68.14.8 - layout

layout/base/FrameProperties.h

@@ -62,7 +62,7 @@ struct FramePropertyDescriptorUntyped {
 template <typename T>
 struct FramePropertyDescriptor : public FramePropertyDescriptorUntyped {
   typedef void Destructor(T* aPropertyValue);
-  typedef void DestructorWithFrame(const nsIFrame* aaFrame, T* aPropertyValue);
+  typedef void DestructorWithFrame(const nsIFrame* aFrame, T* aPropertyValue);
 
   template <Destructor Dtor>
   static constexpr const FramePropertyDescriptor<T> NewWithDestructor() {
@@ -96,9 +96,9 @@ struct FramePropertyDescriptor : public FramePropertyDescriptorUntyped {
 };
 
 // SmallValueHolder<T> is a placeholder intended to be used as template
-// argument of FramePropertyDescriptor for types which can fit into the
+// argument of FramePropertyDescriptor for types which can fit directly into our
-// size of a pointer directly. This class should never be defined, so
+// internal value slot (i.e. types that can fit in 64 bits). This class should
-// that we won't use it for unexpected purpose by mistake.
+// never be defined, so that we won't use it for unexpected purpose by mistake.
 template <typename T>
 class SmallValueHolder;
 
@@ -119,12 +119,6 @@ struct FramePropertyTypeHelper<SmallValueHolder<T>> {
  * The FrameProperties class is optimized for storing 0 or 1 properties on
  * a given frame. Storing very large numbers of properties on a single
  * frame will not be efficient.
- *
- * Property values are passed as void* but do not actually have to be
- * valid pointers. You can use NS_INT32_TO_PTR/NS_PTR_TO_INT32 to
- * store int32_t values. Null/zero values can be stored and retrieved.
- * Of course, the destructor function (if any) must handle such values
- * correctly.
  */
 class FrameProperties {
  public:
@@ -154,8 +148,8 @@ class FrameProperties {
   template <typename T>
   void Set(Descriptor<T> aProperty, PropertyType<T> aValue,
            const nsIFrame* aFrame) {
-    void* ptr = ReinterpretHelper<T>::ToPointer(aValue);
+    uint64_t v = ReinterpretHelper<T>::ToInternalValue(aValue);
-    SetInternal(aProperty, ptr, aFrame);
+    SetInternal(aProperty, v, aFrame);
   }
 
   /**
@@ -164,8 +158,8 @@ class FrameProperties {
   template <typename T>
   void Add(Descriptor<T> aProperty, PropertyType<T> aValue) {
     MOZ_ASSERT(!Has(aProperty), "duplicate frame property");
-    void* ptr = ReinterpretHelper<T>::ToPointer(aValue);
+    uint64_t v = ReinterpretHelper<T>::ToInternalValue(aValue);
-    AddInternal(aProperty, ptr);
+    AddInternal(aProperty, v);
   }
 
   /**
@@ -207,8 +201,8 @@ class FrameProperties {
   template <typename T>
   PropertyType<T> Get(Descriptor<T> aProperty,
                       bool* aFoundResult = nullptr) const {
-    void* ptr = GetInternal(aProperty, aFoundResult);
+    uint64_t v = GetInternal(aProperty, aFoundResult);
-    return ReinterpretHelper<T>::FromPointer(ptr);
+    return ReinterpretHelper<T>::FromInternalValue(v);
   }
 
   /**
@@ -224,8 +218,8 @@ class FrameProperties {
    */
   template <typename T>
   PropertyType<T> Take(Descriptor<T> aProperty, bool* aFoundResult = nullptr) {
-    void* ptr = TakeInternal(aProperty, aFoundResult);
+    uint64_t v = TakeInternal(aProperty, aFoundResult);
-    return ReinterpretHelper<T>::FromPointer(ptr);
+    return ReinterpretHelper<T>::FromInternalValue(v);
   }
 
   /**
@@ -282,62 +276,63 @@ class FrameProperties {
   FrameProperties(const FrameProperties&) = delete;
   FrameProperties& operator=(const FrameProperties&) = delete;
 
-  inline void SetInternal(UntypedDescriptor aProperty, void* aValue,
+  inline void SetInternal(UntypedDescriptor aProperty, uint64_t aValue,
                           const nsIFrame* aFrame);
 
-  inline void AddInternal(UntypedDescriptor aProperty, void* aValue);
+  inline void AddInternal(UntypedDescriptor aProperty, uint64_t aValue);
 
-  inline void* GetInternal(UntypedDescriptor aProperty,
+  inline uint64_t GetInternal(UntypedDescriptor aProperty,
-                           bool* aFoundResult) const;
+                              bool* aFoundResult) const;
 
-  inline void* TakeInternal(UntypedDescriptor aProperty, bool* aFoundResult);
+  inline uint64_t TakeInternal(UntypedDescriptor aProperty, bool* aFoundResult);
 
   inline void RemoveInternal(UntypedDescriptor aProperty,
                              const nsIFrame* aFrame);
 
   template <typename T>
   struct ReinterpretHelper {
-    static_assert(sizeof(PropertyType<T>) <= sizeof(void*),
+    static_assert(sizeof(PropertyType<T>) <= sizeof(uint64_t),
-                  "size of the value must never be larger than a pointer");
+                  "size of the value must never be larger than 64 bits");
 
-    static void* ToPointer(PropertyType<T> aValue) {
+    static uint64_t ToInternalValue(PropertyType<T> aValue) {
-      void* ptr = nullptr;
+      uint64_t v = 0;
-      memcpy(&ptr, &aValue, sizeof(aValue));
+      memcpy(&v, &aValue, sizeof(aValue));
-      return ptr;
+      return v;
     }
 
-    static PropertyType<T> FromPointer(void* aPtr) {
+    static PropertyType<T> FromInternalValue(uint64_t aInternalValue) {
       PropertyType<T> value;
-      memcpy(&value, &aPtr, sizeof(value));
+      memcpy(&value, &aInternalValue, sizeof(value));
       return value;
     }
   };
 
-  template <typename T>
-  struct ReinterpretHelper<T*> {
-    static void* ToPointer(T* aValue) { return static_cast<void*>(aValue); }
-
-    static T* FromPointer(void* aPtr) { return static_cast<T*>(aPtr); }
-  };
-
   /**
    * Stores a property descriptor/value pair.
    */
   struct PropertyValue {
-    PropertyValue() : mProperty(nullptr), mValue(nullptr) {}
+    PropertyValue() : mProperty(nullptr), mValue(0) {}
-    PropertyValue(UntypedDescriptor aProperty, void* aValue)
+    PropertyValue(UntypedDescriptor aProperty, uint64_t aValue)
         : mProperty(aProperty), mValue(aValue) {}
 
+    // NOTE: This function converts our internal 64-bit-integer representation
+    // to a pointer-type representation. This is lossy on 32-bit systems, but it
+    // should be fine, as long as we *only* do this in cases where we're sure
+    // that the stored property-value is in fact a pointer. And we should have
+    // that assurance, since only pointer-typed frame properties are expected to
+    // have a destructor
     void DestroyValueFor(const nsIFrame* aFrame) {
       if (mProperty->mDestructor) {
-        mProperty->mDestructor(mValue);
+        mProperty->mDestructor(
+            ReinterpretHelper<void*>::FromInternalValue(mValue));
       } else if (mProperty->mDestructorWithFrame) {
-        mProperty->mDestructorWithFrame(aFrame, mValue);
+        mProperty->mDestructorWithFrame(
+            aFrame, ReinterpretHelper<void*>::FromInternalValue(mValue));
       }
     }
 
     UntypedDescriptor mProperty;
-    void* mValue;
+    uint64_t mValue;
   };
 
   /**
@@ -360,28 +355,29 @@ class FrameProperties {
   nsTArray<PropertyValue> mProperties;
 };
 
-inline void* FrameProperties::GetInternal(UntypedDescriptor aProperty,
+inline uint64_t FrameProperties::GetInternal(UntypedDescriptor aProperty,
-                                          bool* aFoundResult) const {
+                                             bool* aFoundResult) const {
   MOZ_ASSERT(aProperty, "Null property?");
 
   return mProperties.ApplyIf(
       aProperty, 0, PropertyComparator(),
-      [&aFoundResult](const PropertyValue& aPV) -> void* {
+      [&aFoundResult](const PropertyValue& aPV) -> uint64_t {
         if (aFoundResult) {
           *aFoundResult = true;
         }
         return aPV.mValue;
       },
-      [&aFoundResult]() -> void* {
+      [&aFoundResult]() -> uint64_t {
         if (aFoundResult) {
           *aFoundResult = false;
         }
-        return nullptr;
+        return 0;
       });
 }
 
 inline void FrameProperties::SetInternal(UntypedDescriptor aProperty,
-                                         void* aValue, const nsIFrame* aFrame) {
+                                         uint64_t aValue,
+                                         const nsIFrame* aFrame) {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aProperty, "Null property?");
 
@@ -395,15 +391,15 @@ inline void FrameProperties::SetInternal(UntypedDescriptor aProperty,
 }
 
 inline void FrameProperties::AddInternal(UntypedDescriptor aProperty,
-                                         void* aValue) {
+                                         uint64_t aValue) {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aProperty, "Null property?");
 
   mProperties.AppendElement(PropertyValue(aProperty, aValue));
 }
 
-inline void* FrameProperties::TakeInternal(UntypedDescriptor aProperty,
+inline uint64_t FrameProperties::TakeInternal(UntypedDescriptor aProperty,
-                                           bool* aFoundResult) {
+                                              bool* aFoundResult) {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aProperty, "Null property?");
 
@@ -412,14 +408,14 @@ inline void* FrameProperties::TakeInternal(UntypedDescriptor aProperty,
     if (aFoundResult) {
       *aFoundResult = false;
     }
-    return nullptr;
+    return 0;
   }
 
   if (aFoundResult) {
     *aFoundResult = true;
   }
 
-  void* result = mProperties.Elements()[index].mValue;
+  uint64_t result = mProperties.Elements()[index].mValue;
   mProperties.RemoveElementAt(index);
 
   return result;

layout/base/PresShell.cpp

@@ -197,7 +197,6 @@
 #include "mozilla/StyleSheetInlines.h"
 #include "mozilla/dom/ImageTracker.h"
 #include "nsIDocShellTreeOwner.h"
-#include "nsBindingManager.h"
 #include "nsClassHashtable.h"
 #include "nsHashKeys.h"
 #include "VisualViewport.h"
@@ -1729,20 +1728,6 @@ void PresShell::EndObservingDocument() {
 char* nsPresShell_ReflowStackPointerTop;
 #endif
 
-class XBLConstructorRunner : public Runnable {
- public:
-  explicit XBLConstructorRunner(Document* aDocument)
-      : Runnable("XBLConstructorRunner"), mDocument(aDocument) {}
-
-  NS_IMETHOD Run() override {
-    mDocument->BindingManager()->ProcessAttachedQueue();
-    return NS_OK;
-  }
-
- private:
-  RefPtr<Document> mDocument;
-};
-
 nsresult PresShell::Initialize() {
   if (mIsDestroying) {
     return NS_OK;
@@ -1810,10 +1795,6 @@ nsresult PresShell::Initialize() {
       // content object down
       mFrameConstructor->ContentInserted(
           root, nsCSSFrameConstructor::InsertionKind::Sync);
-      // Run the XBL binding constructors for any new frames we've constructed.
-      // (Do this in a script runner, since our caller might have a script
-      // blocker on the stack.)
-      nsContentUtils::AddScriptRunner(new XBLConstructorRunner(mDocument));
     }
     // Something in mFrameConstructor->ContentInserted may have caused
     // Destroy() to get called, bug 337586.  Or, nsAutoCauseReflowNotifier
@@ -2085,18 +2066,10 @@ void PresShell::FireResizeEvent() {
 }
 
 static nsIContent* GetNativeAnonymousSubtreeRoot(nsIContent* aContent) {
-  if (!aContent || !aContent->IsInNativeAnonymousSubtree()) {
+  if (!aContent) {
     return nullptr;
   }
-  auto* current = aContent;
+  return aContent->GetClosestNativeAnonymousSubtreeRoot();
-  // FIXME(emilio): This should not need to worry about current being null, but
-  // editor removes nodes in native anonymous subtrees, and we don't clean nodes
-  // from the current event content stack from ContentRemoved, so it can
-  // actually happen, see bug 1510208.
-  while (current && !current->IsRootOfNativeAnonymousSubtree()) {
-    current = current->GetFlattenedTreeParent();
-  }
-  return current;
 }
 
 void PresShell::NativeAnonymousContentRemoved(nsIContent* aAnonContent) {
@@ -2881,9 +2854,10 @@ void PresShell::SlotAssignmentWillChange(Element& aElement,
     return;
   }
 
-  // If the old slot is about to become empty, let layout know that it needs to
+  // If the old slot is about to become empty and show fallback, let layout know
-  // do work.
+  // that it needs to do work.
-  if (aOldSlot && aOldSlot->AssignedNodes().Length() == 1) {
+  if (aOldSlot && aOldSlot->AssignedNodes().Length() == 1 &&
+      aOldSlot->HasChildren()) {
     DestroyFramesForAndRestyle(aOldSlot);
   }
 
@@ -2894,7 +2868,7 @@ void PresShell::SlotAssignmentWillChange(Element& aElement,
   if (aNewSlot) {
     // If the new slot will stop showing fallback content, we need to reframe it
     // altogether.
-    if (aNewSlot->AssignedNodes().IsEmpty()) {
+    if (aNewSlot->AssignedNodes().IsEmpty() && aNewSlot->HasChildren()) {
       DestroyFramesForAndRestyle(aNewSlot);
       // Otherwise we just care about the element, but we need to ensure that
       // something takes care of traversing to the relevant slot, if needed.
@@ -2916,21 +2890,6 @@ static void AssertNoFramesInSubtree(nsIContent* aContent) {
   for (nsINode* node : ShadowIncludingTreeIterator(*aContent)) {
     nsIContent* c = nsIContent::FromNode(node);
     MOZ_ASSERT(!c->GetPrimaryFrame());
-    if (auto* binding = c->GetXBLBinding()) {
-      if (auto* bindingWithContent = binding->GetBindingWithContent()) {
-        nsIContent* anonContent = bindingWithContent->GetAnonymousContent();
-        MOZ_ASSERT(!anonContent->GetPrimaryFrame());
-
-        // Need to do this instead of just AssertNoFramesInSubtree(anonContent),
-        // because the parent of the children of the <content> element isn't the
-        // <content> element, but the bound element, and that confuses
-        // GetNextNode a lot.
-        for (nsIContent* child = anonContent->GetFirstChild(); child;
-             child = child->GetNextSibling()) {
-          AssertNoFramesInSubtree(child);
-        }
-      }
-    }
   }
 }
 #endif
@@ -3164,7 +3123,7 @@ nsresult PresShell::GoToAnchor(const nsAString& aAnchorName, bool aScroll,
     // Now focus the document itself if focus is on an element within it.
     nsPIDOMWindowOuter* win = mDocument->GetWindow();
 
-    nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+    nsFocusManager* fm = nsFocusManager::GetFocusManager();
     if (fm && win) {
       nsCOMPtr<mozIDOMWindowProxy> focusedWindow;
       fm->GetFocusedWindow(getter_AddRefs(focusedWindow));
@@ -3287,7 +3246,7 @@ static void AccumulateFrameBounds(nsIFrame* aContainerFrame, nsIFrame* aFrame,
     // We can't use nsRect::UnionRect since it drops empty rects on
     // the floor, and we need to include them.  (Thus we need
     // aHaveRect to know when to drop the initial value on the floor.)
-    aRect.UnionRectEdges(aRect, transformedBounds);
+    aRect = aRect.UnionEdges(transformedBounds);
   } else {
     aHaveRect = true;
     aRect = transformedBounds;
@@ -4130,13 +4089,6 @@ void PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) {
       mPresContext->RestyleManager()->ProcessPendingRestyles();
     }
 
