6 files changed, 833 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index 7a9af6942af8..e7adc6a1ff3c 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	waterfox
 DISTVERSION=	56.1.0
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1424311 b/www/waterfox/files/patch-bug1424311
new file mode 100644
index 000000000000..8db2056c22af
--- /dev/null
+++ b/www/waterfox/files/patch-bug1424311
@@ -0,0 +1,66 @@
+commit af4e28ddf70d
+Author: David Keeler <dkeeler@mozilla.com>
+Date:   Wed Mar 28 13:43:03 2018 -0700
+
+    Bug 1424311 - Don't persist the certificate exception dialog's size so it doesn't grow unboundedly. r=jcj, a=RyanVM
+    
+    window.sizeToContent() apparently interacts poorly with windows that have a
+    persisted size (see bug 90276, which is a 5-digit bug that hasn't been touched
+    in over a decade). As a workaround, don't persist the certificate exception
+    dialog's size. This means we have to call window.sizeToContent() more often and
+    unfortunately results in the window growing and shrinking again on Windows, but
+    at least it will always be the "right size" for its content.
+    
+    MozReview-Commit-ID: 9UT3X8IEqZg
+    
+    --HG--
+    extra : source : 02213fd3a9c84544936a6901adb8821e0c0f44b9
+---
+ security/manager/pki/resources/content/exceptionDialog.js  | 3 ++-
+ security/manager/pki/resources/content/exceptionDialog.xul | 2 --
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git security/manager/pki/resources/content/exceptionDialog.js security/manager/pki/resources/content/exceptionDialog.js
+index bf17af169c54..72c7d455e958 100644
+--- security/manager/pki/resources/content/exceptionDialog.js
++++ security/manager/pki/resources/content/exceptionDialog.js
+@@ -59,6 +59,7 @@ function initExceptionDialog() {
+     // Set out parameter to false by default
+     args[0].exceptionAdded = false;
+   }
++  window.sizeToContent();
+ }
+ 
+ /**
+@@ -150,6 +151,7 @@ function resetDialog() {
+   setText("status2LongDescription", "");
+   setText("status3Description", "");
+   setText("status3LongDescription", "");
++  window.sizeToContent();
+ }
+ 
+ /**
+@@ -275,7 +277,6 @@ function updateCertStatus() {
+   }
+ 
+   window.sizeToContent();
+-
+   gNeedReset = true;
+ }
+ 
+diff --git security/manager/pki/resources/content/exceptionDialog.xul security/manager/pki/resources/content/exceptionDialog.xul
+index 6d417f360ccd..b7d85e2930c4 100644
+--- security/manager/pki/resources/content/exceptionDialog.xul
++++ security/manager/pki/resources/content/exceptionDialog.xul
+@@ -14,11 +14,9 @@
+         buttons="cancel,extra1,extra2"
+         buttonlabelextra1="&exceptionMgr.exceptionButton.label;"
+         buttonaccesskeyextra1="&exceptionMgr.exceptionButton.accesskey;"
+-        style="width: 46em; min-height: 38em;"
+         onload="initExceptionDialog();"
+         ondialogextra1="addException();"
+         ondialogextra2="checkCert();"
+-        persist="screenX screenY width height"
+         defaultButton="extra2">
+ 
+   <stringbundleset id="stringbundleset">
diff --git a/www/waterfox/files/patch-bug1448612 b/www/waterfox/files/patch-bug1448612
new file mode 100644
index 000000000000..61ab540b96f1
--- /dev/null
+++ b/www/waterfox/files/patch-bug1448612
@@ -0,0 +1,72 @@
+commit 2ff478b5f969
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Thu Mar 29 10:02:00 2018 -0400
+
+    Bug 1448612 - Don't take ownership of the stream data too early. r=baku, a=RyanVM
+    
+    MozReview-Commit-ID: 8e8PNR9NvwW
+---
+ dom/fetch/FetchConsumer.cpp | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git dom/fetch/FetchConsumer.cpp dom/fetch/FetchConsumer.cpp
+index cde565705188..a374d1fed8c2 100644
+--- dom/fetch/FetchConsumer.cpp
++++ dom/fetch/FetchConsumer.cpp
+@@ -109,13 +109,11 @@ class ContinueConsumeBodyControlRunnable final : public MainThreadWorkerControlR
+   RefPtr<FetchBodyConsumer<Derived>> mFetchBodyConsumer;
+ 
+ public:
+-  ContinueConsumeBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer,
+-                                     uint8_t* aResult)
++  ContinueConsumeBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer)
+     : MainThreadWorkerControlRunnable(aFetchBodyConsumer->GetWorkerPrivate())
+     , mFetchBodyConsumer(aFetchBodyConsumer)
+   {
+     MOZ_ASSERT(NS_IsMainThread());
+-    free(aResult);
+   }
+ 
+   bool
+@@ -289,14 +287,12 @@ public:
+     // shutting down procedure.
