Merge inbound to mozilla-central. a=merge

--HG--
rename : toolkit/themes/shared/in-content/check-partial.svg => toolkit/themes/shared/icons/check-partial.svg
rename : browser/themes/shared/icons/check.svg => toolkit/themes/shared/icons/check.svg

accessible/generic/ImageAccessible.cpp

@@ -61,7 +61,7 @@ ImageAccessible::NativeState() const
     imageRequest->GetImage(getter_AddRefs(imgContainer));
 
   if (imgContainer) {
-    bool animated;
+    bool animated = false;
     imgContainer->GetAnimated(&animated);
     if (animated)
       state |= states::ANIMATED;

browser/config/mozconfigs/win64/nightly-asan-reporter

@@ -35,8 +35,4 @@ ac_add_options --disable-sandbox
 # while the build otherwise identifies as "nightly" to receive its updates.
 export MOZ_TELEMETRY_REPORTING=1
 
-# Disable stack instrumentation until we can tackle bug 1477490
-export CFLAGS="-mllvm -asan-stack=0"
-export CXXFLAGS="-mllvm -asan-stack=0"
-
 . "$topsrcdir/build/mozconfig.common.override"

build/build-clang/clang-win64.json

@@ -15,6 +15,8 @@
     "ml": "ml64.exe",
     "patches": [
       "workaround-issue38586.patch",
+      "r342649-hotpatch-8-byte-nops.patch",
+      "r342652-unpoison-thread-stacks.patch",
       "loosen-msvc-detection.patch"
     ]
 }

build/build-clang/r342649-hotpatch-8-byte-nops.patch

@@ -0,0 +1,30 @@
+[winasan] Reduce hotpatch prefix check to 8 bytes
+
+Same idea as r310419: The 8 byte nop is a suffix of the 9 byte nop, and we need at most 6 bytes.
+
+Differential Revision: https://reviews.llvm.org/D51788
+
+--- a/compiler-rt/lib/interception/interception_win.cc	(revision 342648)
++++ b/compiler-rt/lib/interception/interception_win.cc	(revision 342649)
+@@ -223,8 +223,8 @@
+   return true;
+ }
+
+-static const u8 kHintNop9Bytes[] = {
+-  0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00
++static const u8 kHintNop8Bytes[] = {
++  0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00
+ };
+
+ template<class T>
+@@ -239,8 +239,8 @@
+ static bool FunctionHasPadding(uptr address, uptr size) {
+   if (IsMemoryPadding(address - size, size))
+     return true;
+-  if (size <= sizeof(kHintNop9Bytes) &&
+-      FunctionHasPrefix(address, kHintNop9Bytes))
++  if (size <= sizeof(kHintNop8Bytes) &&
++      FunctionHasPrefix(address, kHintNop8Bytes))
+     return true;
+   return false;
+ }

build/build-clang/r342652-unpoison-thread-stacks.patch

@@ -0,0 +1,34 @@
+[winasan] Unpoison the stack in NtTerminateThread
+
+In long-running builds we've seen some ASan complaints during thread creation that we suspect are due to leftover poisoning from previous threads whose stacks occupied that memory. This patch adds a hook that unpoisons the stack just before the NtTerminateThread syscall.
+
+Differential Revision: https://reviews.llvm.org/D52091
+
+--- a/compiler-rt/lib/asan/asan_win.cc	(revision 342651)
++++ b/compiler-rt/lib/asan/asan_win.cc	(revision 342652)
+@@ -154,6 +154,14 @@
+                             asan_thread_start, t, thr_flags, tid);
+ }
+
++INTERCEPTOR_WINAPI(void, NtTerminateThread, void *rcx) {
++  // Unpoison the terminating thread's stack because the memory may be re-used.
++  NT_TIB *tib = (NT_TIB *)NtCurrentTeb();
++  uptr stackSize = (uptr)tib->StackBase - (uptr)tib->StackLimit;
++  __asan_unpoison_memory_region(tib->StackLimit, stackSize);
++  return REAL(NtTerminateThread(rcx));
++}
++
+ // }}}
+
+ namespace __asan {
+@@ -161,7 +169,9 @@
+ void InitializePlatformInterceptors() {
+   ASAN_INTERCEPT_FUNC(CreateThread);
+   ASAN_INTERCEPT_FUNC(SetUnhandledExceptionFilter);
+-
++  CHECK(::__interception::OverrideFunction("NtTerminateThread",
++                                           (uptr)WRAP(NtTerminateThread),
++                                           (uptr *)&REAL(NtTerminateThread)));
+ #ifdef _WIN64
+   ASAN_INTERCEPT_FUNC(__C_specific_handler);
+ #else

build/mach_bootstrap.py

@@ -190,7 +190,7 @@ def resolve_repository():
 
     def telemetry_handler(context, data):
         # We have not opted-in to telemetry
-        if 'BUILD_SYSTEM_TELEMETRY' not in os.environ:
+        if not context.settings.build.telemetry:
             return
 
         telemetry_dir = os.path.join(get_state_dir()[0], 'telemetry')
@@ -206,35 +206,16 @@ def telemetry_handler(context, data):
             if e.errno != errno.EEXIST:
                 raise
 