-    // Process whatever XBL constructors those restyles queued up.  This
-    // ensures that onload doesn't fire too early and that we won't do extra
-    // reflows after those constructors run.
-    if (MOZ_LIKELY(!mIsDestroying)) {
-      mDocument->BindingManager()->ProcessAttachedQueue();
-    }
-
     // Now those constructors or events might have posted restyle
     // events.  At the same time, we still need up-to-date style data.
     // In particular, reflow depends on style being completely up to
@@ -6339,7 +6291,7 @@ PresShell::GetFocusedDOMWindowInOurWindow() {
 }
 
 already_AddRefed<nsIContent> PresShell::GetFocusedContentInOurWindow() const {
-  nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+  nsFocusManager* fm = nsFocusManager::GetFocusManager();
   if (fm && mDocument) {
     RefPtr<Element> focusedElement;
     fm->GetFocusedElementForWindow(mDocument->GetWindow(), false, nullptr,
@@ -10060,7 +10012,6 @@ bool PresShell::VerifyIncrementalReflow() {
     nsAutoCauseReflowNotifier crNotifier(this);
     presShell->Initialize();
   }
-  mDocument->BindingManager()->ProcessAttachedQueue();
   presShell->FlushPendingNotifications(FlushType::Layout);
   presShell->SetVerifyReflowEnable(
       true);  // turn on verify reflow again now that

layout/base/RestyleManager.cpp

@@ -560,7 +560,6 @@ nsCString RestyleManager::ChangeHintToString(nsChangeHint aHint) {
                          "UpdateBackgroundPosition",
                          "AddOrRemoveTransform",
                          "ScrollbarChange",
-                         "UpdateWidgetProperties",
                          "UpdateTableCellSpans",
                          "VisibilityChange"};
   static_assert(nsChangeHint_AllHints ==
@@ -1739,9 +1738,6 @@ void RestyleManager::ProcessRestyledFrames(nsStyleChangeList& aChangeList) {
         presContext->PresShell()->SynthesizeMouseMove(false);
         didUpdateCursor = true;
       }
-      if (hint & nsChangeHint_UpdateWidgetProperties) {
-        frame->UpdateWidgetProperties();
-      }
       if (hint & nsChangeHint_UpdateTableCellSpans) {
         frameConstructor->UpdateTableCellSpans(content);
       }
@@ -3111,7 +3107,6 @@ static void VerifyFlatTree(const nsIContent& aContent) {
   for (auto* content = iter.GetNextChild(); content;
        content = iter.GetNextChild()) {
     MOZ_ASSERT(content->GetFlattenedTreeParentNodeForStyle() == &aContent);
-    MOZ_ASSERT(!content->IsActiveChildrenElement());
     VerifyFlatTree(*content);
   }
 }
@@ -3311,8 +3306,8 @@ static inline bool AttributeChangeRequiresSubtreeRestyle(
     return aElement.IsHTMLElement(nsGkAtoms::table);
   }
   if (aAttr == nsGkAtoms::lwtheme || aAttr == nsGkAtoms::lwthemetextcolor) {
-    return aElement.GetNameSpaceID() == kNameSpaceID_XUL &&
+    Document* doc = aElement.OwnerDoc();
-           &aElement == aElement.OwnerDoc()->GetRootElement();
+    return doc->IsInChromeDocShell() && &aElement == doc->GetRootElement();
   }
   // TODO(emilio, bug 1598094): Maybe finer-grained invalidation for exportparts
   // attribute changes?

layout/base/crashtests/1423216.html

@@ -1,18 +0,0 @@
-<style>
-* {
-  -moz-binding: url(l)
-}
-</style>
-<script>
-o1 = document.createElement('span')
-o2 = document.createElement('span')
-document.documentElement.appendChild(o2)
-o2.appendChild(document.createElement('colgroup'))
-o3 = document.createComment('')
-o2.attachShadow({ mode: "open" }).append(o3)
-window.onload = () => {
-  o4 = document.createRange()
-  o4.setStartBefore(o3)
-  o4.insertNode(o1)
-}
-</script>

layout/base/crashtests/288790-1-inner.xhtml

@@ -1,47 +0,0 @@
-<?xml version="1.0"?>
-<html xmlns="http://www.w3.org/1999/xhtml">
-<title>Testcase bug 288790 - Crash [@ GetNearestContainingBlock] with this xbl testcase</title>
-<head>
-<style>
-#z {position: relative;}
-#z span{position: absolute;}
-</style>
-
-<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
-  <binding id="m"></binding>
-  <binding id="ma" extends="#m">
-    <content>
-        <html:div><children/></html:div>
-    </content>
-  </binding>
-</bindings>
-
-</head>
-<body>
-<div id="z"><span></span></div>
-
-
-<script>
-function doe(){
-document.getElementById('z').setAttribute('style','-moz-binding:url(#ma)');
-setTimeout(doe2,0);
-}
-
-function doe2(){
-document.getElementsByTagName('span')[0].setAttribute('style','-moz-binding:url(#m)');
-}
-</script>
-<button id="button" onclick="doe()">Click me</button><br/>
-Clicking on the above button two times, should not crash Mozilla.
-<script>
-function clickbutton()
-{
-  var ev = document.createEvent('MouseEvents');
-  ev.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
-  var button = document.getElementById('button');
-  button.dispatchEvent(ev);
-  button.dispatchEvent(ev);
-}
-clickbutton();
-</script>
-</body></html>

layout/base/crashtests/288790-1.html

@@ -1,9 +0,0 @@
-<html class="reftest-wait">
-<head>
-<script>
-setTimeout('document.documentElement.className = ""', 500);
-</script>
-<body>
-<iframe src="288790-1-inner.xhtml"></iframe>
-</body>
-</html>

layout/base/crashtests/350128-1.xhtml

@@ -1,21 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="lub4">
-    <content>
-      <html:span style="color: green;">
-        <children/>
-      </html:span>
-    </content>
-  </binding>
-</bindings>
-
-
-</head>
-
-<body onload="document.getElementById('gogo');">
-  <span style="-moz-binding: url('#lub4')"><div/><em id="gogo">I</em></span>
-</body>
-
-</html>

layout/base/crashtests/374193-1.xhtml

@@ -1,7 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"
-  ><mtd xmlns="http://www.w3.org/1998/Math/MathML"
-  ><th xmlns="http://www.w3.org/1999/xhtml"
-  /><mtable xmlns="http://www.w3.org/1998/Math/MathML"
-  ><th xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(374193-1xbl.xml);" id="mw_th20"></th></mtable></mtd><style>
-mtable::after { content:"anonymous text"; }
-</style></html>

layout/base/crashtests/374193-1xbl.xml

@@ -1,10 +0,0 @@
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="a">
-<implementation>
-<constructor>
-  this.style.position='fixed';
-</constructor>
-</implementation>
-<content><children/></content>
-</binding>
-</bindings>

layout/base/crashtests/379105-1.xhtml

@@ -1,48 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
-<head>
-<bindings xmlns="http://www.mozilla.org/xbl">
-
-<binding id="x"><content>
-  <zzz><children/></zzz>
-</content></binding>
-
-<binding id="empty"><content>
-</content></binding>
-
-</bindings>
-
-<script>
-<![CDATA[
-
-var xbltarget;
-
-function boom1()
-{
-  xbltarget = document.getElementById("xbltarget");
-  xbltarget.style.MozBinding = "url('#x')";
-  setTimeout(boom2, 0);
-}
-
-function boom2()
-{
-  var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(xbltarget));
-  if (!nodes) {
-    setTimeout(boom2, 10);
-    return;
-  }
-  var anox = nodes[0];
-  var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "frame")
-  frame.src = "data:text/html,<html><body>Hi!</body></html>";
-  anox.appendChild(frame);
-  xbltarget.style.MozBinding = "url('#empty')";
-  
-  document.documentElement.removeAttribute("class");
-}
-
-]]>
-</script>
-</head>
-<body onload="boom1()">
-<div id="xbltarget"></div>
-</body>
-</html>

layout/base/crashtests/379920-1.svg

@@ -1,7 +0,0 @@
-<svg width='100%' height='100%' xmlns='http://www.w3.org/2000/svg' onload="document.documentElement.style.MozBinding = 'url(#foo)';">
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="foo"><content></content></binding>
-</bindings>
-
-</svg>

layout/base/crashtests/379920-2.svg

@@ -1,7 +0,0 @@
-<svg width='100%' height='100%' xmlns='http://www.w3.org/2000/svg' style="-moz-binding: url(#foo)">
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="foo"><content></content></binding>
-</bindings>
-
-</svg>

layout/base/crashtests/379975.html

@@ -1,15 +0,0 @@
-<!DOCTYPE HTML>
-<!--
-<?xml version="1.0"?>
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="a">
-    <content></content>
-  </binding>
-</bindings>
--->
-<html style="-moz-binding: url(data:text/xml,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%20%20%3Cbinding%20id%3D%22a%22%3E%0A%20%20%20%20%3Ccontent%3E%3C/content%3E%0A%20%20%3C/binding%3E%0A%3C/bindings%3E);">
-  <head>
-    <title>Crash</title>
-    <script type="text/javascript" src="data:text/plain,document.documentElement;"></script>
-  </head>
-</html>

layout/base/crashtests/393326-1-binding.xml

@@ -1,4 +0,0 @@
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="a">
-<content><children/></content>
-</binding></bindings>

layout/base/crashtests/393326-1.html

@@ -1,15 +0,0 @@
-<html><head>
-<style>
-div::first-letter {}
-</style>
-</head>
-<body>
-
-<div style="position: fixed; ">
-<q></q>
-</div>
-<span>
-<span style="display: -moz-box; -moz-binding:url(393326-1-binding.xml#a);"></span>
-</span>
-</body></html>
-

layout/base/crashtests/393326-2.html

@@ -1,15 +0,0 @@
-<html><head>
-<style>
-div::first-letter {}
-</style>
-</head>
-<body>
-
-<div style="position: fixed; ">
-<q></q>
-</div>
-<span>
-<span style="display: -moz-box; -moz-binding:url(data:text/xml;charset=utf-8,%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%3Cbinding%20id%3D%22a%22%3E%0A%3Ccontent%3E%3Cchildren/%3E%3C/content%3E%0A%3C/binding%3E%3C/bindings%3E);"></span>
-</span>
-</body></html>
-

layout/base/crashtests/394014-1-iframe.html

@@ -1,21 +0,0 @@
-<html><head></head>
-<body>
-<span id="a" style="display: none;">
-<span id="b">
-<span style="-moz-binding: url(data:text/xml;charset=utf-8,%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%3Cbinding%20id%3D%22a%22%3E%0A%3Cimplementation%3E%0A%3Cconstructor%3E%0A%20%20this.style.outline%3D%27%27%3B%0A%3C/constructor%3E%0A%3C/implementation%3E%0A%3C/binding%3E%0A%3C/bindings%3E);"></span>
-</span>
-</span>
-<script>
-for (var i=0;i<document.getElementsByTagName('*').length;i++){
-document.getElementsByTagName('*')[i];
-}
-function doe2() { 
-//alert('t');
-document.getElementById('b').addEventListener('DOMSubtreeModified', function(e) {window.frameElement.remove() }, true);
-document.body.style.display = 'none';
-document.getElementById('a').style.display = '';
-}
-setTimeout(doe2, 20);
-</script>
-</body>
-</html>

layout/base/crashtests/394014-1-inner.html

@@ -1,10 +0,0 @@
-<html><head>
-<title>Testcase bug 394014 - Crash [@ NS_ProcessNextEvent_P] with DOMSubtreeModified removing windows, binding and other stuff</title>
-</head>
-<body>
-<iframe src="394014-1-iframe.html"></iframe>
-<script>
-setInterval(function() {window.location.reload()}, 1000);
-</script>
-</body>
-</html>

layout/base/crashtests/394014-1.html

@@ -1,9 +0,0 @@
-<html class="reftest-wait">
-<head>
-<script>
-setTimeout('document.documentElement.className = ""', 1000);
-</script>
-<body>
-<iframe src="394014-1-inner.html"></iframe>
-</body>
-</html>

layout/base/crashtests/394014-2-binding.xml

@@ -1,6 +0,0 @@
-<bindings xmlns="http://www.mozilla.org/xbl" xmlns:xlink="http://www.w3.org/1999/xlink">
-<binding id="c" inheritstyle="false">
-<content><children/></content>
-<implementation><constructor>
-</constructor></implementation>
-</binding></bindings>

layout/base/crashtests/394014-2-constructor.xml

@@ -1,10 +0,0 @@
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="a">
-<implementation>
-<constructor>
-  window.frameElement.parentNode.removeChild(window.frameElement);
-</constructor>
-</implementation>
-<content><children/></content>
-</binding>
-</bindings>

layout/base/crashtests/394014-2-constructordestructor.xml

@@ -1,12 +0,0 @@
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="a">
-<implementation>
-<destructor>
-  window.frameElement.parentNode.removeChild(window.frameElement);
-</destructor>
-</implementation>
-<content>
-<children/>
-</content>
-</binding>
-</bindings>

layout/base/crashtests/394014-2-crash.html

@@ -1,13 +0,0 @@
-<html><head>
-</head><body>
-
-<span style=" -moz-binding: url(394014-2-constructordestructor.xml#a);"></span>
-
-<span style="-moz-binding: url(394014-2-constructor.xml#a);">
-
-<style>style {-moz-binding:url(394014-2-binding.xml#c);</style>
-
-<textarea></textarea>
-</span>
-</body>
-</html>

layout/base/crashtests/394014-2.html

@@ -1,7 +0,0 @@
-<html><head>
-<title>Testcase bug 394014 - Crash [@ NS_ProcessNextEvent_P] with DOMSubtreeModified removing windows, binding and other stuff</title>
-</head>
-<body>tt
-<iframe src="394014-2-crash.html"></iframe>
-</body>
-</html>

layout/base/crashtests/399946-1.xhtml

@@ -1,23 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="empty">
-    <content></content>
-  </binding>
-</bindings>
-
-<script>
-function boom()
-{
-  document.getElementById("frame").style.MozBinding = "url('#empty')";
-}
-
-window.addEventListener("load", boom, false);
-</script>
-
-</head>
-
-<math:mtd><frameset><frame id="frame"></frame></frameset></math:mtd>
-
-</html>

layout/base/crashtests/404218-1.xhtml

@@ -1,15 +0,0 @@
-<treeitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<splitter/>
-<splitter>
-  <splitter id="a"/>
-</splitter>
-
-<script xmlns="http://www.w3.org/1999/xhtml">
- document.getElementById('a').setAttribute('a', 'a');
-</script>
-
-<style xmlns="http://www.w3.org/1999/xhtml">
-treeitem, splitter {-moz-binding:url(data:text/xml;charset=utf-8,%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%3Cbinding%20id%3D%22a%22%3E%3Ccontent%3E%3Cchildren/%3E%3C/content%3E%3C/binding%3E%3C/bindings%3E);}
-</style>
-
-</treeitem>

layout/base/crashtests/405184-1.xhtml

@@ -1,31 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="foo">
-    <content>
-      <div xmlns="http://www.w3.org/1999/xhtml" style="position: fixed;">
-        <children xmlns="http://www.mozilla.org/xbl"/>
-      </div>
-    </content>
-  </binding>
-</bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  var div = document.getElementById("div");
-  var caption = document.getElementById("caption");
-
-  div.removeChild(caption);
-  div.style.position = "inherit";
-}
-
-</script></head>
-
-<body onload="boom();">
-<div id="div" style="-moz-binding: url(#foo);"><caption id="caption"></caption></div>
-</body>
-
-</html>

layout/base/crashtests/405186-1.xhtml

@@ -1,39 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="foo">
-    <content>
-      <div xmlns="http://www.w3.org/1999/xhtml" style="position: fixed;">
-        <children xmlns="http://www.mozilla.org/xbl"/>
-      </div>
-    </content>
-  </binding>
-</bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  var table = document.getElementById("table");
-  var tr = document.getElementById("tr");
-  var td = document.getElementById("td");
-  
-  table.style.border = "2px dotted magenta";
-  tr.removeChild(td);
-}
-
-</script>
-</head>
-
-<body onload="boom();">
-
-<table id="table" style="-moz-binding: url(#foo);">
-  <tr id="tr">
-    <td id="td"></td>
-  </tr>
-</table>
-
-</body>
-
-</html>

layout/base/crashtests/429780-1.xhtml

@@ -1,4 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"><head>
-<script>window.addEventListener("load", function() { document.getElementById("v").style.MozBinding = "url(#foo)"; }, false);</script>
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content></content></binding></bindings>
-</head>X<span><div id="v"></div></span></html>

