import changes from `dev' branch of rmottola/Arctic-Fox:

- bit of Bug 1219134: P2. Use LibAV/FFmpeg logic to detect invalid pts. r=edwin (34d2a7d442)
- Bug 1195018 - Support 'background_color' member in the manifest processor. r=marcosc (1451b14321)
- Bug 1240490 - Fix console prefix used by the App Manifest processor. r=marcosc (e3196b53c8)
- Bug 1086997 - Localize developer warnings issued by the manifest processor. r=baku (7659fc5dd6)
- Bug 1258899 - teach manifest processor about dir member. r=baku (00b40c51c2)
- Bug 1262739 - Remove support for splash_screens member in Manifest Processor r=mconley (bceb0d2517)
- Bug 1264813 - Remove image object's density member from Web Manifest processor. r=mconley (f34da7259e)
- Bug 1264816 - Drop background_color from Web manifest image object. r=mconley (40c55f7bf9)
- Bug 1186908 - Return manifest members to canonical form after processing. r=mconley. (59d9a12a17)
- Bug 293394 - javascript: should never execute with chrome privs. r=bz (0dcc8f146b)
- bit of Bug 1153267 - part 2 (a0c5f7fda8)
- Bug 1254320 - Remove SEC_NORMAL from dom/json/ . r=bz (cd068db51c)
- Bug 1262590 - [e10s] AppProcessChecker.cpp has DEUBG typo preventing DEBUG messages. r=mconley (f9ffab4e57)
- Bug 1263556 - Remove EmptyBlobImpl in dom/ipc/Blob.cpp, r=smaug (3f4fe63e05)
- Bug 1261072 - File::GetName() should be const, r=smaug (bccd7475f1)
- Bug 1257759 part.1 Use switch-case at the first message handling in PluginInstanceChild::PluginWindowProcInternal() r=m_kato (bc0d4c457e)
- Bug 1257759 part.2 Separate Windows' message and related definitions from nsWindowDefs.h to mozilla/widget/WinMessages.h r=jimm (f8b5cb62f8)
- Bug 1153829 - Don't use MOZ_ALWAYS_INLINE for non-inline functions. r=jimm (c0e5b26c35)
- Bug 1257759 part.3 ModifierKeyState should be available in plugin module r=jimm (aa3fc81f63)
- Bug 1257759 part.4 Rename WidgetGUIEvent::PluginEvent to NativeEventData for using this class to send native event from plugin process to content and/or chrome process r=smaug (49392203ad)
- Bug 1255968 - Part 1: Let the callback of PeekMessages() to return a boolean to be able to break out the loop. r=dvander (d7f926ee7e)
- Bug 1255968 - Part 2: Implement puppet widget's HasPendingInputEvent() for interruptible reflow to work in content process. r=bz (5a0915e650)
- Bug 1257759 part.5 PluginInstanceChild should post received native key event to chrome process if the key combination may be a shortcut key r=jimm (ad1e3ad1c0)
- Bug 1252152 - Make plugin instances destroyed while that instance is on the stack crash earlier and more usefully, r=jimm (2238cc2a79)
- Bug 1257759 part.6 Keep event order between keyboard events and IME events in a plugin process r=jimm (32cbe1b13e)
- Bug 1257759 part.7 Add new internal events which represent key events on plugin r=smaug (161725755a)
- Bug 1257759 part.8 nsXBLWindowKeyHandler should handle eKeyDownOnPlugin and eKeyUpOnPlugin events only with reserved shortcut key handlers r=smaug (aa7cd1d786)
- Bug 1257759 part.9 Implement nsWindow::OnKeyEventInPluginProcess() on Windows r=jimm (245b2709e4)
- Bug 1257759 part.10 PluginInstanceChild should consume WM_*CHAR messages which follow consumed WM_*KEYDOWN or WM_*KEYUP message r=jimm (db355e6a77)
- Bug 1261735 (part 1) - Overhaul the atom implementation. r=froydnj,erahm. (abbed483f7)
- Bug 1261735 (part 2) - Inline some {Dynamic,Static}Atom methods. r=erahm. (97b11fa656)
- Bug 1261735 (part 3) - De-virtualize nsIAtom::IsStaticAtom(). r=froydnj,erahm. (4e0465a84a)
- Bug 1257207 - Increase ATOM_HASHTABLE_INITIAL_LENGTH. r=froydnj. (fe663e9c77)
- Bug 1261735 (part 4) - Change StaticAtomEntry::mAtom to |StaticAtom*|. r=erahm. (999fff7b8c)
- Bug 1261744 - Add two missing null checks for nsStringBuffer::Alloc(). r=erahm. (dd9ef00b6a)
- Bug 1266295 - Remove unnecessary compiler version checks for gcc <= 4.8.0 in xpcom. r=froydnj (b2f17f8d1a)
- Bug 1259706: Add NS_INLINE_DECL_THREADSAFE_VIRTUAL_REFCOUNTING macro. r=froydnj (d56a5fd48b)
- just a space (1508ec768f)
- Bug 1236991 - part 1: allow forwarding label direction through nsITooltipTextProvider, r=enndeakin (8d49127ffa)
- Bug 1245649: Enable no-nested-ternary. r=mconley (43c7b99372)
- Bug 1236991 - part 2: implement a default tooltiptextprovider in toolkit, r=enndeakin (a0a378979f)
- Bug 1251032 - Send RenderFrame info down to child in BrowserFrameOpenWindow. r=kanru (aec01fcec9)
- Bug 1246327 - Remove dom.always_allow_move_resize_window preference. r=jst (d06d83d596)
- Bug 1158228 - merge github's readability code into m-c, rs=me (38da823ce7)
- Bug 1158184 - merge recent github readability changes into m-c, rs=me (3b634d63c8)
- Bug 1162917 - update readability from github repo, rs=me (29dd18a9f0)
- No bug - update readability from github repo, includes fix for bug 1230050, rs=uplift-with-r+-patches-from-github (fa04927c71)
- Bug 1265866 - update Readability to the latest version from github, rs=me (c89e4dbeac)
- bits of Bug 1158228 (950dd3d561)
- Bug 1249579 - part2 : audio competing suspend/resume methods. r=snorp, baku. (3b6ddc018d)
- Bug 1266221 P1 Get devtools http service worker testing option from top window. r=bz (e8492118f0)
- Bug 225910 - Use nsIURI's GetRef and GetHasRef in nsDocShell. r=bz (76da6473d4)
- Bug 1261471: Remove support for getting mozIDOMWindowProxy via GetInterface. r=mrbkap (04904ed142)
- Bug 1264725 - Isolate Troubleshoot.jsm (about:support) from addons with null names. r=felipe (4ebb240827)
- Bug 1227730 - Support closing libnotify alerts. r=karlt,MattN (73d8b583dc)

