5 files changed, 339 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index 5576e07e09be..8c509103c3ea 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -3,7 +3,7 @@
 PORTNAME=	waterfox
 DISTVERSION=	56.2.0-31
 DISTVERSIONSUFFIX=	-gf435a827f82ac
-PORTREVISION=	6
+PORTREVISION=	7
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1455261 b/www/waterfox/files/patch-bug1455261
new file mode 100644
index 000000000000..0ea9cb5b80ed
--- /dev/null
+++ b/www/waterfox/files/patch-bug1455261
@@ -0,0 +1,27 @@
+commit 24c2adf0cbd4
+Author: Michael Kaply <mozilla@kaply.com>
+Date:   Fri Jun 1 16:59:03 2018 -0500
+
+    Bug 1455261 - Check for null metadata to workaround broken search.json. r=adw, a=RyanVM
+    
+    MozReview-Commit-ID: 4D2F30MHaqE
+    
+    --HG--
+    extra : source : 9a5f5fa5cfa0a6fe45eb7685fb1798529e8f406a
+---
+ toolkit/components/search/nsSearchService.js | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git toolkit/components/search/nsSearchService.js toolkit/components/search/nsSearchService.js
+index 6c153c5e29cdf..86a286819f02b 100644
+--- toolkit/components/search/nsSearchService.js
++++ toolkit/components/search/nsSearchService.js
+@@ -2074,7 +2074,7 @@ Engine.prototype = {
+   },
+ 
+   getAttr(name) {
+-    return this._metaData[name] || undefined;
++    return (this._metaData && this._metaData[name]) || undefined;
+   },
+ 
+   // nsISearchEngine
diff --git a/www/waterfox/files/patch-bug1466606 b/www/waterfox/files/patch-bug1466606
new file mode 100644
index 000000000000..86bdbdd5c6d0
--- /dev/null
+++ b/www/waterfox/files/patch-bug1466606
@@ -0,0 +1,124 @@
+commit 2314357d5b26
+Author: Jean-Yves Avenard <jyavenard@mozilla.com>
+Date:   Wed Jun 6 15:14:24 2018 +0200
+
+    Bug 1466606 - Calculate the current GetSample index when needed. r=bryce, a=RyanVM
+    
+    The assumption that when calling GetNextRandomAccessPoint the next GetSample index would always be known was incorrect. It assumed that the call to GetNextRandomAccessPoint would always be preceded by a call to GetSample.
+    This is not always how the MediaSourceDemuxer called it.
+    
+    MozReview-Commit-ID: H1MyPpDEytk
+    
+    --HG--
+    extra : source : 1bdee3c3ca7cc92b1dd7a6d80cb33c313d2a5e59
+---
+ dom/media/mediasource/TrackBuffersManager.cpp | 60 +++++++++++++++++++++------
+ dom/media/mediasource/TrackBuffersManager.h   |  9 ++++
+ 2 files changed, 56 insertions(+), 13 deletions(-)
+
+diff --git dom/media/mediasource/TrackBuffersManager.cpp dom/media/mediasource/TrackBuffersManager.cpp
+index 3de834a1e29aa..12df3d5461ff0 100644
+--- dom/media/mediasource/TrackBuffersManager.cpp
++++ dom/media/mediasource/TrackBuffersManager.cpp
+@@ -2362,18 +2362,8 @@ TrackBuffersManager::SkipToNextRandomAccessPoint(TrackInfo::TrackType aTrack,
+   // SkipToNextRandomAccessPoint can only be called if aTimeThreadshold is known
+   // to be buffered.
+ 
+-  // So first determine the current position in the track buffer if necessary.
+-  if (trackData.mNextGetSampleIndex.isNothing()) {
+-    if (trackData.mNextSampleTimecode == TimeUnit()) {
+-      // First demux, get first sample.
+-      trackData.mNextGetSampleIndex = Some(0u);
+-    } else {
+-      int32_t pos = FindCurrentPosition(aTrack, aFuzz);
+-      if (pos < 0) {
+-        return 0;
+-      }
+-      trackData.mNextGetSampleIndex = Some(uint32_t(pos));
+-    }
++  if (NS_FAILED(SetNextGetSampleIndexIfNeeded(aTrack, aFuzz))) {
++    return 0;
+   }
+ 
+   TimeUnit nextSampleTimecode = trackData.mNextSampleTimecode;
+@@ -2639,8 +2629,13 @@ TrackBuffersManager::GetNextRandomAccessPoint(TrackInfo::TrackType aTrack,
+                                               const TimeUnit& aFuzz)
+ {
+   MOZ_ASSERT(OnTaskQueue());
++
++  // So first determine the current position in the track buffer if necessary.
