Merge m-b to b2g18. a=merge
authorL. David Baron <dbaron@dbaron.org>
Fri, 21 Dec 2012 16:39:05 -0800
changeset 226373 e10944e73371e4a9bf498eb4c936c7a339be4d4b
parent 226372 2c948f94054db1d6679777be650d319acc84894e (current diff)
parent 217230 4d94221c82df9511a50ef6484dfbff7e5f1dff16 (diff)
child 226374 400714f446452ef9138ed0056346211189dfc36f
push id27461
push userjryans@gmail.com
push dateThu, 14 Aug 2014 18:06:31 +0000
treeherdertry@c3a6ad80e3a8 [default view] [failures only]
reviewersmerge
milestone18.0
Merge m-b to b2g18. a=merge
build/Makefile.in
layout/reftests/table-width/colspan-distribute-to-empty-1-ref.html
layout/reftests/table-width/colspan-distribute-to-empty-1a.html
layout/reftests/table-width/colspan-distribute-to-empty-1b.html
layout/reftests/table-width/colspan-distribute-to-empty-2-ref.html
layout/reftests/table-width/colspan-distribute-to-empty-2.html
--- a/content/media/ogg/nsOggReader.cpp
+++ b/content/media/ogg/nsOggReader.cpp
@@ -405,24 +405,27 @@ nsresult nsOggReader::DecodeVorbis(ogg_p
     }
   }
   return NS_OK;
 }
 #ifdef MOZ_OPUS
 nsresult nsOggReader::DecodeOpus(ogg_packet* aPacket) {
   NS_ASSERTION(aPacket->granulepos != -1, "Must know opus granulepos!");
 
-  // Maximum value is 63*2880.
+  // Maximum value is 63*2880, so there's no chance of overflow.
   int32_t frames_number = opus_packet_get_nb_frames(aPacket->packet,
                                                     aPacket->bytes);
+  if (frames_number <= 0)
+    return NS_ERROR_FAILURE; // Invalid packet header.
   int32_t samples = opus_packet_get_samples_per_frame(aPacket->packet,
                                                       (opus_int32) mOpusState->mRate);
   int32_t frames = frames_number*samples;
 
-  if (frames <= 0)
+  // A valid Opus packet must be between 2.5 and 120 ms long.
+  if (frames < 120 || frames > 5760)
     return NS_ERROR_FAILURE;
   uint32_t channels = mOpusState->mChannels;
   nsAutoArrayPtr<AudioDataValue> buffer(new AudioDataValue[frames * channels]);
 
   // Decode to the appropriate sample type.
 #ifdef MOZ_SAMPLE_TYPE_FLOAT32
   int ret = opus_multistream_decode_float(mOpusState->mDecoder,
                                           aPacket->packet, aPacket->bytes,
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -346,43 +346,48 @@ XBLEnumerate(JSContext *cx, JS::Handle<J
 {
   nsXBLPrototypeBinding* protoBinding =
     static_cast<nsXBLPrototypeBinding*>(::JS_GetReservedSlot(obj, 0).toPrivate());
   MOZ_ASSERT(protoBinding);
 
   return protoBinding->ResolveAllFields(cx, obj);
 }
 
-nsXBLJSClass::nsXBLJSClass(const nsAFlatCString& aClassName)
+uint64_t nsXBLJSClass::sIdCount = 0;
+
+nsXBLJSClass::nsXBLJSClass(const nsAFlatCString& aClassName,
+                           const nsCString& aKey)
 {
   memset(this, 0, sizeof(nsXBLJSClass));
   next = prev = static_cast<JSCList*>(this);
   name = ToNewCString(aClassName);
   flags =
     JSCLASS_HAS_PRIVATE | JSCLASS_PRIVATE_IS_NSISUPPORTS |
     JSCLASS_NEW_RESOLVE |
     // Our one reserved slot holds the relevant nsXBLPrototypeBinding
     JSCLASS_HAS_RESERVED_SLOTS(1);
   addProperty = delProperty = getProperty = ::JS_PropertyStub;
   setProperty = ::JS_StrictPropertyStub;
   enumerate = XBLEnumerate;
   resolve = (JSResolveOp)XBLResolve;
   convert = ::JS_ConvertStub;
   finalize = XBLFinalize;
+  mKey = aKey;
 }
 
 nsrefcnt
 nsXBLJSClass::Destroy()
 {
   NS_ASSERTION(next == prev && prev == static_cast<JSCList*>(this),
                "referenced nsXBLJSClass is on LRU list already!?");
 
