www/waterfox: apply some FF57/FF59 fixes

38 files changed, 3843 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index 4a1d8a46b080..fee9271eaca6 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	waterfox
 DISTVERSION=	56.0.4
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1261175 b/www/waterfox/files/patch-bug1261175
new file mode 100644
index 000000000000..3a505bc52130
--- /dev/null
+++ b/www/waterfox/files/patch-bug1261175
@@ -0,0 +1,31 @@
+commit 315fe73694f9
+Author: Matt Woodrow <mwoodrow@mozilla.com>
+Date:   Tue Nov 14 10:31:36 2017 +1300
+
+    Bug 1261175. r=bobowen a=gchang
+    
+    MozReview-Commit-ID: B9yAN0F01rj
+    
+    --HG--
+    extra : amend_source : 7585df8257930896070ddcb64c93a28a39fbbee7
+---
+ layout/base/nsDocumentViewer.cpp | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git layout/base/nsDocumentViewer.cpp layout/base/nsDocumentViewer.cpp
+index be33cf990d91..4fe03d3f7f88 100644
+--- layout/base/nsDocumentViewer.cpp
++++ layout/base/nsDocumentViewer.cpp
+@@ -549,6 +549,12 @@ nsDocumentViewer::~nsDocumentViewer()
+     mDocument->Destroy();
+   }
+ 
++  if (mPrintEngine) {
++    mPrintEngine->Destroy();
++    mPrintEngine = nullptr;
++  }
++
++  MOZ_RELEASE_ASSERT(mDestroyRefCount == 0);
+   NS_ASSERTION(!mPresShell && !mPresContext,
+                "User did not call nsIContentViewer::Destroy");
+   if (mPresShell || mPresContext) {
diff --git a/www/waterfox/files/patch-bug1275062 b/www/waterfox/files/patch-bug1275062
new file mode 100644
index 000000000000..e9183ad9a677
--- /dev/null
+++ b/www/waterfox/files/patch-bug1275062
@@ -0,0 +1,344 @@
+commit 7b030826befa
+Author: Andrea Marchesini <amarchesini@mozilla.com>
+Date:   Sat Jan 27 13:40:58 2018 +0100
+
+    Bug 1275062 - Introduce a size check of IPC messages for IndexedDB. r=asuth, a=lizzard
+    
+    --HG--
+    extra : source : ca73f9471eded208cbf1206f22e0fe9f10550497
+---
+ dom/indexedDB/ActorsParent.cpp         | 78 +++++++++++++++++++++++++++-------
+ dom/indexedDB/IndexedDatabase.h        |  4 ++
+ dom/indexedDB/IndexedDatabaseInlines.h | 14 ++++++
+ 3 files changed, 80 insertions(+), 16 deletions(-)
+
+diff --git dom/indexedDB/ActorsParent.cpp dom/indexedDB/ActorsParent.cpp
+index b9eb1744b8b6..aef19c8379be 100644
+--- dom/indexedDB/ActorsParent.cpp
++++ dom/indexedDB/ActorsParent.cpp
+@@ -8173,7 +8173,7 @@ protected:
+ 
+   // Subclasses use this override to set the IPDL response value.
+   virtual void
+-  GetResponse(RequestResponse& aResponse) = 0;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) = 0;
+ 
+ private:
+   nsresult
+@@ -8237,7 +8237,7 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override;
+ 
+   void
+   Cleanup() override;
+@@ -8359,7 +8359,7 @@ private:
+   GetPreprocessParams(PreprocessParams& aParams) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override;
+ };
+ 
+ class ObjectStoreGetKeyRequestOp final
+@@ -8385,7 +8385,7 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override;
+ };
+ 
+ class ObjectStoreDeleteRequestOp final
+@@ -8407,9 +8407,10 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override
+   {
+     aResponse = Move(mResponse);
++    *aResponseSize = 0;
+   }
+ };
+ 
+@@ -8432,9 +8433,10 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override
+   {
+     aResponse = Move(mResponse);
++    *aResponseSize = 0;
+   }
+ };
+ 
+@@ -8459,9 +8461,10 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override
+   {
+     aResponse = Move(mResponse);
++    *aResponseSize = sizeof(uint64_t);
+   }
+ };
+ 
+@@ -8511,7 +8514,7 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override;
+ };
+ 
+ class IndexGetKeyRequestOp final
+@@ -8536,7 +8539,7 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override;
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override;
+ };
+ 
+ class IndexCountRequestOp final
+@@ -8561,9 +8564,10 @@ private:
+   DoDatabaseWork(DatabaseConnection* aConnection) override;
+ 
+   void
+-  GetResponse(RequestResponse& aResponse) override
++  GetResponse(RequestResponse& aResponse, size_t* aResponseSize) override
+   {
+     aResponse = Move(mResponse);
++    *aResponseSize = sizeof(uint64_t);
+   }
+ };
+ 
+@@ -25726,8 +25730,22 @@ NormalTransactionOp::SendSuccessResult()
+   AssertIsOnOwningThread();
+ 
+   if (!IsActorDestroyed()) {
++    static const size_t kMaxIDBMsgOverhead = 1024 * 1024 * 10; // 10MB
++    const uint32_t maximalSizeFromPref =
++      IndexedDatabaseManager::MaxSerializedMsgSize();
++    MOZ_ASSERT(maximalSizeFromPref > kMaxIDBMsgOverhead);
++    const size_t kMaxMessageSize = maximalSizeFromPref - kMaxIDBMsgOverhead;
++
+     RequestResponse response;
+-    GetResponse(response);
++    size_t responseSize = kMaxMessageSize;
++    GetResponse(response, &responseSize);
++
++    if (responseSize >= kMaxMessageSize) {
++      nsPrintfCString("The serialized value is too large"
++                      " (size=%zu bytes, max=%zu bytes).",
++                      responseSize, kMaxMessageSize);
++      return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
++    }
+ 
+     MOZ_ASSERT(response.type() != RequestResponse::T__None);
+ 
+@@ -26387,14 +26405,17 @@ ObjectStoreAddOrPutRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
+ }
+ 
+ void
+-ObjectStoreAddOrPutRequestOp::GetResponse(RequestResponse& aResponse)
++ObjectStoreAddOrPutRequestOp::GetResponse(RequestResponse& aResponse,
++                                          size_t* aResponseSize)
+ {
+   AssertIsOnOwningThread();
+ 
+   if (mOverwrite) {
+     aResponse = ObjectStorePutResponse(mResponse);
++    *aResponseSize = mResponse.GetBuffer().Length();
+   } else {
+     aResponse = ObjectStoreAddResponse(mResponse);
++    *aResponseSize = mResponse.GetBuffer().Length();
+   }
+ }
+ 
+@@ -26688,12 +26709,14 @@ ObjectStoreGetRequestOp::GetPreprocessParams(PreprocessParams& aParams)
+ }
+ 
+ void
+-ObjectStoreGetRequestOp::GetResponse(RequestResponse& aResponse)
++ObjectStoreGetRequestOp::GetResponse(RequestResponse& aResponse,
++                                     size_t* aResponseSize)
+ {
+   MOZ_ASSERT_IF(mLimit, mResponse.Length() <= mLimit);
+ 
+   if (mGetAll) {
+     aResponse = ObjectStoreGetAllResponse();
++    *aResponseSize = 0;
+ 
+     if (!mResponse.IsEmpty()) {
+       FallibleTArray<SerializedStructuredCloneReadInfo> fallibleCloneInfos;
+@@ -26706,6 +26729,7 @@ ObjectStoreGetRequestOp::GetResponse(RequestResponse& aResponse)
+       for (uint32_t count = mResponse.Length(), index = 0;
+            index < count;
+            index++) {
++        *aResponseSize += mResponse[index].Size();
+         nsresult rv =
+           ConvertResponse<false>(mResponse[index], fallibleCloneInfos[index]);
+         if (NS_WARN_IF(NS_FAILED(rv))) {
+@@ -26724,11 +26748,13 @@ ObjectStoreGetRequestOp::GetResponse(RequestResponse& aResponse)
+   }
+ 
+   aResponse = ObjectStoreGetResponse();
++  *aResponseSize = 0;
+ 
+   if (!mResponse.IsEmpty()) {
+     SerializedStructuredCloneReadInfo& serializedInfo =
+       aResponse.get_ObjectStoreGetResponse().cloneInfo();
+ 
++    *aResponseSize += mResponse[0].Size();
+     nsresult rv = ConvertResponse<false>(mResponse[0], serializedInfo);
+     if (NS_WARN_IF(NS_FAILED(rv))) {
+       aResponse = rv;
+@@ -26834,25 +26860,33 @@ ObjectStoreGetKeyRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
+ }
+ 
+ void
+-ObjectStoreGetKeyRequestOp::GetResponse(RequestResponse& aResponse)
++ObjectStoreGetKeyRequestOp::GetResponse(RequestResponse& aResponse,
++                                        size_t* aResponseSize)
+ {
+   MOZ_ASSERT_IF(mLimit, mResponse.Length() <= mLimit);
+ 
+   if (mGetAll) {
+     aResponse = ObjectStoreGetAllKeysResponse();
++    *aResponseSize = 0;
+ 
+     if (!mResponse.IsEmpty()) {
+       nsTArray<Key>& response =
+         aResponse.get_ObjectStoreGetAllKeysResponse().keys();
++
+       mResponse.SwapElements(response);
++      for (uint32_t i = 0; i < mResponse.Length(); ++i) {
++        *aResponseSize += mResponse[i].GetBuffer().Length();
++      }
+     }
+ 
+     return;
+   }
+ 
+   aResponse = ObjectStoreGetKeyResponse();
++  *aResponseSize = 0;
+ 
+   if (!mResponse.IsEmpty()) {
++    *aResponseSize = mResponse[0].GetBuffer().Length();
+     aResponse.get_ObjectStoreGetKeyResponse().key() = Move(mResponse[0]);
+   }
+ }
+@@ -27284,12 +27318,14 @@ IndexGetRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
+ }
+ 
+ void
+-IndexGetRequestOp::GetResponse(RequestResponse& aResponse)
++IndexGetRequestOp::GetResponse(RequestResponse& aResponse,
++                               size_t* aResponseSize)
+ {
+   MOZ_ASSERT_IF(!mGetAll, mResponse.Length() <= 1);
+ 
+   if (mGetAll) {
+     aResponse = IndexGetAllResponse();
++    *aResponseSize = 0;
+ 
+     if (!mResponse.IsEmpty()) {
+       FallibleTArray<SerializedStructuredCloneReadInfo> fallibleCloneInfos;
+@@ -27303,6 +27339,7 @@ IndexGetRequestOp::GetResponse(RequestResponse& aResponse)
+            index < count;
+            index++) {
+         StructuredCloneReadInfo& info = mResponse[index];
++        *aResponseSize += info.Size();
+ 
+         SerializedStructuredCloneReadInfo& serializedInfo =
+           fallibleCloneInfos[index];
+@@ -27335,9 +27372,11 @@ IndexGetRequestOp::GetResponse(RequestResponse& aResponse)
+   }
+ 
+   aResponse = IndexGetResponse();
++  *aResponseSize = 0;
+ 
+   if (!mResponse.IsEmpty()) {
+     StructuredCloneReadInfo& info = mResponse[0];
++    *aResponseSize += info.Size();
+ 
+     SerializedStructuredCloneReadInfo& serializedInfo =
+       aResponse.get_IndexGetResponse().cloneInfo();
+@@ -27467,23 +27506,30 @@ IndexGetKeyRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
+ }
+ 
+ void
+-IndexGetKeyRequestOp::GetResponse(RequestResponse& aResponse)
++IndexGetKeyRequestOp::GetResponse(RequestResponse& aResponse,
++                                  size_t* aResponseSize)
+ {
+   MOZ_ASSERT_IF(!mGetAll, mResponse.Length() <= 1);
+ 
+   if (mGetAll) {
+     aResponse = IndexGetAllKeysResponse();
++    *aResponseSize = 0;
+ 
+     if (!mResponse.IsEmpty()) {
+       mResponse.SwapElements(aResponse.get_IndexGetAllKeysResponse().keys());
++      for (uint32_t i = 0; i < mResponse.Length(); ++i) {
++        *aResponseSize += mResponse[i].GetBuffer().Length();
++      }
+     }
+ 
+     return;
+   }
+ 
+   aResponse = IndexGetKeyResponse();
++  *aResponseSize = 0;
+ 
+   if (!mResponse.IsEmpty()) {
++    *aResponseSize = mResponse[0].GetBuffer().Length();
+     aResponse.get_IndexGetKeyResponse().key() = Move(mResponse[0]);
+   }
+ }
+diff --git dom/indexedDB/IndexedDatabase.h dom/indexedDB/IndexedDatabase.h
+index b0c4cb877a9c..9165758bcd62 100644
+--- dom/indexedDB/IndexedDatabase.h
++++ dom/indexedDB/IndexedDatabase.h
+@@ -83,6 +83,10 @@ struct StructuredCloneReadInfo
+   // In IndexedDatabaseInlines.h
+   inline
+   MOZ_IMPLICIT StructuredCloneReadInfo(SerializedStructuredCloneReadInfo&& aOther);
++
++  // In IndexedDatabaseInlines.h
++  inline
++  size_t Size() const;
+ };
+ 
+ } // namespace indexedDB
+diff --git dom/indexedDB/IndexedDatabaseInlines.h dom/indexedDB/IndexedDatabaseInlines.h
+index 830c2f11009d..48cc4f9b3ced 100644
+--- dom/indexedDB/IndexedDatabaseInlines.h
++++ dom/indexedDB/IndexedDatabaseInlines.h
+@@ -99,6 +99,20 @@ StructuredCloneReadInfo::operator=(StructuredCloneReadInfo&& aCloneReadInfo)
+   return *this;
+ }
+ 
++inline size_t
++StructuredCloneReadInfo::Size() const
++{
++  size_t size = mData.Size();
++
++  for (uint32_t i = 0, count = mFiles.Length(); i < count; ++i) {
++    // We don't want to calculate the size of files and so on, because are mainly
++    // file descriptors.
++    size += sizeof(uint64_t);
++  }
++
++  return size;
++}
++
+ } // namespace indexedDB
+ } // namespace dom
+ } // namespace mozilla
diff --git a/www/waterfox/files/patch-bug1321960 b/www/waterfox/files/patch-bug1321960
new file mode 100644
index 000000000000..410894bfbadb
--- /dev/null
+++ b/www/waterfox/files/patch-bug1321960
@@ -0,0 +1,134 @@
+commit 8721b8f42bc0
+Author: Alexander Surkov <surkov.alexander@gmail.com>
+Date:   Tue Sep 26 16:25:12 2017 -0400
+
+    Bug 1321960 - Rename nsIPresShell::mSuppressInterruptibleReflows to mWasLastReflowInterrupted to reflect better its purpose. r=dholbert, a=sledru
+    
+    --HG--
+    extra : source : c65fce03b9e0a1a7591668f727b846675cffa44a
+---
+ layout/base/PresShell.cpp       |  8 ++++----
+ layout/base/nsIPresShell.h      | 18 +++++++++++++++++-
+ layout/base/nsRefreshDriver.cpp |  2 +-
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git layout/base/PresShell.cpp layout/base/PresShell.cpp
+index 4ca35ffe1466..a1660ac30de7 100644
+--- layout/base/PresShell.cpp
++++ layout/base/PresShell.cpp
+@@ -762,7 +762,7 @@ nsIPresShell::nsIPresShell()
+     , mFrozen(false)
+     , mIsFirstPaint(false)
+     , mObservesMutationsForPrint(false)
+-    , mSuppressInterruptibleReflows(false)
++    , mWasLastReflowInterrupted(false)
+     , mScrollPositionClampingScrollPortSizeSet(false)
+     , mNeedLayoutFlush(true)
+     , mNeedStyleFlush(true)
+@@ -4197,7 +4197,7 @@ PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush)
+     // worry about them.  They can't be triggered during reflow, so we should
+     // be good.
+ 
+-    if (flushType >= (mSuppressInterruptibleReflows
++    if (flushType >= (SuppressInterruptibleReflows()
+                         ? FlushType::Layout
+                         : FlushType::InterruptibleLayout) &&
+         !mIsDestroying) {
+@@ -4232,7 +4232,7 @@ PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush)
+   if (!didLayoutFlush && flushType >= FlushType::InterruptibleLayout &&
+       !mIsDestroying) {
+     // We suppressed this flush either due to it not being safe to flush,
+-    // or due to mSuppressInterruptibleReflows.  Either way, the
++    // or due to SuppressInterruptibleReflows().  Either way, the
+     // mNeedLayoutFlush flag needs to be re-set.
+     SetNeedLayoutFlush();
+   }
+@@ -9484,7 +9484,7 @@ PresShell::DoReflow(nsIFrame* target, bool aInterruptible)
+     // Any FlushPendingNotifications with interruptible reflows
+     // should be suppressed now. We don't want to do extra reflow work
+     // before our reflow event happens.
+-    mSuppressInterruptibleReflows = true;
++    mWasLastReflowInterrupted = true;
+     MaybeScheduleReflow();
+   }
+ 
+diff --git layout/base/nsIPresShell.h layout/base/nsIPresShell.h
+index 9f65bad1b4d7..885bc0bc699a 100644
+--- layout/base/nsIPresShell.h
++++ layout/base/nsIPresShell.h
+@@ -1581,6 +1581,21 @@ public:
+     mFontSizeInflationEnabledIsDirty = true;
+   }
+ 
++  /**
++   * Return true if the most recent interruptible reflow was interrupted.
++   */
++  bool IsReflowInterrupted() const {
++    return mWasLastReflowInterrupted;
++  }
++
++  /**
++   * Return true if the the interruptible reflows have to be suppressed.
++   * This may happen only if if the most recent reflow was interrupted.
++   */
++  bool SuppressInterruptibleReflows() const {
++    return mWasLastReflowInterrupted;
++  }
++
+   //////////////////////////////////////////////////////////////////////////////
+   // Approximate frame visibility tracking public API.
+   //////////////////////////////////////////////////////////////////////////////
+@@ -1794,7 +1809,8 @@ protected:
+   bool                      mIsFirstPaint : 1;
+   bool                      mObservesMutationsForPrint : 1;
+ 
+-  bool                      mSuppressInterruptibleReflows : 1;
++  // Whether the most recent interruptible reflow was actually interrupted:
++  bool                      mWasLastReflowInterrupted : 1;
+   bool                      mScrollPositionClampingScrollPortSizeSet : 1;
+ 
+   // True if a layout flush might not be a no-op
+diff --git layout/base/nsRefreshDriver.cpp layout/base/nsRefreshDriver.cpp
+index 4dbe56952ccf..4ca4783561c6 100644
+--- layout/base/nsRefreshDriver.cpp
++++ layout/base/nsRefreshDriver.cpp
+@@ -1949,7 +1949,7 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
+ 
+         nsCOMPtr<nsIPresShell> shellKungFuDeathGrip(shell);
+         shell->mObservingLayoutFlushes = false;
+-        shell->mSuppressInterruptibleReflows = false;
++        shell->mWasLastReflowInterrupted = false;
+         FlushType flushType = HasPendingAnimations(shell)
+                                ? FlushType::Layout
+                                : FlushType::InterruptibleLayout;
+commit 5ee10fd6f2e4
+Author: Alexander Surkov <surkov.alexander@gmail.com>
+Date:   Tue Sep 26 16:27:02 2017 -0400
+
