Merge m-i to m-c, a=merge
authorPhil Ringnalda <philringnalda@gmail.com>
Sun, 25 Jan 2015 11:43:56 -0800
changeset 225611 fa91879c842853961a8da90185821384c0d87926
parent 225590 e27eb3dcb5e8a7e94b7d23f43f61783a2fdc768e (current diff)
parent 225610 1f0d37966eac18d30e78026f0a0ef2e6417713cf (diff)
child 225612 e87f8f11ca152da3fa6188546572a441eddf8c47
child 225616 c1fb4bf7b043ffc16bcf943ee040938d4f354add
child 225634 f80d28a719c074f02cd5e93729b3711cf5cdd3a7
push id28170
push userphilringnalda@gmail.com
push dateSun, 25 Jan 2015 19:44:07 +0000
treeherdermozilla-central@fa91879c8428 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmerge
milestone38.0a1
first release with
nightly linux32
fa91879c8428 / 38.0a1 / 20150126030202 / files
nightly linux64
fa91879c8428 / 38.0a1 / 20150126030202 / files
nightly mac
fa91879c8428 / 38.0a1 / 20150126030202 / files
nightly win32
fa91879c8428 / 38.0a1 / 20150126030202 / files
nightly win64
fa91879c8428 / 38.0a1 / 20150126030202 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-i to m-c, a=merge
--- a/accessible/jsat/ContentControl.jsm
+++ b/accessible/jsat/ContentControl.jsm
@@ -282,18 +282,17 @@ this.ContentControl.prototype = {
 
     if (elem.tagName === 'INPUT' && elem.type === 'range') {
       elem[aStepUp ? 'stepDown' : 'stepUp']();
       let evt = this.document.createEvent('UIEvent');
       evt.initEvent('change', true, true);
       elem.dispatchEvent(evt);
     } else {
       let evt = this.document.createEvent('KeyboardEvent');
-      let keycode = aStepUp ? content.KeyEvent.DOM_VK_DOWN :
-        content.KeyEvent.DOM_VK_UP;
+      let keycode = aStepUp ? evt.DOM_VK_DOWN : evt.DOM_VK_UP;
       evt.initKeyEvent(
         "keypress", false, true, null, false, false, false, false, keycode, 0);
       elem.dispatchEvent(evt);
     }
 
     return true;
   },
 
--- a/browser/base/content/test/newtab/browser.ini
+++ b/browser/base/content/test/newtab/browser.ini
@@ -16,18 +16,19 @@ skip-if = os == "mac" # Intermittent fai
 [browser_newtab_bug752841.js]
 [browser_newtab_bug765628.js]
 [browser_newtab_bug876313.js]
 [browser_newtab_bug991111.js]
 [browser_newtab_bug991210.js]
 [browser_newtab_bug998387.js]
 [browser_newtab_disable.js]
 [browser_newtab_drag_drop.js]
-skip-if = os == "win" && debug # bug 1097056; test fails in --run-by-dir mode on win8 x64 debug
+skip-if = os == "win" && debug || (os == 'mac' && os_version == '10.10') # bug 1097056; test fails in --run-by-dir mode on win8 x64 debug; Bug 1122479 - newtab drag-drop tests fail on OS X 10.10
 [browser_newtab_drag_drop_ext.js]
+skip-if = (os == 'mac' && os_version == '10.10') # bug 1122479 - newtab drag-drop tests fail on OS X 10.10
 [browser_newtab_drop_preview.js]
 [browser_newtab_enhanced.js]
 [browser_newtab_focus.js]
 [browser_newtab_intro.js]
 [browser_newtab_perwindow_private_browsing.js]
 [browser_newtab_reportLinkAction.js]
 [browser_newtab_reflow_load.js]
 support-files =
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -6277,16 +6277,19 @@ class CGCallGenerator(CGThing):
                 resultArgsStr = ""
             result = CGWrapper(result, post=(" %s%s" % (resultVar, resultArgsStr)))
             if resultOutParam is None and resultArgs is None:
                 call = CGList([result, CGWrapper(call, pre="(", post=")")])
             else:
                 self.cgRoot.prepend(CGWrapper(result, post=";\n"))
                 if resultOutParam is None:
                     call = CGWrapper(call, pre=resultVar + " = ")
+        elif result is not None:
+            assert resultOutParam is None
+            call = CGWrapper(call, pre=resultVar + " = ")
 
         call = CGWrapper(call, post=";\n")
         self.cgRoot.append(call)
 
         if isFallible:
             self.cgRoot.prepend(CGGeneric("ErrorResult rv;\n"))
             self.cgRoot.append(CGGeneric("rv.WouldReportJSException();\n"))
             self.cgRoot.append(CGGeneric("if (MOZ_UNLIKELY(rv.Failed())) {\n"))
--- a/dom/plugins/ipc/PluginModuleChild.cpp
+++ b/dom/plugins/ipc/PluginModuleChild.cpp
@@ -80,17 +80,16 @@ static PRLibrary *sGtkLib = nullptr;
 // Hooking CreateFileW for protected-mode magic
 static WindowsDllInterceptor sKernel32Intercept;
 typedef HANDLE (WINAPI *CreateFileWPtr)(LPCWSTR fname, DWORD access,
                                         DWORD share,
                                         LPSECURITY_ATTRIBUTES security,
                                         DWORD creation, DWORD flags,
                                         HANDLE ftemplate);
 static CreateFileWPtr sCreateFileWStub = nullptr;
-static WCHAR* sReplacementConfigFile;
 