   if (nsXBLService::gClassTable) {
-    nsCStringKey key(name);
+    nsCStringKey key(mKey);
     (nsXBLService::gClassTable)->Remove(&key);
+    mKey.Truncate();
   }
 
   if (nsXBLService::gClassLRUListLength >= nsXBLService::gClassLRUListQuota) {
     // Over LRU list quota, just unhash and delete this class.
     delete this;
   } else {
     // Put this most-recently-used class on end of the LRU-sorted freelist.
     JSCList* mru = static_cast<JSCList*>(this);
@@ -1353,88 +1358,102 @@ nsXBLBinding::WalkRules(nsIStyleRuleProc
 nsresult
 nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                             const nsAFlatCString& aClassName,
                             nsXBLPrototypeBinding* aProtoBinding,
                             JSObject** aClassObject)
 {
   // First ensure our JS class is initialized.
   nsAutoCString className(aClassName);
+  nsAutoCString xblKey(aClassName);
   JSObject* parent_proto = nullptr;  // If we have an "obj" we can set this
   JSAutoRequest ar(cx);
 
   JSAutoCompartment ac(cx, global);
-
+  nsXBLJSClass* c = nullptr;
   if (obj) {
     // Retrieve the current prototype of obj.
     if (!JS_GetPrototype(cx, obj, &parent_proto)) {
       return NS_ERROR_FAILURE;
     }
     if (parent_proto) {
       // We need to create a unique classname based on aClassName and
-      // parent_proto.  Append a space (an invalid URI character) to ensure that
+      // id.  Append a space (an invalid URI character) to ensure that
       // we don't have accidental collisions with the case when parent_proto is
       // null and aClassName ends in some bizarre numbers (yeah, it's unlikely).
       jsid parent_proto_id;
       if (!::JS_GetObjectId(cx, parent_proto, &parent_proto_id)) {
         // Probably OOM
         return NS_ERROR_OUT_OF_MEMORY;
       }
 
       // One space, maybe "0x", at most 16 chars (on a 64-bit system) of long,
       // and a null-terminator (which PR_snprintf ensures is there even if the
       // string representation of what we're printing does not fit in the buffer
       // provided).
       char buf[20];
-      PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
-      className.Append(buf);
+      if (sizeof(jsid) == 4) {
+        PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
+      } else {
+        MOZ_ASSERT(sizeof(jsid) == 8);
+        PR_snprintf(buf, sizeof(buf), " %llx", parent_proto_id);
+      }
+      xblKey.Append(buf);
+      nsCStringKey key(xblKey);
+
+      c = static_cast<nsXBLJSClass*>(nsXBLService::gClassTable->Get(&key));
+      if (c) {
+        className.Assign(c->name);
+      } else {
+        char buf[20];
+        PR_snprintf(buf, sizeof(buf), " %llx", nsXBLJSClass::NewId());
+        className.Append(buf);
+      }
     }
   }
 
   jsval val;
   JSObject* proto = NULL;
   if ((!::JS_LookupPropertyWithFlags(cx, global, className.get(), 0, &val)) ||
       JSVAL_IS_PRIMITIVE(val)) {
     // We need to initialize the class.
 
-    nsXBLJSClass* c;
-    void* classObject;
-    nsCStringKey key(className);
-    classObject = (nsXBLService::gClassTable)->Get(&key);
-
-    if (classObject) {
-      c = static_cast<nsXBLJSClass*>(classObject);
-
+    nsCStringKey key(xblKey);
+    if (!c) {
+      c = static_cast<nsXBLJSClass*>(nsXBLService::gClassTable->Get(&key));
+    }
+    if (c) {
       // If c is on the LRU list (i.e., not linked to itself), remove it now!
       JSCList* link = static_cast<JSCList*>(c);
       if (c->next != link) {
         JS_REMOVE_AND_INIT_LINK(link);
         nsXBLService::gClassLRUListLength--;
       }
     } else {
       if (JS_CLIST_IS_EMPTY(&nsXBLService::gClassLRUList)) {
         // We need to create a struct for this class.
-        c = new nsXBLJSClass(className);
+        c = new nsXBLJSClass(className, xblKey);
 
         if (!c)
           return NS_ERROR_OUT_OF_MEMORY;
       } else {
         // Pull the least recently used class struct off the list.
         JSCList* lru = (nsXBLService::gClassLRUList).next;
         JS_REMOVE_AND_INIT_LINK(lru);
         nsXBLService::gClassLRUListLength--;
 
         // Remove any mapping from the old name to the class struct.
         c = static_cast<nsXBLJSClass*>(lru);
-        nsCStringKey oldKey(c->name);
+        nsCStringKey oldKey(c->Key());
         (nsXBLService::gClassTable)->Remove(&oldKey);
 