++  if (NS_FAILED(SetNextGetSampleIndexIfNeeded(aTrack, aFuzz))) {
++    return TimeUnit::FromInfinity();
++  }
++
+   auto& trackData = GetTracksData(aTrack);
+-  MOZ_ASSERT(trackData.mNextGetSampleIndex.isSome());
+   const TrackBuffersManager::TrackBuffer& track = GetTrackBuffer(aTrack);
+ 
+   uint32_t i = trackData.mNextGetSampleIndex.ref();
+@@ -2662,6 +2657,45 @@ TrackBuffersManager::GetNextRandomAccessPoint(TrackInfo::TrackType aTrack,
+   return TimeUnit::FromInfinity();
+ }
+ 
++nsresult
++TrackBuffersManager::SetNextGetSampleIndexIfNeeded(TrackInfo::TrackType aTrack,
++                                                   const TimeUnit& aFuzz)
++{
++  auto& trackData = GetTracksData(aTrack);
++  const TrackBuffer& track = GetTrackBuffer(aTrack);
++
++  if (trackData.mNextGetSampleIndex.isSome()) {
++    // We already know the next GetSample index.
++    return NS_OK;
++  }
++
++  if (!track.Length()) {
++    // There's nothing to find yet.
++    return NS_ERROR_DOM_MEDIA_END_OF_STREAM;
++  }
++
++  if (trackData.mNextSampleTimecode == TimeUnit()) {
++    // First demux, get first sample.
++    trackData.mNextGetSampleIndex = Some(0u);
++    return NS_OK;
++  }
++
++  if (trackData.mNextSampleTimecode >
++      track.LastElement()->mTimecode + track.LastElement()->mDuration) {
++    // The next element is past our last sample. We're done.
++    trackData.mNextGetSampleIndex = Some(uint32_t(track.Length()));
++    return NS_ERROR_DOM_MEDIA_END_OF_STREAM;
++  }
++
++  int32_t pos = FindCurrentPosition(aTrack, aFuzz);
++  if (pos < 0) {
++    // Not found, must wait for more data.
++    return NS_ERROR_DOM_MEDIA_WAITING_FOR_DATA;
++  }
++  trackData.mNextGetSampleIndex = Some(uint32_t(pos));
++  return NS_OK;
++}
++
+ void
+ TrackBuffersManager::TrackData::AddSizeOfResources(MediaSourceDecoder::ResourceSizes* aSizes) const
+ {
+diff --git dom/media/mediasource/TrackBuffersManager.h dom/media/mediasource/TrackBuffersManager.h
+index 9c7d191fc55cf..f8a47b2eeca58 100644
+--- dom/media/mediasource/TrackBuffersManager.h
++++ dom/media/mediasource/TrackBuffersManager.h
+@@ -160,6 +160,15 @@ public:
+                                            MediaResult& aResult);
+   int32_t FindCurrentPosition(TrackInfo::TrackType aTrack,
+                               const media::TimeUnit& aFuzz) const;
++
++  // Will set the next GetSample index if needed. This information is determined
++  // through the value of mNextSampleTimecode. Return false if the index
++  // couldn't be determined or if there's nothing more that could be demuxed.
++  // This occurs if either the track buffer doesn't contain the required
++  // timecode or is empty.
++  nsresult SetNextGetSampleIndexIfNeeded(TrackInfo::TrackType aTrack,
++                                         const media::TimeUnit& aFuzz);
++
+   media::TimeUnit GetNextRandomAccessPoint(TrackInfo::TrackType aTrack,
+                                            const media::TimeUnit& aFuzz);
+ 
diff --git a/www/waterfox/files/patch-bug1466863 b/www/waterfox/files/patch-bug1466863
new file mode 100644
index 000000000000..96eba510c515
--- /dev/null
+++ b/www/waterfox/files/patch-bug1466863
@@ -0,0 +1,36 @@
+commit 99e541f257fd
+Author: Michael Kaply <mozilla@kaply.com>
+Date:   Wed Jun 6 15:58:24 2018 -0500
+
+    Bug 1466863 - Just use empty metadata if invalid. r=florian, a=RyanVM
+    
+    MozReview-Commit-ID: 30Q5Sdi5ZRt
+    
+    --HG--
+    extra : source : 5404016c6d164a29c8dccdce58363d5b893af565
+---
+ toolkit/components/search/nsSearchService.js | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git toolkit/components/search/nsSearchService.js toolkit/components/search/nsSearchService.js
