import changes from `dev' branch of rmottola/Arctic-Fox:

- test part of Bug 789788 - Revise the don't-use-document-fonts option (1b6a0e6ed)
- Bug 1172782 - Change how nsTHashtable::Clear() works. r=froydnj. (c8c2adc51)
- Bug 1180072 - Remove PL_DHashTableEnumerate(). r=froydnj. (b5448efda)
- Bug 1180122 - Make Chaos Mode affect PLDHashTable's iterators. r=froydnj. (11fd0e222)
- Bug 1182516 - Add Chaos Mode environment variable MOZ_CHAOSMODE. r=roc (d636f6c90)
- Bug 1182516 - Fix mid-air conflict with 3fd2ab6cb762 on a CLOSED TREE. r=bustage (8dec46b7a)
- Bug 1184280 - Remove warning about mDisabledJSAndPlugins being false. r=ehsan (c23e96fc1)
- Bug 1181411 - Test some expected aborts in PLDHashTable. r=glandium. (682788df7)
- Bug 1185399 (part 1) - Remove macros from pldhash.h. r=froydnj. (15001ff2a)
- Bug 1185399 (part 2) - Remove macros from pldhash.cpp. r=froydnj. (afeddcc90)
- Bug 1187197 (part 1) - Move comments from PL_DHashTable* functions to the equivalent methods. r=froydnj. (78921590e)
- Bug 1187197 (part 2) - Put function return types on their own line. r=froydnj. (9aae02f83)
- Bug 1187197 (part 3) - Convert pldhash.{cpp,h} to C++ style comments. r=froydnj. (57afe7e1f)
- Bug 1202526 (part 1) - Add PLDHashTable::RemoveEntry(). r=froydnj. (1b5453695)
- Bug 1202526 (part 2) - Avoid PL_DHashTableRawRemove() in nsLoadGroup. r=mcmanus. (1ad20b17f)
- Bug 1202526 (part 3) - Avoid PL_DHashTableRawRemove() in nsDocument. r=bz. (cdde6eff0)
- Bug 1202526 (part 4) - Avoid PL_DHashTableRawRemove() in nsPropertyTable. r=bz. (ed437f4d6)
- Bug 1202526 (part 5) - Use PLDHashTable::RemoveEntry() in nsSecureBrowserUIImpl. r=dkeeler. (ac1d44066)
- Bug 1202526 (part 6) - Use PLDHashTable::RemoveEntry() in XULDocument. r=bz. (2639a053e)
- Bug 1202526 (part 7) - Use PLDHashTable::RemoveEntry() in prefs code. r=bz. (2eb3b1097)
- Bug 1202526 (part 8) - Use PLDHashTable::RemoveEntry() in the cycle collector. r=mccr8. (ec77d7635)
- Bug 1130096 - Convert embedding/components/commandhandler/ to Gecko style. r=mccr8 (a5aecf9de)
- Bug 1184842. Remove layout.frames.force_resizability pref. r=mats (9226b0caf)
- Bug 1184842. Remove frameset mVisibilityOverride since it's always false now. r=mats (1b439feb8)
- Bug 1184842. Change nsAttrAndChildArray::SetAndTakeAttr to nsAttrAndChildArray::SetAndSwapAttr. r=peterv (1442f0eae)
- Bug 1184842. Make SetAttrAndNotify use the real old value instead of aOldValue when possible. r=bz (bc45970f5)
- Bug 1184842. Add aOldValue parameter to nsNodeUtils::AttributeChanged. r=peterv (31bf8c08e)
- Bug 1184842. Pass aOldValue to all mutation observers. r=peterv (e69daf7f7)
- Bug 1184842. Allow BeforeSetAttr to preparse aValue. r=peterv (9c51655de)
- follow up fix to Bug 1184842. Allow BeforeSetAttr to preparse aValue (fb997a066)
- Bug 1149042 - Call AttributeWillChange before a style="" attribute gets created when touching element.style. r=smaug (41f2ea361)
- Bug 1184842. Pass preparsed attribute values to nsNodeUtils::AttributeWillChange. r=peterv (646622252)
- Bug 1013743, MutationObserver should observe only the subtree it is attached to, r=wchen (ad606eb15)
- Bug 1184842. Add aNewValue to nsIMutationObserver::AttributeWillChange. r=peterv (796042972)
- Bug 1184842. Preparse class attribute values in Element::BeforeSetAttr. r=peterv (e18989b2b)
- Bug 1154149 - Remove nsPresContext arguments from a bunch of nsStyleSBug 1154149 - Remove nsPresContext arguments from a bunch of nsStyleS (b7797ef66)
- Bug 1184842. Route aOldValue/aNewValue to AttributeData. r=heycam (14489941b)
- Bug 1184842. Restyling should consider only the classes that have changed. r=heycam (5a5e670dc)
- Bug 1121760 (part 1) - Remove PL_DHashTableSearch(). r=poiru. (d92813655)

dom/base/nsDOMMutationObserver.cpp

@@ -64,6 +64,13 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsDOMMutationRecord,
 