         // Change the class name and we're done.
         nsMemory::Free((void*) c->name);
         c->name = ToNewCString(className);
+        c->SetKey(xblKey);
       }
 
       // Add c to our table.
       (nsXBLService::gClassTable)->Put(&key, (void*)c);
     }
 
     // The prototype holds a strong reference to its class struct.
     c->Hold();
--- a/content/xbl/src/nsXBLService.h
+++ b/content/xbl/src/nsXBLService.h
@@ -126,18 +126,25 @@ public:
 
   nsFixedSizeAllocator mPool;
 };
 
 class nsXBLJSClass : public JSCList, public JSClass
 {
 private:
   nsrefcnt mRefCnt;
+  nsCString mKey;
+  static uint64_t sIdCount;
   nsrefcnt Destroy();
 
 public:
-  nsXBLJSClass(const nsAFlatCString& aClassName);
+  nsXBLJSClass(const nsAFlatCString& aClassName, const nsCString& aKey);
   ~nsXBLJSClass() { nsMemory::Free((void*) name); }
 
+  static uint64_t NewId() { return ++sIdCount; }
+
+  nsCString& Key() { return mKey; }
+  void SetKey(const nsCString& aKey) { mKey = aKey; }
+
   nsrefcnt Hold() { return ++mRefCnt; }
   nsrefcnt Drop() { return --mRefCnt ? mRefCnt : Destroy(); }
 };
 
new file mode 100644
--- /dev/null
+++ b/dom/bindings/crashtests/822340-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+  var xhr = new XMLHttpRequest;
+  function f() {
+    var x = xhr.getResponseHeader;
+    x("abc");
+  }
+  for (var i = 0; i < 20000; ++i) {
+    try { f(); } catch (e) {}
+  }
+</script>
new file mode 100644
--- /dev/null
+++ b/dom/bindings/crashtests/822340-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+  var l = document.getElementsByTagName("*");
+  var count = 20000;
+  for (var i = 0; i < count; ++i) {
+    l.item(0);
+  }
+</script>
--- a/dom/bindings/crashtests/crashtests.list
+++ b/dom/bindings/crashtests/crashtests.list
@@ -1,1 +1,3 @@
 asserts-if(cocoaWidget,0-1) load 769464.html
+load 822340-1.html
+load 822340-2.html
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -2914,20 +2914,28 @@ nsPluginHost::ReadPluginInfo()
       return rv;
 
     // If this is an old plugin registry mark this plugin tag to be refreshed
     int64_t lastmod = (vdiff == 0) ? nsCRT::atoll(values[0]) : -1;
     uint32_t tagflag = atoi(values[2]);
     if (!reader.NextLine())
       return rv;
 
-    const char *description = reader.LinePtr();
+    char *description = reader.LinePtr();
     if (!reader.NextLine())
       return rv;
 
+#if MOZ_WIDGET_ANDROID
+    // Flash on Android does not populate the version field, but it is tacked on to the description.
+    // For example, "Shockwave Flash 11.1 r115"
+    if (PL_strncmp("Shockwave Flash ", description, 16) == 0 && description[16]) {
+      version = &description[16];
+    }
+#endif
+
     const char *name = reader.LinePtr();
     if (!reader.NextLine())
       return rv;
 
     int mimetypecount = atoi(reader.LinePtr());
 
     char *stackalloced[PLUGIN_REG_MIMETYPES_ARRAY_SIZE * 3];
     char **mimetypes;
--- a/dom/workers/EventListenerManager.cpp
+++ b/dom/workers/EventListenerManager.cpp
@@ -4,16 +4,17 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "EventListenerManager.h"
 
 #include "jsapi.h"
 #include "jsfriendapi.h"
 #include "js/Vector.h"
 #include "mozilla/Util.h"
+#include "nsAutoJSValHolder.h"
 
 #include "Events.h"
 #include "EventTarget.h"
 
 USING_WORKERS_NAMESPACE
 using mozilla::ErrorResult;
 
 namespace {
@@ -326,29 +327,43 @@ EventListenerManager::DispatchEvent(JSCo
   ListenerCollection* collection =
     GetCollectionForType(&mCollectionHead,
                          INTERNED_STRING_TO_JSID(aCx, eventType));
   if (!collection) {
     return false;
   }
 