 // Used with fix for flash fullscreen window loosing focus.
 static bool gDelayFlashFocusReplyUntilEval = false;
 // Used to fix GetWindowInfo problems with internal flash settings dialogs
 static WindowsDllInterceptor sUser32Intercept;
 typedef BOOL (WINAPI *GetWindowInfoPtr)(HWND hwnd, PWINDOWINFO pwi);
 static GetWindowInfoPtr sGetWindowInfoPtrStub = nullptr;
 static HWND sBrowserHwnd = nullptr;
@@ -1928,20 +1927,16 @@ PluginModuleChild::DoNP_Initialize(const
 #if defined(OS_LINUX) || defined(OS_BSD)
     result = mInitializeFunc(&sBrowserFuncs, &mFunctions);
 #elif defined(OS_WIN) || defined(OS_MACOSX)
     result = mInitializeFunc(&sBrowserFuncs);
 #else
 #  error Please implement me for your platform
 #endif
 
-#ifdef XP_WIN
-    CleanupProtectedModeHook();
-#endif
-
     return result;
 }
 
 #if defined(XP_WIN)
 
 HANDLE WINAPI
 CreateFileHookFn(LPCWSTR fname, DWORD access, DWORD share,
                  LPSECURITY_ATTRIBUTES security, DWORD creation, DWORD flags,
@@ -1966,17 +1961,18 @@ CreateFileHookFn(LPCWSTR fname, DWORD ac
         }
         WCHAR tempFile[MAX_PATH+1];
         if (GetTempFileNameW(tempPath, L"fx", 0, tempFile) == 0) {
             break;
         }
         HANDLE replacement =
             sCreateFileWStub(tempFile, GENERIC_READ | GENERIC_WRITE, share,
                              security, TRUNCATE_EXISTING,
-                             FILE_ATTRIBUTE_TEMPORARY,
+                             FILE_ATTRIBUTE_TEMPORARY |
+                               FILE_FLAG_DELETE_ON_CLOSE,
                              NULL);
         if (replacement == INVALID_HANDLE_VALUE) {
             break;
         }
 
         HANDLE original = sCreateFileWStub(fname, access, share, security,
                                            creation, flags, ftemplate);
         if (original != INVALID_HANDLE_VALUE) {
@@ -1996,42 +1992,31 @@ CreateFileHookFn(LPCWSTR fname, DWORD ac
             }
             CloseHandle(original);
         }
         static const char kSettingString[] = "\nProtectedMode=0\n";
         DWORD wbytes;
         WriteFile(replacement, static_cast<const void*>(kSettingString),
                   sizeof(kSettingString) - 1, &wbytes, NULL);
         SetFilePointer(replacement, 0, NULL, FILE_BEGIN);
-        sReplacementConfigFile = _wcsdup(tempFile);
         return replacement;
     }
     return sCreateFileWStub(fname, access, share, security, creation, flags,
                             ftemplate);
 }
 
 void
 PluginModuleChild::HookProtectedMode()
 {
     sKernel32Intercept.Init("kernel32.dll");
     sKernel32Intercept.AddHook("CreateFileW",
                                reinterpret_cast<intptr_t>(CreateFileHookFn),
                                (void**) &sCreateFileWStub);
 }
 
-void
-PluginModuleChild::CleanupProtectedModeHook()
-{
-    if (sReplacementConfigFile) {
-        DeleteFile(sReplacementConfigFile);
-        free(sReplacementConfigFile);
-        sReplacementConfigFile = nullptr;
-    }
-}
-
 BOOL WINAPI
 PMCGetWindowInfoHook(HWND hWnd, PWINDOWINFO pwi)
 {
   if (!pwi)
       return FALSE;
 
   if (!sGetWindowInfoPtrStub) {
      NS_ASSERTION(FALSE, "Something is horribly wrong in PMCGetWindowInfoHook!");
--- a/dom/plugins/ipc/PluginModuleChild.h
+++ b/dom/plugins/ipc/PluginModuleChild.h
@@ -302,17 +302,16 @@ private:
       mQuirks |= quirk;
     }
     void InitQuirksModes(const nsCString& aMimeType);
     bool InitGraphics();
     void DeinitGraphics();
 
 #if defined(OS_WIN)
     void HookProtectedMode();
-    void CleanupProtectedModeHook();
 #endif
 
 #if defined(MOZ_WIDGET_GTK)
     static gboolean DetectNestedEventLoop(gpointer data);
     static gboolean ProcessBrowserEvents(gpointer data);
 
     virtual void EnteredCxxStack() MOZ_OVERRIDE;
     virtual void ExitedCxxStack() MOZ_OVERRIDE;
--- a/dom/webidl/SVGSVGElement.webidl
+++ b/dom/webidl/SVGSVGElement.webidl
@@ -14,19 +14,23 @@ interface SVGViewSpec;
 
 interface SVGSVGElement : SVGGraphicsElement {
 
   readonly attribute SVGAnimatedLength x;
   readonly attribute SVGAnimatedLength y;
   readonly attribute SVGAnimatedLength width;
   readonly attribute SVGAnimatedLength height;
   // readonly attribute SVGRect viewport;
+  [Constant]
   readonly attribute float pixelUnitToMillimeterX;
+  [Constant]
   readonly attribute float pixelUnitToMillimeterY;
+  [Constant]
   readonly attribute float screenPixelToMillimeterX;
+  [Constant]
   readonly attribute float screenPixelToMillimeterY;
   readonly attribute boolean useCurrentView;
   // readonly attribute SVGViewSpec currentView;
            attribute float currentScale;
   readonly attribute SVGPoint currentTranslate;
 