 // Observer
 
+bool
+nsMutationReceiverBase::IsObservable(nsIContent* aContent)
+{
+  return !aContent->ChromeOnlyAccess() &&
+    (Observer()->IsChrome() || !aContent->IsInAnonymousSubtree());
+}
+
 NS_IMPL_ADDREF(nsMutationReceiver)
 NS_IMPL_RELEASE(nsMutationReceiver)
 
@@ -108,11 +115,11 @@ nsMutationReceiver::AttributeWillChange(nsIDocument* aDocument,
                                         mozilla::dom::Element* aElement,
                                         int32_t aNameSpaceID,
                                         nsIAtom* aAttribute,
-                                        int32_t aModType)
+                                        int32_t aModType,
+                                        const nsAttrValue* aNewValue)
 {
   if (nsAutoMutationBatch::IsBatching() ||
-      !ObservesAttr(aElement, aNameSpaceID, aAttribute) ||
-      aElement->ChromeOnlyAccess()) {
+      !ObservesAttr(RegisterTarget(), aElement, aNameSpaceID, aAttribute)) {
     return;
   }
 
@@ -147,14 +154,16 @@ nsMutationReceiver::CharacterDataWillChange(nsIDocument *aDocument,
                                             CharacterDataChangeInfo* aInfo)
 {
   if (nsAutoMutationBatch::IsBatching() ||
-      !CharacterData() || !(Subtree() || aContent == Target()) ||
-      aContent->ChromeOnlyAccess()) {
+      !CharacterData() ||
+      (!Subtree() && aContent != Target()) ||
+      (Subtree() && RegisterTarget()->SubtreeRoot() != aContent->SubtreeRoot()) ||
+      !IsObservable(aContent)) {
     return;
   }
-  
+
   nsDOMMutationRecord* m =
     Observer()->CurrentRecord(nsGkAtoms::characterData);
- 
+
   NS_ASSERTION(!m->mTarget || m->mTarget == aContent,
                "Wrong target!");
 
@@ -173,8 +182,11 @@ nsMutationReceiver::ContentAppended(nsIDocument* aDocument,
                                     int32_t aNewIndexInContainer)
 {
   nsINode* parent = NODE_FROM(aContainer, aDocument);
-  bool wantsChildList = ChildList() && (Subtree() || parent == Target());
-  if (!wantsChildList || aFirstNewContent->ChromeOnlyAccess()) {
+  bool wantsChildList =
+    ChildList() &&
+    ((Subtree() && RegisterTarget()->SubtreeRoot() == parent->SubtreeRoot()) ||
+     parent == Target());
+  if (!wantsChildList || !IsObservable(aFirstNewContent)) {
     return;
   }
 
@@ -211,8 +223,11 @@ nsMutationReceiver::ContentInserted(nsIDocument* aDocument,
                                     int32_t aIndexInContainer)
 {
   nsINode* parent = NODE_FROM(aContainer, aDocument);
-  bool wantsChildList = ChildList() && (Subtree() || parent == Target());
-  if (!wantsChildList || aChild->ChromeOnlyAccess()) {
+  bool wantsChildList =
+    ChildList() &&
+    ((Subtree() && RegisterTarget()->SubtreeRoot() == parent->SubtreeRoot()) ||
+     parent == Target());
+  if (!wantsChildList || !IsObservable(aChild)) {
     return;
   }
 
@@ -243,11 +258,14 @@ nsMutationReceiver::ContentRemoved(nsIDocument* aDocument,
                                    int32_t aIndexInContainer,
                                    nsIContent* aPreviousSibling)
 {
-  if (aChild->ChromeOnlyAccess()) {
+  if (!IsObservable(aChild)) {
     return;
   }
 
   nsINode* parent = NODE_FROM(aContainer, aDocument);
+  if (Subtree() && parent->SubtreeRoot() != RegisterTarget()->SubtreeRoot()) {
+    return;
+  }
   if (nsAutoMutationBatch::IsBatching()) {
     if (nsAutoMutationBatch::IsRemovalDone()) {
       // This can happen for example if HTML parser parses to
@@ -265,7 +283,7 @@ nsMutationReceiver::ContentRemoved(nsIDocument* aDocument,
     }
 
     return;
-  }                                                                   
+  }
 
   if (Subtree()) {
     // Try to avoid creating transient observer if the node
@@ -719,8 +737,9 @@ nsDOMMutationObserver::Constructor(const mozilla::dom::GlobalObject& aGlobal,
     return nullptr;
   }
   MOZ_ASSERT(window->IsInnerWindow());
+  bool isChrome = nsContentUtils::IsChromeDoc(window->GetExtantDoc());
   nsRefPtr<nsDOMMutationObserver> observer =
-    new nsDOMMutationObserver(window.forget(), aCb);
+    new nsDOMMutationObserver(window.forget(), aCb, isChrome);
   return observer.forget();
 }