layout/base/crashtests/468546-1.xhtml

@@ -1,25 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<style type="text/css">
-
-[class='anon'], #v { float: left; }
-[class='anon']:first-line { word-spacing: 30ch; }
-body { width: 30ch; }
-
-</style>
-
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><div class="anon"><span>A BCDE</span><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding></bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  document.body.insertBefore(document.createTextNode("fijkl"), document.body.firstChild);
-}
-
-</script>
-</head>
-
-<body onload="boom();" style="-moz-binding: url(#foo)"><div id="v">&#x202C;</div></body>
-
-</html>

layout/base/crashtests/468645-1.xhtml

@@ -1,17 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-paged">
-
-<div style="-moz-binding: url(#xbl); display: table-cell;">
-<span style="display: inline-block;">
-<input style="page-break-after: right;"/>
-</span>
-</div>
-
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="xbl" inheritstyle="false">
-     <resources>
-      <stylesheet src="data:text/css;charset=utf-8,"/>
-     </resources>
-</binding>
-</bindings>
-</html>

layout/base/crashtests/468645-2.xhtml

@@ -1,13 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-paged">
-
-<div style="-moz-binding:url(#xbl)"/>
-<input style="page-break-after: left;"/>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="xbl" inheritstyle="false">
-     <resources>
-      <stylesheet src="data:text/css;charset=utf-8,"/>
-     </resources>
-</binding>
-</bindings>
-</html>

layout/base/crashtests/471594-1.xhtml

@@ -1,20 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="x"><content><SPAN>2!<children xmlns="http://www.mozilla.org/xbl"/></SPAN></content></binding>
-  <binding id="y"><content></content></binding>
-</bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  document.getElementById("a").style.MozBinding = 'url("#y")';
-}
-
-</script>
-</head>
-
-<body dir="rtl" onload="boom();"><div style="-moz-binding: url(#x);"><span style="unicode-bidi: bidi-override;" id="a"></span></div></body>
-</html>

layout/base/crashtests/497519-1.xhtml

@@ -1,28 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
-<xbl:binding id="foo"><xbl:content><div style="position:relative;"><xbl:children/></div></xbl:content></xbl:binding>
-</xbl:bindings>
-
-<script>
-<![CDATA[
-function test() {
-  document.getElementById("span").innerHTML = "<table><tr><td></td></tr></table>";
-}
-]]>
-</script>
-
-</head>
-
-<body onload="test();">
-
-<div style="-moz-binding: url(#foo)">
-
-  <div style="display:none">text</div>
-  <span id="span">text</span>
-
-</div>
-
-</body>
-</html>

layout/base/crashtests/497519-2.xhtml

@@ -1,26 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
-<head>
-
-<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
-<xbl:binding id="foo"><xbl:content><fieldset><xbl:children/></fieldset></xbl:content></xbl:binding>
-</xbl:bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  var dE = document.documentElement;
-  var leg = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
-  leg.style.cssFloat = "left";
-  dE.appendChild(leg);
-  document.documentElement.offsetHeight;
-  dE.removeChild(leg);
-}
-
-</script>
-
-</head>
-
-<body onload="boom();"></body>
-
-</html>

layout/base/crashtests/497519-3.xhtml

@@ -1,26 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
-<head>
-
-<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
-<xbl:binding id="foo"><xbl:content><fieldset><xbl:children/></fieldset></xbl:content></xbl:binding>
-</xbl:bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  var dE = document.documentElement;
-  var leg = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
-  leg.appendChild(document.createTextNode("legend"));
-  dE.appendChild(leg);
-  document.documentElement.offsetHeight;
-  dE.removeChild(leg);
-}
-
-</script>
-
-</head>
-
-<body onload="boom();"></body>
-
-</html>

layout/base/crashtests/497519-4.xhtml

@@ -1,26 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
-<head>
-
-<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
-<xbl:binding id="foo"><xbl:content><fieldset><xbl:children/></fieldset></xbl:content></xbl:binding>
-</xbl:bindings>
-
-<script type="text/javascript">
-
-function boom()
-{
-  var dE = document.documentElement;
-  var leg = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
-  leg.style.position = "absolute";
-  dE.appendChild(leg);
-  document.documentElement.offsetHeight;
-  dE.removeChild(leg);
-}
-
-</script>
-
-</head>
-
-<body onload="boom();"></body>
-
-</html>

layout/base/crashtests/536623-1.xhtml

@@ -1,37 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-
-<bindings
-  xmlns="http://www.mozilla.org/xbl"
-  xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-  xmlns:xbl="http://www.mozilla.org/xbl"
-  xmlns:html="http://www.w3.org/1999/xhtml">
-
-  <binding id="qwe">
-    <content>
-      <xul:label style="-moz-binding: url(#xar)" xbl:inherits="xbl:text=label" flex="1"/>
-    </content>
-  </binding>
-
-  <binding id="xar">
-    <content>
-      <html:table><children/></html:table>
-    </content>
-  </binding>
-
-</bindings>
-
-<script type="text/javascript">
-function boom()
-{
-  document.getElementById("b").setAttribute('label', "1 2 3");
-  document.documentElement.offsetHeight;
-  document.getElementById("b").removeAttribute('label');
-}
-</script>
-</head>
-
-<body onload="boom();">
-<div style="width: 0px;"><box id="b" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="-moz-binding: url(#qwe);"/></div>
-</body>
-</html>

layout/base/crashtests/537059-1.xhtml

@@ -1,14 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-  <head>
-    <bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
-      <binding id="td"><content><html:div><children/></html:div></content></binding>
-    </bindings>
-    <style type="text/css">
-      div, tbody { position: absolute; }
-      div:first-letter { }
-    </style>
-  </head>
-  <body>
-    <div><table>A<tbody><tr style="-moz-binding: url(#td);"></tr></tbody>B</table></div>
-  </body>
-</html>

layout/base/crashtests/537141-1.xhtml

@@ -1,6 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-</head>
-<body onload="document.body.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'span'));" style="-moz-binding: url('537141.xml#mo');">
-<g xmlns="http://www.w3.org/2000/svg"/></body>
-</html>

layout/base/crashtests/537141.xml

@@ -1,2 +0,0 @@
-<!-- This has to be a separate file to trigger the bug -->
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="mo"><content><mrow xmlns="http://www.w3.org/1998/Math/MathML"><children xmlns="http://www.mozilla.org/xbl"/></mrow></content></binding></bindings>

layout/base/crashtests/559705.xhtml

@@ -1,14 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-  <bindings xmlns="http://www.mozilla.org/xbl">
-    <binding id="foo">
-      <content>
-        <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:void 0"><children xmlns="http://www.mozilla.org/xbl"/></iframe>
-      </content>
-    </binding>
-  </bindings>
-</head>
-<body>
-  <span style="-moz-binding: url(#foo)"></span>
-</body>
-</html>

layout/base/crashtests/560441-1.xhtml

@@ -1,12 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><frame xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></frame></content></binding></bindings>
-</head>
-
-<frameset 
-  onload="document.getElementById('y').appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'span'));" 
-  style="-moz-binding: url(#foo)"
->
-<frame id="y"></frame>
-</frameset>
-</html>

layout/base/crashtests/567292-1.xhtml

@@ -1,17 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"><head>
-
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><optgroup><span><children xmlns="http://www.mozilla.org/xbl"/></span></optgroup></content></binding></bindings>
-
-<script>
-<![CDATA[
-
-function boom() { document.getElementById("a").appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "span")); }
-
-window.addEventListener("load", boom);
-
-]]>
-</script></head>
-
-<frameset style="-moz-binding: url(&quot;#foo&quot;);"><frame id="a"></frame></frameset>
-
-</html>

layout/base/crashtests/crashtests.list

@@ -57,29 +57,28 @@ load 280708-2.html
 load 281333-1.html
 load 285212-1.html
 load 286813-1.html
-load 288790-1.html
 load 306940-1.html
 load 310267-1.xml
 load 310638-1.svg
 load 310638-2.html
-load 311661-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/311661-1.xhtml
-load 311661-2.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/311661-2.xhtml
 load 313086-1.xml
 load 317285-1.html
 load 317934-1.html
 load 320459-1.html
-load 321058-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/321058-1.xhtml
-load 321058-2.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/321058-2.xhtml
-load 321077-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/321077-1.xhtml
-load 321077-2.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/321077-2.xhtml
 load 322436-1.html
 load 322678.html
 load 325024.html
-load 325218.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/325218.xhtml
 load 325967-1.html
 load 325984-1.xhtml
 load 325984-2.html
-load 328944-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/328944-1.xhtml
 load 329900-1.html
 load 330015-1.html
 load 331204-1.html
@@ -89,14 +88,14 @@ load 331679-3.xml
 load 331883-1.html
 load 335140-1.html
 load 336291-1.html
-load 336999-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/336999-1.xhtml
 load 337066-1.xhtml
 load 337268-1.html
 load 337419-1.html
-load 337476-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/337476-1.xhtml
 load 338703-1.html
 load 339651-1.html
-load 340093-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/340093-1.xhtml
 load 341382-1.html
 load 341382-2.html
 load 341858-1.html
@@ -108,23 +107,22 @@ load 344057-1.xhtml
 load 344064-1.html
 load 344300-1.html
 load 344300-2.html
-load 344340-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/344340-1.xhtml
 load 347898-1.html
 load 348126-1.html
 load 348688-1.html
 load 348708-1.xhtml
 load 348729-1.html
 load 349095-1.xhtml
-load 350128-1.xhtml
 load 350267-1.html
 load 354133-1.html
 load 354766-1.xhtml
 load 355989-1.xhtml
 load 355993-1.xhtml
-load 356325-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/356325-1.xhtml
 load 358729-1.xhtml
-load 360339-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/360339-1.xhtml
-load 360339-2.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/360339-2.xhtml
 load 363729-1.html
 load 363729-2.html
 load 363729-3.html
@@ -146,17 +144,12 @@ load 372237-1.html
 load 372475-1.xhtml
 load 372550-1.html
 load 373628-1.html
-load 374193-1.xhtml
 load 374297-1.html
 load 374297-2.html
 load 378325-1.html
 load 378682.html
-load 379105-1.xhtml
 load 379419-1.xhtml
 load 379799-1.html
-load 379920-1.svg
-load 379920-2.svg
-load 379975.html
 load 380096-1.html
 load 382204-1.html # bug 1323680
 load 383129-1.html
@@ -173,12 +166,8 @@ load 387195-1.html
 load 387195-2.xhtml
 load 388715-1.html
 load 390976-1.html
-load 393326-1.html
-load 393326-2.html
 load 393661-1.html
 load 393801-1.html
-load 394014-1.html
-load 394014-2.html
 load 394150-1.xhtml
 load 397011-1.xhtml
 load 398510-1.xhtml
@@ -190,12 +179,11 @@ load 399365-1.html
 load 399676-1.xhtml
 load 399687-1.html
 load 399940-1.xhtml
-load 399946-1.xhtml
 load 399951-1.html
 load 399994-1.html
 load 400445-1.xhtml
 load 400904-1.xhtml
-load 401589-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/401589-1.xhtml
 load 401734-1.html
 load 401734-2.html
 needs-focus pref(accessibility.browsewithcaret,true) load 403048.html
@@ -205,13 +193,10 @@ load 403454.html
 load 403569-1.xhtml
 load 403569-2.xhtml
 load 403569-3.xhtml
-load 404218-1.xhtml
 load 404491-1.html
 load 404721-1.xhtml
 load 404721-2.xhtml
-load 405049-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/405049-1.xhtml
-load 405184-1.xhtml
-load 405186-1.xhtml
 load 406675-1.html
 load 408292.html
 load 408299.html
@@ -229,7 +214,7 @@ load 420031-1.html
 load 420213-1.html
 load 420219-1.html
 load 420651-1.xhtml
-load 421203-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/421203-1.xhtml
 load 421432.html
 load 422276.html
 asserts(0-1) load 423107-1.xhtml # bug 866955
@@ -238,7 +223,6 @@ load 428138-1.html
 load 428448-1.html
 load 429088-1.html
 load 429088-2.html
-load 429780-1.xhtml
 load 429865-1.html
 load 429881.html
 load 430569-1.html
@@ -250,7 +234,7 @@ load 437142-1.html
 load 439258-1.html
 load 439343.html
 load 444863-1.html
-load 444925-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/444925-1.xhtml
 load 444967-1.html
 load 446328.html
 load 448488-1.html
@@ -259,7 +243,7 @@ load 448543-2.html
 load 448543-3.html
 load 450319-1.xhtml
 asserts(1) asserts-if(Android,2) load 453894-1.xhtml # Bug 398043
-load 454751-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/454751-1.xhtml
 load 455063-1.html
 load 455063-2.html
 load 455063-3.html
@@ -272,19 +256,15 @@ load 462392.html
 load 466763-1.html
 load 467881-1.html
 load 468491-1.html
-load 468546-1.xhtml
 load 468555-1.xhtml
 load 468563-1.html
 load 468578-1.xhtml
 # These three didn't actually crash without the resizing that the
 # browser does when setting up print preview, but adding them anyway.
-load 468645-1.xhtml
-load 468645-2.xhtml
 load 468645-3.xhtml
 load 469861-1.xhtml
 load 469861-2.xhtml
 load 470851-1.xhtml
-load 471594-1.xhtml
 asserts-if(Android&&!asyncPan,1-2) load 473042.xhtml # bug 1034369 (may also cause a few assertions to be registered on the next test)
 asserts(0-5) load 474075.html # bug 847368
 load 477333-1.xhtml
@@ -301,17 +281,13 @@ load 489691.html
 load 490376-1.xhtml
 load 490559-1.html
 load 490747.html
-load 491547-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/491547-1.xhtml
-load 491547-2.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/491547-2.xhtml
 load 492014.xhtml
 load 492112-1.xhtml
 load 492163-1.xhtml
 load 495350-1.html
 load 496011-1.xhtml
-load 497519-1.xhtml
-load 497519-2.xhtml
-load 497519-3.xhtml
-load 497519-4.xhtml
 load 499741-1.xhtml
 load 499841-1.xhtml
 load 499858-1.xhtml
@@ -321,37 +297,31 @@ load 503936-1.html
 skip-if(Android&&AndroidVersion<21) load 507119.html
 load 522374-1.html
 load 522374-2.html
-load 526378-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/526378-1.xhtml
 load 534367-1.xhtml
 load 534368-1.xhtml
 load 534768-1.html
 load 534768-2.html
 load 535721-1.xhtml
 load 535911-1.xhtml
-load 536623-1.xhtml
+load chrome://reftest/content/crashtests/layout/base/crashtests/536720.xhtml
-load 536720.xul
-load 537059-1.xhtml
-load 537141-1.xhtml
 load 537562-1.xhtml
 load 537624-1.html
 load 537631-1.html
-load 538082-1.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/538082-1.xhtml
 load 538207-1.xhtml
 load 538210-1.html
 load 538267-1.html
-load 540760.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/540760.xhtml
 load 540771-1.xhtml
 load 541869-1.xhtml
 load 541869-2.html
 load 543648-1.html
-load 559705.xhtml
-load 560441-1.xhtml
 load 560447-1.html
 load 564063-1.html
-load 567292-1.xhtml
 load 569018-1.html
 pref(layout.css.xul-display-values.content.enabled,true) load 570038-1.html
-load 572003.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/572003.xhtml
 load 572582-1.xhtml
 load 576649-1.html
 load 579655.html
@@ -462,7 +432,7 @@ load 1140198.html
 load 1143535.html
 load 1153716.html
 load 1156588.html
-load 1162813.xul
+load chrome://reftest/content/crashtests/layout/base/crashtests/1162813.xhtml
 load 1163583.html
 load 1234622-1.html
 load 1235467-1.html
@@ -512,7 +482,6 @@ load 1419762.html
 load 1419802.html
 load 1420533.html
 load 1422908.html
-load 1423216.html
 load 1425893.html
 load 1425959.html
 load 1428353.html

layout/base/moz.build

@@ -48,7 +48,6 @@ EXPORTS += [
     'nsFrameTraversal.h',
     'nsGenConList.h',
     'nsIFrameTraversal.h',
-    'nsILayoutDebugger.h',
     'nsIPercentBSizeObserver.h',
     'nsIReflowCallback.h',
     'nsLayoutUtils.h',
@@ -156,7 +155,6 @@ LOCAL_INCLUDES += [
     '/dom/base',
     '/dom/html',
     '/dom/svg',
-    '/dom/xbl',
     '/dom/xul',
     '/view',
 ]

layout/base/nsCSSFrameConstructor.cpp

@@ -50,7 +50,6 @@
 #include "nsStyleConsts.h"
 #ifdef MOZ_XUL
 #  include "nsXULElement.h"
-#  include "mozilla/dom/BoxObject.h"
 #endif  // MOZ_XUL
 #include "nsContainerFrame.h"
 #include "nsNameSpaceManager.h"
@@ -62,8 +61,6 @@
 #include "nsCSSAnonBoxes.h"
 #include "nsTextFragment.h"
 #include "nsIAnonymousContentCreator.h"
-#include "nsBindingManager.h"
-#include "nsXBLBinding.h"
 #include "nsContentUtils.h"
 #include "nsIScriptError.h"
 #ifdef XP_MACOSX
@@ -115,8 +112,6 @@
 #  include "nsAccessibilityService.h"
 #endif
 