+    Bug 1321960 - Let an interrupted reflow finish before processing a11y. r=eeejay, f=dholbert, a=sledru
+    
+    --HG--
+    extra : source : c845865489652eadaa3f9a12736c1db56c0e6f12
+---
+ accessible/base/NotificationController.cpp | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git accessible/base/NotificationController.cpp accessible/base/NotificationController.cpp
+index d08500458221..8263c7b54d83 100644
+--- accessible/base/NotificationController.cpp
++++ accessible/base/NotificationController.cpp
+@@ -601,9 +601,13 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime)
+   if (!mDocument)
+     return;
+ 
++  // Wait until an update, we have started, or an interruptible reflow is
++  // finished.
+   if (mObservingState == eRefreshProcessing ||
+-      mObservingState == eRefreshProcessingForUpdate)
++      mObservingState == eRefreshProcessingForUpdate ||
++      mPresShell->IsReflowInterrupted()) {
+     return;
++  }
+ 
+   // Any generic notifications should be queued if we're processing content
+   // insertions or generic notifications.
diff --git a/www/waterfox/files/patch-bug1347984 b/www/waterfox/files/patch-bug1347984
new file mode 100644
index 000000000000..fa976288d452
--- /dev/null
+++ b/www/waterfox/files/patch-bug1347984
@@ -0,0 +1,96 @@
+commit d40956eaa7d8
+Author: Jan de Mooij <jdemooij@mozilla.com>
+Date:   Fri Oct 6 20:11:07 2017 +0200
+
+    Bug 1347984 - Check for dead object proxies in TriggerPromiseReactions. r=till, a=ritu
+    
+    --HG--
+    extra : source : 754a3e12321c8656a83759adf297e61b0e188368
+---
+ js/src/builtin/Promise.cpp                  |  6 +++++-
+ js/src/jit-test/tests/basic/bug908915.js    |  1 +
+ js/src/jit-test/tests/promise/bug1347984.js |  6 ++++++
+ js/src/shell/js.cpp                         | 21 +++++++++++++++++++++
+ 4 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git js/src/builtin/Promise.cpp js/src/builtin/Promise.cpp
+index 2462f1f07853..1cb1cff0682e 100644
+--- js/src/builtin/Promise.cpp
++++ js/src/builtin/Promise.cpp
+@@ -1017,8 +1017,12 @@ TriggerPromiseReactions(JSContext* cx, HandleValue reactionsVal, JS::PromiseStat
+     RootedObject reactions(cx, &reactionsVal.toObject());
+     RootedObject reaction(cx);
+ 
+-    if (reactions->is<PromiseReactionRecord>() || IsWrapper(reactions))
++    if (reactions->is<PromiseReactionRecord>() ||
++        IsWrapper(reactions) ||
++        JS_IsDeadWrapper(reactions))
++    {
+         return EnqueuePromiseReactionJob(cx, reactions, valueOrReason, state);
++    }
+ 
+     RootedNativeObject reactionsList(cx, &reactions->as<NativeObject>());
+     size_t reactionsCount = reactionsList->getDenseInitializedLength();
+diff --git js/src/jit-test/tests/basic/bug908915.js js/src/jit-test/tests/basic/bug908915.js
+index 5077801b1b67..f0213296e769 100644
+--- js/src/jit-test/tests/basic/bug908915.js
++++ js/src/jit-test/tests/basic/bug908915.js
+@@ -11,6 +11,7 @@ var blacklist = {
+     'readline': true,
+     'terminate': true,
+     'nestedShell': true,
++    'nukeAllCCWs': true,
+ };
+ 
+ function f(y) {}
+diff --git js/src/jit-test/tests/promise/bug1347984.js js/src/jit-test/tests/promise/bug1347984.js
+new file mode 100644
+index 000000000000..5fc458cd452e
+--- /dev/null
++++ js/src/jit-test/tests/promise/bug1347984.js
+@@ -0,0 +1,6 @@
++// |jit-test| error:dead object
++var g = newGlobal();
++var p = new Promise(() => {});
++g.Promise.prototype.then.call(p, () => void 0);
++g.eval("nukeAllCCWs()");
++resolvePromise(p, 9);
+diff --git js/src/shell/js.cpp js/src/shell/js.cpp
+index 2bb7e97120a7..8e9aee7c854a 100644
+--- js/src/shell/js.cpp
++++ js/src/shell/js.cpp
+@@ -5049,6 +5049,23 @@ NukeCCW(JSContext* cx, unsigned argc, Value* vp)
+     return true;
+ }
+ 
++static bool
++NukeAllCCWs(JSContext* cx, unsigned argc, Value* vp)
++{
++    CallArgs args = CallArgsFromVp(argc, vp);
++
++    if (args.length() != 0) {
++        JS_ReportErrorNumberASCII(cx, my_GetErrorMessage, nullptr, JSSMSG_INVALID_ARGS,
++                                  "nukeAllCCWs");
++        return false;
++    }
++
++    NukeCrossCompartmentWrappers(cx, AllCompartments(), cx->compartment(),
++                                 NukeWindowReferences, NukeAllReferences);
++    args.rval().setUndefined();
++    return true;
++}
++
+ static bool
+ GetMaxArgs(JSContext* cx, unsigned argc, Value* vp)
+ {
+@@ -6552,6 +6569,10 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
+ "nukeCCW(wrapper)",
+ "  Nuke a CrossCompartmentWrapper, which turns it into a DeadProxyObject."),
+ 
++    JS_FN_HELP("nukeAllCCWs", NukeAllCCWs, 0, 0,
++"nukeAllCCWs()",
++"  Like nukeCCW, but for all CrossCompartmentWrappers targeting the current compartment."),
++
+     JS_FN_HELP("createMappedArrayBuffer", CreateMappedArrayBuffer, 1, 0,
+ "createMappedArrayBuffer(filename, [offset, [size]])",
+ "  Create an array buffer that mmaps the given file."),
diff --git a/www/waterfox/files/patch-bug1370791 b/www/waterfox/files/patch-bug1370791
new file mode 100644
index 000000000000..038094fd6fb5
--- /dev/null
+++ b/www/waterfox/files/patch-bug1370791
@@ -0,0 +1,104 @@
+commit 4ab22d92be00
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Wed Oct 4 19:12:40 2017 +0100
+
+    Bug 1370791 - Use CUI listener and an attribute to toggle hiding/showing the new tab button. r=jaws, a=ritu
+    
+    MozReview-Commit-ID: DaKohSCnrJn
+    
+    --HG--
+    extra : source : 3894d341fe1631dc755e5b16b3a286ec4e741991
+    extra : amend_source : 14a18fd29a60434f84664ee21eb245397a87f160
+---
+ browser/base/content/browser.css    |  4 +--
+ browser/base/content/tabbrowser.xml | 49 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 51 insertions(+), 2 deletions(-)
+
+diff --git browser/base/content/browser.css browser/base/content/browser.css
+index 8afcbf4a5f48..4527cd480fb0 100644
+--- browser/base/content/browser.css
++++ browser/base/content/browser.css
+@@ -114,9 +114,9 @@ tabbrowser {
+ }
+ 
+ #tabbrowser-tabs:not([overflow="true"]) ~ #alltabs-button,
+-#tabbrowser-tabs:not([overflow="true"]) + #new-tab-button,
++#tabbrowser-tabs[hasadjacentnewtabbutton]:not([overflow="true"]) ~ #new-tab-button,
+ #tabbrowser-tabs[overflow="true"] > .tabbrowser-arrowscrollbox > .tabs-newtab-button,
+-#TabsToolbar[currentset]:not([currentset*="tabbrowser-tabs,new-tab-button"]) > #tabbrowser-tabs > .tabbrowser-arrowscrollbox > .tabs-newtab-button,
++#tabbrowser-tabs:not([hasadjacentnewtabbutton]) > .tabbrowser-arrowscrollbox > .tabs-newtab-button,
+ #TabsToolbar[customizing="true"] > #tabbrowser-tabs > .tabbrowser-arrowscrollbox > .tabs-newtab-button {
+   visibility: collapse;
+ }
+diff --git browser/base/content/tabbrowser.xml browser/base/content/tabbrowser.xml
+index 7575a985eeba..7e6c321e5dee 100644
+--- browser/base/content/tabbrowser.xml
++++ browser/base/content/tabbrowser.xml
+@@ -5808,11 +5808,58 @@
+         ]]></body>
+       </method>
+ 
++      <method name="_updateNewTabVisibility">
++        <body><![CDATA[
++          let sib = this.tabContainer.nextElementSibling;
++          while (sib && sib.hidden) {
++            sib = sib.nextElementSibling;
++          }
++          const kAttr = "hasadjacentnewtabbutton";
++          if (sib && sib.id == "new-tab-button") {
++            this.tabContainer.setAttribute(kAttr, "true");
++          } else {
++            this.tabContainer.removeAttribute(kAttr);
++          }
++        ]]></body>
++      </method>
++
++      <method name="onWidgetAfterDOMChange">
++        <parameter name="aNode"/>
++        <parameter name="aNextNode"/>
++        <parameter name="aContainer"/>
++        <body><![CDATA[
++          if (aContainer.ownerDocument == document &&
++              aContainer.id == "TabsToolbar") {
++            this._updateNewTabVisibility();
++          }
++        ]]></body>
++      </method>
++      <method name="onAreaNodeRegistered">
++        <parameter name="aArea"/>
++        <parameter name="aContainer"/>
++        <body><![CDATA[
++          if (aContainer.ownerDocument == document &&
++              aArea == "TabsToolbar") {
++            this._updateNewTabVisibility();
++          }
++        ]]></body>
++      </method>
++      <method name="onAreaReset">
++        <parameter name="aArea"/>
++        <parameter name="aContainer"/>
++        <body><![CDATA[
++          this.onAreaNodeRegistered(aArea, aContainer);
++        ]]></body>
++      </method>
++
+       <constructor>
+         <![CDATA[
+           this.mCurrentBrowser = document.getAnonymousElementByAttribute(this, "anonid", "initialBrowser");
+           this.mCurrentBrowser.permanentKey = {};
+ 
++          CustomizableUI.addListener(this);
++          this._updateNewTabVisibility();
++
+           Services.obs.addObserver(this, "contextual-identity-updated");
+ 
+           this.mCurrentTab = this.tabContainer.firstChild;
+@@ -5922,6 +5969,8 @@
+         <![CDATA[
+           Services.obs.removeObserver(this, "contextual-identity-updated");
+ 
++          CustomizableUI.removeListener(this);
++
+           for (let tab of this.tabs) {
+             let browser = tab.linkedBrowser;
+             if (browser.registeredOpenURI) {
diff --git a/www/waterfox/files/patch-bug1383501 b/www/waterfox/files/patch-bug1383501
new file mode 100644
index 000000000000..372046df120b
--- /dev/null
+++ b/www/waterfox/files/patch-bug1383501
@@ -0,0 +1,83 @@
+commit 8ba0e2ee02b0
+Author: Aaron Klotz <aklotz@mozilla.com>
+Date:   Wed Oct 4 09:12:25 2017 -0600
+
+    Bug 1383501 - Do not crash when TabParent::RecvPDocAccessibleConstructor receives a null COM proxy sent to the parent process. r=jimm, a=ritu
+    
+    MozReview-Commit-ID: 5IOuLXc375T
+    
+    --HG--
+    extra : source : e2a6e2ddfa184b5a1f410408d7232ed0041a360f
+---
+ accessible/ipc/win/ProxyAccessible.cpp |  2 +-
+ accessible/ipc/win/ProxyAccessible.h   | 13 ++++++++++++-
+ dom/ipc/TabParent.cpp                  |  2 ++
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git accessible/ipc/win/ProxyAccessible.cpp accessible/ipc/win/ProxyAccessible.cpp
+index 0942e280ea30..383ece99fb0c 100644
+--- accessible/ipc/win/ProxyAccessible.cpp
++++ accessible/ipc/win/ProxyAccessible.cpp
+@@ -34,7 +34,7 @@ ProxyAccessible::GetCOMInterface(void** aOutAccessible) const
+     return false;
+   }
+ 
+-  if (!mCOMProxy) {
++  if (!mCOMProxy && mSafeToRecurse) {
+     // See if we can lazily obtain a COM proxy
+     AccessibleWrap* wrap = WrapperFor(this);
+     bool isDefunct = false;
+diff --git accessible/ipc/win/ProxyAccessible.h accessible/ipc/win/ProxyAccessible.h
+index 83f1e6093253..4fd897e588fe 100644
+--- accessible/ipc/win/ProxyAccessible.h
++++ accessible/ipc/win/ProxyAccessible.h
+@@ -27,6 +27,7 @@ public:
+   ProxyAccessible(uint64_t aID, ProxyAccessible* aParent,
+                   DocAccessibleParent* aDoc, role aRole, uint32_t aInterfaces)
+     : ProxyAccessibleBase(aID, aParent, aDoc, aRole, aInterfaces)
++    , mSafeToRecurse(true)
+   {
+     MOZ_COUNT_CTOR(ProxyAccessible);
+   }
+@@ -40,7 +41,16 @@ public:
+ 
+   bool GetCOMInterface(void** aOutAccessible) const;
+   void SetCOMInterface(const RefPtr<IAccessible>& aIAccessible)
+-  { mCOMProxy = aIAccessible; }
++  {
++    if (aIAccessible) {
++      mCOMProxy = aIAccessible;
++    } else {
++      // If we were supposed to be receiving an interface (hence the call to
++      // this function), but the interface turns out to be null, then we're
++      // broken for some reason.
++      mSafeToRecurse = false;
++    }
++  }
+ 
+ protected:
+   explicit ProxyAccessible(DocAccessibleParent* aThisAsDoc)
+@@ -49,6 +59,7 @@ protected:
+ 
+ private:
+   RefPtr<IAccessible> mCOMProxy;
++  bool                mSafeToRecurse;
+ };
+ 
+ }
+diff --git dom/ipc/TabParent.cpp dom/ipc/TabParent.cpp
+index 7fc5689e6211..d8733a377219 100644
+--- dom/ipc/TabParent.cpp
++++ dom/ipc/TabParent.cpp
+@@ -972,9 +972,11 @@ TabParent::RecvPDocAccessibleConstructor(PDocAccessibleParent* aDoc,
+ #ifdef XP_WIN
+     a11y::WrapperFor(doc)->SetID(aMsaaID);
+     MOZ_ASSERT(!aDocCOMProxy.IsNull());
++#ifdef NIGHTLY_BUILD
+     if (aDocCOMProxy.IsNull()) {
+       return IPC_FAIL(this, "Constructing a top-level PDocAccessible with null COM proxy");
+     }
++#endif
+ 
+     RefPtr<IAccessible> proxy(aDocCOMProxy.Get());
+     doc->SetCOMInterface(proxy);
diff --git a/www/waterfox/files/patch-bug1397114 b/www/waterfox/files/patch-bug1397114
new file mode 100644
index 000000000000..fe12dce4f535
--- /dev/null
+++ b/www/waterfox/files/patch-bug1397114
@@ -0,0 +1,105 @@
+commit 92b82f64e587
+Author: Scott Wu <scottcwwu@gmail.com>
+Date:   Wed Sep 20 16:45:03 2017 +0800
+
+    Bug 1397114 - Disable smooth scrolling when value changes come from input box. r=mconley, a=ritu
+    
+    MozReview-Commit-ID: 9ZLSB2HQvcu
+    
+    --HG--
+    extra : source : f215f88437f1db1884858be2c78582ab2b11bbb0
+---
+ toolkit/content/widgets/datepicker.js | 11 ++++++-----
+ toolkit/content/widgets/spinner.js    | 16 ++--------------
+ 2 files changed, 8 insertions(+), 19 deletions(-)
+
+diff --git toolkit/content/widgets/datepicker.js toolkit/content/widgets/datepicker.js
+index 31651dc63665..b125c5103a9a 100644
+--- toolkit/content/widgets/datepicker.js
++++ toolkit/content/widgets/datepicker.js
+@@ -133,7 +133,7 @@ function DatePicker(context) {
+     /**
+      * Update date picker and its components.
+      */
+-    _update() {
++    _update(options = {}) {
+       const { dateKeeper, isMonthPickerVisible } = this.state;
+ 
+       if (isMonthPickerVisible) {
+@@ -148,7 +148,8 @@ function DatePicker(context) {
+         dateObj: dateKeeper.state.dateObj,
+         months: this.state.months,
+         years: this.state.years,
+-        toggleMonthPicker: this.state.toggleMonthPicker
++        toggleMonthPicker: this.state.toggleMonthPicker,
++        noSmoothScroll: options.noSmoothScroll
+       });
+       this.components.calendar.setProps({
+         isVisible: !isMonthPickerVisible,
+@@ -269,7 +270,7 @@ function DatePicker(context) {
+       dateKeeper.setSelection({
+         year, month, day
+       });
+-      this._update();
++      this._update({ noSmoothScroll: true });
+     }
+   };
+ 
+@@ -350,14 +351,14 @@ function DatePicker(context) {
+           items: props.months,
+           isInfiniteScroll: true,
+           isValueSet: this.state.isMonthSet,
+-          smoothScroll: !this.state.firstOpened
++          smoothScroll: !(this.state.firstOpened || props.noSmoothScroll)
+         });
+         this.components.year.setState({
+           value: props.dateObj.getUTCFullYear(),
+           items: props.years,
+           isInfiniteScroll: false,
+           isValueSet: this.state.isYearSet,
+-          smoothScroll: !this.state.firstOpened
++          smoothScroll: !(this.state.firstOpened || props.noSmoothScroll)
+         });
+         this.state.firstOpened = false;
+       } else {
+diff --git toolkit/content/widgets/spinner.js toolkit/content/widgets/spinner.js
+index 101cb01658a0..0a30766f8d13 100644
+--- toolkit/content/widgets/spinner.js
++++ toolkit/content/widgets/spinner.js
+@@ -124,8 +124,6 @@ function Spinner(props, context) {
+     /**
+      * Whenever scroll event is detected:
+      * - Update the index state
+-     * - If a smooth scroll has reached its destination, set [isScrolling] state
+-     *   to false
+      * - If the value has changed, update the [value] state and call [setValue]
+      * - If infinite scrolling is on, reset the scrolling position if necessary
+      */
+@@ -138,14 +136,8 @@ function Spinner(props, context) {
+ 
+       const value = itemsView[this.state.index + viewportTopOffset].value;
+ 
+-      // Check if smooth scrolling has reached its destination.
+-      // This prevents input box jump when input box changes values.
+-      if (this.state.value == value && this.state.isScrolling) {
+-        this.state.isScrolling = false;
+-      }
+-
+-      // Call setValue if value has changed, and is not smooth scrolling
+-      if (this.state.value != value && !this.state.isScrolling) {
++      // Call setValue if value has changed
++      if (this.state.value != value) {
+         this.state.value = value;
+         this.props.setValue(value);
+       }
+@@ -444,10 +436,6 @@ function Spinner(props, context) {
+     _smoothScrollToIndex(index) {
+       const element = this.elements.spinner.children[index];
+       if (element) {
+-        // Set the isScrolling flag before smooth scrolling begins
+-        // and remove it when it has reached the destination.
+-        // This prevents input box jump when input box changes values
+-        this.state.isScrolling = true;