   [DependsOn=Nothing, Affects=Nothing]
   unsigned long suspendRedraw(unsigned long maxWaitMilliseconds);
--- a/image/src/ClippedImage.cpp
+++ b/image/src/ClippedImage.cpp
@@ -142,17 +142,18 @@ ClippedImage::ShouldClip()
     } else if (NS_SUCCEEDED(InnerImage()->GetWidth(&width)) && width > 0 &&
                NS_SUCCEEDED(InnerImage()->GetHeight(&height)) && height > 0) {
       // Clamp the clipping region to the size of the underlying image.
       mClip = mClip.Intersect(nsIntRect(0, 0, width, height));
 
       // If the clipping region is the same size as the underlying image we
       // don't have to do anything.
       mShouldClip.emplace(!mClip.IsEqualInterior(nsIntRect(0, 0, width, height)));
-    } else if (progressTracker && progressTracker->IsLoading()) {
+    } else if (progressTracker &&
+               !(progressTracker->GetProgress() & FLAG_LOAD_COMPLETE)) {
       // The image just hasn't finished loading yet. We don't yet know whether
       // clipping with be needed or not for now. Just return without memoizing
       // anything.
       return false;
     } else {
       // We have a fully loaded image without a clearly defined width and
       // height. This can happen with SVG images.
       mShouldClip.emplace(false);
--- a/image/src/Decoder.cpp
+++ b/image/src/Decoder.cpp
@@ -31,16 +31,17 @@ Decoder::Decoder(RasterImage* aImage)
   , mDecodeFlags(0)
   , mBytesDecoded(0)
   , mSendPartialInvalidations(false)
   , mDataDone(false)
   , mDecodeDone(false)
   , mDataError(false)
   , mDecodeAborted(false)
   , mImageIsTransient(false)
+  , mImageIsLocked(false)
   , mFrameCount(0)
   , mFailCode(NS_OK)
   , mNeedsNewFrame(false)
   , mNeedsToFlushData(false)
   , mInitialized(false)
   , mSizeDecode(false)
   , mInFrame(false)
   , mIsAnimated(false)
--- a/image/src/Decoder.h
+++ b/image/src/Decoder.h
@@ -184,16 +184,29 @@ public:
    * short-lived images in this case.
    */
   void SetImageIsTransient(bool aIsTransient)
   {
     MOZ_ASSERT(!mInitialized, "Shouldn't be initialized yet");
     mImageIsTransient = aIsTransient;
   }
 
+  /**
+   * Set whether the image is locked for the lifetime of this decoder. We lock
+   * the image during our initial decode to ensure that we don't evict any
+   * surfaces before we realize that the image is animated.
+   */
+  void SetImageIsLocked()
+  {
+    MOZ_ASSERT(!mInitialized, "Shouldn't be initialized yet");
+    mImageIsLocked = true;
+  }
+
+  bool ImageIsLocked() const { return mImageIsLocked; }
+
   size_t BytesDecoded() const { return mBytesDecoded; }
 
   // The amount of time we've spent inside Write() so far for this decoder.
   TimeDuration DecodeTime() const { return mDecodeTime; }
 
   // The number of times Write() has been called so far for this decoder.
   uint32_t ChunkCount() const { return mChunkCount; }
 
@@ -440,16 +453,17 @@ protected:
   uint32_t mDecodeFlags;
   size_t mBytesDecoded;
   bool mSendPartialInvalidations;
   bool mDataDone;
   bool mDecodeDone;
   bool mDataError;
   bool mDecodeAborted;
   bool mImageIsTransient;
+  bool mImageIsLocked;
 
 private:
   uint32_t mFrameCount; // Number of frames, including anything in-progress
 
   nsresult mFailCode;
 
   struct NewFrameData
   {
--- a/image/src/Downscaler.h
+++ b/image/src/Downscaler.h
@@ -122,28 +122,28 @@ private:
 namespace mozilla {
 namespace image {
 
 class Downscaler
 {
 public:
   explicit Downscaler(const nsIntSize&)
   {
-    MOZ_RELEASE_ASSERT("Skia is not enabled");
+    MOZ_RELEASE_ASSERT(false, "Skia is not enabled");
   }
 
   const nsIntSize& OriginalSize() const { return nsIntSize(); }
   const nsIntSize& TargetSize() const { return nsIntSize(); }
-  uint8_t* Buffer() { return nullptr; }
 
   nsresult BeginFrame(const nsIntSize&, uint8_t*, bool)
   {
     return NS_ERROR_FAILURE;
   }
 
+  uint8_t* RowBuffer() { return nullptr; }
   void CommitRow() { }
   bool HasInvalidation() const { return false; }
   nsIntRect TakeInvalidRect() { return nsIntRect(); }
   void ResetForNextProgressivePass() { }
 };
 
 
 } // namespace image
--- a/image/src/ProgressTracker.cpp
+++ b/image/src/ProgressTracker.cpp
@@ -94,25 +94,16 @@ ProgressTracker::SetImage(Image* aImage)
 
 void
 ProgressTracker::ResetImage()
 {
   NS_ABORT_IF_FALSE(mImage, "Resetting image when it's already null!");
   mImage = nullptr;
 }
 
