68ESR (Intel)" value="fx68"/>
               <menuitem label="Firefox 60ESR (Intel)" value="fx60"/>
@@ -74,6 +79,8 @@
               <menuitem label="iOS Safari (iPad)" value="ipad"/>
           </menupopup>
       </menulist>
+      <spacer flex="1"/>
+      <button id="siteSpecificUAs" label="&TFFsiteSpecificUAs.label;"/>
   </hbox>
 </groupbox>
 
@@ -85,3 +92,10 @@
                 preference="tenfourfox.adblock.enabled"/>
   </vbox>
 </groupbox>
+
+<groupbox id="autoRVGroup" data-category="paneTenFourFox" hidden="true">
+  <caption><label>&TFFautoReaderView.title;</label></caption>
+  <hbox>
+      <button id="autoReaderView" label="&TFFautoReaderView.label;"/>
+  </hbox>
+</groupbox>

browser/components/preferences/jar.mn

@@ -24,5 +24,9 @@ browser.jar:
     content/browser/preferences/sanitize.js
     content/browser/preferences/selectBookmark.xul
     content/browser/preferences/selectBookmark.js
+    content/browser/preferences/tenfourfox-autorv.xul
+*   content/browser/preferences/tenfourfox-autorv.js
+    content/browser/preferences/tenfourfox-ssua.xul
+*   content/browser/preferences/tenfourfox-ssua.js
     content/browser/preferences/translation.xul
     content/browser/preferences/translation.js

browser/components/preferences/tenfourfox-autorv.js

@@ -0,0 +1,344 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+const AUTORV_PREF_BRANCH = "tenfourfox.reader.auto.";
+
+function AutoRV(domain, mode)
+{
+  this.domain = domain;
+  this.mode = mode;
+}
+
+var gTenFourFoxAutoRVManager = {
+  _type                 : "",
+  _AutoRVs                : [],
+  _AutoRVsToAdd           : new Map(), // also includes changes, necessarily
+  _AutoRVsToDelete        : new Map(),
+  _bundle               : null,
+  _pbundle              : null,
+  _tree                 : null,
+  _prefBranch           : null,
+
+  _allpText             : null,
+  _subpText             : null,
+  _modeToString : function(mode) {
+    if (!this._allpText)
+      this._allpText = document.getElementById("rvmodey").label;
+    if (!this._subpText)
+      this._subpText = document.getElementById("rvmodes").label;
+
+    return (mode == "s") ? this._subpText : this._allpText;
+  },
+
+  _view: {
+    _rowCount: 0,
+    get rowCount()
+    {
+      return this._rowCount;
+    },
+    getCellText: function (aRow, aColumn)
+    {
+      if (aColumn.id == "domainCol")
+        return gTenFourFoxAutoRVManager._AutoRVs[aRow].domain;
+      else if (aColumn.id == "modeCol")
+        return gTenFourFoxAutoRVManager._modeToString(gTenFourFoxAutoRVManager._AutoRVs[aRow].mode);
+      return "";
+    },
+
+    isSeparator: function(aIndex) { return false; },
+    isSorted: function() { return false; },
+    isContainer: function(aIndex) { return false; },
+    setTree: function(aTree){},
+    getImageSrc: function(aRow, aColumn) {},
+    getProgressMode: function(aRow, aColumn) {},
+    getCellValue: function(aRow, aColumn) {},
+    cycleHeader: function(column) {},
+    getRowProperties: function(row){ return ""; },
+    getColumnProperties: function(column){ return ""; },
+    getCellProperties: function(row,column){
+      if (column.element.getAttribute("id") == "domainCol")
+        return "ltr";
+
+      return "";
+    }
+  },
+
+  addAutoRV: function ()
+  {
+    var textbox = document.getElementById("domain");
+    var input_dom = textbox.value.replace(/^\s*/, ""); // trim any leading space
+    input_dom = input_dom.replace(/\s*$/,"");
+    input_dom = input_dom.replace("http://", "");
+    input_dom = input_dom.replace("https://", "");
+    input_dom = input_dom.replace(/\//g, "");
+
+    var modebox = document.getElementById("mode");
+    var mode = modebox.value;
+
+    try {
+      // Block things like hostname:port by making a URL and seeing if it rejects it.
+      let uri = Services.io.newURI("http://"+input_dom+":80/", null, null);
+      if (!uri.host) throw "as if";
+    } catch(ex) {
+      var message = this._pbundle.getString("invalidURI");
+      var title = this._pbundle.getString("invalidURITitle");
+      Services.prompt.alert(window, title, message);
+      return;
+    }
+
+    // check whether the entry already exists, and if not, add it
+    let already = false;
+    for (var i = 0; i < this._AutoRVs.length; ++i) {
+      if (this._AutoRVs[i].domain == input_dom) {
+        already = true;
+        this._AutoRVs[i].mode = mode;
+        this._AutoRVsToAdd.set(input_dom, mode); // can go through same path
+        this._resortAutoRVs();
+        break;
+      }
+    }
+
+    if (!already) {
+      this._AutoRVsToAdd.set(input_dom, mode);
+      this._addAutoRVToList(input_dom, mode);
+      ++this._view._rowCount;
+      this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, 1);
+      this._resortAutoRVs();
+    }
+
+    textbox.value = "";
+    modebox.value = "";
+    textbox.focus();
+
+    // covers a case where the site exists already, so the buttons don't disable
+    this.onHostInput(textbox);
+
+    // enable "remove all" button as needed
+    document.getElementById("removeAllAutoRVs").disabled = this._AutoRVs.length == 0;
+  },
+
+  _removeAutoRV: function(autorv)
+  {
+    for (let i = 0; i < this._AutoRVs.length; ++i) {
+      if (this._AutoRVs[i].domain == autorv.domain) {
+        this._AutoRVs.splice(i, 1);
+        this._view._rowCount--;
+        this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, -1);
+        this._tree.treeBoxObject.invalidate();
+        break;
+      }
+    }
+
+    // If this was added during this session, let's remove
+    // it from the pending adds list to prevent extra work.
+    let isnew = this._AutoRVsToAdd.delete(autorv.domain);
+    if (!isnew) {
+      this._AutoRVsToDelete.set(autorv.domain, autorv);
+    }
+  },
+
+  _resortAutoRVs: function()
+  {
+    gTreeUtils.sort(this._tree, this._view, this._AutoRVs,
+                    this._lastAutoRVsortColumn,
+                    this._AutoRVsComparator,
+                    this._lastAutoRVsortColumn,
+                    !this._lastAutoRVsortAscending); // keep sort direction
+    this._tree.treeBoxObject.invalidate();
+  },
+
+  onHostInput: function ()
+  {
+    let w = document.getElementById("domain").value;
+    let x = document.getElementById("mode").value;
+    document.getElementById("btnAdd").disabled = !w || !x || !w.length || !x.length
+      || w.length == 0 || x.length == 0;
+  },
+
+  onWindowKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_ESCAPE)
+      window.close();
+  },
+
+  onHostKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_RETURN)
+      document.getElementById("btnAdd").click();
+  },
+
+  onLoad: function ()
+  {
+    this._bundle = document.getElementById("tenFourFoxPreferences");
+    this._pbundle = document.getElementById("bundlePreferences");
+    var params = window.arguments[0];
+    this.init(params);
+  },
+
+  init: function (aParams)
+  {
+    if (this._type) {
+      // reusing an open dialog, clear the old observer
+      this.uninit();
+    }
+    this._type = aParams.type;
+    _prefBranch = Services.prefs.getBranch(AUTORV_PREF_BRANCH);
+
+    var AutoRVsText = document.getElementById("autorvText");
+    while (AutoRVsText.hasChildNodes())
+      AutoRVsText.removeChild(AutoRVsText.firstChild);
+    AutoRVsText.appendChild(document.createTextNode(aParams.introText));
+
+    document.title = aParams.windowTitle;
+
+    this.onHostInput();
+
+    let treecols = document.getElementsByTagName("treecols")[0];
+    treecols.addEventListener("click", event => {
+      if (event.target.nodeName != "treecol" || event.button != 0) {
+        return;
+      }
+
+      let sortField = event.target.getAttribute("data-field-name");
+      if (!sortField) {
+        return;
+      }
+
+      gTenFourFoxAutoRVManager.onAutoRVsort(sortField);
+    });
+
+    this._loadAutoRVs();
+    _prefBranch.addObserver("", this._loadAutoRVs, false); // XXX: make this better
+
+    document.getElementById("domain").focus();
+  },
+
+  uninit: function ()
+  {
+    _prefBranch.removeObserver("", this._loadAutoRVs); // XXX
+    this._type = "";
+  },
+
+  onAutoRVselected: function ()
+  {
+    var hasSelection = this._tree.view.selection.count > 0;
+    var hasRows = this._tree.view.rowCount > 0;
+    document.getElementById("removeAutoRV").disabled = !hasRows || !hasSelection;
+    document.getElementById("removeAllAutoRVs").disabled = !hasRows;
+  },
+
+  onAutoRVDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedAutoRVs = [];
+    gTreeUtils.deleteSelectedItems(this._tree, this._view, this._AutoRVs, removedAutoRVs);
+    for (var i = 0; i < removedAutoRVs.length; ++i) {
+      var p = removedAutoRVs[i];
+      this._removeAutoRV(p);
+    }
+    document.getElementById("removeAutoRV").disabled = !this._AutoRVs.length;
+    document.getElementById("removeAllAutoRVs").disabled = !this._AutoRVs.length;
+  },
+
+  onAllAutoRVsDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedAutoRVs = [];
+    gTreeUtils.deleteAll(this._tree, this._view, this._AutoRVs, removedAutoRVs);
+    for (var i = 0; i < removedAutoRVs.length; ++i) {
+      var p = removedAutoRVs[i];
+      this._removeAutoRV(p);
+    }
+    document.getElementById("removeAutoRV").disabled = true;
+    document.getElementById("removeAllAutoRVs").disabled = true;
+  },
+
+  onAutoRVKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_DELETE
+#ifdef XP_MACOSX
+        || aEvent.keyCode == KeyEvent.DOM_VK_BACK_SPACE
+#endif
+       )
+      this.onAutoRVDeleted();
+  },
+
+  _lastAutoRVsortColumn: "",
+  _lastAutoRVsortAscending: false,
+  _AutoRVsComparator : function (a, b)
+  {
+    return a.toLowerCase().localeCompare(b.toLowerCase());
+  },
+
+
+  onAutoRVsort: function (aColumn)
+  {
+    this._lastAutoRVsortAscending = gTreeUtils.sort(this._tree,
+                                                        this._view,
+                                                        this._AutoRVs,
+                                                        aColumn,
+                                                        this._AutoRVsComparator,
+                                                        this._lastAutoRVsortColumn,
+                                                        this._lastAutoRVsortAscending);
+    this._lastAutoRVsortColumn = aColumn;
+  },
+
+  onApplyChanges: function()
+  {
+    // Stop observing changes since we are about
+    // to write out the pending adds/deletes and don't need
+    // to update the UI.
+    this.uninit();
+
+    // Create and clear prefs out of whole cloth; don't use the
+    // pref branch because it may not exist yet.
+    for (let i of this._AutoRVsToAdd.keys()) {
+      Services.prefs.setCharPref(AUTORV_PREF_BRANCH+i, this._AutoRVsToAdd.get(i));
+    }
+
+    for (let i of this._AutoRVsToDelete.keys()) {
+      Services.prefs.clearUserPref(AUTORV_PREF_BRANCH+i);
+    }
+
+    window.close();
+  },
+
+  _loadAutoRVs: function ()
+  {
+    this._tree = document.getElementById("AutoRVsTree");
+    this._AutoRVs = [];
+
+    // load AutoRVs into a table
+    let count = 0;
+    let domains = _prefBranch.getChildList("");
+    for (let domain of domains) {
+      this._addAutoRVToList(domain, _prefBranch.getCharPref(domain));
+    }
+
+    this._view._rowCount = this._AutoRVs.length;
+
+    // sort and display the table
+    this._tree.view = this._view;
+    this.onAutoRVsort("domain");
+
+    // disable "remove all" button if there are none
+    document.getElementById("removeAllAutoRVs").disabled = this._AutoRVs.length == 0;
+  },
+
+  _addAutoRVToList: function (domain, mode)
+  {
+    var p = new AutoRV(domain, mode);
+    this._AutoRVs.push(p);
+  },
+
+};
+
+function initWithParams(aParams)
+{
+  gTenFourFoxAutoRVManager.init(aParams);
+}

browser/components/preferences/tenfourfox-autorv.xul

@@ -0,0 +1,111 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 
+<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
+
+<!DOCTYPE dialog [
+<!ENTITY % permissionsDTD SYSTEM "chrome://browser/locale/preferences/permissions.dtd" >
+<!ENTITY % tenFourFoxDTD SYSTEM "chrome://browser/locale/TenFourFox.dtd" >
+%permissionsDTD;
+%tenFourFoxDTD;
+]>
+
+<window id="TenFourFoxAutoRVDialog" class="windowDialog"
+        windowtype="Browser:TenFourFoxAutoRV"
+        title="&TFFautoReaderView.title;"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        style="width: &window.width;;"
+        onload="gTenFourFoxAutoRVManager.onLoad();"
+        onunload="gTenFourFoxAutoRVManager.uninit();"
+        persist="screenX screenY width height"
+        onkeypress="gTenFourFoxAutoRVManager.onWindowKeyPress(event);">
+
+  <script src="chrome://global/content/treeUtils.js"/>
+  <script src="chrome://browser/content/preferences/tenfourfox-autorv.js"/>
+  <script src="chrome://browser/content/preferences/in-content/tenfourfox.js"/>
+
+  <stringbundle id="bundlePreferences"
+                src="chrome://browser/locale/preferences/preferences.properties"/>
+  <stringbundle id="tenFourFoxPreferences"
+                src="chrome://browser/locale/TenFourFox.properties"/>
+  <keyset>
+    <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
+  </keyset>
+
+  <vbox class="contentPane largeDialogContainer" flex="1">
+    <description id="autorvText" control="domain"/>
+    <separator class="thin"/>
+    <grid>
+      <columns>
+        <column/>
+        <column flex="1"/>
+      </columns>
+      <rows>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="domainLabel" control="domain"
+                   value="&TFFsiteSpecificUAs.domain.l;" accesskey="&address.accesskey;"/>
+          </hbox>
+          <textbox id="domain" flex="1"
+                   oninput="gTenFourFoxAutoRVManager.onHostInput();"
+                   onkeypress="gTenFourFoxAutoRVManager.onHostKeyPress(event);"/>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label>&TFFautoReaderView.mode.l;</label>
+          </hbox>
+          <menulist id="mode" crop="end" flex="1"
+                   oncommand="gTenFourFoxAutoRVManager.onHostInput();">
+            <menupopup>
+              <menuitem label="" value=""/>
+              <menuitem label="&TFFautoReaderView.mode.all;" value="y" id="rvmodey"/>
+              <menuitem label="&TFFautoReaderView.mode.sub;" value="s" id="rvmodes"/>
+            </menupopup>
+          </menulist>
+        </row>
+      </rows>
+    </grid>
+    <hbox pack="end">
+      <button id="btnAdd" disabled="true" label="&TFFsiteSpecificUAs.add;" default="true" accesskey="&allow.accesskey;"
+              oncommand="gTenFourFoxAutoRVManager.addAutoRV();"/>
+    </hbox>
+
+    <separator class="thin"/>
+    <tree id="AutoRVsTree" flex="1" style="height: 18em;"
+          hidecolumnpicker="true"
+          onkeypress="gTenFourFoxAutoRVManager.onAutoRVKeyPress(event)"
+          onselect="gTenFourFoxAutoRVManager.onAutoRVselected();">
+      <treecols>
+        <treecol id="domainCol" label="&TFFsiteSpecificUAs.domain;" flex="2"
+                 data-field-name="domain" persist="width"/>
+        <splitter class="tree-splitter"/>
+        <treecol id="modeCol" label="&TFFautoReaderView.mode;" flex="1"
+                 data-field-name="mode" persist="width"/>
+      </treecols>
+      <treechildren/>
+    </tree>
+
+    <hbox class="actionButtons" align="left" flex="1">
+      <button id="removeAutoRV" disabled="true"
+              accesskey="&removepermission.accesskey;"
+              icon="remove" label="&removepermission.label;"
+              oncommand="gTenFourFoxAutoRVManager.onAutoRVDeleted();"/>
+       <button id="removeAllAutoRVs" disabled="true"
+              icon="clear" label="&removeallpermissions.label;"
+              accesskey="&removeallpermissions.accesskey;"
+              oncommand="gTenFourFoxAutoRVManager.onAllAutoRVsDeleted();"/>
+   </hbox>
+    <spacer flex="1"/>
+    <hbox class="actionButtons" align="right" flex="1">
+      <button oncommand="close();" icon="close"
+              label="&button.cancel.label;" accesskey="&button.cancel.accesskey;" />
+      <button id="btnApplyChanges" oncommand="gTenFourFoxAutoRVManager.onApplyChanges();" icon="save"
+              label="&button.ok.label;" accesskey="&button.ok.accesskey;"/>
+    </hbox>
+  </vbox>
+</window>