+         element.scrollIntoView({
+           behavior: "smooth", block: "start"
+         });
diff --git a/www/waterfox/files/patch-bug1399939 b/www/waterfox/files/patch-bug1399939
new file mode 100644
index 000000000000..95bdfb17d22a
--- /dev/null
+++ b/www/waterfox/files/patch-bug1399939
@@ -0,0 +1,36 @@
+commit b0369ebbca69
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Thu Sep 28 12:00:22 2017 +0100
+
+    Bug 1399939 - Switch to highly restrictive profile for IDN. r=dveditz, r=jfkthame, a=sledru
+    
+    MozReview-Commit-ID: E5LRuQVfIZP
+    
+    --HG--
+    extra : source : e1c1ebf60808e5e94b9a03d8cb577990ac0b9ca1
+---
+ modules/libpref/init/all.js | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git modules/libpref/init/all.js modules/libpref/init/all.js
+index c74659f8d4a5..c796df0fef1d 100644
+--- modules/libpref/init/all.js
++++ modules/libpref/init/all.js
+@@ -1913,7 +1913,7 @@ pref("network.IDN_show_punycode", false);
+ // IDN-safe. Otherwise, they're treated as unsafe and punycode will be used
+ // for displaying them in the UI (e.g. URL bar), unless they conform to one of
+ // the profiles specified in
+-// http://www.unicode.org/reports/tr36/proposed.html#Security_Levels_and_Alerts
++// https://www.unicode.org/reports/tr39/#Restriction_Level_Detection
+ // If "network.IDN.restriction_profile" is "high", the Highly Restrictive
+ // profile is used.
+ // If "network.IDN.restriction_profile" is "moderate", the Moderately
+@@ -1922,7 +1922,7 @@ pref("network.IDN_show_punycode", false);
+ // Note that these preferences are referred to ONLY when
+ // "network.IDN_show_punycode" is false. In other words, all IDNs will be shown
+ // in punycode if "network.IDN_show_punycode" is true.
+-pref("network.IDN.restriction_profile", "moderate");
++pref("network.IDN.restriction_profile", "high");
+ pref("network.IDN.use_whitelist", false);
+ 
+ // ccTLDs
diff --git a/www/waterfox/files/patch-bug1402025 b/www/waterfox/files/patch-bug1402025
new file mode 100644
index 000000000000..841abfb757c0
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402025
@@ -0,0 +1,201 @@
+commit a80cfb448ce3
+Author: Kirk Steuber <ksteuber@mozilla.com>
+Date:   Thu Sep 28 12:09:56 2017 -0700
+
+    Bug 1402025 - Ensure form submission flush when unsetting relevant attributes. r=bz, a=ritu
+    
+    It seems that we were flushing any pending submission when changing the action or target attributes of a form, but not when unsetting those attributes.
+    
+    MozReview-Commit-ID: E6aUnokg54k
+    
+    --HG--
+    extra : source : 32fa20aaa56cfb063433ff46f202e99eb35043d7
+---
+ dom/html/HTMLFormElement.cpp              | 25 ++++-----
+ dom/html/test/browser.ini                 |  3 ++
+ dom/html/test/browser_submission_flush.js | 85 +++++++++++++++++++++++++++++++
+ dom/html/test/post_action_page.html       | 10 ++++
+ dom/html/test/submission_flush.html       | 13 +++++
+ 5 files changed, 122 insertions(+), 14 deletions(-)
+
+diff --git dom/html/HTMLFormElement.cpp dom/html/HTMLFormElement.cpp
+index 6b87c8b54255..c9ff6ffc8f2a 100644
+--- dom/html/HTMLFormElement.cpp
++++ dom/html/HTMLFormElement.cpp
+@@ -189,21 +189,18 @@ HTMLFormElement::BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+ {
+   if (aNamespaceID == kNameSpaceID_None) {
+     if (aName == nsGkAtoms::action || aName == nsGkAtoms::target) {
+-      // This check is mostly to preserve previous behavior.
+-      if (aValue) {
+-        if (mPendingSubmission) {
+-          // aha, there is a pending submission that means we're in
+-          // the script and we need to flush it. let's tell it
+-          // that the event was ignored to force the flush.
+-          // the second argument is not playing a role at all.
+-          FlushPendingSubmission();
+-        }
+-        // Don't forget we've notified the password manager already if the
+-        // page sets the action/target in the during submit. (bug 343182)
+-        bool notifiedObservers = mNotifiedObservers;
+-        ForgetCurrentSubmission();
+-        mNotifiedObservers = notifiedObservers;
++      if (mPendingSubmission) {
++        // aha, there is a pending submission that means we're in
++        // the script and we need to flush it. let's tell it
++        // that the event was ignored to force the flush.
++        // the second argument is not playing a role at all.
++        FlushPendingSubmission();
+       }
++      // Don't forget we've notified the password manager already if the
++      // page sets the action/target in the during submit. (bug 343182)
++      bool notifiedObservers = mNotifiedObservers;
++      ForgetCurrentSubmission();
++      mNotifiedObservers = notifiedObservers;
+     }
+   }
+ 
+diff --git dom/html/test/browser.ini dom/html/test/browser.ini
+index 34a32b833652..67754c995dfa 100644
+--- dom/html/test/browser.ini
++++ dom/html/test/browser.ini
+@@ -6,6 +6,8 @@ support-files =
+   file_bug649778.html^headers^
+   file_fullscreen-api-keys.html
+   file_content_contextmenu.html
++  submission_flush.html
++  post_action_page.html
+   form_data_file.bin
+   form_data_file.txt
+   form_submit_server.sjs
+@@ -27,3 +29,4 @@ support-files =
+ tags = fullscreen
+ [browser_fullscreen-contextmenu-esc.js]
+ tags = fullscreen
++[browser_submission_flush.js]
+diff --git dom/html/test/browser_submission_flush.js dom/html/test/browser_submission_flush.js
+new file mode 100644
+index 000000000000..e3948e7071e8
+--- /dev/null
++++ dom/html/test/browser_submission_flush.js
+@@ -0,0 +1,85 @@
++"use strict";
++// Form submissions triggered by the Javascript 'submit' event listener are
++// deferred until the event listener finishes. However, changes to specific
++// attributes ("action" and "target" attributes) need to cause an immediate
++// flush of any pending submission to prevent the form submission from using the
++// wrong action or target. This test ensures that such flushes happen properly.
++
++const kTestPage = "http://example.org/browser/dom/html/test/submission_flush.html";
++// This is the page pointed to by the form action in the test HTML page.
++const kPostActionPage = "http://example.org/browser/dom/html/test/post_action_page.html";
++
++const kFormId = "test_form"
++const kFrameId = "test_frame"
++const kSubmitButtonId = "submit_button"
++
++// Take in a variety of actions (in the form of setting and unsetting form
++// attributes). Then submit the form in the submit event listener to cause a
++// deferred form submission. Then perform the test actions and ensure that the
++// form used the correct attribute values rather than the changed ones.
++async function runTest(aTestActions) {
++  let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, kTestPage);
++  registerCleanupFunction(() => BrowserTestUtils.removeTab(tab));
++
++  let frame_url = await ContentTask.spawn(gBrowser.selectedBrowser,
++                          {kFormId, kFrameId, kSubmitButtonId, aTestActions},
++                          async function({kFormId, kFrameId, kSubmitButtonId,
++                                          aTestActions}) {
++    let form = content.document.getElementById(kFormId);
++
++    form.addEventListener("submit", (event) => {
++      // Need to trigger the deferred submission by submitting in the submit
++      // event handler. To prevent the form from being submitted twice, the
++      // <form> tag contains the attribute |onsubmit="return false;"| to cancel
++      // the original submission.
++      form.submit();
++
++      if (aTestActions.setattr) {
++        for (let {attr, value} of aTestActions.setattr) {
++          form.setAttribute(attr, value);
++        }
++      }
++      if (aTestActions.unsetattr) {
++        for (let attr of aTestActions.unsetattr) {
++          form.removeAttribute(attr);
++        }
++      }
++    }, {capture: true, once: true});
++
++    // Trigger the above event listener
++    content.document.getElementById(kSubmitButtonId).click();
++
++    // Test that the form was submitted to the correct target (the frame) with
++    // the correct action (kPostActionPage).
++    let frame = content.document.getElementById(kFrameId);
++    await new Promise(resolve => {
++      frame.addEventListener("load", resolve, {once: true});
++    });
++    return frame.contentWindow.location.href;
++  });
++  is(frame_url, kPostActionPage,
++     "Form should have submitted with correct target and action");
++}
++
++add_task(async function() {
++  info("Changing action should flush pending submissions");
++  await runTest({setattr: [{attr: "action", value: "about:blank"}]});
++});
++
++add_task(async function() {
++  info("Changing target should flush pending submissions");
++  await runTest({setattr: [{attr: "target", value: "_blank"}]});
++});
++
++add_task(async function() {
++  info("Unsetting action should flush pending submissions");
++  await runTest({unsetattr: ["action"]});
++});
++
++// On failure, this test will time out rather than failing an assert. When the
++// target attribute is not set, the form will submit the active page, navigating
++// it away and preventing the wait for iframe load from ever finishing.
++add_task(async function() {
++  info("Unsetting target should flush pending submissions");
++  await runTest({unsetattr: ["target"]});
++});
+diff --git dom/html/test/post_action_page.html dom/html/test/post_action_page.html
+new file mode 100644
+index 000000000000..ba6ae514f2e9
+--- /dev/null
++++ dom/html/test/post_action_page.html
+@@ -0,0 +1,10 @@
++<!DOCTYPE html>
++<html lang="en">
++  <head>
++    <meta charset="utf-8"/>
++    <title>Submission Flush Test Post Action Page</title>
++  </head>
++  <body>
++    <h1>Post Action Page</h1>
++  </body>
++</html>
+diff --git dom/html/test/submission_flush.html dom/html/test/submission_flush.html
+new file mode 100644
+index 000000000000..f70884c66ac8
+--- /dev/null
++++ dom/html/test/submission_flush.html
+@@ -0,0 +1,13 @@
++<!DOCTYPE html>
++<html lang="en">
++  <head>
++    <meta charset="utf-8"/>
++    <title>Submission Flush Test</title>
++  </head>
++  <body>
++    <form id="test_form" action="post_action_page.html" target="form_target" method="POST" onsubmit="return false;">
++      <button type="submit" id="submit_button">Submit</button>
++    </form>
++    <iframe name="form_target" id="test_frame"></iframe>
++  </body>
++</html>
diff --git a/www/waterfox/files/patch-bug1402218 b/www/waterfox/files/patch-bug1402218
new file mode 100644
index 000000000000..e407960ef94b
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402218
@@ -0,0 +1,91 @@
+commit 3ddaaf254633
+Author: Boris Zbarsky <bzbarsky@mit.edu>
+Date:   Thu Sep 28 22:04:34 2017 -0400
+
+    Bug 1402218 - Make sure to clone our CSSDeclaration as needed when removing properties. r=emilio, a=sledru
+    
+    MozReview-Commit-ID: 6LRjLU3QQok
+    
+    --HG--
+    extra : source : 76b6ae2fc6eb389810cb2a745f976be11516eb44
+    extra : amend_source : 849900fa9c4e12b62cf73175666a672ca6ab3914
+---
+ layout/style/DeclarationBlockInlines.h  |  9 +++++++++
+ layout/style/crashtests/1402218-1.html  | 15 +++++++++++++++
+ layout/style/crashtests/crashtests.list |  3 ++-
+ layout/style/nsDOMCSSDeclaration.cpp    | 12 +-----------
+ 4 files changed, 27 insertions(+), 12 deletions(-)
+
+diff --git layout/style/DeclarationBlockInlines.h layout/style/DeclarationBlockInlines.h
+index 5438bd1957c2..c9e0d4f82e31 100644
+--- layout/style/DeclarationBlockInlines.h
++++ layout/style/DeclarationBlockInlines.h
+@@ -46,6 +46,15 @@ DeclarationBlock::EnsureMutable()
+     AsGecko()->AssertNotExpanded();
+   }
+ #endif
++  if (IsServo() && !IsDirty()) {
++    // In stylo, the old DeclarationBlock is stored in element's rule node tree
++    // directly, to avoid new values replacing the DeclarationBlock in the tree
++    // directly, we need to copy the old one here if we haven't yet copied.
++    // As a result the new value does not replace rule node tree until traversal
++    // happens.
++    return Clone();
++  }
++
+   if (!IsMutable()) {
+     return Clone();
+   }
+diff --git layout/style/crashtests/1402218-1.html layout/style/crashtests/1402218-1.html
+new file mode 100644
+index 000000000000..597c1c4d5e53
+--- /dev/null
++++ layout/style/crashtests/1402218-1.html
+@@ -0,0 +1,15 @@
++<!DOCTYPE html>
++<style>
++#wrapper::first-line {}
++</style>
++<body>
++<div id="wrapper">
++  <div id="test"></div>
++</div>
++<script>
++  document.querySelector('#test').style.position = 'absolute';
++  document.body.offsetHeight;
++  document.querySelector('#wrapper').style.color = 'green';
++  document.querySelector('#test').style.position = '';
++</script>
++</body>
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index e0a7fe4a20c5..ab9b5a7a9a4e 100644
+--- layout/style/crashtests/crashtests.list
++++ layout/style/crashtests/crashtests.list
+@@ -202,3 +202,4 @@ load 1387481-1.html
+ load 1387499.html
+ load 1391577.html
+ load 1398581.html
++load 1402218-1.html
+diff --git layout/style/nsDOMCSSDeclaration.cpp layout/style/nsDOMCSSDeclaration.cpp
+index a828f0e7b3dd..12e03c314fe9 100644
+--- layout/style/nsDOMCSSDeclaration.cpp
++++ layout/style/nsDOMCSSDeclaration.cpp
+@@ -305,17 +305,7 @@ nsDOMCSSDeclaration::ModifyDeclaration(GeckoFunc aGeckoFunc,
+   // between when we mutate the declaration and when we set the new
+   // rule (see stack in bug 209575).
+   mozAutoDocConditionalContentUpdateBatch autoUpdate(DocToUpdate(), true);
+-  RefPtr<DeclarationBlock> decl;
+-  if (olddecl->IsServo() && !olddecl->IsDirty()) {
+-    // In stylo, the old DeclarationBlock is stored in element's rule node tree
+-    // directly, to avoid new values replacing the DeclarationBlock in the tree
+-    // directly, we need to copy the old one here if we haven't yet copied.
+-    // As a result the new value does not replace rule node tree until traversal
+-    // happens.
+-    decl = olddecl->Clone();
+-  } else {
+-    decl = olddecl->EnsureMutable();
+-  }
++  RefPtr<DeclarationBlock> decl = olddecl->EnsureMutable();
+ 
+   bool changed;
+   if (decl->IsGecko()) {
diff --git a/www/waterfox/files/patch-bug1402377 b/www/waterfox/files/patch-bug1402377
new file mode 100644
index 000000000000..6d5322defb37
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402377
@@ -0,0 +1,36 @@
+commit 9e374938aaac
+Author: Munro Mengjue Chiang <mchiang@mozilla.com>
+Date:   Wed Sep 27 10:16:46 2017 +0800
+
+    Bug 1402377 - Stop the corresponding track instead of the whole stream when an external device is plugged out. r=jib, r=pehrsons, a=ritu
+    
+    MozReview-Commit-ID: 7gbB5sgn6xI
+    
+    --HG--
+    extra : source : 140805019de38dbfbb9f4fe363de8d7c8a52d387
+    extra : histedit_source : 9f60927d8c7dfba265a60497b305e65eeb28939b
+---
+ dom/media/MediaManager.cpp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git dom/media/MediaManager.cpp dom/media/MediaManager.cpp
+index a06296086a28..6b37fa4206a2 100644
+--- dom/media/MediaManager.cpp
++++ dom/media/MediaManager.cpp
+@@ -4067,14 +4067,14 @@ GetUserMediaWindowListener::StopRawID(const nsString& removedDeviceID)
+       nsString id;
+       source->GetAudioDevice()->GetRawId(id);
+       if (removedDeviceID.Equals(id)) {
+-        source->Stop();
++        source->StopTrack(kAudioTrack);
+       }
+     }
+     if (source->GetVideoDevice()) {
+       nsString id;
+       source->GetVideoDevice()->GetRawId(id);
+       if (removedDeviceID.Equals(id)) {
+-        source->Stop();
++        source->StopTrack(kVideoTrack);
+       }
+     }
+   }
diff --git a/www/waterfox/files/patch-bug1402766 b/www/waterfox/files/patch-bug1402766
new file mode 100644
index 000000000000..f1672e7fa48f
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402766
@@ -0,0 +1,69 @@
+commit fd42606e30e4
+Author: Boris Zbarsky <bzbarsky@mit.edu>
+Date:   Tue Oct 3 18:50:10 2017 -0400
+
+    Bug 1402766 - Work around layout violating its own invariants and causing stylo code to crash. r=emilio, a=sledru
+    
+    MozReview-Commit-ID: 3ggJI0qmOJV
+    
+    --HG--
+    extra : source : 71d02a129bebc9dfd804b1babb8fae587d1930a8
+    extra : histedit_source : d36726bf4182c3820a3f8efd2d2599b114cb55c4
+---
+ layout/generic/crashtests/1405443.html    | 19 +++++++++++++++++++
+ layout/generic/crashtests/crashtests.list |  1 +
+ layout/generic/nsInlineFrame.cpp          |  7 +++++++
+ 3 files changed, 27 insertions(+)
+
+diff --git layout/generic/crashtests/1405443.html layout/generic/crashtests/1405443.html
+new file mode 100644
+index 000000000000..79313ae1c4d4
+--- /dev/null
++++ layout/generic/crashtests/1405443.html
+@@ -0,0 +1,19 @@
++<style>