+index 86a286819f02b..6af0f3e64f39a 100644
+--- toolkit/components/search/nsSearchService.js
++++ toolkit/components/search/nsSearchService.js
+@@ -2074,7 +2074,7 @@ Engine.prototype = {
+   },
+ 
+   getAttr(name) {
+-    return (this._metaData && this._metaData[name]) || undefined;
++    return this._metaData[name] || undefined;
+   },
+ 
+   // nsISearchEngine
+@@ -3191,7 +3191,7 @@ SearchService.prototype = {
+       let name = engine._name;
+       if (name in this._engines) {
+         LOG("_loadEnginesMetadataFromCache, transfering metadata for " + name);
+-        this._engines[name]._metaData = engine._metaData;
++        this._engines[name]._metaData = engine._metaData || {};
+       }
+     }
+   },
diff --git a/www/waterfox/files/patch-z-bug1461619 b/www/waterfox/files/patch-z-bug1461619
new file mode 100644
index 000000000000..cc7c7748ec98
--- /dev/null
+++ b/www/waterfox/files/patch-z-bug1461619
@@ -0,0 +1,151 @@
+commit 9a87f28720d2
+Author: Jon Coppeard <jcoppeard@mozilla.com>
+Date:   Mon Jun 4 11:18:27 2018 +0100
+
+    Bug 1461619 - Don't update atoms marking bitmaps in parallel due to potential races. r=sfink, a=RyanVM
+---
+ js/src/gc/AtomMarking.cpp | 20 +++++++++++---------
+ js/src/gc/AtomMarking.h   |  6 +++---
+ js/src/gc/GC.cpp          | 26 ++++++++++++++------------
+ 3 files changed, 28 insertions(+), 24 deletions(-)
+
+diff --git js/src/gc/AtomMarking.cpp js/src/gc/AtomMarking.cpp
+index 64348293f0eac..fbe005a43a46a 100644
+--- js/src/gc/AtomMarking.cpp
++++ js/src/gc/AtomMarking.cpp
+@@ -28,12 +28,12 @@ namespace gc {
+ // is done by manipulating the mark bitmaps in the chunks used for the atoms.
+ // When the atoms zone is being collected, the mark bitmaps for the chunk(s)
+ // used by the atoms are updated normally during marking. After marking
+-// finishes, the chunk mark bitmaps are translated to a more efficient atom
+-// mark bitmap (see below) that is stored on the zones which the GC collected
++// finishes, the chunk mark bitmaps are translated to a more efficient atom mark
++// bitmap (see below) that is stored on the zones which the GC collected
+ // (computeBitmapFromChunkMarkBits). Before sweeping begins, the chunk mark
+ // bitmaps are updated with any atoms that might be referenced by zones which
+-// weren't collected (updateChunkMarkBits). The GC sweeping will then release
+-// all atoms which are not marked by any zone.
++// weren't collected (markAtomsUsedByUncollectedZones). The GC sweeping will
++// then release all atoms which are not marked by any zone.
+ //
+ // The representation of atom mark bitmaps is as follows:
+ //
+@@ -95,8 +95,10 @@ AtomMarkingRuntime::computeBitmapFromChunkMarkBits(JSRuntime* runtime, DenseBitm
+ }
+ 
+ void
+-AtomMarkingRuntime::updateZoneBitmap(Zone* zone, const DenseBitmap& bitmap)
++AtomMarkingRuntime::refineZoneBitmapForCollectedZone(Zone* zone, const DenseBitmap& bitmap)
+ {
++    MOZ_ASSERT(zone->isCollectingFromAnyThread());
++
+     if (zone->isAtomsZone())
+         return;
+ 
+@@ -109,7 +111,7 @@ AtomMarkingRuntime::updateZoneBitmap(Zone* zone, const DenseBitmap& bitmap)
+ // Set any bits in the chunk mark bitmaps for atoms which are marked in bitmap.
+ template <typename Bitmap>
+ static void
+-AddBitmapToChunkMarkBits(JSRuntime* runtime, Bitmap& bitmap)
++BitwiseOrIntoChunkMarkBits(JSRuntime* runtime, Bitmap& bitmap)
+ {
+     // Make sure that by copying the mark bits for one arena in word sizes we
+     // do not affect the mark bits for other arenas.