browser/components/preferences/tenfourfox-ssua.js

@@ -0,0 +1,343 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+const UA_PREF_BRANCH = "general.useragent.override.";
+
+function SSUA(domain, ua)
+{
+  this.domain = domain;
+  this.ua = ua;
+}
+
+var gTenFourFoxSSUAManager = {
+  _type                 : "",
+  _SSUAs                : [],
+  _SSUAsToAdd           : new Map(), // also includes changes, necessarily
+  _SSUAsToDelete        : new Map(),
+  _bundle               : null,
+  _pbundle              : null,
+  _tree                 : null,
+  _prefBranch           : null,
+
+  _view: {
+    _rowCount: 0,
+    get rowCount()
+    {
+      return this._rowCount;
+    },
+    getCellText: function (aRow, aColumn)
+    {
+      if (aColumn.id == "domainCol")
+        return gTenFourFoxSSUAManager._SSUAs[aRow].domain;
+      else if (aColumn.id == "uaCol")
+        return gTenFourFoxSSUAManager._SSUAs[aRow].ua;
+      return "";
+    },
+
+    isSeparator: function(aIndex) { return false; },
+    isSorted: function() { return false; },
+    isContainer: function(aIndex) { return false; },
+    setTree: function(aTree){},
+    getImageSrc: function(aRow, aColumn) {},
+    getProgressMode: function(aRow, aColumn) {},
+    getCellValue: function(aRow, aColumn) {},
+    cycleHeader: function(column) {},
+    getRowProperties: function(row){ return ""; },
+    getColumnProperties: function(column){ return ""; },
+    getCellProperties: function(row,column){
+      if (column.element.getAttribute("id") == "domainCol")
+        return "ltr";
+
+      return "";
+    }
+  },
+
+  addSSUA: function ()
+  {
+    var textbox = document.getElementById("domain");
+    var uabox = document.getElementById("ua");
+    var input_dom = textbox.value.replace(/^\s*/, ""); // trim any leading space
+    input_dom = input_dom.replace(/\s*$/,"");
+    input_dom = input_dom.replace("http://", "");
+    input_dom = input_dom.replace("https://", "");
+    input_dom = input_dom.replace(/\//g, "");
+
+    var ua = uabox.value.replace(/^\s*/, "");
+    ua = ua.replace(/\s*$/, "");
+
+    try {
+      // Block things like hostname:port by making a URL and seeing if it rejects it.
+      let uri = Services.io.newURI("http://"+input_dom+":80/", null, null);
+      if (!uri.host) throw "as if";
+    } catch(ex) {
+      var message = this._pbundle.getString("invalidURI");
+      var title = this._pbundle.getString("invalidURITitle");
+      Services.prompt.alert(window, title, message);
+      return;
+    }
+
+    // check whether the entry already exists, and if not, add it
+    let already = false;
+    for (var i = 0; i < this._SSUAs.length; ++i) {
+      if (this._SSUAs[i].domain == input_dom) {
+        already = true;
+        this._SSUAs[i].ua = ua;
+        this._SSUAsToAdd.set(input_dom, ua); // can go through same path
+        this._resortSSUAs();
+        break;
+      }
+    }
+
+    if (!already) {
+      this._SSUAsToAdd.set(input_dom, ua);
+      this._addSSUAToList(input_dom, ua);
+      ++this._view._rowCount;
+      this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, 1);
+      this._resortSSUAs();
+    }
+
+    textbox.value = "";
+    uabox.value = "";
+    textbox.focus();
+
+    // covers a case where the site exists already, so the buttons don't disable
+    this.onHostInput(textbox);
+
+    // enable "remove all" button as needed
+    document.getElementById("removeAllSSUAs").disabled = this._SSUAs.length == 0;
+  },
+
+  _removeSSUA: function(ssua)
+  {
+    for (let i = 0; i < this._SSUAs.length; ++i) {
+      if (this._SSUAs[i].domain == ssua.domain) {
+        this._SSUAs.splice(i, 1);
+        this._view._rowCount--;
+        this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, -1);
+        this._tree.treeBoxObject.invalidate();
+        break;
+      }
+    }
+
+    // If this was added during this session, let's remove
+    // it from the pending adds list to prevent extra work.
+    let isnew = this._SSUAsToAdd.delete(ssua.domain);
+    if (!isnew) {
+      this._SSUAsToDelete.set(ssua.domain, ssua);
+    }
+  },
+
+  _resortSSUAs: function()
+  {
+    gTreeUtils.sort(this._tree, this._view, this._SSUAs,
+                    this._lastSSUAsortColumn,
+                    this._SSUAsComparator,
+                    this._lastSSUAsortColumn,
+                    !this._lastSSUAsortAscending); // keep sort direction
+    this._tree.treeBoxObject.invalidate();
+  },
+
+  onHostInput: function ()
+  {
+    let w = document.getElementById("domain").value;
+    let x = document.getElementById("ua").value;
+    document.getElementById("btnAdd").disabled = !w || !x || !w.length || !x.length
+      || w.length == 0 || x.length == 0;
+  },
+
+  onWindowKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_ESCAPE)
+      window.close();
+  },
+
+  onHostKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_RETURN)
+      document.getElementById("btnAdd").click();
+  },
+
+  onLoad: function ()
+  {
+    this._bundle = document.getElementById("tenFourFoxPreferences");
+    this._pbundle = document.getElementById("bundlePreferences");
+    var params = window.arguments[0];
+    this.init(params);
+  },
+
+  init: function (aParams)
+  {
+    if (this._type) {
+      // reusing an open dialog, clear the old observer
+      this.uninit();
+    }
+    this._type = aParams.type;
+    _prefBranch = Services.prefs.getBranch(UA_PREF_BRANCH);
+
+    var SSUAsText = document.getElementById("ssuaText");
+    while (SSUAsText.hasChildNodes())
+      SSUAsText.removeChild(SSUAsText.firstChild);
+    SSUAsText.appendChild(document.createTextNode(aParams.introText));
+
+    document.title = aParams.windowTitle;
+
+    this.onHostInput();
+
+    let treecols = document.getElementsByTagName("treecols")[0];
+    treecols.addEventListener("click", event => {
+      if (event.target.nodeName != "treecol" || event.button != 0) {
+        return;
+      }
+
+      let sortField = event.target.getAttribute("data-field-name");
+      if (!sortField) {
+        return;
+      }
+
+      gTenFourFoxSSUAManager.onSSUAsort(sortField);
+    });
+
+    this._loadSSUAs();
+    _prefBranch.addObserver("", this._loadSSUAs, false); // XXX: make this better
+
+    document.getElementById("domain").focus();
+  },
+
+  uninit: function ()
+  {
+    _prefBranch.removeObserver("", this._loadSSUAs); // XXX
+    this._type = "";
+  },
+
+  onSSUAselected: function ()
+  {
+    var hasSelection = this._tree.view.selection.count > 0;
+    var hasRows = this._tree.view.rowCount > 0;
+    document.getElementById("removeSSUA").disabled = !hasRows || !hasSelection;
+    document.getElementById("removeAllSSUAs").disabled = !hasRows;
+  },
+
+  onSSUADeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedSSUAs = [];
+    gTreeUtils.deleteSelectedItems(this._tree, this._view, this._SSUAs, removedSSUAs);
+    for (var i = 0; i < removedSSUAs.length; ++i) {
+      var p = removedSSUAs[i];
+      this._removeSSUA(p);
+    }
+    document.getElementById("removeSSUA").disabled = !this._SSUAs.length;
+    document.getElementById("removeAllSSUAs").disabled = !this._SSUAs.length;
+  },
+
+  onAllSSUAsDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedSSUAs = [];
+    gTreeUtils.deleteAll(this._tree, this._view, this._SSUAs, removedSSUAs);
+    for (var i = 0; i < removedSSUAs.length; ++i) {
+      var p = removedSSUAs[i];
+      this._removeSSUA(p);
+    }
+    document.getElementById("removeSSUA").disabled = true;
+    document.getElementById("removeAllSSUAs").disabled = true;
+  },
+
+  onSSUAKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_DELETE
+#ifdef XP_MACOSX
+        || aEvent.keyCode == KeyEvent.DOM_VK_BACK_SPACE
+#endif
+       )
+      this.onSSUADeleted();
+  },
+
+  _lastSSUAsortColumn: "",
+  _lastSSUAsortAscending: false,
+  _SSUAsComparator : function (a, b)
+  {
+    return a.toLowerCase().localeCompare(b.toLowerCase());
+  },
+
+
+  onSSUAsort: function (aColumn)
+  {
+    this._lastSSUAsortAscending = gTreeUtils.sort(this._tree,
+                                                        this._view,
+                                                        this._SSUAs,
+                                                        aColumn,
+                                                        this._SSUAsComparator,
+                                                        this._lastSSUAsortColumn,
+                                                        this._lastSSUAsortAscending);
+    this._lastSSUAsortColumn = aColumn;
+  },
+
+  onApplyChanges: function()
+  {
+    // Stop observing changes since we are about
+    // to write out the pending adds/deletes and don't need
+    // to update the UI.
+    this.uninit();
+
+    // Create and clear prefs out of whole cloth; don't use the
+    // pref branch because it may not exist yet.
+    for (let i of this._SSUAsToAdd.keys()) {
+      Services.prefs.setCharPref(UA_PREF_BRANCH+i, this._SSUAsToAdd.get(i));
+    }
+
+    for (let i of this._SSUAsToDelete.keys()) {
+      Services.prefs.clearUserPref(UA_PREF_BRANCH+i);
+    }
+
+    window.close();
+  },
+
+  fillUA: function(popup)
+  {
+    if (popup.value == "")
+      document.getElementById("ua").value = "";
+    else
+      document.getElementById("ua").value = gTenFourFoxPane.validUA[popup.value];
+    this.onHostInput();
+  },
+
+  _loadSSUAs: function ()
+  {
+    this._tree = document.getElementById("SSUAsTree");
+    this._SSUAs = [];
+
+    // load SSUAs into a table
+    let count = 0;
+    let domains = _prefBranch.getChildList("");
+    for (let domain of domains) {
+      this._addSSUAToList(domain, _prefBranch.getCharPref(domain));
+    }
+
+    this._view._rowCount = this._SSUAs.length;
+
+    // sort and display the table
+    this._tree.view = this._view;
+    this.onSSUAsort("domain");
+
+    // disable "remove all" button if there are none
+    document.getElementById("removeAllSSUAs").disabled = this._SSUAs.length == 0;
+  },
+
+  _addSSUAToList: function (domain, ua)
+  {
+    var p = new SSUA(domain, ua);
+    this._SSUAs.push(p);
+  },
+
+};
+
+function initWithParams(aParams)
+{
+  gTenFourFoxSSUAManager.init(aParams);
+}

browser/components/preferences/tenfourfox-ssua.xul

@@ -0,0 +1,128 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 
+<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
+
+<!DOCTYPE dialog [
+<!ENTITY % permissionsDTD SYSTEM "chrome://browser/locale/preferences/permissions.dtd" >
+<!ENTITY % tenFourFoxDTD SYSTEM "chrome://browser/locale/TenFourFox.dtd" >
+%permissionsDTD;
+%tenFourFoxDTD;
+]>
+
+<window id="TenFourFoxSSUADialog" class="windowDialog"
+        windowtype="Browser:TenFourFoxSSUA"
+        title="&TFFsiteSpecificUAs.title;"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        style="width: &window.width;;"
+        onload="gTenFourFoxSSUAManager.onLoad();"
+        onunload="gTenFourFoxSSUAManager.uninit();"
+        persist="screenX screenY width height"
+        onkeypress="gTenFourFoxSSUAManager.onWindowKeyPress(event);">
+
+  <script src="chrome://global/content/treeUtils.js"/>
+  <script src="chrome://browser/content/preferences/tenfourfox-ssua.js"/>
+  <script src="chrome://browser/content/preferences/in-content/tenfourfox.js"/>
+
+  <stringbundle id="bundlePreferences"
+                src="chrome://browser/locale/preferences/preferences.properties"/>
+  <stringbundle id="tenFourFoxPreferences"
+                src="chrome://browser/locale/TenFourFox.properties"/>
+  <keyset>
+    <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
+  </keyset>
+
+  <vbox class="contentPane largeDialogContainer" flex="1">
+    <description id="ssuaText" control="domain"/>
+    <separator class="thin"/>
+    <grid>
+      <columns>
+        <column/>
+        <column flex="1"/>
+      </columns>
+      <rows>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="domainLabel" control="domain"
+                   value="&TFFsiteSpecificUAs.domain.l;" accesskey="&address.accesskey;"/>
+          </hbox>
+          <textbox id="domain" flex="1"
+                   oninput="gTenFourFoxSSUAManager.onHostInput();"
+                   onkeypress="gTenFourFoxSSUAManager.onHostKeyPress(event);"/>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label>&TFFsiteSpecificUAs.preua;</label>
+          </hbox>
+          <menulist id="uaBox" crop="end" flex="1"
+                    oncommand="gTenFourFoxSSUAManager.fillUA(event.target);">
+            <menupopup>
+              <menuitem label="" value=""/>
+              <menuitem label="Firefox 102ESR (Intel)" value="fx102"/>
+              <menuitem label="Firefox 91ESR (Intel)" value="fx91"/>
+              <menuitem label="Firefox 78ESR (Intel)" value="fx78"/>
+              <menuitem label="Firefox 68ESR (Intel)" value="fx68"/>
+              <menuitem label="Firefox 60ESR (Intel)" value="fx60"/>
+              <menuitem label="Firefox 52ESR (Intel)" value="fx"/>
+              <menuitem label="Classilla 9.3.x" value="classilla"/>
+              <menuitem label="Internet Explorer 8" value="ie8"/>
+              <menuitem label="Internet Explorer 11" value="ie11"/>
+              <menuitem label="Android Chrome" value="android"/>
+              <menuitem label="iOS Safari (iPad)" value="ipad"/>
+            </menupopup>
+          </menulist>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="uaLabel" control="ua" value="&TFFsiteSpecificUAs.ua.l;"/>
+          </hbox>
+          <textbox id="ua" flex="1"
+                   oninput="gTenFourFoxSSUAManager.onHostInput();"
+                   onkeypress="gTenFourFoxSSUAManager.onHostKeyPress(event);"/>
+        </row>
+      </rows>
+    </grid>
+    <hbox pack="end">
+      <button id="btnAdd" disabled="true" label="&TFFsiteSpecificUAs.add;" default="true" accesskey="&allow.accesskey;"
+              oncommand="gTenFourFoxSSUAManager.addSSUA();"/>
+    </hbox>
+
+    <separator class="thin"/>
+    <tree id="SSUAsTree" flex="1" style="height: 18em;"
+          hidecolumnpicker="true"
+          onkeypress="gTenFourFoxSSUAManager.onSSUAKeyPress(event)"
+          onselect="gTenFourFoxSSUAManager.onSSUAselected();">
+      <treecols>
+        <treecol id="domainCol" label="&TFFsiteSpecificUAs.domain;" flex="1"
+                 data-field-name="domain" persist="width"/>
+        <splitter class="tree-splitter"/>
+        <treecol id="uaCol" label="&TFFsiteSpecificUAs.ua;" flex="3"
+                 data-field-name="ua" persist="width"/>
+      </treecols>
+      <treechildren/>
+    </tree>
+
+    <hbox class="actionButtons" align="left" flex="1">
+      <button id="removeSSUA" disabled="true"
+              accesskey="&removepermission.accesskey;"
+              icon="remove" label="&removepermission.label;"
+              oncommand="gTenFourFoxSSUAManager.onSSUADeleted();"/>
+       <button id="removeAllSSUAs" disabled="true"
+              icon="clear" label="&removeallpermissions.label;"
+              accesskey="&removeallpermissions.accesskey;"
+              oncommand="gTenFourFoxSSUAManager.onAllSSUAsDeleted();"/>
+   </hbox>
+    <spacer flex="1"/>
+    <hbox class="actionButtons" align="right" flex="1">
+      <button oncommand="close();" icon="close"
+              label="&button.cancel.label;" accesskey="&button.cancel.accesskey;" />
+      <button id="btnApplyChanges" oncommand="gTenFourFoxSSUAManager.onApplyChanges();" icon="save"
+              label="&button.ok.label;" accesskey="&button.ok.accesskey;"/>
+    </hbox>
+  </vbox>
+</window>

browser/config/version.txt

@@ -1 +1 @@
-45.37.0
+45.41.6

browser/config/version_display.txt

@@ -1 +1 @@
-Feature Parity Release 28
+Rolling Release

browser/extensions/pdfjs/content/PdfStreamConverter.jsm

@@ -362,7 +362,7 @@ ChromeActions.prototype = {
   supportsDocumentFonts: function() {
     var prefBrowser = getIntPref('browser.display.use_document_fonts', 1);
     var prefGfx = getBoolPref('gfx.downloadable_fonts.enabled', true);
-    return (!!prefBrowser && prefGfx);
+    return (!!prefBrowser && prefGfx && getBoolPref('pdfjs.display.use_document_fonts', true));
   },
   supportsDocumentColors: function() {
     if (getIntPref('browser.display.document_color_use', 0) === 2 ||

browser/extensions/pdfjs/content/network.js

@@ -104,6 +104,7 @@ var NetworkManager = (function NetworkManagerClosure() {
         var rangeStr = args.begin + '-' + (args.end - 1);
         xhr.setRequestHeader('Range', 'bytes=' + rangeStr);
         pendingRequest.expectedStatus = 206;
+        xhr.channel.QueryInterface(Ci.nsIHttpChannel).redirectionLimit = 0;
       } else {
         pendingRequest.expectedStatus = 200;
       }

browser/locales/en-US/chrome/browser/TenFourFox.dtd

@@ -11,3 +11,20 @@
 
 <!ENTITY TFFmseMode.title	"MediaSource">
 <!ENTITY TFFmseMode.prompt	"Enable MSE/media quality options (slower, if available)">
+
+<!ENTITY TFFsiteSpecificUAs.label	"Site Specific…">
+<!ENTITY TFFsiteSpecificUAs.title	"Site Specific User Agents">
+<!ENTITY TFFsiteSpecificUAs.add		"Add">
+<!ENTITY TFFsiteSpecificUAs.domain	"Domain">
+<!ENTITY TFFsiteSpecificUAs.domain.l	"Domain:">
+<!ENTITY TFFsiteSpecificUAs.ua		"User agent">
+<!ENTITY TFFsiteSpecificUAs.ua.l	"User agent string:">
+<!ENTITY TFFsiteSpecificUAs.preua	"Common user agents:">
+
+<!ENTITY TFFautoReaderView.label	"Auto Reader View…">
+<!ENTITY TFFautoReaderView.title	"Site Specific Auto Reader View">
+<!-- also uses domain and add from above -->
+<!ENTITY TFFautoReaderView.mode		"Mode">
+<!ENTITY TFFautoReaderView.mode.l	"Mode:">
+<!ENTITY TFFautoReaderView.mode.all	"All pages">
+<!ENTITY TFFautoReaderView.mode.sub	"Only subpages">

browser/locales/en-US/chrome/browser/TenFourFox.properties

@@ -12,3 +12,8 @@ TFFpdfViewMode.prompt.p	= Use built-in PDF viewer (slower but safer)
 TFFmseMode.title.p	= MediaSource
 TFFmseMode.prompt.p	= Enable MSE/media quality options (slower, if available)
 
+TFFsiteSpecificUAs.title	= Site Specific User Agents
+TFFsiteSpecificUAs.prompt	= This is for advanced users to use a custom user agent for particular domains automatically. Enter a domain and a user agent string, or select a predefined one.
+
+TFFautoReaderView.title		= Site Specific Auto Reader View
+TFFautoReaderView.prompt	= Enter domain names that will automatically switch to the simpler Reader View for all pages, or for subpages only.

browser/locales/en-US/chrome/browser/aboutDialog.dtd

@@ -49,7 +49,7 @@
 <!ENTITY helpus.getInvolvedLink     "get involved!">
 <!ENTITY helpus.end                 "">
 
-<!ENTITY copyright.blurb            "Copyright © 2010-2020 Contributors to TenFourFox. All rights reserved.">
+<!ENTITY copyright.blurb            "Copyright © 2010-2023 Contributors to TenFourFox. All rights reserved.">
 
 <!-- LOCALIZATION NOTE (bottomLinks.license): This is a link title that links to about:license. -->
 <!ENTITY bottomLinks.license        "Licensing Information">

browser/locales/en-US/chrome/browser/browser.dtd

@@ -105,6 +105,8 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 <!ENTITY fullScreenCmd.macCommandKey "f">
 <!ENTITY showAllTabsCmd.label "Show All Tabs">
 <!ENTITY showAllTabsCmd.accesskey "A">
+<!ENTITY toggleReaderMode.label "Toggle Reader Mode">
+<!ENTITY toggleReaderMode.key "R">
 
 <!ENTITY fxaSignIn.label "Sign in to &syncBrand.shortName.label;">
 <!ENTITY fxaSignedIn.tooltip "Open &syncBrand.shortName.label; preferences">
@@ -633,17 +635,19 @@ items are mutually exclusive. -->
 <!ENTITY mediaUnmute.accesskey       "m">
 <!ENTITY mediaPlaybackRate.label     "Play Speed">
 <!ENTITY mediaPlaybackRate.accesskey "l">
-<!ENTITY mediaPlaybackRate050x.label "Slow Motion (0.5×)">
-<!ENTITY mediaPlaybackRate050x.accesskey "S">
-<!ENTITY mediaPlaybackRate100x.label "Normal Speed">
-<!ENTITY mediaPlaybackRate100x.accesskey "N">
-<!ENTITY mediaPlaybackRate150x.label "High Speed (1.5×)">
-<!ENTITY mediaPlaybackRate150x.accesskey "H">
-<!-- LOCALIZATION NOTE: "Ludicrous Speed" is a reference to the
+<!ENTITY mediaPlaybackRate050x2.label "Slow (0.5×)">
+<!ENTITY mediaPlaybackRate050x2.accesskey "S">
+<!ENTITY mediaPlaybackRate100x2.label "Normal">
+<!ENTITY mediaPlaybackRate100x2.accesskey "N">
+<!ENTITY mediaPlaybackRate125x2.label "Fast (1.25×)">
+<!ENTITY mediaPlaybackRate125x2.accesskey "F">
+<!ENTITY mediaPlaybackRate150x2.label "Faster (1.5×)">
+<!ENTITY mediaPlaybackRate150x2.accesskey "a">
+<!-- LOCALIZATION NOTE: "Ludicrous" is a reference to the
 movie "Space Balls" and is meant to say that this speed is very
 fast. -->
-<!ENTITY mediaPlaybackRate200x.label "Ludicrous Speed (2×)">
-<!ENTITY mediaPlaybackRate200x.accesskey "L">
+<!ENTITY mediaPlaybackRate200x2.label "Ludicrous (2×)">
+<!ENTITY mediaPlaybackRate200x2.accesskey "L">
 <!-- LOCALIZATION NOTE: The access keys for "Show Controls" and
 "Hide Controls" are the same because the two context-menu
 items are mutually exclusive. -->

browser/locales/en-US/chrome/browser/browser.properties

@@ -291,6 +291,10 @@ tabHistory.goForward=Go forward to this page
 # URL Bar
 pasteAndGo.label=Paste & Go
 