+ 
+     RefPtr<ContinueConsumeBodyControlRunnable<Derived>> r =
+-      new ContinueConsumeBodyControlRunnable<Derived>(mFetchBodyConsumer,
+-                                                      nonconstResult);
++      new ContinueConsumeBodyControlRunnable<Derived>(mFetchBodyConsumer);
+     if (NS_WARN_IF(!r->Dispatch())) {
+       return NS_ERROR_FAILURE;
+     }
+ 
+-    // FetchBody is responsible for data.
+-    return NS_SUCCESS_ADOPTED_DATA;
++    return NS_OK;
+   }
+ 
+   virtual void BlobStoreCompleted(MutableBlobStorage* aBlobStorage,
+commit 84a72343d0ba
+Author: Ryan VanderMeulen <ryanvm@gmail.com>
+Date:   Thu Mar 29 10:46:07 2018 -0400
+
+    Bug 1448612 - Mark ContinueConsumeBodyControlRunnable as explicit to make the static analysis happy. r=emilio, a=bustage
+    
+    --HG--
+    extra : rebase_source : d11e91ec335292d9448df17a5c05c98f6837884c
+---
+ dom/fetch/FetchConsumer.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git dom/fetch/FetchConsumer.cpp dom/fetch/FetchConsumer.cpp
+index a374d1fed8c2..2771a23843e3 100644
+--- dom/fetch/FetchConsumer.cpp
++++ dom/fetch/FetchConsumer.cpp
+@@ -109,7 +109,7 @@ class ContinueConsumeBodyControlRunnable final : public MainThreadWorkerControlR
+   RefPtr<FetchBodyConsumer<Derived>> mFetchBodyConsumer;
+ 
+ public:
+-  ContinueConsumeBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer)
++  explicit ContinueConsumeBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer)
+     : MainThreadWorkerControlRunnable(aFetchBodyConsumer->GetWorkerPrivate())
+     , mFetchBodyConsumer(aFetchBodyConsumer)
+   {
diff --git a/www/waterfox/files/patch-bug1448771 b/www/waterfox/files/patch-bug1448771
new file mode 100644
index 000000000000..5da37bbc1a33
--- /dev/null
+++ b/www/waterfox/files/patch-bug1448771
@@ -0,0 +1,173 @@
+commit ece500858fb2
+Author: Jonathan Kew <jkew@mozilla.com>
+Date:   Wed Mar 28 10:17:51 2018 +0100
+
+    Bug 1448771 - Update hnjstdio to handle additional functions from stdio.h that libhyphen wants to use. r=glandium, a=RyanVM
+    
+    --HG--
+    extra : source : 846bcaa210aa2264bec412c0595113964fafc972
+---
+ intl/hyphenation/glue/hnjalloc.h   |  6 +++++
+ intl/hyphenation/glue/hnjstdio.cpp | 50 ++++++++++++++++++++++++++------------
+ 2 files changed, 41 insertions(+), 15 deletions(-)
+
+diff --git intl/hyphenation/glue/hnjalloc.h intl/hyphenation/glue/hnjalloc.h
+index fec3a4bc9009..5cee1be1b6d7 100644
+--- intl/hyphenation/glue/hnjalloc.h
++++ intl/hyphenation/glue/hnjalloc.h
+@@ -31,6 +31,8 @@
+ #define fopen(path,mode)      hnjFopen(path,mode)
+ #define fclose(file)          hnjFclose(file)
+ #define fgets(buf,count,file) hnjFgets(buf,count,file)
++#define feof(file)            hnjFeof(file)
++#define fgetc(file)           hnjFgetc(file)
+ 
+ typedef struct hnjFile_ hnjFile;
+ 
+@@ -44,6 +46,10 @@ int hnjFclose(hnjFile* f);
+ 
+ char* hnjFgets(char* s, int n, hnjFile* f);
+ 
++int hnjFeof(hnjFile* f);
++
++int hnjFgetc(hnjFile* f);
++
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git intl/hyphenation/glue/hnjstdio.cpp intl/hyphenation/glue/hnjstdio.cpp
+index 660ebaf13291..8d50ae17f57b 100644
+--- intl/hyphenation/glue/hnjstdio.cpp
++++ intl/hyphenation/glue/hnjstdio.cpp
+@@ -22,6 +22,7 @@ struct hnjFile_ {
+     char                     mBuffer[BUFSIZE];
+     uint32_t                 mCurPos;
+     uint32_t                 mLimit;
++    bool                     mEOF;
+ };
+ 
+ // replacement for fopen()
+@@ -58,6 +59,7 @@ hnjFopen(const char* aURISpec, const char* aMode)
+     f->mStream = instream;
+     f->mCurPos = 0;
+     f->mLimit = 0;
++    f->mEOF = false;
+ 
+     return f;
+ }