-        # Add common metadata to help submit sorted data later on.
-        data['argv'] = sys.argv
-        data.setdefault('system', {}).update(dict(
-            architecture=list(platform.architecture()),
-            machine=platform.machine(),
-            python_version=platform.python_version(),
-            release=platform.release(),
-            system=platform.system(),
-            version=platform.version(),
-        ))
-
-        if platform.system() == 'Linux':
-            dist = list(platform.linux_distribution())
-            data['system']['linux_distribution'] = dist
-        elif platform.system() == 'Windows':
-            win32_ver = list((platform.win32_ver())),
-            data['system']['win32_ver'] = win32_ver
-        elif platform.system() == 'Darwin':
-            # mac version is a special Cupertino snowflake
-            r, v, m = platform.mac_ver()
-            data['system']['mac_ver'] = [r, list(v), m]
-
         with open(os.path.join(outgoing_dir, str(uuid.uuid4()) + '.json'),
                   'w') as f:
             json.dump(data, f, sort_keys=True)
 
     def should_skip_dispatch(context, handler):
         # The user is performing a maintenance command.
-        if handler.name in ('bootstrap', 'doctor', 'mach-commands', 'vcs-setup'):
+        if handler.name in ('bootstrap', 'doctor', 'mach-commands', 'vcs-setup',
+                            # We call mach environment in client.mk which would cause the
+                            # data submission to block the forward progress of make.
+                            'environment'):
             return True
 
         # We are running in automation.
@@ -257,13 +238,8 @@ def post_dispatch_handler(context, handler, args):
         if should_skip_dispatch(context, handler):
             return
 
-        # We call mach environment in client.mk which would cause the
-        # data submission below to block the forward progress of make.
-        if handler.name in ('environment'):
-            return
-
         # We have not opted-in to telemetry
-        if 'BUILD_SYSTEM_TELEMETRY' not in os.environ:
+        if not context.settings.build.telemetry:
             return
 
         # Every n-th operation

dom/svg/SVGTextPathElement.cpp

@@ -90,6 +90,18 @@ SVGTextPathElement::SVGTextPathElement(already_AddRefed<mozilla::dom::NodeInfo>&
 {
 }
 
+void
+SVGTextPathElement::HrefAsString(nsAString& aHref)
+{
+  if (mStringAttributes[SVGTextPathElement::HREF].IsExplicitlySet()) {
+    mStringAttributes[SVGTextPathElement::HREF]
+      .GetAnimValue(aHref, this);
+  } else {
+    mStringAttributes[SVGTextPathElement::XLINK_HREF]
+      .GetAnimValue(aHref, this);
+  }
+}
+
 //----------------------------------------------------------------------
 // nsINode methods
 

dom/svg/SVGTextPathElement.h

@@ -59,6 +59,8 @@ friend class ::SVGTextFrame;
   already_AddRefed<SVGAnimatedEnumeration> Side();
   already_AddRefed<SVGAnimatedString> Href();
 
+  void HrefAsString(nsAString& aHref);
+
  protected:
 
   virtual LengthAttributesInfo GetLengthInfo() override;

gfx/layers/client/ContentClient.cpp

@@ -195,7 +195,6 @@ ContentClient::BeginPaint(PaintedLayer* aLayer,
           newParameters.SetUnrotated();
           mBuffer->SetParameters(newParameters);
         } else {
-          MOZ_ASSERT(!result.mAsyncPaint);
           MOZ_ASSERT(GetFrontBuffer());
           mBuffer->Unlock();
           dest.mBufferRect = ComputeBufferRect(dest.mNeededRegion.GetBounds());

gfx/tests/crashtests/1470440.html

@@ -0,0 +1,7 @@
+<style>
+:last-child{
+  border-width: 9596.6vmin thin;
+  border-style: dotted;
+}
+</style>
+<rect id='id3'/>

gfx/tests/crashtests/crashtests.list

@@ -167,4 +167,5 @@ load 1408078-1.html
 load 1464243.html
 load 1467847-1.html
 load 1468020.html
+load 1470440.html
 load 1478035.html

js/src/devtools/automation/autospider.py

@@ -423,7 +423,7 @@ def need_updating_configure(configure):
             'make',
             'recurse_syms',
             'MOZ_SOURCE_REPO=file://' + DIR.source,
-            'RUST_TARGET=0', 'RUSTC_COMMIT=0',
+            'RUSTC_COMMIT=0',
             'MOZ_CRASHREPORTER=1',
             'MOZ_AUTOMATION_BUILD_SYMBOLS=1',
         ], check=True)

js/src/gc/GC.cpp

@@ -4283,6 +4283,11 @@ GCRuntime::purgeRuntime()
 