+# LOCALIZATION NOTE (reader-mode-button.tooltip):
+# %S is the keyboard shortcut for entering/exiting reader view
+reader-mode-button.tooltip=Toggle Reader View (%S)
+
 # Block autorefresh
 refreshBlocked.goButton=Allow
 refreshBlocked.goButton.accesskey=A

browser/modules/BrowserUITelemetry.jsm

@@ -661,7 +661,7 @@ this.BrowserUITelemetry = {
     "marklinkMenu", "copyemail", "copylink", "media-play", "media-pause",
     "media-mute", "media-unmute", "media-playbackrate",
     "media-playbackrate-050x", "media-playbackrate-100x",
-    "media-playbackrate-150x", "media-playbackrate-200x",
+    "media-playbackrate-125x", "media-playbackrate-150x", "media-playbackrate-200x",
     "media-showcontrols", "media-hidecontrols", "video-showstats",
     "video-hidestats", "video-fullscreen", "leave-dom-fullscreen",
     "reloadimage", "viewimage", "viewvideo", "copyimage-contents", "copyimage",

browser/modules/ReaderParent.jsm

@@ -139,22 +139,23 @@ var ReaderParent = {
 
     let button = win.document.getElementById("reader-mode-button");
     let command = win.document.getElementById("View:ReaderView");
+    let key = win.document.getElementById("key_toggleReaderMode");
     if (browser.currentURI.spec.startsWith("about:reader")) {
       button.setAttribute("readeractive", true);
       button.hidden = false;
       let closeText = gStringBundle.GetStringFromName("readerView.close");
-      button.setAttribute("tooltiptext", closeText);
       command.setAttribute("label", closeText);
       command.setAttribute("hidden", false);
       command.setAttribute("accesskey", gStringBundle.GetStringFromName("readerView.close.accesskey"));
+      key.setAttribute("disabled", false);
     } else {
       button.removeAttribute("readeractive");
       button.hidden = !browser.isArticle;
       let enterText = gStringBundle.GetStringFromName("readerView.enter");
-      button.setAttribute("tooltiptext", enterText);
       command.setAttribute("label", enterText);
       command.setAttribute("hidden", !browser.isArticle);
       command.setAttribute("accesskey", gStringBundle.GetStringFromName("readerView.enter.accesskey"));
+      key.setAttribute("disabled", !browser.isArticle);
     }
 
     let currentUriHost = browser.currentURI && browser.currentURI.asciiHost;

caps/nsScriptSecurityManager.cpp

@@ -699,15 +699,26 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
             ToLowerCase(hostname);
 #define BLOC(q) hostname.EqualsLiteral(q)
 #define BLOCU(q) url.EqualsLiteral(q)
+#define BLOCS(q) (StringBeginsWith(url, NS_LITERAL_CSTRING(q)))
+#define BLOCE(q) (StringEndsWith(url, NS_LITERAL_CSTRING(q)))
+
             if (0 ||
 
 #ifdef __ppc__
-                    BLOC("static-exp1.licdn.com") || // wallpaper issue 621
+                    // wallpapers for issue 621
+                    BLOC("static-exp1.licdn.com") ||
+                    (
+                      BLOC("communities.apple.com") &&
+                      BLOCE("/public/scripts/tldr/index.js")
+                    ) ||
 #endif // __ppc__
+                    BLOCS("https://developer.mozilla.org/static/js/main.") ||
 
                     0) {
 #undef BLOC
 #undef BLOCU
+#undef BLOCS
+#undef BLOCE
 
 #ifndef DEBUG
                 if (mIsTenFourFoxTroublesomeJsLoggingEnabled)
@@ -727,6 +738,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
         if (MOZ_LIKELY(NS_SUCCEEDED(targetBaseURI->GetHost(hostname)))) {
             ToLowerCase(hostname);
 #define BLOK(q) hostname.EqualsLiteral(q)
+#define BLOKD(q) (StringEndsWith(hostname, NS_LITERAL_CSTRING(q)))
             if (0 ||
                 // This is used as a data source by a lot of UIs,
                 // so we shouldn't block it (e.g., nytimes).
@@ -877,6 +889,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
                 BLOK("static.yieldmo.com") ||
                 
                 BLOK("ads.rubiconproject.com") ||
+                BLOK("eus.rubiconproject.com") ||
                 BLOK("fastlane.rubiconproject.com") ||
                 BLOK("optimized-by.rubiconproject.com") ||
                 
@@ -1250,9 +1263,18 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
                 BLOK("s3.buysellads.com") ||
                 BLOK("srv.buysellads.com") ||
 
+                BLOK("ads.intentiq.com") ||
+
+                BLOK("tag.durationmedia.net") ||
+
+                BLOK("www.datadoghq-browser-agent.com") ||
+
+                BLOK("ext.chtbl.com") ||
+
 #include "shavar-blocklist.h"
 
                     0) {
+#undef BLOKD
 #undef BLOK
                 // Yup.
 #ifndef DEBUG

caps/shavar-blocklist.h

@@ -1,105 +1,568 @@
 // a.js
 //    http://zymerget.bid
         BLOK("alflying.date") ||
+        BLOKD(".alflying.date") ||
         BLOK("alflying.win") ||
+        BLOKD(".alflying.win") ||
         BLOK("anybest.site") ||
+        BLOKD(".anybest.site") ||
         BLOK("flightsy.bid") ||
+        BLOKD(".flightsy.bid") ||
         BLOK("flightsy.win") ||
+        BLOKD(".flightsy.win") ||
         BLOK("flightzy.bid") ||
+        BLOKD(".flightzy.bid") ||
         BLOK("flightzy.date") ||
+        BLOKD(".flightzy.date") ||
         BLOK("flightzy.win") ||
+        BLOKD(".flightzy.win") ||
         BLOK("zymerget.bid") ||
+        BLOKD(".zymerget.bid") ||
         BLOK("zymerget.faith") ||
+        BLOKD(".zymerget.faith") ||
 // CashBeet
 //    http://cashbeet.com
         BLOK("cashbeet.com") ||
+        BLOKD(".cashbeet.com") ||
         BLOK("serv1swork.com") ||
+        BLOKD(".serv1swork.com") ||
 // CoinHive
 //    https://coinhive.com
         BLOK("ad-miner.com") ||
+        BLOKD(".ad-miner.com") ||
         BLOK("authedmine.com") ||
+        BLOKD(".authedmine.com") ||
         BLOK("bmst.pw") ||
+        BLOKD(".bmst.pw") ||
         BLOK("cnhv.co") ||
+        BLOKD(".cnhv.co") ||
         BLOK("coin-hive.com") ||
+        BLOKD(".coin-hive.com") ||
         BLOK("coinhive.com") ||
+        BLOKD(".coinhive.com") ||
         BLOK("wsservices.org") ||
+        BLOKD(".wsservices.org") ||
 // CoinPot
 //    http://coinpot.co
         BLOK("coinpot.co") ||
+        BLOKD(".coinpot.co") ||
 // CryptoLoot
 //    https://crypto-loot.com
         BLOK("cryptaloot.pro") ||
+        BLOKD(".cryptaloot.pro") ||
         BLOK("crypto-loot.com") ||
+        BLOKD(".crypto-loot.com") ||
         BLOK("cryptolootminer.com") ||
+        BLOKD(".cryptolootminer.com") ||
         BLOK("flashx.pw") ||
+        BLOKD(".flashx.pw") ||
         BLOK("gitgrub.pro") ||
+        BLOKD(".gitgrub.pro") ||
         BLOK("reauthenticator.com") ||
+        BLOKD(".reauthenticator.com") ||
         BLOK("statdynamic.com") ||
+        BLOKD(".statdynamic.com") ||
         BLOK("webmine.pro") ||
+        BLOKD(".webmine.pro") ||
 // CryptoWebMiner
 //    https://www.crypto-webminer.com
         BLOK("bitcoin-pay.eu") ||
+        BLOKD(".bitcoin-pay.eu") ||
         BLOK("crypto-webminer.com") ||
+        BLOKD(".crypto-webminer.com") ||
         BLOK("ethpocket.de") ||
+        BLOKD(".ethpocket.de") ||
         BLOK("ethtrader.de") ||
+        BLOKD(".ethtrader.de") ||
 // Gridcash
 //    https://www.gridcash.net/
         BLOK("adless.io") ||
+        BLOKD(".adless.io") ||
         BLOK("gridcash.net") ||
+        BLOKD(".gridcash.net") ||
 // JSE
 //    http://jsecoin.com
         BLOK("freecontent.bid") ||
+        BLOKD(".freecontent.bid") ||
         BLOK("freecontent.date") ||
+        BLOKD(".freecontent.date") ||
         BLOK("freecontent.stream") ||
+        BLOKD(".freecontent.stream") ||
         BLOK("hashing.win") ||
+        BLOKD(".hashing.win") ||
         BLOK("hostingcloud.racing") ||
+        BLOKD(".hostingcloud.racing") ||
         BLOK("hostingcloud.science") ||
+        BLOKD(".hostingcloud.science") ||
         BLOK("jsecoin.com") ||
+        BLOKD(".jsecoin.com") ||
 // MinerAlt
 //    http://mineralt.io
         BLOK("1q2w3.website") ||
+        BLOKD(".1q2w3.website") ||
         BLOK("analytics.blue") ||
+        BLOKD(".analytics.blue") ||
         BLOK("aster18cdn.nl") ||
+        BLOKD(".aster18cdn.nl") ||
         BLOK("belicimo.pw") ||
+        BLOKD(".belicimo.pw") ||
         BLOK("besstahete.info") ||
+        BLOKD(".besstahete.info") ||
         BLOK("dinorslick.icu") ||
+        BLOKD(".dinorslick.icu") ||
         BLOK("feesocrald.com") ||
+        BLOKD(".feesocrald.com") ||
         BLOK("gramombird.com") ||
+        BLOKD(".gramombird.com") ||
         BLOK("istlandoll.com") ||
+        BLOKD(".istlandoll.com") ||
         BLOK("mepirtedic.com") ||
+        BLOKD(".mepirtedic.com") ||
         BLOK("mineralt.io") ||
+        BLOKD(".mineralt.io") ||
         BLOK("pampopholf.com") ||
+        BLOKD(".pampopholf.com") ||
         BLOK("tercabilis.info") ||
+        BLOKD(".tercabilis.info") ||
         BLOK("tulip18.com") ||
+        BLOKD(".tulip18.com") ||
         BLOK("vidzi.tv") ||
+        BLOKD(".vidzi.tv") ||
         BLOK("yololike.space") ||
+        BLOKD(".yololike.space") ||
 // Minescripts
 //    http://minescripts.info
         BLOK("minescripts.info") ||
+        BLOKD(".minescripts.info") ||
         BLOK("sslverify.info") ||
+        BLOKD(".sslverify.info") ||
 // MineXMR
 //    http://minexmr.stream
         BLOK("minexmr.stream") ||
+        BLOKD(".minexmr.stream") ||
 // NeroHut
 //    https://nerohut.com
         BLOK("nerohut.com") ||
+        BLOKD(".nerohut.com") ||
         BLOK("nhsrv.cf") ||
+        BLOKD(".nhsrv.cf") ||
 // Service4refresh
 //    https://service4refresh.info
         BLOK("service4refresh.info") ||
+        BLOKD(".service4refresh.info") ||
 // SpareChange
 //    http://sparechange.io
         BLOK("sparechange.io") ||
+        BLOKD(".sparechange.io") ||
 // SwiftMining
 //    https://swiftmining.win/
         BLOK("swiftmining.win") ||
+        BLOKD(".swiftmining.win") ||
 // Webmine
 //    https://webmine.cz/
         BLOK("authedwebmine.cz") ||
+        BLOKD(".authedwebmine.cz") ||
         BLOK("webmine.cz") ||
+        BLOKD(".webmine.cz") ||
 // WebminePool
 //    http://webminepool.com
         BLOK("webminepool.com") ||
+        BLOKD(".webminepool.com") ||
 // Webmining
 //    https://webmining.co/
         BLOK("webmining.co") ||
+        BLOKD(".webmining.co") ||
+// Adbot
+//    https://adbot.tw/
+        BLOK("adbot.tw") ||
+        BLOKD(".adbot.tw") ||
+// AdCash
+//    https://adcash.com
+        BLOK("ufpcdn.com") ||
+        BLOKD(".ufpcdn.com") ||
+// AdMaven
+//    https://ad-maven.com/
+        BLOK("ad-maven.com") ||
+        BLOKD(".ad-maven.com") ||
+        BLOK("wrethicap.info") ||
+        BLOKD(".wrethicap.info") ||
+// Admicro
+//    http://www.admicro.vn/
+        BLOK("admicro.vn") ||
+        BLOKD(".admicro.vn") ||
+        BLOK("vcmedia.vn") ||
+        BLOKD(".vcmedia.vn") ||
+// Adnium
+//    https://adnium.com
+        BLOK("adnium.com") ||
+        BLOKD(".adnium.com") ||
+        BLOK("montwam.top") ||
+        BLOKD(".montwam.top") ||
+// AdScore
+//    http://www.adscoremarketing.com/
+        BLOK("adsco.re") ||
+        BLOKD(".adsco.re") ||
+// AdxSpace
+//    https://adx.space
+        BLOK("00px.net") ||
+        BLOKD(".00px.net") ||
+// AivaLabs
+//    https://aivalabs.com
+        BLOK("aivalabs.com") ||
+        BLOKD(".aivalabs.com") ||
+// AuditedMedia
+//    https://auditedmedia.com/
+        BLOK("aamapi.com") ||
+        BLOKD(".aamapi.com") ||
+        BLOK("aamsitecertifier.com") ||
+        BLOKD(".aamsitecertifier.com") ||
+        BLOK("auditedmedia.com") ||
+        BLOKD(".auditedmedia.com") ||
+// Azet
+//    http://mediaimpact.sk/
+        BLOK("rsz.sk") ||
+        BLOKD(".rsz.sk") ||
+// BetssonPalantir
+//    https://betssonpalantir.com/
+        BLOK("betssonpalantir.com") ||
+        BLOKD(".betssonpalantir.com") ||
+// BitMedia
+//    https://bitmedia.io/
+        BLOK("bitmedia.io") ||
+        BLOKD(".bitmedia.io") ||
+// BlueCava
+//    http://www.bluecava.com/
+        BLOK("bluecava.com") ||
+        BLOKD(".bluecava.com") ||
+// BoostBox
+//    https://www.boostbox.com.br/
+        BLOK("boostbox.com.br") ||
+        BLOKD(".boostbox.com.br") ||
+// Bouncex
+//    https://www.bouncex.com/
+        BLOK("bounceexchange.com") ||
+        BLOKD(".bounceexchange.com") ||
+        BLOK("bouncex.com") ||
+        BLOKD(".bouncex.com") ||
+        BLOK("bouncex.net") ||
+        BLOKD(".bouncex.net") ||
+// Brandcrumb
+//    http://www.brandcrumb.com
+        BLOK("brandcrumb.com") ||
+        BLOKD(".brandcrumb.com") ||
+// BreakTime
+//    https://www.breaktime.com.tw/
+        BLOK("breaktime.com.tw") ||
+        BLOKD(".breaktime.com.tw") ||
+// BrightEdge
+//    http://www.brightedge.com/
+        BLOK("b0e8.com") ||
+        BLOKD(".b0e8.com") ||
+// C3 Metrics
+//    http://c3metrics.com/
+        BLOK("c3metrics.com") ||
+        BLOKD(".c3metrics.com") ||
+        BLOK("c3tag.com") ||
+        BLOKD(".c3tag.com") ||
+// CallSource
+//    https://www.callsource.com/
+        BLOK("leadtrackingdata.com") ||
+        BLOKD(".leadtrackingdata.com") ||
+// CartsGuru
+//    https://carts.guru/
+        BLOK("carts.guru") ||
+        BLOKD(".carts.guru") ||
+// ClearLink
+//    https://www.clearlink.com/
+        BLOK("clearlink.com") ||
+        BLOKD(".clearlink.com") ||
+// Clickayab
+//    http://www.clickyab.com
+        BLOK("clickyab.com") ||
+        BLOKD(".clickyab.com") ||
+// ClickFrog
+//    https://clickfrog.ru/
+        BLOK("bashirian.biz") ||
+        BLOKD(".bashirian.biz") ||
+        BLOK("buckridge.link") ||
+        BLOKD(".buckridge.link") ||
+        BLOK("franecki.net") ||
+        BLOKD(".franecki.net") ||
+        BLOK("quitzon.net") ||
+        BLOKD(".quitzon.net") ||
+        BLOK("reichelcormier.bid") ||
+        BLOKD(".reichelcormier.bid") ||
+        BLOK("wisokykulas.bid") ||
+        BLOKD(".wisokykulas.bid") ||
+// ClickGuard
+//    https://www.clickguard.com/
+        BLOK("clickguard.com") ||
+        BLOKD(".clickguard.com") ||
+// Clixtell
+//    https://www.clixtell.com/
+        BLOK("clixtell.com") ||
+        BLOKD(".clixtell.com") ||
+// Cloudflare
+//    https://cloudflare.com
+        BLOK("hcaptcha.com") ||
+        BLOKD(".hcaptcha.com") ||
+// dmpxs
+//    http://bob.dmpxs.com
+        BLOK("dmpxs.com") ||
+        BLOKD(".dmpxs.com") ||
+// EroAdvertising
+//    http://www.ero-advertising.com/
+        BLOK("ero-advertising.com") ||
+        BLOKD(".ero-advertising.com") ||
+// Foresee
+//    https://www.foresee.com
+        BLOK("answerscloud.com") ||
+        BLOKD(".answerscloud.com") ||
+        BLOK("foresee.com") ||
+        BLOKD(".foresee.com") ||
+// Friends2Follow
+//    https://friends2follow.com/
+        BLOK("antifraudjs.friends2follow.com") ||
+        BLOKD(".antifraudjs.friends2follow.com") ||
+// Gleam
+//    https://gleam.io/
+        BLOK("fraudjs.io") ||
+        BLOKD(".fraudjs.io") ||
+// GrapheneMedia
+//    http://graphenemedia.in/
+        BLOK("graphenedigitalanalytics.in") ||
+        BLOKD(".graphenedigitalanalytics.in") ||
+// HilltopAds
+//    https://hilltopads.com/
+        BLOK("hilltopads.net") ||
+        BLOKD(".hilltopads.net") ||
+// HotelChamp
+//    https://www.hotelchamp.com
+        BLOK("hotelchamp.com") ||
+        BLOKD(".hotelchamp.com") ||
+// HumanSecurity
+//    https://www.humansecurity.com/
+        BLOK("perimeterx.net") ||
+        BLOKD(".perimeterx.net") ||
+// iMedia
+//    http://www.imedia.cz
+        BLOK("imedia.cz") ||
+        BLOKD(".imedia.cz") ||
+// Impact
+//    https://impact.com/
+        BLOK("fqtag.com") ||
+        BLOKD(".fqtag.com") ||
+// Integral Ad Science
+//    https://integralads.com/
+        BLOK("adsafeprotected.com") ||
+        BLOKD(".adsafeprotected.com") ||
+// iShumei
+//    https://www.ishumei.com/
+        BLOK("fengkongcloud.com") ||
+        BLOKD(".fengkongcloud.com") ||
+// IslayTech
+//    http://islay.tech
+        BLOK("islay.tech") ||
+        BLOKD(".islay.tech") ||
+// ismatlab.com
+//    http://ismatlab.com
+        BLOK("ismatlab.com") ||
+        BLOKD(".ismatlab.com") ||
+// Itch
+//    https://itch.io/
+        BLOK("itch.io") ||
+        BLOKD(".itch.io") ||
+// Kitewheel
+//    https://kitewheel.com/
+        BLOK("kitewheel.com") ||
+        BLOKD(".kitewheel.com") ||
+// Konduto
+//    http://konduto.com
+        BLOK("k-analytix.com") ||
+        BLOKD(".k-analytix.com") ||
+        BLOK("konduto.com") ||
+        BLOKD(".konduto.com") ||
+// LeadsHub
+//    https://ztsrv.com/
+        BLOK("ztsrv.com") ||
+        BLOKD(".ztsrv.com") ||
+// lptracker
+//    https://lptracker.io/
+        BLOK("lptracker.io") ||
+        BLOKD(".lptracker.io") ||
+// MaxMind
+//    https://www.maxmind.com/en/home
+        BLOK("maxmind.com") ||
+        BLOKD(".maxmind.com") ||
+        BLOK("mmapiws.com") ||
+        BLOKD(".mmapiws.com") ||
+// Mercadopago
+//    https://www.mercadopago.com/
+        BLOK("mercadopago.com") ||
+        BLOKD(".mercadopago.com") ||
+// Mobials
+//    http://mobials.com
+        BLOK("mobials.com") ||
+        BLOKD(".mobials.com") ||
+// Negishim
+//    http://www.negishim.org
+        BLOK("negishim.org") ||
+        BLOKD(".negishim.org") ||
+// OneAd
+//    https://www.onead.com.tw/
+        BLOK("guoshipartners.com") ||
+        BLOKD(".guoshipartners.com") ||
+        BLOK("onevision.com.tw") ||
+        BLOKD(".onevision.com.tw") ||
+// OnlineMetrix
+//    http://h.online-metrix.net
+        BLOK("online-metrix.net") ||
+        BLOKD(".online-metrix.net") ||
+// Outbrain
+//    http://www.outbrain.com/
+        BLOK("ligatus.com") ||
+        BLOKD(".ligatus.com") ||
+// PartyPoker
+//    https://www.partypoker.com/
+        BLOK("iivt.com") ||
+        BLOKD(".iivt.com") ||
+// Paypal
+//    https://www.paypal.com
+        BLOK("simility.com") ||
+        BLOKD(".simility.com") ||
+// PixAnalytics
+//    https://pixanalytics.com/
+        BLOK("pixanalytics.com") ||
+        BLOKD(".pixanalytics.com") ||
+// Pixlee
+//    https://www.pixlee.com/
+        BLOK("pixlee.com") ||
+        BLOKD(".pixlee.com") ||
+// PPCProtect
+//    https://ppcprotect.com
+        BLOK("ppcprotect.com") ||
+        BLOKD(".ppcprotect.com") ||
+// PrometheusIntelligenceTechnology
+//    https://prometheusintelligencetechnology.com/
+        BLOK("prometheusintelligencetechnology.com") ||
+        BLOKD(".prometheusintelligencetechnology.com") ||
+// Protected Media
+//    http://www.protected.media/
+        BLOK("ad-score.com") ||
+        BLOKD(".ad-score.com") ||
+// Radware
+//    https://www.radware.com/
+        BLOK("perfdrive.com") ||
+        BLOKD(".perfdrive.com") ||
+// RazorPay
+//    https://razorpay.com
+        BLOK("thirdwatch.ai") ||
+        BLOKD(".thirdwatch.ai") ||
+// Rollick
+//    https://gorollick.com
+        BLOK("rollick.io") ||
+        BLOKD(".rollick.io") ||
+// Selectable Media
+//    http://selectablemedia.com/
+        BLOK("selectablemedia.com") ||
+        BLOKD(".selectablemedia.com") ||
+// Semantiqo
+//    http://semantiqo.com/
+        BLOK("semantiqo.com") ||
+        BLOKD(".semantiqo.com") ||
+// SendPulse
+//    https://sendpulse.com/
+        BLOK("sendpulse.com") ||
+        BLOKD(".sendpulse.com") ||
+// ShaftTraffic
+//    https://shafttraffic.com
+        BLOK("libertystmedia.com") ||
+        BLOKD(".libertystmedia.com") ||
+// Shixiseng
+//    https://www.shixiseng.com/
+        BLOK("xiaoyuanzhao.com") ||
+        BLOKD(".xiaoyuanzhao.com") ||
+// Shortest
+//    http://shorte.st/
+        BLOK("shorte.st") ||
+        BLOKD(".shorte.st") ||
+// SiftScience
+//    https://sift.com/
+        BLOK("siftscience.com") ||
+        BLOKD(".siftscience.com") ||
+// Signifyd
+//    https://www.signifyd.com/
+        BLOK("signifyd.com") ||
+        BLOKD(".signifyd.com") ||
+// SmarterClick
+//    https://smarterclick.com/privacy-policy/
+        BLOK("smct.io") ||
+        BLOKD(".smct.io") ||
+// Smi
+//    http://24smi.net
+        BLOK("24smi.net") ||
+        BLOKD(".24smi.net") ||
+// Storeland
+//    https://storeland.ru/
+        BLOK("storeland.ru") ||
+        BLOKD(".storeland.ru") ||
+// Stripchat
+//    https://stripchat.com/
+        BLOK("stripst.com") ||
+        BLOKD(".stripst.com") ||
+// Stripe
+//    https://stripe.com
+        BLOK("stripe.network") ||
+        BLOKD(".stripe.network") ||
+// TechSolutions
+//    https://www.techsolutions.com.tw/
+        BLOK("techsolutions.com.tw") ||
+        BLOKD(".techsolutions.com.tw") ||
+// tongdun.cn
+//    https://www.tongdun.cn/?lan=EN
+        BLOK("fraudmetrix.cn") ||
+        BLOKD(".fraudmetrix.cn") ||
+        BLOK("tongdun.net") ||
+        BLOKD(".tongdun.net") ||
+// Trendemon
+//    https://trendemon.com/
+        BLOK("trendemon.com") ||
+        BLOKD(".trendemon.com") ||
+// Upland
+//    https://uplandsoftware.com/
+        BLOK("leadlander.com") ||
+        BLOKD(".leadlander.com") ||
+        BLOK("sf14g.com") ||
+        BLOKD(".sf14g.com") ||
+// VerticalHealth
+//    https://www.verticalhealth.com/
+        BLOK("verticalhealth.net") ||
+        BLOKD(".verticalhealth.net") ||
+// Warumbistdusoarm
+//    https://warumbistdusoarm.space
+        BLOK("warumbistdusoarm.space") ||
+        BLOKD(".warumbistdusoarm.space") ||
+// Webmecanik
+//    https://www.webmecanik.com/
+        BLOK("webmecanik.com") ||
+        BLOKD(".webmecanik.com") ||
+// WideOrbit
+//    https://www.wideorbit.com/
+        BLOK("dep-x.com") ||
+        BLOKD(".dep-x.com") ||
+// Yandex
+//    http://www.yandex.com/
+        BLOK("mc.yandex.ru") ||
+        BLOKD(".mc.yandex.ru") ||
+// ZafulAffiliate
+//    https://affiliate.zaful.com/
+        BLOK("affasi.com") ||
+        BLOKD(".affasi.com") ||
+        BLOK("gw-ec.com") ||
+        BLOKD(".gw-ec.com") ||
+        BLOK("zaful.com") ||
+        BLOKD(".zaful.com") ||
+// Zip
+//    https://zip.co
+        BLOK("zipmoney.com.au") ||
+        BLOKD(".zipmoney.com.au") ||