-#include "nsXBLService.h"
-
 #undef NOISY_FIRST_LETTER
 
 #include "nsMathMLParts.h"
@@ -211,7 +206,6 @@ static FrameCtorDebugFlags gFlags[] = {
 #  include "nsMenuFrame.h"
 #  include "nsPopupSetFrame.h"
 #  include "nsTreeColFrame.h"
-#  include "nsIBoxObject.h"
 #  include "nsXULLabelFrame.h"
 
 //------------------------------------------------------------------
@@ -226,8 +220,6 @@ nsIFrame* NS_NewDeckFrame(PresShell* aPresShell, ComputedStyle* aStyle);
 
 nsIFrame* NS_NewLeafBoxFrame(PresShell* aPresShell, ComputedStyle* aStyle);
 
-nsIFrame* NS_NewStackFrame(PresShell* aPresShell, ComputedStyle* aStyle);
-
 nsIFrame* NS_NewRangeFrame(PresShell* aPresShell, ComputedStyle* aStyle);
 
 nsIFrame* NS_NewImageBoxFrame(PresShell* aPresShell, ComputedStyle* aStyle);
@@ -652,18 +644,6 @@ class MOZ_STACK_CLASS nsFrameConstructorSaveState {
   friend class nsFrameConstructorState;
 };
 
-// Structure used to keep track of a list of bindings we need to call
-// AddToAttachedQueue on.  These should be in post-order depth-first
-// flattened tree traversal order.
-struct PendingBinding : public LinkedListElement<PendingBinding> {
-#ifdef NS_BUILD_REFCNT_LOGGING
-  PendingBinding() { MOZ_COUNT_CTOR(PendingBinding); }
-  ~PendingBinding() { MOZ_COUNT_DTOR(PendingBinding); }
-#endif
-
-  RefPtr<nsXBLBinding> mBinding;
-};
-
 // Structure used for maintaining state information during the
 // frame construction process
 class MOZ_STACK_CLASS nsFrameConstructorState {
@@ -817,45 +797,6 @@ class MOZ_STACK_CLASS nsFrameConstructorState {
     return mFixedPosIsAbsPos ? mAbsoluteList : mFixedList;
   }
 
-  /**
-   * class to automatically push and pop a pending binding in the frame
-   * constructor state.  See nsCSSFrameConstructor::FrameConstructionItem
-   * mPendingBinding documentation.
-   */
-  class PendingBindingAutoPusher;
-  friend class PendingBindingAutoPusher;
-  class MOZ_STACK_CLASS PendingBindingAutoPusher {
-   public:
-    PendingBindingAutoPusher(nsFrameConstructorState& aState,
-                             PendingBinding* aPendingBinding)
-        : mState(aState),
-          mPendingBinding(aState.mCurrentPendingBindingInsertionPoint) {
-      if (aPendingBinding) {
-        aState.mCurrentPendingBindingInsertionPoint = aPendingBinding;
-      }
-    }
-
-    ~PendingBindingAutoPusher() {
-      mState.mCurrentPendingBindingInsertionPoint = mPendingBinding;
-    }
-
-   private:
-    nsFrameConstructorState& mState;
-    PendingBinding* mPendingBinding;
-  };
-
-  /**
-   * Add a new pending binding to the list
-   */
-  void AddPendingBinding(UniquePtr<PendingBinding> aPendingBinding) {
-    if (mCurrentPendingBindingInsertionPoint) {
-      mCurrentPendingBindingInsertionPoint->setPrevious(
-          aPendingBinding.release());
-    } else {
-      mPendingBindings.insertBack(aPendingBinding.release());
-    }
-  }
-
  protected:
   friend class nsFrameConstructorSaveState;
 
@@ -881,12 +822,6 @@ class MOZ_STACK_CLASS nsFrameConstructorState {
                                            nsFrameState* aPlaceholderType);
 
   void ConstructBackdropFrameFor(nsIContent* aContent, nsIFrame* aFrame);
-
-  // Our list of all pending bindings.  When we're done, we need to call
-  // AddToAttachedQueue on all of them, in order.
-  LinkedList<PendingBinding> mPendingBindings;
-
-  PendingBinding* mCurrentPendingBindingInsertionPoint;
 };
 
 nsFrameConstructorState::nsFrameConstructorState(
@@ -916,8 +851,7 @@ nsFrameConstructorState::nsFrameConstructorState(
       mFixedPosIsAbsPos(aFixedContainingBlock == aAbsoluteContainingBlock),
       mHavePendingPopupgroup(false),
       mCreatingExtraFrames(false),
-      mHasRenderedLegend(false),
+      mHasRenderedLegend(false) {
-      mCurrentPendingBindingInsertionPoint(nullptr) {
 #ifdef MOZ_XUL
   nsIPopupContainer* popupContainer =
       nsIPopupContainer::GetPopupContainer(aPresShell);
@@ -943,15 +877,6 @@ nsFrameConstructorState::~nsFrameConstructorState() {
   for (auto& content : Reversed(mGeneratedContentWithInitializer)) {
     content->RemoveProperty(nsGkAtoms::genConInitializerProperty);
   }
-  if (!mPendingBindings.isEmpty()) {
-    nsBindingManager* bindingManager =
-        mPresShell->GetDocument()->BindingManager();
-    do {
-      UniquePtr<PendingBinding> pendingBinding(mPendingBindings.popFirst());
-      bindingManager->AddToAttachedQueue(pendingBinding->mBinding);
-    } while (!mPendingBindings.isEmpty());
-    mCurrentPendingBindingInsertionPoint = nullptr;
-  }
 }
 
 void nsFrameConstructorState::ProcessFrameInsertionsForAllLists() {
@@ -1612,7 +1537,7 @@ already_AddRefed<nsIContent> nsCSSFrameConstructor::CreateGeneratedContent(
       } else {
         auto& counters = item.AsCounters();
         name = counters._0.AsAtom();
-        separator = NS_ConvertUTF8toUTF16(counters._1.AsString());
+        CopyUTF8toUTF16(counters._1.AsString(), separator);
         ptr = CounterStylePtr::FromStyle(counters._2);
       }
 
@@ -1963,7 +1888,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructTable(nsFrameConstructorState& aState,
         aItem.mFCData->mBits & FCDATA_IS_WRAPPER_ANON_BOX, childList);
   } else {
     ProcessChildren(aState, content, computedStyle, innerFrame, true, childList,
-                    false, aItem.mPendingBinding);
+                    false);
   }
 
   nsFrameList captionList;
@@ -2036,7 +1961,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructTableRowOrRowGroup(
         aItem.mFCData->mBits & FCDATA_IS_WRAPPER_ANON_BOX, childList);
   } else {
     ProcessChildren(aState, content, computedStyle, newFrame, true, childList,
-                    false, aItem.mPendingBinding);
+                    false);
   }
 
   newFrame->SetInitialChildList(kPrincipalList, childList);
@@ -2147,7 +2072,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructTableCell(
   } else {
     // Process the child content
     ProcessChildren(aState, content, computedStyle, cellInnerFrame, true,
-                    childList, isBlock, aItem.mPendingBinding);
+                    childList, isBlock);
   }
 
   cellInnerFrame->SetInitialChildList(kPrincipalList, childList);
@@ -2271,37 +2196,6 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
 
   const nsStyleDisplay* display = computedStyle->StyleDisplay();
 
-  // Ensure that our XBL bindings are installed.
-  //
-  // FIXME(emilio): Can we remove support for bindings on the root?
-  if (display->mBinding.IsUrl()) {
-    // Get the XBL loader.
-    nsresult rv;
-
-    nsXBLService* xblService = nsXBLService::GetInstance();
-    if (!xblService) {
-      return nullptr;
-    }
-
-    const auto& url = display->mBinding.AsUrl();
-
-    RefPtr<nsXBLBinding> binding;
-    rv = xblService->LoadBindings(aDocElement, url.GetURI(),
-                                  url.ExtraData().Principal(),
-                                  getter_AddRefs(binding));
-    if (NS_FAILED(rv) && rv != NS_ERROR_XBL_BLOCKED) {
-      // Binding will load asynchronously.
-      return nullptr;
-    }
-
-    if (binding) {
-      // For backwards compat, keep firing the root's constructor
-      // after all of its kids' constructors.  So tell the binding
-      // manager about it right now.
-      mDocument->BindingManager()->AddToAttachedQueue(binding);
-    }
-  }
-
   // --------- IF SCROLLABLE WRAP IN SCROLLFRAME --------
 
   NS_ASSERTION(!display->IsScrollableOverflow() ||
@@ -2391,9 +2285,8 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
     // FrameConstructionData/Item, then we'd need the right function
     // here... but would probably be able to get away with less code in this
     // function in general.
-    // Use a null PendingBinding, since our binding is not in fact pending.
     static const FrameConstructionData rootSVGData = FCDATA_DECL(0, nullptr);
-    AutoFrameConstructionItem item(this, &rootSVGData, aDocElement, nullptr,
+    AutoFrameConstructionItem item(this, &rootSVGData, aDocElement,
                                    do_AddRef(computedStyle), true);
 
     contentFrame = static_cast<nsContainerFrame*>(ConstructOuterSVG(
@@ -2428,9 +2321,8 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
     // FrameConstructionData/Item, then we'd need the right function
     // here... but would probably be able to get away with less code in this
     // function in general.
-    // Use a null PendingBinding, since our binding is not in fact pending.
     static const FrameConstructionData rootTableData = FCDATA_DECL(0, nullptr);
-    AutoFrameConstructionItem item(this, &rootTableData, aDocElement, nullptr,
+    AutoFrameConstructionItem item(this, &rootTableData, aDocElement,
                                    do_AddRef(computedStyle), true);
 
     // if the document is a table then just populate it.
@@ -2439,7 +2331,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
   } else if (display->DisplayInside() == StyleDisplayInside::Ruby) {
     static const FrameConstructionData data =
         FULL_CTOR_FCDATA(0, &nsCSSFrameConstructor::ConstructBlockRubyFrame);
-    AutoFrameConstructionItem item(this, &data, aDocElement, nullptr,
+    AutoFrameConstructionItem item(this, &data, aDocElement,
                                    do_AddRef(computedStyle), true);
     contentFrame = static_cast<nsContainerFrame*>(ConstructBlockRubyFrame(
         state, item,
@@ -2450,13 +2342,12 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
                    display->mDisplay == StyleDisplay::FlowRoot,
                "Unhandled display type for root element");
     contentFrame = NS_NewBlockFormattingContext(mPresShell, computedStyle);
-    // Use a null PendingBinding, since our binding is not in fact pending.
     ConstructBlock(
         state, aDocElement,
         state.GetGeometricParent(*display, mDocElementContainingBlock),
         mDocElementContainingBlock, computedStyle, &contentFrame, frameList,
-        display->IsAbsPosContainingBlock(contentFrame) ? contentFrame : nullptr,
+        display->IsAbsPosContainingBlock(contentFrame) ? contentFrame
-        nullptr);
+                                                       : nullptr);
   }
 
   MOZ_ASSERT(frameList.FirstChild());
@@ -2488,9 +2379,8 @@ nsIFrame* nsCSSFrameConstructor::ConstructDocElementFrame(
     NS_ASSERTION(!contentFrame->IsBlockFrameOrSubclass() &&
                      !contentFrame->IsFrameOfType(nsIFrame::eSVG),
                  "Only XUL frames should reach here");
-    // Use a null PendingBinding, since our binding is not in fact pending.
     ProcessChildren(state, aDocElement, computedStyle, contentFrame, true,
-                    childList, false, nullptr);
+                    childList, false);
 
     // Set the initial child lists
     contentFrame->SetInitialChildList(kPrincipalList, childList);
@@ -2660,9 +2550,19 @@ void nsCSSFrameConstructor::SetUpDocElementContainingBlock(
     isXUL = aDocElement->IsXULElement();
   }
 
-  // Never create scrollbars for XUL documents
+  // Never create scrollbars for XUL documents or top level XHTML documents that
-  bool isScrollable =
+  // disable scrolling.
-      isPaginated ? presContext->HasPaginatedScrolling() : !isXUL;
+  bool isScrollable = true;
+  if (isPaginated) {
+    isScrollable = presContext->HasPaginatedScrolling();
+  } else if (isXUL) {
+    isScrollable = false;
+  } else if (nsContentUtils::IsInChromeDocshell(aDocElement->OwnerDoc()) &&
+             aDocElement->AsElement()->AttrValueIs(
+                 kNameSpaceID_None, nsGkAtoms::scrolling, nsGkAtoms::_false,
+                 eCaseMatters)) {
+    isScrollable = false;
+  }
 
   // We no longer need to do overflow propagation here. It's taken care of
   // when we construct frames for the element whose overflow might be
@@ -2948,8 +2848,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructSelectFrame(
         NS_NewSelectsAreaFrame(mPresShell, computedStyle, flags);
 
     InitializeSelectFrame(aState, listFrame, scrolledFrame, content,
-                          comboboxFrame, listStyle, true, aItem.mPendingBinding,
+                          comboboxFrame, listStyle, true, childList);
-                          childList);
 
     NS_ASSERTION(listFrame->GetView(), "ListFrame's view is nullptr");
 
@@ -3009,8 +2908,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructSelectFrame(
   // please adjust this code to use BuildScrollFrame.
 