   ContextAllocPolicy ap(aCx);
-  js::Vector<JSObject*, 10, ContextAllocPolicy> listeners(ap);
+
+  // XXXbent There is no reason to use nsAutoJSValHolder here as we should be
+  //         able to use js::AutoValueVector. Worse, nsAutoJSValHolder is much
+  //         slower. However, js::AutoValueVector causes crashes on Android at
+  //         the moment so we don't have much choice.
+  js::Vector<nsAutoJSValHolder, 10, ContextAllocPolicy> listeners(ap);
 
   for (PRCList* elem = PR_NEXT_LINK(&collection->mListenerHead);
        elem != &collection->mListenerHead;
        elem = PR_NEXT_LINK(elem)) {
     ListenerData* listenerData = static_cast<ListenerData*>(elem);
 
     // Listeners that don't want untrusted events will be skipped if this is an
     // untrusted event.
-    if ((eventIsTrusted || listenerData->mWantsUntrusted) &&
-        !listeners.append(listenerData->mListener)) {
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return false;
+    if (eventIsTrusted || listenerData->mWantsUntrusted) {
+      nsAutoJSValHolder holder;
+      if (!holder.Hold(aCx)) {
+        aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+        return false;
+      }
+
+      holder = listenerData->mListener;
+
+      if (!listeners.append(holder)) {
+        aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+        return false;
+      }
     }
   }
 
   if (listeners.empty()) {
     return false;
   }
 
   SetEventTarget(aEvent, aTarget.GetJSObject());
@@ -359,17 +374,17 @@ EventListenerManager::DispatchEvent(JSCo
     }
 
     // If anything fails in here we want to report the exception and continue on
     // to the next listener rather than bailing out. If something fails and
     // does not set an exception then we bail out entirely as we've either run
     // out of memory or the operation callback has indicated that we should
     // stop running.
 
-    jsval listenerVal = OBJECT_TO_JSVAL(listeners[index]);
+    jsval listenerVal = listeners[index];
 
     JSObject* listenerObj;
     if (!JS_ValueToObject(aCx, listenerVal, &listenerObj)) {
       if (!JS_ReportPendingException(aCx)) {
         aRv.Throw(NS_ERROR_FAILURE);
         return false;
       }
       continue;
--- a/gfx/2d/QuartzSupport.mm
+++ b/gfx/2d/QuartzSupport.mm
@@ -726,38 +726,49 @@ void nsCARenderer::SetBounds(int aWidth,
   if (mContentsScaleFactor != 1.0) {
     CGAffineTransform affineTransform = [layer affineTransform];
     affineTransform.a = mContentsScaleFactor;
     affineTransform.d = mContentsScaleFactor;
     affineTransform.tx = ((double)aWidth)/mContentsScaleFactor;
     affineTransform.ty = ((double)aHeight)/mContentsScaleFactor;
     [layer setAffineTransform:affineTransform];
     if ([layer respondsToSelector:@selector(setContentsScale:)]) {
-      // For reasons that aren't clear (perhaps one or more OS bugs), OOP
-      // Core Graphics plugins (ones that use CGBridgeLayer) can only use
-      // HiDPI mode if the tree is built with the 10.7 SDK or up.
+      // For reasons that aren't clear (perhaps one or more OS bugs), if layer
+      // belongs to a subclass of CALayer we can only use full HiDPI resolution
+      // here if the tree is built with the 10.7 SDK or up:  If we change
+      // layer.contentsScale (even to the same value), layer simply stops
+      // working (goes blank).  And even if we're building with the 10.7 SDK,
+      // we can't use full HiDPI resolution if layer belongs to CAOpenGLLayer
+      // or a subclass:  Changing layer.contentsScale to values higher than
+      // 1.0 makes it display only in the lower left part of its "box".
+      // We use CGBridgeLayer (a subclass of CALayer) to implement CoreGraphics
+      // mode for OOP plugins.  Shockwave uses a subclass of CAOpenGLLayer
+      // (SWRenderer) to implement CoreAnimation mode.  The SlingPlayer plugin
+      // uses another subclass of CAOpenGLLayer (CoreAnimationLayer).
 #if !defined(MAC_OS_X_VERSION_10_7) || \
     MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
-      Class CGBridgeLayerClass = ::NSClassFromString(@"CGBridgeLayer");
-      if (!CGBridgeLayerClass || ![layer isKindOfClass:CGBridgeLayerClass])
+      if ([layer isMemberOfClass:[CALayer class]])
+#else
+      if (![layer isKindOfClass:[CAOpenGLLayer class]])
 #endif
       {
         layer.contentsScale = mContentsScaleFactor;
       }
     }
   } else {
     // These settings are the default values.  But they might have been
     // changed as above if we were previously running in a HiDPI mode
     // (i.e. if we just switched from that to a non-HiDPI mode).
     [layer setAffineTransform:CGAffineTransformIdentity];
     if ([layer respondsToSelector:@selector(setContentsScale:)]) {
 #if !defined(MAC_OS_X_VERSION_10_7) || \
     MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
-      Class CGBridgeLayerClass = ::NSClassFromString(@"CGBridgeLayer");
-      if (!CGBridgeLayerClass || ![layer isKindOfClass:CGBridgeLayerClass])
+      if ([layer isMemberOfClass:[CALayer class]])
+#else
+      if (![layer isKindOfClass:[CAOpenGLLayer class]])
 #endif
       {
         layer.contentsScale = 1.0;
       }
     }
   }
   [CATransaction commit];
 