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-45.37.0
+45.41.6

docshell/base/nsDocShell.cpp

@@ -5385,11 +5385,19 @@ nsDocShell::Stop(uint32_t aStopFlags)
   }
 
   if (nsIWebNavigation::STOP_CONTENT & aStopFlags) {
-    // Stop the document loading
+    // Stop the document loading and animations
     if (mContentViewer) {
       nsCOMPtr<nsIContentViewer> cv = mContentViewer;
       cv->Stop();
     }
+  } else if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {
+    // Stop the document loading only
+    if (mContentViewer) {
+      nsCOMPtr<nsIDocument> doc = mContentViewer->GetDocument();
+      if (doc) {
+        doc->StopDocumentLoad();
+      }
+    }
   }
 
   if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {
@@ -9211,7 +9219,11 @@ nsDocShell::SetupNewViewer(nsIContentViewer* aNewViewer)
   mContentViewer->SetNavigationTiming(mTiming);
 
   if (NS_FAILED(mContentViewer->Init(widget, bounds))) {
+    nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
+    viewer->Close(nullptr);
+    viewer->Destroy();
     mContentViewer = nullptr;
+    mCurrentURI = nullptr;
     NS_WARNING("ContentViewer Initialization failed");
     return NS_ERROR_FAILURE;
   }

dom/base/nsContentUtils.cpp

@@ -8807,10 +8807,6 @@ ShouldEscape(nsIContent* aParent)
     nsGkAtoms::style, nsGkAtoms::script, nsGkAtoms::xmp,
     nsGkAtoms::iframe, nsGkAtoms::noembed, nsGkAtoms::noframes,
     nsGkAtoms::plaintext,
-    // Per the current spec noscript should be escaped in case
-    // scripts are disabled or if document doesn't have
-    // browsing context. However the latter seems to be a spec bug
-    // and Gecko hasn't traditionally done the former.
     nsGkAtoms::noscript
   };
   static mozilla::BloomFilter<12, nsIAtom> sFilter;
@@ -8826,6 +8822,10 @@ ShouldEscape(nsIContent* aParent)
   if (sFilter.mightContain(tag)) {
     for (uint32_t i = 0; i < ArrayLength(nonEscapingElements); ++i) {
       if (tag == nonEscapingElements[i]) {
+        if (MOZ_UNLIKELY(tag == nsGkAtoms::noscript) &&
+            MOZ_UNLIKELY(!aParent->OwnerDoc()->IsScriptEnabled())) {
+          return true;
+        }
         return false;
       }
     }

dom/base/nsHTMLContentSerializer.cpp

@@ -281,7 +281,7 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
   if (ns == kNameSpaceID_XHTML &&
       (name == nsGkAtoms::script ||
        name == nsGkAtoms::style ||
-       name == nsGkAtoms::noscript ||
+       (name == nsGkAtoms::noscript && aElement->OwnerDoc()->IsScriptEnabled()) ||
        name == nsGkAtoms::noframes)) {
     ++mDisableEntityEncoding;
   }
@@ -310,7 +310,7 @@ nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
   if (ns == kNameSpaceID_XHTML &&
       (name == nsGkAtoms::script ||
        name == nsGkAtoms::style ||
-       name == nsGkAtoms::noscript ||
+       (name == nsGkAtoms::noscript && aElement->OwnerDoc()->IsScriptEnabled()) ||
        name == nsGkAtoms::noframes)) {
     --mDisableEntityEncoding;
   }

dom/base/nsStructuredCloneContainer.cpp

@@ -133,6 +133,10 @@ nsStructuredCloneContainer::GetDataAsBase64(nsAString &aOut)
   if (!DataLength()) {
     return NS_ERROR_FAILURE;
   }
+  CheckedInt<nsAutoCString::size_type> sizeCheck(DataLength());
+  if (MOZ_UNLIKELY(!sizeCheck.isValid())) {
+    return NS_ERROR_FAILURE;
+  }
 
   if (HasClonedDOMObjects()) {
     return NS_ERROR_FAILURE;

dom/base/nsTextFragment.cpp

@@ -209,6 +209,11 @@ FirstNon8Bit(const char16_t *str, const char16_t *end)
 bool
 nsTextFragment::SetTo(const char16_t* aBuffer, int32_t aLength, bool aUpdateBidi)
 {
+  if (MOZ_UNLIKELY(aLength < 0 || static_cast<uint32_t>(aLength) >
+                                      NS_MAX_TEXT_FRAGMENT_LENGTH)) {
+    return false;
+  }
+
   ReleaseText();
 
   if (aLength == 0) {
@@ -337,9 +342,16 @@ nsTextFragment::CopyTo(char16_t *aDest, int32_t aOffset, int32_t aCount)
 bool
 nsTextFragment::Append(const char16_t* aBuffer, uint32_t aLength, bool aUpdateBidi)
 {
+  if (!aLength) {
+    return true;
+  }
+
   // This is a common case because some callsites create a textnode
   // with a value by creating the node and then calling AppendData.
   if (mState.mLength == 0) {
+    if (MOZ_UNLIKELY(aLength > INT32_MAX)) {
+      return false;
+    }
     return SetTo(aBuffer, aLength, aUpdateBidi);
   }
 

dom/base/nsXMLHttpRequest.cpp

@@ -1317,7 +1317,13 @@ nsXMLHttpRequest::IsSafeHeader(const nsACString& header, nsIHttpChannel* httpCha
     if (!NS_IsValidHTTPToken(token)) {
       return false;
     }
-    if (header.Equals(token, nsCaseInsensitiveCStringComparator())) {
+
+    if (token.EqualsLiteral("*") &&
+        (mState & XML_HTTP_REQUEST_AC_WITH_CREDENTIALS) !=
+XML_HTTP_REQUEST_AC_WITH_CREDENTIALS /* See this->SetWithCredentials */)
+    {
+      isSafe = true;
+    } else if (header.Equals(token, nsCaseInsensitiveCStringComparator())) {
       isSafe = true;
     }
   }

dom/bindings/ToJSValue.h

@@ -117,7 +117,7 @@ ToJSValue(JSContext* aCx,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(aArgument));
   return true;
 }
 

dom/canvas/CanvasRenderingContext2D.cpp

@@ -4030,29 +4030,41 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
 
 gfxFontGroup *CanvasRenderingContext2D::GetCurrentFontStyle()
 {
-  // use lazy initilization for the font group since it's rather expensive
-  if (!CurrentState().fontGroup) {
+  // Use lazy (re)initialization for the fontGroup since it's rather expensive.
+
+  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
+  gfxTextPerfMetrics* tp = nullptr;
+  if (presShell && !presShell->IsDestroying()) {
+    tp = presShell->GetPresContext()->GetTextPerfMetrics();
+  }
+
+  // If we have a cached fontGroup, check that it is valid for the current
+  // prescontext; if not, we need to discard and re-create it.
+  RefPtr<gfxFontGroup>& fontGroup = CurrentState().fontGroup;
+  if (fontGroup && fontGroup->GetTextPerfMetrics() != tp)
+    fontGroup = nullptr;
+
+  if (!fontGroup) {
     ErrorResult err;
     NS_NAMED_LITERAL_STRING(kDefaultFontStyle, "10px sans-serif");
     static float kDefaultFontSize = 10.0;
-    nsCOMPtr<nsIPresShell> presShell = GetPresShell();
-    bool fontUpdated = SetFontInternal(kDefaultFontStyle, err);
+    // If the font has already been set, we're re-creating the fontGroup
+    // and should re-use the existing font attribute; if not, we initialize
+    // it to the canvas default.
+    const nsString& currentFont = CurrentState().font;
+    bool fontUpdated = SetFontInternal(
+        currentFont.IsEmpty() ? kDefaultFontStyle : currentFont, err);
     if (err.Failed() || !fontUpdated) {
       err.SuppressException();
       gfxFontStyle style;
       style.size = kDefaultFontSize;
-      gfxTextPerfMetrics* tp = nullptr;
-      if (presShell && !presShell->IsDestroying()) {
-        tp = presShell->GetPresContext()->GetTextPerfMetrics();
-      }
       int32_t perDevPixel, perCSSPixel;
       GetAppUnitsValues(&perDevPixel, &perCSSPixel);
       gfxFloat devToCssSize = gfxFloat(perDevPixel) / gfxFloat(perCSSPixel);
-      CurrentState().fontGroup =
-        gfxPlatform::GetPlatform()->CreateFontGroup(FontFamilyList(eFamily_sans_serif),
+      fontGroup = gfxPlatform::GetPlatform()->CreateFontGroup(FontFamilyList(eFamily_sans_serif),
                                                     &style, tp,
                                                     nullptr, devToCssSize);
-      if (CurrentState().fontGroup) {
+      if (fontGroup) {
         CurrentState().font = kDefaultFontStyle;
       } else {
         NS_ERROR("Default canvas font is invalid");
@@ -4060,7 +4072,7 @@ gfxFontGroup *CanvasRenderingContext2D::GetCurrentFontStyle()
     }
   }
 
-  return CurrentState().fontGroup;
+  return fontGroup;
 }
 
 //
@@ -5217,6 +5229,16 @@ CanvasRenderingContext2D::GetImageData(JSContext* aCx, double aSx,
   return imageData.forget();
 }
 
+static IntRect ClipImageDataTransfer(IntRect& aSrc, const IntPoint& aDestOffset,
+                                     const IntSize& aDestBounds) {
+  IntRect dest = aSrc;
+  dest.SafeMoveBy(aDestOffset);
+  dest = IntRect(IntPoint(0, 0), aDestBounds).SafeIntersect(dest);
+
+  aSrc = aSrc.SafeIntersect(dest - aDestOffset);
+  return aSrc + aDestOffset;
+}
+
 nsresult
 CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
                                             int32_t aX,
@@ -5232,7 +5254,7 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
   MOZ_ASSERT(aWidth && aHeight);
 
   CheckedInt<uint32_t> len = CheckedInt<uint32_t>(aWidth) * aHeight * 4;
-  if (!len.isValid()) {
+  if (!len.isValid() || len.value() > INT32_MAX) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
@@ -5254,8 +5276,9 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
   }
 
   IntRect srcRect(0, 0, mWidth, mHeight);
-  IntRect destRect(aX, aY, aWidth, aHeight);
-  IntRect srcReadRect = srcRect.Intersect(destRect);
+  IntRect dstWriteRect(0, 0, aWidth, aHeight);
+  IntRect srcReadRect = ClipImageDataTransfer(dstWriteRect, IntPoint(aX, aY),
+                                              IntSize(mWidth, mHeight));
   RefPtr<DataSourceSurface> readback;
   DataSourceSurface::MappedSurface rawData;
   if (!srcReadRect.IsEmpty()) {
@@ -5268,9 +5291,6 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
     }
   }
 
-  IntRect dstWriteRect = srcReadRect;
-  dstWriteRect.MoveBy(-aX, -aY);
-
   uint8_t* src;
   uint32_t srcStride;
 
@@ -5455,10 +5475,10 @@ CanvasRenderingContext2D::PutImageData_explicit(int32_t x, int32_t y, uint32_t w
     dirtyRect = imageDataRect;
   }
 
-  dirtyRect.MoveBy(IntPoint(x, y));
-  dirtyRect = IntRect(0, 0, mWidth, mHeight).Intersect(dirtyRect);
-
-  if (dirtyRect.Width() <= 0 || dirtyRect.Height() <= 0) {
+  IntRect srcRect = dirtyRect;
+  dirtyRect = ClipImageDataTransfer(srcRect, IntPoint(x, y),
+                                    IntSize(mWidth, mHeight));
+  if (dirtyRect.IsEmpty()) {
     return NS_OK;
   }
 
@@ -5551,7 +5571,7 @@ CreateImageData(JSContext* cx, CanvasRenderingContext2D* context,
       h = 1;
 
   CheckedInt<uint32_t> len = CheckedInt<uint32_t>(w) * h * 4;
-  if (!len.isValid()) {
+  if (!len.isValid() || len.value() > INT32_MAX) {
     error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }

dom/events/EventListenerManager.cpp

@@ -24,6 +24,7 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/EventTargetBinding.h"
+#include "mozilla/ScopeExit.h"
 #include "mozilla/TimelineConsumers.h"
 #include "mozilla/EventTimelineMarker.h"
 
@@ -712,6 +713,8 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
                                       bool aPermitUntrustedEvents,
                                       Element* aElement)
 {
+  auto removeEventHandler = MakeScopeExit([&] { RemoveEventHandler(aName, EmptyString()); });
+
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIScriptGlobalObject> global =
     GetScriptGlobalAndDocument(getter_AddRefs(doc));
@@ -786,6 +789,8 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
   NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
   NS_ENSURE_STATE(global->GetGlobalJSObject());
 