+@@ -79,6 +81,27 @@ hnjFclose(hnjFile* f)
+     return result;
+ }
+ 
++// replacement for fgetc()
++int
++hnjFgetc(hnjFile* f)
++{
++    if (f->mCurPos >= f->mLimit) {
++        f->mCurPos = 0;
++
++        nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit);
++        if (NS_FAILED(rv)) {
++            f->mLimit = 0;
++        }
++
++        if (f->mLimit == 0) {
++            f->mEOF = true;
++            return EOF;
++        }
++    }
++
++    return f->mBuffer[f->mCurPos++];
++}
++
+ // replacement for fgets()
+ // (not a full reimplementation, but sufficient for libhyphen's needs)
+ char*
+@@ -88,24 +111,15 @@ hnjFgets(char* s, int n, hnjFile* f)
+ 
+     int i = 0;
+     while (i < n - 1) {
+-        if (f->mCurPos < f->mLimit) {
+-            char c = f->mBuffer[f->mCurPos++];
+-            s[i++] = c;
+-            if (c == '\n' || c == '\r') {
+-                break;
+-            }
+-            continue;
+-        }
+-
+-        f->mCurPos = 0;
++        int c = hnjFgetc(f);
+ 
+-        nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit);
+-        if (NS_FAILED(rv)) {
+-            f->mLimit = 0;
+-            return nullptr;
++        if (c == EOF) {
++            break;
+         }
+ 
+-        if (f->mLimit == 0) {
++        s[i++] = c;
++
++        if (c == '\n' || c == '\r') {
+             break;
+         }
+     }
+@@ -117,3 +131,9 @@ hnjFgets(char* s, int n, hnjFile* f)
+     s[i] = '\0'; // null-terminate the returned string
+     return s;
+ }
++
++int
++hnjFeof(hnjFile* f)
++{
++    return f->mEOF ? EOF : 0;
++}
+
+commit 5174306ad60c
+Author: Jonathan Kew <jkew@mozilla.com>
+Date:   Mon Mar 26 20:35:48 2018 +0100
+
+    Bug 1448771 - Merge fix from upstream. r=ryanvm, a=RyanVM
+    
+    --HG--
+    extra : source : f5db47b5c6416a3cef546de1aa9089d98109f95f
+---
+ intl/hyphenation/hyphen/hyphen.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git intl/hyphenation/hyphen/hyphen.c intl/hyphenation/hyphen/hyphen.c
+index 9a132d0262f2..9f2b7112c848 100644
+--- intl/hyphenation/hyphen/hyphen.c
++++ intl/hyphenation/hyphen/hyphen.c
+@@ -438,11 +438,25 @@ for (k = 0; k < 2; k++) {
+   }
+ 
+   if (k == 0 || nextlevel) {
+-    while (fgets (buf, sizeof(buf), f) != NULL) {
++    while (fgets(buf, sizeof(buf), f) != NULL) {
++      
++      /* discard lines that don't fit in buffer */
++      if (!feof(f) && strchr(buf, '\n') == NULL) {
++        int c;
++        while ((c = fgetc(f)) != '\n' && c != EOF);
++        /* issue warning if not a comment */
++        if (buf[0] != '%') {
++          fprintf(stderr, "Warning: skipping too long pattern (more than %lu chars)\n", sizeof(buf));
++        }
++        continue;
++      }
++      
+       if (strncmp(buf, "NEXTLEVEL", 9) == 0) {
+-	nextlevel = 1;
+-	break;
+-      } else if (buf[0] != '%') hnj_hyphen_load_line(buf, dict[k], hashtab);
++        nextlevel = 1;
++        break;
++      } else if (buf[0] != '%') {
++        hnj_hyphen_load_line(buf, dict[k], hashtab);
++      }
+     }
+   } else if (k == 1) {
+     /* default first level: hyphen and ASCII apostrophe */
diff --git a/www/waterfox/files/patch-bug1448774 b/www/waterfox/files/patch-bug1448774
new file mode 100644
index 000000000000..8627702a8f10
--- /dev/null
+++ b/www/waterfox/files/patch-bug1448774
@@ -0,0 +1,40 @@
+commit 8ae6890efea4
+Author: Robert Longson <longsonr@gmail.com>
+Date:   Thu Mar 29 03:12:05 2018 +0100
+
+    Bug 1448774. r=dholbert, a=RyanVM
+    
+    --HG--
+    extra : source : edfd9ffbd7208ef0a59f40a0d77d8dd53c905cb9
+---
+ dom/svg/SVGTextContentElement.h | 1 +