++#htmlvar00009 { page-break-inside: avoid; }

++* { padding-left: 1vw; border-right: solid green 3em; }

++#htmlvar00001 { columns: 1px; )

++</style>

++<script>

++function jsfuzzer() {

++try { htmlvar00009.appendChild(htmlvar00013); } catch(e) { }

++try { var var00143 = htmlvar00009.x; } catch(e) { }

++try { htmlvar00009.appendChild(document.createElement("table").createCaption()); } catch(e) { }

++}

++</script>

++<body onload=jsfuzzer()>

++<dl id="htmlvar00001">

++A

++<img id="htmlvar00009" align="left"></img>

++<menu id="htmlvar00013">

++<menuitem>

++<hr>

+diff --git layout/generic/crashtests/crashtests.list layout/generic/crashtests/crashtests.list
+index 25c2c32470fc..07cc75ea0f9a 100644
+--- layout/generic/crashtests/crashtests.list
++++ layout/generic/crashtests/crashtests.list
+@@ -659,3 +659,4 @@ load 1367413-1.html
+ load 1368617-1.html
+ load 1373586.html
+ load 1401420-1.html
++asserts(11) load 1405443.html # bug 1405443
+diff --git layout/generic/nsInlineFrame.cpp layout/generic/nsInlineFrame.cpp
+index 089178a6ada2..ce62f822bda0 100644
+--- layout/generic/nsInlineFrame.cpp
++++ layout/generic/nsInlineFrame.cpp
+@@ -1065,6 +1065,13 @@ nsInlineFrame::UpdateStyleOfOwnedAnonBoxesForIBSplit(
+     }
+ 
+     nsIFrame* nextInline = blockFrame->GetProperty(nsIFrame::IBSplitSibling());
++
++    // This check is here due to bug 1405443.  Please remove it once
++    // that bug is fixed.
++    if (!nextInline) {
++      break;
++    }
++
+     MOZ_ASSERT(nextInline, "There is always a trailing inline in an IB split");
+ 
+     for (nsIFrame* cont = nextInline; cont; cont = cont->GetNextContinuation()) {
diff --git a/www/waterfox/files/patch-bug1402951 b/www/waterfox/files/patch-bug1402951
new file mode 100644
index 000000000000..7c9a14017c7e
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402951
@@ -0,0 +1,164 @@
+commit 71daba14a2c4
+Author: Alexander Surkov <surkov.alexander@gmail.com>
+Date:   Tue Oct 3 10:58:27 2017 -0400
+
+    Bug 1402951 - No show events for content on document load complete. r=aklotz, r=yzen, a=ritu
+    
+    --HG--
+    extra : source : ffc4c63976921cbfec03b26ff48541c2f414d2e3
+---
+ accessible/generic/DocAccessible.cpp                     | 14 ++++++++------
+ accessible/ipc/DocAccessibleChildBase.cpp                | 15 ++++++++++++++-
+ accessible/ipc/DocAccessibleChildBase.h                  |  5 +++++
+ accessible/ipc/DocAccessibleParent.cpp                   |  5 +++++
+ accessible/ipc/other/PDocAccessible.ipdl                 |  1 +
+ accessible/ipc/win/DocAccessibleChild.h                  |  3 ++-
+ accessible/ipc/win/PDocAccessible.ipdl                   |  1 +
+ accessible/tests/mochitest/treeupdate/test_ariaowns.html |  5 ++---
+ 8 files changed, 38 insertions(+), 11 deletions(-)
+
+diff --git accessible/generic/DocAccessible.cpp accessible/generic/DocAccessible.cpp
+index 60b160b21a78..fa6f3c6a70d5 100644
+--- accessible/generic/DocAccessible.cpp
++++ accessible/generic/DocAccessible.cpp
+@@ -1536,13 +1536,15 @@ DocAccessible::DoInitialUpdate()
+     ParentDocument()->FireDelayedEvent(reorderEvent);
+   }
+ 
+-  TreeMutation mt(this);
+-  uint32_t childCount = ChildCount();
+-  for (uint32_t i = 0; i < childCount; i++) {
+-    Accessible* child = GetChildAt(i);
+-    mt.AfterInsertion(child);
++  if (IPCAccessibilityActive()) {
++    DocAccessibleChild* ipcDoc = IPCDoc();
++    MOZ_ASSERT(ipcDoc);
++    if (ipcDoc) {
++      for (auto idx = 0U; idx < mChildren.Length(); idx++) {
++        ipcDoc->InsertIntoIpcTree(this, mChildren.ElementAt(idx), idx);
++      }
++    }
+   }
+-  mt.Done();
+ }
+ 
+ void
+diff --git accessible/ipc/DocAccessibleChildBase.cpp accessible/ipc/DocAccessibleChildBase.cpp
+index 6a0ad9b7dbc6..19a858aa6d9b 100644
+--- accessible/ipc/DocAccessibleChildBase.cpp
++++ accessible/ipc/DocAccessibleChildBase.cpp
+@@ -80,6 +80,19 @@ DocAccessibleChildBase::SerializeTree(Accessible* aRoot,
+   }
+ }
+ 
++void
++DocAccessibleChildBase::InsertIntoIpcTree(Accessible* aParent,
++                                          Accessible* aChild,
++                                          uint32_t aIdxInParent)
++{
++  uint64_t parentID = aParent->IsDoc() ?
++    0 : reinterpret_cast<uint64_t>(aParent->UniqueID());
++  nsTArray<AccessibleData> shownTree;
++  ShowEventData data(parentID, aIdxInParent, shownTree, true);
++  SerializeTree(aChild, data.NewTree());
++  MaybeSendShowEvent(data, false);
++}
++
+ void
+ DocAccessibleChildBase::ShowEvent(AccShowEvent* aShowEvent)
+ {
+@@ -87,7 +100,7 @@ DocAccessibleChildBase::ShowEvent(AccShowEvent* aShowEvent)
+   uint64_t parentID = parent->IsDoc() ? 0 : reinterpret_cast<uint64_t>(parent->UniqueID());
+   uint32_t idxInParent = aShowEvent->GetAccessible()->IndexInParent();
+   nsTArray<AccessibleData> shownTree;
+-  ShowEventData data(parentID, idxInParent, shownTree);
++  ShowEventData data(parentID, idxInParent, shownTree, false);
+   SerializeTree(aShowEvent->GetAccessible(), data.NewTree());
+   MaybeSendShowEvent(data, aShowEvent->IsFromUserInput());
+ }
+diff --git accessible/ipc/DocAccessibleChildBase.h accessible/ipc/DocAccessibleChildBase.h
+index b8a8bfde1d0c..13146e5d44e2 100644
+--- accessible/ipc/DocAccessibleChildBase.h
++++ accessible/ipc/DocAccessibleChildBase.h
+@@ -45,6 +45,11 @@ public:
+     SendShutdown();
+   }
+ 
++  /**
++   * Serializes a shown tree and sends it to the chrome process.
++   */
++  void InsertIntoIpcTree(Accessible* aParent,
++                         Accessible* aChild, uint32_t aIdxInParent);
+   void ShowEvent(AccShowEvent* aShowEvent);
+ 
+   virtual void ActorDestroy(ActorDestroyReason) override
+diff --git accessible/ipc/DocAccessibleParent.cpp accessible/ipc/DocAccessibleParent.cpp
+index 4bbf261273c5..34c334847c04 100644
+--- accessible/ipc/DocAccessibleParent.cpp
++++ accessible/ipc/DocAccessibleParent.cpp
+@@ -79,6 +79,11 @@ DocAccessibleParent::RecvShowEvent(const ShowEventData& aData,
+ 
+   MOZ_ASSERT(CheckDocTree());
+ 
++  // Just update, no events.
++  if (aData.EventSuppressed()) {
++    return IPC_OK();
++  }
++
+   ProxyAccessible* target = parent->ChildAt(newChildIdx);
+   ProxyShowHideEvent(target, parent, true, aFromUser);
+ 
+diff --git accessible/ipc/other/PDocAccessible.ipdl accessible/ipc/other/PDocAccessible.ipdl
+index 4c084bbee125..ffed961185fa 100644
+--- accessible/ipc/other/PDocAccessible.ipdl
++++ accessible/ipc/other/PDocAccessible.ipdl
+@@ -29,6 +29,7 @@ struct ShowEventData
+   uint64_t ID;
+   uint32_t Idx;
+   AccessibleData[] NewTree;
++  bool EventSuppressed;
+ };
+ 
+ struct Attribute
+diff --git accessible/ipc/win/DocAccessibleChild.h accessible/ipc/win/DocAccessibleChild.h
+index e34987005a40..9b4586a16cda 100644
+--- accessible/ipc/win/DocAccessibleChild.h
++++ accessible/ipc/win/DocAccessibleChild.h
+@@ -110,7 +110,8 @@ private:
+     SerializedShow(DocAccessibleChild* aTarget,
+                    ShowEventData& aEventData, bool aFromUser)
+       : DeferredEvent(aTarget)
+-      , mEventData(aEventData.ID(), aEventData.Idx(), nsTArray<AccessibleData>())
++      , mEventData(aEventData.ID(), aEventData.Idx(),
++                   nsTArray<AccessibleData>(), aEventData.EventSuppressed())
+       , mFromUser(aFromUser)
+     {
+       // Since IPDL doesn't generate a move constructor for ShowEventData,
+diff --git accessible/ipc/win/PDocAccessible.ipdl accessible/ipc/win/PDocAccessible.ipdl
+index afd3b991efdc..da7128e87a65 100644
+--- accessible/ipc/win/PDocAccessible.ipdl
++++ accessible/ipc/win/PDocAccessible.ipdl
+@@ -29,6 +29,7 @@ struct ShowEventData
+   uint64_t ID;
+   uint32_t Idx;
+   AccessibleData[] NewTree;
++  bool EventSuppressed;
+ };
+ 
+ struct Attribute
+diff --git accessible/tests/mochitest/treeupdate/test_ariaowns.html accessible/tests/mochitest/treeupdate/test_ariaowns.html
+index 7d88b9a0698b..bf47bc84c280 100644
+--- accessible/tests/mochitest/treeupdate/test_ariaowns.html
++++ accessible/tests/mochitest/treeupdate/test_ariaowns.html
+@@ -580,9 +580,8 @@
+     function test9_prepare()
+     {
+       this.eventSeq = [
+-        new invokerChecker(EVENT_SHOW, () => {
+-          let doc = getNode('t9_container').contentDocument;
+-          return doc && doc.getElementById('container');
++        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, () => {
++          return getNode('t9_container').contentDocument;
+         })
+       ];
+ 
diff --git a/www/waterfox/files/patch-bug1402981 b/www/waterfox/files/patch-bug1402981
new file mode 100644
index 000000000000..9e177ca672e2
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402981
@@ -0,0 +1,172 @@
+commit bcef6c71b916
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Wed Sep 27 22:37:19 2017 +0100
+
+    Bug 1402981 - Add light and dark themes to the list of themes in customize mode by default. r=jaws, a=sledru
+    
+    MozReview-Commit-ID: 4GxPEm119Yc
+    
+    --HG--
+    extra : source : ed2a1dff7a2e544a76de0eb65139f0febd0211e4
+---
+ .../components/customizableui/CustomizeMode.jsm    | 45 +++++++++++++++-------
+ .../browser_1007336_lwthemes_in_customize_mode.js  | 44 +++++++++++++++------
+ 2 files changed, 64 insertions(+), 25 deletions(-)
+
+diff --git browser/components/customizableui/CustomizeMode.jsm browser/components/customizableui/CustomizeMode.jsm
+index fbc8ff27093c..aa80840a3c42 100644
+--- browser/components/customizableui/CustomizeMode.jsm
++++ browser/components/customizableui/CustomizeMode.jsm
+@@ -1311,7 +1311,9 @@ CustomizeMode.prototype = {
+ 
+   onLWThemesMenuShowing(aEvent) {
+     const DEFAULT_THEME_ID = "{972ce4c6-7e08-4474-a285-3208198ce6fd}";
+-    const RECENT_LWT_COUNT = 5;
++    const LIGHT_THEME_ID = "firefox-compact-light@mozilla.org";
++    const DARK_THEME_ID = "firefox-compact-dark@mozilla.org";
++    const MAX_THEME_COUNT = 6;
+ 
+     this._clearLWThemesMenu(aEvent.target);
+ 
+@@ -1366,19 +1368,27 @@ CustomizeMode.prototype = {
+       let themes = [aDefaultTheme];
+       let lwts = LightweightThemeManager.usedThemes;
+       let currentLwt = LightweightThemeManager.currentTheme;
+-      let currentLwtIndex = lwts.indexOf(currentLwt);
+-      if (currentLwtIndex > -1) {
+-        // Make sure that the current lightweight theme
+-        // is at the beginning of the array to avoid truncation
+-        // in the next step.
+-        lwts = lwts.splice(currentLwtIndex, 1).concat(lwts);
+-      }
+-      if (lwts.length > RECENT_LWT_COUNT)
+-        lwts.length = RECENT_LWT_COUNT;
++      // The lwts besides the builtin themes don't have an isActive property:
+       for (let lwt of lwts) {
+-        lwt.isActive = !!currentLwt && (lwt.id == currentLwt.id);
+-        themes.push(lwt);
++        if (!lwt.hasOwnProperty("isActive")) {
++          lwt.isActive = !!currentLwt && (lwt.id == currentLwt.id);
++        }
++      }
++
++      // Move the current theme (if any) and the light/dark themes to the start:
++      let importantThemes = [LIGHT_THEME_ID, DARK_THEME_ID];
++      if (currentLwt && !importantThemes.includes(currentLwt.id)) {
++        importantThemes.push(currentLwt.id);
++      }
++      for (let importantTheme of importantThemes) {
++        let themeIndex = lwts.findIndex(theme => theme.id == importantTheme);
++        if (themeIndex > -1) {
++          themes.push(...lwts.splice(themeIndex, 1));
++        }
+       }
++      themes = themes.concat(lwts);
++      if (themes.length > MAX_THEME_COUNT)
++        themes.length = MAX_THEME_COUNT;
+ 
+       let footer = doc.getElementById("customization-lwtheme-menu-footer");
+       let panel = footer.parentNode;
+@@ -1400,8 +1410,15 @@ CustomizeMode.prototype = {
+       recommendedThemes = JSON.parse(recommendedThemes);
+       let sb = Services.strings.createBundle("chrome://browser/locale/lightweightThemes.properties");
+       for (let theme of recommendedThemes) {
+-        theme.name = sb.GetStringFromName("lightweightThemes." + theme.id + ".name");
+-        theme.description = sb.GetStringFromName("lightweightThemes." + theme.id + ".description");
++        try {
++          theme.name = sb.GetStringFromName("lightweightThemes." + theme.id + ".name");
++          theme.description = sb.GetStringFromName("lightweightThemes." + theme.id + ".description");
++        } catch (ex) {
++          // If finding strings for this failed, just don't build it. This can
++          // happen for users with 'older' recommended themes lists, some of which
++          // have since been removed from Firefox.
++          continue;
++        }
+         let button = buildToolbarButton(theme);
+         button.addEventListener("command", () => {
+           LightweightThemeManager.setLocalTheme(button.theme);
+diff --git browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
+index 3cb3ee34c7cf..3ee8f9b8f697 100644
+--- browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
++++ browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
+@@ -5,12 +5,13 @@
+ "use strict";
+ 
+ const DEFAULT_THEME_ID = "{972ce4c6-7e08-4474-a285-3208198ce6fd}";
++const LIGHT_THEME_ID = "firefox-compact-light@mozilla.org";
++const DARK_THEME_ID = "firefox-compact-dark@mozilla.org";
+ const {LightweightThemeManager} = Components.utils.import("resource://gre/modules/LightweightThemeManager.jsm", {});
+ 
+ add_task(async function() {
+   Services.prefs.clearUserPref("lightweightThemes.usedThemes");
+   Services.prefs.clearUserPref("lightweightThemes.recommendedThemes");
+-  LightweightThemeManager.clearBuiltInThemes();
+ 
+   await startCustomizing();
+ 
+@@ -35,9 +36,14 @@ add_task(async function() {
+   let header = document.getElementById("customization-lwtheme-menu-header");
+   let recommendedHeader = document.getElementById("customization-lwtheme-menu-recommended");
+ 
+-  is(header.nextSibling.nextSibling, recommendedHeader,
+-     "There should only be one theme (default) in the 'My Themes' section by default");
+-  is(header.nextSibling.theme.id, DEFAULT_THEME_ID, "That theme should be the default theme");
++  is(header.nextSibling.nextSibling.nextSibling.nextSibling, recommendedHeader,
++     "There should only be three themes (default, light, dark) in the 'My Themes' section by default");
++  is(header.nextSibling.theme.id, DEFAULT_THEME_ID,
++     "The first theme should be the default theme");
++  is(header.nextSibling.nextSibling.theme.id, LIGHT_THEME_ID,
++     "The second theme should be the light theme");
++  is(header.nextSibling.nextSibling.nextSibling.theme.id, DARK_THEME_ID,
++     "The third theme should be the dark theme");
+ 
+   let firstLWTheme = recommendedHeader.nextSibling;
+   let firstLWThemeId = firstLWTheme.theme.id;
+@@ -52,12 +58,18 @@ add_task(async function() {
+   await popupShownPromise;
+ 
+   is(header.nextSibling.theme.id, DEFAULT_THEME_ID, "The first theme should be the Default theme");
+-  let installedThemeId = header.nextSibling.nextSibling.theme.id;
++  let installedThemeId = header.nextSibling.nextSibling.nextSibling.nextSibling.theme.id;
+   ok(installedThemeId.startsWith(firstLWThemeId),
+      "The second theme in the 'My Themes' section should be the newly installed theme: " +
+      "Installed theme id: " + installedThemeId + "; First theme ID: " + firstLWThemeId);
+-  is(header.nextSibling.nextSibling.nextSibling, recommendedHeader,
+-     "There should be two themes in the 'My Themes' section");
++  let themeCount = 0;
++  let iterNode = header;
++  while (iterNode.nextSibling && iterNode.nextSibling.theme) {
++    themeCount++;
++    iterNode = iterNode.nextSibling;
++  }
++  is(themeCount, 4,
++     "There should be four themes in the 'My Themes' section");
+ 
+   let defaultTheme = header.nextSibling;
+   defaultTheme.doCommand();
+@@ -90,11 +102,21 @@ add_task(async function() {
+   await popupShownPromise;
+   header = document.getElementById("customization-lwtheme-menu-header");
+   is(header.hidden, false, "Header should never be hidden");
+-  is(header.nextSibling.theme.id, DEFAULT_THEME_ID, "The first theme should be the Default theme");
+-  is(header.nextSibling.hidden, false, "The default theme should never be hidden");
++  let themeNode = header.nextSibling;
++  is(themeNode.theme.id, DEFAULT_THEME_ID, "The first theme should be the Default theme");
++  is(themeNode.hidden, false, "The default theme should never be hidden");
++
++  themeNode = themeNode.nextSibling;
++  is(themeNode.theme.id, LIGHT_THEME_ID, "The second theme should be the Light theme");
++  is(themeNode.hidden, false, "The light theme should never be hidden");
++
++  themeNode = themeNode.nextSibling;
++  is(themeNode.theme.id, DARK_THEME_ID, "The third theme should be the Dark theme");
++  is(themeNode.hidden, false, "The dark theme should never be hidden");
++
+   recommendedHeader = document.getElementById("customization-lwtheme-menu-recommended");
+-  is(header.nextSibling.nextSibling, recommendedHeader,
+-     "There should only be one theme (default) in the 'My Themes' section by default");
++  is(themeNode.nextSibling, recommendedHeader,
++     "There should only be three themes (default, light, dark) in the 'My Themes' section now");
+   let footer = document.getElementById("customization-lwtheme-menu-footer");
+   is(recommendedHeader.nextSibling.id, footer.id, "There should be no recommended themes in the menu");
+   is(recommendedHeader.hidden, true, "The recommendedHeader should be hidden since there are no recommended themes");
diff --git a/www/waterfox/files/patch-bug1403721 b/www/waterfox/files/patch-bug1403721
new file mode 100644
index 000000000000..6459c0894087
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403721
@@ -0,0 +1,182 @@
+commit 637bcd0503db
+Author: Tom Schuster <evilpies@gmail.com>
+Date:   Thu Sep 28 12:46:09 2017 +0200
+
+    Bug 1403723 - Correct metadata when using management.get. r=mixedpuppy, a=ritu
+    * * *
+    Bug 1403721 - Limit management.get to allowed addon types. r=mixedpuppy
+---
+ toolkit/components/extensions/ext-management.js    | 36 ++++++++++++++--------
+ .../test/xpcshell/test_ext_experiments.js          | 25 +++++++++++++++
+ .../test/xpcshell/test_ext_management.js           |  8 +++++
+ .../mozapps/extensions/internal/XPIProvider.jsm    |  4 +++
+ 4 files changed, 61 insertions(+), 12 deletions(-)
+
+diff --git toolkit/components/extensions/ext-management.js toolkit/components/extensions/ext-management.js
+index 0e46732b201d..d86a15ceb6a1 100644
+--- toolkit/components/extensions/ext-management.js
++++ toolkit/components/extensions/ext-management.js
+@@ -91,6 +91,16 @@ const listenerMap = new WeakMap();
+ // Some management APIs are intentionally limited.
+ const allowedTypes = ["theme", "extension"];
+ 
++function checkAllowedAddon(addon) {
++  if (addon.isSystem || addon.isAPIExtension) {
++    return false;
++  }
++  if (addon.type == "extension" && !addon.isWebExtension) {
++    return false;
++  }
++  return allowedTypes.includes(addon.type);
++}
++
+ class AddonListener {
+   constructor() {
+     AddonManager.addAddonListener(this);
+@@ -106,33 +116,29 @@ class AddonListener {
+     return getExtensionInfoForAddon(ext, addon);
+   }
+ 
+-  checkAllowed(addon) {
+-    return !addon.isSystem && allowedTypes.includes(addon.type);
+-  }
+-
+   onEnabled(addon) {
+-    if (!this.checkAllowed(addon)) {
++    if (!checkAllowedAddon(addon)) {
+       return;
+     }
+     this.emit("onEnabled", this.getExtensionInfo(addon));
+   }
+ 
+   onDisabled(addon) {
+-    if (!this.checkAllowed(addon)) {
++    if (!checkAllowedAddon(addon)) {
+       return;
+     }
+     this.emit("onDisabled", this.getExtensionInfo(addon));
+   }
+ 
+   onInstalled(addon) {
+-    if (!this.checkAllowed(addon)) {
++    if (!checkAllowedAddon(addon)) {
+       return;
+     }
+     this.emit("onInstalled", this.getExtensionInfo(addon));
+   }
+ 
+   onUninstalled(addon) {
+-    if (!this.checkAllowed(addon)) {
++    if (!checkAllowedAddon(addon)) {
+       return;
+     }
+     this.emit("onUninstalled", this.getExtensionInfo(addon));
+@@ -167,16 +173,22 @@ this.management = class extends ExtensionAPI {
+       management: {
+         async get(id) {
+           let addon = await AddonManager.getAddonByID(id);
+-          if (!addon.isSystem) {
+-            return getExtensionInfoForAddon(extension, addon);
++          if (!addon) {
++            throw new ExtensionError(`No such addon ${id}`);
++          }
++          if (!checkAllowedAddon(addon)) {
++            throw new ExtensionError("get not allowed for this addon");
+           }
++          // If the extension is enabled get it and use it for more data.
++          let ext = GlobalManager.extensionMap.get(addon.id);
++          return getExtensionInfoForAddon(ext, addon);
+         },
+ 
+         async getAll() {
+           let addons = await AddonManager.getAddonsByTypes(allowedTypes);
+-          return addons.filter(addon => !addon.isSystem).map(addon => {
++          return addons.filter(checkAllowedAddon).map(addon => {
+             // If the extension is enabled get it and use it for more data.