+  removeEventHandler.release();
+
   Listener* listener = SetEventHandlerInternal(aName,
                                                EmptyString(),
                                                TypedEventHandler(),

dom/fetch/FetchDriver.cpp

@@ -491,7 +491,8 @@ FetchDriver::OnStartRequest(nsIRequest* aRequest,
     nsAutoCString statusText;
     httpChannel->GetResponseStatusText(statusText);
 
-    response = new InternalResponse(responseStatus, statusText);
+    response = new InternalResponse(responseStatus, statusText,
+                                    mRequest->GetCredentialsMode());
 
     RefPtr<FillResponseHeaders> visitor = new FillResponseHeaders(response);
     rv = httpChannel->VisitResponseHeaders(visitor);
@@ -511,7 +512,8 @@ FetchDriver::OnStartRequest(nsIRequest* aRequest,
                                 result);
     MOZ_ASSERT(!result.Failed());
   } else {
-    response = new InternalResponse(200, NS_LITERAL_CSTRING("OK"));
+    response = new InternalResponse(200, NS_LITERAL_CSTRING("OK"),
+                                    mRequest->GetCredentialsMode());
 
     ErrorResult result;
     nsAutoCString contentType;
@@ -615,9 +617,12 @@ FetchDriver::OnDataAvailable(nsIRequest* aRequest,
   // NB: This can be called on any thread!  But we're guaranteed that it is
   // called between OnStartRequest and OnStopRequest, so we don't need to worry
   // about races.
+  if (!mResponse) {
+    MOZ_ASSERT(false);
+    return NS_ERROR_UNEXPECTED;
+  }
 
-  uint32_t aRead;
-  MOZ_ASSERT(mResponse);
+  uint32_t aRead = 0;
   MOZ_ASSERT(mPipeOutputStream);
 
   nsresult rv = aInputStream->ReadSegments(NS_CopySegmentToStream,

dom/fetch/InternalHeaders.cpp

@@ -300,7 +300,8 @@ InternalHeaders::BasicHeaders(InternalHeaders* aHeaders)
 
 // static
 already_AddRefed<InternalHeaders>
-InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
+InternalHeaders::CORSHeaders(InternalHeaders* aHeaders,
+                             RequestCredentials aCredentialsMode)
 {
   RefPtr<InternalHeaders> cors = new InternalHeaders(aHeaders->mGuard);
   ErrorResult result;
@@ -309,6 +310,7 @@ InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
   aHeaders->Get(NS_LITERAL_CSTRING("Access-Control-Expose-Headers"), acExposedNames, result);
   MOZ_ASSERT(!result.Failed());
 
+  bool allowAllHeaders = false;
   nsAutoTArray<nsCString, 5> exposeNamesArray;
   nsCCharSeparatedTokenizer exposeTokens(acExposedNames, ',');
   while (exposeTokens.hasMoreTokens()) {
@@ -324,19 +326,27 @@ InternalHeaders::CORSHeaders(InternalHeaders* aHeaders)
       break;
     }
 
+    if (token.EqualsLiteral("*") &&
+        aCredentialsMode != RequestCredentials::Include) {
+      allowAllHeaders = true;
+    }
+
     exposeNamesArray.AppendElement(token);
   }
 
   nsCaseInsensitiveCStringArrayComparator comp;
   for (uint32_t i = 0; i < aHeaders->mList.Length(); ++i) {
     const Entry& entry = aHeaders->mList[i];
-    if (entry.mName.EqualsASCII("cache-control") ||
-        entry.mName.EqualsASCII("content-language") ||
-        entry.mName.EqualsASCII("content-type") ||
-        entry.mName.EqualsASCII("expires") ||
-        entry.mName.EqualsASCII("last-modified") ||
-        entry.mName.EqualsASCII("pragma") ||
-        exposeNamesArray.Contains(entry.mName, comp)) {
+    if (allowAllHeaders) {
+      cors->Append(entry.mName, entry.mValue, result);
+      MOZ_ASSERT(!result.Failed());
+    } else if (entry.mName.EqualsASCII("cache-control") ||
+               entry.mName.EqualsASCII("content-language") ||
+               entry.mName.EqualsASCII("content-type") ||
+               entry.mName.EqualsASCII("expires") ||
+               entry.mName.EqualsASCII("last-modified") ||
+               entry.mName.EqualsASCII("pragma") ||
+               exposeNamesArray.Contains(entry.mName, comp)) {
       cors->Append(entry.mName, entry.mValue, result);
       MOZ_ASSERT(!result.Failed());
     }

dom/fetch/InternalHeaders.h

@@ -9,6 +9,7 @@
 
 // needed for HeadersGuardEnum.
 #include "mozilla/dom/HeadersBinding.h"
+#include "mozilla/dom/RequestBinding.h"
 #include "mozilla/dom/UnionTypes.h"
 
 #include "nsClassHashtable.h"
@@ -103,7 +104,8 @@ public:
   BasicHeaders(InternalHeaders* aHeaders);
 
   static already_AddRefed<InternalHeaders>
-  CORSHeaders(InternalHeaders* aHeaders);
+  CORSHeaders(InternalHeaders* aHeaders,
+              RequestCredentials mCredentialsMode = RequestCredentials::Omit);
 
   void
   GetEntries(nsTArray<InternalHeaders::Entry>& aEntries) const;

dom/fetch/InternalResponse.cpp

@@ -16,11 +16,14 @@
 namespace mozilla {
 namespace dom {
 
-InternalResponse::InternalResponse(uint16_t aStatus, const nsACString& aStatusText)
+InternalResponse::InternalResponse(uint16_t aStatus,
+                                   const nsACString& aStatusText,
+                                   RequestCredentials aCredentialsMode)
   : mType(ResponseType::Default)
   , mStatus(aStatus)
   , mStatusText(aStatusText)
   , mHeaders(new InternalHeaders(HeadersGuardEnum::Response))
+  , mCredentialsMode(aCredentialsMode)
 {
 }
 
@@ -76,7 +79,7 @@ InternalResponse::CORSResponse()
   MOZ_ASSERT(!mWrappedResponse, "Can't CORSResponse a already wrapped response");
   RefPtr<InternalResponse> cors = CreateIncompleteCopy();
   cors->mType = ResponseType::Cors;
-  cors->mHeaders = InternalHeaders::CORSHeaders(Headers());
+  cors->mHeaders = InternalHeaders::CORSHeaders(Headers(), mCredentialsMode);
   cors->mWrappedResponse = this;
   return cors.forget();
 }

dom/fetch/InternalResponse.h

@@ -10,7 +10,9 @@
 #include "nsIInputStream.h"
 #include "nsISupportsImpl.h"
 
+#include "mozilla/dom/InternalHeaders.h"
 #include "mozilla/dom/ResponseBinding.h"
+#include "mozilla/dom/RequestBinding.h"
 #include "mozilla/dom/ChannelInfo.h"
 #include "mozilla/UniquePtr.h"
 
@@ -30,7 +32,8 @@ class InternalResponse final
 public:
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(InternalResponse)
 
-  InternalResponse(uint16_t aStatus, const nsACString& aStatusText);
+  InternalResponse(uint16_t aStatus, const nsACString& aStatusText,
+                   RequestCredentials aCredentialsMode = RequestCredentials::Omit);
 
   already_AddRefed<InternalResponse> Clone();
 
@@ -241,6 +244,7 @@ private:
   nsCOMPtr<nsIInputStream> mBody;
   ChannelInfo mChannelInfo;
   UniquePtr<mozilla::ipc::PrincipalInfo> mPrincipalInfo;
+  RequestCredentials mCredentialsMode;
 
   // For filtered responses.
   // Cache, and SW interception should always serialize/access the underlying

dom/fetch/Request.cpp

@@ -275,7 +275,7 @@ Request::Constructor(const GlobalObject& aGlobal,
 
     request->SetURL(NS_ConvertUTF16toUTF8(requestURL));
     fallbackMode = RequestMode::Cors;
-    fallbackCredentials = RequestCredentials::Omit;
+    fallbackCredentials = RequestCredentials::Same_origin;
     fallbackCache = RequestCache::Default;
   }
 
@@ -365,7 +365,8 @@ Request::Constructor(const GlobalObject& aGlobal,
     return nullptr;
   }
 
-  if (aInit.mBody.WasPassed() || temporaryBody) {
+  if ((aInit.mBody.WasPassed() && !aInit.mBody.Value().IsNull()) ||
+      temporaryBody) {
     // HEAD and GET are not allowed to have a body.
     nsAutoCString method;
     request->GetMethod(method);
@@ -377,29 +378,34 @@ Request::Constructor(const GlobalObject& aGlobal,
   }
 
   if (aInit.mBody.WasPassed()) {
-    const OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& bodyInit = aInit.mBody.Value();
-    nsCOMPtr<nsIInputStream> stream;
-    nsAutoCString contentType;
-    aRv = ExtractByteStreamFromBody(bodyInit,
-                                    getter_AddRefs(stream), contentType);
-    if (NS_WARN_IF(aRv.Failed())) {
-      return nullptr;
+    const Nullable<OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams>& bodyInitNullable =
+      aInit.mBody.Value();
+    if (!bodyInitNullable.IsNull()) {
+      const OwningArrayBufferOrArrayBufferViewOrBlobOrFormDataOrUSVStringOrURLSearchParams& bodyInit =
+        bodyInitNullable.Value();
+      nsCOMPtr<nsIInputStream> stream;
+      nsAutoCString contentType;
+      aRv = ExtractByteStreamFromBody(bodyInit,
+                                      getter_AddRefs(stream), contentType);
+      if (NS_WARN_IF(aRv.Failed())) {
+        return nullptr;
+      }
+
+      temporaryBody = stream;
+
+      if (!contentType.IsVoid() &&
+          !requestHeaders->Has(NS_LITERAL_CSTRING("Content-Type"), aRv)) {
+        requestHeaders->Append(NS_LITERAL_CSTRING("Content-Type"),
+                               contentType, aRv);
+      }
+
+      if (NS_WARN_IF(aRv.Failed())) {
+        return nullptr;
+      }
+
+      request->ClearCreatedByFetchEvent();
+      request->SetBody(temporaryBody);
     }
-
-    temporaryBody = stream;
-
-    if (!contentType.IsVoid() &&
-        !requestHeaders->Has(NS_LITERAL_CSTRING("Content-Type"), aRv)) {
-      requestHeaders->Append(NS_LITERAL_CSTRING("Content-Type"),
-                             contentType, aRv);
-    }
-
-    if (NS_WARN_IF(aRv.Failed())) {
-      return nullptr;
-    }
-
-    request->ClearCreatedByFetchEvent();
-    request->SetBody(temporaryBody);
   }
 
   RefPtr<Request> domRequest = new Request(global, request);

dom/html/HTMLSharedObjectElement.cpp

@@ -193,7 +193,12 @@ HTMLSharedObjectElement::SetAttr(int32_t aNameSpaceID, nsIAtom *aName,
   // attributes before inserting the node into the document.
   if (aNotify && IsInComposedDoc() && mIsDoneAddingChildren &&
       aNameSpaceID == kNameSpaceID_None && aName == URIAttrName()) {
-    return LoadObject(aNotify, true);
+    nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
+            [self = RefPtr<HTMLSharedObjectElement>(this), aNotify]() {
+              if (self->IsInComposedDoc()) {
+                self->LoadObject(aNotify, true);
+              }
+            }));
   }
 
   return NS_OK;

dom/indexedDB/KeyPath.cpp

@@ -107,7 +107,7 @@ GetJSValFromKeyPathString(JSContext* aCx,
       // step 4 substep 1: check for .length on a String value.
       if (currentVal.isString() && !tokenizer.hasMoreTokens() &&
           token.EqualsLiteral("length") && aOptions == DoNotCreateProperties) {
-        aKeyJSVal->setNumber(double(JS_GetStringLength(currentVal.toString())));
+        aKeyJSVal->setNumber(uint32_t(JS_GetStringLength(currentVal.toString())));
         break;
       }
 

dom/jsurl/nsJSProtocolHandler.cpp

@@ -201,7 +201,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
     // Sandboxed document check: javascript: URI's are disabled
     // in a sandboxed document unless 'allow-scripts' was specified.
     nsIDocument* doc = aOriginalInnerWindow->GetExtantDoc();
-    if (doc && doc->HasScriptsBlockedBySandbox()) {
+    if (doc && !doc->IsScriptEnabled()) {
         return NS_ERROR_DOM_RETVAL_UNDEFINED;
     }
 

dom/media/ADTSDemuxer.cpp

@@ -852,8 +852,9 @@ ADTSTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize)
 
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
+    int64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/media/MP3Demuxer.cpp

@@ -655,7 +655,8 @@ MP3TrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) {
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    uint64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/security/nsCSPContext.cpp

@@ -673,32 +673,52 @@ nsCSPContext::logToConsole(const char16_t* aName,
  * Strip URI for reporting according to:
  * http://www.w3.org/TR/CSP/#violation-reports
  *
+ * @param aSelfURI
+ *        The URI of the CSP policy. Used for cross-origin checks.
  * @param aURI
  *        The uri to be stripped for reporting
  * @param aProtectedResourcePrincipal
  *        The loadingPrincipal of the protected resource
  *        which is needed to enforce the SOP.
+ * @param aEffectiveDirective
+ *        The effective directive that triggered this report
  * @return ASCII serialization of the uri to be reported.
  */
 void
-StripURIForReporting(nsIURI* aURI,
+StripURIForReporting(nsIURI* aSelfURI, nsIURI* aURI,
                      nsIPrincipal* aProtectedResourcePrincipal,
+                     const nsAString& aEffectiveDirective,
                      nsACString& outStrippedURI)
 {
   // 1) If the origin of uri is a globally unique identifier (for example,
   // aURI has a scheme of data, blob, or filesystem), then return the
   // ASCII serialization of uri’s scheme.
-  bool isHttp =
-    (NS_SUCCEEDED(aURI->SchemeIs("http", &isHttp)) && isHttp) ||
-    (NS_SUCCEEDED(aURI->SchemeIs("https", &isHttp)) && isHttp);
-  if (!isHttp) {
+  bool isHttpFtpOrWs =
+    (NS_SUCCEEDED(aURI->SchemeIs("https", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("http", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("wss", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("ws", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("ftp", &isHttpFtpOrWs)) && isHttpFtpOrWs);
+  if (!isHttpFtpOrWs) {
     // not strictly spec compliant, but what we really care about is
-    // http/https. If it's not http/https, then treat aURI as if
-    // it's a globally unique identifier and just return the scheme.
+    // http/https and also ftp. If it's not http/https or ftp, then treat aURI
+    // as if it's a globally unique identifier and just return the scheme.
     aURI->GetScheme(outStrippedURI);
     return;
   }
 
+  // For cross-origin URIs in frame-src also strip the path.
+  // This prevents detailed tracking of pages loaded into an iframe
+  // by the embedding page using a report-only policy.
+  if (aEffectiveDirective.EqualsLiteral("frame-src") ||
+      aEffectiveDirective.EqualsLiteral("object-src")) {
+    nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
+    if (NS_FAILED(ssm->CheckSameOriginURI(aSelfURI, aURI, false))) {
+      aURI->GetPrePath(outStrippedURI);
+      return;
+    }
+  }
+
   // 2) If the origin of uri is not the same as the origin of the protected
   // resource, then return the ASCII serialization of uri’s origin.
   bool sameOrigin =
@@ -740,6 +760,11 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
                           nsAString& aScriptSample,
                           uint32_t aLineNum)
 {
+  /* Due to unclear vulnerabilities in bug 1542194 and others, just don't.
+     We probably don't do it right anymore anyway. -- Cameron */
+  if (!Preferences::GetBool("security.csp.sendreports", false))
+    return NS_OK;
+
   NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
 
 #ifdef MOZ_B2G
@@ -760,7 +785,8 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
     nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
     // could be a string or URI
     if (uri) {
-      StripURIForReporting(uri, mLoadingPrincipal, reportBlockedURI);
+      StripURIForReporting(mSelfURI, uri, mLoadingPrincipal, aViolatedDirective,
+                           reportBlockedURI);
     } else {
       nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
       if (cstr) {
@@ -777,7 +803,8 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
 
   // document-uri
   nsAutoCString reportDocumentURI;
-  StripURIForReporting(mSelfURI, mLoadingPrincipal, reportDocumentURI);
+  StripURIForReporting(mSelfURI, mSelfURI, mLoadingPrincipal,
+                       aViolatedDirective, reportDocumentURI);
   report.mCsp_report.mDocument_uri = NS_ConvertUTF8toUTF16(reportDocumentURI);
 
   // original-policy

dom/webidl/Request.webidl

@@ -38,7 +38,7 @@ Request implements Body;
 dictionary RequestInit {
   ByteString method;
   HeadersInit headers;
-  BodyInit body;
+  BodyInit? body;
   RequestMode mode;
   RequestCredentials credentials;
   RequestCache cache;

dom/workers/ScriptLoader.cpp

@@ -1993,12 +1993,14 @@ void ReportLoadError(JSContext* aCx, nsresult aLoadResult)
 
     case NS_ERROR_FILE_NOT_FOUND:
     case NS_ERROR_NOT_AVAILABLE:
+    case NS_ERROR_CORRUPTED_CONTENT:
       Throw(aCx, NS_ERROR_DOM_NETWORK_ERR);
       break;
 
     case NS_ERROR_MALFORMED_URI:
       aLoadResult = NS_ERROR_DOM_SYNTAX_ERR;
       // fall through
+    case NS_ERROR_DOM_BAD_URI:
     case NS_ERROR_DOM_SECURITY_ERR:
     case NS_ERROR_DOM_SYNTAX_ERR:
       Throw(aCx, aLoadResult);

dom/workers/WorkerPrivate.cpp

@@ -4120,6 +4120,11 @@ WorkerPrivate::Constructor(JSContext* aCx,
     return nullptr;
   }
 
+  // From this point on (worker thread has been started) we
+  // must keep ourself alive. We can now only be cleared by
+  // ClearSelfRef().
+  worker->mSelfRef = worker;
+
   worker->EnableDebugger();
 
   RefPtr<CompileScriptRunnable> compiler =
@@ -4129,8 +4134,6 @@ WorkerPrivate::Constructor(JSContext* aCx,
     return nullptr;
   }
 
-  worker->mSelfRef = worker;
-
   return worker.forget();
 }
 

dom/xslt/xslt/txMozillaXMLOutput.cpp

@@ -236,19 +236,6 @@ txMozillaXMLOutput::endDocument(nsresult aResult)
         }
     }
 
-    if (!mRefreshString.IsEmpty()) {
-        nsPIDOMWindow *win = mDocument->GetWindow();
-        if (win) {
-            nsCOMPtr<nsIRefreshURI> refURI =
-                do_QueryInterface(win->GetDocShell());
-            if (refURI) {
-                refURI->SetupRefreshURIFromHeader(mDocument->GetDocBaseURI(),
-                                                  mDocument->NodePrincipal(),
-                                                  mRefreshString);
-            }
-        }
-    }
-
     if (mNotifier) {
         mNotifier->OnTransformEnd();
     }
@@ -747,30 +734,13 @@ txMozillaXMLOutput::endHTMLElement(nsIContent* aElement)
 
         return NS_OK;
     }
-    else if (mCreatingNewDocument && aElement->IsHTMLElement(nsGkAtoms::meta)) {
-        // handle HTTP-EQUIV data
-        nsAutoString httpEquiv;
-        aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, httpEquiv);
-        if (!httpEquiv.IsEmpty()) {
-            nsAutoString value;
-            aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::content, value);
-            if (!value.IsEmpty()) {
-                nsContentUtils::ASCIIToLower(httpEquiv);
-                nsCOMPtr<nsIAtom> header = do_GetAtom(httpEquiv);
-                processHTTPEquiv(header, value);
-            }
-        }
-    }
-    
+
     return NS_OK;
 }
 
 void txMozillaXMLOutput::processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue)
 {
-    // For now we only handle "refresh". There's a longer list in
-    // HTMLContentSink::ProcessHeaderData
-    if (aHeader == nsGkAtoms::refresh)
-        LossyCopyUTF16toASCII(aValue, mRefreshString);
+    MOZ_CRASH("Don't call processHTTPEquiv, see bug 1746720");
 }
 
 nsresult

dom/xslt/xslt/txMozillaXSLTProcessor.cpp

@@ -237,9 +237,10 @@ txToFragmentHandlerFactory::createHandlerWith(txOutputFormat* aFormat,
 class txVariable : public txIGlobalParameter
 {
 public:
-    explicit txVariable(nsIVariant* aValue) : mValue(aValue)
+    explicit txVariable(nsIVariant* aValue, txAExprResult* aTxValue)
+      : mValue(aValue), mTxValue(aTxValue)
     {
-        NS_ASSERTION(aValue, "missing value");
+        NS_ASSERTION(aValue && aTxValue, "missing value");
     }
     explicit txVariable(txAExprResult* aValue) : mTxValue(aValue)
     {
@@ -247,12 +248,7 @@ public:
     }
     nsresult getValue(txAExprResult** aValue)
     {
-        NS_ASSERTION(mValue || mTxValue, "variablevalue is null");
-
-        if (!mTxValue) {
-            nsresult rv = Convert(mValue, getter_AddRefs(mTxValue));
-            NS_ENSURE_SUCCESS(rv, rv);
-        }
+        NS_ASSERTION(mTxValue, "variablevalue is null");
 