+ layout/svg/SVGTextFrame.cpp     | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git dom/svg/SVGTextContentElement.h dom/svg/SVGTextContentElement.h
+index 712d9492b5a0..9eb464ab159a 100644
+--- dom/svg/SVGTextContentElement.h
++++ dom/svg/SVGTextContentElement.h
+@@ -25,6 +25,7 @@ typedef SVGGraphicsElement SVGTextContentElementBase;
+ 
+ class SVGTextContentElement : public SVGTextContentElementBase
+ {
++  friend class ::SVGTextFrame;
+ public:
+   using FragmentOrElement::TextLength;
+ 
+diff --git layout/svg/SVGTextFrame.cpp layout/svg/SVGTextFrame.cpp
+index 9c44ce595654..2be5970075dd 100644
+--- layout/svg/SVGTextFrame.cpp
++++ layout/svg/SVGTextFrame.cpp
+@@ -5290,8 +5290,8 @@ SVGTextFrame::DoGlyphPositioning()
+     float actualTextLength =
+       static_cast<float>(presContext->AppUnitsToGfxUnits(frameLength) * factor);
+ 
+-    RefPtr<SVGAnimatedEnumeration> lengthAdjustEnum = element->LengthAdjust();
+-    uint16_t lengthAdjust = lengthAdjustEnum->AnimVal();
++    uint16_t lengthAdjust =
++      element->EnumAttributes()[SVGTextContentElement::LENGTHADJUST].GetAnimValue();
+     switch (lengthAdjust) {
+       case LENGTHADJUST_SPACINGANDGLYPHS:
+         // Scale the glyphs and their positions.
diff --git a/www/waterfox/files/patch-bug712130 b/www/waterfox/files/patch-bug712130
new file mode 100644
index 000000000000..aaa845735f45
--- /dev/null
+++ b/www/waterfox/files/patch-bug712130
@@ -0,0 +1,481 @@
+commit a5892fdff0c9
+Author: decltype <mozilla@decltype.org>
+Date:   Wed Jan 10 00:40:13 2018 +0100
+
+    Bug 712130 - Add reftest to ensure the first autofocus elements gets picked. r=bz
+    
+    MozReview-Commit-ID: 6UAUbqwVhTm
+    
+    --HG--
+    extra : rebase_source : 7ade8a42489bbf0be97894c18a38bd765a1da891
+---
+ layout/reftests/bugs/712130-1-ref.html | 5 +++++
+ layout/reftests/bugs/712130-1.html     | 5 +++++
+ layout/reftests/bugs/reftest.list      | 1 +
+ 3 files changed, 11 insertions(+)
+
+diff --git layout/reftests/bugs/712130-1-ref.html layout/reftests/bugs/712130-1-ref.html
+new file mode 100644
+index 000000000000..6d07ca048250
+--- /dev/null
++++ layout/reftests/bugs/712130-1-ref.html
+@@ -0,0 +1,5 @@
++<!DOCTYPE html>
++<html class="reftest-wait">
++<link rel="stylesheet" href="nothing"><!-- Empty stylesheet to delay PresShell init -->
++<input type="text" autofocus="" onfocus="document.documentElement.removeAttribute('class')">
++<input type="text">
+diff --git layout/reftests/bugs/712130-1.html layout/reftests/bugs/712130-1.html
+new file mode 100644
+index 000000000000..ffbc82309366
+--- /dev/null
++++ layout/reftests/bugs/712130-1.html
+@@ -0,0 +1,5 @@
++<!DOCTYPE html>
++<html class="reftest-wait">
++<link rel="stylesheet" href="nothing"><!-- Empty stylesheet to delay PresShell init -->
++<input type="text" autofocus="" onfocus="document.documentElement.removeAttribute('class')">
++<input type="text" autofocus="" onfocus="document.documentElement.removeAttribute('class')">
+diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
+index 764d3dbd5b3c..79e5df14fcff 100644
+--- layout/reftests/bugs/reftest.list
++++ layout/reftests/bugs/reftest.list
+@@ -1707,6 +1707,7 @@ needs-focus == 703186-1.html 703186-1-ref.html
+ needs-focus == 703186-2.html 703186-2-ref.html
+ needs-focus != 703186-1.html 703186-2.html
+ == 711359-1.html 711359-1-ref.html
++fuzzy-if(skiaContent,1,3) needs-focus == 712130-1.html 712130-1-ref.html
+ == 712849-1.html 712849-1-ref.html
+ == 713856-static.html  713856-ref.html
+ == 713856-dynamic.html 713856-ref.html
+
+commit 5269d4159ca0
+Author: decltype <mozilla@decltype.org>
+Date:   Wed Jan 10 19:07:21 2018 +0100
+
+    Bug 712130 - Add reftest in case autofocus element is seen after PresShell init. r=bz