-bool
-ProgressTracker::IsLoading() const
-{
-  // Checking for whether OnStopRequest has fired allows us to say we're
-  // loading before OnStartRequest gets called, letting the request properly
-  // get removed from the cache in certain cases.
-  return !(mProgress & FLAG_LOAD_COMPLETE);
-}
-
 uint32_t
 ProgressTracker::GetImageStatus() const
 {
   uint32_t status = imgIRequest::STATUS_NONE;
 
   // Translate our current state to a set of imgIRequest::STATE_* flags.
   if (mProgress & FLAG_SIZE_AVAILABLE) {
     status |= imgIRequest::STATUS_SIZE_AVAILABLE;
--- a/image/src/ProgressTracker.h
+++ b/image/src/ProgressTracker.h
@@ -83,20 +83,16 @@ public:
 
   bool HasImage() const { return mImage; }
   already_AddRefed<Image> GetImage() const
   {
     nsRefPtr<Image> image = mImage;
     return image.forget();
   }
 
-  // Returns whether we are in the process of loading; that is, whether we have
-  // not received OnStopRequest from Necko.
-  bool IsLoading() const;
-
   // Get the current image status (as in imgIRequest).
   uint32_t GetImageStatus() const;
 
   // Get the current Progress.
   Progress GetProgress() const { return mProgress; }
 
   // Schedule an asynchronous "replaying" of all the notifications that would
   // have to happen to put us in the current state.
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -1360,16 +1360,25 @@ RasterImage::CreateDecoder(const Maybe<n
 
   MOZ_ASSERT(decoder, "Should have a decoder now");
 
   // Initialize the decoder.
   decoder->SetSizeDecode(!aSize);
   decoder->SetSendPartialInvalidations(!mHasBeenDecoded);
   decoder->SetImageIsTransient(mTransient);
   decoder->SetDecodeFlags(DecodeFlags(aFlags));
+
+  if (!mHasBeenDecoded && aSize) {
+    // Lock the image while we're decoding, so that it doesn't get evicted from
+    // the SurfaceCache before we have a chance to realize that it's animated.
+    // The corresponding unlock happens in FinalizeDecoder.
+    LockImage();
+    decoder->SetImageIsLocked();
+  }
+
   if (aSize) {
     // We already have the size; tell the decoder so it can preallocate a
     // frame.  By default, we create an ARGB frame with no offset. If decoders
     // need a different type, they need to ask for it themselves.
     // XXX(seth): Note that we call SetSize() and NeedNewFrame() with the
     // image's intrinsic size, but AllocateFrame with our target size.
     decoder->SetSize(mSize, mOrientation);
     decoder->NeedNewFrame(0, 0, 0, aSize->width, aSize->height,
@@ -1539,21 +1548,16 @@ RasterImage::Decode(DecodeStrategy aStra
   }
 
   if (aSize) {
     // This isn't a size decode (which doesn't send any early notifications), so
     // send out notifications right away.
     NotifyProgress(decoder->TakeProgress(),
                    decoder->TakeInvalidRect(),
                    decoder->GetDecodeFlags());
-
-    // Lock the image while we're decoding, so that it doesn't get evicted from
-    // the SurfaceCache before we have a chance to realize that it's animated.
-    // The corresponding unlock happens in FinalizeDecoder.
-    LockImage();
   }
 
   if (mHasSourceData) {
     // If we have all the data, we can sync decode if requested.
     if (aStrategy == DecodeStrategy::SYNC_FOR_SMALL_IMAGES) {
       PROFILER_LABEL_PRINTF("DecodePool", "SyncDecodeIfSmall",
         js::ProfileEntry::Category::GRAPHICS, "%s", GetURIString().get());
       DecodePool::Singleton()->SyncDecodeIfSmall(decoder);
@@ -2040,18 +2044,18 @@ RasterImage::FinalizeDecoder(Decoder* aD
     // Detect errors.
     if (aDecoder->HasError() && !aDecoder->WasAborted()) {
       DoError();
     } else if (wasSize && !mHasSize) {
       DoError();
     }
   }
 
-  if (!wasSize) {
-    // Unlock the image, balancing the LockImage call we made in Decode().
+  if (aDecoder->ImageIsLocked()) {
+    // Unlock the image, balancing the LockImage call we made in CreateDecoder.
     UnlockImage();
   }
 
   // If we were a size decode and a full decode was requested, now's the time.
   if (done && wasSize && mWantFullDecode) {
     mWantFullDecode = false;
     RequestDecode();
   }
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -228,17 +228,18 @@ nsresult imgRequest::RemoveProxy(imgRequ
     }
 #endif
 
     /* If |aStatus| is a failure code, then cancel the load if it is still in progress.
        Otherwise, let the load continue, keeping 'this' in the cache with no observers.
        This way, if a proxy is destroyed without calling cancel on it, it won't leak
        and won't leave a bad pointer in the observer list.
      */
-    if (progressTracker->IsLoading() && NS_FAILED(aStatus)) {
+    if (!(progressTracker->GetProgress() & FLAG_LAST_PART_COMPLETE) &&
+        NS_FAILED(aStatus)) {
       LOG_MSG(GetImgLog(), "imgRequest::RemoveProxy", "load in progress.  canceling");
 
       this->Cancel(NS_BINDING_ABORTED);
     }
 
     /* break the cycle from the cache entry. */
     mCacheEntry = nullptr;
   }
@@ -304,17 +305,17 @@ void imgRequest::ContinueCancel(nsresult
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   nsRefPtr<ProgressTracker> progressTracker = GetProgressTracker();
   progressTracker->SyncNotifyProgress(FLAG_HAS_ERROR | FLAG_ONLOAD_UNBLOCKED);
 