         *aValue = mTxValue;
         NS_ADDREF(*aValue);
@@ -269,11 +265,11 @@ public:
     {
         return mValue;
     }
-    void setValue(nsIVariant* aValue)
+    void setValue(nsIVariant* aValue, txAExprResult* aTxValue)
     {
-        NS_ASSERTION(aValue, "setting variablevalue to null");
+        NS_ASSERTION(aValue && aTxValue, "setting variablevalue to null");
         mValue = aValue;
-        mTxValue = nullptr;
+        mTxValue = aTxValue;
     }
     void setValue(txAExprResult* aValue)
     {
@@ -282,14 +278,14 @@ public:
         mTxValue = aValue;
     }
 
+    static nsresult Convert(nsIVariant* aValue, txAExprResult** aResult);
+
     friend void ImplCycleCollectionUnlink(txVariable& aVariable);
     friend void ImplCycleCollectionTraverse(
         nsCycleCollectionTraversalCallback& aCallback, txVariable& aVariable,
         const char* aName, uint32_t aFlags);
 
 private:
-    static nsresult Convert(nsIVariant *aValue, txAExprResult** aResult);
-
     nsCOMPtr<nsIVariant> mValue;
     RefPtr<txAExprResult> mTxValue;
 };
@@ -949,13 +945,17 @@ txMozillaXSLTProcessor::SetParameter(const nsAString & aNamespaceURI,
     nsCOMPtr<nsIAtom> localName = do_GetAtom(aLocalName);
     txExpandedName varName(nsId, localName);
 
+    RefPtr<txAExprResult> txValue;
+    rv = txVariable::Convert(value, getter_AddRefs(txValue));
+    NS_ENSURE_SUCCESS(rv, rv);
+
     txVariable* var = static_cast<txVariable*>(mVariables.get(varName));
     if (var) {
-        var->setValue(value);
+        var->setValue(value, txValue);
         return NS_OK;
     }
 
-    var = new txVariable(value);
+    var = new txVariable(value, txValue);
     return mVariables.add(varName, var);
 }
 

gfx/2d/BaseRect.h

@@ -118,12 +118,36 @@ struct BaseRect {
     }
     return result;
   }
+  // Gives the same results as Intersect() but handles integer overflow
+  // better. This comes at a tiny cost in performance.
+  // e.g. {INT_MIN, 0, 0, 20} Intersect { 5000, 0, 500, 20 } gives:
+  // {5000, 0, 0, 0}
+  MOZ_WARN_UNUSED_RESULT Sub SafeIntersect(const Sub& aRect) const {
+    Sub result;
+    result.x = std::max<T>(x, aRect.x);
+    result.y = std::max<T>(y, aRect.y);
+    T right = std::min<T>(x + width, aRect.x + aRect.width);
+    T bottom = std::min<T>(y + height, aRect.y + aRect.height);
+    // See bug 1457110, this function expects to -only- size to 0,0 if the
+    // width/height is explicitly negative.
+    if (right < result.x || bottom < result.y) {
+      result.width = 0;
+      result.height = 0;
+    } else {
+      result.width = right - result.x;
+      result.height = bottom - result.y;
+    }
+    return result;
+  }
   // Sets *this to be the rectangle containing the intersection of the points
   // (including edges) of *this and aRect. If there are no points in that
   // intersection, sets *this to be an empty rectangle with x/y set to the std::max
   // of the x/y of *this and aRect.
   //
   // 'this' can be the same object as either aRect1 or aRect2
+  // Note: bug 1457110 changed this due to a regression from bug 1387399,
+  // but we never used that code, and it was subsequently backed out. We have
+  // SafeIntersect only so we can implement bug 1767365.
   bool IntersectRect(const Sub& aRect1, const Sub& aRect2)
   {
     *static_cast<Sub*>(this) = aRect1.Intersect(aRect2);
@@ -209,6 +233,39 @@ struct BaseRect {
   void SizeTo(T aWidth, T aHeight) { width = aWidth; height = aHeight; }
   void SizeTo(const SizeT& aSize) { width = aSize.width; height = aSize.height; }
 
+  // Variant of MoveBy that ensures that even after translation by a point that
+  // the rectangle coordinates will still fit within numeric limits. The origin
+  // and size will be clipped within numeric limits to ensure this.
+  void SafeMoveByX(T aDx) {
+    T x2 = XMost();
+    if (aDx >= T(0)) {
+      T limit = std::numeric_limits<T>::max();
+      x = limit - aDx < x ? limit : x + aDx;
+      width = (limit - aDx < x2 ? limit : x2 + aDx) - x;
+    } else {
+      T limit = std::numeric_limits<T>::min();
+      x = limit - aDx > x ? limit : x + aDx;
+      width = (limit - aDx > x2 ? limit : x2 + aDx) - x;
+    }
+  }
+  void SafeMoveByY(T aDy) {
+    T y2 = YMost();
+    if (aDy >= T(0)) {
+      T limit = std::numeric_limits<T>::max();
+      y = limit - aDy < y ? limit : y + aDy;
+      height = (limit - aDy < y2 ? limit : y2 + aDy) - y;
+    } else {
+      T limit = std::numeric_limits<T>::min();
+      y = limit - aDy > y ? limit : y + aDy;
+      height = (limit - aDy > y2 ? limit : y2 + aDy) - y;
+    }
+  }
+  void SafeMoveBy(T aDx, T aDy) {
+    SafeMoveByX(aDx);
+    SafeMoveByY(aDy);
+  }
+  void SafeMoveBy(const Point& aPoint) { SafeMoveBy(aPoint.x, aPoint.y); }
+
   void Inflate(T aD) { Inflate(aD, aD); }
   void Inflate(T aDx, T aDy)
   {

gfx/2d/DrawTargetCairo.cpp

@@ -262,6 +262,15 @@ cairo_surface_t* GetAsImageSurface(cairo_surface_t* aSurface)
   return nullptr;
 }
 
+// We're creating a subimage from the parent image's data (in aData) without
+// altering that data or its stride. This constrains the values in aRect, and
+// how they're used. Callers must see to it that the parent fully contains the
+// subimage. Here we ensure that no clipping is done in the X dimension at the
+// beginning of any line. (To do otherwise would require creating a copy of
+// aData from parts of every line in aData (from aRect.Y() to aRect.Height()),
+// and setting the copy to a different stride.) A non-zero aRect.X() is used
+// only to specify the subimage's location in its parent (via
+// cairo_surface_set_device_offset()). This change resolves bug 1719215.
 cairo_surface_t* CreateSubImageForData(unsigned char* aData,
                                        const IntRect& aRect,
                                        int aStride,
@@ -271,16 +280,14 @@ cairo_surface_t* CreateSubImageForData(unsigned char* aData,
     gfxWarning() << "DrawTargetCairo.CreateSubImageForData null aData";
     return nullptr;
   }
-  unsigned char *data = aData +
-                        aRect.y * aStride +
-                        aRect.x * BytesPerPixel(aFormat);
-
+  unsigned char* data = aData + aRect.y * aStride;
   cairo_surface_t *image =
     cairo_image_surface_create_for_data(data,
                                         GfxFormatToCairoFormat(aFormat),
                                         aRect.width,
                                         aRect.height,
                                         aStride);
+  // Set the subimage's location in its parent
   cairo_surface_set_device_offset(image, -aRect.x, -aRect.y);
   return image;
 }

gfx/2d/RecordedEvent.h

@@ -412,7 +412,7 @@ private:
   ReferencePtr mScaledFont;
   PatternStorage mPattern;
   DrawOptions mOptions;
-  Glyph *mGlyphs;
+  Glyph *mGlyphs = nullptr;
   uint32_t mNumGlyphs;
 };
 
@@ -746,7 +746,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  uint8_t *mData;
+  uint8_t *mData = nullptr;
   int32_t mStride;
   IntSize mSize;
   SurfaceFormat mFormat;
@@ -846,7 +846,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  GradientStop *mStops;
+  GradientStop *mStops = nullptr;
   uint32_t mNumStops;
   ExtendMode mExtendMode;
   bool mDataOwned;
@@ -907,7 +907,7 @@ public:
   }
 
   RecordedScaledFontCreation(ReferencePtr aRefPtr, ScaledFont *aScaledFont)
-    : RecordedEvent(SCALEDFONTCREATION), mRefPtr(aRefPtr), mData(nullptr)
+    : RecordedEvent(SCALEDFONTCREATION), mRefPtr(aRefPtr)
   {
     aScaledFont->GetFontFileData(&FontDataProc, this);
   }
@@ -928,7 +928,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  uint8_t *mData;
+  uint8_t *mData = nullptr;
   uint32_t mSize;
   Float mGlyphSize;
   uint32_t mIndex;

gfx/cairo/libpixman/src/pixman-trap.c

@@ -74,7 +74,7 @@ pixman_sample_floor_y (pixman_fixed_t y,
 
     if (f < Y_FRAC_FIRST (n))
     {
-	if (pixman_fixed_to_int (i) == 0x8000)
+	if (pixman_fixed_to_int (i) == 0xffff8000)
 	{
 	    f = 0; /* saturate */
 	}

gfx/ots/src/vdmx.cc

@@ -4,18 +4,23 @@
 
 #include "vdmx.h"
 
+#include <set>
+
 // VDMX - Vertical Device Metrics
 // http://www.microsoft.com/typography/otspec/vdmx.htm
 
 namespace ots {
 
+#define TABLE_NAME "VDMX"
+
 bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
   Buffer table(data, length);
+  ots::Font* font = this->GetFont();
 
   if (!table.ReadU16(&this->version) ||
       !table.ReadU16(&this->num_recs) ||
       !table.ReadU16(&this->num_ratios)) {
-    return Error("Failed to read table header");
+    return Drop("Failed to read table header");
   }
 
   if (this->version > 1) {
@@ -30,7 +35,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
         !table.ReadU8(&rec.x_ratio) ||
         !table.ReadU8(&rec.y_start_ratio) ||
         !table.ReadU8(&rec.y_end_ratio)) {
-      return Error("Failed to read RatioRange record %d", i);
+      return Drop("Failed to read RatioRange record %d", i);
     }
 
     if (rec.charset > 1) {
@@ -56,17 +61,28 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
 
   this->offsets.reserve(this->num_ratios);
   const size_t current_offset = table.offset();
+  std::set<uint16_t> unique_offsets;
   // current_offset is less than (2 bytes * 3) + (4 bytes * USHRT_MAX) = 256k.
   for (unsigned i = 0; i < this->num_ratios; ++i) {
     uint16_t offset;
     if (!table.ReadU16(&offset)) {
-      return Error("Failed to read ratio offset %d", i);
+      return Drop("Failed to read ratio offset %d", i);
     }
     if (current_offset + offset >= length) {  // thus doesn't overflow.
-      return Error("Bad ratio offset %d for ration %d", offset, i);
+      return Drop("Bad ratio offset %d for ration %d", offset, i);
     }
 
     this->offsets.push_back(offset);
+    unique_offsets.insert(offset);
+  }
+
+  // Check that num_recs is sufficient to provide as many VDMXGroup records
+  // as there are unique offsets; if not, update it (we'll return an error
+  // below if they're not actually present).
+  if (unique_offsets.size() > this->num_recs) {
+    OTS_WARNING("increasing num_recs (%u is too small for %u unique offsets)",
+                this->num_recs, unique_offsets.size());
+    this->num_recs = unique_offsets.size();
   }
 
   this->groups.reserve(this->num_recs);
@@ -75,7 +91,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
     if (!table.ReadU16(&group.recs) ||
         !table.ReadU8(&group.startsz) ||
         !table.ReadU8(&group.endsz)) {
-      return Error("Failed to read record header %d", i);
+      return Drop("Failed to read record header %d", i);
     }
     group.entries.reserve(group.recs);
     for (unsigned j = 0; j < group.recs; ++j) {
@@ -83,7 +99,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
       if (!table.ReadU16(&vt.y_pel_height) ||
           !table.ReadS16(&vt.y_max) ||
           !table.ReadS16(&vt.y_min)) {
-        return Error("Failed to read reacord %d group %d", i, j);
+        return Drop("Failed to read record %d group %d", i, j);
       }
       if (vt.y_max < vt.y_min) {
         return Drop("bad y min/max");
@@ -152,4 +168,6 @@ bool OpenTypeVDMX::Serialize(OTSStream *out) {
   return true;
 }
 
+#undef TABLE_NAME
+
 }  // namespace ots

gfx/thebes/gfxFontEntry.cpp

@@ -1573,6 +1573,12 @@ gfxFontFamily::FindFontForChar(GlobalFontMatch *aMatchData)
 void
 gfxFontFamily::SearchAllFontsForChar(GlobalFontMatch *aMatchData)
 {
+    if (!mFamilyCharacterMapInitialized) {
+      ReadAllCMAPs();
+    }
+    if (!mFamilyCharacterMap.test(aMatchData->mCh)) {
+      return;
+    }
     uint32_t i, numFonts = mAvailableFonts.Length();
     for (i = 0; i < numFonts; i++) {
         gfxFontEntry *fe = mAvailableFonts[i];

gfx/thebes/gfxPlatformMac.cpp

@@ -297,15 +297,28 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     // Start with leftmost, using hostname as a screen (TenFourFox issue 492).
 
+                    HTTP_OR_HTTPS_SUBDIR("www.tagesschau.de", "/resources/assets/fonts/TheSansC5s");
+
+                    HTTP_OR_HTTPS_SUBDIR("assets.tagesspiegel.de", "/fonts/Abril_Text_");
+                    HTTP_OR_HTTPS_SUBDIR("assets.tagesspiegel.de", "/fonts/franklingothic-");
+
                     HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/ea/notosansjapanese/v6/NotoSansJP-");
                     HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/notosansjp/v14/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/pressstart2p/v9/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/sourceserifpro/v17/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/oswald/v53/");
 
+
+                    HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/SFUIText-");
                     HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/current/fonts/SFNSText-");
                     HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/current/fonts/SFNSDisplay-");
 
+
                     HTTP_OR_HTTPS_SUBDIR("typeface.nyt.com", "/fonts/nyt-cheltenham-");
                     HTTP_OR_HTTPS_SUBDIR("typeface.nytimes.com", "/fonts/nyt-cheltenham-");
 
+                    HTTP_OR_HTTPS_SUBDIR("www.washingtonpost.com", "/wp-stat/assets/fonts/PostoniWide-");
+
                     // Don't cut to SF-Pro-; there are some dingbat fonts that DO work.
                     HTTP_OR_HTTPS_SUBDIR("www.apple.com", "/wss/fonts/SF-Pro-JP/v1/");
                     HTTP_OR_HTTPS_SUBDIR("www.apple.com", "/wss/fonts/SF-Pro-Text/v1/");
@@ -329,8 +342,9 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     HTTP_OR_HTTPS_SUBDIR("www.vetmed.fu-berlin.de", "/assets/default2/NexusSansWeb-P");
 
-                    HTTP_OR_HTTPS_SUBDIR("cdn.theatlantic.com", "/assets/static/a/frontend/dist/theatlantic/fonts/garamond/AGaramondPro");
-                    HTTP_OR_HTTPS_SUBDIR("cdn.theatlantic.com", "/assets/static/a/frontend/dist/theatlantic/fonts/atlantic-serif/Atlantic-Serif");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/garamond/AGaramondPro");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/goldwyn/goldwyn");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/atlantic/Atlantic-Serif");
 
                     HTTP_OR_HTTPS_SUBDIR("www.kulturstiftung-des-bundes.de", "/typo3conf/ext/base_ksb/Resources/Public/");
 
@@ -340,6 +354,8 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     HTTP_OR_HTTPS_SUBDIR("hartzfacts.de", "/google-fonts/s/notoseriftc/v7/");
 
+                    HTTP_OR_HTTPS_SUBDIR("som.yale.edu","/themes/custom/som/fonts/neuehaasunica/NeueHaasUnicaBlack");
+
                     // Check hostname and subpatterns (TenFourFox issue 477).
                     HOST_AND_KEY("www.latimes.com", "/fonts/KisFBDisplay-");
                     HOST_AND_KEY("www.nerdwallet.com", "Gotham-Book--critical");

image/imgLoader.h

@@ -41,34 +41,10 @@ class ImageURL;
 class imgCacheEntry
 {
 public:
+  NS_INLINE_DECL_REFCOUNTING(imgCacheEntry)
+
   imgCacheEntry(imgLoader* loader, imgRequest* request,
                 bool aForcePrincipalCheck);
-  ~imgCacheEntry();
-
-  nsrefcnt AddRef()
-  {
-    NS_PRECONDITION(int32_t(mRefCnt) >= 0, "illegal refcnt");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry addref isn't thread-safe!");
-    ++mRefCnt;
-    NS_LOG_ADDREF(this, mRefCnt, "imgCacheEntry", sizeof(*this));
-    return mRefCnt;
-  }
-
-  nsrefcnt Release()
-  {
-    NS_PRECONDITION(0 != mRefCnt, "dup release");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry release isn't thread-safe!");
-    --mRefCnt;
-    NS_LOG_RELEASE(this, mRefCnt, "imgCacheEntry");
-    if (mRefCnt == 0) {
-      mRefCnt = 1; /* stabilize */
-      delete this;
-      return 0;
-    }
-    return mRefCnt;
-  }
 
   uint32_t GetDataSize() const
   {
@@ -162,11 +138,9 @@ private: // methods
 
   // Private, unimplemented copy constructor.
   imgCacheEntry(const imgCacheEntry&);
+  ~imgCacheEntry();
 
 private: // data
-  nsAutoRefCnt mRefCnt;
-  NS_DECL_OWNINGTHREAD
-
   imgLoader* mLoader;
   RefPtr<imgRequest> mRequest;
   uint32_t mDataSize;