+-            let ext = addon.isWebExtension && GlobalManager.extensionMap.get(addon.id);
++            let ext = GlobalManager.extensionMap.get(addon.id);
+             return getExtensionInfoForAddon(ext, addon);
+           });
+         },
+diff --git toolkit/components/extensions/test/xpcshell/test_ext_experiments.js toolkit/components/extensions/test/xpcshell/test_ext_experiments.js
+index 343e1e50d983..c8d097decf90 100644
+--- toolkit/components/extensions/test/xpcshell/test_ext_experiments.js
++++ toolkit/components/extensions/test/xpcshell/test_ext_experiments.js
+@@ -148,6 +148,31 @@ add_task(async function test_experiments_api() {
+   let hello = await promise;
+   equal(hello, "Here I am", "Should get hello from add-on");
+ 
++  // Install management test add-on.
++  let managementAddon = ExtensionTestUtils.loadExtension({
++    manifest: {
++      applications: {gecko: {id: "management@web.extension"}},
++      permissions: ["management"],
++    },
++    async background() {
++      // Should find the simple extension.
++      let normalAddon = await browser.management.get("boring@web.extension");
++      browser.test.assertEq(normalAddon.id, "boring@web.extension", "Found boring addon");
++
++      try {
++        // Not allowed to get the API experiment.
++        await browser.management.get("fooBar@experiments.addons.mozilla.org");
++      } catch (e) {
++        browser.test.sendMessage("done");
++      }
++    },
++    useAddonManager: "temporary",
++  });
++
++  await managementAddon.startup();
++  await managementAddon.awaitMessage("done");
++  await managementAddon.unload();
++
+   // Cleanup.
+   apiAddon.uninstall();
+ 
+diff --git toolkit/components/extensions/test/xpcshell/test_ext_management.js toolkit/components/extensions/test/xpcshell/test_ext_management.js
+index c1702042c054..975c14a566e4 100644
+--- toolkit/components/extensions/test/xpcshell/test_ext_management.js
++++ toolkit/components/extensions/test/xpcshell/test_ext_management.js
+@@ -22,6 +22,7 @@ add_task(async function test_management_getAll() {
+       },
+       name: id,
+       version: "1.0",
++      short_name: id,
+       permissions: ["management"],
+     };
+   }
+@@ -55,11 +56,18 @@ add_task(async function test_management_getAll() {
+   for (let id of [id1, id2]) {
+     let addon = addons.find(a => { return a.id === id; });
+     equal(addon.name, id, `The extension with id ${id} was returned by getAll.`);
++    equal(addon.shortName, id, "Additional extension metadata was correct");
+   }
+ 
+   extension2.sendMessage("getAddon", id1);
+   let addon = await extension2.awaitMessage("addon");
+   equal(addon.name, id1, `The extension with id ${id1} was returned by get.`);
++  equal(addon.shortName, id1, "Additional extension metadata was correct");
++
++  extension2.sendMessage("getAddon", id2);
++  addon = await extension2.awaitMessage("addon");
++  equal(addon.name, id2, `The extension with id ${id2} was returned by get.`);
++  equal(addon.shortName, id2, "Additional extension metadata was correct");
+ 
+   await extension2.unload();
+   await extension1.unload();
+diff --git toolkit/mozapps/extensions/internal/XPIProvider.jsm toolkit/mozapps/extensions/internal/XPIProvider.jsm
+index 0027e13e3804..56f3982e7214 100644
+--- toolkit/mozapps/extensions/internal/XPIProvider.jsm
++++ toolkit/mozapps/extensions/internal/XPIProvider.jsm
+@@ -5197,6 +5197,10 @@ AddonWrapper.prototype = {
+     return isWebExtension(addonFor(this).type);
+   },
+ 
++  get isAPIExtension() {
++    return addonFor(this).type == "apiextension";
++  },
++
+   get temporarilyInstalled() {
+     return addonFor(this)._installLocation == TemporaryInstallLocation;
+   },
diff --git a/www/waterfox/files/patch-bug1403998 b/www/waterfox/files/patch-bug1403998
new file mode 100644
index 000000000000..585198482647
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403998
@@ -0,0 +1,167 @@
+commit b5254d352036
+Author: Honza Bambas <honzab.moz@firemni.cz>
+Date:   Mon Oct 2 10:12:00 2017 -0400
+
+    Bug 1403998 - Make view-source channels return correct resultPrincipalURI via LoadInfo after redirect. r=bz, a=ritu
+    
+    --HG--
+    extra : source : f693bf1345f941592b1ce19514a2bbf00e6ef06a
+---
+ .../protocol/viewsource/nsViewSourceChannel.cpp    | 95 ++++++++++++++++++----
+ netwerk/protocol/viewsource/nsViewSourceChannel.h  | 10 +++
+ 2 files changed, 91 insertions(+), 14 deletions(-)
+
+diff --git netwerk/protocol/viewsource/nsViewSourceChannel.cpp netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+index 4c7f335352d3..1f1ee01818fb 100644
+--- netwerk/protocol/viewsource/nsViewSourceChannel.cpp
++++ netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+@@ -129,12 +129,87 @@ nsViewSourceChannel::InitSrcdoc(nsIURI* aURI,
+     mApplicationCacheChannel = do_QueryInterface(mChannel);
+     mUploadChannel = do_QueryInterface(mChannel);
+ 
++    rv = UpdateLoadInfoResultPrincipalURI();
++    NS_ENSURE_SUCCESS(rv, rv);
++
+     nsCOMPtr<nsIInputStreamChannel> isc = do_QueryInterface(mChannel);
+     MOZ_ASSERT(isc);
+     isc->SetBaseURI(aBaseURI);
+     return NS_OK;
+ }
+ 
++nsresult
++nsViewSourceChannel::UpdateLoadInfoResultPrincipalURI()
++{
++    nsresult rv;
++
++    MOZ_ASSERT(mChannel);
++
++    nsCOMPtr<nsILoadInfo> channelLoadInfo = mChannel->GetLoadInfo();
++    if (!channelLoadInfo) {
++        return NS_OK;
++    }
++
++    nsCOMPtr<nsIURI> channelResultPrincipalURI;
++    rv = channelLoadInfo->GetResultPrincipalURI(getter_AddRefs(channelResultPrincipalURI));
++    if (NS_FAILED(rv)) {
++        return rv;
++    }
++
++    if (!channelResultPrincipalURI) {
++        mChannel->GetOriginalURI(getter_AddRefs(channelResultPrincipalURI));
++        return NS_OK;
++    }
++
++    if (!channelResultPrincipalURI) {
++        return NS_ERROR_UNEXPECTED;
++    }
++
++    bool alreadyViewSource;
++    if (NS_SUCCEEDED(channelResultPrincipalURI->SchemeIs("view-source", &alreadyViewSource)) &&
++        alreadyViewSource) {
++        return NS_OK;
++    }
++
++    nsCOMPtr<nsIURI> updatedResultPrincipalURI;
++    rv = BuildViewSourceURI(channelResultPrincipalURI,
++                            getter_AddRefs(updatedResultPrincipalURI));
++    if (NS_FAILED(rv)) {
++        return rv;
++    }
++
++    rv = channelLoadInfo->SetResultPrincipalURI(updatedResultPrincipalURI);
++    if (NS_FAILED(rv)) {
++        return rv;
++    }
++
++    return NS_OK;
++}
++
++nsresult
++nsViewSourceChannel::BuildViewSourceURI(nsIURI * aURI, nsIURI ** aResult)
++{
++    nsresult rv;
++
++    // protect ourselves against broken channel implementations
++    if (!aURI) {
++        NS_ERROR("no URI to build view-source uri!");
++        return NS_ERROR_UNEXPECTED;
++    }
++
++    nsAutoCString spec;
++    rv = aURI->GetSpec(spec);
++    if (NS_FAILED(rv)) {
++        return rv;
++    }
++
++    return NS_NewURI(aResult,
++                     /* XXX Gross hack -- NS_NewURI goes into an infinite loop on
++                     non-flat specs.  See bug 136980 */
++                     nsAutoCString(NS_LITERAL_CSTRING("view-source:") + spec),
++                     nullptr);
++}
++
+ ////////////////////////////////////////////////////////////////////////////////
+ // nsIRequest methods:
+ 
+@@ -229,24 +304,11 @@ nsViewSourceChannel::GetURI(nsIURI* *aURI)
+ 
+     nsCOMPtr<nsIURI> uri;
+     nsresult rv = mChannel->GetURI(getter_AddRefs(uri));
+-    if (NS_FAILED(rv))
+-      return rv;
+-
+-    // protect ourselves against broken channel implementations
+-    if (!uri) {
+-      NS_ERROR("inner channel returned NS_OK and a null URI");
+-      return NS_ERROR_UNEXPECTED;
+-    }
+-
+-    nsAutoCString spec;
+-    rv = uri->GetSpec(spec);
+     if (NS_FAILED(rv)) {
+       return rv;
+     }
+ 
+-    /* XXX Gross hack -- NS_NewURI goes into an infinite loop on
+-       non-flat specs.  See bug 136980 */
+-    return NS_NewURI(aURI, nsAutoCString(NS_LITERAL_CSTRING("view-source:")+spec), nullptr);
++    return BuildViewSourceURI(uri, aURI);
+ }
+ 
+ NS_IMETHODIMP
+@@ -671,6 +733,11 @@ nsViewSourceChannel::OnStartRequest(nsIRequest *aRequest, nsISupports *aContext)
+     mCacheInfoChannel = do_QueryInterface(mChannel);
+     mUploadChannel = do_QueryInterface(aRequest);
+ 
++    nsresult rv = UpdateLoadInfoResultPrincipalURI();
++    if (NS_FAILED(rv)) {
++        Cancel(rv);
++    }
++
+     return mListener->OnStartRequest(static_cast<nsIViewSourceChannel*>
+                                                 (this),
+                                      aContext);
+diff --git netwerk/protocol/viewsource/nsViewSourceChannel.h netwerk/protocol/viewsource/nsViewSourceChannel.h
+index 002739b361f7..1970c01588e3 100644
+--- netwerk/protocol/viewsource/nsViewSourceChannel.h
++++ netwerk/protocol/viewsource/nsViewSourceChannel.h
+@@ -55,9 +55,19 @@ public:
+                                      const nsAString &aSrcdoc,
+                                      nsILoadInfo* aLoadInfo);
+ 
++    // Updates or sets the result principal URI of the underlying channel's
++    // loadinfo to be prefixed with the "view-source:" schema as:
++    //
++    // mChannel.loadInfo.resultPrincipalURI = "view-source:" +
++    //    (mChannel.loadInfo.resultPrincipalURI | mChannel.orignalURI);
++    nsresult UpdateLoadInfoResultPrincipalURI();
++
+ protected:
+     ~nsViewSourceChannel() {}
+ 
++    // Clones aURI and prefixes it with "view-source:" schema,
++    nsresult BuildViewSourceURI(nsIURI* aURI, nsIURI** aResult);
++
+     nsCOMPtr<nsIChannel>        mChannel;
+     nsCOMPtr<nsIHttpChannel>    mHttpChannel;
+     nsCOMPtr<nsIHttpChannelInternal>    mHttpChannelInternal;
diff --git a/www/waterfox/files/patch-bug1404057 b/www/waterfox/files/patch-bug1404057
new file mode 100644
index 000000000000..e82bafd8ba75
--- /dev/null
+++ b/www/waterfox/files/patch-bug1404057
@@ -0,0 +1,139 @@
+commit 52f5824f49d0
+Author: Manish Goregaokar <manishsmail@gmail.com>
+Date:   Wed Oct 4 20:57:24 2017 -0500
+
+    Bug 1404057 - stylo: `all` shorthand should not apply to internal properties. r=xidorn, a=ritu
+    
+    Source-Repo: https://github.com/servo/servo
+    Source-Revision: 43686a8738513db728eebcc535b5ac6e1a2f17f7
+---
+ servo/components/style/properties/properties.mako.rs | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git servo/components/style/properties/properties.mako.rs servo/components/style/properties/properties.mako.rs
+index 13dd6212fe1a..269bf0dbbbb5 100644
+--- servo/components/style/properties/properties.mako.rs
++++ servo/components/style/properties/properties.mako.rs
+@@ -217,7 +217,9 @@ pub mod shorthands {
+     // We don't defined the 'all' shorthand using the regular helpers:shorthand
+     // mechanism, since it causes some very large types to be generated.
+     <% data.declare_shorthand("all",
+-                              [p.name for p in data.longhands if p.name not in ['direction', 'unicode-bidi']],
++                              [p.name for p in data.longhands
++                                if p.name not in ['direction', 'unicode-bidi']
++                                      and not p.internal],
+                               spec="https://drafts.csswg.org/css-cascade-3/#all-shorthand") %>
+ }
+ 
+commit ff25959d0893
+Author: Manish Goregaokar <manishearth@gmail.com>
+Date:   Mon Oct 2 18:53:19 2017 -0700
+
+    Bug 1404057 - stylo: Add crashtest for text-zoom being reenabled within svg:text. r=xidorn, a=ritu
+    
+    MozReview-Commit-ID: 3dIDW8Tz6Mj
+---
+ layout/style/crashtests/1404057.html    | 6 ++++++
+ layout/style/crashtests/crashtests.list | 1 +
+ 2 files changed, 7 insertions(+)
+
+diff --git layout/style/crashtests/1404057.html layout/style/crashtests/1404057.html
+new file mode 100644
+index 000000000000..4c4a33ce495d
+--- /dev/null
++++ layout/style/crashtests/1404057.html
+@@ -0,0 +1,6 @@
++<html>
++  <title>Testcase, bug 143862</title>
++  <head>
++<svg><text><t style='all:initial'>aaa</t></text></svg>
++  </head>
++</html>
+\ No newline at end of file
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index 5eaba6935ee2..70e240d14e2f 100644
+--- layout/style/crashtests/crashtests.list
++++ layout/style/crashtests/crashtests.list
+@@ -205,3 +205,4 @@ asserts-if(stylo,1) load 1404324-1.html # bug 1405605
+ load 1387499.html
+ load 1391577.html
+ load 1398581.html
++load 1404057.html
+commit c883f59323fd
+Author: Manish Goregaokar <manishearth@gmail.com>
+Date:   Tue Oct 3 08:30:34 2017 -0700
+
+    Bug 1404057 - stylo: Add reftest for ensuring lang is not reset by the `all` shorthand. r=xidorn, a=ritu
+    
+    MozReview-Commit-ID: HgjJDwUM6Ju
+---
+ layout/reftests/bugs/1404057-noref.html | 12 ++++++++++++
+ layout/reftests/bugs/1404057-ref.html   | 12 ++++++++++++
+ layout/reftests/bugs/1404057.html       | 12 ++++++++++++
+ layout/reftests/bugs/reftest.list       |  2 ++
+ 4 files changed, 38 insertions(+)
+
+diff --git layout/reftests/bugs/1404057-noref.html layout/reftests/bugs/1404057-noref.html
+new file mode 100644
+index 000000000000..dc734b6b1f5e
+--- /dev/null
++++ layout/reftests/bugs/1404057-noref.html
+@@ -0,0 +1,12 @@
++<!DOCTYPE html>
++<meta charset="UTF-8">
++<style>
++  div {
++    height: 2em;
++  }
++</style>
++<body>
++  <div lang="ja">令</div>
++  <div lang="ja">令</div>
++  <div lang="ja">令</div>
++</body>
+diff --git layout/reftests/bugs/1404057-ref.html layout/reftests/bugs/1404057-ref.html
+new file mode 100644
+index 000000000000..3c06958591be
+--- /dev/null
++++ layout/reftests/bugs/1404057-ref.html
+@@ -0,0 +1,12 @@
++<!DOCTYPE html>
++<meta charset="UTF-8">
++<style>
++  div {
++    height: 2em;
++  }
++</style>
++<body>
++  <div lang="zh-CN">令</div>
++  <div lang="ja">令</div>
++  <div lang="ja">令</div>
++</body>
+diff --git layout/reftests/bugs/1404057.html layout/reftests/bugs/1404057.html
+new file mode 100644
+index 000000000000..3a9e3af26a25
+--- /dev/null
++++ layout/reftests/bugs/1404057.html
+@@ -0,0 +1,12 @@
++<!DOCTYPE html>
++<meta charset="UTF-8">
++<style>
++  div {
++    height: 2em;
++  }
++</style>
++<body lang="zh-CN">
++  <div>令</div>
++  <div lang="ja">令</div>
++  <div><div lang="ja" style="all: inherit">令</div></div>
++</body>
+diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
+index 679672b8c24b..52f8cb915cee 100644
+--- layout/reftests/bugs/reftest.list
++++ layout/reftests/bugs/reftest.list
+@@ -2037,3 +2037,5 @@ needs-focus != 1377447-1.html 1377447-2.html
+ == 1380224-1.html 1380224-1-ref.html
+ == 1384065.html 1384065-ref.html
+ == 1384275-1.html 1384275-1-ref.html
++== 1404057.html 1404057-ref.html
++!= 1404057.html 1404057-noref.html
diff --git a/www/waterfox/files/patch-bug1404180 b/www/waterfox/files/patch-bug1404180
new file mode 100644
index 000000000000..87ad2b6c5382
--- /dev/null
+++ b/www/waterfox/files/patch-bug1404180
@@ -0,0 +1,68 @@
+commit 5d2f7f4ae8d8
+Author: Cameron McCormack <cam@mcc.id.au>
+Date:   Mon Oct 2 13:10:18 2017 +0800
+
+    Bug 1404180 - Don't allow associating form elements by ID to <form>s across anonymous subtree boundaries. r=smaug, a=ritu
+    
+    MozReview-Commit-ID: KRJjrkL4FgZ
+    
+    --HG--
+    extra : source : 123004932443033cc9490e80d52c827d60079c65
+---
+ dom/html/nsGenericHTMLElement.cpp       |  4 +++-
+ layout/style/crashtests/1404180-1.html  | 22 ++++++++++++++++++++++
+ layout/style/crashtests/crashtests.list |  1 +
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git dom/html/nsGenericHTMLElement.cpp dom/html/nsGenericHTMLElement.cpp
+index eda85c9eebaf..54041d7bf071 100644
+--- dom/html/nsGenericHTMLElement.cpp
++++ dom/html/nsGenericHTMLElement.cpp
+@@ -2319,7 +2319,9 @@ nsGenericHTMLFormElement::UpdateFormOwner(bool aBindToTree,
+                      "element should be equals to the current element "
+                      "associated with the id in @form!");
+ 
+-        if (element && element->IsHTMLElement(nsGkAtoms::form)) {
++        if (element &&
++            element->IsHTMLElement(nsGkAtoms::form) &&
++            nsContentUtils::IsInSameAnonymousTree(this, element)) {
+           SetForm(static_cast<HTMLFormElement*>(element), aBindToTree);
+         }
+       }
+diff --git layout/style/crashtests/1404180-1.html layout/style/crashtests/1404180-1.html
+new file mode 100644
+index 000000000000..079d6800f55f
+--- /dev/null
++++ layout/style/crashtests/1404180-1.html
+@@ -0,0 +1,22 @@
++<script>
++function jsfuzzer() {
++  try { htmlvar00016.appendChild(htmlvar00017); } catch(e) { }
++  try { htmlvar00016.form.setAttribute("novalidate", "novalidate"); } catch(e) { }
++  try { htmlvar00017.appendChild(htmlvar00036); } catch(e) { }
++  try { svgvar00007.appendChild(htmlvar00008); } catch(e) { }
++}
++</script>
++<body onload=jsfuzzer()>
++<form id="htmlvar00007">
++<legend id="htmlvar00008">
++<output id="htmlvar00016"></output>
++</legend>
++<link id="htmlvar00017"></link>
++<svg>
++<path id="svgvar00006">
++<animateTransform id="svgvar00007"/>
++</path>
++<use xlink:href="#svgvar00006">
++<table id="htmlvar00036">
++<th>
++<output form="htmlvar00007">
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index d75d5559ec2b..be9a46c52bfa 100644
+--- layout/style/crashtests/crashtests.list
++++ layout/style/crashtests/crashtests.list
+@@ -206,3 +206,4 @@ load 1404324-2.html
+ load 1404324-3.html
+ load 1398581.html
+ load 1404057.html
++load 1404180-1.html
diff --git a/www/waterfox/files/patch-bug1404323 b/www/waterfox/files/patch-bug1404323
new file mode 100644
index 000000000000..20adb23c2c44
--- /dev/null
+++ b/www/waterfox/files/patch-bug1404323
@@ -0,0 +1,27 @@
+commit f9c6b4c7459c
+Author: Lee Salzman <lsalzman@mozilla.com>
+Date:   Fri Sep 29 23:59:40 2017 -0400
+
+    Bug 1404323 - Limit WindowSurfaceX11Image::Commit to clip bounds. r=gankro, a=ritu
+    
+    MozReview-Commit-ID: 55GbZ2EHdbQ
+    
+    --HG--
+    extra : source : 19c2892e7a3ad24b6d235948ef514b20e216b57d
+---
+ widget/gtk/WindowSurfaceX11Image.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git widget/gtk/WindowSurfaceX11Image.cpp widget/gtk/WindowSurfaceX11Image.cpp
+index 5de0288043d6..59db17b642f2 100644
+--- widget/gtk/WindowSurfaceX11Image.cpp
++++ widget/gtk/WindowSurfaceX11Image.cpp
+@@ -93,7 +93,7 @@ WindowSurfaceX11Image::Commit(const LayoutDeviceIntRegion& aInvalidRegion)
+   }
+ 
+   gfx::IntRect bounds = aInvalidRegion.GetBounds().ToUnknownRect();
+-  gfx::Rect rect(0, 0, bounds.XMost(), bounds.YMost());
++  gfx::Rect rect(bounds);
+   if (rect.IsEmpty()) {
+     return;
+   }
diff --git a/www/waterfox/files/patch-bug1404714 b/www/waterfox/files/patch-bug1404714
new file mode 100644
index 000000000000..5c867926d439
--- /dev/null
+++ b/www/waterfox/files/patch-bug1404714
@@ -0,0 +1,34 @@
+commit 867b599b37e0
+Author: Benjamin Bouvier <benj@benj.me>
+Date:   Tue Oct 3 19:57:05 2017 +0200
+
+    Bug 1404714 - inIon() should return false when in wasm. r=nbp, a=test-only on a CLOSED TREE
+    
+    MozReview-Commit-ID: 76qU9UjcROt
+    
+    --HG--
+    extra : source : 6956f4fcbb7973e93c7314eb8bb9e7f8de93b96f
+    extra : amend_source : ed03aa30810d829dbf0951ccbc7aaab805afa280
+    extra : intermediate-source : d5f57ad0a0fb5b362ed6abc150aa1038a1555fa5
+---
+ js/src/builtin/TestingFunctions.cpp | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git js/src/builtin/TestingFunctions.cpp js/src/builtin/TestingFunctions.cpp
+index cf2f0e3ecc2a..5cc776d0a7cc 100644
+--- js/src/builtin/TestingFunctions.cpp
++++ js/src/builtin/TestingFunctions.cpp
+@@ -2199,6 +2199,13 @@ testingFunc_inIon(JSContext* cx, unsigned argc, Value* vp)
+         return true;
+     }
+ 
++    if (cx->activation()->isWasm()) {
++        // Exited through wasm. Note this is false when the fast wasm->jit exit
++        // was taken, in which case we actually have jit frames on the stack.
++        args.rval().setBoolean(false);
++        return true;
++    }
++
+     ScriptFrameIter iter(cx);
+     if (!iter.done() && iter.isIon()) {
+         // Reset the counter of the IonScript's script.
diff --git a/www/waterfox/files/patch-bug1404760 b/www/waterfox/files/patch-bug1404760
new file mode 100644
index 000000000000..68cf6f5f73b6
--- /dev/null
+++ b/www/waterfox/files/patch-bug1404760
@@ -0,0 +1,65 @@
+commit a73710615fe2
+Author: Lars T Hansen <lhansen@mozilla.com>
+Date:   Mon Oct 2 10:45:26 2017 +0200
+
+    Bug 1404760 - wasm baseline, disable branch optimization for int64 on x86 to avoid register starvation. r=bbouvier, a=ritu
+    
+    --HG--
+    extra : source : c80e87f3242679c9e9548592f27173871824b681
+    extra : intermediate-source : 12d671fcc1f1c25898ebb0723e1eb0b20b5b4838
+---
+ .../jit-test/tests/wasm/regress/baseline-i64-opt-cmp.js  | 16 ++++++++++++++++
+ js/src/wasm/WasmBaselineCompile.cpp                      | 14 ++++++++------
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git js/src/jit-test/tests/wasm/regress/baseline-i64-opt-cmp.js js/src/jit-test/tests/wasm/regress/baseline-i64-opt-cmp.js
+new file mode 100644
+index 000000000000..aad892558a15
+--- /dev/null
++++ js/src/jit-test/tests/wasm/regress/baseline-i64-opt-cmp.js
+@@ -0,0 +1,16 @@
