import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1180189 - Fix crash in mozilla::a11y::HTMLTableRowAccessible::GroupPosition, r=MarcoZ (a2ee5f2df8)
- Bug 1194859 - crash in mozilla::a11y::ARIAGridCellAccessible::GroupPosition, r=marcoz (879bad005f)
- Bug 1194859 - crash in mozilla::a11y::ARIAGridCellAccessible::GroupPosition(), part2, r=marcoz (38193050c0)
- comment and style (a3ae06e5e6)
- var/let (7b3552e2ba)
- var-let and some misspatch fixes (a6d3b0c9cb)
- Bug 1141978 - Support rowgroup and colgroup HTML scope, r=marcoz (11eedb88f0)
- Bug 1146257 - spanned headers don't work well in our table code, r=marcoz (d9b11584c2)
- remove unused MultiCompartmentMatcher (480d895553)
- Bug 1168170 - Mark reference counted members of nsTimerImpl::mCallback as MOZ_OWNING_REF. r=froydnj (b84c55460a)
- Bug 1178363 - make nsTimerImpl::SetDelayInternal a private method; r=poiru (5f70ed869e)
- Bug 1178363 - make nsTimerImpl::Fire a private method; r=poiru (4b6007c376)
- Bug 1178363 - make MOZ_TASK_TRACER-dependent bits of nsTimerImpl private; r=poiru (e1f54cde97)
- Bug 1178363 - make nsTimerImpl::PostTimerEvent a private method; r=poiru (0a0b71eae3)
- Bug 1178363 - make nsTimerImpl::GetGeneration a private method; r=poiru (593d3a3f2d)
- Bug 1059572 - Part 0: Fuzz test for timers. r=nfroyd (7b03728aa4)
- Bug 1059572 - Part 0.5: Fixes for pre-existing problems in TestTimers. r=nfroyd (e463afc995)
- Bug 1059572 - Part 1: Move PostTimerEvent to TimerThread to allow TimerThread's monitor to protect it. r=nfroyd (5e56ce272a)
- Bug 1059572 - Part 2: Make absolutely sure a timer is removed before reinitting it. r=nfroyd (7d916a9aa9)
- Bug 1190735 - Remove nsITimer.TYPE_REPEATING_PRECISE. r=froydnj. (34f7e4c02e)
- Bug 1203427 (part 5) - Add logging of timer firings. r=froydnj. (664954eef7)

accessible/html/HTMLTableAccessible.cpp

@@ -147,8 +147,9 @@ GroupPos
 HTMLTableCellAccessible::GroupPosition()
 {
   int32_t count = 0, index = 0;
-  if (nsCoreUtils::GetUIntAttr(Table()->AsAccessible()->GetContent(),
-                               nsGkAtoms::aria_colcount, &count) &&
+  TableAccessible* table = Table();
+  if (table && nsCoreUtils::GetUIntAttr(table->AsAccessible()->GetContent(),
+                                        nsGkAtoms::aria_colcount, &count) &&
       nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_colindex, &index)) {
     return GroupPos(0, index, count);
   }
@@ -312,46 +313,43 @@ HTMLTableHeaderCellAccessible::NativeRole()
 {
   // Check value of @scope attribute.
   static nsIContent::AttrValuesArray scopeValues[] =
-    {&nsGkAtoms::col, &nsGkAtoms::row, nullptr};
+    { &nsGkAtoms::col, &nsGkAtoms::colgroup,
+      &nsGkAtoms::row, &nsGkAtoms::rowgroup, nullptr };
   int32_t valueIdx =
     mContent->FindAttrValueIn(kNameSpaceID_None, nsGkAtoms::scope,
                               scopeValues, eCaseMatters);
 
   switch (valueIdx) {
     case 0:
-      return roles::COLUMNHEADER;
     case 1:
+      return roles::COLUMNHEADER;
+    case 2:
+    case 3:
       return roles::ROWHEADER;
   }
 
-  // Assume it's columnheader if there are headers in siblings, otherwise
-  // rowheader.
-  // This should iterate the flattened tree
-  nsIContent* parentContent = mContent->GetParent();
-  if (!parentContent) {
-    NS_ERROR("Deattached content on alive accessible?");
+  TableAccessible* table = Table();
+  if (!table)
     return roles::NOTHING;
-  }
 
-  for (nsIContent* siblingContent = mContent->GetPreviousSibling(); siblingContent;
-       siblingContent = siblingContent->GetPreviousSibling()) {
-    if (siblingContent->IsElement()) {
-      return nsCoreUtils::IsHTMLTableHeader(siblingContent) ?
-        roles::COLUMNHEADER : roles::ROWHEADER;
-    }
-  }
+  // If the cell next to this one is not a header cell then assume this cell is
+  // a row header for it.
+  uint32_t rowIdx = RowIdx(), colIdx = ColIdx();
+  Accessible* cell = table->CellAt(rowIdx, colIdx + ColExtent());
+  if (cell && !nsCoreUtils::IsHTMLTableHeader(cell->GetContent()))
+    return roles::ROWHEADER;
 
-  for (nsIContent* siblingContent = mContent->GetNextSibling(); siblingContent;
-       siblingContent = siblingContent->GetNextSibling()) {
-    if (siblingContent->IsElement()) {
-      return nsCoreUtils::IsHTMLTableHeader(siblingContent) ?
-       roles::COLUMNHEADER : roles::ROWHEADER;
-    }
-  }
+  // If the cell below this one is not a header cell then assume this cell is
+  // a column header for it.
+  uint32_t rowExtent = RowExtent();
+  cell = table->CellAt(rowIdx + rowExtent, colIdx);
+  if (cell && !nsCoreUtils::IsHTMLTableHeader(cell->GetContent()))
+    return roles::COLUMNHEADER;
 
-  // No elements in siblings what means the table has one column only. Therefore
-  // it should be column header.
-  return roles::COLUMNHEADER;
+  // Otherwise if this cell is surrounded by header cells only then make a guess
+  // based on its cell spanning. In other words if it is row spanned then assume
+  // it's a row header, otherwise it's a column header.
+  return rowExtent > 1 ? roles::ROWHEADER : roles::COLUMNHEADER;
 }
 
 
@@ -376,8 +374,9 @@ GroupPos
 HTMLTableRowAccessible::GroupPosition()
 {
   int32_t count = 0, index = 0;
-  if (nsCoreUtils::GetUIntAttr(nsAccUtils::TableFor(this)->GetContent(),
-                               nsGkAtoms::aria_rowcount, &count) &&
+  Accessible* table = nsAccUtils::TableFor(this);
+  if (table && nsCoreUtils::GetUIntAttr(table->GetContent(),
+                                        nsGkAtoms::aria_rowcount, &count) &&
       nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_rowindex, &index)) {
     return GroupPos(0, index, count);
   }