intl/icu/source/data/misc/metaZones.txt

@@ -305,9 +305,7 @@ metaZones:table(nofallback){
             EG{"Africa/Cairo"}
             FI{"Europe/Helsinki"}
             GR{"Europe/Athens"}
-            JO{"Asia/Amman"}
             LB{"Asia/Beirut"}
-            SY{"Asia/Damascus"}
         }
         Europe_Further_Eastern{
             001{"Europe/Minsk"}
@@ -708,9 +706,170 @@ metaZones:table(nofallback){
             001{"Asia/Yerevan"}
         }
         Yukon{
-            001{"America/Yakutat"}
+            001{"America/Whitehorse"}
         }
     }
+    metazoneIds{
+        acre{"Acre"}
+        afce{"Africa_Central"}
+        afea{"Africa_Eastern"}
+        afgh{"Afghanistan"}
+        afso{"Africa_Southern"}
+        afwe{"Africa_Western"}
+        alam{"Almaty"}
+        alas{"Alaska"}
+        amaz{"Amazon"}
+        amce{"America_Central"}
+        amea{"America_Eastern"}
+        ammo{"America_Mountain"}
+        ampa{"America_Pacific"}
+        anad{"Anadyr"}
+        apia{"Apia"}
+        aqta{"Aqtau"}
+        aqto{"Aqtobe"}
+        arab{"Arabian"}
+        arge{"Argentina"}
+        arme{"Armenia"}
+        arwe{"Argentina_Western"}
+        atla{"Atlantic"}
+        auce{"Australia_Central"}
+        aucw{"Australia_CentralWestern"}
+        auea{"Australia_Eastern"}
+        auwe{"Australia_Western"}
+        azer{"Azerbaijan"}
+        azor{"Azores"}
+        bang{"Bangladesh"}
+        bhut{"Bhutan"}
+        boli{"Bolivia"}
+        bras{"Brasilia"}
+        brun{"Brunei"}
+        case{"Casey"}
+        cave{"Cape_Verde"}
+        cham{"Chamorro"}
+        chat{"Chatham"}
+        chil{"Chile"}
+        chin{"China"}
+        choi{"Choibalsan"}
+        chri{"Christmas"}
+        coco{"Cocos"}
+        colo{"Colombia"}
+        cook{"Cook"}
+        cuba{"Cuba"}
+        davi{"Davis"}
+        dumo{"DumontDUrville"}
+        east{"Easter"}
+        eati{"East_Timor"}
+        ecua{"Ecuador"}
+        euce{"Europe_Central"}
+        euea{"Europe_Eastern"}
+        eufe{"Europe_Further_Eastern"}
+        euwe{"Europe_Western"}
+        falk{"Falkland"}
+        fiji{"Fiji"}
+        frgu{"French_Guiana"}
+        frso{"French_Southern"}
+        gala{"Galapagos"}
+        gamb{"Gambier"}
+        geor{"Georgia"}
+        giis{"Gilbert_Islands"}
+        grea{"Greenland_Eastern"}
+        grwe{"Greenland_Western"}
+        guam{"Guam"}
+        gulf{"Gulf"}
+        guya{"Guyana"}
+        haal{"Hawaii_Aleutian"}
+        hoko{"Hong_Kong"}
+        hovd{"Hovd"}
+        ince{"Indonesia_Central"}
+        indi{"India"}
+        indo{"Indochina"}
+        inea{"Indonesia_Eastern"}
+        inoc{"Indian_Ocean"}
+        inwe{"Indonesia_Western"}
+        iran{"Iran"}
+        irku{"Irkutsk"}
+        isra{"Israel"}
+        japa{"Japan"}
+        kaea{"Kazakhstan_Eastern"}
+        kamc{"Kamchatka"}
+        kawe{"Kazakhstan_Western"}
+        kore{"Korea"}
+        kosr{"Kosrae"}
+        kras{"Krasnoyarsk"}
+        kyrg{"Kyrgystan"}
+        lank{"Lanka"}
+        liis{"Line_Islands"}
+        loho{"Lord_Howe"}
+        maca{"Macau"}
+        macq{"Macquarie"}
+        maga{"Magadan"}
+        mais{"Marshall_Islands"}
+        mala{"Malaysia"}
+        mald{"Maldives"}
+        marq{"Marquesas"}
+        maur{"Mauritius"}
+        maws{"Mawson"}
+        meno{"Mexico_Northwest"}
+        mepa{"Mexico_Pacific"}
+        mgmt{"GMT"}
+        mong{"Mongolia"}
+        mosc{"Moscow"}
+        myan{"Myanmar"}
+        naur{"Nauru"}
+        neca{"New_Caledonia"}
+        nepa{"Nepal"}
+        newf{"Newfoundland"}
+        neze{"New_Zealand"}
+        niue{"Niue"}
+        noma{"North_Mariana"}
+        norf{"Norfolk"}
+        noro{"Noronha"}
+        novo{"Novosibirsk"}
+        omsk{"Omsk"}
+        paki{"Pakistan"}
+        pala{"Palau"}
+        pang{"Papua_New_Guinea"}
+        para{"Paraguay"}
+        peru{"Peru"}
+        phil{"Philippines"}
+        phis{"Phoenix_Islands"}
+        pimi{"Pierre_Miquelon"}
+        pitc{"Pitcairn"}
+        pona{"Ponape"}
+        pyon{"Pyongyang"}
+        qyzy{"Qyzylorda"}
+        reun{"Reunion"}
+        roth{"Rothera"}
+        sakh{"Sakhalin"}
+        sama{"Samara"}
+        samo{"Samoa"}
+        seyc{"Seychelles"}
+        sing{"Singapore"}
+        soge{"South_Georgia"}
+        solo{"Solomon"}
+        suri{"Suriname"}
+        syow{"Syowa"}
+        tahi{"Tahiti"}
+        taip{"Taipei"}
+        taji{"Tajikistan"}
+        toke{"Tokelau"}
+        tong{"Tonga"}
+        truk{"Truk"}
+        turk{"Turkmenistan"}
+        tuva{"Tuvalu"}
+        urug{"Uruguay"}
+        uzbe{"Uzbekistan"}
+        vanu{"Vanuatu"}
+        vene{"Venezuela"}
+        vlad{"Vladivostok"}
+        volg{"Volgograd"}
+        vost{"Vostok"}
+        wake{"Wake"}
+        wall{"Wallis"}
+        yaku{"Yakutsk"}
+        yeka{"Yekaterinburg"}
+        yuko{"Yukon"}
+    }
     metazoneInfo{
         "Africa:Abidjan"{
             {
@@ -896,6 +1055,11 @@ metaZones:table(nofallback){
             {
                 "Africa_Eastern",
                 "2000-01-15 10:00",
+                "2021-01-31 21:00",
+            }
+            {
+                "Africa_Central",
+                "2021-01-31 21:00",
                 "9999-12-31 23:59",
             }
         }
@@ -1127,11 +1291,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 11:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 11:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -1494,6 +1653,33 @@ metaZones:table(nofallback){
             {
                 "Mexico_Pacific",
                 "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
+                "9999-12-31 23:59",
+            }
+        }
+        "America:Ciudad_Juarez"{
+            {
+                "America_Central",
+                "1970-01-01 00:00",
+                "1998-04-05 09:00",
+            }
+            {
+                "Mexico_Pacific",
+                "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
+                "2022-11-30 06:00",
+            }
+            {
+                "America_Mountain",
+                "2022-11-30 06:00",
                 "9999-12-31 23:59",
             }
         }
@@ -1547,19 +1733,14 @@ metaZones:table(nofallback){
             }
         }
         "America:Dawson"{
-            {
-                "Yukon",
-                "1970-01-01 00:00",
-                "1973-10-28 09:00",
-            }
             {
                 "America_Pacific",
                 "1973-10-28 09:00",
-                "2020-03-08 10:00",
+                "2020-11-01 07:00",
             }
             {
-                "America_Mountain",
-                "2020-03-08 10:00",
+                "Yukon",
+                "2020-11-01 07:00",
                 "9999-12-31 23:59",
             }
         }
@@ -1665,11 +1846,11 @@ metaZones:table(nofallback){
             {
                 "America_Eastern",
                 "1970-01-01 00:00",
-                "2015-11-01 06:00",
+                "2015-03-08 07:00",
             }
             {
                 "Atlantic",
-                "2015-11-01 06:00",
+                "2015-03-08 07:00",
                 "2018-03-11 07:00",
             }
             {
@@ -1889,21 +2070,11 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1980-04-27 10:00",
             }
-            {
-                "Yukon",
-                "1980-04-27 10:00",
-                "1980-10-26 10:00",
-            }
             {
                 "America_Pacific",
                 "1980-10-26 10:00",
                 "1983-10-30 09:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 09:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2164,11 +2335,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 12:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 12:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2225,6 +2391,11 @@ metaZones:table(nofallback){
             {
                 "America_Mountain",
                 "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
                 "9999-12-31 23:59",
             }
         }
@@ -2234,14 +2405,9 @@ metaZones:table(nofallback){
             }
         }
         "America:Pangnirtung"{
-            {
-                "Atlantic",
-                "1970-01-01 00:00",
-                "1995-04-02 06:00",
-            }
             {
                 "America_Eastern",
-                "1995-04-02 06:00",
+                "1970-01-01 00:00",
                 "1999-10-31 06:00",
             }
             {
@@ -2442,11 +2608,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 09:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 09:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2534,11 +2695,11 @@ metaZones:table(nofallback){
             {
                 "America_Pacific",
                 "1970-01-01 00:00",
-                "2020-03-08 10:00",
+                "2020-11-01 07:00",
             }
             {
-                "America_Mountain",
-                "2020-03-08 10:00",
+                "Yukon",
+                "2020-11-01 07:00",
                 "9999-12-31 23:59",
             }
         }
@@ -2548,11 +2709,6 @@ metaZones:table(nofallback){
             }
         }
         "America:Yakutat"{
-            {
-                "Yukon",
-                "1970-01-01 00:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2598,6 +2754,31 @@ metaZones:table(nofallback){
             {
                 "Australia_Western",
                 "2018-03-10 17:00",
+                "2018-10-06 20:00",
+            }
+            {
+                "Casey",
+                "2018-10-06 20:00",
+                "2019-03-16 16:00",
+            }
+            {
+                "Australia_Western",
+                "2019-03-16 16:00",
+                "2019-10-03 19:00",
+            }
+            {
+                "Casey",
+                "2019-10-03 19:00",
+                "2020-03-07 16:00",
+            }
+            {
+                "Australia_Western",
+                "2020-03-07 16:00",
+                "2020-10-03 16:01",
+            }
+            {
+                "Casey",
+                "2020-10-03 16:01",
                 "9999-12-31 23:59",
             }
         }
@@ -2614,13 +2795,6 @@ metaZones:table(nofallback){
         "Antarctica:Macquarie"{
             {
                 "Australia_Eastern",
-                "1970-01-01 00:00",
-                "2010-04-03 16:00",
-            }
-            {
-                "Macquarie",
-                "2010-04-03 16:00",
-                "9999-12-31 23:59",
             }
         }
         "Antarctica:Mawson"{
@@ -2690,6 +2864,8 @@ metaZones:table(nofallback){
         "Asia:Amman"{
             {
                 "Europe_Eastern",
+                "1970-01-01 00:00",
+                "2022-10-27 22:00",
             }
         }
         "Asia:Anadyr"{
@@ -2877,6 +3053,8 @@ metaZones:table(nofallback){
         "Asia:Damascus"{
             {
                 "Europe_Eastern",
+                "1970-01-01 00:00",
+                "2022-10-27 21:00",
             }
         }
         "Asia:Dhaka"{
@@ -3984,16 +4162,11 @@ metaZones:table(nofallback){
             {
                 "Moscow",
                 "1970-01-01 00:00",
-                "1990-06-30 23:00",
-            }
-            {
-                "Europe_Central",
-                "1990-06-30 23:00",
-                "1991-03-31 02:00",
+                "1990-06-30 22:00",
             }
             {
                 "Europe_Eastern",
-                "1991-03-31 02:00",
+                "1990-06-30 22:00",
                 "9999-12-31 23:59",
             }
         }
@@ -4037,18 +4210,6 @@ metaZones:table(nofallback){
         "Europe:Volgograd"{
             {
                 "Volgograd",
-                "1970-01-01 00:00",
-                "1992-03-28 22:00",
-            }
-            {
-                "Moscow",
-                "1992-03-28 22:00",
-                "2018-10-27 23:00",
-            }
-            {
-                "Volgograd",
-                "2018-10-27 23:00",
-                "9999-12-31 23:59",
             }
         }
         "Europe:Warsaw"{
@@ -4065,11 +4226,11 @@ metaZones:table(nofallback){
             {
                 "Moscow",
                 "1970-01-01 00:00",
-                "1991-03-30 23:00",
+                "1990-06-30 22:00",
             }
             {
                 "Europe_Eastern",
-                "1991-03-30 23:00",
+                "1990-06-30 22:00",
                 "9999-12-31 23:59",
             }
         }

intl/icu/source/data/misc/timezoneTypes.txt

@@ -5,12 +5,47 @@ timezoneTypes:table(nofallback){
     bcpTypeAlias{
         tz{
             aqams{"nzakl"}
+            aukns{"auhba"}
+            caffs{"cawnp"}
+            camtr{"cator"}
+            canpg{"cator"}
+            capnt{"caiql"}
+            cathu{"cator"}
+            cayzf{"caedm"}
             cnckg{"cnsha"}
             cnhrb{"cnsha"}
             cnkhg{"cnurc"}
+            gaza{"gazastrp"}
+            mxstis{"mxtij"}
+            uaozh{"uaiev"}
+            uauzh{"uaiev"}
+            umjon{"ushnl"}
             usnavajo{"usden"}
         }
     }
+    ianaMap{
+        timezone{
+            "Africa:Asmera"{"Africa/Asmara"}
+            "America:Buenos_Aires"{"America/Argentina/Buenos_Aires"}
+            "America:Catamarca"{"America/Argentina/Catamarca"}
+            "America:Coral_Harbour"{"America/Atikokan"}
+            "America:Cordoba"{"America/Argentina/Cordoba"}
+            "America:Godthab"{"America/Nuuk"}
+            "America:Indianapolis"{"America/Indiana/Indianapolis"}
+            "America:Jujuy"{"America/Argentina/Jujuy"}
+            "America:Louisville"{"America/Kentucky/Louisville"}
+            "America:Mendoza"{"America/Argentina/Mendoza"}
+            "Asia:Calcutta"{"Asia/Kolkata"}
+            "Asia:Katmandu"{"Asia/Kathmandu"}
+            "Asia:Rangoon"{"Asia/Yangon"}
+            "Asia:Saigon"{"Asia/Ho_Chi_Minh"}
+            "Atlantic:Faeroe"{"Atlantic/Faroe"}
+            "Europe:Kiev"{"Europe/Kyiv"}
+            "Pacific:Enderbury"{"Pacific/Kanton"}
+            "Pacific:Ponape"{"Pacific/Pohnpei"}
+            "Pacific:Truk"{"Pacific/Chuuk"}
+        }
+    }
     typeAlias{
         timezone{
             "Africa:Asmara"{"Africa/Asmera"}
@@ -28,11 +63,18 @@ timezoneTypes:table(nofallback){
             "America:Indiana:Indianapolis"{"America/Indianapolis"}
             "America:Kentucky:Louisville"{"America/Louisville"}
             "America:Knox_IN"{"America/Indiana/Knox"}
+            "America:Montreal"{"America/Toronto"}
+            "America:Nipigon"{"America/Toronto"}
             "America:Nuuk"{"America/Godthab"}
+            "America:Pangnirtung"{"America/Iqaluit"}
             "America:Porto_Acre"{"America/Rio_Branco"}
+            "America:Rainy_River"{"America/Winnipeg"}
             "America:Rosario"{"America/Cordoba"}
+            "America:Santa_Isabel"{"America/Tijuana"}
             "America:Shiprock"{"America/Denver"}
+            "America:Thunder_Bay"{"America/Toronto"}
             "America:Virgin"{"America/St_Thomas"}
+            "America:Yellowknife"{"America/Edmonton"}
             "Antarctica:South_Pole"{"Pacific/Auckland"}
             "Asia:Ashkhabad"{"Asia/Ashgabat"}
             "Asia:Chongqing"{"Asia/Shanghai"}
@@ -54,6 +96,7 @@ timezoneTypes:table(nofallback){
             "Atlantic:Jan_Mayen"{"Arctic/Longyearbyen"}
             "Australia:ACT"{"Australia/Sydney"}
             "Australia:Canberra"{"Australia/Sydney"}
+            "Australia:Currie"{"Australia/Hobart"}
             "Australia:LHI"{"Australia/Lord_Howe"}
             "Australia:NSW"{"Australia/Sydney"}
             "Australia:North"{"Australia/Darwin"}
@@ -86,12 +129,17 @@ timezoneTypes:table(nofallback){
             "Etc:Universal"{"Etc/UTC"}
             "Etc:Zulu"{"Etc/UTC"}
             "Europe:Belfast"{"Europe/London"}
+            "Europe:Kyiv"{"Europe/Kiev"}
             "Europe:Nicosia"{"Asia/Nicosia"}
             "Europe:Tiraspol"{"Europe/Chisinau"}
+            "Europe:Uzhgorod"{"Europe/Kiev"}
+            "Europe:Zaporozhye"{"Europe/Kiev"}
             "Mexico:BajaNorte"{"America/Tijuana"}
             "Mexico:BajaSur"{"America/Mazatlan"}
             "Mexico:General"{"America/Mexico_City"}
             "Pacific:Chuuk"{"Pacific/Truk"}
+            "Pacific:Johnston"{"Pacific/Honolulu"}
+            "Pacific:Kanton"{"Pacific/Enderbury"}
             "Pacific:Pohnpei"{"Pacific/Ponape"}
             "Pacific:Samoa"{"Pacific/Pago_Pago"}
             "Pacific:Yap"{"Pacific/Truk"}
@@ -233,6 +281,7 @@ timezoneTypes:table(nofallback){
             "America:Cayman"{"kygec"}
             "America:Chicago"{"uschi"}
             "America:Chihuahua"{"mxchi"}
+            "America:Ciudad_Juarez"{"mxcjs"}
             "America:Coral_Harbour"{"cayzs"}
             "America:Cordoba"{"arcor"}
             "America:Costa_Rica"{"crsjo"}
@@ -298,11 +347,9 @@ timezoneTypes:table(nofallback){
             "America:Moncton"{"camon"}
             "America:Monterrey"{"mxmty"}
             "America:Montevideo"{"uymvd"}
-            "America:Montreal"{"camtr"}
             "America:Montserrat"{"msmni"}
             "America:Nassau"{"bsnas"}
             "America:New_York"{"usnyc"}
-            "America:Nipigon"{"canpg"}
             "America:Nome"{"usome"}
             "America:Noronha"{"brfen"}
             "America:North_Dakota:Beulah"{"usxul"}
@@ -310,7 +357,6 @@ timezoneTypes:table(nofallback){
             "America:North_Dakota:New_Salem"{"usndnsl"}
             "America:Ojinaga"{"mxoji"}
             "America:Panama"{"papty"}
-            "America:Pangnirtung"{"capnt"}
             "America:Paramaribo"{"srpbm"}
             "America:Phoenix"{"usphx"}
             "America:Port-au-Prince"{"htpap"}
@@ -318,13 +364,11 @@ timezoneTypes:table(nofallback){
             "America:Porto_Velho"{"brpvh"}
             "America:Puerto_Rico"{"prsju"}
             "America:Punta_Arenas"{"clpuq"}
-            "America:Rainy_River"{"caffs"}
             "America:Rankin_Inlet"{"cayek"}
             "America:Recife"{"brrec"}
             "America:Regina"{"careg"}
             "America:Resolute"{"careb"}
             "America:Rio_Branco"{"brrbr"}
-            "America:Santa_Isabel"{"mxstis"}
             "America:Santarem"{"brstm"}
             "America:Santiago"{"clscl"}
             "America:Santo_Domingo"{"dosdq"}
@@ -340,7 +384,6 @@ timezoneTypes:table(nofallback){
             "America:Swift_Current"{"cayyn"}
             "America:Tegucigalpa"{"hntgu"}
             "America:Thule"{"glthu"}
-            "America:Thunder_Bay"{"cathu"}
             "America:Tijuana"{"mxtij"}
             "America:Toronto"{"cator"}
             "America:Tortola"{"vgtov"}
@@ -348,7 +391,6 @@ timezoneTypes:table(nofallback){
             "America:Whitehorse"{"cayxy"}
             "America:Winnipeg"{"cawnp"}
             "America:Yakutat"{"usyak"}
-            "America:Yellowknife"{"cayzf"}
             "Antarctica:Casey"{"aqcas"}
             "Antarctica:Davis"{"aqdav"}
             "Antarctica:DumontDUrville"{"aqddu"}
@@ -387,7 +429,7 @@ timezoneTypes:table(nofallback){
             "Asia:Dubai"{"aedxb"}
             "Asia:Dushanbe"{"tjdyu"}
             "Asia:Famagusta"{"cyfmg"}
-            "Asia:Gaza"{"gaza"}
+            "Asia:Gaza"{"gazastrp"}
             "Asia:Hebron"{"hebron"}
             "Asia:Hong_Kong"{"hkhkg"}
             "Asia:Hovd"{"mnhvd"}
@@ -457,7 +499,6 @@ timezoneTypes:table(nofallback){
             "Australia:Adelaide"{"auadl"}
             "Australia:Brisbane"{"aubne"}
             "Australia:Broken_Hill"{"aubhq"}
-            "Australia:Currie"{"aukns"}
             "Australia:Darwin"{"audrw"}
             "Australia:Eucla"{"aueuc"}
             "Australia:Hobart"{"auhba"}
@@ -545,7 +586,6 @@ timezoneTypes:table(nofallback){
             "Europe:Tallinn"{"eetll"}
             "Europe:Tirane"{"altia"}
             "Europe:Ulyanovsk"{"ruuly"}
-            "Europe:Uzhgorod"{"uauzh"}
             "Europe:Vaduz"{"livdz"}
             "Europe:Vatican"{"vavat"}
             "Europe:Vienna"{"atvie"}
@@ -553,7 +593,6 @@ timezoneTypes:table(nofallback){
             "Europe:Volgograd"{"ruvog"}
             "Europe:Warsaw"{"plwaw"}
             "Europe:Zagreb"{"hrzag"}
-            "Europe:Zaporozhye"{"uaozh"}
             "Europe:Zurich"{"chzrh"}
             "Indian:Antananarivo"{"mgtnr"}
             "Indian:Chagos"{"iodga"}
@@ -581,7 +620,6 @@ timezoneTypes:table(nofallback){
             "Pacific:Guadalcanal"{"sbhir"}
             "Pacific:Guam"{"gugum"}
             "Pacific:Honolulu"{"ushnl"}
-            "Pacific:Johnston"{"umjon"}
             "Pacific:Kiritimati"{"kicxi"}
             "Pacific:Kosrae"{"fmksa"}
             "Pacific:Kwajalein"{"mhkwa"}