+    
+    MozReview-Commit-ID: 75IKOqiqBhL
+    
+    --HG--
+    extra : rebase_source : ec679c6f6b6c48aa88dd6c5fa6b6970e6cfa1314
+---
+ layout/reftests/bugs/712130-2-ref.html | 3 +++
+ layout/reftests/bugs/712130-2.html     | 4 ++++
+ layout/reftests/bugs/reftest.list      | 1 +
+ 3 files changed, 8 insertions(+)
+
+diff --git layout/reftests/bugs/712130-2-ref.html layout/reftests/bugs/712130-2-ref.html
+new file mode 100644
+index 000000000000..919ac05704ae
+--- /dev/null
++++ layout/reftests/bugs/712130-2-ref.html
+@@ -0,0 +1,3 @@
++<!DOCTYPE html>
++<html class="reftest-wait">
++<input type="text" autofocus="" onfocus="document.documentElement.removeAttribute('class')">
+diff --git layout/reftests/bugs/712130-2.html layout/reftests/bugs/712130-2.html
+new file mode 100644
+index 000000000000..232bef484917
+--- /dev/null
++++ layout/reftests/bugs/712130-2.html
+@@ -0,0 +1,4 @@
++<!DOCTYPE html>
++<html class="reftest-wait">
++<link rel="stylesheet" href="nothing"><!-- Empty stylesheet to delay PresShell init -->
++<input type="text" autofocus="" onfocus="document.documentElement.removeAttribute('class')">
+diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
+index 79e5df14fcff..7978c54a5ea2 100644
+--- layout/reftests/bugs/reftest.list
++++ layout/reftests/bugs/reftest.list
+@@ -1708,6 +1708,7 @@ needs-focus == 703186-2.html 703186-2-ref.html
+ needs-focus != 703186-1.html 703186-2.html
+ == 711359-1.html 711359-1-ref.html
+ fuzzy-if(skiaContent,1,3) needs-focus == 712130-1.html 712130-1-ref.html
++fuzzy-if(skiaContent,1,3) needs-focus == 712130-2.html 712130-2-ref.html
+ == 712849-1.html 712849-1-ref.html
+ == 713856-static.html  713856-ref.html
+ == 713856-dynamic.html 713856-ref.html
+
+commit dd080e9ebacf
+Author: decltype <mozilla@decltype.org>
+Date:   Mon Jan 8 22:35:00 2018 +0100
+
+    Bug 712130 - Defer autofocus until after frame construction. r=bz
+    
+    The autofocus attribute on form elements forces layout in CheckIfFocusable.
+    To avoid unpleasant FOUCs, defer autofocus processing until frames are
+    constructed in PresShell::Initialize.
+    
+    Resolve the race between nsAutoFocusEvent running and page load by checking the
+    readystate at time of event posting. Skip autofocus if the element moved to a
+    different window in the meantime.
+    
+    MozReview-Commit-ID: 90jiJYJWmRg
+    
+    --HG--
+    extra : rebase_source : f94b479075df3e37ec1a658d71596c03930bab92
+---
+ dom/base/nsDocument.cpp           | 128 ++++++++++++++++++++++++++++++++++++++
+ dom/base/nsDocument.h             |   6 ++
+ dom/base/nsFocusManager.cpp       |   2 +-
+ dom/base/nsIDocument.h            |   3 +
+ dom/html/nsGenericHTMLElement.cpp |  64 +------------------
+ layout/base/PresShell.cpp         |   2 +
+ 6 files changed, 142 insertions(+), 63 deletions(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 4ecc537eb54e..3ed0e93222ec 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -1500,6 +1500,7 @@ nsDocument::nsDocument(const char* aContentType)
+ #ifdef DEBUG
+   , mWillReparent(false)
+ #endif
++  , mAutoFocusFired(false)
+ {
+   SetContentTypeInternal(nsDependentCString(aContentType));
+ 
+@@ -9444,6 +9445,133 @@ nsDocument::GetTemplateContentsOwner()
+   return mTemplateContentsOwner;
+ }
+ 
++static already_AddRefed<nsPIDOMWindowOuter>
++FindTopWindowForElement(Element* element)
++{
++  nsIDocument* document = element->OwnerDoc();
++  if (!document) {
++    return nullptr;
++  }
++
++  nsCOMPtr<nsPIDOMWindowOuter> window = document->GetWindow();
++  if (!window) {
++    return nullptr;
++  }
++
++  // Trying to find the top window (equivalent to window.top).