++// Bug 1404760: Optimized compare-and-branch with a preserved value would fail
++// the baseline compiler on x86 debug builds (and would just generate bad code
++// on non-debug builds) because of register starvation.
++
++wasmEvalText(
++    `(module
++      (func $run (param i64) (param i64) (result i64)
++        block i64
++	  i64.const 1
++          (i64.lt_s (get_local 0) (get_local 1))
++	  br_if 0
++	  drop
++          i64.const 2
++        end)
++      (export "run" $run))`
++);
+diff --git js/src/wasm/WasmBaselineCompile.cpp js/src/wasm/WasmBaselineCompile.cpp
+index bf83cbb3f818..50de676de678 100644
+--- js/src/wasm/WasmBaselineCompile.cpp
++++ js/src/wasm/WasmBaselineCompile.cpp
+@@ -5212,16 +5212,18 @@ BaseCompiler::sniffConditionalControlCmp(Cond compareOp, ValType operandType)
+ {
+     MOZ_ASSERT(latentOp_ == LatentOp::None, "Latent comparison state not properly reset");
+ 
++#ifdef JS_CODEGEN_X86
++    // On x86, latent i64 binary comparisons use too many registers: the
++    // reserved join register and the lhs and rhs operands require six, but we
++    // only have five.
++    if (operandType == ValType::I64)
++        return false;
++#endif
++
+     OpBytes op;
+     iter_.peekOp(&op);
+     switch (op.b0) {
+       case uint16_t(Op::Select):
+-#ifdef JS_CODEGEN_X86
+-        // On x86, with only 5 available registers, a latent i64 binary
+-        // comparison takes 4 leaving only 1 which is not enough for select.
+-        if (operandType == ValType::I64)
+-            return false;
+-#endif
+         MOZ_FALLTHROUGH;
+       case uint16_t(Op::BrIf):
+       case uint16_t(Op::If):
diff --git a/www/waterfox/files/patch-bug1405267 b/www/waterfox/files/patch-bug1405267
new file mode 100644
index 000000000000..63fc86f584b9
--- /dev/null
+++ b/www/waterfox/files/patch-bug1405267
@@ -0,0 +1,32 @@
+commit 28e925727f61
+Author: Chris Coulson <chrisccoulson@ubuntu.com>
+Date:   Tue Oct 3 04:58:00 2017 -0400
+
+    Bug 1405267 - Don't stub gdk_window_get_window_type in mozgtk2. r=karlt, a=ritu
+    
+    --HG--
+    extra : source : d06512adfab5cc90d985a1b814e8ba3dc4b81fff
+---
+ widget/gtk/mozgtk/mozgtk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git widget/gtk/mozgtk/mozgtk.c widget/gtk/mozgtk/mozgtk.c
+index 7285b7f001ac..9a5498a173fd 100644
+--- widget/gtk/mozgtk/mozgtk.c
++++ widget/gtk/mozgtk/mozgtk.c
+@@ -95,6 +95,7 @@ STUB(gdk_window_get_update_area)
+ STUB(gdk_window_get_user_data)
+ STUB(gdk_window_get_visual)
+ STUB(gdk_window_get_width)
++STUB(gdk_window_get_window_type)
+ STUB(gdk_window_hide)
+ STUB(gdk_window_input_shape_combine_region)
+ STUB(gdk_window_invalidate_rect)
+@@ -520,7 +521,6 @@ STUB(gdk_error_trap_pop_ignored)
+ STUB(gdk_event_get_source_device)
+ STUB(gdk_screen_get_monitor_workarea)
+ STUB(gdk_window_get_type)
+-STUB(gdk_window_get_window_type)
+ STUB(gdk_x11_window_get_xid)
+ STUB(gdk_x11_display_get_type)
+ STUB(gdk_wayland_display_get_type)
diff --git a/www/waterfox/files/patch-bug1405377 b/www/waterfox/files/patch-bug1405377
new file mode 100644
index 000000000000..4f6a39347fbc
--- /dev/null
+++ b/www/waterfox/files/patch-bug1405377
@@ -0,0 +1,31 @@
+commit 3036b2933fde
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Tue Oct 3 19:29:36 2017 +0100
+
+    Bug 1405377 - Remove trailing separator in recently closed tabs/windows subviews. r=mikedeboer, a=ritu
+    
+    The third param of 'getTabsFragment' and 'getWindowsFragment' toggles whether the 'restore all' item
+    gets prefixed (true) or suffixed (false). The prefixed version doesn't get a separator, so this
+    seems like the simplest fix.
+    
+    MozReview-Commit-ID: BzKWvndWUMp
+    
+    --HG--
+    extra : source : ed7b92c9eca5e1faa1b193918f0b9ddf7fc9c0e5
+---
+ browser/components/customizableui/CustomizableWidgets.jsm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git browser/components/customizableui/CustomizableWidgets.jsm browser/components/customizableui/CustomizableWidgets.jsm
+index fb12d40da42d..b197d2d72fdc 100644
+--- browser/components/customizableui/CustomizableWidgets.jsm
++++ browser/components/customizableui/CustomizableWidgets.jsm
+@@ -215,7 +215,7 @@ const CustomizableWidgets = [
+ 
+       let utils = RecentlyClosedTabsAndWindowsMenuUtils;
+       let method = `get${viewType}Fragment`;
+-      let fragment = utils[method](window, "toolbarbutton");
++      let fragment = utils[method](window, "toolbarbutton", true);
+       let elementCount = fragment.childElementCount;
+       this._panelMenuView._setEmptyPopupStatus(panelview, !elementCount);
+       if (!elementCount)
diff --git a/www/waterfox/files/patch-bug1405635 b/www/waterfox/files/patch-bug1405635
new file mode 100644
index 000000000000..c4a015d63fb1
--- /dev/null
+++ b/www/waterfox/files/patch-bug1405635
@@ -0,0 +1,100 @@
+commit c10a94980921
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Thu Oct 5 05:49:06 2017 -0500
+
+    Bug 1405635 - style: Use the flattened tree parent to find the closest non-nac ancestor of an element. r=bzbarsky, a=ritu
+    
+    This only matters for document level NAC like canvas custom content, in which
+    case otherwise we inherit from the document element (which is wrong).
+    
+    Source-Repo: https://github.com/servo/servo
+    Source-Revision: 35e84c5cdf9cad0f16f94525d425a3b881b3b524
+    
+    --HG--
+    extra : source : 657529d410eb93f3e89cde5e11b9ca7a6f882d39
+---
+ servo/components/style/gecko/wrapper.rs | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git servo/components/style/gecko/wrapper.rs servo/components/style/gecko/wrapper.rs
+index 1d6864a482bd..353bbeeedffc 100644
+--- servo/components/style/gecko/wrapper.rs
++++ servo/components/style/gecko/wrapper.rs
+@@ -934,7 +934,7 @@ impl<'le> TElement for GeckoElement<'le> {
+ 
+     fn closest_non_native_anonymous_ancestor(&self) -> Option<Self> {
+         debug_assert!(self.is_native_anonymous());
+-        let mut parent = match self.parent_element() {
++        let mut parent = match self.traversal_parent() {
+             Some(e) => e,
+             None => return None,
+         };
+@@ -944,7 +944,7 @@ impl<'le> TElement for GeckoElement<'le> {
+                 return Some(parent);
+             }
+ 
+-            parent = match parent.parent_element() {
++            parent = match parent.traversal_parent() {
+                 Some(p) => p,
+                 None => return None,
+             };
+commit efb04b1d1114
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Thu Oct 5 01:40:48 2017 +0200
+
+    Bug 1405635 - Test that custom content doesn't inherit from the root element. r=bholley, a=ritu
+    
+    MozReview-Commit-ID: GvjsdQk5Wt4
+    
+    --HG--
+    extra : source : 777faf67f590f1d1c64f1b09601a7974a8f627ce
+---
+ layout/style/test/mochitest.ini                    |  2 ++
+ .../test/test_custom_content_inheritance.html      | 26 ++++++++++++++++++++++
+ 2 files changed, 28 insertions(+)
+
+diff --git layout/style/test/mochitest.ini layout/style/test/mochitest.ini
+index dafe0434981c..5a8beed3b103 100644
+--- layout/style/test/mochitest.ini
++++ layout/style/test/mochitest.ini
+@@ -194,6 +194,8 @@ skip-if = toolkit == 'android' #bug 536603
+ [test_css_parse_error_smoketest.html]
+ [test_css_supports.html]
+ [test_css_supports_variables.html]
++[test_custom_content_inheritance.html]
++skip-if = !stylo # Gecko fails this and messes up inheritance
+ [test_default_bidi_css.html]
+ [test_default_computed_style.html]
+ [test_descriptor_storage.html]
+diff --git layout/style/test/test_custom_content_inheritance.html layout/style/test/test_custom_content_inheritance.html
+new file mode 100644
+index 000000000000..ccbce86574bb
+--- /dev/null
++++ layout/style/test/test_custom_content_inheritance.html
+@@ -0,0 +1,26 @@
++<!doctype html>
++<title>Test for custom content inheritance</title>
++<style>
++  html { color: red !important; }
++</style>
++<script src="/tests/SimpleTest/SimpleTest.js"></script>
++<script>
++onload = function() {
++  try {
++    let doc = SpecialPowers.wrap(document);
++    let div = doc.createElement('div');
++    div.id = "test-id";
++    ok(!!doc.insertAnonymousContent,
++       "Must have the insertAnonymousContent API");
++    let content = doc.insertAnonymousContent(div);
++    ok(!!content, "Must have anon content");
++    isnot(content.getComputedStylePropertyValue("test-id", "color"),
++          getComputedStyle(document.documentElement).color,
++          "Custom anon content shouldn't inherit from the root element");
++  } catch(e) {
++    ok(false, "Threw: " + e);
++  }
++  SimpleTest.finish();
++};
++SimpleTest.waitForExplicitFinish();
++</script>
diff --git a/www/waterfox/files/patch-bug1405720 b/www/waterfox/files/patch-bug1405720
new file mode 100644
index 000000000000..c316067d398a
--- /dev/null
+++ b/www/waterfox/files/patch-bug1405720
@@ -0,0 +1,122 @@
+commit f0664b7a8e76
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Thu Oct 5 15:17:12 2017 +0100
+
+    Bug 1405720 - Ensure only 1 theme is ever shown as selected in customize mode. r=jaws, r=johannh, a=ritu
+    
+    The previous code here always set the `isActive` property on all themes. When writing the
+    patch for bug 1402981 I ran into issues because the default theme has an `isActive` property
+    anyway (it's a different type of object). So I tried to avoid setting `isActive` if it was
+    already present. Unfortunately, the result was that `isActive` values, once set, weren't
+    correctly updated. Worse, these values are (and were, prior to bug 1402981) persisted in
+    some cases.
+    
+    There's no point persisting these values, all that will happen is that they'll start
+    mismatching the 'real' state of the world (LightweightThemeManager.currentTheme). So instead,
+    let's just not set the `isActive` property at all, and rely solely on the ID of the current
+    theme (or the default theme's ID, now that we no longer support non-lightweight-themes) to
+    establish whether any of the themes should appear selected or not.
+    
+    MozReview-Commit-ID: 7rajS71FoQR
+    
+    --HG--
+    extra : source : 4099fa94e3ba6728761655f0e11e7b65d573617d
+---
+ .../components/customizableui/CustomizeMode.jsm    | 13 ++++------
+ .../browser_1007336_lwthemes_in_customize_mode.js  | 28 +++++++++++++++++++---
+ 2 files changed, 30 insertions(+), 11 deletions(-)
+
+diff --git browser/components/customizableui/CustomizeMode.jsm browser/components/customizableui/CustomizeMode.jsm
+index b0e31cad63fc..79f23079b1a0 100644
+--- browser/components/customizableui/CustomizeMode.jsm
++++ browser/components/customizableui/CustomizeMode.jsm
+@@ -1358,9 +1358,10 @@ CustomizeMode.prototype = {
+           tbb.setAttribute("tooltiptext", aTheme.description);
+         tbb.setAttribute("tabindex", "0");
+         tbb.classList.add("customization-lwtheme-menu-theme");
+-        tbb.setAttribute("aria-checked", aTheme.isActive);
++        let isActive = activeThemeID == aTheme.id;
++        tbb.setAttribute("aria-checked", isActive);
+         tbb.setAttribute("role", "menuitemradio");
+-        if (aTheme.isActive) {
++        if (isActive) {
+           tbb.setAttribute("active", "true");
+         }
+         tbb.addEventListener("focus", previewTheme);
+@@ -1374,12 +1375,8 @@ CustomizeMode.prototype = {
+       let themes = [aDefaultTheme];
+       let lwts = LightweightThemeManager.usedThemes;
+       let currentLwt = LightweightThemeManager.currentTheme;
+-      // The lwts besides the builtin themes don't have an isActive property:
+-      for (let lwt of lwts) {
+-        if (!lwt.hasOwnProperty("isActive")) {
+-          lwt.isActive = !!currentLwt && (lwt.id == currentLwt.id);
+-        }
+-      }
++
++      let activeThemeID = currentLwt ? currentLwt.id : DEFAULT_THEME_ID;
+ 
+       // Move the current theme (if any) and the light/dark themes to the start:
+       let importantThemes = [LIGHT_THEME_ID, DARK_THEME_ID];
+diff --git browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
+index 3ee8f9b8f697..7b94289c0177 100644
+--- browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
++++ browser/components/customizableui/test/browser_1007336_lwthemes_in_customize_mode.js
+@@ -45,9 +45,25 @@ add_task(async function() {
+   is(header.nextSibling.nextSibling.nextSibling.theme.id, DARK_THEME_ID,
+      "The third theme should be the dark theme");
+ 
++  let themeChangedPromise = promiseObserverNotified("lightweight-theme-changed");
++  header.nextSibling.nextSibling.doCommand(); // Select light theme
++  info("Clicked on light theme");
++  await themeChangedPromise;
++
++  popupShownPromise = popupShown(popup);
++  EventUtils.synthesizeMouseAtCenter(themesButton, {});
++  info("Clicked on themes button a third time");
++  await popupShownPromise;
++
++  let activeThemes = popup.querySelectorAll("toolbarbutton.customization-lwtheme-menu-theme[active]");
++  is(activeThemes.length, 1, "Exactly 1 theme should be selected");
++  if (activeThemes.length > 0) {
++    is(activeThemes[0].theme.id, LIGHT_THEME_ID, "Light theme should be selected");
++  }
++
+   let firstLWTheme = recommendedHeader.nextSibling;
+   let firstLWThemeId = firstLWTheme.theme.id;
+-  let themeChangedPromise = promiseObserverNotified("lightweight-theme-changed");
++  themeChangedPromise = promiseObserverNotified("lightweight-theme-changed");
+   firstLWTheme.doCommand();
+   info("Clicked on first theme");
+   await themeChangedPromise;
+@@ -57,6 +73,12 @@ add_task(async function() {
+   info("Clicked on themes button");
+   await popupShownPromise;
+ 
++  activeThemes = popup.querySelectorAll("toolbarbutton.customization-lwtheme-menu-theme[active]");
++  is(activeThemes.length, 1, "Exactly 1 theme should be selected");
++  if (activeThemes.length > 0) {
++    is(activeThemes[0].theme.id, firstLWThemeId, "First theme should be selected");
++  }
++
+   is(header.nextSibling.theme.id, DEFAULT_THEME_ID, "The first theme should be the Default theme");
+   let installedThemeId = header.nextSibling.nextSibling.nextSibling.nextSibling.theme.id;
+   ok(installedThemeId.startsWith(firstLWThemeId),
+@@ -78,7 +100,7 @@ add_task(async function() {
+   // ensure current theme isn't set to "Default"
+   popupShownPromise = popupShown(popup);
+   EventUtils.synthesizeMouseAtCenter(themesButton, {});
+-  info("Clicked on themes button a second time");
++  info("Clicked on themes button a fourth time");
+   await popupShownPromise;
+ 
+   firstLWTheme = recommendedHeader.nextSibling;
+@@ -98,7 +120,7 @@ add_task(async function() {
+   await startCustomizing();
+   popupShownPromise = popupShown(popup);
+   EventUtils.synthesizeMouseAtCenter(themesButton, {});
+-  info("Clicked on themes button a second time");
++  info("Clicked on themes button a fifth time");
+   await popupShownPromise;
+   header = document.getElementById("customization-lwtheme-menu-header");
+   is(header.hidden, false, "Header should never be hidden");
diff --git a/www/waterfox/files/patch-bug1416523 b/www/waterfox/files/patch-bug1416523
new file mode 100644
index 000000000000..10f4e4268061
--- /dev/null
+++ b/www/waterfox/files/patch-bug1416523
@@ -0,0 +1,46 @@
+commit aeff426f078d
+Author: Brian Hackett <bhackett1024@gmail.com>
+Date:   Tue Feb 6 14:11:34 2018 -0500
+
+    Bug 1416523 - Don't attach arguments stub if the IC isn't monitored. r=jandem a=abillings
+    
+    --HG--
+    extra : rebase_source : d1797b87843df0aea266bd7d1e0c98e9809b1291
+    extra : source : 5fc563433fcfc2a08400988c247ccb23e45129d4
+---
+ js/src/jit/CacheIR.cpp | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git js/src/jit/CacheIR.cpp js/src/jit/CacheIR.cpp
+index 22c0111756d8..aeef8f84d233 100644
+--- js/src/jit/CacheIR.cpp
++++ js/src/jit/CacheIR.cpp
+@@ -286,7 +286,7 @@ GetPropIRGenerator::tryAttachIdempotentStub()
+         return true;
+ 
+     // Object lengths are supported only if int32 results are allowed.
+-    if ((resultFlags_ & GetPropertyResultFlags::AllowInt32) && tryAttachObjectLength(obj, objId, id))
++    if (tryAttachObjectLength(obj, objId, id))
+         return true;
+ 
+     // Also support native data properties on DOMProxy prototypes.
+@@ -1433,6 +1433,9 @@ GetPropIRGenerator::tryAttachObjectLength(HandleObject obj, ObjOperandId objId,
+     if (!JSID_IS_ATOM(id, cx_->names().length))
+         return false;
+ 
++    if (!(resultFlags_ & GetPropertyResultFlags::AllowInt32))
++        return false;
++
+     if (obj->is<ArrayObject>()) {
+         // Make sure int32 is added to the TypeSet before we attach a stub, so
+         // the stub can return int32 values without monitoring the result.
+@@ -1697,6 +1700,9 @@ GetPropIRGenerator::tryAttachArgumentsObjectArg(HandleObject obj, ObjOperandId o
+     if (!obj->is<ArgumentsObject>() || obj->as<ArgumentsObject>().hasOverriddenElement())
+         return false;
+ 
++    if (!(resultFlags_ & GetPropertyResultFlags::Monitored))
++        return false;
++
+     if (obj->is<MappedArgumentsObject>()) {
+         writer.guardClass(objId, GuardClassKind::MappedArguments);
+     } else {
diff --git a/www/waterfox/files/patch-bug1418757 b/www/waterfox/files/patch-bug1418757
new file mode 100644
index 000000000000..139fce6ec8c7
--- /dev/null
+++ b/www/waterfox/files/patch-bug1418757
@@ -0,0 +1,169 @@
+commit 1b3df31dd202
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Wed Nov 22 13:49:07 2017 +0000
+
+    Bug 1418757 - new tab button isn't adjacent to the last tab when customizing in customize mode, r=jaws a=gchang
+    
+    MozReview-Commit-ID: bQoNfDD2sX
+    
+    --HG--
+    extra : histedit_source : 15b29e1c8e8ba295ecbd76d266de3611862a72c3
+---
+ browser/base/content/tabbrowser.xml                |  15 ++-
+ browser/components/customizableui/test/browser.ini |   1 +
+ .../test/browser_newtab_button_customizemode.js    | 106 +++++++++++++++++++++
+ 3 files changed, 121 insertions(+), 1 deletion(-)
+
+diff --git browser/base/content/tabbrowser.xml browser/base/content/tabbrowser.xml
+index dc4560e0f5b2..a13df7715f2d 100644
+--- browser/base/content/tabbrowser.xml
++++ browser/base/content/tabbrowser.xml
+@@ -5448,10 +5448,23 @@
+ 
+       <method name="_updateNewTabVisibility">
+         <body><![CDATA[
++          let isCustomizing = this.tabContainer.parentNode.getAttribute("customizing") == "true";
++
++          // Confusingly, the <tabs> are never wrapped in <toolbarpaletteitem>s in customize mode,
++          // but the other items will be.
+           let sib = this.tabContainer.nextElementSibling;
++          if (isCustomizing) {
++            sib = sib && sib.firstElementChild;
++          }
+           while (sib && sib.hidden) {
+-            sib = sib.nextElementSibling;
++            if (isCustomizing) {
++              sib = sib.parentNode.nextElementSibling;
++              sib = sib && sib.firstElementChild;
++            } else {
++              sib = sib.nextElementSibling;
++            }
+           }
++
+           const kAttr = "hasadjacentnewtabbutton";
+           if (sib && sib.id == "new-tab-button") {
+             this.tabContainer.setAttribute(kAttr, "true");
+diff --git browser/components/customizableui/test/browser.ini browser/components/customizableui/test/browser.ini
+index d5f5eaf2a113..b164a573f094 100644
+--- browser/components/customizableui/test/browser.ini
++++ browser/components/customizableui/test/browser.ini
+@@ -164,6 +164,7 @@ tags = fullscreen
+ [browser_check_tooltips_in_navbar.js]
+ [browser_editcontrols_update.js]
+ subsuite = clipboard
++[browser_newtab_button_customizemode.js]
+ [browser_photon_customization_context_menus.js]
+ [browser_sidebar_toggle.js]
+ [browser_remote_tabs_button.js]
+diff --git browser/components/customizableui/test/browser_newtab_button_customizemode.js browser/components/customizableui/test/browser_newtab_button_customizemode.js
+new file mode 100644
+index 000000000000..da886fc47376
+--- /dev/null
++++ browser/components/customizableui/test/browser_newtab_button_customizemode.js
+@@ -0,0 +1,106 @@
++/* Any copyright is dedicated to the Public Domain.
++ * http://creativecommons.org/publicdomain/zero/1.0/ */
++
++"use strict";
++
++/**
++ * Tests in this file check that user customizations to the tabstrip show
++ * the correct type of new tab button while the tabstrip isn't overflowing.
++ */
++
++const kGlobalNewTabButton = document.getElementById("new-tab-button");
++const kInnerNewTabButton = document.getAnonymousElementByAttribute(gBrowser.tabContainer, "anonid", "tabs-newtab-button");
++
++function assertNewTabButton(which) {
++  if (which == "global") {
++    isnot(kGlobalNewTabButton.getBoundingClientRect().width, 0,
++      "main new tab button should be visible");
++    is(kInnerNewTabButton.getBoundingClientRect().width, 0,
++      "inner new tab button should be hidden");
++  } else if (which == "inner") {
++    is(kGlobalNewTabButton.getBoundingClientRect().width, 0,
++      "main new tab button should be hidden");
++    isnot(kInnerNewTabButton.getBoundingClientRect().width, 0,
++      "inner new tab button should be visible");