   RemoveFromCache();
 
-  if (mRequest && progressTracker->IsLoading()) {
+  if (mRequest && !(progressTracker->GetProgress() & FLAG_LAST_PART_COMPLETE)) {
      mRequest->Cancel(aStatus);
   }
 }
 
 class imgRequestMainThreadEvict : public nsRunnable
 {
 public:
   explicit imgRequestMainThreadEvict(imgRequest *aImgRequest)
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -530,19 +530,17 @@ BacktrackingAllocator::processInterval(L
         }
 
         // A minimal interval cannot be split any further. If we try to split
         // it at this point we will just end up with the same interval and will
         // enter an infinite loop. Weights and the initial live intervals must
         // be constructed so that any minimal interval is allocatable.
         MOZ_ASSERT(!minimalInterval(interval));
 
-        if (canAllocate && fixed)
-            return splitAcrossCalls(interval);
-        return chooseIntervalSplit(interval, conflict);
+        return chooseIntervalSplit(interval, canAllocate && fixed, conflict);
     }
 }
 
 bool
 BacktrackingAllocator::processGroup(VirtualRegisterGroup *group)
 {
     if (JitSpewEnabled(JitSpew_RegAlloc)) {
         JitSpew(JitSpew_RegAlloc, "Allocating group v%u [priority %lu] [weight %lu]",
@@ -1516,21 +1514,72 @@ BacktrackingAllocator::trySplitAcrossHot
     }
     if (!coldCode) {
         JitSpew(JitSpew_RegAlloc, "  interval does not contain cold code");
         return true;
     }
 
     JitSpew(JitSpew_RegAlloc, "  split across hot range %s", hotRange->toString());
 
-    SplitPositionVector splitPositions;
-    if (!splitPositions.append(hotRange->from) || !splitPositions.append(hotRange->to))
+    // Tweak the splitting method when compiling asm.js code to look at actual
+    // uses within the hot/cold code. This heuristic is in place as the below
+    // mechanism regresses several asm.js tests. Hopefully this will be fixed
+    // soon and this special case removed. See bug 948838.
+    if (compilingAsmJS()) {
+        SplitPositionVector splitPositions;
+        if (!splitPositions.append(hotRange->from) || !splitPositions.append(hotRange->to))
+            return false;
+        *success = true;
+        return splitAt(interval, splitPositions);
+    }
+
+    LiveInterval *hotInterval = LiveInterval::New(alloc(), interval->vreg(), 0);
+    LiveInterval *preInterval = nullptr, *postInterval = nullptr;
+
+    // Accumulate the ranges of hot and cold code in the interval. Note that
+    // we are only comparing with the single hot range found, so the cold code
+    // may contain separate hot ranges.
+    Vector<LiveInterval::Range, 1, SystemAllocPolicy> hotList, coldList;
+    for (size_t i = 0; i < interval->numRanges(); i++) {
+        LiveInterval::Range hot, coldPre, coldPost;
+        interval->getRange(i)->intersect(hotRange, &coldPre, &hot, &coldPost);
+
+        if (!hot.empty() && !hotInterval->addRange(hot.from, hot.to))
+            return false;
+
+        if (!coldPre.empty()) {
+            if (!preInterval)
+                preInterval = LiveInterval::New(alloc(), interval->vreg(), 0);
+            if (!preInterval->addRange(coldPre.from, coldPre.to))
+                return false;
+        }
+
+        if (!coldPost.empty()) {
+            if (!postInterval)
+                postInterval = LiveInterval::New(alloc(), interval->vreg(), 0);
+            if (!postInterval->addRange(coldPost.from, coldPost.to))
+                return false;
+        }
+    }
+
+    MOZ_ASSERT(preInterval || postInterval);
+    MOZ_ASSERT(hotInterval->numRanges());
+
+    LiveIntervalVector newIntervals;
+    if (!newIntervals.append(hotInterval))
         return false;
+    if (preInterval && !newIntervals.append(preInterval))
+        return false;
+    if (postInterval && !newIntervals.append(postInterval))
+        return false;
+
+    distributeUses(interval, newIntervals);
+
     *success = true;
-    return splitAt(interval, splitPositions);
+    return split(interval, newIntervals) && requeueIntervals(newIntervals);
 }
 
 bool
 BacktrackingAllocator::trySplitAfterLastRegisterUse(LiveInterval *interval, LiveInterval *conflict, bool *success)
 {
     // If this interval's later uses do not require it to be in a register,
     // split it after the last use which does require a register. If conflict
     // is specified, only consider register uses before the conflict starts.
@@ -1870,25 +1919,28 @@ BacktrackingAllocator::splitAcrossCalls(
     }
     JitSpewFin(JitSpew_RegAlloc);
 #endif
 
     return splitAt(interval, callPositions);
 }
 
 bool
-BacktrackingAllocator::chooseIntervalSplit(LiveInterval *interval, LiveInterval *conflict)
+BacktrackingAllocator::chooseIntervalSplit(LiveInterval *interval, bool fixed, LiveInterval *conflict)
 {
     bool success = false;
 
     if (!trySplitAcrossHotcode(interval, &success))
         return false;
     if (success)
         return true;
 