++  if (nsCOMPtr<nsPIDOMWindowOuter> top = window->GetTop()) {
++    window = top.forget();
++  }
++  return window.forget();
++}
++
++/**
++ * nsAutoFocusEvent is used to dispatch a focus event for an
++ * nsGenericHTMLFormElement with the autofocus attribute enabled.
++ */
++class nsAutoFocusEvent : public Runnable
++{
++public:
++  explicit nsAutoFocusEvent(already_AddRefed<Element>&& aElement,
++                            already_AddRefed<nsPIDOMWindowOuter>&& aTopWindow)
++    : mozilla::Runnable("nsAutoFocusEvent")
++    , mElement(aElement)
++    , mTopWindow(aTopWindow)
++  {
++  }
++
++  NS_IMETHOD Run() override
++  {
++    nsCOMPtr<nsPIDOMWindowOuter> currentTopWindow =
++      FindTopWindowForElement(mElement);
++    if (currentTopWindow != mTopWindow) {
++      // The element's top window changed from when the event was queued.
++      // Don't take away focus from an unrelated window.
++      return NS_OK;
++    }
++
++    nsFocusManager* fm = nsFocusManager::GetFocusManager();
++    if (!fm) {
++      return NS_ERROR_NULL_POINTER;
++    }
++
++    nsIDocument* document = mElement->OwnerDoc();
++
++    // Don't steal focus from the user.
++    if (mTopWindow->GetFocusedNode()) {
++      return NS_OK;
++    }
++
++    // If something is focused in the same document, ignore autofocus.
++    if (!fm->GetFocusedContent() ||
++        fm->GetFocusedContent()->OwnerDoc() != document) {
++      mozilla::ErrorResult rv;
++      mElement->Focus(rv);
++      return rv.StealNSResult();
++    }
++
++    return NS_OK;
++  }
++private:
++  nsCOMPtr<Element> mElement;
++  nsCOMPtr<nsPIDOMWindowOuter> mTopWindow;
++};
++
++void
++nsDocument::SetAutoFocusElement(Element* aAutoFocusElement)
++{
++  if (mAutoFocusFired) {
++    // Too late.
++    return;
++  }
++
++  if (mAutoFocusElement) {
++    // The spec disallows multiple autofocus elements, so we consider only the
++    // first one to preserve the old behavior.
++    return;
++  }
++
++  mAutoFocusElement = do_GetWeakReference(aAutoFocusElement);
++  TriggerAutoFocus();
++}
++
++void
++nsDocument::TriggerAutoFocus()
++{
++  if (mAutoFocusFired) {
++    return;
++  }
++
++  if (!mPresShell || !mPresShell->DidInitialize()) {
++    // Delay autofocus until frames are constructed so that we don't thrash
++    // style and layout calculations.
++    return;
++  }
++
++  nsCOMPtr<Element> autoFocusElement = do_QueryReferent(mAutoFocusElement);
++  if (autoFocusElement && autoFocusElement->OwnerDoc() == this) {
++    mAutoFocusFired = true;
++
++    nsCOMPtr<nsPIDOMWindowOuter> topWindow =
++      FindTopWindowForElement(autoFocusElement);
++    if (!topWindow) {
++      return;
++    }
++
++    // NOTE: This may be removed in the future since the spec technically
++    // allows autofocus after load.