     MOZ_ASSERT(unmarkGrayStack.empty());
     unmarkGrayStack.clearAndFree();
+
+    // If we're the main runtime, tell helper threads to free their unused
+    // memory when they are next idle.
+    if (!rt->parentRuntime)
+        HelperThreadState().triggerFreeUnusedMemory();
 }
 
 bool

js/src/jit-test/tests/wasm/gc/anyref-global-object.js

@@ -47,9 +47,8 @@ assertEq(new WebAssembly.Global({value: "anyref"}) instanceof WebAssembly.Global
     assertEq(g.value instanceof Symbol, true);
     assertEq(g.value.toString(), "Symbol(status)");
 
-    assertErrorMessage(() => new WebAssembly.Global({value: "anyref"}, undefined),
-                       TypeError,
-                       "can't convert undefined to object");
+    g = new WebAssembly.Global({value: "anyref"}, undefined);
+    assertEq(g.value, null);
 })();
 
 (function() {

js/src/jit-test/tests/wasm/gc/anyref.js

@@ -93,11 +93,25 @@ let { exports } = wasmEvalText(`(module
         get_local 0
         ref.is_null
     )
-)`);
+
+    (func (export "ref_eq") (param $a anyref) (param $b anyref) (result i32)
+	  (ref.eq (get_local $a) (get_local $b)))
+
+    (func (export "ref_eq_for_control") (param $a anyref) (param $b anyref) (result f64)
+	  (if f64 (ref.eq (get_local $a) (get_local $b))
+	      (f64.const 5.0)
+	      (f64.const 3.0)))
+    )`);
 
 assertEq(exports.is_null(), 1);
 assertEq(exports.is_null_spill(), 1);
 assertEq(exports.is_null_local(), 1);
+assertEq(exports.ref_eq(null, null), 1);
+assertEq(exports.ref_eq(null, {}), 0);
+assertEq(exports.ref_eq(this, this), 1);
+assertEq(exports.ref_eq_for_control(null, null), 5);
+assertEq(exports.ref_eq_for_control(null, {}), 3);
+assertEq(exports.ref_eq_for_control(this, this), 5);
 
 // Anyref param and result in wasm functions.
 

js/src/jit-test/tests/wasm/gc/gc-feature-opt-in.js

@@ -118,3 +118,9 @@ assertErrorMessage(() => new WebAssembly.Module(wasmTextToBinary(
       (func ref.is_null))`)),
                    WebAssembly.CompileError,
                    /unrecognized opcode/);
+
+assertErrorMessage(() => new WebAssembly.Module(wasmTextToBinary(
+    `(module
+      (func ref.eq))`)),
+                   WebAssembly.CompileError,
+                   /unrecognized opcode/);

js/src/jit-test/tests/wasm/gc/ref.js

@@ -58,6 +58,11 @@ var bin = wasmTextToBinary(
        (call $imp (get_local 0))
        drop)
 
+      (func (param (ref $cons))
+       (drop (ref.eq (get_local 0) (ref.null (ref $cons))))
+       (drop (ref.eq (ref.null (ref $cons)) (get_local 0)))
+       (drop (ref.eq (get_local 0) (ref.null anyref)))
+       (drop (ref.eq (ref.null anyref) (get_local 0))))
      )`);
 
 // Validation

js/src/jit-test/tests/wasm/globals.js

@@ -343,12 +343,12 @@ wasmAssert(`(module
     assertEq(mod.exports.f(), 1);
 
     {
-        // "value" is enumerable
+        // "value" is enumerable and is the first enumerated value
         let x = new Global({value: "i32"});
         let s = "";
         for ( let i in x )
             s = s + i + ",";
-        assertEq(s, "value,");
+        assertEq(s.substring(0,6), "value,");
     }
 
     // "value" is defined on the prototype, not on the object

js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js → js/src/jit-test/tests/wasm/regress/proxy-get-trap-table.js

@@ -1,11 +1,14 @@
+// The 'get' handler should be invoked directly when reading fields of the
+// descriptor.
+
 assertErrorMessage(() => {
     var desc = {
         element: "anyfunc",
         initial: 1
     };
     var proxy = new Proxy({}, {
-        has: true
+        get: true
     });
     Object.setPrototypeOf(desc, proxy);
     let table = new WebAssembly.Table(desc);
-}, TypeError, /proxy handler's has trap/);
+}, TypeError, /proxy handler's get trap/);