docshell/base/nsDocShell.cpp

@@ -10028,31 +10028,44 @@ nsDocShell::InternalLoad2(nsIURI* aURI,
       aLoadType == LOAD_HISTORY ||
       aLoadType == LOAD_LINK) {
     nsCOMPtr<nsIURI> currentURI = mCurrentURI;
-    // Split currentURI and aURI on the '#' character.  Make sure we read
-    // the return values of SplitURIAtHash; if it fails, we don't want to
-    // allow a short-circuited navigation.
-    nsAutoCString curBeforeHash, curHash, newBeforeHash, newHash;
-    nsresult splitRv1, splitRv2;
-    splitRv1 = currentURI ?
-      nsContentUtils::SplitURIAtHash(currentURI, curBeforeHash, curHash) :
-      NS_ERROR_FAILURE;
-    splitRv2 = nsContentUtils::SplitURIAtHash(aURI, newBeforeHash, newHash);
 
-    bool sameExceptHashes = NS_SUCCEEDED(splitRv1) &&
-                            NS_SUCCEEDED(splitRv2) &&
-                            curBeforeHash.Equals(newBeforeHash);
+    nsAutoCString curHash, newHash;
+    bool curURIHasRef = false, newURIHasRef = false;
+
+    nsresult rvURINew = aURI->GetRef(newHash);
+    if (NS_SUCCEEDED(rvURINew)) {
+      rvURINew = aURI->GetHasRef(&newURIHasRef);
+    }
+
+    bool sameExceptHashes = false;
+    if (currentURI && NS_SUCCEEDED(rvURINew)) {
+      nsresult rvURIOld = currentURI->GetRef(curHash);
+      if (NS_SUCCEEDED(rvURIOld)) {
+        rvURIOld = currentURI->GetHasRef(&curURIHasRef);
+      }
+      if (NS_SUCCEEDED(rvURIOld)) {
+        if (NS_FAILED(currentURI->EqualsExceptRef(aURI, &sameExceptHashes))) {
+          sameExceptHashes = false;
+        }
+      }
+    }
 
     if (!sameExceptHashes && sURIFixup && currentURI &&
-        NS_SUCCEEDED(splitRv2)) {
+        NS_SUCCEEDED(rvURINew)) {
       // Maybe aURI came from the exposable form of currentURI?
       nsCOMPtr<nsIURI> currentExposableURI;
       rv = sURIFixup->CreateExposableURI(currentURI,
                                          getter_AddRefs(currentExposableURI));
       NS_ENSURE_SUCCESS(rv, rv);
-      splitRv1 = nsContentUtils::SplitURIAtHash(currentExposableURI,
-                                                curBeforeHash, curHash);
-      sameExceptHashes =
-        NS_SUCCEEDED(splitRv1) && curBeforeHash.Equals(newBeforeHash);
+      nsresult rvURIOld = currentExposableURI->GetRef(curHash);
+      if (NS_SUCCEEDED(rvURIOld)) {
+        rvURIOld = currentExposableURI->GetHasRef(&curURIHasRef);
+      }
+      if (NS_SUCCEEDED(rvURIOld)) {
+        if (NS_FAILED(currentExposableURI->EqualsExceptRef(aURI, &sameExceptHashes))) {
+          sameExceptHashes = false;
+        }
+      }
     }
 