++  } else {
++    ok(false, "Unexpected button: " + which);
++  }
++}
++
++/**
++ * Add and remove items *after* the new tab button in customize mode.
++ */
++add_task(async function addremove_after_newtab_customizemode() {
++  await startCustomizing();
++  simulateItemDrag(document.getElementById("home-button"),
++                   kGlobalNewTabButton.parentNode.nextElementSibling);
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should have the adjacent newtab attribute");
++  await endCustomizing();
++  assertNewTabButton("inner");
++
++  await startCustomizing();
++  simulateItemDrag(document.getElementById("home-button"),
++    document.getElementById("stop-reload-button").parentNode.nextElementSibling);
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should still have the adjacent newtab attribute");
++  await endCustomizing();
++  assertNewTabButton("inner");
++  ok(CustomizableUI.inDefaultState, "Should be in default state");
++});
++
++/**
++ * Add and remove items *before* the new tab button in customize mode.
++ */
++add_task(async function addremove_before_newtab_customizemode() {
++  await startCustomizing();
++  simulateItemDrag(document.getElementById("home-button"), kGlobalNewTabButton);
++  ok(!gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should no longer have the adjacent newtab attribute");
++  await endCustomizing();
++  assertNewTabButton("global");
++  await startCustomizing();
++  simulateItemDrag(document.getElementById("home-button"),
++    document.getElementById("stop-reload-button").parentNode.nextElementSibling);
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should have the adjacent newtab attribute again");
++  await endCustomizing();
++  assertNewTabButton("inner");
++  ok(CustomizableUI.inDefaultState, "Should be in default state");
++});
++
++/**
++ * Add and remove items *after* the new tab button outside of customize mode.
++ */
++add_task(async function addremove_after_newtab_api() {
++  CustomizableUI.addWidgetToArea("home-button", "TabsToolbar");
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should have the adjacent newtab attribute");
++  assertNewTabButton("inner");
++
++  CustomizableUI.reset();
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should still have the adjacent newtab attribute");
++  assertNewTabButton("inner");
++  ok(CustomizableUI.inDefaultState, "Should be in default state");
++
++});
++
++/**
++ * Add and remove items *before* the new tab button outside of customize mode.
++ */
++add_task(async function addremove_before_newtab_api() {
++  let index = CustomizableUI.getWidgetIdsInArea("TabsToolbar").indexOf("new-tab-button");
++  CustomizableUI.addWidgetToArea("home-button", "TabsToolbar", index);
++  ok(!gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should no longer have the adjacent newtab attribute");
++  assertNewTabButton("global");
++
++  CustomizableUI.removeWidgetFromArea("home-button");
++  ok(gBrowser.tabContainer.hasAttribute("hasadjacentnewtabbutton"),
++    "tabs should have the adjacent newtab attribute again");
++  assertNewTabButton("inner");
++
++  CustomizableUI.reset();
++  ok(CustomizableUI.inDefaultState, "Should be in default state");
++});
diff --git a/www/waterfox/files/patch-bug1422036 b/www/waterfox/files/patch-bug1422036
new file mode 100644
index 000000000000..3f19764927f5
--- /dev/null
+++ b/www/waterfox/files/patch-bug1422036
@@ -0,0 +1,229 @@
+commit 74ed31e949fa
+Author: Andrea Marchesini <amarchesini@mozilla.com>
+Date:   Mon Feb 5 19:55:08 2018 +0100
+
+    Bug 1422036 - Using WorkerControlRunnable to release resources in fetch when the worker is shutting down. r=catalinb, a=RyanVM
+    
+    --HG--
+    extra : source : d79788e03f7451ebc4a3c694117497f091a5a129
+---
+ dom/fetch/FetchConsumer.cpp | 123 +++++++++++++++++++++++++++++++++++++-------
+ dom/fetch/FetchConsumer.h   |   5 +-
+ 2 files changed, 106 insertions(+), 22 deletions(-)
+
+diff --git dom/fetch/FetchConsumer.cpp dom/fetch/FetchConsumer.cpp
+index b83c8671404a..1e173f9c9661 100644
+--- dom/fetch/FetchConsumer.cpp
++++ dom/fetch/FetchConsumer.cpp
+@@ -102,6 +102,32 @@ public:
+   }
+ };
+ 
++// ControlRunnable used to complete the releasing of resources on the worker
++// thread when already shutting down.
++template <class Derived>
++class ContinueConsumeBodyControlRunnable final : public MainThreadWorkerControlRunnable
++{
++  RefPtr<FetchBodyConsumer<Derived>> mFetchBodyConsumer;
++
++public:
++  ContinueConsumeBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer,
++                                     uint8_t* aResult)
++    : MainThreadWorkerControlRunnable(aFetchBodyConsumer->GetWorkerPrivate())
++    , mFetchBodyConsumer(aFetchBodyConsumer)
++  {
++    MOZ_ASSERT(NS_IsMainThread());
++    free(aResult);
++  }
++
++  bool
++  WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate) override
++  {
++    mFetchBodyConsumer->ContinueConsumeBody(NS_BINDING_ABORTED, 0, nullptr,
++                                            true /* shutting down */);
++    return true;
++  }
++};
++
+ template <class Derived>
+ class FailConsumeBodyWorkerRunnable : public MainThreadWorkerControlRunnable
+ {
+@@ -189,6 +215,31 @@ public:
+   }
+ };
+ 
++// ControlRunnable used to complete the releasing of resources on the worker
++// thread when already shutting down.
++template <class Derived>
++class ContinueConsumeBlobBodyControlRunnable final
++  : public MainThreadWorkerControlRunnable
++{
++  RefPtr<FetchBodyConsumer<Derived>> mFetchBodyConsumer;
++
++public:
++  explicit ContinueConsumeBlobBodyControlRunnable(FetchBodyConsumer<Derived>* aFetchBodyConsumer)
++    : MainThreadWorkerControlRunnable(aFetchBodyConsumer->GetWorkerPrivate())
++    , mFetchBodyConsumer(aFetchBodyConsumer)
++  {
++    MOZ_ASSERT(NS_IsMainThread());
++  }
++
++  bool
++  WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate) override
++  {
++    mFetchBodyConsumer->ContinueConsumeBlobBody(nullptr,
++                                                true /* shutting down */);
++    return true;
++  }
++};
++
+ template <class Derived>
+ class ConsumeBodyDoneObserver : public nsIStreamLoaderObserver
+                               , public MutableBlobStorageCallback
+@@ -216,20 +267,33 @@ public:
+     mFetchBodyConsumer->NullifyConsumeBodyPump();
+ 
+     uint8_t* nonconstResult = const_cast<uint8_t*>(aResult);
+-    if (mFetchBodyConsumer->GetWorkerPrivate()) {
++    if (!mFetchBodyConsumer->GetWorkerPrivate()) {
++      mFetchBodyConsumer->ContinueConsumeBody(aStatus, aResultLength,
++                                              nonconstResult);
++      // FetchBody is responsible for data.
++      return NS_SUCCESS_ADOPTED_DATA;
++    }
++
++    {
+       RefPtr<ContinueConsumeBodyRunnable<Derived>> r =
+         new ContinueConsumeBodyRunnable<Derived>(mFetchBodyConsumer,
+                                                  aStatus,
+                                                  aResultLength,
+                                                  nonconstResult);
+-      if (!r->Dispatch()) {
+-        NS_WARNING("Could not dispatch ConsumeBodyRunnable");
+-        // Return failure so that aResult is freed.
+-        return NS_ERROR_FAILURE;
++      if (r->Dispatch()) {
++        // FetchBody is responsible for data.
++        return NS_SUCCESS_ADOPTED_DATA;
+       }
+-    } else {
+-      mFetchBodyConsumer->ContinueConsumeBody(aStatus, aResultLength,
+-                                              nonconstResult);
++    }
++
++    // The worker is shutting down. Let's use a control runnable to complete the
++    // shutting down procedure.
++
++    RefPtr<ContinueConsumeBodyControlRunnable<Derived>> r =
++      new ContinueConsumeBodyControlRunnable<Derived>(mFetchBodyConsumer,
++                                                      nonconstResult);
++    if (NS_WARN_IF(!r->Dispatch())) {
++      return NS_ERROR_FAILURE;
+     }
+ 
+     // FetchBody is responsible for data.
+@@ -252,18 +316,28 @@ public:
+ 
+     MOZ_ASSERT(aBlob);
+ 
+-    if (mFetchBodyConsumer->GetWorkerPrivate()) {
++    if (!mFetchBodyConsumer->GetWorkerPrivate()) {
++      mFetchBodyConsumer->ContinueConsumeBlobBody(aBlob->Impl());
++      return;
++    }
++
++    {
+       RefPtr<ContinueConsumeBlobBodyRunnable<Derived>> r =
+         new ContinueConsumeBlobBodyRunnable<Derived>(mFetchBodyConsumer,
+                                                      aBlob->Impl());
+ 
+-      if (!r->Dispatch()) {
+-        NS_WARNING("Could not dispatch ConsumeBlobBodyRunnable");
++      if (r->Dispatch()) {
+         return;
+       }
+-    } else {
+-      mFetchBodyConsumer->ContinueConsumeBlobBody(aBlob->Impl());
+     }
++
++    // The worker is shutting down. Let's use a control runnable to complete the
++    // shutting down procedure.
++
++    RefPtr<ContinueConsumeBlobBodyControlRunnable<Derived>> r =
++      new ContinueConsumeBlobBodyControlRunnable<Derived>(mFetchBodyConsumer);
++
++    Unused << NS_WARN_IF(!r->Dispatch());
+   }
+ 
+ private:
+@@ -525,7 +599,8 @@ template <class Derived>
+ void
+ FetchBodyConsumer<Derived>::ContinueConsumeBody(nsresult aStatus,
+                                                 uint32_t aResultLength,
+-                                                uint8_t* aResult)
++                                                uint8_t* aResult,
++                                                bool aShuttingDown)
+ {
+   AssertIsOnTargetThread();
+ 
+@@ -550,6 +625,11 @@ FetchBodyConsumer<Derived>::ContinueConsumeBody(nsresult aStatus,
+     self->ReleaseObject();
+   });
+ 
++  if (aShuttingDown) {
++    // If shutting down, we don't want to resolve any promise.
++    return;
++  }
++
+   if (NS_WARN_IF(NS_FAILED(aStatus))) {
+     localPromise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+   }
+@@ -632,7 +712,8 @@ FetchBodyConsumer<Derived>::ContinueConsumeBody(nsresult aStatus,
+ 
+ template <class Derived>
+ void
+-FetchBodyConsumer<Derived>::ContinueConsumeBlobBody(BlobImpl* aBlobImpl)
++FetchBodyConsumer<Derived>::ContinueConsumeBlobBody(BlobImpl* aBlobImpl,
++                                                    bool aShuttingDown)
+ {
+   AssertIsOnTargetThread();
+   MOZ_ASSERT(mConsumeType == CONSUME_BLOB);
+@@ -646,13 +727,15 @@ FetchBodyConsumer<Derived>::ContinueConsumeBlobBody(BlobImpl* aBlobImpl)
+   // sync with a body read.
+   MOZ_ASSERT(mBody->BodyUsed());
+ 
+-  MOZ_ASSERT(mConsumePromise);
+-  RefPtr<Promise> localPromise = mConsumePromise.forget();
++  if (!aShuttingDown) {
++    MOZ_ASSERT(mConsumePromise);
++    RefPtr<Promise> localPromise = mConsumePromise.forget();
+ 
+-  RefPtr<dom::Blob> blob = dom::Blob::Create(mGlobal, aBlobImpl);
+-  MOZ_ASSERT(blob);
++    RefPtr<dom::Blob> blob = dom::Blob::Create(mGlobal, aBlobImpl);
++    MOZ_ASSERT(blob);
+ 
+-  localPromise->MaybeResolve(blob);
++    localPromise->MaybeResolve(blob);
++  }
+ 
+   ReleaseObject();
+ }
+diff --git dom/fetch/FetchConsumer.h dom/fetch/FetchConsumer.h
+index 04b02aee5d4b..d45b62b8379b 100644
+--- dom/fetch/FetchConsumer.h
++++ dom/fetch/FetchConsumer.h
+@@ -54,10 +54,11 @@ public:
+   BeginConsumeBodyMainThread();
+ 
+   void
+-  ContinueConsumeBody(nsresult aStatus, uint32_t aLength, uint8_t* aResult);
++  ContinueConsumeBody(nsresult aStatus, uint32_t aLength, uint8_t* aResult,
++                      bool aShuttingDown = false);
+ 
+   void
+-  ContinueConsumeBlobBody(BlobImpl* aBlobImpl);
++  ContinueConsumeBlobBody(BlobImpl* aBlobImpl, bool aShuttingDown = false);
+ 
+   void
+   ShutDownMainThreadConsuming();
diff --git a/www/waterfox/files/patch-bug1424469 b/www/waterfox/files/patch-bug1424469
new file mode 100644
index 000000000000..2d7d4a14fc97
--- /dev/null
+++ b/www/waterfox/files/patch-bug1424469
@@ -0,0 +1,36 @@
+commit 3c1a70ea1e0c
+Author: Paolo Amadini <paolo.mozmail@amadzone.org>
+Date:   Tue Jan 30 14:38:25 2018 +0000
+
+    Bug 1424469 - The Downloads view in the Library window doesn't get focus when opened. r=mak, a=RyanVM
+    
+    We have to keep track of the focused element while we remove the richlistbox element temporarily.
+    
+    MozReview-Commit-ID: AePydUyyUS7
+    
+    --HG--
+    extra : source : 6aa2d7b4215e350c76bdfbb9132eb5ae42b23123
+---
+ browser/components/downloads/content/allDownloadsViewOverlay.js | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git browser/components/downloads/content/allDownloadsViewOverlay.js browser/components/downloads/content/allDownloadsViewOverlay.js
+index 64052c0259f1..7f1990651ced 100644
+--- browser/components/downloads/content/allDownloadsViewOverlay.js
++++ browser/components/downloads/content/allDownloadsViewOverlay.js
+@@ -1022,11 +1022,15 @@ DownloadsPlacesView.prototype = {
+       xblFields.set(key, value);
+     }
+ 
++    let oldActiveElement = document.activeElement;
+     let parentNode = this._richlistbox.parentNode;
+     let nextSibling = this._richlistbox.nextSibling;
+     parentNode.removeChild(this._richlistbox);
+     this._richlistbox.appendChild(aDOMFragment);
+     parentNode.insertBefore(this._richlistbox, nextSibling);
++    if (oldActiveElement && oldActiveElement != document.activeElement) {
++      oldActiveElement.focus();
++    }
+ 
+     for (let [key, value] of xblFields) {
+       this._richlistbox[key] = value;
diff --git a/www/waterfox/files/patch-bug1426087 b/www/waterfox/files/patch-bug1426087
new file mode 100644
index 000000000000..abd09689e666
--- /dev/null
+++ b/www/waterfox/files/patch-bug1426087
@@ -0,0 +1,80 @@
+commit 1b9a43c32852
+Author: Bob Owen <bobowencode@gmail.com>
+Date:   Fri Jan 12 10:17:36 2018 +0000
+
+    Bug 1426087 - Decrement nsDocumentViewer::mDestroyRefCount in a separate function. r=jwatt, a=ritu
+    
+    --HG--
+    extra : source : 86d41b5efe074f6988085082df9ef537eee0813a
+---
+ layout/base/nsDocumentViewer.cpp     |  7 ++++++-
+ layout/base/nsIDocumentViewerPrint.h |  2 ++
+ layout/printing/nsPagePrintTimer.cpp | 10 ++--------
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git layout/base/nsDocumentViewer.cpp layout/base/nsDocumentViewer.cpp
+index 4fe03d3f7f88..58690001ad73 100644
+--- layout/base/nsDocumentViewer.cpp
++++ layout/base/nsDocumentViewer.cpp
+@@ -1665,7 +1665,6 @@ nsDocumentViewer::Destroy()
+   // We also keep the viewer from being cached in session history, since
+   // we require all documents there to be sanitized.
+   if (mDestroyRefCount != 0) {
+-    --mDestroyRefCount;
+     return NS_OK;
+   }
+ 
+@@ -4471,6 +4470,12 @@ nsDocumentViewer::IncrementDestroyRefCount()
+   ++mDestroyRefCount;
+ }
+ 
++void
++nsDocumentViewer::DecrementDestroyRefCount()
++{
++  --mDestroyRefCount;
++}
++
+ //------------------------------------------------------------
+ 
+ #if defined(NS_PRINTING) && defined(NS_PRINT_PREVIEW)
+diff --git layout/base/nsIDocumentViewerPrint.h layout/base/nsIDocumentViewerPrint.h
+index 874ee31e5344..e6ac5318f20c 100644
+--- layout/base/nsIDocumentViewerPrint.h
++++ layout/base/nsIDocumentViewerPrint.h
+@@ -42,6 +42,7 @@ public:
+   virtual mozilla::StyleSetHandle CreateStyleSet(nsIDocument* aDocument) = 0;
+ 
+   virtual void IncrementDestroyRefCount() = 0;
++  virtual void DecrementDestroyRefCount() = 0;
+ 
+   virtual void ReturnToGalleyPresentation() = 0;
+ 
+@@ -76,6 +77,7 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocumentViewerPrint,
+   bool GetIsPrintPreview() override; \
+   mozilla::StyleSetHandle CreateStyleSet(nsIDocument* aDocument) override; \
+   void IncrementDestroyRefCount() override; \
++  void DecrementDestroyRefCount() override; \
+   void ReturnToGalleyPresentation() override; \
+   void OnDonePrinting() override; \
+   bool IsInitializedForPrintPreview() override; \
+diff --git layout/printing/nsPagePrintTimer.cpp layout/printing/nsPagePrintTimer.cpp
+index 2a29bc85111c..25458b95b3b0 100644
+--- layout/printing/nsPagePrintTimer.cpp
++++ layout/printing/nsPagePrintTimer.cpp
+@@ -17,14 +17,8 @@ NS_IMPL_ISUPPORTS_INHERITED(nsPagePrintTimer, mozilla::Runnable, nsITimerCallbac
+ 
+ nsPagePrintTimer::~nsPagePrintTimer()
+ {
+-  // "Destroy" the document viewer; this normally doesn't actually
+-  // destroy it because of the IncrementDestroyRefCount call below
+-  // XXX This is messy; the document viewer should use a single approach
+-  // to keep itself alive during printing
+-  nsCOMPtr<nsIContentViewer> cv(do_QueryInterface(mDocViewerPrint));
+-  if (cv) {
+-    cv->Destroy();
+-  }
++  // This matches the IncrementDestroyRefCount call in the constructor.
++  mDocViewerPrint->DecrementDestroyRefCount();
+ }
+ 
+ nsresult
diff --git a/www/waterfox/files/patch-bug1431192 b/www/waterfox/files/patch-bug1431192
new file mode 100644
index 000000000000..3409a299dc24
--- /dev/null
+++ b/www/waterfox/files/patch-bug1431192
@@ -0,0 +1,44 @@
+commit f953dbadab3f
+Author: Francois Marier <francois@mozilla.com>
+Date:   Mon Jan 29 15:16:54 2018 -0800
+
+    Bug 1431192 - Only fetch download protection lists when Safe Browsing is enabled. r=gcp, a=RyanVM
+    
+    Download protection requires both the malware list as well as its
+    own special lists. The code therefore checks that both Safe
+    Browsing and download protection are enabled before checking
+    downloaded files.
+    
+    The list manager should check the same prefs before downloading
+    any of the download protection lists in order to avoid connecting
+    to the Safe Browsing server when Safe Browsing is fully disabled.
+    
+    MozReview-Commit-ID: 66vMA56T4pJ
+    
+    --HG--
+    extra : source : 79905d4e85aba22cafcd8f331b06197134267975
+---
+ toolkit/components/url-classifier/SafeBrowsing.jsm | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git toolkit/components/url-classifier/SafeBrowsing.jsm toolkit/components/url-classifier/SafeBrowsing.jsm
+index 73bd04dafcf9..64b8dd35de03 100644
+--- toolkit/components/url-classifier/SafeBrowsing.jsm
++++ toolkit/components/url-classifier/SafeBrowsing.jsm
+@@ -405,14 +405,14 @@ this.SafeBrowsing = {
+       }
+     }
+     for (let i = 0; i < this.downloadBlockLists.length; ++i) {
+-      if (this.downloadsEnabled) {
++      if (this.malwareEnabled && this.downloadsEnabled) {
+         listManager.enableUpdate(this.downloadBlockLists[i]);
+       } else {
+         listManager.disableUpdate(this.downloadBlockLists[i]);
+       }
+     }
+     for (let i = 0; i < this.downloadAllowLists.length; ++i) {
+-      if (this.downloadsEnabled) {
++      if (this.malwareEnabled && this.downloadsEnabled) {
+         listManager.enableUpdate(this.downloadAllowLists[i]);
+       } else {
+         listManager.disableUpdate(this.downloadAllowLists[i]);
diff --git a/www/waterfox/files/patch-bug1431370 b/www/waterfox/files/patch-bug1431370
new file mode 100644
index 000000000000..dfa33ce32a61
--- /dev/null
+++ b/www/waterfox/files/patch-bug1431370
@@ -0,0 +1,30 @@
+commit eed02e1bbf61
+Author: Francois Marier <francois@mozilla.com>
+Date:   Tue Jan 30 13:26:43 2018 -0800
+
+    Bug 1431370 - Make DoRiceDeltaDecode allocation fallible to fix startup OOM crash. r=gcp a=RyanVM
+    
+    MozReview-Commit-ID: 2vf4EU4TVCq
+    
+    --HG--
+    extra : source : bdb502c30c7c72c758d7bc4f22774fe27d045c1d
+---
+ toolkit/components/url-classifier/ProtocolParser.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git toolkit/components/url-classifier/ProtocolParser.cpp toolkit/components/url-classifier/ProtocolParser.cpp
+index d4fce581e394..a5da314bda30 100644
+--- toolkit/components/url-classifier/ProtocolParser.cpp
++++ toolkit/components/url-classifier/ProtocolParser.cpp
+@@ -999,7 +999,10 @@ DoRiceDeltaDecode(const RiceDeltaEncoding& aEncoding,
+ 
+   // Setup the output buffer. The "first value" is included in
+   // the output buffer.
+-  aDecoded.SetLength(aEncoding.num_entries() + 1);
++  if (!aDecoded.SetLength(aEncoding.num_entries() + 1, mozilla::fallible)) {
++    NS_WARNING("Not enough memory to decode the RiceDelta input.");
++    return NS_ERROR_OUT_OF_MEMORY;
++  }
+ 
+   // Decode!
+   bool rv = decoder.Decode(aEncoding.rice_parameter(),
diff --git a/www/waterfox/files/patch-bug1432870 b/www/waterfox/files/patch-bug1432870
new file mode 100644
index 000000000000..f276b2b822a0
--- /dev/null
+++ b/www/waterfox/files/patch-bug1432870
@@ -0,0 +1,29 @@
+commit 4d12d7970aee
+Author: Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Date:   Tue Jan 30 12:07:08 2018 +0000
+
+    Bug 1432870. r=bz, a=lizzard
+    
+    --HG--
+    extra : source : 54491805113acdce065ed6164b524acc411986ef
+---
+ chrome/nsChromeRegistry.cpp | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git chrome/nsChromeRegistry.cpp chrome/nsChromeRegistry.cpp
+index 4443b11f93ba..8e81c531c4cf 100644
+--- chrome/nsChromeRegistry.cpp
++++ chrome/nsChromeRegistry.cpp
+@@ -235,6 +235,12 @@ nsChromeRegistry::Canonify(nsIURL* aChromeURL)
+     // path is already unescaped once, but uris can get unescaped twice
+     const char* pos = path.BeginReading();
+     const char* end = path.EndReading();
++    // Must start with [a-zA-Z0-9].