   InitializeSelectFrame(aState, listFrame, scrolledFrame, content, aParentFrame,
-                        computedStyle, false, aItem.mPendingBinding,
+                        computedStyle, false, aFrameList);
-                        aFrameList);
 
   return listFrame;
 }
@@ -3024,8 +2922,7 @@ void nsCSSFrameConstructor::InitializeSelectFrame(
     nsFrameConstructorState& aState, nsContainerFrame* scrollFrame,
     nsContainerFrame* scrolledFrame, nsIContent* aContent,
     nsContainerFrame* aParentFrame, ComputedStyle* aComputedStyle,
-    bool aBuildCombobox, PendingBinding* aPendingBinding,
+    bool aBuildCombobox, nsFrameList& aFrameList) {
-    nsFrameList& aFrameList) {
   // Initialize it
   nsContainerFrame* geometricParent =
       aState.GetGeometricParent(*aComputedStyle->StyleDisplay(), aParentFrame);
@@ -3052,7 +2949,7 @@ void nsCSSFrameConstructor::InitializeSelectFrame(
   nsFrameList childList;
 
   ProcessChildren(aState, aContent, aComputedStyle, scrolledFrame, false,
-                  childList, false, aPendingBinding);
+                  childList, false);
 
   // Set the scrolled frame's initial child lists
   scrolledFrame->SetInitialChildList(kPrincipalList, childList);
@@ -3143,7 +3040,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructFieldSetFrame(
     AutoRestore<bool> savedHasRenderedLegend(aState.mHasRenderedLegend);
     aState.mHasRenderedLegend = false;
     ProcessChildren(aState, content, computedStyle, contentFrame, true,
-                    childList, true, aItem.mPendingBinding);
+                    childList, true);
   }
   nsFrameList fieldsetKids;
   fieldsetKids.AppendFrame(nullptr,
@@ -3799,7 +3696,7 @@ void nsCSSFrameConstructor::ConstructFrameFromItemInternal(
         ProcessChildren(aState, content, computedStyle, newFrameAsContainer,
                         !(bits & FCDATA_DISALLOW_GENERATED_CONTENT), childList,
                         (bits & FCDATA_ALLOW_BLOCK_STYLES) != 0,
-                        aItem.mPendingBinding, possiblyLeafFrame);
+                        possiblyLeafFrame);
       }
 
       if (bits & FCDATA_WRAP_KIDS_IN_BLOCKS) {
@@ -4199,9 +4096,8 @@ already_AddRefed<ComputedStyle> nsCSSFrameConstructor::BeginBuildingScrollFrame(
     // HTMLScrollFrame
     const nsStyleDisplay* displayStyle = aContentStyle->StyleDisplay();
     if (displayStyle->IsXULDisplayStyle()) {
-      gfxScrollFrame = NS_NewXULScrollFrame(
+      gfxScrollFrame =
-          mPresShell, contentStyle, aIsRoot,
+          NS_NewXULScrollFrame(mPresShell, contentStyle, aIsRoot, false);
-          displayStyle->mDisplay == StyleDisplay::MozStack);
     } else {
       gfxScrollFrame = NS_NewHTMLScrollFrame(mPresShell, contentStyle, aIsRoot);
     }
@@ -4446,8 +4342,7 @@ nsCSSFrameConstructor::FindDisplayData(const nsStyleDisplay& aDisplay,
           &nsCSSFrameConstructor::ConstructTableCell);
       return &data;
     }
-    case StyleDisplayInside::MozBox:
+    case StyleDisplayInside::MozBox: {
-    case StyleDisplayInside::MozInlineBox: {
       if (!aElement.IsInNativeAnonymousSubtree() &&
           aElement.OwnerDoc()->IsContentDocument()) {
         aElement.OwnerDoc()->WarnOnceAbout(Document::eMozBoxOrInlineBoxDisplay);
@@ -4534,11 +4429,6 @@ nsCSSFrameConstructor::FindDisplayData(const nsStyleDisplay& aDisplay,
           SCROLLABLE_XUL_FCDATA(NS_NewGridRowLeafFrame);
       return &data;
     }
-    case StyleDisplayInside::MozStack: {
-      static const FrameConstructionData data =
-          SCROLLABLE_XUL_FCDATA(NS_NewStackFrame);
-      return &data;
-    }
     case StyleDisplayInside::MozDeck: {
       static const FrameConstructionData data =
           SIMPLE_XUL_FCDATA(NS_NewDeckFrame);
@@ -4592,8 +4482,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructScrollableBlockWithConstructor(
   ConstructBlock(
       aState, content, newFrame, newFrame, scrolledContentStyle, &scrolledFrame,
       blockList,
-      aDisplay->IsAbsPosContainingBlock(newFrame) ? newFrame : nullptr,
+      aDisplay->IsAbsPosContainingBlock(newFrame) ? newFrame : nullptr);
-      aItem.mPendingBinding);
 
   MOZ_ASSERT(blockList.OnlyChild() == scrolledFrame,
              "Scrollframe's frameList should be exactly the scrolled frame!");
@@ -4639,8 +4528,7 @@ nsIFrame* nsCSSFrameConstructor::ConstructNonScrollableBlockWithConstructor(
       aState, aItem.mContent,
       aState.GetGeometricParent(*aDisplay, aParentFrame), aParentFrame,
       computedStyle, &newFrame, aFrameList,
-      aDisplay->IsAbsPosContainingBlock(newFrame) ? newFrame : nullptr,
+      aDisplay->IsAbsPosContainingBlock(newFrame) ? newFrame : nullptr);
-      aItem.mPendingBinding);
   return newFrame;
 }
 
@@ -4856,7 +4744,7 @@ nsContainerFrame* nsCSSFrameConstructor::ConstructFrameWithAnonymousChild(
         aItem.mFCData->mBits & FCDATA_IS_WRAPPER_ANON_BOX, childList);
   } else {
     ProcessChildren(aState, content, computedStyle, innerFrame, true, childList,
-                    false, aItem.mPendingBinding);
+                    false);
   }
 
   // Set the inner wrapper frame's initial primary list
@@ -5138,8 +5026,8 @@ void nsCSSFrameConstructor::AddPageBreakItem(
   static const FrameConstructionData sPageBreakData =
       FCDATA_DECL(FCDATA_SKIP_FRAMESET, NS_NewPageBreakFrame);
 
-  aItems.AppendItem(this, &sPageBreakData, aContent, nullptr,
+  aItems.AppendItem(this, &sPageBreakData, aContent, pseudoStyle.forget(),
-                    pseudoStyle.forget(), true);
+                    true);
 }
 
 bool nsCSSFrameConstructor::ShouldCreateItemsForChild(
@@ -5370,45 +5258,6 @@ nsCSSFrameConstructor::FindElementTagData(const Element& aElement,
   }
 }
 
-nsCSSFrameConstructor::XBLBindingLoadInfo::XBLBindingLoadInfo(
-    UniquePtr<PendingBinding> aPendingBinding)
-    : mPendingBinding(std::move(aPendingBinding)), mSuccess(true) {}
-
-nsCSSFrameConstructor::XBLBindingLoadInfo::XBLBindingLoadInfo() = default;
-
-nsCSSFrameConstructor::XBLBindingLoadInfo
-nsCSSFrameConstructor::LoadXBLBindingIfNeeded(nsIContent& aContent,
-                                              const ComputedStyle& aStyle,
-                                              ItemFlags aFlags) {
-  if (!aFlags.contains(ItemFlag::AllowPageBreak)) {
-    return XBLBindingLoadInfo(nullptr);
-  }
-
-  const auto& binding = aStyle.StyleDisplay()->mBinding;
-  if (binding.IsNone()) {
-    return XBLBindingLoadInfo(nullptr);
-  }
-
-  nsXBLService* xblService = nsXBLService::GetInstance();
-  if (!xblService) {
-    return {};
-  }
-
-  auto newPendingBinding = MakeUnique<PendingBinding>();
-  const auto& url = binding.AsUrl();
-  nsresult rv = xblService->LoadBindings(
-      aContent.AsElement(), url.GetURI(), url.ExtraData().Principal(),
-      getter_AddRefs(newPendingBinding->mBinding));
-  if (NS_FAILED(rv)) {
-    if (rv == NS_ERROR_XBL_BLOCKED) {
-      return XBLBindingLoadInfo(nullptr);
-    }
-    return {};
-  }
-
-  return XBLBindingLoadInfo(std::move(newPendingBinding));
-}
-
 void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
     nsFrameConstructorState& aState, nsIContent* aContent,
     nsContainerFrame* aParentFrame, bool aSuppressWhiteSpaceOptimizations,
@@ -5420,20 +5269,6 @@ void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
   MOZ_ASSERT(!aContent->GetPrimaryFrame() || aState.mCreatingExtraFrames ||
              aContent->NodeInfo()->NameAtom() == nsGkAtoms::area);
 
-  PendingBinding* pendingBinding = nullptr;
-  {
-    XBLBindingLoadInfo xblInfo =
-        LoadXBLBindingIfNeeded(*aContent, *aComputedStyle, aFlags);
-    if (!xblInfo.mSuccess) {
-      return;
-    }
-
-    if (xblInfo.mPendingBinding && xblInfo.mPendingBinding->mBinding) {
-      pendingBinding = xblInfo.mPendingBinding.get();
-      aState.AddPendingBinding(std::move(xblInfo.mPendingBinding));
-    }
-  }
-
   const bool withinSVGText = aFlags.contains(ItemFlag::IsWithinSVGText);
   const bool isGeneratedContent = aFlags.contains(ItemFlag::IsGeneratedContent);
   MOZ_ASSERT(!isGeneratedContent || aComputedStyle->IsPseudoElement(),
@@ -5477,7 +5312,7 @@ void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
       AddFrameConstructionItems(aState, child, aSuppressWhiteSpaceOptimizations,
                                 insertion, aItems, aFlags);
     }
-    aItems.SetParentHasNoXBLChildren(!iter.XBLInvolved());
+    aItems.SetParentHasNoXBLChildren(!iter.ShadowDOMInvolved());
 
     CreateGeneratedContentItem(aState, aParentFrame, *aContent->AsElement(),
                                *aComputedStyle, PseudoStyleType::after, aItems);
@@ -5553,15 +5388,13 @@ void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
     if (summary && summary->IsMainSummary()) {
       // If details is open, the main summary needs to be rendered as if it is
       // the first child, so add the item to the front of the item list.
-      item = aItems.PrependItem(this, data, aContent, pendingBinding,
+      item = aItems.PrependItem(this, data, aContent, do_AddRef(aComputedStyle),
-                                do_AddRef(aComputedStyle),
                                 aSuppressWhiteSpaceOptimizations);
     }
   }
 
   if (!item) {
-    item = aItems.AppendItem(this, data, aContent, pendingBinding,
+    item = aItems.AppendItem(this, data, aContent, do_AddRef(aComputedStyle),
-                             do_AddRef(aComputedStyle),
                              aSuppressWhiteSpaceOptimizations);
     if (aFlags.contains(ItemFlag::IsForRenderedLegend)) {
       item->mIsRenderedLegend = true;
@@ -5705,12 +5538,11 @@ void nsCSSFrameConstructor::ConstructFramesFromItem(
 
   const auto* disp = computedStyle->StyleDisplay();
   MOZ_ASSERT(!disp->IsAbsolutelyPositionedStyle() ||
-                 (disp->mDisplay != StyleDisplay::MozBox &&
+             disp->DisplayInside() != StyleDisplayInside::MozBox,
-                  disp->mDisplay != StyleDisplay::MozInlineBox),
              "This may be a frame that was previously blockified "
              "but isn't any longer! It probably needs explicit "
              "'display:block' to preserve behavior");
-  Unused << disp; // (unused in configs that define the assertion away)
+  Unused << disp;  // (unused in configs that define the assertion away)
 
   if (item.mIsText) {
     // If this is collapsible whitespace next to a line boundary,
@@ -6321,7 +6153,7 @@ nsIFrame* nsCSSFrameConstructor::GetInsertionPrevSibling(
   // XBL insertion point is involved, we'll need to use _that_ to find
   // the preceding frame.
   FlattenedChildIterator iter(aInsertion->mContainer);
-  if (iter.XBLInvolved() || !aChild->IsRootOfAnonymousSubtree()) {
+  if (iter.ShadowDOMInvolved() || !aChild->IsRootOfAnonymousSubtree()) {
     // The check for IsRootOfAnonymousSubtree() is because editor is
     // severely broken and calls us directly for native anonymous
     // nodes that it creates.
@@ -6593,7 +6425,7 @@ nsCSSFrameConstructor::GetRangeInsertionPoint(nsIContent* aStartChild,
   // If the children of the container may be distributed to different insertion
   // points, insert them separately and bail out, letting ContentInserted handle
   // the mess.
-  if (parent->GetShadowRoot() || parent->GetXBLBinding()) {
+  if (parent->GetShadowRoot()) {
     IssueSingleInsertNofications(aStartChild, aEndChild, aInsertionKind);
     return {};
   }
@@ -6850,7 +6682,8 @@ void nsCSSFrameConstructor::ContentAppended(nsIContent* aFirstNewContent,
   LayoutFrameType frameType = parentFrame->Type();
 
   FlattenedChildIterator iter(insertion.mContainer);
-  const bool haveNoXBLChildren = !iter.XBLInvolved() || !iter.GetNextChild();
+  const bool haveNoXBLChildren =
+      !iter.ShadowDOMInvolved() || !iter.GetNextChild();
 
   AutoFrameConstructionItemList items(this);
   if (aFirstNewContent->GetPreviousSibling() &&
@@ -7271,7 +7104,7 @@ void nsCSSFrameConstructor::ContentRangeInserted(nsIContent* aStartChild,
   AutoFrameConstructionItemList items(this);
   ParentType parentType = GetParentType(frameType);
   FlattenedChildIterator iter(insertion.mContainer);
-  bool haveNoXBLChildren = !iter.XBLInvolved() || !iter.GetNextChild();
+  bool haveNoXBLChildren = !iter.ShadowDOMInvolved() || !iter.GetNextChild();
   if (aStartChild->GetPreviousSibling() && parentType == eTypeBlock &&
       haveNoXBLChildren) {
     // If there's a text node in the normal content list just before the
@@ -7640,9 +7473,11 @@ bool nsCSSFrameConstructor::ContentRemoved(nsIContent* aChild,
     }
 
 #ifdef ACCESSIBILITY
-    if (nsAccessibilityService* accService =
+    if (aFlags != REMOVE_FOR_RECONSTRUCTION) {
-            PresShell::GetAccessibilityService()) {
+      if (nsAccessibilityService* accService =
-      accService->ContentRemoved(mPresShell, aChild);
+              PresShell::GetAccessibilityService()) {
+        accService->ContentRemoved(mPresShell, aChild);
+      }
     }
 #endif
 
@@ -8925,12 +8760,10 @@ void nsCSSFrameConstructor::CreateNeededAnonFlexOrGridItems(
                         FCDATA_IS_WRAPPER_ANON_BOX,
                     NS_NewBlockFormattingContext);
 
-    FrameConstructionItem* newItem =
+    FrameConstructionItem* newItem = new (this)
-        new (this) FrameConstructionItem(&sBlockFormattingContextFCData,
+        FrameConstructionItem(&sBlockFormattingContextFCData,
-                                         // Use the content of our parent frame
+                              // Use the content of our parent frame
-                                         parentContent,
+                              parentContent, wrapperStyle.forget(), true);
-                                         // no pending binding
-                                         nullptr, wrapperStyle.forget(), true);
 
     newItem->mIsAllInline =
         newItem->mComputedStyle->StyleDisplay()->IsInlineOutsideStyle();
@@ -9407,12 +9240,10 @@ void nsCSSFrameConstructor::WrapItemsInPseudoParent(
             pseudoType);
   }
 
-  FrameConstructionItem* newItem =
+  FrameConstructionItem* newItem = new (this)
-      new (this) FrameConstructionItem(&pseudoData.mFCData,
+      FrameConstructionItem(&pseudoData.mFCData,
-                                       // Use the content of our parent frame
+                            // Use the content of our parent frame
-                                       aParentContent,
+                            aParentContent, wrapperStyle.forget(), true);
-                                       // no pending binding
-                                       nullptr, wrapperStyle.forget(), true);
 
   const nsStyleDisplay* disp = newItem->mComputedStyle->StyleDisplay();
   // Here we're cheating a tad... technically, table-internal items should be
@@ -9466,12 +9297,10 @@ void nsCSSFrameConstructor::CreateNeededPseudoSiblings(
   RefPtr<ComputedStyle> pseudoStyle =
       mPresShell->StyleSet()->ResolveInheritingAnonymousBoxStyle(
           pseudoData.mPseudoType, aParentFrame->Style());
-  FrameConstructionItem* newItem =
+  FrameConstructionItem* newItem = new (this) FrameConstructionItem(
-      new (this) FrameConstructionItem(&pseudoData.mFCData,
+      &pseudoData.mFCData,
-                                       // Use the content of the parent frame
+      // Use the content of the parent frame
-                                       aParentFrame->GetContent(),
+      aParentFrame->GetContent(), pseudoStyle.forget(), true);
-                                       // no pending binding
-                                       nullptr, pseudoStyle.forget(), true);
   newItem->mIsAllInline = true;
   newItem->mChildItems.SetParentHasNoXBLChildren(true);
   iter.InsertItem(newItem);
@@ -9640,8 +9469,7 @@ void nsCSSFrameConstructor::ProcessChildren(
     nsFrameConstructorState& aState, nsIContent* aContent,
     ComputedStyle* aComputedStyle, nsContainerFrame* aFrame,
     const bool aCanHaveGeneratedContent, nsFrameList& aFrameList,
-    const bool aAllowBlockStyles, PendingBinding* aPendingBinding,
+    const bool aAllowBlockStyles, nsIFrame* aPossiblyLeafFrame) {
-    nsIFrame* aPossiblyLeafFrame) {
   MOZ_ASSERT(aFrame, "Must have parent frame here");
   MOZ_ASSERT(aFrame->GetContentInsertionFrame() == aFrame,
              "Parent frame in ProcessChildren should be its own "
@@ -9679,9 +9507,6 @@ void nsCSSFrameConstructor::ProcessChildren(
     aState.PushFloatContainingBlock(aFrame, floatSaveState);
   }
 