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -5562,76 +5562,16 @@ TestShouldDOMCall(JSContext *cx, types::
         RootedObject proto(cx, typeProto);
         if (!instanceChecker(proto, jinfo->protoID, jinfo->depth))
             return false;
     }
 
     return true;
 }
 
-static bool
-TestAreKnownDOMTypes(JSContext *cx, types::TypeSet *inTypes)
-{
-    if (inTypes->unknown())
-        return false;
-
-    // First iterate to make sure they all are DOM objects, then freeze all of
-    // them as such if they are.
-    for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
-        types::TypeObject *curType = inTypes->getTypeObject(i);
-
-        if (!curType) {
-            JSObject *curObj = inTypes->getSingleObject(i);
-
-            // Skip holes in TypeSets.
-            if (!curObj)
-                continue;
-
-            curType = curObj->getType(cx);
-        }
-
-        if (curType->unknownProperties())
-            return false;
-
-        // Unlike TypeSet::HasObjectFlags, TypeObject::hasAnyFlags doesn't add a
-        // freeze.
-        if (curType->hasAnyFlags(types::OBJECT_FLAG_NON_DOM))
-            return false;
-    }
-
-    // If we didn't check anything, no reason to say yes.
-    if (inTypes->getObjectCount() > 0)
-        return true;
-
-    return false;
-}
-
-static void
-FreezeDOMTypes(JSContext *cx, types::StackTypeSet *inTypes)
-{
-    for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
-        types::TypeObject *curType = inTypes->getTypeObject(i);
-
-        if (!curType) {
-            JSObject *curObj = inTypes->getSingleObject(i);
-
-            // Skip holes in TypeSets.
-            if (!curObj)
-                continue;
-
-            curType = curObj->getType(cx);
-        }
-
-        // Add freeze by asking the question.
-        DebugOnly<bool> wasntDOM =
-            types::HeapTypeSet::HasObjectFlags(cx, curType, types::OBJECT_FLAG_NON_DOM);
-        JS_ASSERT(!wasntDOM);
-    }
-}
-
 bool
 IonBuilder::annotateGetPropertyCache(JSContext *cx, MDefinition *obj, MGetPropertyCache *getPropCache,
                                     types::StackTypeSet *objTypes, types::StackTypeSet *pushedTypes)
 {
     RootedId id(cx, NameToId(getPropCache->name()));
     if ((jsid)id != types::MakeTypeId(cx, id))
         return true;
 
@@ -5830,25 +5770,16 @@ IonBuilder::jsop_getprop(HandlePropertyN
         if (isKnownConstant) {
             if (testObject) {
                 MGuardObject *guard = MGuardObject::New(obj);
                 current->add(guard);
             }
             MConstant *known = MConstant::New(ObjectValue(*singleton));
             current->add(known);
             current->push(known);
-            if (singleton->isFunction()) {
-                RootedFunction singletonFunc(cx, singleton->toFunction());
-                if (TestAreKnownDOMTypes(cx, unaryTypes.inTypes) &&
-                    TestShouldDOMCall(cx, unaryTypes.inTypes, singletonFunc, JSJitInfo::Method))
-                {
-                    FreezeDOMTypes(cx, unaryTypes.inTypes);
-                    known->setDOMFunction();
-                }
-            }
             return true;
         }
     }
 
     if (types::TypeSet *propTypes = GetDefiniteSlot(cx, unaryTypes.inTypes, name)) {
         MDefinition *useObj = obj;
         if (unaryTypes.inTypes && unaryTypes.inTypes->baseFlags()) {
             MGuardObject *guard = MGuardObject::New(obj);
--- a/js/xpconnect/public/nsAutoJSValHolder.h
+++ b/js/xpconnect/public/nsAutoJSValHolder.h
@@ -13,29 +13,32 @@
 /**
  * Simple class that looks and acts like a jsval except that it unroots
  * itself automatically if Root() is ever called. Designed to be rooted on the
  * context or runtime (but not both!).
  */
 class nsAutoJSValHolder
 {
 public:
-  nsAutoJSValHolder() : mVal(JSVAL_NULL), mRt(nullptr)
+  nsAutoJSValHolder()
+    : mVal(JSVAL_NULL), mRt(nullptr)
   {
     // nothing to do
   }
 