++    if (!('a' <= *pos && *pos <= 'z') &&
++        !('A' <= *pos && *pos <= 'Z') &&
++        !('0' <= *pos && *pos <= '9')) {
++      return NS_ERROR_DOM_BAD_URI;
++    }
+     while (pos < end) {
+       switch (*pos) {
+         case ':':
diff --git a/www/waterfox/files/patch-bug1432915 b/www/waterfox/files/patch-bug1432915
new file mode 100644
index 000000000000..cd584b59466f
--- /dev/null
+++ b/www/waterfox/files/patch-bug1432915
@@ -0,0 +1,27 @@
+commit aefee13a68d4
+Author: Luke Crouch <lcrouch@mozilla.com>
+Date:   Tue Jan 30 10:59:43 2018 -0600
+
+    Bug 1432915 - don't save download source url when aIsPrivate r=Ehsan a=RyanVM
+    
+    MozReview-Commit-ID: 9mQjwcCtrWg
+    
+    --HG--
+    extra : source : 91c18ad31b298458978b2817a691d94b2c7d802d
+---
+ toolkit/components/jsdownloads/src/DownloadPlatform.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git toolkit/components/jsdownloads/src/DownloadPlatform.cpp toolkit/components/jsdownloads/src/DownloadPlatform.cpp
+index fd7c8fbd9b18..b519d33fcfab 100644
+--- toolkit/components/jsdownloads/src/DownloadPlatform.cpp
++++ toolkit/components/jsdownloads/src/DownloadPlatform.cpp
+@@ -167,7 +167,7 @@ nsresult DownloadPlatform::DownloadDone(nsIURI* aSource, nsIURI* aReferrer, nsIF
+                                                  (const UniChar*)path.get(),
+                                                  path.Length());
+     }
+-    if (pathCFStr) {
++    if (pathCFStr && !aIsPrivate) {
+       bool isFromWeb = IsURLPossiblyFromWeb(aSource);
+ 
+       CFURLRef sourceCFURL = CreateCFURLFromNSIURI(aSource);
diff --git a/www/waterfox/files/patch-bug1433671 b/www/waterfox/files/patch-bug1433671
new file mode 100644
index 000000000000..b43f60006ca3
--- /dev/null
+++ b/www/waterfox/files/patch-bug1433671
@@ -0,0 +1,179 @@
+commit c5af1605ca8e
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Mon Feb 5 15:27:35 2018 -0500
+
+    Bug 1433671 - Make AccessibleCaretManager flushes a bit more sound. r=TYLin, a=RyanVM
+    
+    The accessible caret manager is owned by the event hub, that is owned by the
+    shell.
+    
+    All the callers of methods that call FlushLayout on the AccessibleCaretManager
+    should hold an external reference to the event hub.
+    
+    Flushing pending notifications can run arbitrary script, that can call Destroy()
+    on the pres shell (and thus tear down the accessible caret event hub, and the
+    manager with him).
+    
+    I don't know why before my change this wasn't crashing badly, but the code as it
+    was just doesn't look sound to me at all either (maybe I'm misunderstanding
+    something and I should just revert that patch and give up on having nice
+    invariants during our flushes..., but I don't think it's the case).
+    
+    This also adds some sanity-checking that we don't die under our flush.
+    
+    MozReview-Commit-ID: 4s0UT0fD3TI
+---
+ layout/base/AccessibleCaretEventHub.cpp          |  6 +++--
+ layout/base/AccessibleCaretManager.cpp           | 29 +++++++++++++-----------
+ layout/base/AccessibleCaretManager.h             | 17 ++++++++++----
+ layout/base/gtest/TestAccessibleCaretManager.cpp |  4 ++--
+ 4 files changed, 34 insertions(+), 22 deletions(-)
+
+diff --git layout/base/AccessibleCaretEventHub.cpp layout/base/AccessibleCaretEventHub.cpp
+index 2c777396c857..05da6cad3369 100644
+--- layout/base/AccessibleCaretEventHub.cpp
++++ layout/base/AccessibleCaretEventHub.cpp
+@@ -677,7 +677,8 @@ AccessibleCaretEventHub::CancelLongTapInjector()
+ AccessibleCaretEventHub::FireLongTap(nsITimer* aTimer,
+                                      void* aAccessibleCaretEventHub)
+ {
+-  auto* self = static_cast<AccessibleCaretEventHub*>(aAccessibleCaretEventHub);
++  RefPtr<AccessibleCaretEventHub> self =
++    static_cast<AccessibleCaretEventHub*>(aAccessibleCaretEventHub);
+   self->mState->OnLongTap(self, self->mPressPoint);
+ }
+ 
+@@ -779,7 +780,8 @@ AccessibleCaretEventHub::CancelScrollEndInjector()
+ AccessibleCaretEventHub::FireScrollEnd(nsITimer* aTimer,
+                                        void* aAccessibleCaretEventHub)
+ {
+-  auto* self = static_cast<AccessibleCaretEventHub*>(aAccessibleCaretEventHub);
++  RefPtr<AccessibleCaretEventHub> self =
++    static_cast<AccessibleCaretEventHub*>(aAccessibleCaretEventHub);
+   self->mState->OnScrollEnd(self);
+ }
+ 
+diff --git layout/base/AccessibleCaretManager.cpp layout/base/AccessibleCaretManager.cpp
+index 19ca4e3da9cc..994396785ba6 100644
+--- layout/base/AccessibleCaretManager.cpp
++++ layout/base/AccessibleCaretManager.cpp
+@@ -124,6 +124,7 @@ AccessibleCaretManager::AccessibleCaretManager(nsIPresShell* aPresShell)
+ 
+ AccessibleCaretManager::~AccessibleCaretManager()
+ {
++  MOZ_RELEASE_ASSERT(!mFlushingLayout, "Going away in FlushLayout? Bad!");
+ }
+ 
+ void
+@@ -221,8 +222,7 @@ AccessibleCaretManager::HideCarets()
+ void
+ AccessibleCaretManager::UpdateCarets(UpdateCaretsHintSet aHint)
+ {
+-  FlushLayout();
+-  if (IsTerminated()) {
++  if (!FlushLayout()) {
+     return;
+   }
+ 
+@@ -389,8 +389,7 @@ AccessibleCaretManager::UpdateCaretsForSelectionMode(UpdateCaretsHintSet aHints)
+   if (firstCaretResult == PositionChangedResult::Changed ||
+       secondCaretResult == PositionChangedResult::Changed) {
+     // Flush layout to make the carets intersection correct.
+-    FlushLayout();
+-    if (IsTerminated()) {
++    if (!FlushLayout()) {
+       return;
+     }
+   }
+@@ -1022,12 +1021,17 @@ AccessibleCaretManager::ClearMaintainedSelection() const
+   }
+ }
+ 
+-void
+-AccessibleCaretManager::FlushLayout() const
++bool
++AccessibleCaretManager::FlushLayout()
+ {
+   if (mPresShell) {
++    AutoRestore<bool> flushing(mFlushingLayout);
++    mFlushingLayout = true;
++
+     mPresShell->FlushPendingNotifications(FlushType::Layout);
+   }
++
++  return !IsTerminated();
+ }
+ 
+ nsIFrame*
+@@ -1380,14 +1384,9 @@ AccessibleCaretManager::AdjustDragBoundary(const nsPoint& aPoint) const
+ }
+ 
+ void
+-AccessibleCaretManager::DispatchCaretStateChangedEvent(CaretChangedReason aReason) const
++AccessibleCaretManager::DispatchCaretStateChangedEvent(CaretChangedReason aReason)
+ {
+-  if (!mPresShell) {
+-    return;
+-  }
+-
+-  FlushLayout();
+-  if (IsTerminated()) {
++  if (!FlushLayout()) {
+     return;
+   }
+ 
+diff --git layout/base/AccessibleCaretManager.h layout/base/AccessibleCaretManager.h
+index 2de756d4699b..4805b519585d 100644
+--- layout/base/AccessibleCaretManager.h
++++ layout/base/AccessibleCaretManager.h
+@@ -193,9 +193,13 @@ protected:
+   nsPoint AdjustDragBoundary(const nsPoint& aPoint) const;
+   void ClearMaintainedSelection() const;
+ 
+-  // Caller is responsible to use IsTerminated() to check whether PresShell is
+-  // still valid.
+-  void FlushLayout() const;
++  // This method could kill the shell, so callers to methods that call
++  // FlushLayout should ensure the event hub that owns us is still alive.
++  //
++  // See the mRefCnt assertions in AccessibleCaretEventHub.
++  //
++  // Returns whether mPresShell we're holding is still valid.
++  MOZ_MUST_USE bool FlushLayout();
+ 
+   dom::Element* GetEditingHostForFrame(nsIFrame* aFrame) const;
+   dom::Selection* GetSelection() const;
+@@ -251,7 +255,7 @@ protected:
+ 
+   // This function will flush layout, so caller must ensure the PresShell is
+   // still valid after calling this method.
+-  virtual void DispatchCaretStateChangedEvent(dom::CaretChangedReason aReason) const;
++  virtual void DispatchCaretStateChangedEvent(dom::CaretChangedReason aReason);
+ 
+   // ---------------------------------------------------------------------------
+   // Member variables
+@@ -295,6 +299,9 @@ protected:
+   // Set to true in OnScrollStart() and set to false in OnScrollEnd().
+   bool mIsScrollStarted = false;
+ 
++  // Whether we're flushing layout, used for sanity-checking.
++  bool mFlushingLayout = false;
++
+   static const int32_t kAutoScrollTimerDelay = 30;
+ 
+   // Clicking on the boundary of input or textarea will move the caret to the
+diff --git layout/base/gtest/TestAccessibleCaretManager.cpp layout/base/gtest/TestAccessibleCaretManager.cpp
+index 1d3a1c039404..118e5cbcf5fe 100644
+--- layout/base/gtest/TestAccessibleCaretManager.cpp
++++ layout/base/gtest/TestAccessibleCaretManager.cpp
+@@ -108,8 +108,8 @@ public:
+     virtual bool IsTerminated() const override { return false; }
+ 
+     MOCK_CONST_METHOD0(GetCaretMode, CaretMode());
+-    MOCK_CONST_METHOD1(DispatchCaretStateChangedEvent,
+-                       void(CaretChangedReason aReason));
++    MOCK_METHOD1(DispatchCaretStateChangedEvent,
++                 void(CaretChangedReason aReason));
+     MOCK_CONST_METHOD1(HasNonEmptyTextContent, bool(nsINode* aNode));
+ 
+   }; // class MockAccessibleCaretManager
diff --git a/www/waterfox/files/patch-bug1435098 b/www/waterfox/files/patch-bug1435098
new file mode 100644
index 000000000000..f1be765bbaa3
--- /dev/null
+++ b/www/waterfox/files/patch-bug1435098
@@ -0,0 +1,46 @@
+commit 9cfd36156d04
+Author: Francois Marier <francois@mozilla.com>
+Date:   Fri Feb 2 13:30:28 2018 -0800
+
+    Bug 1435098 - Gate flashinfobar list on the plugins.show_infobar. r=bytesized,gcp a=RyanVM
+    
+    The list of sites to suppress flash infobars on should not be
+    downloaded from shavar unless the infobar feature is enabled.
+    
+    MozReview-Commit-ID: BjkS5vWiilg
+    
+    --HG--
+    extra : source : 40f74605367ec4d620873fa8ff90c2dcc2a7ce31
+---
+ toolkit/components/url-classifier/SafeBrowsing.jsm | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git toolkit/components/url-classifier/SafeBrowsing.jsm toolkit/components/url-classifier/SafeBrowsing.jsm
+index 64b8dd35de03..29d2a46fe72c 100644
+--- toolkit/components/url-classifier/SafeBrowsing.jsm
++++ toolkit/components/url-classifier/SafeBrowsing.jsm
+@@ -66,6 +66,7 @@ this.SafeBrowsing = {
+     Services.prefs.addObserver("privacy.trackingprotection", this);
+     Services.prefs.addObserver("urlclassifier", this);
+     Services.prefs.addObserver("plugins.flashBlock.enabled", this);
++    Services.prefs.addObserver("plugins.show_infobar", this);
+ 
+     this.readPrefs();
+     this.addMozEntries();
+@@ -151,7 +152,7 @@ this.SafeBrowsing = {
+   blockedEnabled:       false,
+   trackingAnnotations:  false,
+   flashBlockEnabled:    false,
+-  flashInfobarListEnabled: true,
++  flashInfobarListEnabled: false,
+ 
+   phishingLists:                [],
+   malwareLists:                 [],
+@@ -231,6 +232,7 @@ this.SafeBrowsing = {
+     this.blockedEnabled = Services.prefs.getBoolPref("browser.safebrowsing.blockedURIs.enabled");
+     this.trackingAnnotations = Services.prefs.getBoolPref("privacy.trackingprotection.annotate_channels");
+     this.flashBlockEnabled = Services.prefs.getBoolPref("plugins.flashBlock.enabled");
++    this.flashInfobarListEnabled = Services.prefs.getBoolPref("plugins.show_infobar", false);
+ 
+     let flashAllowTable, flashAllowExceptTable, flashTable,
+         flashExceptTable, flashSubDocTable,
diff --git a/www/waterfox/files/patch-bug1435286 b/www/waterfox/files/patch-bug1435286
new file mode 100644
index 000000000000..4aa4aa1f8aa3
--- /dev/null
+++ b/www/waterfox/files/patch-bug1435286
@@ -0,0 +1,294 @@
+commit 63d4e507c859
+Author: Jonathan Watt <jwatt@jwatt.org>
+Date:   Thu Jan 18 12:45:18 2018 +0000
+
+    Bug 1435286 - Stop recording draw events for reference DrawTargets returned from PrintTarget. r=bobowen a=RyanVM
+    
+    MozReview-Commit-ID: 1cE71hBCGx5
+    
+    --HG--
+    extra : source : 2ec583a00c078700add6a3615f6b6af12756695c
+---
+ gfx/src/nsDeviceContext.cpp      |  9 ++++-----
+ gfx/thebes/PrintTarget.cpp       | 24 +-----------------------
+ gfx/thebes/PrintTarget.h         | 13 ++-----------
+ gfx/thebes/PrintTargetCG.h       |  2 +-
+ gfx/thebes/PrintTargetCG.mm      | 23 +----------------------
+ gfx/thebes/PrintTargetEMF.cpp    |  4 ++--
+ gfx/thebes/PrintTargetEMF.h      |  2 +-
+ gfx/thebes/PrintTargetSkPDF.cpp  | 23 +----------------------
+ gfx/thebes/PrintTargetSkPDF.h    |  2 +-
+ gfx/thebes/PrintTargetThebes.cpp | 23 +----------------------
+ gfx/thebes/PrintTargetThebes.h   |  2 +-
+ 11 files changed, 16 insertions(+), 111 deletions(-)
+
+diff --git gfx/src/nsDeviceContext.cpp gfx/src/nsDeviceContext.cpp
+index 913f46d272cc..ca5db861a303 100644
+--- gfx/src/nsDeviceContext.cpp
++++ gfx/src/nsDeviceContext.cpp
+@@ -382,14 +382,13 @@ nsDeviceContext::CreateRenderingContextCommon(bool aWantReferenceContext)
+     MOZ_ASSERT(IsPrinterContext());
+     MOZ_ASSERT(mWidth > 0 && mHeight > 0);
+ 
+-    // This will usually be null, depending on the pref print.print_via_parent.
+-    RefPtr<DrawEventRecorder> recorder;
+-    mDeviceContextSpec->GetDrawEventRecorder(getter_AddRefs(recorder));
+-
+     RefPtr<gfx::DrawTarget> dt;
+     if (aWantReferenceContext) {
+-      dt = mPrintTarget->GetReferenceDrawTarget(recorder);
++      dt = mPrintTarget->GetReferenceDrawTarget();
+     } else {
++      // This will be null if e10s is disabled or print.print_via_parent=false.
++      RefPtr<DrawEventRecorder> recorder;
++      mDeviceContextSpec->GetDrawEventRecorder(getter_AddRefs(recorder));
+       dt = mPrintTarget->MakeDrawTarget(gfx::IntSize(mWidth, mHeight), recorder);
+     }
+ 
+diff --git gfx/thebes/PrintTarget.cpp gfx/thebes/PrintTarget.cpp
+index bb81158e5b77..c76a930221bf 100644
+--- gfx/thebes/PrintTarget.cpp
++++ gfx/thebes/PrintTarget.cpp
+@@ -25,7 +25,6 @@ PrintTarget::PrintTarget(cairo_surface_t* aCairoSurface, const IntSize& aSize)
+   , mIsFinished(false)
+ #ifdef DEBUG
+   , mHasActivePage(false)
+-  , mRecorder(nullptr)
+ #endif
+ 
+ {
+@@ -92,7 +91,7 @@ PrintTarget::MakeDrawTarget(const IntSize& aSize,
+ }
+ 
+ already_AddRefed<DrawTarget>
+-PrintTarget::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
++PrintTarget::GetReferenceDrawTarget()
+ {
+   if (!mRefDT) {
+     const IntSize size(1, 1);
+@@ -136,27 +135,6 @@ PrintTarget::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
+     mRefDT = dt.forget();
+   }
+ 
+-  if (aRecorder) {
+-    if (!mRecordingRefDT) {
+-      RefPtr<DrawTarget> dt = CreateWrapAndRecordDrawTarget(aRecorder, mRefDT);
+-      if (!dt || !dt->IsValid()) {
+-        return nullptr;
+-      }
+-      mRecordingRefDT = dt.forget();
+-#ifdef DEBUG
+-      mRecorder = aRecorder;
+-#endif
+-    }
+-#ifdef DEBUG
+-    else {
+-      MOZ_ASSERT(aRecorder == mRecorder,
+-                 "Caching mRecordingRefDT assumes the aRecorder is an invariant");
+-    }
+-#endif
+-
+-    return do_AddRef(mRecordingRefDT);
+-  }
+-
+   return do_AddRef(mRefDT);
+ }
+ 
+diff --git gfx/thebes/PrintTarget.h gfx/thebes/PrintTarget.h
+index c5720c6cdb1f..818dc31fe0c4 100644
+--- gfx/thebes/PrintTarget.h
++++ gfx/thebes/PrintTarget.h
+@@ -130,10 +130,9 @@ public:
+   /**
+    * Returns a reference DrawTarget. Unlike MakeDrawTarget, this method is not
+    * restricted to being called between BeginPage()/EndPage() calls, and the
+-   * returned DrawTarget it is still valid to use after EndPage() has been
+-   * called.
++   * returned DrawTarget is still valid to use after EndPage() has been called.
+    */
+-  virtual already_AddRefed<DrawTarget> GetReferenceDrawTarget(DrawEventRecorder* aRecorder);
++  virtual already_AddRefed<DrawTarget> GetReferenceDrawTarget();
+ 
+ protected:
+ 
+@@ -150,18 +149,10 @@ protected:
+   cairo_surface_t* mCairoSurface;
+   RefPtr<DrawTarget> mRefDT; // reference DT
+ 
+-  // Early on during printing we expect to be called without a recorder in
+-  // order to gather metrics for reflow.  However, in a content process, once
+-  // we go on to paint we then expect to be called with a recorder.  Hence why
+-  // we have this separate recording reference DrawTarget (which wraps mRefDT).
+-  RefPtr<DrawTarget> mRecordingRefDT;
+-
+   IntSize mSize;
+   bool mIsFinished;
+ #ifdef DEBUG
+   bool mHasActivePage;
+-  // owned by mRecordingRefDT, so kept alive for our entire lifetime if set:
+-  DrawEventRecorder* mRecorder;
+ #endif
+ };
+ 
+diff --git gfx/thebes/PrintTargetCG.h gfx/thebes/PrintTargetCG.h
+index 8e0d2c505024..7808ebbd2a58 100644
+--- gfx/thebes/PrintTargetCG.h
++++ gfx/thebes/PrintTargetCG.h
+@@ -34,7 +34,7 @@ public:
+   virtual nsresult EndPage() final;
+ 
+   virtual already_AddRefed<DrawTarget>
+-  GetReferenceDrawTarget(DrawEventRecorder* aRecorder) final;
++  GetReferenceDrawTarget() final;
+ 
+ private:
+   PrintTargetCG(PMPrintSession aPrintSession,
+diff --git gfx/thebes/PrintTargetCG.mm gfx/thebes/PrintTargetCG.mm
+index 7a7858f71456..93432711ed3d 100644
+--- gfx/thebes/PrintTargetCG.mm
++++ gfx/thebes/PrintTargetCG.mm
+@@ -65,7 +65,7 @@ PutBytesNull(void* info, const void* buffer, size_t count)
+ }
+ 
+ already_AddRefed<DrawTarget>
+-PrintTargetCG::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
++PrintTargetCG::GetReferenceDrawTarget()
+ {
+   if (!mRefDT) {
+     const IntSize size(1, 1);
+@@ -97,27 +97,6 @@ PrintTargetCG::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
+     mRefDT = dt.forget();
+   }
+ 
+-  if (aRecorder) {
+-    if (!mRecordingRefDT) {
+-      RefPtr<DrawTarget> dt = CreateWrapAndRecordDrawTarget(aRecorder, mRefDT);
+-      if (!dt || !dt->IsValid()) {
+-        return nullptr;
+-      }
+-      mRecordingRefDT = dt.forget();
+-#ifdef DEBUG
+-      mRecorder = aRecorder;
+-#endif
+-    }
+-#ifdef DEBUG
+-    else {
+-      MOZ_ASSERT(aRecorder == mRecorder,
+-                 "Caching mRecordingRefDT assumes the aRecorder is an invariant");
+-    }
+-#endif
+-
+-    return do_AddRef(mRecordingRefDT);
+-  }
+-
+   return do_AddRef(mRefDT);
+ }
+ 
+diff --git gfx/thebes/PrintTargetSkPDF.cpp gfx/thebes/PrintTargetSkPDF.cpp
+index bdc6f9fec21f..e89afaea5d47 100644
+--- gfx/thebes/PrintTargetSkPDF.cpp
++++ gfx/thebes/PrintTargetSkPDF.cpp
+@@ -122,7 +122,7 @@ PrintTargetSkPDF::MakeDrawTarget(const IntSize& aSize,
+ }
+ 
+ already_AddRefed<DrawTarget>
+-PrintTargetSkPDF::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
++PrintTargetSkPDF::GetReferenceDrawTarget()
+ {
+   if (!mRefDT) {
+     SkDocument::PDFMetadata metadata;
+@@ -145,27 +145,6 @@ PrintTargetSkPDF::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
+     mRefDT = dt.forget();
+   }
+ 
+-  if (aRecorder) {
+-    if (!mRecordingRefDT) {
+-      RefPtr<DrawTarget> dt = CreateWrapAndRecordDrawTarget(aRecorder, mRefDT);
+-      if (!dt || !dt->IsValid()) {
+-        return nullptr;
+-      }
+-      mRecordingRefDT = dt.forget();
+-#ifdef DEBUG
+-      mRecorder = aRecorder;
+-#endif
+-    }
+-#ifdef DEBUG
+-    else {
+-      MOZ_ASSERT(aRecorder == mRecorder,
+-                 "Caching mRecordingRefDT assumes the aRecorder is an invariant");
+-    }
+-#endif
+-
+-    return do_AddRef(mRecordingRefDT);
+-  }
+-
+   return do_AddRef(mRefDT);
+ }
+ 
+diff --git gfx/thebes/PrintTargetSkPDF.h gfx/thebes/PrintTargetSkPDF.h
+index fe5f28b31202..84ef2ff21ace 100644
+--- gfx/thebes/PrintTargetSkPDF.h
++++ gfx/thebes/PrintTargetSkPDF.h
+@@ -44,7 +44,7 @@ public:
+                  DrawEventRecorder* aRecorder = nullptr) final;
+ 
+   virtual already_AddRefed<DrawTarget>
+-  GetReferenceDrawTarget(DrawEventRecorder* aRecorder) override final;
++  GetReferenceDrawTarget() override final;
+ 
+ private:
+   PrintTargetSkPDF(const IntSize& aSize,
+diff --git gfx/thebes/PrintTargetThebes.cpp gfx/thebes/PrintTargetThebes.cpp
+index 3cb6d1e5d6b7..f12a7d5b3fb9 100644
+--- gfx/thebes/PrintTargetThebes.cpp
++++ gfx/thebes/PrintTargetThebes.cpp
+@@ -57,7 +57,7 @@ PrintTargetThebes::MakeDrawTarget(const IntSize& aSize,
+ }
+ 
+ already_AddRefed<DrawTarget>
+-PrintTargetThebes::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
++PrintTargetThebes::GetReferenceDrawTarget()
+ {
+   if (!mRefDT) {
+     RefPtr<gfx::DrawTarget> dt =
+@@ -68,27 +68,6 @@ PrintTargetThebes::GetReferenceDrawTarget(DrawEventRecorder* aRecorder)
+     mRefDT = dt->CreateSimilarDrawTarget(IntSize(1,1), dt->GetFormat());
+   }
+ 
+-  if (aRecorder) {
+-    if (!mRecordingRefDT) {
+-      RefPtr<DrawTarget> dt = CreateWrapAndRecordDrawTarget(aRecorder, mRefDT);
+-      if (!dt || !dt->IsValid()) {
+-        return nullptr;
+-      }
+-      mRecordingRefDT = dt.forget();
+-#ifdef DEBUG
+-      mRecorder = aRecorder;
+-#endif
+-    }
+-#ifdef DEBUG
+-    else {
+-      MOZ_ASSERT(aRecorder == mRecorder,
+-                 "Caching mRecordingRefDT assumes the aRecorder is an invariant");
+-    }
+-#endif
+-
+-    return do_AddRef(mRecordingRefDT);
+-  }
+-
+   return do_AddRef(mRefDT);
+ }
+ 
+diff --git gfx/thebes/PrintTargetThebes.h gfx/thebes/PrintTargetThebes.h
+index 02f0e0ea51c3..94ffbc78fa6c 100644
+--- gfx/thebes/PrintTargetThebes.h
++++ gfx/thebes/PrintTargetThebes.h
+@@ -43,7 +43,7 @@ public:
+   MakeDrawTarget(const IntSize& aSize,
+                  DrawEventRecorder* aRecorder = nullptr) override;
+ 
+-  virtual already_AddRefed<DrawTarget> GetReferenceDrawTarget(DrawEventRecorder* aRecorder) final;
++  virtual already_AddRefed<DrawTarget> GetReferenceDrawTarget() final;
+ 
+ private:
+