++    nsCOMPtr<nsIDocument> topDoc = topWindow->GetExtantDoc();
++    if (topDoc && topDoc->GetReadyStateEnum() == nsIDocument::READYSTATE_COMPLETE) {
++      return;
++    }
++
++    nsCOMPtr<nsIRunnable> event =
++      new nsAutoFocusEvent(autoFocusElement.forget(), topWindow.forget());
++    nsresult rv = NS_DispatchToCurrentThread(event.forget());
++    NS_ENSURE_SUCCESS_VOID(rv);
++  }
++}
++
+ void
+ nsDocument::SetScrollToRef(nsIURI *aDocumentURI)
+ {
+diff --git dom/base/nsDocument.h dom/base/nsDocument.h
+index a25c4b417861..d015aae0bc8f 100644
+--- dom/base/nsDocument.h
++++ dom/base/nsDocument.h
+@@ -804,6 +804,9 @@ public:
+   // Only BlockOnload should call this!
+   void AsyncBlockOnload();
+ 
++  virtual void SetAutoFocusElement(Element* aAutoFocusElement) override;
++  virtual void TriggerAutoFocus() override;
++
+   virtual void SetScrollToRef(nsIURI *aDocumentURI) override;
+   virtual void ScrollToRef() override;
+   virtual void ResetScrolledToRefAlready() override;
+@@ -1306,6 +1309,8 @@ private:
+ 
+   RefPtr<nsContentList> mImageMaps;
+ 
++  nsWeakPtr mAutoFocusElement;
++
+   nsCString mScrollToRef;
+   uint8_t mScrolledToRefAlready : 1;
+   uint8_t mChangeScrollPosWhenScrollingToRef : 1;
+@@ -1431,6 +1436,9 @@ private:
+ public:
+   bool mWillReparent;
+ #endif
++
++private:
++  bool mAutoFocusFired : 1;
+ };
+ 
+ class nsDocumentOnStack
+diff --git dom/base/nsFocusManager.cpp dom/base/nsFocusManager.cpp
+index dfec30f7da13..a8faa46fff3c 100644
+--- dom/base/nsFocusManager.cpp
++++ dom/base/nsFocusManager.cpp
+@@ -1603,7 +1603,7 @@ nsFocusManager::CheckIfFocusable(nsIContent* aContent, uint32_t aFlags)
+   }
+ 
+   // Make sure that our frames are up to date while ensuring the presshell is
+-  // also initialized in case we come from an autofocus event.
++  // also initialized in case we come from a script calling focus() early.
+   mEventHandlingNeedsFlush = false;
+   doc->FlushPendingNotifications(FlushType::EnsurePresShellInitAndFrames);
+ 
+diff --git dom/base/nsIDocument.h dom/base/nsIDocument.h
+index 53ef3746ffc7..98d5b0d2ed15 100644
+--- dom/base/nsIDocument.h
++++ dom/base/nsIDocument.h
+@@ -2637,6 +2637,9 @@ public:
+ 
+   virtual nsISupports* GetCurrentContentSink() = 0;
+ 
++  virtual void SetAutoFocusElement(Element* aAutoFocusElement) = 0;
++  virtual void TriggerAutoFocus() = 0;
++
+   virtual void SetScrollToRef(nsIURI *aDocumentURI) = 0;
+   virtual void ScrollToRef() = 0;
+   virtual void ResetScrolledToRefAlready() = 0;
+diff --git dom/html/nsGenericHTMLElement.cpp dom/html/nsGenericHTMLElement.cpp
+index 334c80ace636..775ec887ba2c 100644
+--- dom/html/nsGenericHTMLElement.cpp
++++ dom/html/nsGenericHTMLElement.cpp
+@@ -111,64 +111,6 @@
+ using namespace mozilla;
+ using namespace mozilla::dom;
+ 
+-/**
+- * nsAutoFocusEvent is used to dispatch a focus event when a
+- * nsGenericHTMLFormElement is binded to the tree with the autofocus attribute
+- * enabled.
+- */
+-class nsAutoFocusEvent : public Runnable
+-{
+-public:
+-  explicit nsAutoFocusEvent(nsGenericHTMLFormElement* aElement)
+-    : mozilla::Runnable("nsAutoFocusEvent")
+-    , mElement(aElement)
+-  {
+-  }
+-
+-  NS_IMETHOD Run() override {
+-    nsFocusManager* fm = nsFocusManager::GetFocusManager();
+-    if (!fm) {
+-      return NS_ERROR_NULL_POINTER;
+-    }
+-
+-    nsIDocument* document = mElement->OwnerDoc();
+-
+-    nsPIDOMWindowOuter* window = document->GetWindow();
+-    if (!window) {
+-      return NS_OK;
+-    }
+-
+-    // Trying to found the top window (equivalent to window.top).