   /**
    * Always release on destruction.
    */
   virtual ~nsAutoJSValHolder() {
     Release();
   }
 
-  nsAutoJSValHolder(const nsAutoJSValHolder& aOther) {
+  nsAutoJSValHolder(const nsAutoJSValHolder& aOther)
+    : mVal(JSVAL_NULL), mRt(nullptr)
+  {
     *this = aOther;
   }
 
   nsAutoJSValHolder& operator=(const nsAutoJSValHolder& aOther) {
     if (this != &aOther) {
       if (aOther.IsHeld()) {
         // XXX No error handling here...
         this->Hold(aOther.mRt);
deleted file mode 100644
--- a/layout/reftests/table-width/colspan-distribute-to-empty-1-ref.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!DOCTYPE HTML>
-<title>Distributing widths from spanning cells to empty columns</title>
-<table cellpadding="0" cellspacing="0" width="75">
-  <tr>
-    <td width="25" bgcolor="yellow" >&nbsp;</td>
-    <td width="25" bgcolor="aqua"   >&nbsp;</td>
-    <td width="25" bgcolor="aqua"   >&nbsp;</td>
-  </tr>
-  <tr>
-    <td width="25" bgcolor="fuchsia">&nbsp;</td>
-    <td width="25" bgcolor="fuchsia">&nbsp;</td>
-    <td width="25" bgcolor="yellow" >&nbsp;</td>
-  </tr>
-</table>
deleted file mode 100644
--- a/layout/reftests/table-width/colspan-distribute-to-empty-1a.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML>
-<title>Distributing widths from spanning cells to empty columns</title>
-<table cellpadding="0" cellspacing="0">
-  <tr>
-    <td width="25"             bgcolor="yellow" >&nbsp;</td>
-    <td width="50" colspan="2" bgcolor="aqua"   >&nbsp;</td>
-  </tr>
-  <tr>
-    <td width="50" colspan="2" bgcolor="fuchsia">&nbsp;</td>
-    <td width="25"             bgcolor="yellow" >&nbsp;</td>
-  </tr>
-</table>
deleted file mode 100644
--- a/layout/reftests/table-width/colspan-distribute-to-empty-1b.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML>
-<title>Distributing widths from spanning cells to empty columns</title>
-<table cellpadding="0" cellspacing="0" width="75">
-  <tr>
-    <td width="25"             bgcolor="yellow" >&nbsp;</td>
-    <td width="50" colspan="2" bgcolor="aqua"   >&nbsp;</td>
-  </tr>
-  <tr>
-    <td width="50" colspan="2" bgcolor="fuchsia">&nbsp;</td>
-    <td width="25"             bgcolor="yellow" >&nbsp;</td>
-  </tr>
-</table>
deleted file mode 100644
--- a/layout/reftests/table-width/colspan-distribute-to-empty-2-ref.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<table width="250" cellpadding="0" border="0" cellspacing="0">
-<tr>
-<td width="50" bgcolor=yellow>50
-<td width="180" bgcolor=aqua>This is a cell with enough text in it to wrap.
-<td width="20" bgcolor=lime><span style="display:inline-block"></span>
-</table>
-<table width="250" cellpadding="0" border="0" cellspacing="0">
-<tr>
-<td width="180" bgcolor=fuchsia>This is a cell with enough text in it to wrap.
-<td width="50" bgcolor=yellow>50
-<td width="20" bgcolor=lime><span style="display:inline-block"></span>
-</table>
deleted file mode 100644
--- a/layout/reftests/table-width/colspan-distribute-to-empty-2.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<!DOCTYPE html>
-<table width="250" cellpadding="0" border="0" cellspacing="0">
-<tr>
-<td width="50" bgcolor=yellow>50
-<td colspan="2" bgcolor=aqua>This is a cell with enough text in it to wrap.
-<td bgcolor=lime><span style="display:inline-block; width: 20px"></span>
-<tr>
-<td colspan="2" bgcolor=fuchsia>This is a cell with enough text in it to wrap.
-<td width="50" bgcolor=yellow>50
-<td bgcolor=lime><span style="display:inline-block; width: 20px"></span>
-</table>
--- a/layout/reftests/table-width/reftest.list
+++ b/layout/reftests/table-width/reftest.list
@@ -55,11 +55,8 @@ fails == default-box-sizing-collapse-qui
 == spanning-cell-sort-2-small-fixed.html spanning-cell-sort-2-fixed-ref.html
 == spanning-cell-sort-2-large-fixed.html spanning-cell-sort-2-fixed-ref.html
 == colgroup-vs-column-1.html colgroup-vs-column-1-ref.html
 == colgroup-vs-column-2.html colgroup-vs-column-2-ref.html
 == colgroup-vs-column-3.html colgroup-vs-column-3-ref.html
 == colgroup-vs-column-4.html colgroup-vs-column-4-ref.html
 == dynamic-fixed-layout-1.html dynamic-fixed-layout-1-ref.html
 == cell-pref-width-border-box.html cell-pref-width-border-box-ref.html