+    if (fixed)
+        return splitAcrossCalls(interval);
+
     if (!trySplitBeforeFirstRegisterUse(interval, conflict, &success))
         return false;
     if (success)
         return true;
 
     if (!trySplitAfterLastRegisterUse(interval, conflict, &success))
         return false;
     if (success)
--- a/js/src/jit/BacktrackingAllocator.h
+++ b/js/src/jit/BacktrackingAllocator.h
@@ -231,23 +231,27 @@ class BacktrackingAllocator
     // Heuristic methods.
 
     size_t computePriority(const LiveInterval *interval);
     size_t computeSpillWeight(const LiveInterval *interval);
 
     size_t computePriority(const VirtualRegisterGroup *group);
     size_t computeSpillWeight(const VirtualRegisterGroup *group);
 
-    bool chooseIntervalSplit(LiveInterval *interval, LiveInterval *conflict);
+    bool chooseIntervalSplit(LiveInterval *interval, bool fixed, LiveInterval *conflict);
 
     bool splitAt(LiveInterval *interval,
                  const SplitPositionVector &splitPositions);
     bool trySplitAcrossHotcode(LiveInterval *interval, bool *success);
     bool trySplitAfterLastRegisterUse(LiveInterval *interval, LiveInterval *conflict, bool *success);
     bool trySplitBeforeFirstRegisterUse(LiveInterval *interval, LiveInterval *conflict, bool *success);
     bool splitAtAllRegisterUses(LiveInterval *interval);
     bool splitAcrossCalls(LiveInterval *interval);
+
+    bool compilingAsmJS() {
+        return mir->info().compilingAsmJS();
+    }
 };
 
 } // namespace jit
 } // namespace js
 
 #endif /* jit_BacktrackingAllocator_h */
--- a/layout/forms/nsFieldSetFrame.cpp
+++ b/layout/forms/nsFieldSetFrame.cpp
@@ -475,29 +475,29 @@ nsFieldSetFrame::Reflow(nsPresContext*  
                                      innerAvailSize, -1, -1,
                                      nsHTMLReflowState::CALLER_WILL_INIT);
     // Override computed padding, in case it's percentage padding
     kidReflowState.Init(aPresContext, -1, -1, nullptr,
                         &aReflowState.ComputedPhysicalPadding());
     // Our child is "height:100%" but we actually want its height to be reduced
     // by the amount of content-height the legend is eating up, unless our
     // height is unconstrained (in which case the child's will be too).
-    if (aReflowState.ComputedHeight() != NS_UNCONSTRAINEDSIZE) {
-      kidReflowState.SetComputedHeight(
-         std::max(0, aReflowState.ComputedHeight() - mLegendSpace));
+    if (aReflowState.ComputedBSize() != NS_UNCONSTRAINEDSIZE) {
+      kidReflowState.SetComputedBSize(
+         std::max(0, aReflowState.ComputedBSize() - mLegendSpace));
     }
 
-    if (aReflowState.ComputedMinHeight() > 0) {
-      kidReflowState.ComputedMinHeight() =
-        std::max(0, aReflowState.ComputedMinHeight() - mLegendSpace);
+    if (aReflowState.ComputedMinBSize() > 0) {
+      kidReflowState.ComputedMinBSize() =
+        std::max(0, aReflowState.ComputedMinBSize() - mLegendSpace);
     }
 
-    if (aReflowState.ComputedMaxHeight() != NS_UNCONSTRAINEDSIZE) {
-      kidReflowState.ComputedMaxHeight() =
-        std::max(0, aReflowState.ComputedMaxHeight() - mLegendSpace);
+    if (aReflowState.ComputedMaxBSize() != NS_UNCONSTRAINEDSIZE) {
+      kidReflowState.ComputedMaxBSize() =
+        std::max(0, aReflowState.ComputedMaxBSize() - mLegendSpace);
     }
 
     nsHTMLReflowMetrics kidDesiredSize(kidReflowState,
                                        aDesiredSize.mFlags);
     // Reflow the frame
     NS_ASSERTION(kidReflowState.ComputedPhysicalMargin() == nsMargin(0,0,0,0),
                  "Margins on anonymous fieldset child not supported!");
     nsPoint pt(border.left, border.top);
--- a/layout/reftests/canvas/reftest.list
+++ b/layout/reftests/canvas/reftest.list
@@ -94,11 +94,11 @@ fails-if(OSX==1006) == 672646-alpha-radi
 
 == transformed-clip.html transformed-clip-ref.html
 == transformed-gradient.html transformed-gradient-ref.html
 == transformed-path.html transformed-path.html
 
 == 749467-1.html 749467-1-ref.html
 
 # You get a little bit of rounding fuzz on OSX from transforming the paths between user space and device space
-fuzzy-if(azureQuartz,2,113) fuzzy-if(d2d,12,21) == 784573-1.html 784573-1-ref.html
+fuzzy-if(azureQuartz,2,128) fuzzy-if(d2d,12,21) == 784573-1.html 784573-1-ref.html
 