-  nsFrameConstructorState::PendingBindingAutoPusher pusher(aState,
-                                                           aPendingBinding);
-
   AutoFrameConstructionItemList itemsToConstruct(this);
 
   // If we have first-letter or first-line style then frames can get
@@ -9746,13 +9571,13 @@ void nsCSSFrameConstructor::ProcessChildren(
       MOZ_ASSERT(insertion.mContainer == GetInsertionPoint(child).mContainer,
                  "GetInsertionPoint should agree with us");
       if (addChildItems) {
-        AddFrameConstructionItems(aState, child, iter.XBLInvolved(), insertion,
+        AddFrameConstructionItems(aState, child, iter.ShadowDOMInvolved(),
-                                  itemsToConstruct);
+                                  insertion, itemsToConstruct);
       } else {
         ClearLazyBits(child, child->GetNextSibling());
       }
     }
-    itemsToConstruct.SetParentHasNoXBLChildren(!iter.XBLInvolved());
+    itemsToConstruct.SetParentHasNoXBLChildren(!iter.ShadowDOMInvolved());
 
     if (aCanHaveGeneratedContent) {
       // Probe for generated content after
@@ -10537,8 +10362,7 @@ void nsCSSFrameConstructor::ConstructBlock(
     nsFrameConstructorState& aState, nsIContent* aContent,
     nsContainerFrame* aParentFrame, nsContainerFrame* aContentParentFrame,
     ComputedStyle* aComputedStyle, nsContainerFrame** aNewFrame,
-    nsFrameList& aFrameList, nsIFrame* aPositionedFrameForAbsPosContainer,
+    nsFrameList& aFrameList, nsIFrame* aPositionedFrameForAbsPosContainer) {
-    PendingBinding* aPendingBinding) {
   // clang-format off
   //
   // If a block frame is in a multi-column subtree, its children may need to
@@ -10664,7 +10488,7 @@ void nsCSSFrameConstructor::ConstructBlock(
   // Process the child content
   nsFrameList childList;
   ProcessChildren(aState, aContent, aComputedStyle, blockFrame, true, childList,
-                  true, aPendingBinding);
+                  true);
 
   if (!MayNeedToCreateColumnSpanSiblings(blockFrame, childList)) {
     // No need to create column-span siblings.
@@ -11199,11 +11023,6 @@ void nsCSSFrameConstructor::CreateIBSiblings(nsFrameConstructorState& aState,
 void nsCSSFrameConstructor::BuildInlineChildItems(
     nsFrameConstructorState& aState, FrameConstructionItem& aParentItem,
     bool aItemIsWithinSVGText, bool aItemAllowsTextPathChild) {
-  // XXXbz should we preallocate aParentItem.mChildItems to some sane
-  // length?  Maybe even to parentContent->GetChildCount()?
-  nsFrameConstructorState::PendingBindingAutoPusher pusher(
-      aState, aParentItem.mPendingBinding);
-
   ComputedStyle* const parentComputedStyle = aParentItem.mComputedStyle;
   nsIContent* const parentContent = aParentItem.mContent;
 
@@ -11231,7 +11050,7 @@ void nsCSSFrameConstructor::BuildInlineChildItems(
   FlattenedChildIterator iter(parentContent);
   for (nsIContent* content = iter.GetNextChild(); content;
        content = iter.GetNextChild()) {
-    AddFrameConstructionItems(aState, content, iter.XBLInvolved(),
+    AddFrameConstructionItems(aState, content, iter.ShadowDOMInvolved(),
                               InsertionPoint(), aParentItem.mChildItems, flags);
   }
 
@@ -11801,11 +11620,8 @@ void nsCSSFrameConstructor::GenerateChildFrames(nsContainerFrame* aFrame) {
     nsAutoScriptBlocker scriptBlocker;
     nsFrameList childList;
     nsFrameConstructorState state(mPresShell, nullptr, nullptr, nullptr);
-    // We don't have a parent frame with a pending binding constructor here,
-    // so no need to worry about ordering of the kids' constructors with it.
-    // Pass null for the PendingBinding.
     ProcessChildren(state, aFrame->GetContent(), aFrame->Style(), aFrame, false,
-                    childList, false, nullptr);
+                    childList, false);
 
     aFrame->SetInitialChildList(kPrincipalList, childList);
   }
@@ -11818,9 +11634,6 @@ void nsCSSFrameConstructor::GenerateChildFrames(nsContainerFrame* aFrame) {
     }
   }
 #endif
-
-  // call XBL constructors after the frames are created
-  mPresShell->GetDocument()->BindingManager()->ProcessAttachedQueue();
 }
 
 //////////////////////////////////////////////////////////

layout/base/nsCSSFrameConstructor.h

@@ -36,7 +36,6 @@ class nsCSSAnonBoxPseudoStaticAtom;
 class nsPageSequenceFrame;
 
 class nsPageContentFrame;
-struct PendingBinding;
 
 class nsFrameConstructorState;
 
@@ -786,24 +785,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
      pseudo-frames as needed */
   static const PseudoParentData sPseudoParentData[eParentTypeCount];
 
-  // The information that concerns the frame constructor after loading an XBL
-  // binding.
-  //
-  // This is expected to just be used temporarily to aggregate the different
-  // objects that LoadXBLBindingIfNeeded returns.
-  struct MOZ_STACK_CLASS XBLBindingLoadInfo {
-    mozilla::UniquePtr<PendingBinding> mPendingBinding;
-    bool mSuccess = false;
-
-    // For the error case.
-    XBLBindingLoadInfo();
-    explicit XBLBindingLoadInfo(mozilla::UniquePtr<PendingBinding>);
-  };
-
-  // Returns null mStyle member to signal an error.
-  XBLBindingLoadInfo LoadXBLBindingIfNeeded(nsIContent&, const ComputedStyle&,
-                                            ItemFlags aFlags);
-
   const FrameConstructionData* FindDataForContent(nsIContent&, ComputedStyle&,
                                                   nsIFrame* aParentFrame,
                                                   ItemFlags aFlags);
@@ -878,12 +859,11 @@ class nsCSSFrameConstructor final : public nsFrameManager {
     // Also, the return value is always non-null, thanks to infallible 'new'.
     FrameConstructionItem* AppendItem(
         nsCSSFrameConstructor* aFCtor, const FrameConstructionData* aFCData,
-        nsIContent* aContent, PendingBinding* aPendingBinding,
+        nsIContent* aContent, already_AddRefed<ComputedStyle>&& aComputedStyle,
-        already_AddRefed<ComputedStyle>&& aComputedStyle,
         bool aSuppressWhiteSpaceOptimizations) {
-      FrameConstructionItem* item = new (aFCtor) FrameConstructionItem(
+      FrameConstructionItem* item = new (aFCtor)
-          aFCData, aContent, aPendingBinding, std::move(aComputedStyle),
+          FrameConstructionItem(aFCData, aContent, std::move(aComputedStyle),
-          aSuppressWhiteSpaceOptimizations);
+                                aSuppressWhiteSpaceOptimizations);
       mItems.insertBack(item);
       ++mItemCount;
       ++mDesiredParentCounts[item->DesiredParentType()];
@@ -893,12 +873,11 @@ class nsCSSFrameConstructor final : public nsFrameManager {
     // Arguments are the same as AppendItem().
     FrameConstructionItem* PrependItem(
         nsCSSFrameConstructor* aFCtor, const FrameConstructionData* aFCData,
-        nsIContent* aContent, PendingBinding* aPendingBinding,
+        nsIContent* aContent, already_AddRefed<ComputedStyle>&& aComputedStyle,
-        already_AddRefed<ComputedStyle>&& aComputedStyle,
         bool aSuppressWhiteSpaceOptimizations) {
-      FrameConstructionItem* item = new (aFCtor) FrameConstructionItem(
+      FrameConstructionItem* item = new (aFCtor)
-          aFCData, aContent, aPendingBinding, std::move(aComputedStyle),
+          FrameConstructionItem(aFCData, aContent, std::move(aComputedStyle),
-          aSuppressWhiteSpaceOptimizations);
+                                aSuppressWhiteSpaceOptimizations);
       mItems.insertFront(item);
       ++mItemCount;
       ++mDesiredParentCounts[item->DesiredParentType()];
@@ -1112,12 +1091,11 @@ class nsCSSFrameConstructor final : public nsFrameManager {
   struct FrameConstructionItem final
       : public mozilla::LinkedListElement<FrameConstructionItem> {
     FrameConstructionItem(const FrameConstructionData* aFCData,
-                          nsIContent* aContent, PendingBinding* aPendingBinding,
+                          nsIContent* aContent,
                           already_AddRefed<ComputedStyle>&& aComputedStyle,
                           bool aSuppressWhiteSpaceOptimizations)
         : mFCData(aFCData),
           mContent(aContent),
-          mPendingBinding(aPendingBinding),
           mComputedStyle(std::move(aComputedStyle)),
           mSuppressWhiteSpaceOptimizations(aSuppressWhiteSpaceOptimizations),
           mIsText(false),
@@ -1173,15 +1151,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
     const FrameConstructionData* mFCData;
     // The nsIContent node to use when initializing the new frame.
     nsIContent* mContent;
-    // The PendingBinding for this frame construction item, if any.  May be
-    // null.  We maintain a list of PendingBindings in the frame construction
-    // state in the order in which AddToAttachedQueue should be called on them:
-    // depth-first, post-order traversal order.  Since we actually traverse the
-    // DOM in a mix of breadth-first and depth-first, it is the responsibility
-    // of whoever constructs FrameConstructionItem kids of a given
-    // FrameConstructionItem to push its mPendingBinding as the current
-    // insertion point before doing so and pop it afterward.
-    PendingBinding* mPendingBinding;
     // The style to use for creating the new frame.
     RefPtr<ComputedStyle> mComputedStyle;
     // Whether optimizations to skip constructing textframes around
@@ -1626,8 +1595,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
    * @param aFrameList the list in which we should place the in-flow children
    * @param aAllowBlockStyles Whether to allow first-letter and first-line
    *        styles on the parent.
-   * @param aPendingBinding Make sure to push this into aState before doing any
-   *        child item construction.
    * @param aPossiblyLeafFrame if non-null, this should be used for the isLeaf
    *        test and the anonymous content creation.  If null, aFrame will be
    *        used.
@@ -1637,7 +1604,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
                        nsContainerFrame* aParentFrame,
                        const bool aCanHaveGeneratedContent,
                        nsFrameList& aFrameList, const bool aAllowBlockStyles,
-                       PendingBinding* aPendingBinding,
                        nsIFrame* aPossiblyLeafFrame = nullptr);
 
   /**
@@ -1687,7 +1653,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
                              nsIContent* aContent,
                              nsContainerFrame* aParentFrame,
                              ComputedStyle* aComputedStyle, bool aBuildCombobox,
-                             PendingBinding* aPendingBinding,
                              nsFrameList& aFrameList);
 
   /**
@@ -1760,15 +1725,12 @@ class nsCSSFrameConstructor final : public nsFrameManager {
   // @param aPositionedFrameForAbsPosContainer if non-null, then the new
   // block should be an abs-pos container and aPositionedFrameForAbsPosContainer
   // is the frame whose style is making this block an abs-pos container.
-  // @param aPendingBinding the pending binding  from this block's frame
-  // construction item.
   void ConstructBlock(nsFrameConstructorState& aState, nsIContent* aContent,
                       nsContainerFrame* aParentFrame,
                       nsContainerFrame* aContentParentFrame,
                       ComputedStyle* aComputedStyle,
                       nsContainerFrame** aNewFrame, nsFrameList& aFrameList,
-                      nsIFrame* aPositionedFrameForAbsPosContainer,
+                      nsIFrame* aPositionedFrameForAbsPosContainer);
-                      PendingBinding* aPendingBinding);
 
   // Build the initial column hierarchy around aColumnContent. This function
   // should be called before constructing aColumnContent's children.

layout/base/nsChangeHint.h

@@ -220,17 +220,11 @@ enum nsChangeHint : uint32_t {
    */
   nsChangeHint_ScrollbarChange = 1 << 26,
 
-  /**
-   * Indicates that nsIFrame::UpdateWidgetProperties needs to be called.
-   * This is used for -moz-window-* properties.
-   */
-  nsChangeHint_UpdateWidgetProperties = 1 << 27,
-
   /**
    *  Indicates that there has been a colspan or rowspan attribute change
    *  on the cells of a table.
    */
-  nsChangeHint_UpdateTableCellSpans = 1 << 28,
+  nsChangeHint_UpdateTableCellSpans = 1 << 27,
 
   /**
    * Indicates that the visiblity property changed.
@@ -238,7 +232,7 @@ enum nsChangeHint : uint32_t {
    * visibility:hidden elements in the case where the elements have no visible
    * descendants.
    */
-  nsChangeHint_VisibilityChange = 1u << 29,
+  nsChangeHint_VisibilityChange = 1u << 28,
 
   // IMPORTANT NOTE: When adding a new hint, you will need to add it to
   // one of:
@@ -255,7 +249,7 @@ enum nsChangeHint : uint32_t {
   /**
    * Dummy hint value for all hints. It exists for compile time check.
    */
-  nsChangeHint_AllHints = uint32_t((1ull << 30) - 1),
+  nsChangeHint_AllHints = uint32_t((1ull << 29) - 1),
 };
 
 // Redefine these operators to return nothing. This will catch any use
@@ -336,8 +330,7 @@ inline nsChangeHint operator^=(nsChangeHint& aLeft, nsChangeHint aRight) {
    nsChangeHint_UpdateOverflow | nsChangeHint_UpdateParentOverflow |          \
    nsChangeHint_UpdatePostTransformOverflow |                                 \
    nsChangeHint_UpdateTableCellSpans | nsChangeHint_UpdateTransformLayer |    \
-   nsChangeHint_UpdateUsesOpacity | nsChangeHint_AddOrRemoveTransform |       \
+   nsChangeHint_UpdateUsesOpacity | nsChangeHint_AddOrRemoveTransform)
-   nsChangeHint_UpdateWidgetProperties)
 
 // The change hints that are sometimes considered to be handled for descendants.
 #define nsChangeHint_Hints_SometimesHandledForDescendants           \

layout/base/nsDocumentViewer.cpp

@@ -990,15 +990,14 @@ nsDocumentViewer::LoadComplete(nsresult aStatus) {
     restoring =
         (mDocument->GetReadyStateEnum() == Document::READYSTATE_COMPLETE);
     if (!restoring) {
-      NS_ASSERTION(mDocument->IsXULDocument() ||  // readyState for XUL is bogus
+      NS_ASSERTION(
-                       mDocument->GetReadyStateEnum() ==
+          mDocument->GetReadyStateEnum() == Document::READYSTATE_INTERACTIVE ||
-                           Document::READYSTATE_INTERACTIVE ||
+              // test_stricttransportsecurity.html has old-style
-                       // test_stricttransportsecurity.html has old-style
+              // docshell-generated about:blank docs reach this code!
-                       // docshell-generated about:blank docs reach this code!
+              (mDocument->GetReadyStateEnum() ==
-                       (mDocument->GetReadyStateEnum() ==
+                   Document::READYSTATE_UNINITIALIZED &&
-                            Document::READYSTATE_UNINITIALIZED &&
+               NS_IsAboutBlank(mDocument->GetDocumentURI())),
-                        NS_IsAboutBlank(mDocument->GetDocumentURI())),
+          "Bad readystate");
-                   "Bad readystate");
 #ifdef DEBUG
       bool docShellThinksWeAreRestoring;
       docShell->GetRestoringDocument(&docShellThinksWeAreRestoring);
@@ -3222,11 +3221,6 @@ nsresult nsDocViewerFocusListener::HandleEvent(Event* aEvent) {
 NS_IMETHODIMP
 nsDocumentViewer::Print(nsIPrintSettings* aPrintSettings,
                         nsIWebProgressListener* aWebProgressListener) {
-  // Printing XUL documents is not supported.
-  if (mDocument && mDocument->IsXULDocument()) {
-    return NS_ERROR_FAILURE;
-  }
-
   if (!mContainer) {
     PR_PL(("Container was destroyed yet we are still trying to use it!"));
     return NS_ERROR_FAILURE;
@@ -3316,12 +3310,6 @@ nsDocumentViewer::PrintPreview(nsIPrintSettings* aPrintSettings,
     return NS_ERROR_FAILURE;
   }
 