intl/icu/source/data/misc/windowsZones.txt

@@ -157,7 +157,7 @@ windowsZones:table(nofallback){
         }
         "Central Pacific Standard Time"{
             001{"Pacific/Guadalcanal"}
-            AU{"Antarctica/Macquarie"}
+            AQ{"Antarctica/Casey"}
             FM{"Pacific/Ponape Pacific/Kosrae"}
             NC{"Pacific/Noumea"}
             SB{"Pacific/Guadalcanal"}
@@ -168,7 +168,7 @@ windowsZones:table(nofallback){
             001{"America/Mexico_City"}
             MX{
                 "America/Mexico_City America/Bahia_Banderas America/Merida America/Mo"
-                "nterrey"
+                "nterrey America/Chihuahua "
             }
         }
         "Central Standard Time"{
@@ -177,7 +177,7 @@ windowsZones:table(nofallback){
                 "America/Winnipeg America/Rainy_River America/Rankin_Inlet America/Re"
                 "solute"
             }
-            MX{"America/Matamoros"}
+            MX{"America/Matamoros America/Ojinaga"}
             US{
                 "America/Chicago America/Indiana/Knox America/Indiana/Tell_City Ameri"
                 "ca/Menominee America/North_Dakota/Beulah America/North_Dakota/Center"
@@ -213,7 +213,6 @@ windowsZones:table(nofallback){
             KM{"Indian/Comoro"}
             MG{"Indian/Antananarivo"}
             SO{"Africa/Mogadishu"}
-            SS{"Africa/Juba"}
             TZ{"Africa/Dar_es_Salaam"}
             UG{"Africa/Kampala"}
             YT{"Indian/Mayotte"}
@@ -305,6 +304,7 @@ windowsZones:table(nofallback){
             BF{"Africa/Ouagadougou"}
             CI{"Africa/Abidjan"}
             GH{"Africa/Accra"}
+            GL{"America/Danmarkshavn"}
             GM{"Africa/Banjul"}
             GN{"Africa/Conakry"}
             GW{"Africa/Bissau"}
@@ -398,8 +398,8 @@ windowsZones:table(nofallback){
             MA{"Africa/Casablanca"}
         }
         "Mountain Standard Time (Mexico)"{
-            001{"America/Chihuahua"}
-            MX{"America/Chihuahua America/Mazatlan"}
+            001{"America/Mazatlan"}
+            MX{"America/Mazatlan"}
         }
         "Mountain Standard Time"{
             001{"America/Denver"}
@@ -407,7 +407,7 @@ windowsZones:table(nofallback){
                 "America/Edmonton America/Cambridge_Bay America/Inuvik America/Yellow"
                 "knife"
             }
-            MX{"America/Ojinaga"}
+            MX{"America/Ciudad_Juarez"}
             US{"America/Denver America/Boise"}
             ZZ{"MST7MDT"}
         }
@@ -594,7 +594,6 @@ windowsZones:table(nofallback){
         }
         "Singapore Standard Time"{
             001{"Asia/Singapore"}
-            AQ{"Antarctica/Casey"}
             BN{"Asia/Brunei"}
             ID{"Asia/Makassar"}
             MY{"Asia/Kuala_Lumpur Asia/Kuching"}
@@ -617,6 +616,10 @@ windowsZones:table(nofallback){
             ZW{"Africa/Harare"}
             ZZ{"Etc/GMT-2"}
         }
+        "South Sudan Standard Time"{
+            001{"Africa/Juba"}
+            SS{"Africa/Juba"}
+        }
         "Sri Lanka Standard Time"{
             001{"Asia/Colombo"}
             LK{"Asia/Colombo"}
@@ -635,7 +638,7 @@ windowsZones:table(nofallback){
         }
         "Tasmania Standard Time"{
             001{"Australia/Hobart"}
-            AU{"Australia/Hobart Australia/Currie"}
+            AU{"Australia/Hobart Australia/Currie Antarctica/Macquarie"}
         }
         "Tocantins Standard Time"{
             001{"America/Araguaina"}
@@ -675,18 +678,14 @@ windowsZones:table(nofallback){
         }
         "US Mountain Standard Time"{
             001{"America/Phoenix"}
-            CA{
-                "America/Whitehorse America/Creston America/Dawson America/Dawson_Cre"
-                "ek America/Fort_Nelson"
-            }
+            CA{"America/Creston America/Dawson_Creek America/Fort_Nelson"}
             MX{"America/Hermosillo"}
             US{"America/Phoenix"}
             ZZ{"Etc/GMT+7"}
         }
         "UTC"{
-            001{"Etc/GMT"}
-            GL{"America/Danmarkshavn"}
-            ZZ{"Etc/GMT Etc/UTC"}
+            001{"Etc/UTC"}
+            ZZ{"Etc/UTC Etc/GMT"}
         }
         "UTC+12"{
             001{"Etc/GMT-12"}
@@ -815,5 +814,9 @@ windowsZones:table(nofallback){
             001{"Asia/Yakutsk"}
             RU{"Asia/Yakutsk Asia/Khandyga"}
         }
+        "Yukon Standard Time"{
+            001{"America/Whitehorse"}
+            CA{"America/Whitehorse America/Dawson"}
+        }
     }
 }

js/src/jit-test/tests/errors/bug1810711.js

@@ -0,0 +1,13 @@
+var g = newGlobal({newCompartment: true});
+
+try {
+  undef()
+} catch (err) {
+  const handler = { "getPrototypeOf": (x) => () => x };
+  const proxy = new g.Proxy(err, handler);
+  try {
+    proxy.stack
+/* odds are we weren't exploitable because we don't support pure catch,
+   but now it's not a problem */
+  } catch(e) {}
+}

js/src/jit-test/tests/ion/bug1814899.js

@@ -0,0 +1,23 @@
+function bar(x) {
+  with ({}) {}
+  switch (x) {
+  case 1:
+    foo(2);
+    break;
+  case 2:
+    gczeal(14, 1);
+    break;
+  }
+  return "a sufficiently long string";
+}
+
+function foo(x) {
+  for (var s in bar(x)) { gczeal(0); }
+}
+
+with ({}) {}
+for (var i = 0; i < 100; i++) {
+  foo(0);
+}
+foo(1);
+

js/src/jit/InstructionReordering.cpp

@@ -130,6 +130,8 @@ jit::ReorderInstructions(MIRGenerator* mir, MIRGraph& graph)
                 MInstruction* prev = *riter;
                 if (prev->isInterruptCheck())
                     break;
+                if (prev->isSetInitializedLength())
+                    break;
 
                 // The instruction can't be moved before any of its uses.
                 bool isUse = false;

js/src/jit/JitFrames.cpp

@@ -1949,9 +1949,15 @@ SnapshotIterator::allocationValue(const RValueAllocation& alloc, ReadMethod rm)
         } pun;
         MOZ_ASSERT(alloc.fpuReg().isSingle());
         pun.d = fromRegister(alloc.fpuReg());
+#ifdef JS_CODEGEN_PPC_OSX
+        // The register is always written as a double, so we need to cast
+        // it down.
+        return Float32Value((float)pun.d);
+#else
         // The register contains the encoding of a float32. We just read
         // the bits without making any conversion.
         return Float32Value(pun.f);
+#endif
       }
 
       case RValueAllocation::ANY_FLOAT_STACK:

js/src/jit/shared/CodeGenerator-shared.cpp

@@ -1370,6 +1370,7 @@ CodeGeneratorShared::callVM(const VMFunction& fun, LInstruction* ins, const Regi
     // when returning from the call.  Failures are handled with exceptions based
     // on the return value of the C functions.  To guard the outcome of the
     // returned value, use another LIR instruction.
+    ensureOsiSpace();
     uint32_t callOffset = masm.callJit(wrapper);
     markSafepointAt(callOffset, ins);
 

js/src/vm/ErrorObject.cpp

@@ -174,34 +174,31 @@ js::ErrorObject::checkAndUnwrapThis(JSContext* cx, CallArgs& args, const char* f
     // the slots we need. This allows us to support the poor-man's subclassing
     // of error: Object.create(Error.prototype).
 
-    RootedObject target(cx, CheckedUnwrap(&thisValue.toObject()));
-    if (!target) {
+    RootedObject obj(cx, &args.thisv().toObject());
+    RootedObject curr(cx, obj);
+    RootedObject target(cx);
+    do {
+      target = CheckedUnwrap(curr);
+      if (!target) {
         JS_ReportError(cx, "Permission denied to access object");
         return false;
-    }
+      }
+      if (target->is<ErrorObject>()) {
+        error.set(&target->as<ErrorObject>());
+        return true;
+      }
 
-    RootedObject proto(cx);
-    while (!target->is<ErrorObject>()) {
-        if (!GetPrototype(cx, target, &proto))
-            return false;
+      if (!GetPrototype(cx, curr, &curr)) {
+        return false;
+      }
+    } while (curr);
 
-        if (!proto) {
-            // We walked the whole prototype chain and did not find an Error
-            // object.
-            JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
-                                 js_Error_str, fnName, thisValue.toObject().getClass()->name);
-            return false;
-        }
-
-        target = CheckedUnwrap(proto);
-        if (!target) {
-            JS_ReportError(cx, "Permission denied to access object");
-            return false;
-        }
-    }
-
-    error.set(&target->as<ErrorObject>());
-    return true;
+    // We walked the whole prototype chain and did not find an Error
+    // object.
+    JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,
+                         JSMSG_INCOMPATIBLE_PROTO, js_Error_str,
+                         "(get stack)", obj->getClass()->name);
+    return false;
 }
 
 /* static */ bool

js/src/vm/Interpreter.cpp

@@ -3851,7 +3851,20 @@ END_CASE(JSOP_INITHOMEOBJECT)
 CASE(JSOP_SUPERBASE)
 {
     JSFunction& superEnvFunc = GetSuperEnvFunction(cx, REGS);
+#if(0)
+    // TenFourFox issue 488. This sometimes happens when we throw, so make
+    // it a warning.
     MOZ_ASSERT(superEnvFunc.allowSuperProperty());
+#else
+    if(!superEnvFunc.allowSuperProperty()) {
+#ifdef DEBUG
+        fprintf(stderr, "JSOP_SUPERBASE should only get things that allow SuperProperties\n");
+#endif
+        JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_CONVERT_TO,
+                                "null", "object");
+        goto error;
+    }
+#endif
     MOZ_ASSERT(superEnvFunc.nonLazyScript()->needsHomeObject());
     const Value& homeObjVal = superEnvFunc.getExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT);
 

js/xpconnect/src/XPCConvert.cpp

@@ -134,7 +134,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
         d.setNumber(*static_cast<const float*>(s));
         return true;
     case nsXPTType::T_DOUBLE:
-        d.setNumber(*static_cast<const double*>(s));
+        d.set(JS_NumberValue(*static_cast<const double*>(s)));
         return true;
     case nsXPTType::T_BOOL  :
         d.setBoolean(*static_cast<const bool*>(s));

js/xpconnect/src/XPCVariant.cpp

@@ -425,7 +425,7 @@ XPCVariant::VariantDataToJS(nsIVariant* variant,
             double d;
             if (NS_FAILED(variant->GetAsDouble(&d)))
                 return false;
-            pJSVal.setNumber(d);
+            pJSVal.set(JS_NumberValue(d));
             return true;
         }
         case nsIDataType::VTYPE_BOOL:

js/xpconnect/wrappers/XrayWrapper.h

@@ -254,6 +254,9 @@ public:
     {
         JSXrayTraits& self = JSXrayTraits::singleton;
         JS::RootedObject holder(cx, self.ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         if (self.getProtoKey(holder) == JSProto_Function)
             return baseInstance.call(cx, wrapper, args);
 
@@ -267,6 +270,9 @@ public:
     {
         JSXrayTraits& self = JSXrayTraits::singleton;
         JS::RootedObject holder(cx, self.ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         if (self.getProtoKey(holder) == JSProto_Function)
             return baseInstance.construct(cx, wrapper, args);
 
@@ -280,6 +286,9 @@ public:
                       JS::MutableHandleObject protop)
     {
         JS::RootedObject holder(cx, ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         JSProtoKey key = getProtoKey(holder);
         if (isPrototype(holder)) {
             JSProtoKey parentKey = js::ParentKeyForStandardClass(key);

layout/base/nsCSSFrameConstructor.cpp

@@ -3289,8 +3289,11 @@ nsCSSFrameConstructor::ConstructTextFrame(const FrameConstructionData* aData,
   // Add the newly constructed frame to the flow
   aFrameItems.AddChild(newFrame);
 
-  if (!aState.mCreatingExtraFrames)
+  if (!aState.mCreatingExtraFrames ||
+      (aContent->IsInNativeAnonymousSubtree() &&
+       !aContent->GetPrimaryFrame())) {
     aContent->SetPrimaryFrame(newFrame);
+  }
 }
 
 /* static */

layout/base/nsCaret.cpp

@@ -396,7 +396,7 @@ nsCaret::GetFrameAndOffset(Selection* aSelection,
     return nullptr;
   }
 
-  if (!focusNode || !focusNode->IsContent()) {
+  if (!focusNode || !focusNode->IsContent() || !aSelection) {
     return nullptr;
   }
 

layout/base/nsDocumentViewer.cpp

@@ -1540,8 +1540,6 @@ DetachContainerRecurse(nsIDocShell *aShell)
 NS_IMETHODIMP
 nsDocumentViewer::Destroy()
 {
-  NS_ASSERTION(mDocument, "No document in Destroy()!");
-
 #ifdef NS_PRINTING
   // Here is where we check to see if the document was still being prepared 
   // for printing when it was asked to be destroy from someone externally

layout/base/nsLayoutUtils.cpp

@@ -174,6 +174,9 @@ static ContentMap& GetContentMap() {
 // When the pref "layout.css.grid.enabled" changes, this function is invoked
 // to let us update kDisplayKTable, to selectively disable or restore the
 // entries for "grid" and "inline-grid" in that table.
+//
+// NB: as of TenFourFox issue 659, a whitelist entry per host is also required
+// to enable (but turning it off turns it off globally).
 static void
 GridEnabledPrefChangeCallback(const char* aPrefName, void* aClosure)
 {

layout/base/nsPresShell.cpp

@@ -6598,7 +6598,11 @@ PresShell::RecordMouseLocation(WidgetGUIEvent* aEvent)
 
 nsIFrame* GetNearestFrameContainingPresShell(nsIPresShell* aPresShell)
 {
-  nsView* view = aPresShell->GetViewManager()->GetRootView();
+  nsViewManager* vm = aPresShell->GetViewManager();
+  if (!vm) {
+    return nullptr;
+  }
+  nsView* view = vm->GetRootView();
   while (view && !view->GetFrame()) {
     view = view->GetParent();
   }

layout/style/nsCSSParser.cpp

@@ -1439,6 +1439,10 @@ protected:
   // Value to make sure our resolved variable results stay within sane limits.
   const uint32_t MAX_CSS_VAR_LENGTH = 10240;
 
+  // TenFourFox issue 659
+  // If this host is whitelisted, turn on CSS grid and inline grid.
+  bool mHostCSSGridOK : 1;
+
 public:
   // Used from nsCSSParser constructors and destructors
   CSSParserImpl* mNextFree;
@@ -1587,6 +1591,32 @@ CSSParserImpl::InitScanner(nsCSSScanner& aScanner,
   mSheetURI = aSheetURI;
   mSheetPrincipal = aSheetPrincipal;
   mHavePushBack = false;
+
+  // TenFourFox issue 659
+  mHostCSSGridOK = false;
+  if (MOZ_LIKELY(mBaseURI)) {
+    nsCString host;
+    bool isChrome;
+
+    // Never turn on grid for browser chrome.
+    nsresult rv = mBaseURI->SchemeIs("chrome", &isChrome);
+    if (NS_SUCCEEDED(rv) && !isChrome) {
+      // Get host and check pref.
+      rv = mBaseURI->GetHost(host);
+      if (NS_SUCCEEDED(rv) && !host.IsEmpty()) {
+        nsCString pref;
+
+        pref.AssignLiteral("layout.css.grid.host.");
+        pref.SetCapacity(pref.Length() + host.Length());
+        pref += host;
+        mHostCSSGridOK = Preferences::GetBool(pref.get(), false);
+#if DEBUG
+        if (mHostCSSGridOK)
+          fprintf(stderr, "CSS grid enabled for %s\n", pref.get());
+#endif
+      }
+    }
+  }
 }
 
 void
@@ -7586,6 +7616,14 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
       }
       if ((aVariantMask & VARIANT_KEYWORD) != 0) {
         int32_t value;
+
+        // TenFourFox issue 659
+        if (MOZ_UNLIKELY(!mHostCSSGridOK &&
+             aKeywordTable == nsCSSProps::kDisplayKTable &&
+             (keyword == eCSSKeyword_grid ||
+              keyword == eCSSKeyword_inline_grid))) {
+          // pretend the keyword wasn't found
+        } else
         if (nsCSSProps::FindKeyword(keyword, aKeywordTable, value)) {
           aValue.SetIntValue(value, eCSSUnit_Enumerated);
           return CSSParseResult::Ok;

layout/xul/nsMenuFrame.cpp

@@ -1267,7 +1267,9 @@ nsMenuFrame::PassMenuCommandEventToPopupManager()
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
   nsMenuParent* menuParent = GetMenuParent();
   if (pm && menuParent && mDelayedMenuCommandEvent) {
-    pm->ExecuteMenu(mContent, mDelayedMenuCommandEvent);
+    nsCOMPtr<nsIContent> content = mContent;
+    RefPtr<nsXULMenuCommandEvent> event = mDelayedMenuCommandEvent;
+    pm->ExecuteMenu(content, event);
   }
   mDelayedMenuCommandEvent = nullptr;
 }

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -589,6 +589,8 @@ nsTreeBodyFrame::GetSelectionRegion(nsIScriptableRegion **aRegion)
 {
   *aRegion = nullptr;
 
+  if (!mView) return NS_OK;
+
   nsCOMPtr<nsITreeSelection> selection;
   mView->GetSelection(getter_AddRefs(selection));
   NS_ENSURE_TRUE(selection, NS_OK);