import changes from `dev' branch of rmottola/Arctic-Fox:

- remove some hacks (5a020c69f1)
- fix misspatch in 1188129 (3f533c3b35)
- pointer style (c001547d31)
- No bug - Fix typo in MissingScopeKey comment. No review. (bdddaf5243)
- pointer style (d29bf7eddc)
- Bug 1201051 - Add ObjectWeakMap::init() rather than crashing in constructor on OOM r=terrence (632b865197)
- Bug 1193039 - Fix assertion failure related to ObjectValueMap and OOM r=terrence (7110da6cee)
- pointer style and spaces (30193d1c6b)
- Bug 1205255 - Force inline and use relaxed atomic. r=terrence (c14013330f)
- Bug 1206300 - Allow immutable prototypes to be disabled at compile time with a single-line change, but don't actually disable them. r=jorendorff (f61ff0c6ab)
- Bug 1195058 - Handle pa_context_new returning NULL in OOM situations. r=padenot (93c2acd8c9)
- Bug 1144087 - "Audio glitches on OpenBSD caused by rounding errors." r=kinetik (ff963727a9)
- apply/partially revert to   Bug 979705 - Re-write the upmixing functions in the WASAPI cubeb backend to fix mono audio and surround compatibility. r=padenot (9dda58fe7f)
- Bug 1195061 - Correctly restore audio hardware mix format after attempting to use an alternative format. r=padenot (c971f0f27a)
- Bug 1197049 - Retain stream volume across device changes. r=padenot (c8631d230b)
- Bug 1199794 - Add NULL checks to avoid crashing during media playback if the audio device removed. r=padenot (2f70698942)
- Bug 1204913 - IonMonkey: MIPS32: Fix build erros in defineSinCos. r=sunfish (70235d955b)
- fix misspatch and pointer style (6d732302ae)
- Missing bit of Bug 1141121 (3ba5331859)
- Bug 1176288 - Part 3: Rename CompareV to CompareBitwise, r=jandem (790ee9496d)
- pointer style (ec9e8c4c35)
- Bug 1135047 - IonMonkey: Fix range before bailouts of MToInt32, r=nbp,sunfish (c6732433d0)
- Bug 1105574 - Range Analysis: Keep folded bitwise instructions alive for bailouts. r=sunfish (5e31e0f772)
- Bug 1135047 - IonMonkey: Use output range when taking range from operands, r=nbp,sunfish (67d297dbae)
- Bug 1201459: IonMonkey - Fix typepolicy of MFilterTypeSet with MIRType_Float32, r=bbouvier,nbp (9c25aa23e1)
- Bug 1204073 - Optimize GETELEM with constant string-or-symbol index better in Ion. r=bhackett (9d8acd6d87)
- pointer style (3d06794b72)
- misspatch (88b8faeda5)
- Bug 1187511 - IonMonkey: Refine type sets for unbox operations based on unbox type r=jandem (42effad799)
- Bug 1188586 - Temporarily disable recovery of MPow to unblock fuzzers. (rs=jandem) (322fa7267c)
- Bug 1186424: Get rid of the tokenStream in the ModuleCompiler; r=luke (736c957b1a)
- Bug 1186424: Remove usage of ExclusiveContext from the ModuleCompiler; r=luke (502be345de)
- Bug 1186424: Remove perf blocks annotations in OdinMonkey; r=luke (cedf212c9c)
- pointer style (746fb0ec36)
- Bug 1199719 werr.2 - Remove some of the uninitialized variable noise. r=bbouvier (07cde27868)
- code style (30fb139d82)
- Bug 1146895 - Remove redundant __asan_default_options from JS shell. r=jandem (da2b735b57)
- Bug 1176240: IonMonkey: Try to fold phis containing MFilterTypeSet, r=nbp (eea905a46f)
- pointer style (406a7024db)
- Bug 1181142 - Part 2: Make the minimum jemalloc4 allocation size 16 bytes on Windows 64. r=glandium (a7838e7b97)
- Bug 1176313. Reland the changes to make Attr handling follow the spec again. This is a relanding of bug 1075702, effectively. r=smaug (958248e30d)
- Bug 1205424 - Use swap instead of NS_RELEASE in UnbindFromTree. r=baku (b2be0ec231)
- bug 1171072 - make libcubeb build on iOS. r=kinetik (0edfad1a4a)

dom/base/nsDOMAttributeMap.cpp

@@ -306,8 +306,7 @@ nsDOMAttributeMap::SetNamedItemInternal(Attr& aAttr,
     nsAutoString name;
     aAttr.GetName(name);
     oldNi = mContent->GetExistingAttrNameFromQName(name);
-  }
-  else {
+  } else {
     uint32_t i, count = mContent->GetAttrCount();
     for (i = 0; i < count; ++i) {
       const nsAttrName* name = mContent->GetAttrNameAt(i);
@@ -337,6 +336,25 @@ nsDOMAttributeMap::SetNamedItemInternal(Attr& aAttr,
       attr = RemoveNamedItem(oldNi, aError);
       NS_ASSERTION(attr->NodeInfo()->NameAndNamespaceEquals(oldNi),
         "RemoveNamedItem() called, attr->NodeInfo() should be equal to oldNi!");
+
+      // That might have run mutation event listeners, so re-verify
+      // our assumptions.
+      nsDOMAttributeMap* newOwner = aAttr.GetMap();
+      if (newOwner) {
+        if (newOwner == this) {
+          // OK, we're just done here.
+          return attr.forget();
+        }
+
+        // The attr we're trying to set got stuck on some other
+        // element.  Just throw, for lack of anything better to do.
+        aError.Throw(NS_ERROR_DOM_INUSE_ATTRIBUTE_ERR);
+        return nullptr;
+      } else if (mContent->OwnerDoc() != aAttr.OwnerDoc()) {
+        // Got moved into a different document, boo.
+        aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
+        return nullptr;
+      }
     }
   }