-== colspan-distribute-to-empty-1a.html colspan-distribute-to-empty-1-ref.html
-== colspan-distribute-to-empty-1b.html colspan-distribute-to-empty-1-ref.html
-== colspan-distribute-to-empty-2.html colspan-distribute-to-empty-2-ref.html
--- a/layout/tables/BasicTableLayoutStrategy.cpp
+++ b/layout/tables/BasicTableLayoutStrategy.cpp
@@ -695,20 +695,20 @@ BasicTableLayoutStrategy::DistributeWidt
      *
      * If |aWidth| is *larger* than what we would assign in (4), then we
      * expand the columns:
      *
      *   a. if any columns without a specified coordinate width or
      *   percent width have nonzero pref width, in proportion to pref
      *   width [total_flex_pref]
      *
-     *   b. otherwise, if any columns without a specified coordinate
-     *   width or percent width, but with cells originating in them,
-     *   have zero pref width, equally between these
-     *   [numNonSpecZeroWidthCols]
+     *   b. (NOTE: this case is for BTLS_FINAL_WIDTH only) otherwise, if
+     *   any columns without a specified coordinate width or percent
+     *   width, but with cells originating in them have zero pref width,
+     *   equally between these [numNonSpecZeroWidthCols]
      *
      *   c. otherwise, if any columns without percent width have nonzero
      *   pref width, in proportion to pref width [total_fixed_pref]
      *
      *   d. otherwise, if any columns have nonzero percentage widths, in
      *   proportion to the percentage widths [total_pct]
      *
      *   e. otherwise, equally.
@@ -756,17 +756,18 @@ BasicTableLayoutStrategy::DistributeWidt
                 // we'll add on the rest of guess_min_spec outside the
                 // loop
                 nscoord delta = NSCoordSaturatingSubtract(pref_width, 
                                                           min_width, 0);
                 guess_min_spec = NSCoordSaturatingAdd(guess_min_spec, delta);
                 total_fixed_pref = NSCoordSaturatingAdd(total_fixed_pref, 
                                                         pref_width);
             } else if (pref_width == 0) {
-                if (cellMap->GetNumCellsOriginatingInCol(col) > 0) {
+                if (aWidthType == BTLS_FINAL_WIDTH &&
+                    cellMap->GetNumCellsOriginatingInCol(col) > 0) {
                     ++numNonSpecZeroWidthCols;
                 }
             } else {
                 total_flex_pref = NSCoordSaturatingAdd(total_flex_pref,
                                                        pref_width);
             }
         }
     }
@@ -817,16 +818,19 @@ BasicTableLayoutStrategy::DistributeWidt
                                                 nscoord_MAX);
         }
     } else {
         space = NSCoordSaturatingSubtract(aWidth, guess_pref, nscoord_MAX);
         if (total_flex_pref > 0) {
             l2t = FLEX_FLEX_LARGE;
             basis.c = total_flex_pref;
         } else if (numNonSpecZeroWidthCols > 0) {
+            NS_ASSERTION(aWidthType == BTLS_FINAL_WIDTH,
+                         "numNonSpecZeroWidthCols should only "
+                         "be set when we're setting final width.");
             l2t = FLEX_FLEX_LARGE_ZERO;
             basis.c = numNonSpecZeroWidthCols;
         } else if (total_fixed_pref > 0) {
             l2t = FLEX_FIXED_LARGE;
             basis.c = total_fixed_pref;
         } else if (total_pct > 0.0f) {
             l2t = FLEX_PCT_LARGE;
             basis.f = total_pct;
@@ -946,16 +950,19 @@ BasicTableLayoutStrategy::DistributeWidt
                             float c = float(space) / float(basis.c);
                             basis.c -= col_width;
                             col_width += NSToCoordRound(float(col_width) * c);
                         }
                     }
                 }
                 break;
             case FLEX_FLEX_LARGE_ZERO:
+                NS_ASSERTION(aWidthType == BTLS_FINAL_WIDTH,
+                             "FLEX_FLEX_LARGE_ZERO only should be hit "
+                             "when we're setting final width.");
                 if (pct == 0.0f &&
                     !colFrame->GetHasSpecifiedCoord() &&
                     cellMap->GetNumCellsOriginatingInCol(col) > 0) {
 