+-    if (nsCOMPtr<nsPIDOMWindowOuter> top = window->GetTop()) {
+-      window = top;
+-    }
+-
+-    if (window->GetFocusedNode()) {
+-      return NS_OK;
+-    }
+-
+-    nsCOMPtr<nsIDocument> topDoc = window->GetExtantDoc();
+-    if (topDoc && topDoc->GetReadyStateEnum() == nsIDocument::READYSTATE_COMPLETE) {
+-      return NS_OK;
+-    }
+-
+-    // If something is focused in the same document, ignore autofocus.
+-    if (!fm->GetFocusedContent() ||
+-        fm->GetFocusedContent()->OwnerDoc() != document) {
+-      mozilla::ErrorResult rv;
+-      mElement->Focus(rv);
+-      return rv.StealNSResult();
+-    }
+-
+-    return NS_OK;
+-  }
+-private:
+-  // NOTE: nsGenericHTMLFormElement is saved as a nsGenericHTMLElement
+-  // because AddRef/Release are ambiguous with nsGenericHTMLFormElement
+-  // and Focus() is declared (and defined) in nsGenericHTMLElement class.
+-  RefPtr<nsGenericHTMLElement> mElement;
+-};
+-
+ NS_IMPL_ADDREF_INHERITED(nsGenericHTMLElement, nsGenericHTMLElementBase)
+ NS_IMPL_RELEASE_INHERITED(nsGenericHTMLElement, nsGenericHTMLElementBase)
+ 
+@@ -1882,10 +1824,8 @@ nsGenericHTMLFormElement::BindToTree(nsIDocument* aDocument,
+   // the document should not be already loaded and the "browser.autofocus"
+   // preference should be 'true'.
+   if (IsAutofocusable() && HasAttr(kNameSpaceID_None, nsGkAtoms::autofocus) &&
+-      nsContentUtils::AutoFocusEnabled()) {
+-    nsCOMPtr<nsIRunnable> event = new nsAutoFocusEvent(this);
+-    rv = NS_DispatchToCurrentThread(event);
+-    NS_ENSURE_SUCCESS(rv, rv);
++      nsContentUtils::AutoFocusEnabled() && aDocument) {
++    aDocument->SetAutoFocusElement(this);
+   }
+ 
+   // If @form is set, the element *has* to be in a document, otherwise it
+diff --git layout/base/PresShell.cpp layout/base/PresShell.cpp
+index 0c94f8516271..f851f9c7df2c 100644
+--- layout/base/PresShell.cpp
++++ layout/base/PresShell.cpp
+@@ -1817,6 +1817,8 @@ PresShell::Initialize(nscoord aWidth, nscoord aHeight)
+     NS_ENSURE_STATE(!mHaveShutDown);
+   }
+ 
++  mDocument->TriggerAutoFocus();
++
+   NS_ASSERTION(rootFrame, "How did that happen?");
+ 
+   // Note: when the frame was created above it had the NS_FRAME_IS_DIRTY bit
+
+commit 0c31aff36b45
+Author: decltype <mozilla@decltype.org>
+Date:   Fri Jan 12 00:17:58 2018 +0100
+
+    Bug 712130 - Simplify focus stealing prevention for autofocus. r=bz
+    
+    Remove redundant check already implied by earlier condition: If the focus
+    manager's focused content is in our document, all parent windows including the
+    root window must have their focused node set to non-null.
+    
+    MozReview-Commit-ID: CryGb6mfczK
+    
+    --HG--
+    extra : rebase_source : ed5c452f68b76a656512026b5d162d8782083c2c
+---
+ dom/base/nsDocument.cpp | 19 +++----------------
+ 1 file changed, 3 insertions(+), 16 deletions(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 3ed0e93222ec..18b81abe599a 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -9490,27 +9490,14 @@ public:
+       return NS_OK;
+     }
+ 
+-    nsFocusManager* fm = nsFocusManager::GetFocusManager();
+-    if (!fm) {
+-      return NS_ERROR_NULL_POINTER;
+-    }
+-
+-    nsIDocument* document = mElement->OwnerDoc();
+-
+     // Don't steal focus from the user.
+     if (mTopWindow->GetFocusedNode()) {
+       return NS_OK;
+     }
+ 
+-    // If something is focused in the same document, ignore autofocus.
+-    if (!fm->GetFocusedContent() ||
+-        fm->GetFocusedContent()->OwnerDoc() != document) {
+-      mozilla::ErrorResult rv;
+-      mElement->Focus(rv);
+-      return rv.StealNSResult();
+-    }
+-
+-    return NS_OK;
++    mozilla::ErrorResult rv;
++    mElement->Focus(rv);
++    return rv.StealNSResult();
+   }
+ private:
+   nsCOMPtr<Element> mElement;