 == 802658-1.html 802658-1-ref.html
--- a/layout/reftests/css-gradients/reftest.list
+++ b/layout/reftests/css-gradients/reftest.list
@@ -47,19 +47,19 @@ fails-if(d2d) == linear-repeat-1g.html l
 == linear-stops-1f.html linear-stops-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,88500) fuzzy-if(azureSkiaGL,2,89700) fuzzy-if(azureQuartz,1,22367) == linear-vertical-1a.html linear-vertical-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,88500) fuzzy-if(azureSkiaGL,2,89700) fuzzy-if(azureQuartz,1,22367) == linear-vertical-1b.html linear-vertical-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,88500) fuzzy-if(azureSkiaGL,2,89700) fuzzy-if(azureQuartz,2,26777) == linear-vertical-1c.html linear-vertical-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,88500) fuzzy-if(azureSkiaGL,2,89700) fuzzy-if(azureQuartz,2,26777) == linear-vertical-1d.html linear-vertical-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,88500) fuzzy-if(azureSkiaGL,2,89700) fuzzy-if(azureQuartz,1,22367) == linear-vertical-1e.html linear-vertical-1-ref.html
 == linear-vertical-subpixel-1.html linear-vertical-subpixel-1-ref.html
 == linear-viewport.html linear-viewport-ref.html
-== linear-zero-length-1a.html linear-zero-length-1-ref.html
-== linear-zero-length-1b.html linear-zero-length-1-ref.html
-== linear-zero-length-1c.html linear-zero-length-1-ref.html
+fails-if(OSX==1010) == linear-zero-length-1a.html linear-zero-length-1-ref.html
+fails-if(OSX==1010) == linear-zero-length-1b.html linear-zero-length-1-ref.html
+fails-if(OSX==1010) == linear-zero-length-1c.html linear-zero-length-1-ref.html
 == nostops.html about:blank
 == onestop.html about:blank
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,5884) fuzzy-if(cocoaWidget,9,87824) fuzzy-if(azureSkiaGL,2,88024) random-if(d2d) == radial-1a.html radial-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,5884) fuzzy-if(cocoaWidget,9,87824) fuzzy-if(azureSkiaGL,2,88024) random-if(d2d) == radial-1b.html radial-1-ref.html
 fuzzy-if(!contentSameGfxBackendAsCanvas,1,5884) fuzzy-if(cocoaWidget,9,87824) fuzzy-if(azureSkiaGL,2,88024) random-if(d2d) == radial-1c.html radial-1-ref.html
 fuzzy(3,7860) fuzzy-if(cocoaWidget,5,89041) fuzzy-if(azureSkiaGL,2,90000) == radial-2a.html radial-2-ref.html
 fuzzy(3,7860) fuzzy-if(cocoaWidget,5,89041) fuzzy-if(azureSkiaGL,2,90000) == radial-2b.html radial-2-ref.html
 fuzzy(3,7860) fuzzy-if(cocoaWidget,5,89041) fuzzy-if(azureSkiaGL,2,90000) == radial-2c.html radial-2-ref.html
new file mode 100644
--- /dev/null
+++ b/layout/reftests/writing-mode/1124636-1-fieldset-max-height-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Maximum height on fieldset</title>
+    <style>
+    div {
+      writing-mode: vertical-lr;
+    }
+    fieldset {
+      background:rgba(0,0,0,0.1);
+      border-color:teal;
+      border-width:2px;
+      height:100px;
+    }
+    </style>
+  </head>
+  <body>
+    <div>
+      <fieldset>
+	<p>Lorem ipsum dolor sit amet, consectetur adipiscing
+	  elit. Duis odio est, cursus non adipiscing at, fringilla
+	  quis eros. Sed volutpat nibh sit amet ante molestie a
+	  vehicula nulla gravida. Mauris elementum cursus urna id
+	  vestibulum.</p>
+      </fieldset>
+    </div>
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/writing-mode/1124636-1-fieldset-max-height.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Maximum height on fieldset</title>
+    <style>
+    div {
+      writing-mode: vertical-lr;
+    }
+    fieldset {
+      background:rgba(0,0,0,0.1);
+      border-color:teal;
+      border-width:2px;
+      max-height:100px;
+    }
+    </style>
+  </head>
+  <body>
+    <div>
+      <fieldset>
+	<p>Lorem ipsum dolor sit amet, consectetur adipiscing
+	  elit. Duis odio est, cursus non adipiscing at, fringilla
+	  quis eros. Sed volutpat nibh sit amet ante molestie a
+	  vehicula nulla gravida. Mauris elementum cursus urna id
+	  vestibulum.</p>
+      </fieldset>
+    </div>
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/writing-mode/1124636-2-fieldset-min-height-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Minimum height on fieldset</title>
+    <style>
+    div {
+      writing-mode: vertical-lr;
+    }
+    fieldset {
+      background:rgba(0,0,0,0.1);
+      border-color:teal;
+      border-width:2px;
+      height:400px;
+    }
+    </style>
+  </head>
+  <body>
+    <div>
+      <fieldset>
+	<p>Lorem ipsum.</p>
+      </fieldset>
+    </div>
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/writing-mode/1124636-2-fieldset-min-height.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Minimum height on fieldset</title>
+    <style>
+    div {
+      writing-mode: vertical-lr;
+    }
+    fieldset {
+      background:rgba(0,0,0,0.1);
+      border-color:teal;
+      border-width:2px;
+      min-height:200px;
+      max-height:400px;
+    }
+    </style>
+  </head>
+  <body>
+    <div>
+      <fieldset>
+	<p>Lorem ipsum.</p>
+      </fieldset>
+    </div>
+  </body>
+</html>
--- a/layout/reftests/writing-mode/reftest.list
+++ b/layout/reftests/writing-mode/reftest.list
@@ -30,8 +30,10 @@ fails == 1102175-1a.html 1102175-1-ref.h
 == 1103613-1.html 1103613-1-ref.html
 == 1105268-1-min-max-dimensions.html 1105268-1-min-max-dimensions-ref.html
 == 1105268-2-min-max-dimensions.html 1105268-2-min-max-dimensions-ref.html
 == 1106669-1-intrinsic-for-container.html 1106669-1-intrinsic-for-container-ref.html
 == 1108923-1-percentage-margins.html 1108923-1-percentage-margins-ref.html
 == 1111944-1-list-marker.html 1111944-1-list-marker-ref.html
 HTTP(..) == 1115916-1-vertical-metrics.html 1115916-1-vertical-metrics-ref.html
 == 1122366-1-margin-collapse.html 1122366-1-margin-collapse-ref.html
+== 1124636-1-fieldset-max-height.html 1124636-1-fieldset-max-height-ref.html
+== 1124636-2-fieldset-min-height.html 1124636-2-fieldset-min-height-ref.html
--- a/testing/web-platform/meta/media-source/mediasource-duration.html.ini
+++ b/testing/web-platform/meta/media-source/mediasource-duration.html.ini
@@ -18,10 +18,10 @@
 