                     NS_ASSERTION(col_width == 0 &&
                                  colFrame->GetPrefCoord() == 0,
                                  "Since we're in FLEX_FLEX_LARGE_ZERO case, "
                                  "all auto-width cols should have zero pref "
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -142,18 +142,18 @@ abstract public class BrowserApp extends
                     loadFavicon(tab);
                 }
             });
         }
     }
 
     @Override
     void handleClearHistory() {
+        super.handleClearHistory();
         updateAboutHomeTopSites();
-        super.handleClearHistory();
     }
 
     @Override
     void handleSecurityChange(final int tabId, final JSONObject identityData) {
         super.handleSecurityChange(tabId, identityData);
         final Tab tab = Tabs.getInstance().getTab(tabId);
         if (tab == null)
             return;
--- a/mobile/android/base/background/announcements/AnnouncementsConstants.java
+++ b/mobile/android/base/background/announcements/AnnouncementsConstants.java
@@ -5,17 +5,17 @@
 package org.mozilla.gecko.background.announcements;
 
 import org.mozilla.gecko.sync.GlobalConstants;
 
 import android.app.AlarmManager;
 
 public class AnnouncementsConstants {
   // Not `final` so we have the option to turn this on at runtime with a magic addon.
-  public static boolean DISABLED = true;
+  public static boolean DISABLED = false;
 
   public static final String GLOBAL_LOG_TAG = "GeckoAnnounce";
   public static final String ACTION_ANNOUNCEMENTS_PREF = "org.mozilla.gecko.ANNOUNCEMENTS_PREF";
 
   static final String PREFS_BRANCH = "background";
   static final String PREF_LAST_FETCH_LOCAL_TIME  = "last_fetch";
   static final String PREF_LAST_FETCH_SERVER_DATE = "last_announce_date";
   static final String PREF_LAST_LAUNCH = "last_firefox_launch";
--- a/netwerk/base/src/nsPACMan.cpp
+++ b/netwerk/base/src/nsPACMan.cpp
@@ -490,16 +490,39 @@ nsPACMan::ProcessPendingQ()
 
   // do GC while the thread has nothing pending
   mPAC.GC();
 
   if (mShutdown)
     mPAC.Shutdown();
 }
 
+// this is to workaround bug 815783 and is not a general
+// purpose solution. It is intended to only be applied to gecko 18
+static nsresult
+WorkaroundFileLocalhostURL(nsACString &aURI)
+{
+  // only deal with file://
+  if (!StringBeginsWith(aURI, NS_LITERAL_CSTRING("file://")))
+    return NS_OK;
+
+  // file://localhost/foo -> file:///foo
+  if (StringBeginsWith(aURI, NS_LITERAL_CSTRING("file://localhost/"))) {
+    aURI.Replace(0, 17, NS_LITERAL_CSTRING("file:///"));
+    return NS_OK;
+  }
+  
+  // file://?:/foo -> file:///foo
+  if (aURI.Length() >= 10 && aURI.CharAt(8) == ':' && aURI.CharAt(9) == '/') {
+    aURI.Replace(0, 10, NS_LITERAL_CSTRING("file:///"));
+  }
+      
+  return NS_OK;
+}
+
 // returns true if progress was made by shortening the queue
 bool
 nsPACMan::ProcessPending()
 {
   if (mPendingQ.isEmpty())
     return false;
 
   // queue during normal load, but if we are retrying a failed load then
@@ -518,16 +541,17 @@ nsPACMan::ProcessPending()
   bool completed = false;
   mInProgress = true;
   nsAutoCString PACURI;
 
   // first we need to consider the system proxy changing the pac url
   if (mSystemProxySettings &&
       NS_SUCCEEDED(mSystemProxySettings->GetPACURI(PACURI)) &&
       !PACURI.IsEmpty() &&
+      NS_SUCCEEDED(WorkaroundFileLocalhostURL(PACURI)) && // bug 815783 for Gecko 18 only
       !PACURI.Equals(mPACURISpec)) {
     query->UseAlternatePACFile(PACURI);
     completed = true;
   }
 
   // now try the system proxy settings for this particular url if
   // PAC was not specified
   if (!completed && mSystemProxySettings && PACURI.IsEmpty() &&