-  // Printing XUL documents is not supported.
-  if (mDocument && mDocument->IsXULDocument()) {
-    nsPrintJob::CloseProgressDialog(aWebProgressListener);
-    return NS_ERROR_FAILURE;
-  }
-
   nsCOMPtr<nsIDocShell> docShell(mContainer);
   if (!docShell || !mDeviceContext) {
     PR_PL(("Can't Print Preview without device context and docshell"));

layout/base/nsGenConList.cpp

@@ -68,14 +68,6 @@ inline int32_t PseudoCompareType(nsIFrame* aFrame, nsIContent** aContent) {
   return 0;
 }
 
-#ifdef DEBUG
-static bool IsXBLInvolved(nsIContent* aContent1, nsIContent* aContent2) {
-  auto* ancestor = nsContentUtils::GetCommonAncestor(aContent1, aContent2);
-  return ancestor && ancestor->IsElement() &&
-         ancestor->AsElement()->GetXBLBinding();
-}
-#endif
-
 /* static */
 bool nsGenConList::NodeAfter(const nsGenConNode* aNode1,
                              const nsGenConNode* aNode2) {
@@ -105,8 +97,7 @@ bool nsGenConList::NodeAfter(const nsGenConNode* aNode1,
   int32_t cmp = nsLayoutUtils::CompareTreePosition(content1, content2);
   // DoCompareTreePosition doesn't know about XBL anonymous content, and we
   // probably shouldn't bother teaching it about it.
-  MOZ_ASSERT(cmp != 0 || IsXBLInvolved(content1, content2),
+  MOZ_ASSERT(cmp != 0, "same content, different frames");
-             "same content, different frames");
   return cmp > 0;
 }
 

layout/base/nsILayoutDebugger.h

@@ -1,42 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* XPCOM interface for layout-debug extension to reach layout internals */
-
-#ifndef nsILayoutDebugger_h___
-#define nsILayoutDebugger_h___
-
-#include "nsISupports.h"
-
-// 1295f7c0-96b3-41fc-93ed-c95dfb712ce7
-#define NS_ILAYOUT_DEBUGGER_IID                      \
-  {                                                  \
-    0x1295f7c0, 0x96b3, 0x41fc, {                    \
-      0x93, 0xed, 0xc9, 0x5d, 0xfb, 0x71, 0x2c, 0xe7 \
-    }                                                \
-  }
-
-/**
- * API for access and control of layout debugging
- */
-class nsILayoutDebugger : public nsISupports {
- public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ILAYOUT_DEBUGGER_IID)
-
-  NS_IMETHOD SetShowFrameBorders(bool aEnable) = 0;
-
-  NS_IMETHOD GetShowFrameBorders(bool* aResult) = 0;
-
-  NS_IMETHOD SetShowEventTargetFrameBorder(bool aEnable) = 0;
-
-  NS_IMETHOD GetShowEventTargetFrameBorder(bool* aResult) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsILayoutDebugger, NS_ILAYOUT_DEBUGGER_IID)
-
-#ifdef DEBUG
-nsresult NS_NewLayoutDebugger(nsILayoutDebugger** aResult);
-#endif /* DEBUG */
-
-#endif /* nsILayoutDebugger_h___ */

layout/base/nsLayoutDebugger.cpp

@@ -2,12 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/*
+/* some layout debugging functions that ought to live in nsFrame.cpp */
- * implementation of interface that allows layout-debug extension access
- * to some internals of layout
- */
-
-#include "nsILayoutDebugger.h"
 
 #include "nsAttrValue.h"
 #include "nsIFrame.h"
@@ -20,66 +15,6 @@
 using namespace mozilla;
 using namespace mozilla::layers;
 
-#ifdef DEBUG
-class nsLayoutDebugger : public nsILayoutDebugger {
- public:
-  nsLayoutDebugger();
-
-  NS_DECL_ISUPPORTS
-
-  NS_IMETHOD SetShowFrameBorders(bool aEnable) override;
-
-  NS_IMETHOD GetShowFrameBorders(bool* aResult) override;
-
-  NS_IMETHOD SetShowEventTargetFrameBorder(bool aEnable) override;
-
-  NS_IMETHOD GetShowEventTargetFrameBorder(bool* aResult) override;
-
- protected:
-  virtual ~nsLayoutDebugger();
-};
-
-nsresult NS_NewLayoutDebugger(nsILayoutDebugger** aResult) {
-  MOZ_ASSERT(aResult, "null OUT ptr");
-  if (!aResult) {
-    return NS_ERROR_NULL_POINTER;
-  }
-  nsLayoutDebugger* it = new nsLayoutDebugger();
-  return it->QueryInterface(NS_GET_IID(nsILayoutDebugger), (void**)aResult);
-}
-
-nsLayoutDebugger::nsLayoutDebugger() {}
-
-nsLayoutDebugger::~nsLayoutDebugger() {}
-
-NS_IMPL_ISUPPORTS(nsLayoutDebugger, nsILayoutDebugger)
-
-NS_IMETHODIMP
-nsLayoutDebugger::SetShowFrameBorders(bool aEnable) {
-  nsFrame::ShowFrameBorders(aEnable);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsLayoutDebugger::GetShowFrameBorders(bool* aResult) {
-  *aResult = nsFrame::GetShowFrameBorders();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsLayoutDebugger::SetShowEventTargetFrameBorder(bool aEnable) {
-  nsFrame::ShowEventTargetFrameBorder(aEnable);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsLayoutDebugger::GetShowEventTargetFrameBorder(bool* aResult) {
-  *aResult = nsFrame::GetShowEventTargetFrameBorder();
-  return NS_OK;
-}
-
-#endif
-
 static std::ostream& operator<<(std::ostream& os, const nsPrintfCString& rhs) {
   os << rhs.get();
   return os;

layout/base/nsPresContext.cpp

@@ -82,6 +82,7 @@
 #include "mozilla/Telemetry.h"
 #include "mozilla/dom/Performance.h"
 #include "mozilla/dom/PerformanceTiming.h"
+#include "mozilla/dom/PerformancePaintTiming.h"
 #include "mozilla/layers/APZThreadUtils.h"
 #include "mozilla/dom/ImageTracker.h"
 
@@ -152,11 +153,9 @@ static bool IsVisualCharset(NotNull<const Encoding*> aCharset) {
 }
 
 nsPresContext::nsPresContext(dom::Document* aDocument, nsPresContextType aType)
-    : mType(aType),
+    : mPresShell(nullptr),
-      mPresShell(nullptr),
       mDocument(aDocument),
       mMedium(aType == eContext_Galley ? nsGkAtoms::screen : nsGkAtoms::print),
-      mInflationDisabledForShrinkWrap(false),
       mSystemFontScale(1.0),
       mTextZoom(1.0),
       mEffectiveTextZoom(1.0),
@@ -169,17 +168,19 @@ nsPresContext::nsPresContext(dom::Document* aDocument, nsPresContextType aType)
       mPageScale(0.0),
       mPPScale(1.0f),
       mViewportScrollOverrideElement(nullptr),
-      mViewportScrollStyles(StyleOverflow::Auto, StyleOverflow::Auto),
-      mExistThrottledUpdates(false),
-      // mImageAnimationMode is initialised below, in constructor body
-      mImageAnimationModePref(imgIContainer::kNormalAnimMode),
-      mInterruptChecksToSkip(0),
-      mNextFrameRateMultiplier(0),
       mElementsRestyled(0),
       mFramesConstructed(0),
       mFramesReflowed(0),
+      mInterruptChecksToSkip(0),
+      mNextFrameRateMultiplier(0),
+      mViewportScrollStyles(StyleOverflow::Auto, StyleOverflow::Auto),
+      // mImageAnimationMode is initialised below, in constructor body
+      mImageAnimationModePref(imgIContainer::kNormalAnimMode),
+      mType(aType),
+      mInflationDisabledForShrinkWrap(false),
       mInteractionTimeEnabled(true),
       mHasPendingInterrupt(false),
+      mHasEverBuiltInvisibleText(false),
       mPendingInterruptFromTest(false),
       mInterruptsEnabled(false),
       mSendAfterPaintToContent(false),
@@ -210,6 +211,7 @@ nsPresContext::nsPresContext(dom::Document* aDocument, nsPresContextType aType)
       mQuirkSheetAdded(false),
       mHadNonBlankPaint(false),
       mHadContentfulPaint(false),
+      mHadNonTickContentfulPaint(false),
       mHadContentfulPaintComposite(false)
 #ifdef DEBUG
       ,
@@ -2306,12 +2308,35 @@ void nsPresContext::NotifyNonBlankPaint() {
 }
 
 void nsPresContext::NotifyContentfulPaint() {
+  nsRootPresContext* rootPresContext = GetRootPresContext();
+  if (!rootPresContext) {
+    return;
+  }
   if (!mHadContentfulPaint) {
+    if (!rootPresContext->RefreshDriver()->IsInRefresh()) {
+      if (!mHadNonTickContentfulPaint) {
+        rootPresContext->RefreshDriver()
+            ->AddForceNotifyContentfulPaintPresContext(this);
+        mHadNonTickContentfulPaint = true;
+      }
+      return;
+    }
     mHadContentfulPaint = true;
-    if (IsRootContentDocument()) {
+    mFirstContentfulPaintTransactionId =
-      if (nsRootPresContext* rootPresContext = GetRootPresContext()) {
+        Some(rootPresContext->mRefreshDriver->LastTransactionId().Next());
-        mFirstContentfulPaintTransactionId =
+    if (nsPIDOMWindowInner* innerWindow = mDocument->GetInnerWindow()) {
-            Some(rootPresContext->mRefreshDriver->LastTransactionId().Next());
+      if (Performance* perf = innerWindow->GetPerformance()) {
+        TimeStamp nowTime = rootPresContext->RefreshDriver()->MostRecentRefresh(
+            /* aEnsureTimerStarted */ false);
+        MOZ_ASSERT(!nowTime.IsNull(),
+                   "Most recent refresh timestamp should exist since we are in "
+                   "a refresh driver tick");
+        MOZ_ASSERT(rootPresContext->RefreshDriver()->IsInRefresh(),
+                   "We should only notify contentful paint during refresh "
+                   "driver ticks");
+        RefPtr<PerformancePaintTiming> paintTiming = new PerformancePaintTiming(
+            perf, u"first-contentful-paint"_ns, nowTime);
+        perf->SetFCPTimingEntry(paintTiming);
       }
     }
   }

layout/base/nsPresContext.h

@@ -137,7 +137,7 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS_FINAL
   NS_DECL_CYCLE_COLLECTION_CLASS(nsPresContext)
 
-  enum nsPresContextType {
+  enum nsPresContextType : uint8_t {
     eContext_Galley,        // unpaginated screen presentation
     eContext_PrintPreview,  // paginated screen presentation
     eContext_Print,         // paginated printer presentation
@@ -964,19 +964,13 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   void NotifyContentfulPaint();
   void NotifyDOMContentFlushed();
 
+  bool HasEverBuiltInvisibleText() const { return mHasEverBuiltInvisibleText; }
+  void SetBuiltInvisibleText() { mHasEverBuiltInvisibleText = true; }
+
   bool UsesExChUnits() const { return mUsesExChUnits; }
 
   void SetUsesExChUnits(bool aValue) { mUsesExChUnits = aValue; }
 
-  // true if there are OMTA transition updates for the current document which
-  // have been throttled, and therefore some style information may not be up
-  // to date
-  bool ExistThrottledUpdates() const { return mExistThrottledUpdates; }
-
-  void SetExistThrottledUpdates(bool aExistThrottledUpdates) {
-    mExistThrottledUpdates = aExistThrottledUpdates;
-  }
-
   bool IsDeviceSizePageSize();
 
   bool HasWarnedAboutPositionedTableParts() const {
@@ -1083,7 +1077,6 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   // has been explicitly checked.  If you add any members to this class,
   // please make the ownership explicit (pinkerton, scc).
 
-  nsPresContextType mType;
   // the PresShell owns a strong reference to the nsPresContext, and is
   // responsible for nulling this pointer before it is destroyed
   mozilla::PresShell* MOZ_NON_OWNING_REF mPresShell;  // [WEAK]
@@ -1105,15 +1098,6 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   RefPtr<nsAtom> mMediaEmulated;
   RefPtr<gfxFontFeatureValueSet> mFontFeatureValuesLookup;
 
- public:
-  // The following are public member variables so that we can use them
-  // with mozilla::AutoToggle or mozilla::AutoRestore.
-
-  // Should we disable font size inflation because we're inside of
-  // shrink-wrapping calculations on an inflation container?
-  bool mInflationDisabledForShrinkWrap;
-
- protected:
   float mSystemFontScale;    // Internal text zoom factor, defaults to 1.0
   float mTextZoom;           // Text zoom, defaults to 1.0
   float mEffectiveTextZoom;  // Text zoom * system font scale
@@ -1159,17 +1143,6 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   // fullscreen elements, it happens in the fullscreen-specific cleanup invoked
   // by Element::UnbindFromTree().)
   mozilla::dom::Element* MOZ_NON_OWNING_REF mViewportScrollOverrideElement;
-  ScrollStyles mViewportScrollStyles;
-
-  bool mExistThrottledUpdates;
-
-  uint16_t mImageAnimationMode;
-  uint16_t mImageAnimationModePref;
-
-  uint32_t mInterruptChecksToSkip;
-
-  // During page load we use slower frame rate.
-  uint32_t mNextFrameRateMultiplier;
 
   // Counters for tests and tools that want to detect frame construction
   // or reflow.
@@ -1181,6 +1154,9 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
 
   Maybe<TransactionId> mFirstContentfulPaintTransactionId;
 
+  mozilla::UniquePtr<mozilla::MediaFeatureChange>
+      mPendingMediaFeatureValuesChange;
+
   // Time of various first interaction types, used to report time from
   // first paint of the top level content pres shell to first interaction.
   mozilla::TimeStamp mFirstNonBlankPaintTime;
@@ -1189,12 +1165,33 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   mozilla::TimeStamp mFirstMouseMoveTime;
   mozilla::TimeStamp mFirstScrollTime;
 
-  bool mInteractionTimeEnabled;
-
   // last time we did a full style flush
   mozilla::TimeStamp mLastStyleUpdateForAllAnimations;
 
+  uint32_t mInterruptChecksToSkip;
+
+  // During page load we use slower frame rate.
+  uint32_t mNextFrameRateMultiplier;
+
+  ScrollStyles mViewportScrollStyles;
+
+  uint16_t mImageAnimationMode;
+  uint16_t mImageAnimationModePref;
+
+  nsPresContextType mType;
+
+ public:
+  // The following are public member variables so that we can use them
+  // with mozilla::AutoToggle or mozilla::AutoRestore.
+
+  // Should we disable font size inflation because we're inside of
+  // shrink-wrapping calculations on an inflation container?
+  bool mInflationDisabledForShrinkWrap;
+
+ protected:
+  unsigned mInteractionTimeEnabled : 1;
   unsigned mHasPendingInterrupt : 1;
+  unsigned mHasEverBuiltInvisibleText : 1;
   unsigned mPendingInterruptFromTest : 1;
   unsigned mInterruptsEnabled : 1;
   unsigned mSendAfterPaintToContent : 1;
@@ -1250,6 +1247,11 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   unsigned mHadNonBlankPaint : 1;
   // Has NotifyContentfulPaint been called on this PresContext?
   unsigned mHadContentfulPaint : 1;
+  // True when a contentful paint has happened and this paint doesn't
+  // come from the regular tick process. Usually this means a
+  // contentful paint was triggered manually.
+  unsigned mHadNonTickContentfulPaint : 1;
+
   // Has NotifyDidPaintForSubtree been called for a contentful paint?
   unsigned mHadContentfulPaintComposite : 1;
 
@@ -1257,8 +1259,6 @@ class nsPresContext : public nsISupports, public mozilla::SupportsWeakPtr {
   unsigned mInitialized : 1;
 #endif
 