   [Test endOfStream completes previous seek to truncated duration]
     expected:
       if (os == "win") and (version != "5.1.2600"): FAIL
       if os == "mac": FAIL
       TIMEOUT
 
   [Test setting same duration multiple times does not fire duplicate durationchange]
-    expected: FAIL
+    disabled: https://bugzilla.mozilla.org/show_bug.cgi?id=1116007
 
--- a/toolkit/content/tests/chrome/test_arrowpanel.xul
+++ b/toolkit/content/tests/chrome/test_arrowpanel.xul
@@ -39,16 +39,18 @@
   <label value="Animate Closed" height="40"/>
 </panel>
 
 <script type="application/javascript">
 <![CDATA[
 
 SimpleTest.waitForExplicitFinish();
 
+const isOSXYosemite = navigator.userAgent.indexOf("Mac OS X 10.10") != -1;
+
 var expectedAnchor = null;
 var expectedSide = "", expectedAnchorEdge = "", expectedPack = "", expectedAlignment = "";
 var zoomFactor = 1;
 var animatedPopupShown = false;
 var animatedPopupHidden = false;
 var runNextTest;
 
 function startTest()
@@ -287,17 +289,18 @@ function checkPanelPosition(panel)
       if (iscentered)
         adj += Math.round(anchorRect.width) / 2;
       isWithinHalfPixel(panelRect.left, anchorRect.left * zoomFactor + adj, "anchored on left ");
       break;
     case "right":
       adj = hwinpos + parseInt(getComputedStyle(panel, "").marginRight);
       if (iscentered)
         adj += Math.round(anchorRect.width) / 2;
-      isWithinHalfPixel(panelRect.right, anchorRect.right * zoomFactor - adj, "anchored on right");
+      if (!isOSXYosemite)
+        isWithinHalfPixel(panelRect.right, anchorRect.right * zoomFactor - adj, "anchored on right");
       break;
   }
 
   is(anchor, expectedAnchor, "anchor");
 
   var arrow = document.getAnonymousElementByAttribute(panel, "anonid", "arrow");
   is(arrow.getAttribute("side"), expectedSide, "panel arrow side");
   is(arrow.hidden, false, "panel hidden");
--- a/toolkit/webapps/tests/chrome.ini
+++ b/toolkit/webapps/tests/chrome.ini
@@ -3,33 +3,33 @@ skip-if = buildapp == 'mulet' || os == "
 support-files =
   head.js
   app.sjs
   data/*
 
 [test_custom_origin.xul]
 skip-if = asan
 [test_custom_origin_uninstall_install.xul]
-skip-if = asan
+skip-if = asan || (os == 'mac' && os_version == '10.10') # Bug 1123085
 [test_install_appcache.xul]
 skip-if = asan
 [test_hosted.xul]
 [test_packaged.xul]
 [test_hosted_launch.xul]
 skip-if = asan
 [test_hosted_launch_no_registry.xul]
 skip-if = asan
 [test_packaged_launch.xul]
 skip-if = asan
 [test_packaged_launch_no_registry.xul]
 skip-if = asan
 [test_hosted_uninstall.xul]
-skip-if = os == "win" && os_version == "5.1" # see bug 981251
+skip-if = (os == "win" && os_version == "5.1") || (os == 'mac' && os_version == '10.10') # WinXP: bug 981251; OS X 10.10: bug 1123085
 [test_packaged_uninstall.xul]
-skip-if = os == "win" && os_version == "5.1" # see bug 981251
+skip-if = (os == "win" && os_version == "5.1") || (os == 'mac' && os_version == '10.10') # WinXP: bug 981251; OS X 10.10: bug 1123085
 [test_hosted_update_from_webapp_runtime.xul]
 skip-if = asan
 [test_packaged_update_from_webapp_runtime.xul]
 skip-if = asan
 [test_hosted_icons.xul]
 [test_hosted_checkforupdates_from_webapp_runtime.xul]
 skip-if = asan
 [test_packaged_icons.xul]