     bool historyNavBetweenSameDoc = false;
@@ -10088,7 +10101,7 @@ nsDocShell::InternalLoad2(nsIURI* aURI,
     bool doShortCircuitedLoad =
       (historyNavBetweenSameDoc && mOSHE != aSHEntry) ||
       (!aSHEntry && !aPostData &&
-       sameExceptHashes && !newHash.IsEmpty());
+       sameExceptHashes && newURIHasRef);
 
     if (doShortCircuitedLoad) {
       // Save the position of the scrollers.
@@ -10243,7 +10256,7 @@ nsDocShell::InternalLoad2(nsIURI* aURI,
       // arguments it receives.  But even if we don't end up scrolling,
       // ScrollToAnchor performs other important tasks, such as informing
       // the presShell that we have a new hash.  See bug 680257.
-      rv = ScrollToAnchor(curHash, newHash, aLoadType);
+      rv = ScrollToAnchor(curURIHasRef, newURIHasRef, newHash, aLoadType);
       NS_ENSURE_SUCCESS(rv, rv);
 
       /* restore previous position of scroller(s), if we're moving
@@ -10266,7 +10279,8 @@ nsDocShell::InternalLoad2(nsIURI* aURI,
       // reference to avoid null derefs. See bug 914521.
       if (win) {
         // Fire a hashchange event URIs differ, and only in their hashes.
-        bool doHashchange = sameExceptHashes && !curHash.Equals(newHash);
+        bool doHashchange = sameExceptHashes &&
+                            (curURIHasRef != newURIHasRef || !curHash.Equals(newHash));
 
         if (historyNavBetweenSameDoc || doHashchange) {
           win->DispatchSyncPopState();
@@ -11151,8 +11165,8 @@ nsDocShell::DoChannelLoad(nsIChannel* aChannel,
 }
 
 nsresult
-nsDocShell::ScrollToAnchor(nsACString& aCurHash, nsACString& aNewHash,
-                           uint32_t aLoadType)
+nsDocShell::ScrollToAnchor(bool aCurHasRef, bool aNewHasRef,
+                           nsACString& aNewHash, uint32_t aLoadType)
 {
   if (!mCurrentURI) {
     return NS_OK;
@@ -11174,25 +11188,20 @@ nsDocShell::ScrollToAnchor(nsACString& aCurHash, nsACString& aNewHash,
   // current anchor and we are doing a history load.  So return if we have no
   // new anchor, and there is no current anchor or the load is not a history
   // load.
-  if ((aCurHash.IsEmpty() || aLoadType != LOAD_HISTORY) &&
-      aNewHash.IsEmpty()) {
+  if ((!aCurHasRef || aLoadType != LOAD_HISTORY) && !aNewHasRef) {
     return NS_OK;
   }
 
-  // Take the '#' off aNewHash to get the ref name.  (aNewHash might be empty,
-  // but that's fine.)
-  nsDependentCSubstring newHashName(aNewHash, 1);
-
   // Both the new and current URIs refer to the same page. We can now
   // browse to the hash stored in the new URI.
 
-  if (!newHashName.IsEmpty()) {
+  if (!aNewHash.IsEmpty()) {
     // anchor is there, but if it's a load from history,
     // we don't have any anchor jumping to do
     bool scroll = aLoadType != LOAD_HISTORY &&
                   aLoadType != LOAD_RELOAD_NORMAL;
 
-    char* str = ToNewCString(newHashName);
+    char* str = ToNewCString(aNewHash);
     if (!str) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
@@ -11234,7 +11243,7 @@ nsDocShell::ScrollToAnchor(nsACString& aCurHash, nsACString& aNewHash,
       nsXPIDLString uStr;
 
       rv = textToSubURI->UnEscapeAndConvert(PromiseFlatCString(aCharset).get(),
-                                            PromiseFlatCString(newHashName).get(),
+                                            PromiseFlatCString(aNewHash).get(),
                                             getter_Copies(uStr));
       NS_ENSURE_SUCCESS(rv, rv);
 
@@ -11244,7 +11253,7 @@ nsDocShell::ScrollToAnchor(nsACString& aCurHash, nsACString& aNewHash,
       // with the new URI no matter whether we actually scrolled
       // somewhere).
       //
-      // When newHashName contains "%00", unescaped string may be empty.
+      // When aNewHash contains "%00", unescaped string may be empty.
       // And GoToAnchor asserts if we ask it to scroll to an empty ref.
       shell->GoToAnchor(uStr, scroll && !uStr.IsEmpty(),
                         nsIPresShell::SCROLL_SMOOTH_AUTO);