-  mozilla::UniquePtr<mozilla::MediaFeatureChange> mPendingMediaFeatureValuesChange;
-
  protected:
   virtual ~nsPresContext();
 

layout/base/nsRefreshDriver.cpp

@@ -119,24 +119,6 @@ static mozilla::LazyLogModule sRefreshDriverLog("nsRefreshDriver");
 #endif
 
 namespace {
-// `true` if we are currently in jank-critical mode.
-//
-// In jank-critical mode, any iteration of the event loop that takes
-// more than 16ms to compute will cause an ongoing animation to miss
-// frames.
-//
-// For simplicity, the current implementation assumes that we are in
-// jank-critical mode if and only if at least one vsync driver has
-// at least one observer.
-static uint64_t sActiveVsyncTimers = 0;
-
-// The latest value of process-wide jank levels.
-//
-// For each i, sJankLevels[i] counts the number of times delivery of
-// vsync to the main thread has been delayed by at least 2^i ms. Use
-// GetJankLevels to grab a copy of this array.
-uint64_t sJankLevels[12];
-
 // The number outstanding nsRefreshDrivers (that have been created but not
 // disconnected). When this reaches zero we will call
 // nsRefreshDriver::Shutdown.
@@ -638,7 +620,6 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
             Telemetry::FX_REFRESH_DRIVER_CHROME_FRAME_DELAY_MS, sample);
         Telemetry::Accumulate(
             Telemetry::FX_REFRESH_DRIVER_SYNC_SCROLL_FRAME_DELAY_MS, sample);
-        RecordJank(sample);
       } else if (mVsyncRate != TimeDuration::Forever()) {
         TimeDuration contentDelay =
             (TimeStamp::Now() - mLastChildTick) - mVsyncRate;
@@ -653,7 +634,6 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
             Telemetry::FX_REFRESH_DRIVER_CONTENT_FRAME_DELAY_MS, sample);
         Telemetry::Accumulate(
             Telemetry::FX_REFRESH_DRIVER_SYNC_SCROLL_FRAME_DELAY_MS, sample);
-        RecordJank(sample);
       } else {
         // Request the vsync rate from the parent process. Might be a few vsyncs
         // until the parent responds.
@@ -664,15 +644,6 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
 #endif
     }
 
-    void RecordJank(uint32_t aJankMS) {
-      uint32_t duration = 1 /* ms */;
-      for (size_t i = 0;
-           i < mozilla::ArrayLength(sJankLevels) && duration < aJankMS;
-           ++i, duration *= 2) {
-        sJankLevels[i]++;
-      }
-    }
-
     void TickRefreshDriver(VsyncId aId, TimeStamp aVsyncTimestamp) {
       MOZ_ASSERT(NS_IsMainThread());
 
@@ -747,7 +718,6 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
   }
 
   void StartTimer() override {
-    // Protect updates to `sActiveVsyncTimers`.
     MOZ_ASSERT(NS_IsMainThread());
 
     mLastFireTime = TimeStamp::Now();
@@ -758,12 +728,9 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
       Unused << mVsyncChild->SendObserve();
       mVsyncObserver->OnTimerStart();
     }
-
-    ++sActiveVsyncTimers;
   }
 
   void StopTimer() override {
-    // Protect updates to `sActiveVsyncTimers`.
     MOZ_ASSERT(NS_IsMainThread());
 
     if (XRE_IsParentProcess()) {
@@ -771,9 +738,6 @@ class VsyncRefreshDriverTimer : public RefreshDriverTimer {
     } else {
       Unused << mVsyncChild->SendUnobserve();
     }
-
-    MOZ_ASSERT(sActiveVsyncTimers > 0);
-    --sActiveVsyncTimers;
   }
 
   void ScheduleNextTick(TimeStamp aNowTime) override {
@@ -985,8 +949,6 @@ static void CreateContentVsyncRefreshTimer(void*) {
 static void CreateVsyncRefreshTimer() {
   MOZ_ASSERT(NS_IsMainThread());
 
-  PodArrayZero(sJankLevels);
-
   if (gfxPlatform::IsInLayoutAsapMode()) {
     return;
   }
@@ -1169,10 +1131,10 @@ void nsRefreshDriver::RestoreNormalRefresh() {
   mCompletedTransaction = mOutstandingTransactionId = mNextTransactionId;
 }
 
-TimeStamp nsRefreshDriver::MostRecentRefresh() const {
+TimeStamp nsRefreshDriver::MostRecentRefresh(bool aEnsureTimerStarted) const {
   // In case of stylo traversal, we have already activated the refresh driver in
   // RestyleManager::ProcessPendingRestyles().
-  if (!ServoStyleSet::IsInServoTraversal()) {
+  if (aEnsureTimerStarted && !ServoStyleSet::IsInServoTraversal()) {
     const_cast<nsRefreshDriver*>(this)->EnsureTimerStarted();
   }
 
@@ -1309,6 +1271,21 @@ void nsRefreshDriver::NotifyDOMContentLoaded() {
   }
 }
 
+void nsRefreshDriver::AddForceNotifyContentfulPaintPresContext(
+    nsPresContext* aPresContext) {
+  mForceNotifyContentfulPaintPresContexts.AppendElement(aPresContext);
+}
+
+void nsRefreshDriver::FlushForceNotifyContentfulPaintPresContext() {
+  while (!mForceNotifyContentfulPaintPresContexts.IsEmpty()) {
+    WeakPtr<nsPresContext> presContext =
+        mForceNotifyContentfulPaintPresContexts.PopLastElement();
+    if (presContext) {
+      presContext->NotifyContentfulPaint();
+    }
+  }
+}
+
 void nsRefreshDriver::RunDelayedEventsSoon() {
   // Place entries for delayed events into their corresponding normal list,
   // and schedule a refresh. When these delayed events run, if their document
@@ -1871,6 +1848,8 @@ void nsRefreshDriver::Tick(VsyncId aId, TimeStamp aNowTime) {
     DisplayPortUtils::UpdateDisplayPortMarginsFromPendingMessages();
   }
 
+  FlushForceNotifyContentfulPaintPresContext();
+
   AutoTArray<nsCOMPtr<nsIRunnable>, 16> earlyRunners = std::move(mEarlyRunners);
   for (auto& runner : earlyRunners) {
     runner->Run();
@@ -2481,16 +2460,4 @@ void nsRefreshDriver::Disconnect() {
   }
 }
 
-/* static */
-bool nsRefreshDriver::IsJankCritical() {
-  MOZ_ASSERT(NS_IsMainThread());
-  return sActiveVsyncTimers > 0;
-}
-
-/* static */
-bool nsRefreshDriver::GetJankLevels(Vector<uint64_t>& aJank) {
-  aJank.clear();
-  return aJank.append(sJankLevels, ArrayLength(sJankLevels));
-}
-
 #undef LOG

layout/base/nsRefreshDriver.h

@@ -75,7 +75,7 @@ class nsRefreshDriver final : public mozilla::layers::TransactionIdAllocator,
    * ensure that multiple animations started during the same event off
    * the main event loop have the same start time.)
    */
-  mozilla::TimeStamp MostRecentRefresh() const;
+  mozilla::TimeStamp MostRecentRefresh(bool aEnsureTimerStarted = true) const;
 
   /**
    * Add / remove refresh observers.
@@ -314,20 +314,6 @@ class nsRefreshDriver final : public mozilla::layers::TransactionIdAllocator,
   void SetIsResizeSuppressed() { mResizeSuppressed = true; }
   bool IsResizeSuppressed() const { return mResizeSuppressed; }
 
-  /**
-   * The latest value of process-wide jank levels.
-   *
-   * For each i, sJankLevels[i] counts the number of times delivery of
-   * vsync to the main thread has been delayed by at least 2^i
-   * ms. This data structure has been designed to make it easy to
-   * determine how much jank has taken place between two instants in
-   * time.
-   *
-   * Return `false` if `aJank` needs to be grown to accomodate the
-   * data but we didn't have enough memory.
-   */
-  static bool GetJankLevels(mozilla::Vector<uint64_t>& aJank);
-
   // mozilla::layers::TransactionIdAllocator
   TransactionId GetTransactionId(bool aThrottle) override;
   TransactionId LastTransactionId() const override;
@@ -398,6 +384,9 @@ class nsRefreshDriver final : public mozilla::layers::TransactionIdAllocator,
     mNeedToUpdateIntersectionObservations = true;
   }
 
+  void AddForceNotifyContentfulPaintPresContext(nsPresContext* aPresContext);
+  void FlushForceNotifyContentfulPaintPresContext();
+
  private:
   typedef nsTObserverArray<nsARefreshObserver*> ObserverArray;
   typedef nsTArray<RefPtr<VVPResizeEvent>> VisualViewportResizeEventArray;
@@ -552,23 +541,23 @@ class nsRefreshDriver final : public mozilla::layers::TransactionIdAllocator,
   AutoTArray<mozilla::AnimationEventDispatcher*, 16>
       mAnimationEventFlushObservers;
 
+  // nsPresContexts which `NotifyContentfulPaint` have been called,
+  // however the corresponding paint doesn't come from a regular
+  // rendering steps(aka tick).
+  //
+  // For these nsPresContexts, we invoke
+  // `FlushForceNotifyContentfulPaintPresContext` in the next tick
+  // to force notify contentful paint, regardless whether the tick paints
+  // or not.
+  nsTArray<mozilla::WeakPtr<nsPresContext>>
+      mForceNotifyContentfulPaintPresContexts;
+
   void BeginRefreshingImages(RequestTable& aEntries,
                              mozilla::TimeStamp aDesired);
 
   friend class mozilla::RefreshDriverTimer;
 
   static void Shutdown();
-
-  // `true` if we are currently in jank-critical mode.
-  //
-  // In jank-critical mode, any iteration of the event loop that takes
-  // more than 16ms to compute will cause an ongoing animation to miss
-  // frames.
-  //
-  // For simplicity, the current implementation assumes that we are
-  // in jank-critical mode if and only if the vsync driver has at least
-  // one observer.
-  static bool IsJankCritical();
 };
 
 #endif /* !defined(nsRefreshDriver_h_) */

layout/base/tests/browser_bug617076.js

@@ -19,7 +19,7 @@ add_task(async function test() {
   // insert button into test page content
   await ContentTask.spawn(gBrowser.selectedBrowser, null, async function() {
     let doc = content.document;
-    let e = doc.createElement("button");
+    let e = doc.createXULElement("button");
     e.setAttribute("label", "hello");
     e.setAttribute("tooltiptext", "world");
     e.setAttribute("id", "test-button");

layout/base/tests/chrome/chrome.ini

@@ -8,13 +8,13 @@ support-files =
   animated.gif
   blue-32x32.png
   bug551434_childframe.html
-  chrome_content_integration_window.xul
+  chrome_content_integration_window.xhtml
-  default_background_window.xul
+  default_background_window.xhtml
-  dialog_with_positioning_window.xul
+  dialog_with_positioning_window.xhtml
   file_bug458898.html
-  printpreview_bug396024_helper.xul
+  printpreview_bug396024_helper.xhtml
-  printpreview_bug482976_helper.xul
+  printpreview_bug482976_helper.xhtml
-  printpreview_helper.xul
+  printpreview_helper.xhtml
   printpreview_font_api.html
   printpreview_font_api_ref.html
   printpreview_font_mozprintcallback.html
@@ -27,48 +27,51 @@ support-files =
   test_shadow_root_adopted_styles_ref.html
   test_shared_adopted_styles.html
   test_shared_adopted_styles_ref.html
-  file_bug1018265.xul
+  file_bug1018265.xhtml
 
 [test_bug396367-1.html]
 [test_bug396367-2.html]
-[test_bug420499.xul]
+[test_bug420499.xhtml]
 [test_bug458898.html]
-[test_bug514660.xul]
+[test_bug465448.xhtml]
-[test_bug533845.xul]
+support-files =
+  file_bug465448.html
+[test_bug514660.xhtml]
+[test_bug533845.xhtml]
 skip-if = os == 'linux' && !debug # Bug 1208197
 [test_bug551434.html]
 [test_bug708062.html]
-[test_bug812817.xul]
+[test_bug812817.xhtml]
 [test_bug847890_paintFlashing.html]
-[test_bug1018265.xul]
+[test_bug1018265.xhtml]
-[test_bug1041200.xul]
+[test_bug1041200.xhtml]
 skip-if = os == 'win' && bits == 64 # Bug 1272321
 support-files =
   bug1041200_frame.html
   bug1041200_window.html
-[test_chrome_content_integration.xul]
+[test_chrome_content_integration.xhtml]
-[test_chrome_over_plugin.xul]
+[test_chrome_over_plugin.xhtml]
 support-files =
-  chrome_over_plugin_window.xul
+  chrome_over_plugin_window.xhtml
   chrome_over_plugin_window_frame.html
-[test_default_background.xul]
+[test_default_background.xhtml]
 [test_dialog_with_positioning.html]
 tags = openwindow
 [test_fixed_bg_scrolling_repaints.html]
-[test_leaf_layers_partition_browser_window.xul]
+[test_leaf_layers_partition_browser_window.xhtml]
 skip-if = true # Bug 992311
 [test_prerendered_transforms.html]
-[test_printpreview.xul]
+[test_printpreview.xhtml]
 skip-if = (os == "linux" && bits == 32) || (verify && (os == 'win')) # Disabled on Linux32 for bug 1278957
-[test_printpreview_bug396024.xul]
+[test_printpreview_bug396024.xhtml]
 skip-if = (verify && (os == 'win'))
-[test_printpreview_bug482976.xul]
+[test_printpreview_bug482976.xhtml]
 skip-if = (verify && (os == 'win'))
 [test_scrolling_repaints.html]
 [test_will_change.html]
 skip-if = webrender
 [test_getClientRectsAndTexts.html]
-[test_css_visibility_propagation.xul]
+[test_css_visibility_propagation.xhtml]
 support-files =
   window_css_visibility_propagation-1.html
   window_css_visibility_propagation-2.html

layout/base/tests/chrome/chrome_content_integration_window.xhtml

@@ -6,7 +6,7 @@
         style="background:black; -moz-appearance:none;">
   <script src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
 
-  <stack style="height:300px; width:200px;">
+  <stack style="align-items: center; height: 300px; width: 200px;">
     <!-- the bottom 100px is a strip of black that should be vixible through the content iframe -->
     <vbox style="background:pink; border-bottom:100px solid black"/>
     <!-- the middle 100px is a strip of black in the content iframe -->
@@ -24,7 +24,7 @@
     for (var name of imports) {
       window[name] = window.opener.wrappedJSObject[name];
     }
-    
+
     function runTests() {
       var testCanvas = snapshotWindow(window);
 

layout/base/tests/chrome/test_bug1018265.xhtml

@@ -19,7 +19,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1018265
   SimpleTest.waitForExplicitFinish();
 
   function run() {
-    window.open("file_bug1018265.xul", "contentViewerTest", "chrome,width=100,height=100");
+    window.open("file_bug1018265.xhtml", "contentViewerTest", "chrome,width=100,height=100");
   }
 
   function done() {

layout/base/tests/chrome/test_bug420499.xhtml

@@ -13,13 +13,13 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=420499
 
     <menu id="menu" label="Menu">
       <menupopup id="file-popup">
-        <!-- <textbox id="some-text" maxlength="10" value="some text"/> -->
+        <!-- <input xmlns="http://www.w3.org/1999/xhtml" id="some-text" maxlength="10" value="some text"/> -->
         <menu label="submenu">
           <menupopup id="file-popup-inner">
 
             <menuitem label="Item1"/>
             <menuitem label="Item2"/>
-            <textbox id="some-text" maxlength="10" value="some more text"/>
+            <input xmlns="http://www.w3.org/1999/xhtml" id="some-text" maxlength="10" value="some more text"/>
           </menupopup>
         </menu>
         <menuitem label="Item3"/>

layout/base/tests/chrome/test_bug465448.xhtml

@@ -7,8 +7,8 @@
   xmlns:html="http://www.w3.org/1999/xhtml"
   xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
 
-  <script src="/tests/SimpleTest/SimpleTest.js"></script>      
+  <script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
-  <script src="/tests/SimpleTest/EventUtils.js"></script>      
+  <script src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
 
 <script><![CDATA[
 SimpleTest.waitForExplicitFinish();