Bug 840739 - Make opening a new URI respect the privacy status of the opener. r=gavin a=lsblakk
Bug 842015 - Avoid modifying the root docshell's privacy status when we aren't opening a new toplevel window. r=bz a=lsblakk
Bug 803870 - Compare the subject with the outer window for History. r=bz, a=lsblakk
Bug 842305 - Don't try to cleanup values in global frames and watch for null payloads flowing into Ion. r=jandem, a=lsblakk
Bug 843827 - Makefile entry missing on MDPI phone. r=mfinkle, a=lsblakk
Bug 829927 - Don't read favicon URL if it's null. r=mfinkle, a=lsblakk
Bug 842561 - Assert that our inheritance chain is correct for WebIDL objects. r=peterv, a=lsblakk

We could drop the descriptor for Text if we changed nsIDocument::CreateTextNode
to return an already_AddRefed<Text>, but then we'd need more casting in
nsDocument.cpp for the XPCOM CreateTextNode.  Not sure which way is better,
really.
Bug 816498 - Fix some things about background attribute handling that are still broken. r=bz, a=lsblakk

As filed the bug is about table backgrounds failing to print.  The root cause of this is that we load images from the original document, because print/print-preview documents (which are static clones of the original) cannot do loads.  This results in an entry in the css::ImageValue's request table under the original document, but entry under the printing document.  Then we do layout, try to get the request, and fail, and nothing is displayed.  The solution to this is to force us to clone the request for the printing document if we're loading off the original document.  I manually verified that this does not regress Bug 560235.

While writing a test for this, we discovered another problem.  The reftest print code does not actually use the printing codepath.  Instead it takes an existing document, tears down its presshell, and creates a new presshell for printing.  Fixing the above bug did not make the reftest print test pass because ImageLoader does not deal properly with presshell destruction/recreation.  It assumes that when the presshell is destroyed all of the css::ImageValues can be cleared of their entries for that document.  This fails for ImageValues for mapped attributes because they are held alive by the content tree.  When a new presshell for this document is then created there is no entry for the document and thus no image request to paint.  The fix for this is to only clear the frame to request and request to frame mapping hashtables and not to clear the document's entry on the ImageValue when the presshell is destroyed.  The destruction of the ImageLoader (which is held from a strong reference on the document) is when those entries are removed.  The final change is to change css::ImageValue's hashtable from holding a strong reference to the keys (which are documents) to holding raw pointer references.  This is safe because we clear the relevant entry when the corresponding ImageLoader dies, and is needed to prevent a reference cycle that was being broken by presshell destruction.

--HG--
rename : layout/reftests/backgrounds/table-background-ref.html => layout/reftests/backgrounds/table-background-print-ref.html
rename : layout/reftests/backgrounds/table-background.html => layout/reftests/backgrounds/table-background-print.html
Backed out changeset e485a12e27ae (bug 842561) for bustage. a=backout