+@@ -127,7 +129,7 @@ AddBitmapToChunkMarkBits(JSRuntime* runtime, Bitmap& bitmap)
+ }
+ 
+ void
+-AtomMarkingRuntime::updateChunkMarkBits(JSRuntime* runtime)
++AtomMarkingRuntime::markAtomsUsedByUncollectedZones(JSRuntime* runtime)
+ {
+     MOZ_ASSERT(runtime->currentThreadHasExclusiveAccess());
+ 
+@@ -143,11 +145,11 @@ AtomMarkingRuntime::updateChunkMarkBits(JSRuntime* runtime)
+             if (!zone->isCollectingFromAnyThread())
+                 zone->markedAtoms().bitwiseOrInto(markedUnion);
+         }
+-        AddBitmapToChunkMarkBits(runtime, markedUnion);
++        BitwiseOrIntoChunkMarkBits(runtime, markedUnion);
+     } else {
+         for (ZonesIter zone(runtime, SkipAtoms); !zone.done(); zone.next()) {
+             if (!zone->isCollectingFromAnyThread())
+-                AddBitmapToChunkMarkBits(runtime, zone->markedAtoms());
++                BitwiseOrIntoChunkMarkBits(runtime, zone->markedAtoms());
+         }
+     }
+ }
+diff --git js/src/gc/AtomMarking.h js/src/gc/AtomMarking.h
+index 78aa612f79c9a..3a2c22c1d4d7e 100644
+--- js/src/gc/AtomMarking.h
++++ js/src/gc/AtomMarking.h
+@@ -52,11 +52,11 @@ class AtomMarkingRuntime
+ 
+     // Update the atom marking bitmap in |zone| according to another
+     // overapproximation of the reachable atoms in |bitmap|.
+-    void updateZoneBitmap(Zone* zone, const DenseBitmap& bitmap);
++    void refineZoneBitmapForCollectedZone(Zone* zone, const DenseBitmap& bitmap);
+ 
+     // Set any bits in the chunk mark bitmaps for atoms which are marked in any
+-    // zone in the runtime.
+-    void updateChunkMarkBits(JSRuntime* runtime);
++    // uncollected zone in the runtime.
++    void markAtomsUsedByUncollectedZones(JSRuntime* runtime);
+ 
+     // Mark an atom or id as being newly reachable by the context's zone.
+     template <typename T> void markAtom(JSContext* cx, T* thing);
+diff --git js/src/jsgc.cpp js/src/jsgc.cpp
+index b5bbac865cfdf..f0d9d3e95e8a3 100644
+--- js/src/jsgc.cpp
++++ js/src/jsgc.cpp
+@@ -4989,21 +4989,19 @@ class ImmediateSweepWeakCacheTask : public GCParallelTaskHelper<ImmediateSweepWe
+ };
+ 
+ static void
+-UpdateAtomsBitmap(GCParallelTask* task)
++UpdateAtomsBitmap(JSRuntime* runtime)
+ {
+-    JSRuntime* runtime = task->runtime();
+-
+     DenseBitmap marked;
+     if (runtime->gc.atomMarking.computeBitmapFromChunkMarkBits(runtime, marked)) {
+         for (GCZonesIter zone(runtime); !zone.done(); zone.next())
+-            runtime->gc.atomMarking.updateZoneBitmap(zone, marked);
++            runtime->gc.atomMarking.refineZoneBitmapForCollectedZone(zone, marked);
+     } else {
+-        // Ignore OOM in computeBitmapFromChunkMarkBits. The updateZoneBitmap
+-        // call can only remove atoms from the zone bitmap, so it is
+-        // conservative to just not call it.
++        // Ignore OOM in computeBitmapFromChunkMarkBits. The
++        // refineZoneBitmapForCollectedZone call can only remove atoms from the
++        // zone bitmap, so it is conservative to just not call it.
+     }
+ 
+-    runtime->gc.atomMarking.updateChunkMarkBits(runtime);
++    runtime->gc.atomMarking.markAtomsUsedByUncollectedZones(runtime);
+ 
+     // For convenience sweep these tables non-incrementally as part of bitmap
+     // sweeping; they are likely to be much smaller than the main atoms table.
+@@ -5305,15 +5303,19 @@ GCRuntime::beginSweepingSweepGroup()
+         callFinalizeCallbacks(&fop, JSFINALIZE_GROUP_START);
+     }
+ 
++    // Updating the atom marking bitmaps. This marks atoms referenced by
++    // uncollected zones so cannot be done in parallel with the other sweeping
++    // work below.
++    if (sweepingAtoms) {
++        AutoPhase ap(stats(), PhaseKind::UPDATE_ATOMS_BITMAP);
++        UpdateAtomsBitmap(rt);
++    }
++
+     sweepDebuggerOnMainThread(&fop);
+ 
+     {
+         AutoLockHelperThreadState lock;
+ 
+-        Maybe<AutoRunParallelTask> updateAtomsBitmap;
+-        if (sweepingAtoms)
+-            updateAtomsBitmap.emplace(rt, UpdateAtomsBitmap, PhaseKind::UPDATE_ATOMS_BITMAP, lock);
+-
+         AutoPhase ap(stats(), PhaseKind::SWEEP_COMPARTMENTS);
+ 
+         AutoRunParallelTask sweepCCWrappers(rt, SweepCCWrappers, PhaseKind::SWEEP_CC_WRAPPER, lock);